# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 09.06.2019 09:41:14.928 Process: id = "1" image_name = "rruzcj.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rruzcj.exe" page_root = "0x4dac5000" os_pid = "0x97c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rruzcj.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x980 [0029.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x8b2dcd00, dwHighDateTime=0x1d51ea7)) [0029.874] GetCurrentProcessId () returned 0x97c [0029.874] GetCurrentThreadId () returned 0x980 [0029.874] GetTickCount () returned 0x186fa [0029.874] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=15012144872) returned 1 [0029.906] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rruzcj.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0029.906] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x5a0000 [0029.908] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0029.908] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.908] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.908] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.909] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.909] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.909] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.909] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.909] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.909] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.910] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0029.910] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x214) returned 0x5a07d0 [0029.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.910] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0029.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0029.910] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.910] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0029.911] GetCurrentThreadId () returned 0x980 [0029.911] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rruzcj.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0029.911] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5a09f0 [0029.911] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0029.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.911] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0029.911] SetHandleCount (uNumber=0x20) returned 0x20 [0029.911] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rruzcj.exe\" " [0029.911] GetEnvironmentStringsW () returned 0x5d4bf8* [0029.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0029.911] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x565) returned 0x5a11f8 [0029.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x5a11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0029.911] FreeEnvironmentStringsW (penv=0x5d4bf8) returned 1 [0029.911] GetLastError () returned 0x0 [0029.911] SetLastError (dwErrCode=0x0) [0029.911] GetLastError () returned 0x0 [0029.911] SetLastError (dwErrCode=0x0) [0029.911] GetLastError () returned 0x0 [0029.911] SetLastError (dwErrCode=0x0) [0029.911] GetACP () returned 0x4e4 [0029.911] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x220) returned 0x5a1768 [0029.911] GetLastError () returned 0x0 [0029.912] SetLastError (dwErrCode=0x0) [0029.912] IsValidCodePage (CodePage=0x4e4) returned 1 [0029.912] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0029.912] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0029.912] GetLastError () returned 0x0 [0029.912] SetLastError (dwErrCode=0x0) [0029.912] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.912] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0029.912] GetLastError () returned 0x0 [0029.912] SetLastError (dwErrCode=0x0) [0029.912] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā") returned 256 [0029.912] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0029.912] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa2\x24\x3f\xf5\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0029.912] GetLastError () returned 0x0 [0029.912] SetLastError (dwErrCode=0x0) [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā") returned 256 [0029.912] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0029.912] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螼￴빪@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0029.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa2\x24\x3f\xf5\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0029.912] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4294c8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rruzcj.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rruzcj.exe")) returned 0x30 [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.913] SetLastError (dwErrCode=0x0) [0029.913] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.914] GetLastError () returned 0x0 [0029.914] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.915] SetLastError (dwErrCode=0x0) [0029.915] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.916] SetLastError (dwErrCode=0x0) [0029.916] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x39) returned 0x5a1990 [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.917] SetLastError (dwErrCode=0x0) [0029.917] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.918] SetLastError (dwErrCode=0x0) [0029.918] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.919] GetLastError () returned 0x0 [0029.919] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.920] SetLastError (dwErrCode=0x0) [0029.920] GetLastError () returned 0x0 [0029.921] SetLastError (dwErrCode=0x0) [0029.921] GetLastError () returned 0x0 [0029.921] SetLastError (dwErrCode=0x0) [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x98) returned 0x5a19d8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1f) returned 0x5a1a78 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5a1aa0 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x37) returned 0x5a1ae0 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5a1b20 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x31) returned 0x5a1b68 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x17) returned 0x5a1ba8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5a1bc8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x14) returned 0x5a1bf8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xd) returned 0x5a1c18 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x25) returned 0x5a1c30 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x39) returned 0x5a1c60 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5a1ca8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x17) returned 0x5a1cc8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xe) returned 0x5a1ce8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x69) returned 0x5a1d00 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3e) returned 0x5a1d78 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1b) returned 0x5a1dc0 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1d) returned 0x5a1de8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5a1e10 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x12) returned 0x5a1e60 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5a1e80 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1b) returned 0x5a1ea0 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5a1ec8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x29) returned 0x5a1ef8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1e) returned 0x5a1f30 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x41) returned 0x5a1f58 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x17) returned 0x5a1fa8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xf) returned 0x5a1fc8 [0029.921] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x16) returned 0x5a1fe8 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5a2008 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x29) returned 0x5a2040 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x15) returned 0x5a2078 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1e) returned 0x5a2098 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5a20c0 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x12) returned 0x5a20f8 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5a2118 [0029.922] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x46) returned 0x5a2138 [0029.922] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5a11f8 | out: hHeap=0x5a0000) returned 1 [0029.923] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x80) returned 0x5a11f8 [0029.923] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x409897) returned 0x0 [0029.923] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5a11f8) returned 0x80 [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.924] SetLastError (dwErrCode=0x0) [0029.924] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.925] GetLastError () returned 0x0 [0029.925] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.926] SetLastError (dwErrCode=0x0) [0029.926] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.927] GetLastError () returned 0x0 [0029.927] SetLastError (dwErrCode=0x0) [0029.928] GetLastError () returned 0x0 [0029.928] SetLastError (dwErrCode=0x0) [0029.928] GetLastError () returned 0x0 [0029.928] SetLastError (dwErrCode=0x0) [0029.928] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.928] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.928] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.928] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.928] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.928] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.928] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0029.928] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.928] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.929] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.929] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.929] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.929] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.929] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.929] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.929] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.929] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.929] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.929] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.929] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.929] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.929] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.929] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.929] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.929] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.929] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.930] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.930] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.930] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.930] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.930] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.930] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.930] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.930] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.930] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.930] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.930] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.930] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.930] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.930] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.930] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.930] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.931] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.931] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.931] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.931] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.931] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.931] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.931] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.931] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.931] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.931] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.931] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.931] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.931] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.931] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.931] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.931] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.932] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.932] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.932] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.932] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.932] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.932] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.932] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.932] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.932] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.932] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.932] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.932] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.933] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.933] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.933] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.933] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.933] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.933] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.933] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.933] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.933] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.933] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.933] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.933] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.933] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.933] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.933] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.933] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.934] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.934] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.934] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.934] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.934] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.934] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.934] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.934] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.934] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.934] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.934] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.934] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.935] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.935] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.935] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.935] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.935] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.935] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.935] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.935] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.935] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.935] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.935] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.935] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.936] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.936] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.936] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.936] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.936] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.936] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.936] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.936] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.936] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.936] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.936] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.936] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.937] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.937] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.937] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.937] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.937] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.937] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.937] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.937] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.937] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.937] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.937] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.937] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.937] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.937] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.937] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.937] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.938] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.938] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.938] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.938] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.938] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.938] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.938] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.938] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.938] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.938] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.938] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.938] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.938] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.938] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.938] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.938] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.939] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.939] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.939] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.939] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.939] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.939] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.939] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.939] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.939] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.939] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.939] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.939] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.939] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.939] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.939] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.939] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.940] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.940] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.940] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.940] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.940] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.940] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.940] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.940] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.940] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.940] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.940] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.940] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.941] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.941] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.941] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.941] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.941] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.941] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.941] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.941] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.941] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.941] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.941] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.941] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.942] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.942] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.942] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.942] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.942] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.942] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.942] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.942] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.942] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.942] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.942] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.942] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.943] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.943] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.943] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.943] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.943] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.943] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.943] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.943] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.943] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.943] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.943] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.943] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.943] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.943] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.943] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.943] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.943] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.944] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.944] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.944] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.944] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.944] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.944] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.944] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.944] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.944] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.944] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.944] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.944] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.944] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.944] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.944] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.944] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.945] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.945] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.945] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.945] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.945] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.945] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.945] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.945] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.945] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.945] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.945] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.945] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.946] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.946] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.946] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.946] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.946] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.946] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.946] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.946] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.946] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.946] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.946] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.946] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.946] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.946] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.946] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.946] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.947] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.947] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.947] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.947] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.947] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.947] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.947] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.947] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.947] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.947] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.947] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.947] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.947] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.947] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.948] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.948] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.948] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.948] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.948] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.948] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.948] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.948] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.948] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.948] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.948] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.948] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.949] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.949] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.949] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.949] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.949] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.949] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.949] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.949] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.949] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.949] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.949] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.949] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.949] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.949] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.949] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.949] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.949] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.950] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.950] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.950] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.950] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.950] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.950] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.950] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.950] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.950] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.950] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.950] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.950] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.950] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.950] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.950] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.950] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.951] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.951] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.951] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.951] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.951] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.951] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.951] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.951] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.951] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.951] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.951] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.951] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.952] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.952] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.952] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.952] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.952] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.952] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.952] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.952] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.952] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.952] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.952] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.952] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.953] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.953] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.953] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.953] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.953] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.953] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.953] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.953] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.953] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.953] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.953] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.953] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.954] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.954] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.954] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.954] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.954] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.954] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.954] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.954] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.954] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.954] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.954] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.954] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.954] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.954] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.954] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.954] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.955] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.955] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.955] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.955] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.955] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.955] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.955] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.955] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.955] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.955] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.955] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.955] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.956] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.956] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.956] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.956] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.956] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.956] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.956] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.956] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.956] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.956] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.956] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.956] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.957] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.957] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.957] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.957] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.957] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.957] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.957] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.957] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.957] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.957] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.957] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.957] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.957] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.957] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.957] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.957] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.958] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.958] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.958] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.958] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.958] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.958] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.958] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.958] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.958] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.958] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.958] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.958] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.958] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.958] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.959] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.959] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.959] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.959] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.959] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.959] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.959] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.959] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.959] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.959] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.959] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.959] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.960] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.960] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.960] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.960] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.960] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.960] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.960] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.960] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.960] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.960] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.960] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.960] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.961] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.961] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.961] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.961] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.961] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.961] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.961] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.961] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.961] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.961] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.961] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.961] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.962] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.962] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.962] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.962] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.962] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.962] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.962] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.962] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.962] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.962] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.962] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.962] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.962] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.962] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.962] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.962] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.962] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.963] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.963] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.963] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.963] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.963] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.963] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.963] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.963] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.963] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.963] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.963] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.963] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.964] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.964] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.964] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.964] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.964] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.964] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.964] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.964] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.964] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.964] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.964] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.964] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.964] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.964] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.964] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.964] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.965] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.965] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.965] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.965] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.965] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.965] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.965] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.965] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.965] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.965] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.965] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.965] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.965] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.965] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.965] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.965] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.966] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.966] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.966] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.966] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.966] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.966] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.966] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.966] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.966] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.966] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.966] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.966] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.967] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.967] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.967] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.967] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.967] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.967] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.967] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.967] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.967] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.967] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.967] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.967] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.968] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.968] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.968] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.968] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.968] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.968] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.968] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.968] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.968] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.968] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.968] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.968] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.968] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.969] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.969] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.969] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.969] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.969] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.969] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.969] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.969] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.969] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.969] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.969] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.970] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.970] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.970] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.970] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.970] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.970] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.970] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.970] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.970] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.970] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.970] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.970] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.970] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.970] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.970] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.970] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.971] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.971] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.971] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.971] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.971] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.971] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.971] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.971] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.971] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.971] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.971] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.971] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.972] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.972] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.972] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.972] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.972] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.972] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.972] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.972] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.972] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.972] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.972] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.972] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.972] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.972] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.972] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.972] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.973] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.973] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.973] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.973] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.973] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.973] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.973] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.973] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.973] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.973] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.973] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.973] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.973] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.973] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.973] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.973] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.974] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.974] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.974] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.974] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.974] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.974] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.974] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.974] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.974] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.974] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.974] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.974] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.975] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.975] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.975] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.975] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.975] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.975] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.975] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.975] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.975] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.975] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.975] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.975] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.976] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.976] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.976] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.976] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.976] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.976] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.976] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.976] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.976] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.976] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.976] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.976] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.976] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.976] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.976] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.976] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.976] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.977] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.977] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.977] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.977] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.977] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.977] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.977] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.977] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.977] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.977] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.977] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.977] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.977] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.977] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.977] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.977] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.978] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.978] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.978] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.978] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.978] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.978] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.978] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.978] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.978] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.978] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0029.978] GetThreadTimes (in: hThread=0x0, lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728 | out: lpCreationTime=0x18f730, lpExitTime=0x18f720, lpKernelTime=0x18f718, lpUserTime=0x18f728) returned 0 [0029.978] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] GetStdHandle (nStdHandle=0x0) returned 0xffffffff [0029.978] EndPaint (hWnd=0x0, lpPaint=0x0) returned 0 [0029.978] GetDriveTypeW (lpRootPathName=0x0) returned 0x3 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.860] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.861] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.862] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.863] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.864] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.865] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0030.866] GetEnhMetaFileHeader (in: hemf=0x0, nSize=0x0, lpEnhMetaHeader=0x18f678 | out: lpEnhMetaHeader=0x18f678) returned 0x0 [0031.148] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.149] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.149] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.150] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.150] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.151] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.151] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.152] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.152] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.153] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.153] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.154] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.154] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.155] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.155] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.156] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.156] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.157] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.157] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.158] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.158] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.159] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.159] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.160] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.160] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.161] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.161] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.162] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.162] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.163] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.163] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.164] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.164] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.164] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.164] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.164] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.165] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.165] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.165] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.165] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.165] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.165] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.165] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.165] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.166] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.166] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.167] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.167] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.168] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.168] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.169] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.169] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.170] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.170] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.171] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.171] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.172] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.172] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.173] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.173] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.173] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.173] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.173] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.173] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.173] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.173] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.173] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.173] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.174] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.174] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.175] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.175] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.176] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.176] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.177] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.177] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.178] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.178] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.179] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.179] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.180] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.180] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.180] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.180] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.180] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.180] SetCommMask (hFile=0x0, dwEvtMask=0x0) returned 0 [0031.181] TransmitCommChar (hFile=0x0, cChar=0) returned 0 [0031.500] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0031.501] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0031.502] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0031.503] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0031.504] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0031.505] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0031.506] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0031.506] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0031.506] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0031.506] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0031.506] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0031.506] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0031.506] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0031.506] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0031.506] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0031.506] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0031.507] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0031.507] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0031.507] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0031.507] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0031.507] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0031.507] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0031.507] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0031.507] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74a90000 [0031.595] GetProcAddress (hModule=0x74a90000, lpProcName="WNetCloseEnum") returned 0x74a92dd6 [0031.595] GetProcAddress (hModule=0x74a90000, lpProcName="WNetOpenEnumW") returned 0x74a92f06 [0031.595] GetProcAddress (hModule=0x74a90000, lpProcName="WNetEnumResourceW") returned 0x74a93058 [0031.595] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0031.780] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0031.781] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0031.781] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0031.781] GetProcessHeap () returned 0x5c0000 [0031.781] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x605408 [0031.781] QueryPerformanceCounter (in: lpPerformanceCount=0x18f458 | out: lpPerformanceCount=0x18f458*=15199603787) returned 1 [0031.781] GetTickCount () returned 0x18d8f [0031.781] GetCurrentProcessId () returned 0x97c [0031.782] GetTickCount () returned 0x18d8f [0031.782] GetTickCount () returned 0x18d8f [0031.782] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x605430 [0031.782] GetVersion () returned 0x1db10106 [0031.782] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x605060 [0031.782] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5cefb8 [0031.782] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cefb8, Size=0x20) returned 0x605480 [0031.782] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605480, Size=0x40) returned 0x605150 [0031.782] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x605ad8 [0031.782] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_5SR5S9A") returned 0x0 [0031.783] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_5SR5S9A") returned 0x88 [0031.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605060 | out: hHeap=0x5c0000) returned 1 [0031.783] lstrlenW (lpString="Global\\syncronize_") returned 18 [0031.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605150 | out: hHeap=0x5c0000) returned 1 [0031.783] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x605060 [0031.783] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5cefb8 [0031.783] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cefb8, Size=0x20) returned 0x605480 [0031.783] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605480, Size=0x40) returned 0x615af8 [0031.783] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x616ae0 [0031.783] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_5SR5S9U") returned 0x0 [0031.783] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_5SR5S9U") returned 0x8c [0031.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605060 | out: hHeap=0x5c0000) returned 1 [0031.784] lstrlenW (lpString="Global\\syncronize_") returned 18 [0031.784] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x615af8 | out: hHeap=0x5c0000) returned 1 [0031.784] GetVersion () returned 0x1db10106 [0031.784] GetCurrentProcess () returned 0xffffffff [0031.784] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18f444 | out: TokenHandle=0x18f444*=0x90) returned 1 [0031.784] GetTokenInformation (in: TokenHandle=0x90, TokenInformationClass=0x14, TokenInformation=0x18f440, TokenInformationLength=0x4, ReturnLength=0x18f44c | out: TokenInformation=0x18f440, ReturnLength=0x18f44c) returned 1 [0031.784] CloseHandle (hObject=0x90) returned 1 [0031.784] WaitForSingleObject (hHandle=0x8c, dwMilliseconds=0x0) returned 0x0 [0031.784] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x3e8) returned 0x0 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x605060 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5cefb8 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cefb8, Size=0x20) returned 0x605480 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605480, Size=0x40) returned 0x615af8 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615af8, Size=0x80) returned 0x605150 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605150, Size=0x100) returned 0x605150 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x626ae8 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x605258 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x605268 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x605278 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5cefb8 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x626b28 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5cefd0 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626b28, Size=0x8) returned 0x626b28 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5cefe8 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626b28, Size=0x10) returned 0x626b28 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b58 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b70 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626b28, Size=0x20) returned 0x626f40 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626b88 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ba0 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605258, Size=0x8) returned 0x605258 [0031.784] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605268, Size=0x8) returned 0x605268 [0031.784] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x626b28 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626bb8 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x626f68 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626bd0 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626f68, Size=0x8) returned 0x626f68 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626be8 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626f68, Size=0x10) returned 0x626f68 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c00 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x626f80 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626f68, Size=0x20) returned 0x626f90 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605258, Size=0x10) returned 0x626f68 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605268, Size=0x10) returned 0x626fb8 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x605258 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626c18 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x605268 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c30 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605268, Size=0x8) returned 0x605268 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x626fd0 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626c48 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x626fe0 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c60 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626fe0, Size=0x8) returned 0x626fe0 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626f68, Size=0x20) returned 0x626ff0 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626fb8, Size=0x20) returned 0x627018 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x626fb8 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626c78 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x626f68 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c90 [0031.785] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626f68, Size=0x8) returned 0x626f68 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x627040 [0031.785] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x627060 [0031.785] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605150 | out: hHeap=0x5c0000) returned 1 [0031.785] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18f490 | out: lpWSAData=0x18f490) returned 0 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626ca8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626ca8, Size=0x20) returned 0x605688 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605688, Size=0x40) returned 0x615af8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615af8, Size=0x80) returned 0x6051a8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x100) returned 0x627338 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626ca8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626ca8, Size=0x20) returned 0x605688 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605688, Size=0x40) returned 0x615af8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615af8, Size=0x80) returned 0x6051a8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x100) returned 0x627440 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626ca8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6051a8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626cc0 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x8) returned 0x6051a8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x6051b8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x10) returned 0x6051d8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x6051f0 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x605688 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051d8, Size=0x20) returned 0x605210 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x6056b0 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x605238 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x6056d8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626cd8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6051a8 [0031.796] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x615af8 [0031.796] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x8) returned 0x6051a8 [0031.797] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x615b40 [0031.797] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051a8, Size=0x10) returned 0x6051d8 [0031.797] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x627548 [0031.797] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x627568 [0031.797] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051d8, Size=0x20) returned 0x627588 [0031.797] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x6275b0 [0031.797] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0031.797] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627338 | out: hHeap=0x5c0000) returned 1 [0031.797] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0031.797] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627440 | out: hHeap=0x5c0000) returned 1 [0031.797] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x629a98 [0031.800] EnumServicesStatusExW (in: hSCManager=0x629a98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18f42c, lpServicesReturned=0x18f444, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18f42c, lpServicesReturned=0x18f444, lpResumeHandle=0x0) returned 0 [0031.802] GetLastError () returned 0xea [0031.802] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x62a3c8 [0031.802] EnumServicesStatusExW (in: hSCManager=0x629a98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x62a3c8, cbBufSize=0x11e4, pcbBytesNeeded=0x18f42c, lpServicesReturned=0x18f444, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x62a3c8, pcbBytesNeeded=0x18f42c, lpServicesReturned=0x18f444, lpResumeHandle=0x0) returned 1 [0031.805] CloseServiceHandle (hSCObject=0x629a98) returned 1 [0031.807] lstrlenW (lpString="Appinfo") returned 7 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0031.808] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0031.808] lstrlenW (lpString="AudioSrv") returned 8 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0031.808] lstrlenW (lpString="BFE") returned 3 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0031.808] lstrlenW (lpString="CryptSvc") returned 8 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0031.808] lstrlenW (lpString="CscService") returned 10 [0031.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0031.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0031.808] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0031.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0031.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0031.809] lstrlenW (lpString="DcomLaunch") returned 10 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0031.809] lstrlenW (lpString="Dhcp") returned 4 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0031.809] lstrlenW (lpString="Dnscache") returned 8 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0031.809] lstrlenW (lpString="DPS") returned 3 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0031.809] lstrlenW (lpString="eventlog") returned 8 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0031.809] lstrlenW (lpString="EventSystem") returned 11 [0031.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0031.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0031.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0031.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0031.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0031.810] lstrlenW (lpString="gpsvc") returned 5 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0031.810] lstrlenW (lpString="iphlpsvc") returned 8 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0031.810] lstrlenW (lpString="LanmanServer") returned 12 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0031.810] lstrlenW (lpString="LanmanWorkstation") returned 17 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0031.810] lstrlenW (lpString="lmhosts") returned 7 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0031.810] lstrlenW (lpString="MMCSS") returned 5 [0031.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0031.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0031.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0031.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0031.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0031.810] lstrlenW (lpString="MpsSvc") returned 6 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0031.811] lstrlenW (lpString="Netman") returned 6 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0031.811] lstrlenW (lpString="netprofm") returned 8 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0031.811] lstrlenW (lpString="NlaSvc") returned 6 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0031.811] lstrlenW (lpString="nsi") returned 3 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0031.811] lstrlenW (lpString="PcaSvc") returned 6 [0031.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0031.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0031.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0031.811] lstrlenW (lpString="PlugPlay") returned 8 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0031.812] lstrlenW (lpString="Power") returned 5 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0031.812] lstrlenW (lpString="ProfSvc") returned 7 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0031.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0031.812] lstrlenW (lpString="RpcSs") returned 5 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0031.812] lstrlenW (lpString="SamSs") returned 5 [0031.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0031.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0031.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0031.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0031.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0031.812] lstrlenW (lpString="Schedule") returned 8 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0031.813] lstrlenW (lpString="SENS") returned 4 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0031.813] lstrlenW (lpString="ShellHWDetection") returned 16 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0031.813] lstrlenW (lpString="Spooler") returned 7 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0031.813] lstrlenW (lpString="SysMain") returned 7 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0031.813] lstrlenW (lpString="Themes") returned 6 [0031.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0031.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0031.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0031.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0031.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0031.813] lstrlenW (lpString="TrkWks") returned 6 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0031.814] lstrlenW (lpString="UxSms") returned 5 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0031.814] lstrlenW (lpString="WdiServiceHost") returned 14 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0031.814] lstrlenW (lpString="WdiSystemHost") returned 13 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0031.814] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0031.814] lstrlenW (lpString="Winmgmt") returned 7 [0031.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0031.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0031.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0031.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0031.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0031.814] lstrlenW (lpString="WPDBusEnum") returned 10 [0031.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0031.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0031.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0031.815] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62a3c8 | out: hHeap=0x5c0000) returned 1 [0031.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe4 [0031.818] Process32FirstW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.822] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.822] lstrlenW (lpString="System") returned 6 [0031.822] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0031.822] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0031.822] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0031.822] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0031.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0031.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0031.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0031.823] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.823] lstrlenW (lpString="smss.exe") returned 8 [0031.823] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0031.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0031.823] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.824] lstrlenW (lpString="csrss.exe") returned 9 [0031.824] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.824] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.824] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.824] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0031.824] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.825] lstrlenW (lpString="wininit.exe") returned 11 [0031.825] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0031.825] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0031.825] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.825] lstrlenW (lpString="csrss.exe") returned 9 [0031.825] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.825] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.825] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.825] InternalLcidToName () [0031.826] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0031.826] lstrlenW (lpString="winlogon.exe") returned 12 [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] InternalLcidToName () [0031.826] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0031.827] lstrlenW (lpString="services.exe") returned 12 [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] InternalLcidToName () [0031.827] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0031.828] lstrlenW (lpString="lsass.exe") returned 9 [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] InternalLcidToName () [0031.828] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0031.828] lstrlenW (lpString="lsm.exe") returned 7 [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.829] lstrlenW (lpString="svchost.exe") returned 11 [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.829] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.830] lstrlenW (lpString="svchost.exe") returned 11 [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] InternalLcidToName () [0031.830] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.831] lstrlenW (lpString="svchost.exe") returned 11 [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] InternalLcidToName () [0031.831] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.832] lstrlenW (lpString="svchost.exe") returned 11 [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.832] lstrlenW (lpString="svchost.exe") returned 11 [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.832] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0031.833] lstrlenW (lpString="audiodg.exe") returned 11 [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] InternalLcidToName () [0031.833] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.834] lstrlenW (lpString="svchost.exe") returned 11 [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] InternalLcidToName () [0031.834] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.835] lstrlenW (lpString="svchost.exe") returned 11 [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] InternalLcidToName () [0031.835] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0031.836] lstrlenW (lpString="dwm.exe") returned 7 [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] InternalLcidToName () [0031.836] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0031.837] lstrlenW (lpString="explorer.exe") returned 12 [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] InternalLcidToName () [0031.837] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0031.838] lstrlenW (lpString="spoolsv.exe") returned 11 [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.838] lstrlenW (lpString="taskhost.exe") returned 12 [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.838] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.839] lstrlenW (lpString="svchost.exe") returned 11 [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] InternalLcidToName () [0031.839] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0031.840] lstrlenW (lpString="taskeng.exe") returned 11 [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] InternalLcidToName () [0031.840] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.841] lstrlenW (lpString="taskhost.exe") returned 12 [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] InternalLcidToName () [0031.841] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0031.842] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0031.842] lstrlenW (lpString="locationshumanities.exe") returned 23 [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.842] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0031.843] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] InternalLcidToName () [0031.843] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0031.844] lstrlenW (lpString="decreased.exe") returned 13 [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] InternalLcidToName () [0031.844] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0031.845] lstrlenW (lpString="marcus instrument.exe") returned 21 [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] InternalLcidToName () [0031.845] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0031.846] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0031.846] lstrlenW (lpString="hdtv.exe") returned 8 [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.846] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0031.847] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] InternalLcidToName () [0031.847] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0031.848] lstrlenW (lpString="adjusted.exe") returned 12 [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] InternalLcidToName () [0031.848] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0031.849] lstrlenW (lpString="width_worker.exe") returned 16 [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] InternalLcidToName () [0031.849] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0031.849] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0031.849] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] InternalLcidToName () [0031.850] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0031.851] lstrlenW (lpString="licensed.exe") returned 12 [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0031.851] lstrlenW (lpString="rocket.exe") returned 10 [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.851] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0031.852] lstrlenW (lpString="alexander motel.exe") returned 19 [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] InternalLcidToName () [0031.852] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0031.853] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] InternalLcidToName () [0031.853] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0031.854] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] InternalLcidToName () [0031.854] Process32NextW (in: hSnapshot=0xe4, lppe=0x18f21c | out: lppe=0x18f21c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0031.855] lstrlenW (lpString="shall.exe") returned 9 [0031.855] InternalLcidToName () [0031.855] InternalLcidToName () [0031.855] InternalLcidToName () [0031.963] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x605238 [0031.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x605238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626d08 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626d08, Size=0x20) returned 0x6056b0 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6056b0, Size=0x40) returned 0x615af8 [0031.964] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x628598 [0031.964] GetLogicalDrives () returned 0x4 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x62c610 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626d08 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626d08, Size=0x20) returned 0x6056b0 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6056b0, Size=0x40) returned 0x615b40 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615b40, Size=0x80) returned 0x628670 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628670, Size=0x100) returned 0x62a380 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62a380, Size=0x200) returned 0x62a380 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62a380, Size=0x400) returned 0x62a380 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62a380, Size=0x800) returned 0x62a380 [0031.964] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62a380, Size=0x1000) returned 0x62a380 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x63c630 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626d08 [0031.964] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626de0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x605248 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626df8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6051f0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e10 [0031.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051f0, Size=0x8) returned 0x6051f0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e28 [0031.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051f0, Size=0x10) returned 0x6051f0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e40 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e58 [0031.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051f0, Size=0x20) returned 0x6275b0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e70 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6051f0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626e88 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626ea0 [0031.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6275b0, Size=0x40) returned 0x628880 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626eb8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626ed0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626ee8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x626f00 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f18 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c650 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x605200 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c668 [0031.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628880, Size=0x80) returned 0x628670 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c680 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c698 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c6b0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c6c8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c6e0 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c6f8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c710 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6051b8 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c728 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c740 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c758 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c770 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c788 [0031.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c7a0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c7b8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c7d0 [0031.966] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628670, Size=0x100) returned 0x62b388 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c7e8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c800 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c818 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64c830 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c848 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c860 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6051c8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c878 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c890 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c8a8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6275b0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c8c0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c8d8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6275c0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c8f0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c908 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c920 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c938 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c950 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c968 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64c980 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c998 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64c9b0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c9c8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c9e0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64c9f8 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ca10 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6275d0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ca50 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ca68 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ca80 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ca98 [0031.966] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62b388, Size=0x200) returned 0x62b388 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cab0 [0031.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64ce50 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cac8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cae0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64caf8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb10 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb28 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb40 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb58 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb70 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cb88 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cba0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cbb8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cbd0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cbe8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cc00 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cc18 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cc30 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cc48 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cc60 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cc78 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cc90 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cca8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64ce60 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ccc0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ccd8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ccf0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64ce70 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd08 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cd20 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd38 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd50 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd68 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd80 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cd98 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cdb0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cdc8 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64cde0 [0031.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64cdf8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ce10 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d250 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d268 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d280 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d298 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d2b0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d2c8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d2e0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d2f8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d310 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64ce80 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64ce90 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d328 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d340 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d358 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d370 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d388 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d3a0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d3b8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d3d0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d3e8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d400 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d418 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d430 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d448 [0031.968] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62b388, Size=0x400) returned 0x64d638 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d460 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d478 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d490 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d4a8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d4c0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d4d8 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d4f0 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d508 [0031.968] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d520 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d538 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64cea0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d550 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64d568 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d580 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d598 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d5b0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d5c8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64d5e0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d5f8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64d610 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64da58 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64da70 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64da88 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64daa0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dab8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dad0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x64ceb0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dae8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db00 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db18 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db30 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db48 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db60 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db78 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64db90 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dba8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64dbc0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dbd8 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64dbf0 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc08 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc20 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc38 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc50 [0031.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc68 [0031.970] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64dc80 [0031.970] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dc98 [0031.970] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dcb0 [0031.970] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64dcc8 [0031.970] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18f34c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f34c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.971] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63c630 | out: hHeap=0x5c0000) returned 1 [0031.975] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18f34c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f34c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.975] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x671258 | out: hHeap=0x5c0000) returned 1 Thread: id = 2 os_tid = 0x98c Thread: id = 4 os_tid = 0x998 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x640fb8 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x640fb8, Size=0x20) returned 0x629c50 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x629c50, Size=0x40) returned 0x615d38 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615d38, Size=0x80) returned 0x66f270 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x66f270, Size=0x100) returned 0x63ee50 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x640fb8 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x640fb8, Size=0x20) returned 0x629c50 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x629c50, Size=0x40) returned 0x615d38 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615d38, Size=0x80) returned 0x66f270 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x66f270, Size=0x100) returned 0x63ef58 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x640fb8 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x64d210 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x640f88 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d210, Size=0x8) returned 0x641660 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x627b70 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641660, Size=0x10) returned 0x640fa0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x627b90 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x629c50 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x640fa0, Size=0x20) returned 0x629c78 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x629ca0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x627bb0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x629cc8 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x640fa0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x641660 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x615d38 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641660, Size=0x8) returned 0x641650 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x615d80 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641650, Size=0x10) returned 0x640f70 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x627bd0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x627bf0 [0032.156] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x640f70, Size=0x20) returned 0x629cf0 [0032.156] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x62a828 [0032.157] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0032.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63ee50 | out: hHeap=0x5c0000) returned 1 [0032.157] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0032.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63ef58 | out: hHeap=0x5c0000) returned 1 [0032.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x629d90 [0032.157] EnumServicesStatusExW (in: hSCManager=0x629d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0032.157] GetLastError () returned 0xea [0032.157] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x644ee0 [0032.157] EnumServicesStatusExW (in: hSCManager=0x629d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x644ee0, cbBufSize=0x11e4, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x644ee0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0032.158] CloseServiceHandle (hSCObject=0x629d90) returned 1 [0032.158] lstrlenW (lpString="Appinfo") returned 7 [0032.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0032.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0032.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0032.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0032.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0032.158] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0032.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.158] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0032.158] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0032.159] lstrlenW (lpString="AudioSrv") returned 8 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0032.159] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0032.159] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0032.159] lstrlenW (lpString="BFE") returned 3 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0032.159] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0032.159] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0032.159] lstrlenW (lpString="CryptSvc") returned 8 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0032.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0032.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0032.159] lstrlenW (lpString="CscService") returned 10 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0032.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0032.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0032.159] lstrlenW (lpString="DcomLaunch") returned 10 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0032.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0032.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0032.159] lstrlenW (lpString="Dhcp") returned 4 [0032.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0032.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0032.160] lstrlenW (lpString="Dnscache") returned 8 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0032.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0032.160] lstrlenW (lpString="DPS") returned 3 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0032.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0032.160] lstrlenW (lpString="eventlog") returned 8 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0032.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0032.160] lstrlenW (lpString="EventSystem") returned 11 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0032.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0032.160] lstrlenW (lpString="gpsvc") returned 5 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0032.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0032.160] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0032.160] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0032.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0032.160] lstrlenW (lpString="iphlpsvc") returned 8 [0032.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0032.161] lstrlenW (lpString="LanmanServer") returned 12 [0032.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0032.161] lstrlenW (lpString="LanmanWorkstation") returned 17 [0032.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0032.161] lstrlenW (lpString="lmhosts") returned 7 [0032.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0032.161] lstrlenW (lpString="MMCSS") returned 5 [0032.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0032.161] lstrlenW (lpString="MpsSvc") returned 6 [0032.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0032.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0032.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0032.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0032.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0032.162] lstrlenW (lpString="Netman") returned 6 [0032.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0032.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0032.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0032.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0032.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0032.162] lstrlenW (lpString="netprofm") returned 8 [0032.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0032.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0032.162] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0032.162] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0032.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0032.162] lstrlenW (lpString="NlaSvc") returned 6 [0032.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0032.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0032.162] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0032.162] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0032.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0032.162] lstrlenW (lpString="nsi") returned 3 [0032.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0032.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0032.162] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0032.162] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0032.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0032.162] lstrlenW (lpString="PcaSvc") returned 6 [0032.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0032.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0032.163] lstrlenW (lpString="PlugPlay") returned 8 [0032.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0032.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0032.163] lstrlenW (lpString="Power") returned 5 [0032.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0032.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0032.163] lstrlenW (lpString="ProfSvc") returned 7 [0032.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0032.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0032.163] lstrlenW (lpString="RpcEptMapper") returned 12 [0032.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0032.163] lstrlenW (lpString="RpcSs") returned 5 [0032.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0032.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0032.163] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0032.163] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0032.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0032.163] lstrlenW (lpString="SamSs") returned 5 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0032.164] lstrlenW (lpString="Schedule") returned 8 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0032.164] lstrlenW (lpString="SENS") returned 4 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0032.164] lstrlenW (lpString="ShellHWDetection") returned 16 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0032.164] lstrlenW (lpString="Spooler") returned 7 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0032.164] lstrlenW (lpString="SysMain") returned 7 [0032.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0032.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0032.164] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0032.164] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0032.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0032.165] lstrlenW (lpString="Themes") returned 6 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0032.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0032.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0032.165] lstrlenW (lpString="TrkWks") returned 6 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0032.165] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0032.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0032.165] lstrlenW (lpString="UxSms") returned 5 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0032.165] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0032.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0032.165] lstrlenW (lpString="WdiServiceHost") returned 14 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0032.165] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0032.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0032.165] lstrlenW (lpString="WdiSystemHost") returned 13 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0032.165] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0032.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0032.165] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0032.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0032.166] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0032.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0032.166] lstrlenW (lpString="Winmgmt") returned 7 [0032.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0032.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0032.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0032.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0032.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0032.166] lstrlenW (lpString="WPDBusEnum") returned 10 [0032.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.166] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0032.166] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0032.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0032.166] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x644ee0 | out: hHeap=0x5c0000) returned 1 [0032.166] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0032.168] Process32FirstW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.169] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0032.169] lstrlenW (lpString="System") returned 6 [0032.169] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0032.169] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0032.169] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0032.169] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0032.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0032.170] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0032.170] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0032.170] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0032.170] lstrlenW (lpString="smss.exe") returned 8 [0032.170] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0032.170] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0032.170] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.171] lstrlenW (lpString="csrss.exe") returned 9 [0032.171] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.171] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.171] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.171] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.171] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.171] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0032.171] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0032.172] lstrlenW (lpString="wininit.exe") returned 11 [0032.172] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0032.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0032.172] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.173] lstrlenW (lpString="csrss.exe") returned 9 [0032.173] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.173] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.173] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.832] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a088 [0033.833] EnumServicesStatusExW (in: hSCManager=0x62a088, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0033.833] GetLastError () returned 0xea [0033.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x3fc3930 [0033.833] EnumServicesStatusExW (in: hSCManager=0x62a088, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc3930, cbBufSize=0x11e4, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc3930, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0033.834] CloseServiceHandle (hSCObject=0x62a088) returned 1 [0033.834] lstrlenW (lpString="Appinfo") returned 7 [0033.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0033.836] Process32FirstW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.837] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0033.838] lstrlenW (lpString="System") returned 6 [0033.838] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0033.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0033.838] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0033.839] lstrlenW (lpString="smss.exe") returned 8 [0033.839] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0033.839] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.839] lstrlenW (lpString="csrss.exe") returned 9 [0033.839] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.840] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.840] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.840] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0033.840] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0033.840] lstrlenW (lpString="wininit.exe") returned 11 [0033.840] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0033.840] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0033.841] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.841] lstrlenW (lpString="csrss.exe") returned 9 [0033.841] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.841] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.841] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0033.841] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0033.842] lstrlenW (lpString="winlogon.exe") returned 12 [0033.842] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0033.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0033.842] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0033.843] lstrlenW (lpString="services.exe") returned 12 [0033.843] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0033.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0033.843] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0033.844] lstrlenW (lpString="lsass.exe") returned 9 [0033.844] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0033.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0033.844] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0033.844] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0033.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0033.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0033.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0033.844] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0033.845] lstrlenW (lpString="lsm.exe") returned 7 [0033.845] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0033.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0033.845] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0033.845] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0033.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0033.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0033.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0033.845] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.845] lstrlenW (lpString="svchost.exe") returned 11 [0033.845] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.846] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.846] lstrlenW (lpString="svchost.exe") returned 11 [0033.846] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.847] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.859] lstrlenW (lpString="svchost.exe") returned 11 [0033.859] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.860] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.860] lstrlenW (lpString="svchost.exe") returned 11 [0033.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.861] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.861] lstrlenW (lpString="svchost.exe") returned 11 [0033.861] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.861] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0033.862] lstrlenW (lpString="audiodg.exe") returned 11 [0033.862] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0033.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0033.862] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0033.862] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0033.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0033.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0033.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0033.862] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.863] lstrlenW (lpString="svchost.exe") returned 11 [0033.863] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.863] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.864] lstrlenW (lpString="svchost.exe") returned 11 [0033.864] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.864] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.864] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0033.865] lstrlenW (lpString="dwm.exe") returned 7 [0033.865] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0033.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0033.865] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0033.865] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0033.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0033.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0033.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0033.865] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0033.866] lstrlenW (lpString="explorer.exe") returned 12 [0033.866] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0033.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0033.866] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0033.866] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0033.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0033.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0033.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0033.866] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0033.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0033.867] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0033.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0033.867] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.867] lstrlenW (lpString="taskhost.exe") returned 12 [0033.867] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0033.868] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.868] lstrlenW (lpString="svchost.exe") returned 11 [0033.868] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0033.868] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0033.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0033.869] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0033.869] lstrlenW (lpString="taskeng.exe") returned 11 [0033.869] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0033.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0033.869] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.870] lstrlenW (lpString="taskhost.exe") returned 12 [0033.870] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0033.870] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0033.870] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0033.871] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0033.871] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0033.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0033.871] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0033.871] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0033.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0033.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0033.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0033.871] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0033.872] lstrlenW (lpString="locationshumanities.exe") returned 23 [0033.872] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0033.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0033.872] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0033.872] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0033.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0033.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0033.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0033.872] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0033.873] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0033.873] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0033.873] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0033.873] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0033.873] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0033.873] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0033.873] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0033.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0033.873] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0033.873] lstrlenW (lpString="decreased.exe") returned 13 [0033.874] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0033.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0033.874] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0033.874] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0033.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0033.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0033.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0033.874] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0033.874] lstrlenW (lpString="marcus instrument.exe") returned 21 [0033.874] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0033.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0033.874] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0033.874] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0033.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0033.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0033.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0033.875] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0033.875] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0033.875] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0033.875] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0033.876] lstrlenW (lpString="hdtv.exe") returned 8 [0033.876] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0033.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0033.876] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0033.876] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0033.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0033.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0033.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0033.876] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0033.877] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0033.877] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0033.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0033.877] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0033.877] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0033.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0033.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0033.877] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0033.877] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0033.878] lstrlenW (lpString="adjusted.exe") returned 12 [0033.878] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0033.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0033.878] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0033.878] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0033.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0033.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0033.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0033.878] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0034.093] lstrlenW (lpString="width_worker.exe") returned 16 [0034.094] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0034.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0034.094] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0034.094] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0034.094] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0034.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0034.094] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0034.095] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0034.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0034.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0034.095] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0034.095] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0034.095] lstrlenW (lpString="licensed.exe") returned 12 [0034.095] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0034.095] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0034.095] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0034.095] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0034.095] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.096] lstrlenW (lpString="rocket.exe") returned 10 [0034.096] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.097] lstrlenW (lpString="alexander motel.exe") returned 19 [0034.097] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.098] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0034.098] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.098] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0034.099] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.099] lstrlenW (lpString="shall.exe") returned 9 [0034.099] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.100] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0034.100] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.100] lstrlenW (lpString="fax fixtures.exe") returned 16 [0034.100] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.101] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.101] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.102] lstrlenW (lpString="dllhost.exe") returned 11 [0034.102] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.102] lstrlenW (lpString="dllhost.exe") returned 11 [0034.102] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.103] lstrlenW (lpString="rruzcj.exe") returned 10 [0034.103] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.104] lstrlenW (lpString="cmd.exe") returned 7 [0034.104] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.104] lstrlenW (lpString="conhost.exe") returned 11 [0034.104] NtMapViewOfSection (SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0034.105] CloseHandle (hObject=0x168) returned 1 [0034.105] Sleep (dwMilliseconds=0x1f4) [0035.460] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a128 [0035.532] EnumServicesStatusExW (in: hSCManager=0x62a128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0035.532] GetLastError () returned 0xea [0035.532] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x3fc0070 [0035.532] EnumServicesStatusExW (in: hSCManager=0x62a128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc0070, cbBufSize=0x11e4, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc0070, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0035.533] CloseServiceHandle (hSCObject=0x62a128) returned 1 [0035.533] lstrlenW (lpString="Appinfo") returned 7 [0035.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.533] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.534] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.534] lstrlenW (lpString="AudioSrv") returned 8 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.534] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.534] lstrlenW (lpString="BFE") returned 3 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.534] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.534] lstrlenW (lpString="CryptSvc") returned 8 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.534] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.534] lstrlenW (lpString="CscService") returned 10 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.534] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.534] lstrlenW (lpString="DcomLaunch") returned 10 [0035.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.534] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.535] lstrlenW (lpString="Dhcp") returned 4 [0035.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.535] lstrlenW (lpString="Dnscache") returned 8 [0035.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.535] lstrlenW (lpString="DPS") returned 3 [0035.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.535] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.535] lstrlenW (lpString="eventlog") returned 8 [0035.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.535] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.535] lstrlenW (lpString="EventSystem") returned 11 [0035.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.535] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.535] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.536] lstrlenW (lpString="gpsvc") returned 5 [0035.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.536] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.536] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.536] lstrlenW (lpString="iphlpsvc") returned 8 [0035.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.536] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.536] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.536] lstrlenW (lpString="LanmanServer") returned 12 [0035.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.536] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.536] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.536] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.536] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.536] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.536] lstrlenW (lpString="lmhosts") returned 7 [0035.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.536] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.536] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.536] lstrlenW (lpString="MMCSS") returned 5 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.537] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.537] lstrlenW (lpString="MpsSvc") returned 6 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.537] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.537] lstrlenW (lpString="Netman") returned 6 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.537] lstrlenW (lpString="netprofm") returned 8 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.537] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.537] lstrlenW (lpString="NlaSvc") returned 6 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.537] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.537] lstrlenW (lpString="nsi") returned 3 [0035.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.537] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.538] lstrlenW (lpString="PcaSvc") returned 6 [0035.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.538] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.538] lstrlenW (lpString="PlugPlay") returned 8 [0035.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.538] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.538] lstrlenW (lpString="Power") returned 5 [0035.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.538] lstrlenW (lpString="ProfSvc") returned 7 [0035.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.538] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.538] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.538] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.538] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.538] lstrlenW (lpString="RpcSs") returned 5 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.539] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.539] lstrlenW (lpString="SamSs") returned 5 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.539] lstrlenW (lpString="Schedule") returned 8 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.539] lstrlenW (lpString="SENS") returned 4 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.539] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.539] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.539] lstrlenW (lpString="Spooler") returned 7 [0035.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.540] lstrlenW (lpString="SysMain") returned 7 [0035.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.540] lstrlenW (lpString="Themes") returned 6 [0035.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.540] lstrlenW (lpString="TrkWks") returned 6 [0035.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.540] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.540] lstrlenW (lpString="UxSms") returned 5 [0035.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.540] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.540] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.540] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.540] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.541] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.541] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.541] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.541] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.541] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.541] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.541] lstrlenW (lpString="Winmgmt") returned 7 [0035.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.541] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.541] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.541] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.541] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc0070 | out: hHeap=0x5c0000) returned 1 [0035.541] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0035.544] Process32FirstW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.544] Process32NextW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.545] lstrlenW (lpString="System") returned 6 [0035.545] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.545] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.545] Process32NextW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.546] lstrlenW (lpString="smss.exe") returned 8 [0035.546] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.546] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.546] Process32NextW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.547] lstrlenW (lpString="csrss.exe") returned 9 [0035.547] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.547] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.547] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.547] Process32NextW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.548] lstrlenW (lpString="wininit.exe") returned 11 [0035.548] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.548] Process32NextW (in: hSnapshot=0x170, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.549] lstrlenW (lpString="csrss.exe") returned 9 [0035.549] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.549] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.549] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.549] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.550] lstrlenW (lpString="winlogon.exe") returned 12 [0035.550] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.550] lstrlenW (lpString="services.exe") returned 12 [0035.550] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.551] lstrlenW (lpString="lsass.exe") returned 9 [0035.551] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.552] lstrlenW (lpString="lsm.exe") returned 7 [0035.552] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.552] lstrlenW (lpString="svchost.exe") returned 11 [0035.552] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.553] lstrlenW (lpString="svchost.exe") returned 11 [0035.553] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.554] lstrlenW (lpString="svchost.exe") returned 11 [0035.554] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.554] lstrlenW (lpString="svchost.exe") returned 11 [0035.554] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.555] lstrlenW (lpString="svchost.exe") returned 11 [0035.555] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.556] lstrlenW (lpString="audiodg.exe") returned 11 [0035.556] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.556] lstrlenW (lpString="svchost.exe") returned 11 [0035.556] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.557] lstrlenW (lpString="svchost.exe") returned 11 [0035.557] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.558] lstrlenW (lpString="dwm.exe") returned 7 [0035.558] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.558] lstrlenW (lpString="explorer.exe") returned 12 [0035.559] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.643] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.643] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.668] lstrlenW (lpString="taskhost.exe") returned 12 [0035.668] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.669] lstrlenW (lpString="svchost.exe") returned 11 [0035.669] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.670] lstrlenW (lpString="taskeng.exe") returned 11 [0035.670] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.670] lstrlenW (lpString="taskhost.exe") returned 12 [0035.670] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.671] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0035.671] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0035.672] lstrlenW (lpString="locationshumanities.exe") returned 23 [0035.672] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.119] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0036.119] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.120] lstrlenW (lpString="decreased.exe") returned 13 [0036.120] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.120] lstrlenW (lpString="marcus instrument.exe") returned 21 [0036.120] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.121] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0036.121] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.122] lstrlenW (lpString="hdtv.exe") returned 8 [0036.122] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.122] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0036.122] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.123] lstrlenW (lpString="adjusted.exe") returned 12 [0036.123] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.124] lstrlenW (lpString="width_worker.exe") returned 16 [0036.124] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.124] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0036.124] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.125] lstrlenW (lpString="licensed.exe") returned 12 [0036.125] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.126] lstrlenW (lpString="rocket.exe") returned 10 [0036.126] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.127] lstrlenW (lpString="alexander motel.exe") returned 19 [0036.127] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.127] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0036.127] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.128] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0036.128] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.129] lstrlenW (lpString="shall.exe") returned 9 [0036.129] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.129] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0036.129] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.130] lstrlenW (lpString="fax fixtures.exe") returned 16 [0036.130] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.131] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.131] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.131] lstrlenW (lpString="dllhost.exe") returned 11 [0036.131] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.132] lstrlenW (lpString="dllhost.exe") returned 11 [0036.132] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.133] lstrlenW (lpString="rruzcj.exe") returned 10 [0036.133] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.133] lstrlenW (lpString="cmd.exe") returned 7 [0036.133] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.134] lstrlenW (lpString="conhost.exe") returned 11 [0036.134] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.135] lstrlenW (lpString="vssadmin.exe") returned 12 [0036.135] NtMapViewOfSection (SectionHandle=0x170, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.135] CloseHandle (hObject=0x170) returned 1 [0036.136] Sleep (dwMilliseconds=0x1f4) [0036.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a100 [0036.831] EnumServicesStatusExW (in: hSCManager=0x62a100, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0036.832] GetLastError () returned 0xea [0036.832] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x3fc0070 [0036.832] EnumServicesStatusExW (in: hSCManager=0x62a100, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc0070, cbBufSize=0x11e4, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc0070, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0036.832] CloseServiceHandle (hSCObject=0x62a100) returned 1 [0036.833] lstrlenW (lpString="Appinfo") returned 7 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.833] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.833] lstrlenW (lpString="AudioSrv") returned 8 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.833] lstrlenW (lpString="BFE") returned 3 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.833] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.833] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.833] lstrlenW (lpString="CryptSvc") returned 8 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.833] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.833] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.833] lstrlenW (lpString="CscService") returned 10 [0036.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.834] lstrlenW (lpString="DcomLaunch") returned 10 [0036.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.834] lstrlenW (lpString="Dhcp") returned 4 [0036.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.834] lstrlenW (lpString="Dnscache") returned 8 [0036.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.834] lstrlenW (lpString="DPS") returned 3 [0036.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.834] lstrlenW (lpString="eventlog") returned 8 [0036.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.834] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.834] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.834] lstrlenW (lpString="EventSystem") returned 11 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.835] lstrlenW (lpString="gpsvc") returned 5 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.835] lstrlenW (lpString="iphlpsvc") returned 8 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.835] lstrlenW (lpString="LanmanServer") returned 12 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.835] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.835] lstrlenW (lpString="lmhosts") returned 7 [0036.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.835] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.835] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.836] lstrlenW (lpString="MMCSS") returned 5 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.836] lstrlenW (lpString="MpsSvc") returned 6 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.836] lstrlenW (lpString="Netman") returned 6 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.836] lstrlenW (lpString="netprofm") returned 8 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.836] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.836] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.836] lstrlenW (lpString="NlaSvc") returned 6 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.836] lstrlenW (lpString="nsi") returned 3 [0036.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.837] lstrlenW (lpString="PcaSvc") returned 6 [0036.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.837] lstrlenW (lpString="PlugPlay") returned 8 [0036.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.837] lstrlenW (lpString="Power") returned 5 [0036.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.837] lstrlenW (lpString="ProfSvc") returned 7 [0036.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.837] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.837] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.837] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.838] lstrlenW (lpString="RpcSs") returned 5 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.838] lstrlenW (lpString="SamSs") returned 5 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.838] lstrlenW (lpString="Schedule") returned 8 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.838] lstrlenW (lpString="SENS") returned 4 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.838] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.838] lstrlenW (lpString="Spooler") returned 7 [0036.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.839] lstrlenW (lpString="SysMain") returned 7 [0036.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.839] lstrlenW (lpString="Themes") returned 6 [0036.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.839] lstrlenW (lpString="TrkWks") returned 6 [0036.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.839] lstrlenW (lpString="UxSms") returned 5 [0036.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.839] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.839] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.839] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.840] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.840] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.840] lstrlenW (lpString="Winmgmt") returned 7 [0036.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.840] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc0070 | out: hHeap=0x5c0000) returned 1 [0036.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0036.843] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.843] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.844] lstrlenW (lpString="System") returned 6 [0036.844] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.844] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.845] lstrlenW (lpString="smss.exe") returned 8 [0036.845] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.845] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.846] lstrlenW (lpString="csrss.exe") returned 9 [0036.846] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.846] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.846] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.846] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.847] lstrlenW (lpString="wininit.exe") returned 11 [0036.847] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.847] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.847] lstrlenW (lpString="csrss.exe") returned 9 [0036.847] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.848] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.848] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.848] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.848] lstrlenW (lpString="winlogon.exe") returned 12 [0036.848] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.849] lstrlenW (lpString="services.exe") returned 12 [0036.849] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.850] lstrlenW (lpString="lsass.exe") returned 9 [0036.850] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.850] lstrlenW (lpString="lsm.exe") returned 7 [0036.850] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.851] lstrlenW (lpString="svchost.exe") returned 11 [0036.851] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.852] lstrlenW (lpString="svchost.exe") returned 11 [0036.852] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.852] lstrlenW (lpString="svchost.exe") returned 11 [0036.852] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.853] lstrlenW (lpString="svchost.exe") returned 11 [0036.853] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.854] lstrlenW (lpString="svchost.exe") returned 11 [0036.854] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.854] lstrlenW (lpString="audiodg.exe") returned 11 [0036.855] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.855] lstrlenW (lpString="svchost.exe") returned 11 [0036.855] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.856] lstrlenW (lpString="svchost.exe") returned 11 [0036.856] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.857] lstrlenW (lpString="dwm.exe") returned 7 [0036.857] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.857] lstrlenW (lpString="explorer.exe") returned 12 [0036.857] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.858] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.858] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.859] lstrlenW (lpString="taskhost.exe") returned 12 [0036.859] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.860] lstrlenW (lpString="svchost.exe") returned 11 [0036.860] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.860] lstrlenW (lpString="taskeng.exe") returned 11 [0036.860] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.861] lstrlenW (lpString="taskhost.exe") returned 12 [0036.861] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.862] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0036.862] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.862] lstrlenW (lpString="locationshumanities.exe") returned 23 [0036.862] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.863] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0036.863] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.864] lstrlenW (lpString="decreased.exe") returned 13 [0036.864] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.864] lstrlenW (lpString="marcus instrument.exe") returned 21 [0036.864] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.865] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0036.865] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.866] lstrlenW (lpString="hdtv.exe") returned 8 [0036.866] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.866] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0036.867] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.867] lstrlenW (lpString="adjusted.exe") returned 12 [0036.867] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.868] lstrlenW (lpString="width_worker.exe") returned 16 [0036.868] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.869] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0036.869] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.869] lstrlenW (lpString="licensed.exe") returned 12 [0036.869] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.870] lstrlenW (lpString="rocket.exe") returned 10 [0036.870] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.871] lstrlenW (lpString="alexander motel.exe") returned 19 [0036.871] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.871] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0036.871] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.872] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0036.872] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.873] lstrlenW (lpString="shall.exe") returned 9 [0036.873] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0036.873] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0036.873] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.253] lstrlenW (lpString="fax fixtures.exe") returned 16 [0037.253] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.253] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.254] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.254] lstrlenW (lpString="dllhost.exe") returned 11 [0037.254] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.255] lstrlenW (lpString="dllhost.exe") returned 11 [0037.255] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.255] lstrlenW (lpString="rruzcj.exe") returned 10 [0037.256] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.256] lstrlenW (lpString="cmd.exe") returned 7 [0037.256] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.257] lstrlenW (lpString="conhost.exe") returned 11 [0037.257] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.257] lstrlenW (lpString="vssadmin.exe") returned 12 [0037.257] NtMapViewOfSection (SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x1edfd30*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x1edfd18*=0, ViewSize=0x1edfd20*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4) [0037.258] CloseHandle (hObject=0x1a4) returned 1 [0037.258] Sleep (dwMilliseconds=0x1f4) [0038.046] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a1a0 [0038.046] EnumServicesStatusExW (in: hSCManager=0x62a1a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0038.046] GetLastError () returned 0xea [0038.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x63c630 [0038.047] EnumServicesStatusExW (in: hSCManager=0x62a1a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63c630, cbBufSize=0x123e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63c630, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0038.047] CloseServiceHandle (hSCObject=0x62a1a0) returned 1 [0038.047] lstrlenW (lpString="Appinfo") returned 7 [0038.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.048] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.048] lstrlenW (lpString="AudioSrv") returned 8 [0038.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.048] lstrlenW (lpString="BFE") returned 3 [0038.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.048] lstrlenW (lpString="CryptSvc") returned 8 [0038.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.048] lstrlenW (lpString="CscService") returned 10 [0038.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.049] lstrlenW (lpString="DcomLaunch") returned 10 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.049] lstrlenW (lpString="Dhcp") returned 4 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.049] lstrlenW (lpString="Dnscache") returned 8 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.049] lstrlenW (lpString="DPS") returned 3 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.049] lstrlenW (lpString="eventlog") returned 8 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.049] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.049] lstrlenW (lpString="EventSystem") returned 11 [0038.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.049] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.050] lstrlenW (lpString="gpsvc") returned 5 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.050] lstrlenW (lpString="iphlpsvc") returned 8 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.050] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.050] lstrlenW (lpString="LanmanServer") returned 12 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.050] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.050] lstrlenW (lpString="lmhosts") returned 7 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.050] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.050] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.050] lstrlenW (lpString="MMCSS") returned 5 [0038.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.051] lstrlenW (lpString="MpsSvc") returned 6 [0038.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.051] lstrlenW (lpString="Netman") returned 6 [0038.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.051] lstrlenW (lpString="netprofm") returned 8 [0038.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.051] lstrlenW (lpString="NlaSvc") returned 6 [0038.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.051] lstrlenW (lpString="nsi") returned 3 [0038.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.051] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.051] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.052] lstrlenW (lpString="PcaSvc") returned 6 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.052] lstrlenW (lpString="PlugPlay") returned 8 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.052] lstrlenW (lpString="Power") returned 5 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.052] lstrlenW (lpString="ProfSvc") returned 7 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.052] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.052] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.052] lstrlenW (lpString="RpcSs") returned 5 [0038.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.053] lstrlenW (lpString="SamSs") returned 5 [0038.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.053] lstrlenW (lpString="Schedule") returned 8 [0038.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.053] lstrlenW (lpString="SENS") returned 4 [0038.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.053] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.053] lstrlenW (lpString="Spooler") returned 7 [0038.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.054] lstrlenW (lpString="SysMain") returned 7 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.054] lstrlenW (lpString="Themes") returned 6 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.054] lstrlenW (lpString="TrkWks") returned 6 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.054] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.054] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.054] lstrlenW (lpString="UxSms") returned 5 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.054] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.054] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.054] lstrlenW (lpString="VSS") returned 3 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0038.054] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0038.054] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0038.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0038.054] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.055] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.055] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.055] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.055] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.055] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.055] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.055] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.055] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.055] lstrlenW (lpString="Winmgmt") returned 7 [0038.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.055] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.055] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.055] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63c630 | out: hHeap=0x5c0000) returned 1 [0038.055] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0038.058] Process32FirstW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.058] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.059] lstrlenW (lpString="System") returned 6 [0038.059] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.060] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.060] lstrlenW (lpString="smss.exe") returned 8 [0038.060] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.060] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.061] lstrlenW (lpString="csrss.exe") returned 9 [0038.061] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.061] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.061] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.061] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.062] lstrlenW (lpString="wininit.exe") returned 11 [0038.062] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.062] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.063] lstrlenW (lpString="csrss.exe") returned 9 [0038.063] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.897] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x642dd8 [0038.897] EnumServicesStatusExW (in: hSCManager=0x642dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0038.898] GetLastError () returned 0xea [0038.898] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x63c630 [0038.898] EnumServicesStatusExW (in: hSCManager=0x642dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63c630, cbBufSize=0x123e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63c630, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0038.899] CloseServiceHandle (hSCObject=0x642dd8) returned 1 [0038.899] lstrlenW (lpString="Appinfo") returned 7 [0038.899] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0038.902] Process32FirstW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.903] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.904] lstrlenW (lpString="System") returned 6 [0038.904] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.904] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.904] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.905] lstrlenW (lpString="smss.exe") returned 8 [0038.905] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.905] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.905] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.906] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.906] lstrlenW (lpString="csrss.exe") returned 9 [0038.906] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.907] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.907] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.907] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.908] lstrlenW (lpString="wininit.exe") returned 11 [0038.908] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.908] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.909] lstrlenW (lpString="csrss.exe") returned 9 [0038.909] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.909] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.909] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.909] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.910] lstrlenW (lpString="winlogon.exe") returned 12 [0038.910] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0038.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0038.910] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.911] lstrlenW (lpString="services.exe") returned 12 [0038.911] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0038.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0038.911] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.912] lstrlenW (lpString="lsass.exe") returned 9 [0038.912] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0038.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0038.912] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0038.912] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0038.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0038.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0038.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0038.913] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.913] lstrlenW (lpString="lsm.exe") returned 7 [0038.913] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0038.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0038.914] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0038.914] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0038.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0038.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0038.914] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0038.914] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.915] lstrlenW (lpString="svchost.exe") returned 11 [0038.915] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.915] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.916] lstrlenW (lpString="svchost.exe") returned 11 [0038.916] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.916] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.916] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.917] lstrlenW (lpString="svchost.exe") returned 11 [0038.917] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.917] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.917] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.918] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.918] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.918] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.918] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.918] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.919] lstrlenW (lpString="svchost.exe") returned 11 [0038.919] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.919] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.919] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.920] lstrlenW (lpString="svchost.exe") returned 11 [0038.920] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.920] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.920] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.921] lstrlenW (lpString="audiodg.exe") returned 11 [0038.921] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0038.921] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0038.921] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0038.921] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0038.921] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0038.921] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0038.921] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0038.921] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.922] lstrlenW (lpString="svchost.exe") returned 11 [0038.922] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.922] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.922] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.923] lstrlenW (lpString="svchost.exe") returned 11 [0038.923] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.923] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.924] lstrlenW (lpString="dwm.exe") returned 7 [0038.924] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0038.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0038.924] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0038.924] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0038.925] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0038.925] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0038.925] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0038.925] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.926] lstrlenW (lpString="explorer.exe") returned 12 [0038.926] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0038.926] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0038.926] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0038.926] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0038.926] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0038.926] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0038.926] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0038.926] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.927] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.927] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0038.927] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0038.927] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.927] lstrlenW (lpString="taskhost.exe") returned 12 [0038.927] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0038.928] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.928] lstrlenW (lpString="svchost.exe") returned 11 [0038.928] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0038.928] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0038.929] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0038.929] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0038.929] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.929] lstrlenW (lpString="taskeng.exe") returned 11 [0038.929] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0038.929] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0038.929] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.930] lstrlenW (lpString="taskhost.exe") returned 12 [0038.930] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0038.930] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0038.930] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0038.931] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0038.931] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0038.931] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0038.931] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0038.931] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0038.931] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0038.931] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0038.931] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0038.931] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0038.932] lstrlenW (lpString="locationshumanities.exe") returned 23 [0038.932] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0038.932] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0038.932] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0038.932] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0038.932] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0038.932] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0038.932] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0038.932] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0039.169] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0039.169] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0039.170] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0039.170] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0039.170] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0039.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0039.170] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0039.170] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0039.170] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0039.170] lstrlenW (lpString="decreased.exe") returned 13 [0039.171] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0039.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0039.171] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0039.171] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0039.171] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0039.171] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0039.171] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0039.171] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0039.171] lstrlenW (lpString="marcus instrument.exe") returned 21 [0039.171] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0039.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0039.171] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0039.172] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0039.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0039.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0039.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0039.172] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0039.172] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0039.172] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0039.172] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0039.173] lstrlenW (lpString="hdtv.exe") returned 8 [0039.173] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0039.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0039.173] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0039.173] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0039.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0039.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0039.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0039.173] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0039.174] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0039.174] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0039.174] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0039.174] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0039.174] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0039.174] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0039.174] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0039.174] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0039.174] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0039.175] lstrlenW (lpString="adjusted.exe") returned 12 [0039.175] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0039.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0039.175] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0039.175] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0039.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0039.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0039.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0039.175] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0039.176] lstrlenW (lpString="width_worker.exe") returned 16 [0039.176] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0039.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0039.176] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0039.177] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0039.177] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0039.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0039.177] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0039.177] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0039.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0039.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0039.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0039.177] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0039.178] lstrlenW (lpString="licensed.exe") returned 12 [0039.178] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0039.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0039.178] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0039.178] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0040.122] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x642f18 [0040.122] EnumServicesStatusExW (in: hSCManager=0x642f18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0040.123] GetLastError () returned 0xea [0040.123] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x63c630 [0040.123] EnumServicesStatusExW (in: hSCManager=0x642f18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63c630, cbBufSize=0x123e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63c630, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0040.123] CloseServiceHandle (hSCObject=0x642f18) returned 1 [0040.124] lstrlenW (lpString="Appinfo") returned 7 [0040.124] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.124] lstrlenW (lpString="AudioSrv") returned 8 [0040.124] lstrlenW (lpString="BFE") returned 3 [0040.124] lstrlenW (lpString="CryptSvc") returned 8 [0040.125] lstrlenW (lpString="CscService") returned 10 [0040.125] lstrlenW (lpString="DcomLaunch") returned 10 [0040.125] lstrlenW (lpString="Dhcp") returned 4 [0040.125] lstrlenW (lpString="Dnscache") returned 8 [0040.125] lstrlenW (lpString="DPS") returned 3 [0040.126] lstrlenW (lpString="eventlog") returned 8 [0040.126] lstrlenW (lpString="EventSystem") returned 11 [0040.126] lstrlenW (lpString="gpsvc") returned 5 [0040.126] lstrlenW (lpString="iphlpsvc") returned 8 [0040.126] lstrlenW (lpString="LanmanServer") returned 12 [0040.127] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.127] lstrlenW (lpString="lmhosts") returned 7 [0040.127] lstrlenW (lpString="MMCSS") returned 5 [0040.127] lstrlenW (lpString="MpsSvc") returned 6 [0040.127] lstrlenW (lpString="Netman") returned 6 [0040.128] lstrlenW (lpString="netprofm") returned 8 [0040.128] lstrlenW (lpString="NlaSvc") returned 6 [0040.128] lstrlenW (lpString="nsi") returned 3 [0040.128] lstrlenW (lpString="PcaSvc") returned 6 [0040.128] lstrlenW (lpString="PlugPlay") returned 8 [0040.129] lstrlenW (lpString="Power") returned 5 [0040.129] lstrlenW (lpString="ProfSvc") returned 7 [0040.129] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.129] lstrlenW (lpString="RpcSs") returned 5 [0040.129] lstrlenW (lpString="SamSs") returned 5 [0040.130] lstrlenW (lpString="Schedule") returned 8 [0040.130] lstrlenW (lpString="SENS") returned 4 [0040.130] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.130] lstrlenW (lpString="Spooler") returned 7 [0040.130] lstrlenW (lpString="SysMain") returned 7 [0040.131] lstrlenW (lpString="Themes") returned 6 [0040.131] lstrlenW (lpString="TrkWks") returned 6 [0040.131] lstrlenW (lpString="UxSms") returned 5 [0040.131] lstrlenW (lpString="VSS") returned 3 [0040.131] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.132] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.132] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.132] lstrlenW (lpString="Winmgmt") returned 7 [0040.132] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63c630 | out: hHeap=0x5c0000) returned 1 [0040.132] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0040.135] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.135] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.136] lstrlenW (lpString="System") returned 6 [0040.136] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.136] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.136] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.137] lstrlenW (lpString="smss.exe") returned 8 [0040.137] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.137] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.137] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.138] lstrlenW (lpString="csrss.exe") returned 9 [0040.138] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.138] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.138] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.138] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.138] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.138] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.138] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.138] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.139] lstrlenW (lpString="wininit.exe") returned 11 [0040.139] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.139] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.140] lstrlenW (lpString="csrss.exe") returned 9 [0040.140] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.140] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.140] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.141] lstrlenW (lpString="winlogon.exe") returned 12 [0040.141] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0040.141] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0040.141] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.142] lstrlenW (lpString="services.exe") returned 12 [0040.142] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0040.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0040.142] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.143] lstrlenW (lpString="lsass.exe") returned 9 [0040.143] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0040.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0040.143] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0040.143] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0040.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0040.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0040.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0040.143] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.143] lstrlenW (lpString="lsm.exe") returned 7 [0040.143] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0040.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0040.144] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0040.144] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0040.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0040.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0040.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0040.144] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.144] lstrlenW (lpString="svchost.exe") returned 11 [0040.144] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.144] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.144] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.145] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.145] lstrlenW (lpString="svchost.exe") returned 11 [0040.145] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.145] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.146] lstrlenW (lpString="svchost.exe") returned 11 [0040.146] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.146] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.147] lstrlenW (lpString="svchost.exe") returned 11 [0040.147] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.147] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.148] lstrlenW (lpString="svchost.exe") returned 11 [0040.148] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.148] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.149] lstrlenW (lpString="audiodg.exe") returned 11 [0040.149] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0040.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0040.149] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0040.149] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0040.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0040.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0040.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0040.149] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.150] lstrlenW (lpString="svchost.exe") returned 11 [0040.150] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.150] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.151] lstrlenW (lpString="svchost.exe") returned 11 [0040.151] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.151] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.152] lstrlenW (lpString="dwm.exe") returned 7 [0040.152] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0040.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0040.152] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0040.152] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0040.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0040.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0040.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0040.152] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.153] lstrlenW (lpString="explorer.exe") returned 12 [0040.153] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0040.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0040.153] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0040.153] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0040.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0040.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0040.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0040.153] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.154] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.154] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0040.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0040.154] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.154] lstrlenW (lpString="taskhost.exe") returned 12 [0040.154] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0040.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0040.155] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.155] lstrlenW (lpString="svchost.exe") returned 11 [0040.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.156] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.156] lstrlenW (lpString="taskeng.exe") returned 11 [0040.156] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0040.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0040.156] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.401] lstrlenW (lpString="taskhost.exe") returned 12 [0040.401] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0040.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0040.401] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0040.402] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0040.402] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0040.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0040.402] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0040.402] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0040.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0040.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0040.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0040.402] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0040.403] lstrlenW (lpString="locationshumanities.exe") returned 23 [0040.403] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0040.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0040.403] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0040.403] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0040.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0040.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0040.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0040.403] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0040.404] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0040.404] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0040.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0040.404] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0040.404] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0040.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0040.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0040.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0040.404] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0040.405] lstrlenW (lpString="decreased.exe") returned 13 [0040.405] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0040.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0040.405] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0040.405] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0040.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0040.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0040.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0040.405] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0040.406] lstrlenW (lpString="marcus instrument.exe") returned 21 [0040.406] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0040.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0040.406] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0040.406] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0040.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0040.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0040.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0040.406] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0040.407] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0040.407] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.407] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0040.408] lstrlenW (lpString="hdtv.exe") returned 8 [0040.408] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0040.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0040.408] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0040.408] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0040.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0040.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0040.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0040.408] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0040.409] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0040.409] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0040.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0040.409] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0040.409] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0040.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0040.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0040.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0040.409] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0040.410] lstrlenW (lpString="adjusted.exe") returned 12 [0040.410] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0040.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0040.410] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0040.410] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0040.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0040.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0040.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0040.410] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0040.411] lstrlenW (lpString="width_worker.exe") returned 16 [0040.411] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0040.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0040.411] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0040.412] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0040.412] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0040.412] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0040.412] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0040.412] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0040.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0040.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0040.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0040.412] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0040.413] lstrlenW (lpString="licensed.exe") returned 12 [0040.413] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0040.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0040.413] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0040.413] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0040.949] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643080 [0040.949] EnumServicesStatusExW (in: hSCManager=0x643080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0040.950] GetLastError () returned 0xea [0040.950] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x64a468 [0040.950] EnumServicesStatusExW (in: hSCManager=0x643080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x123e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0040.951] CloseServiceHandle (hSCObject=0x643080) returned 1 [0040.951] lstrlenW (lpString="Appinfo") returned 7 [0040.951] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0040.953] Process32FirstW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.954] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.955] lstrlenW (lpString="System") returned 6 [0040.955] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.955] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.956] lstrlenW (lpString="smss.exe") returned 8 [0040.956] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.956] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.956] lstrlenW (lpString="csrss.exe") returned 9 [0040.956] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.957] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.957] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.957] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.957] lstrlenW (lpString="wininit.exe") returned 11 [0040.957] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.957] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.957] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.958] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.958] lstrlenW (lpString="csrss.exe") returned 9 [0040.958] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.958] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.958] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.958] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.959] lstrlenW (lpString="winlogon.exe") returned 12 [0040.959] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0040.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0040.959] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.960] lstrlenW (lpString="services.exe") returned 12 [0040.960] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0040.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0040.960] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.961] lstrlenW (lpString="lsass.exe") returned 9 [0040.961] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0040.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0040.961] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0040.961] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0040.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0040.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0040.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0040.961] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.962] lstrlenW (lpString="lsm.exe") returned 7 [0040.962] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0040.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0040.962] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0040.962] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0040.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0040.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0040.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0040.962] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.963] lstrlenW (lpString="svchost.exe") returned 11 [0040.963] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.963] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.964] lstrlenW (lpString="svchost.exe") returned 11 [0040.964] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.964] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.964] lstrlenW (lpString="svchost.exe") returned 11 [0040.964] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.965] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.965] lstrlenW (lpString="svchost.exe") returned 11 [0040.965] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.966] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.966] lstrlenW (lpString="svchost.exe") returned 11 [0040.966] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.966] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.967] lstrlenW (lpString="audiodg.exe") returned 11 [0040.967] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0040.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0040.967] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0040.967] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0040.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0040.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0040.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0040.968] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.968] lstrlenW (lpString="svchost.exe") returned 11 [0040.968] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.968] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.969] lstrlenW (lpString="svchost.exe") returned 11 [0040.969] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.969] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.979] lstrlenW (lpString="dwm.exe") returned 7 [0040.979] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0040.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0040.979] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0040.979] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0040.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0040.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0040.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0040.979] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.980] lstrlenW (lpString="explorer.exe") returned 12 [0040.980] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0040.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0040.980] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0040.980] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0040.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0040.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0040.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0040.980] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.981] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.981] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0040.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0040.981] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.981] lstrlenW (lpString="taskhost.exe") returned 12 [0040.981] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0040.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0040.981] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0040.982] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.982] lstrlenW (lpString="svchost.exe") returned 11 [0040.982] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0040.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0040.983] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.983] lstrlenW (lpString="taskeng.exe") returned 11 [0040.983] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0040.983] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0040.983] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.984] lstrlenW (lpString="taskhost.exe") returned 12 [0040.984] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0040.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0040.984] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0040.985] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0040.985] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0040.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0040.985] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0040.985] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0040.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0040.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0040.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0040.985] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0040.986] lstrlenW (lpString="locationshumanities.exe") returned 23 [0040.986] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0040.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0040.986] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0040.986] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0040.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0040.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0040.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0040.986] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0040.987] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0040.987] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0040.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0040.987] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0040.987] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0040.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0040.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0040.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0040.987] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0040.988] lstrlenW (lpString="decreased.exe") returned 13 [0040.988] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0040.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0040.988] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0040.988] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0040.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0040.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0040.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0040.988] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0040.988] lstrlenW (lpString="marcus instrument.exe") returned 21 [0040.988] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0040.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0040.988] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0040.989] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0040.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0040.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0040.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0040.989] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0040.989] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0040.989] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0040.989] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0040.990] lstrlenW (lpString="hdtv.exe") returned 8 [0040.990] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0040.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0040.990] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0040.990] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0040.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0040.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0040.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0040.990] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0040.991] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0040.991] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0040.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0040.991] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0040.991] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0040.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0040.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0040.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0040.991] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0041.089] lstrlenW (lpString="adjusted.exe") returned 12 [0041.089] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0041.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0041.090] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0041.090] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0041.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0041.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0041.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0041.090] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0041.090] lstrlenW (lpString="width_worker.exe") returned 16 [0041.090] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0041.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0041.090] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0041.091] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0041.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0041.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0041.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0041.091] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0041.091] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0041.091] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0041.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0041.091] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.091] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.092] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0041.092] lstrlenW (lpString="licensed.exe") returned 12 [0041.092] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0041.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0041.092] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0041.092] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0041.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6430d0 [0041.863] EnumServicesStatusExW (in: hSCManager=0x6430d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0041.863] GetLastError () returned 0xea [0041.863] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x64a468 [0041.864] EnumServicesStatusExW (in: hSCManager=0x6430d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x123e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0041.864] CloseServiceHandle (hSCObject=0x6430d0) returned 1 [0041.864] lstrlenW (lpString="Appinfo") returned 7 [0041.865] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0041.867] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.870] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.871] lstrlenW (lpString="System") returned 6 [0041.871] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.871] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.872] lstrlenW (lpString="smss.exe") returned 8 [0041.872] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.872] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.873] lstrlenW (lpString="csrss.exe") returned 9 [0041.873] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.873] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.873] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.873] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.873] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.873] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.873] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.874] lstrlenW (lpString="wininit.exe") returned 11 [0041.874] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.874] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.875] lstrlenW (lpString="csrss.exe") returned 9 [0041.875] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.875] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.875] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.875] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.876] lstrlenW (lpString="winlogon.exe") returned 12 [0041.876] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0041.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0041.876] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.877] lstrlenW (lpString="services.exe") returned 12 [0041.877] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0041.877] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0041.877] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.878] lstrlenW (lpString="lsass.exe") returned 9 [0041.878] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0041.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0041.878] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0041.878] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0041.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0041.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0041.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0041.878] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.879] lstrlenW (lpString="lsm.exe") returned 7 [0041.879] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0041.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0041.879] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0041.879] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0041.879] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0041.879] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0041.879] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0041.879] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.880] lstrlenW (lpString="svchost.exe") returned 11 [0041.880] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.880] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.881] lstrlenW (lpString="svchost.exe") returned 11 [0041.881] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.881] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.882] lstrlenW (lpString="svchost.exe") returned 11 [0041.882] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.882] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.883] lstrlenW (lpString="svchost.exe") returned 11 [0041.883] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.883] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.884] lstrlenW (lpString="svchost.exe") returned 11 [0041.884] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.884] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.885] lstrlenW (lpString="audiodg.exe") returned 11 [0041.885] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0041.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0041.885] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0041.885] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0041.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0041.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0041.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0041.885] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.885] lstrlenW (lpString="svchost.exe") returned 11 [0041.885] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.886] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.886] lstrlenW (lpString="svchost.exe") returned 11 [0041.886] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.887] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.887] lstrlenW (lpString="dwm.exe") returned 7 [0041.887] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0041.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0041.888] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0041.888] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0041.888] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0041.888] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0041.888] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0041.888] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.888] lstrlenW (lpString="explorer.exe") returned 12 [0041.888] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0041.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0041.888] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0041.889] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0041.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0041.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0041.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0041.889] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.889] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.889] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0041.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0041.890] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.890] lstrlenW (lpString="taskhost.exe") returned 12 [0041.890] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0041.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0041.890] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.891] lstrlenW (lpString="svchost.exe") returned 11 [0041.891] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0041.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0041.891] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.892] lstrlenW (lpString="taskeng.exe") returned 11 [0041.892] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0041.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0041.892] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.893] lstrlenW (lpString="taskhost.exe") returned 12 [0041.893] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0041.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0041.893] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0041.894] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0041.894] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0041.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0041.894] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0041.894] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0041.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0041.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0041.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0041.894] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0041.895] lstrlenW (lpString="locationshumanities.exe") returned 23 [0041.895] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0041.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0041.895] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0041.895] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0041.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0041.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0041.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0041.895] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0041.895] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0041.895] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0041.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0041.896] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0041.896] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0041.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0041.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0041.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0041.896] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0041.896] lstrlenW (lpString="decreased.exe") returned 13 [0041.896] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0041.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0041.896] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0041.896] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0041.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0041.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0041.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0041.897] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0041.897] lstrlenW (lpString="marcus instrument.exe") returned 21 [0041.897] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0041.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0041.897] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0041.897] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0041.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0041.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0041.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0041.898] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0041.898] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0041.898] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0041.898] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0041.899] lstrlenW (lpString="hdtv.exe") returned 8 [0041.899] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0041.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0041.899] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0041.899] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0041.899] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0041.899] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0041.899] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0041.899] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0041.900] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0041.900] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0041.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0041.900] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0041.900] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0041.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0041.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0041.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0041.900] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0041.901] lstrlenW (lpString="adjusted.exe") returned 12 [0041.901] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0041.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0041.901] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0041.901] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0041.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0041.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0041.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0041.901] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0041.902] lstrlenW (lpString="width_worker.exe") returned 16 [0041.902] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0041.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0041.902] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0041.903] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0041.903] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0041.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0041.903] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.903] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.903] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0041.903] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0042.151] lstrlenW (lpString="licensed.exe") returned 12 [0042.151] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0042.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0042.151] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0042.151] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0043.010] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643120 [0043.011] EnumServicesStatusExW (in: hSCManager=0x643120, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0043.011] GetLastError () returned 0xea [0043.011] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x40b8640 [0043.011] EnumServicesStatusExW (in: hSCManager=0x643120, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40b8640, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40b8640, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0043.012] CloseServiceHandle (hSCObject=0x643120) returned 1 [0043.012] lstrlenW (lpString="Appinfo") returned 7 [0043.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0043.017] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.017] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.018] lstrlenW (lpString="System") returned 6 [0043.018] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.018] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.019] lstrlenW (lpString="smss.exe") returned 8 [0043.019] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.019] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.020] lstrlenW (lpString="csrss.exe") returned 9 [0043.020] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.020] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.020] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.020] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.021] lstrlenW (lpString="wininit.exe") returned 11 [0043.021] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.021] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.022] lstrlenW (lpString="csrss.exe") returned 9 [0043.022] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.022] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.022] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.022] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.023] lstrlenW (lpString="winlogon.exe") returned 12 [0043.023] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0043.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0043.023] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.024] lstrlenW (lpString="services.exe") returned 12 [0043.024] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0043.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0043.024] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.025] lstrlenW (lpString="lsass.exe") returned 9 [0043.025] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0043.025] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0043.025] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0043.025] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0043.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0043.025] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0043.025] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0043.025] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.025] lstrlenW (lpString="lsm.exe") returned 7 [0043.026] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0043.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0043.026] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0043.026] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0043.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0043.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0043.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0043.026] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.026] lstrlenW (lpString="svchost.exe") returned 11 [0043.026] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.026] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.026] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.027] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.027] lstrlenW (lpString="svchost.exe") returned 11 [0043.027] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.027] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.028] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.028] lstrlenW (lpString="svchost.exe") returned 11 [0043.028] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.028] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.029] lstrlenW (lpString="svchost.exe") returned 11 [0043.029] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.029] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.029] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.030] lstrlenW (lpString="svchost.exe") returned 11 [0043.030] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.030] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.030] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.031] lstrlenW (lpString="audiodg.exe") returned 11 [0043.031] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0043.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0043.031] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0043.031] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0043.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0043.031] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0043.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0043.031] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.032] lstrlenW (lpString="svchost.exe") returned 11 [0043.032] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.032] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.033] lstrlenW (lpString="svchost.exe") returned 11 [0043.033] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.033] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.034] lstrlenW (lpString="dwm.exe") returned 7 [0043.034] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0043.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0043.034] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0043.034] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0043.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0043.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0043.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0043.034] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.034] lstrlenW (lpString="explorer.exe") returned 12 [0043.034] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0043.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0043.035] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0043.035] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0043.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0043.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0043.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0043.035] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.042] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.042] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0043.042] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0043.042] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.043] lstrlenW (lpString="taskhost.exe") returned 12 [0043.043] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0043.043] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0043.043] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.044] lstrlenW (lpString="svchost.exe") returned 11 [0043.044] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0043.044] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0043.044] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.045] lstrlenW (lpString="taskeng.exe") returned 11 [0043.045] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0043.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0043.045] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.045] lstrlenW (lpString="taskhost.exe") returned 12 [0043.045] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0043.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0043.045] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0043.046] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0043.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0043.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0043.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0043.046] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0043.046] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0043.046] lstrcmpiW (lpString1="1c8.exe", lpString2="first-nc-parking.exe") returned -1 [0043.046] lstrcmpiW (lpString1="1cv77.exe", lpString2="first-nc-parking.exe") returned -1 [0043.046] lstrcmpiW (lpString1="outlook.exe", lpString2="first-nc-parking.exe") returned 1 [0043.046] lstrcmpiW (lpString1="postgres.exe", lpString2="first-nc-parking.exe") returned 1 [0043.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="first-nc-parking.exe") returned 1 [0043.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="first-nc-parking.exe") returned 1 [0043.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="first-nc-parking.exe") returned 1 [0043.047] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0043.047] lstrlenW (lpString="locationshumanities.exe") returned 23 [0043.047] lstrcmpiW (lpString1="1c8.exe", lpString2="locationshumanities.exe") returned -1 [0043.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="locationshumanities.exe") returned -1 [0043.047] lstrcmpiW (lpString1="outlook.exe", lpString2="locationshumanities.exe") returned 1 [0043.047] lstrcmpiW (lpString1="postgres.exe", lpString2="locationshumanities.exe") returned 1 [0043.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="locationshumanities.exe") returned 1 [0043.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="locationshumanities.exe") returned 1 [0043.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="locationshumanities.exe") returned 1 [0043.047] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0043.048] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0043.048] lstrcmpiW (lpString1="1c8.exe", lpString2="absadministrationronald.exe") returned -1 [0043.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="absadministrationronald.exe") returned -1 [0043.048] lstrcmpiW (lpString1="outlook.exe", lpString2="absadministrationronald.exe") returned 1 [0043.048] lstrcmpiW (lpString1="postgres.exe", lpString2="absadministrationronald.exe") returned 1 [0043.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="absadministrationronald.exe") returned 1 [0043.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="absadministrationronald.exe") returned 1 [0043.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="absadministrationronald.exe") returned 1 [0043.048] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0043.049] lstrlenW (lpString="decreased.exe") returned 13 [0043.049] lstrcmpiW (lpString1="1c8.exe", lpString2="decreased.exe") returned -1 [0043.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="decreased.exe") returned -1 [0043.049] lstrcmpiW (lpString1="outlook.exe", lpString2="decreased.exe") returned 1 [0043.049] lstrcmpiW (lpString1="postgres.exe", lpString2="decreased.exe") returned 1 [0043.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="decreased.exe") returned 1 [0043.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="decreased.exe") returned 1 [0043.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="decreased.exe") returned 1 [0043.049] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0043.396] lstrlenW (lpString="marcus instrument.exe") returned 21 [0043.401] lstrcmpiW (lpString1="1c8.exe", lpString2="marcus instrument.exe") returned -1 [0043.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="marcus instrument.exe") returned -1 [0043.402] lstrcmpiW (lpString1="outlook.exe", lpString2="marcus instrument.exe") returned 1 [0043.402] lstrcmpiW (lpString1="postgres.exe", lpString2="marcus instrument.exe") returned 1 [0043.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="marcus instrument.exe") returned 1 [0043.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="marcus instrument.exe") returned 1 [0043.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="marcus instrument.exe") returned 1 [0043.402] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0043.402] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0043.402] lstrcmpiW (lpString1="1c8.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] lstrcmpiW (lpString1="outlook.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] lstrcmpiW (lpString1="postgres.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="techniquesconsolidated.exe") returned -1 [0043.403] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0043.403] lstrlenW (lpString="hdtv.exe") returned 8 [0043.403] lstrcmpiW (lpString1="1c8.exe", lpString2="hdtv.exe") returned -1 [0043.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="hdtv.exe") returned -1 [0043.403] lstrcmpiW (lpString1="outlook.exe", lpString2="hdtv.exe") returned 1 [0043.403] lstrcmpiW (lpString1="postgres.exe", lpString2="hdtv.exe") returned 1 [0043.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hdtv.exe") returned 1 [0043.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="hdtv.exe") returned 1 [0043.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hdtv.exe") returned 1 [0043.404] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0043.404] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0043.404] lstrcmpiW (lpString1="1c8.exe", lpString2="funky-java-applies.exe") returned -1 [0043.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="funky-java-applies.exe") returned -1 [0043.404] lstrcmpiW (lpString1="outlook.exe", lpString2="funky-java-applies.exe") returned 1 [0043.404] lstrcmpiW (lpString1="postgres.exe", lpString2="funky-java-applies.exe") returned 1 [0043.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="funky-java-applies.exe") returned 1 [0043.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="funky-java-applies.exe") returned 1 [0043.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="funky-java-applies.exe") returned 1 [0043.404] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0043.405] lstrlenW (lpString="adjusted.exe") returned 12 [0043.405] lstrcmpiW (lpString1="1c8.exe", lpString2="adjusted.exe") returned -1 [0043.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="adjusted.exe") returned -1 [0043.405] lstrcmpiW (lpString1="outlook.exe", lpString2="adjusted.exe") returned 1 [0043.405] lstrcmpiW (lpString1="postgres.exe", lpString2="adjusted.exe") returned 1 [0043.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="adjusted.exe") returned 1 [0043.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="adjusted.exe") returned 1 [0043.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="adjusted.exe") returned 1 [0043.405] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0043.406] lstrlenW (lpString="width_worker.exe") returned 16 [0043.406] lstrcmpiW (lpString1="1c8.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="outlook.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="postgres.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="width_worker.exe") returned -1 [0043.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="width_worker.exe") returned -1 [0043.406] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0043.407] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0043.407] lstrcmpiW (lpString1="1c8.exe", lpString2="markers municipal assignments.exe") returned -1 [0043.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="markers municipal assignments.exe") returned -1 [0043.407] lstrcmpiW (lpString1="outlook.exe", lpString2="markers municipal assignments.exe") returned 1 [0043.407] lstrcmpiW (lpString1="postgres.exe", lpString2="markers municipal assignments.exe") returned 1 [0043.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="markers municipal assignments.exe") returned 1 [0043.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="markers municipal assignments.exe") returned 1 [0043.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="markers municipal assignments.exe") returned 1 [0043.407] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0043.408] lstrlenW (lpString="licensed.exe") returned 12 [0043.408] lstrcmpiW (lpString1="1c8.exe", lpString2="licensed.exe") returned -1 [0043.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="licensed.exe") returned -1 [0043.408] lstrcmpiW (lpString1="outlook.exe", lpString2="licensed.exe") returned 1 [0043.408] lstrcmpiW (lpString1="postgres.exe", lpString2="licensed.exe") returned 1 [0043.408] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0043.409] lstrlenW (lpString="rocket.exe") returned 10 [0043.409] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0043.409] lstrlenW (lpString="alexander motel.exe") returned 19 [0043.409] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0043.410] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0043.410] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0043.411] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0043.411] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0043.411] lstrlenW (lpString="shall.exe") returned 9 [0043.411] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0043.412] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0043.412] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0043.413] lstrlenW (lpString="fax fixtures.exe") returned 16 [0043.413] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.414] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.414] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0043.414] lstrlenW (lpString="rruzcj.exe") returned 10 [0043.414] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.415] lstrlenW (lpString="cmd.exe") returned 7 [0043.415] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.416] lstrlenW (lpString="conhost.exe") returned 11 [0043.416] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.416] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.416] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.417] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.417] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.418] lstrlenW (lpString="svchost.exe") returned 11 [0043.418] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0043.418] CloseHandle (hObject=0x1fc) returned 1 [0043.418] Sleep (dwMilliseconds=0x1f4) [0044.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643198 [0044.271] EnumServicesStatusExW (in: hSCManager=0x643198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0044.271] GetLastError () returned 0xea [0044.271] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0044.272] EnumServicesStatusExW (in: hSCManager=0x643198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0044.272] CloseServiceHandle (hSCObject=0x643198) returned 1 [0044.273] lstrlenW (lpString="Appinfo") returned 7 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.273] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.273] lstrlenW (lpString="AudioSrv") returned 8 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.273] lstrlenW (lpString="BFE") returned 3 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.273] lstrlenW (lpString="CryptSvc") returned 8 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.273] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.273] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.273] lstrlenW (lpString="CscService") returned 10 [0044.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.274] lstrlenW (lpString="DcomLaunch") returned 10 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.274] lstrlenW (lpString="Dhcp") returned 4 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.274] lstrlenW (lpString="Dnscache") returned 8 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.274] lstrlenW (lpString="DPS") returned 3 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.274] lstrlenW (lpString="eventlog") returned 8 [0044.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.274] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.274] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.274] lstrlenW (lpString="EventSystem") returned 11 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.275] lstrlenW (lpString="gpsvc") returned 5 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.275] lstrlenW (lpString="iphlpsvc") returned 8 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.275] lstrlenW (lpString="LanmanServer") returned 12 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.275] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.275] lstrlenW (lpString="lmhosts") returned 7 [0044.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.275] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.275] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.276] lstrlenW (lpString="MMCSS") returned 5 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.276] lstrlenW (lpString="MpsSvc") returned 6 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.276] lstrlenW (lpString="Netman") returned 6 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.276] lstrlenW (lpString="netprofm") returned 8 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.276] lstrlenW (lpString="NlaSvc") returned 6 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.276] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.276] lstrlenW (lpString="nsi") returned 3 [0044.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.276] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.277] lstrlenW (lpString="PcaSvc") returned 6 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.277] lstrlenW (lpString="PlugPlay") returned 8 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.277] lstrlenW (lpString="Power") returned 5 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.277] lstrlenW (lpString="ProfSvc") returned 7 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.277] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.277] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.277] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.277] lstrlenW (lpString="RpcSs") returned 5 [0044.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.278] lstrlenW (lpString="SamSs") returned 5 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.278] lstrlenW (lpString="Schedule") returned 8 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.278] lstrlenW (lpString="SENS") returned 4 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.278] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.278] lstrlenW (lpString="Spooler") returned 7 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.279] lstrlenW (lpString="swprv") returned 5 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.279] lstrlenW (lpString="SysMain") returned 7 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.279] lstrlenW (lpString="Themes") returned 6 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.279] lstrlenW (lpString="TrkWks") returned 6 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.279] lstrlenW (lpString="UxSms") returned 5 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.279] lstrlenW (lpString="VSS") returned 3 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.280] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.280] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.280] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.280] lstrlenW (lpString="Winmgmt") returned 7 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.280] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0044.281] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0044.283] Process32FirstW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.283] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.284] lstrlenW (lpString="System") returned 6 [0044.284] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.284] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.285] lstrlenW (lpString="smss.exe") returned 8 [0044.285] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.285] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.286] lstrlenW (lpString="csrss.exe") returned 9 [0044.286] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.286] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.286] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.286] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.286] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.287] lstrlenW (lpString="wininit.exe") returned 11 [0044.287] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.287] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.287] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.288] lstrlenW (lpString="csrss.exe") returned 9 [0044.288] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.288] lstrlenW (lpString="winlogon.exe") returned 12 [0044.288] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.289] lstrlenW (lpString="services.exe") returned 12 [0044.289] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.290] lstrlenW (lpString="lsass.exe") returned 9 [0044.290] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.291] lstrlenW (lpString="lsm.exe") returned 7 [0044.291] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.291] lstrlenW (lpString="svchost.exe") returned 11 [0044.291] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.292] lstrlenW (lpString="svchost.exe") returned 11 [0044.292] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.293] lstrlenW (lpString="svchost.exe") returned 11 [0044.293] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.294] lstrlenW (lpString="svchost.exe") returned 11 [0044.294] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.294] lstrlenW (lpString="svchost.exe") returned 11 [0044.295] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.295] lstrlenW (lpString="audiodg.exe") returned 11 [0044.295] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.296] lstrlenW (lpString="svchost.exe") returned 11 [0044.296] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.297] lstrlenW (lpString="svchost.exe") returned 11 [0044.297] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.297] lstrlenW (lpString="dwm.exe") returned 7 [0044.297] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.298] lstrlenW (lpString="explorer.exe") returned 12 [0044.298] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.299] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.299] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.300] lstrlenW (lpString="taskhost.exe") returned 12 [0044.300] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.300] lstrlenW (lpString="svchost.exe") returned 11 [0044.300] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.301] lstrlenW (lpString="taskeng.exe") returned 11 [0044.301] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.302] lstrlenW (lpString="taskhost.exe") returned 12 [0044.302] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0044.303] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0044.303] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0044.303] lstrlenW (lpString="locationshumanities.exe") returned 23 [0044.303] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0044.304] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0044.304] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0044.305] lstrlenW (lpString="decreased.exe") returned 13 [0044.305] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0044.305] lstrlenW (lpString="marcus instrument.exe") returned 21 [0044.305] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0044.492] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0044.492] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0044.492] lstrlenW (lpString="hdtv.exe") returned 8 [0044.492] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0044.493] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0044.493] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0044.494] lstrlenW (lpString="adjusted.exe") returned 12 [0044.494] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0044.494] lstrlenW (lpString="width_worker.exe") returned 16 [0044.495] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0044.495] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0044.495] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0044.496] lstrlenW (lpString="licensed.exe") returned 12 [0044.496] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0044.497] lstrlenW (lpString="rocket.exe") returned 10 [0044.497] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0044.497] lstrlenW (lpString="alexander motel.exe") returned 19 [0044.497] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0044.498] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0044.498] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0044.499] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0044.499] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0044.499] lstrlenW (lpString="shall.exe") returned 9 [0044.499] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0044.500] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0044.500] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0044.501] lstrlenW (lpString="fax fixtures.exe") returned 16 [0044.501] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.501] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.502] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0044.502] lstrlenW (lpString="rruzcj.exe") returned 10 [0044.502] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.503] lstrlenW (lpString="cmd.exe") returned 7 [0044.503] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.504] lstrlenW (lpString="conhost.exe") returned 11 [0044.504] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.504] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.504] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.505] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.505] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.506] lstrlenW (lpString="svchost.exe") returned 11 [0044.506] Process32NextW (in: hSnapshot=0x16c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.506] CloseHandle (hObject=0x16c) returned 1 [0044.506] Sleep (dwMilliseconds=0x1f4) [0045.368] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643210 [0045.369] EnumServicesStatusExW (in: hSCManager=0x643210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0045.369] GetLastError () returned 0xea [0045.369] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0045.369] EnumServicesStatusExW (in: hSCManager=0x643210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0045.370] CloseServiceHandle (hSCObject=0x643210) returned 1 [0045.370] lstrlenW (lpString="Appinfo") returned 7 [0045.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.370] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.370] lstrlenW (lpString="AudioSrv") returned 8 [0045.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.371] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.371] lstrlenW (lpString="BFE") returned 3 [0045.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.371] lstrlenW (lpString="CryptSvc") returned 8 [0045.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.371] lstrlenW (lpString="CscService") returned 10 [0045.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.371] lstrlenW (lpString="DcomLaunch") returned 10 [0045.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.371] lstrlenW (lpString="Dhcp") returned 4 [0045.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.372] lstrlenW (lpString="Dnscache") returned 8 [0045.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.372] lstrlenW (lpString="DPS") returned 3 [0045.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.372] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.372] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.372] lstrlenW (lpString="eventlog") returned 8 [0045.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.372] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.372] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.372] lstrlenW (lpString="EventSystem") returned 11 [0045.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.372] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.372] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.372] lstrlenW (lpString="gpsvc") returned 5 [0045.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.372] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.373] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.373] lstrlenW (lpString="iphlpsvc") returned 8 [0045.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.373] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.373] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.373] lstrlenW (lpString="LanmanServer") returned 12 [0045.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.373] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.373] lstrlenW (lpString="lmhosts") returned 7 [0045.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.373] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.373] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.373] lstrlenW (lpString="MMCSS") returned 5 [0045.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.373] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.374] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.374] lstrlenW (lpString="MpsSvc") returned 6 [0045.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.374] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.374] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.374] lstrlenW (lpString="Netman") returned 6 [0045.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.374] lstrlenW (lpString="netprofm") returned 8 [0045.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.374] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.374] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.374] lstrlenW (lpString="NlaSvc") returned 6 [0045.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.374] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.374] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.374] lstrlenW (lpString="nsi") returned 3 [0045.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.374] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.375] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.375] lstrlenW (lpString="PcaSvc") returned 6 [0045.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.375] lstrlenW (lpString="PlugPlay") returned 8 [0045.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.375] lstrlenW (lpString="Power") returned 5 [0045.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.375] lstrlenW (lpString="ProfSvc") returned 7 [0045.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.375] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.376] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.376] lstrlenW (lpString="RpcSs") returned 5 [0045.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.376] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.376] lstrlenW (lpString="SamSs") returned 5 [0045.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.376] lstrlenW (lpString="Schedule") returned 8 [0045.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.377] lstrlenW (lpString="SENS") returned 4 [0045.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.377] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.377] lstrlenW (lpString="Spooler") returned 7 [0045.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.377] lstrlenW (lpString="swprv") returned 5 [0045.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.377] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.377] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.377] lstrlenW (lpString="SysMain") returned 7 [0045.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.378] lstrlenW (lpString="Themes") returned 6 [0045.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.378] lstrlenW (lpString="TrkWks") returned 6 [0045.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.378] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.378] lstrlenW (lpString="UxSms") returned 5 [0045.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.378] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.378] lstrlenW (lpString="VSS") returned 3 [0045.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.378] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.378] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.379] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.379] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.379] lstrlenW (lpString="Winmgmt") returned 7 [0045.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.379] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.379] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0045.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0045.382] Process32FirstW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.382] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.383] lstrlenW (lpString="System") returned 6 [0045.383] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.383] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.384] lstrlenW (lpString="smss.exe") returned 8 [0045.384] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.384] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.385] lstrlenW (lpString="csrss.exe") returned 9 [0045.385] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.385] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.385] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.385] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.386] lstrlenW (lpString="wininit.exe") returned 11 [0045.386] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.386] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.386] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.387] lstrlenW (lpString="csrss.exe") returned 9 [0045.387] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.387] lstrlenW (lpString="winlogon.exe") returned 12 [0045.387] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.388] lstrlenW (lpString="services.exe") returned 12 [0045.388] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.389] lstrlenW (lpString="lsass.exe") returned 9 [0045.389] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.389] lstrlenW (lpString="lsm.exe") returned 7 [0045.389] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.390] lstrlenW (lpString="svchost.exe") returned 11 [0045.390] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.391] lstrlenW (lpString="svchost.exe") returned 11 [0045.391] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.392] lstrlenW (lpString="svchost.exe") returned 11 [0045.392] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.392] lstrlenW (lpString="svchost.exe") returned 11 [0045.392] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.393] lstrlenW (lpString="svchost.exe") returned 11 [0045.393] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.394] lstrlenW (lpString="audiodg.exe") returned 11 [0045.394] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.395] lstrlenW (lpString="svchost.exe") returned 11 [0045.395] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.395] lstrlenW (lpString="svchost.exe") returned 11 [0045.395] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.396] lstrlenW (lpString="dwm.exe") returned 7 [0045.396] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.397] lstrlenW (lpString="explorer.exe") returned 12 [0045.397] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.397] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.397] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.398] lstrlenW (lpString="taskhost.exe") returned 12 [0045.398] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.399] lstrlenW (lpString="svchost.exe") returned 11 [0045.399] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.399] lstrlenW (lpString="taskeng.exe") returned 11 [0045.400] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.400] lstrlenW (lpString="taskhost.exe") returned 12 [0045.400] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0045.401] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0045.401] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0045.402] lstrlenW (lpString="locationshumanities.exe") returned 23 [0045.402] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0045.402] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0045.402] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0045.403] lstrlenW (lpString="decreased.exe") returned 13 [0045.403] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0045.404] lstrlenW (lpString="marcus instrument.exe") returned 21 [0045.404] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0045.404] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0045.404] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0045.592] lstrlenW (lpString="hdtv.exe") returned 8 [0045.592] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0045.593] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0045.593] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0045.593] lstrlenW (lpString="adjusted.exe") returned 12 [0045.593] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0045.594] lstrlenW (lpString="width_worker.exe") returned 16 [0045.594] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0045.595] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0045.595] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0045.596] lstrlenW (lpString="licensed.exe") returned 12 [0045.596] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0045.596] lstrlenW (lpString="rocket.exe") returned 10 [0045.596] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0045.597] lstrlenW (lpString="alexander motel.exe") returned 19 [0045.597] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0045.598] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0045.598] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0045.598] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0045.598] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0045.599] lstrlenW (lpString="shall.exe") returned 9 [0045.599] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0045.600] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0045.600] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0045.600] lstrlenW (lpString="fax fixtures.exe") returned 16 [0045.600] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.601] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.601] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0045.602] lstrlenW (lpString="rruzcj.exe") returned 10 [0045.602] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.603] lstrlenW (lpString="cmd.exe") returned 7 [0045.603] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.603] lstrlenW (lpString="conhost.exe") returned 11 [0045.603] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.604] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.604] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.605] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.605] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.605] lstrlenW (lpString="svchost.exe") returned 11 [0045.605] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.606] CloseHandle (hObject=0x208) returned 1 [0045.606] Sleep (dwMilliseconds=0x1f4) [0046.382] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a0d8 [0046.383] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0046.383] GetLastError () returned 0xea [0046.383] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0046.383] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0046.384] CloseServiceHandle (hSCObject=0x62a0d8) returned 1 [0046.384] lstrlenW (lpString="Appinfo") returned 7 [0046.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.384] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.384] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.384] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.384] lstrlenW (lpString="AudioSrv") returned 8 [0046.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.384] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.384] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.384] lstrlenW (lpString="BFE") returned 3 [0046.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.385] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.385] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.385] lstrlenW (lpString="CryptSvc") returned 8 [0046.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.385] lstrlenW (lpString="CscService") returned 10 [0046.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.385] lstrlenW (lpString="DcomLaunch") returned 10 [0046.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.385] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.385] lstrlenW (lpString="Dhcp") returned 4 [0046.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.385] lstrlenW (lpString="Dnscache") returned 8 [0046.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.386] lstrlenW (lpString="DPS") returned 3 [0046.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.386] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.386] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.386] lstrlenW (lpString="eventlog") returned 8 [0046.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.386] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.386] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.386] lstrlenW (lpString="EventSystem") returned 11 [0046.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.386] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.386] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.386] lstrlenW (lpString="gpsvc") returned 5 [0046.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.386] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.386] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.386] lstrlenW (lpString="iphlpsvc") returned 8 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.387] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.387] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.387] lstrlenW (lpString="LanmanServer") returned 12 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.387] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.387] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.387] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.387] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.387] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.387] lstrlenW (lpString="lmhosts") returned 7 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.387] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.387] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.387] lstrlenW (lpString="MMCSS") returned 5 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.387] lstrlenW (lpString="MpsSvc") returned 6 [0046.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.388] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.388] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.388] lstrlenW (lpString="Netman") returned 6 [0046.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.388] lstrlenW (lpString="netprofm") returned 8 [0046.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.388] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.388] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.388] lstrlenW (lpString="NlaSvc") returned 6 [0046.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.388] lstrlenW (lpString="nsi") returned 3 [0046.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.388] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.388] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.388] lstrlenW (lpString="PcaSvc") returned 6 [0046.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.389] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.389] lstrlenW (lpString="PlugPlay") returned 8 [0046.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.389] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.389] lstrlenW (lpString="Power") returned 5 [0046.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.389] lstrlenW (lpString="ProfSvc") returned 7 [0046.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.389] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.389] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.389] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.389] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.390] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.390] lstrlenW (lpString="RpcSs") returned 5 [0046.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.390] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.390] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.390] lstrlenW (lpString="SamSs") returned 5 [0046.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.391] lstrlenW (lpString="Schedule") returned 8 [0046.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.391] lstrlenW (lpString="SENS") returned 4 [0046.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.391] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.391] lstrlenW (lpString="Spooler") returned 7 [0046.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.391] lstrlenW (lpString="swprv") returned 5 [0046.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.391] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.391] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.392] lstrlenW (lpString="SysMain") returned 7 [0046.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.392] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.392] lstrlenW (lpString="Themes") returned 6 [0046.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.392] lstrlenW (lpString="TrkWks") returned 6 [0046.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.392] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.392] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.392] lstrlenW (lpString="UxSms") returned 5 [0046.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.392] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.392] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.392] lstrlenW (lpString="VSS") returned 3 [0046.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.392] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.392] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.393] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.393] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.393] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.393] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.393] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.393] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.393] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.393] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.393] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.393] lstrlenW (lpString="Winmgmt") returned 7 [0046.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.393] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.394] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.394] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.394] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0046.394] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0046.399] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.400] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.401] lstrlenW (lpString="System") returned 6 [0046.401] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.401] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.402] lstrlenW (lpString="smss.exe") returned 8 [0046.402] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.402] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.403] lstrlenW (lpString="csrss.exe") returned 9 [0046.403] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.403] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.403] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.403] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.404] lstrlenW (lpString="wininit.exe") returned 11 [0046.404] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.404] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.404] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.405] lstrlenW (lpString="csrss.exe") returned 9 [0046.405] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.405] lstrlenW (lpString="winlogon.exe") returned 12 [0046.405] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.406] lstrlenW (lpString="services.exe") returned 12 [0046.406] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.407] lstrlenW (lpString="lsass.exe") returned 9 [0046.407] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.408] lstrlenW (lpString="lsm.exe") returned 7 [0046.408] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.409] lstrlenW (lpString="svchost.exe") returned 11 [0046.409] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.409] lstrlenW (lpString="svchost.exe") returned 11 [0046.409] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.410] lstrlenW (lpString="svchost.exe") returned 11 [0046.410] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.411] lstrlenW (lpString="svchost.exe") returned 11 [0046.411] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.411] lstrlenW (lpString="svchost.exe") returned 11 [0046.411] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.412] lstrlenW (lpString="audiodg.exe") returned 11 [0046.412] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.413] lstrlenW (lpString="svchost.exe") returned 11 [0046.413] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.414] lstrlenW (lpString="svchost.exe") returned 11 [0046.414] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.414] lstrlenW (lpString="dwm.exe") returned 7 [0046.414] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.415] lstrlenW (lpString="explorer.exe") returned 12 [0046.415] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.416] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.416] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.416] lstrlenW (lpString="taskhost.exe") returned 12 [0046.417] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.417] lstrlenW (lpString="svchost.exe") returned 11 [0046.417] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.418] lstrlenW (lpString="taskeng.exe") returned 11 [0046.418] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.419] lstrlenW (lpString="taskhost.exe") returned 12 [0046.419] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0046.419] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0046.419] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0046.475] lstrlenW (lpString="locationshumanities.exe") returned 23 [0046.475] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0046.475] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0046.475] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0046.476] lstrlenW (lpString="decreased.exe") returned 13 [0046.476] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0046.477] lstrlenW (lpString="marcus instrument.exe") returned 21 [0046.477] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0046.477] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0046.477] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0046.478] lstrlenW (lpString="hdtv.exe") returned 8 [0046.478] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0046.479] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0046.479] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0046.480] lstrlenW (lpString="adjusted.exe") returned 12 [0046.480] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0046.480] lstrlenW (lpString="width_worker.exe") returned 16 [0046.480] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0046.481] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0046.481] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0046.482] lstrlenW (lpString="licensed.exe") returned 12 [0046.482] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0046.482] lstrlenW (lpString="rocket.exe") returned 10 [0046.482] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0046.483] lstrlenW (lpString="alexander motel.exe") returned 19 [0046.483] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0046.484] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0046.484] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0046.485] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0046.485] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0046.486] lstrlenW (lpString="shall.exe") returned 9 [0046.486] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0046.486] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0046.486] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0046.487] lstrlenW (lpString="fax fixtures.exe") returned 16 [0046.487] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.488] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.488] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0046.488] lstrlenW (lpString="rruzcj.exe") returned 10 [0046.488] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.489] lstrlenW (lpString="cmd.exe") returned 7 [0046.489] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.490] lstrlenW (lpString="conhost.exe") returned 11 [0046.490] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.490] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.491] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.492] lstrlenW (lpString="svchost.exe") returned 11 [0046.492] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.493] CloseHandle (hObject=0x1bc) returned 1 [0046.493] Sleep (dwMilliseconds=0x1f4) [0047.094] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a0d8 [0047.094] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0047.094] GetLastError () returned 0xea [0047.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0047.095] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0047.095] CloseServiceHandle (hSCObject=0x62a0d8) returned 1 [0047.095] lstrlenW (lpString="Appinfo") returned 7 [0047.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.096] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.096] lstrlenW (lpString="AudioSrv") returned 8 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.096] lstrlenW (lpString="BFE") returned 3 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.096] lstrlenW (lpString="CryptSvc") returned 8 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.096] lstrlenW (lpString="CscService") returned 10 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.097] lstrlenW (lpString="DcomLaunch") returned 10 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.097] lstrlenW (lpString="Dhcp") returned 4 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.097] lstrlenW (lpString="Dnscache") returned 8 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.097] lstrlenW (lpString="DPS") returned 3 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.097] lstrlenW (lpString="eventlog") returned 8 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.098] lstrlenW (lpString="EventSystem") returned 11 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.098] lstrlenW (lpString="gpsvc") returned 5 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.098] lstrlenW (lpString="iphlpsvc") returned 8 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.098] lstrlenW (lpString="LanmanServer") returned 12 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.098] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrlenW (lpString="lmhosts") returned 7 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.099] lstrlenW (lpString="MMCSS") returned 5 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.099] lstrlenW (lpString="MpsSvc") returned 6 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.099] lstrlenW (lpString="Netman") returned 6 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.099] lstrlenW (lpString="netprofm") returned 8 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.100] lstrlenW (lpString="NlaSvc") returned 6 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.100] lstrlenW (lpString="nsi") returned 3 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.100] lstrlenW (lpString="PcaSvc") returned 6 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.100] lstrlenW (lpString="PlugPlay") returned 8 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.100] lstrlenW (lpString="Power") returned 5 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.100] lstrlenW (lpString="ProfSvc") returned 7 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.101] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.101] lstrlenW (lpString="RpcSs") returned 5 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.101] lstrlenW (lpString="SamSs") returned 5 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.101] lstrlenW (lpString="Schedule") returned 8 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.101] lstrlenW (lpString="SENS") returned 4 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.102] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.102] lstrlenW (lpString="Spooler") returned 7 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.102] lstrlenW (lpString="swprv") returned 5 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.102] lstrlenW (lpString="SysMain") returned 7 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.102] lstrlenW (lpString="Themes") returned 6 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.103] lstrlenW (lpString="TrkWks") returned 6 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.103] lstrlenW (lpString="UxSms") returned 5 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.103] lstrlenW (lpString="VSS") returned 3 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.103] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.103] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.104] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.104] lstrlenW (lpString="Winmgmt") returned 7 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.104] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.104] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0047.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0047.106] Process32FirstW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.107] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.108] lstrlenW (lpString="System") returned 6 [0047.108] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.108] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.109] lstrlenW (lpString="smss.exe") returned 8 [0047.109] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.109] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.110] lstrlenW (lpString="csrss.exe") returned 9 [0047.110] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.110] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.110] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.110] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.111] lstrlenW (lpString="wininit.exe") returned 11 [0047.111] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.111] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.111] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.112] lstrlenW (lpString="csrss.exe") returned 9 [0047.112] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.112] lstrlenW (lpString="winlogon.exe") returned 12 [0047.112] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.113] lstrlenW (lpString="services.exe") returned 12 [0047.113] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.114] lstrlenW (lpString="lsass.exe") returned 9 [0047.114] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.114] lstrlenW (lpString="lsm.exe") returned 7 [0047.114] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.115] lstrlenW (lpString="svchost.exe") returned 11 [0047.115] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.116] lstrlenW (lpString="svchost.exe") returned 11 [0047.116] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.116] lstrlenW (lpString="svchost.exe") returned 11 [0047.116] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.117] lstrlenW (lpString="svchost.exe") returned 11 [0047.117] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.118] lstrlenW (lpString="svchost.exe") returned 11 [0047.118] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.119] lstrlenW (lpString="audiodg.exe") returned 11 [0047.119] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.119] lstrlenW (lpString="svchost.exe") returned 11 [0047.119] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.120] lstrlenW (lpString="svchost.exe") returned 11 [0047.120] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.121] lstrlenW (lpString="dwm.exe") returned 7 [0047.121] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.121] lstrlenW (lpString="explorer.exe") returned 12 [0047.121] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.122] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.122] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.123] lstrlenW (lpString="taskhost.exe") returned 12 [0047.123] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.123] lstrlenW (lpString="svchost.exe") returned 11 [0047.124] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.124] lstrlenW (lpString="taskeng.exe") returned 11 [0047.124] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.125] lstrlenW (lpString="taskhost.exe") returned 12 [0047.125] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0047.126] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0047.126] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0047.126] lstrlenW (lpString="locationshumanities.exe") returned 23 [0047.127] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0047.127] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0047.127] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0047.128] lstrlenW (lpString="decreased.exe") returned 13 [0047.128] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0047.129] lstrlenW (lpString="marcus instrument.exe") returned 21 [0047.129] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0047.129] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0047.129] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0047.130] lstrlenW (lpString="hdtv.exe") returned 8 [0047.130] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0047.672] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0047.672] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0047.673] lstrlenW (lpString="adjusted.exe") returned 12 [0047.673] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0047.673] lstrlenW (lpString="width_worker.exe") returned 16 [0047.673] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0047.674] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0047.674] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0047.675] lstrlenW (lpString="licensed.exe") returned 12 [0047.675] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0047.675] lstrlenW (lpString="rocket.exe") returned 10 [0047.675] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0047.676] lstrlenW (lpString="alexander motel.exe") returned 19 [0047.676] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0047.677] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0047.677] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0047.678] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0047.678] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0047.678] lstrlenW (lpString="shall.exe") returned 9 [0047.678] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0047.679] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0047.679] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0047.680] lstrlenW (lpString="fax fixtures.exe") returned 16 [0047.680] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.681] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.681] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0047.681] lstrlenW (lpString="rruzcj.exe") returned 10 [0047.681] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.682] lstrlenW (lpString="cmd.exe") returned 7 [0047.682] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.683] lstrlenW (lpString="conhost.exe") returned 11 [0047.683] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.684] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.684] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.684] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.684] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.685] lstrlenW (lpString="svchost.exe") returned 11 [0047.685] Process32NextW (in: hSnapshot=0x210, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.686] CloseHandle (hObject=0x210) returned 1 [0047.686] Sleep (dwMilliseconds=0x1f4) [0048.272] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a0d8 [0048.273] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0048.273] GetLastError () returned 0xea [0048.273] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x40c8638 [0048.274] EnumServicesStatusExW (in: hSCManager=0x62a0d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40c8638, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40c8638, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0048.274] CloseServiceHandle (hSCObject=0x62a0d8) returned 1 [0048.275] lstrlenW (lpString="Appinfo") returned 7 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.275] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.275] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.275] lstrlenW (lpString="AudioSrv") returned 8 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.275] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.275] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.275] lstrlenW (lpString="BFE") returned 3 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.275] lstrlenW (lpString="CryptSvc") returned 8 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.275] lstrlenW (lpString="CscService") returned 10 [0048.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.276] lstrlenW (lpString="DcomLaunch") returned 10 [0048.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.276] lstrlenW (lpString="Dhcp") returned 4 [0048.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.276] lstrlenW (lpString="Dnscache") returned 8 [0048.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.276] lstrlenW (lpString="DPS") returned 3 [0048.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.276] lstrlenW (lpString="eventlog") returned 8 [0048.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.276] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.276] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.277] lstrlenW (lpString="EventSystem") returned 11 [0048.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.277] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.277] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.277] lstrlenW (lpString="gpsvc") returned 5 [0048.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.277] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.277] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.277] lstrlenW (lpString="iphlpsvc") returned 8 [0048.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.277] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.277] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.277] lstrlenW (lpString="LanmanServer") returned 12 [0048.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.277] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.277] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.277] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.277] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.277] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.277] lstrlenW (lpString="lmhosts") returned 7 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.278] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.278] lstrlenW (lpString="MMCSS") returned 5 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.278] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.278] lstrlenW (lpString="MpsSvc") returned 6 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.278] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.278] lstrlenW (lpString="Netman") returned 6 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.278] lstrlenW (lpString="netprofm") returned 8 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.278] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.278] lstrlenW (lpString="NlaSvc") returned 6 [0048.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.278] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.279] lstrlenW (lpString="nsi") returned 3 [0048.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.279] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.279] lstrlenW (lpString="PcaSvc") returned 6 [0048.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.279] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.279] lstrlenW (lpString="PlugPlay") returned 8 [0048.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.279] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.279] lstrlenW (lpString="Power") returned 5 [0048.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.279] lstrlenW (lpString="ProfSvc") returned 7 [0048.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.279] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.279] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.279] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.280] lstrlenW (lpString="RpcSs") returned 5 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.280] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.280] lstrlenW (lpString="SamSs") returned 5 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.280] lstrlenW (lpString="Schedule") returned 8 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.280] lstrlenW (lpString="SENS") returned 4 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.280] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.280] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.280] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.281] lstrlenW (lpString="Spooler") returned 7 [0048.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.281] lstrlenW (lpString="swprv") returned 5 [0048.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.281] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.281] lstrlenW (lpString="SysMain") returned 7 [0048.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.281] lstrlenW (lpString="Themes") returned 6 [0048.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.281] lstrlenW (lpString="TrkWks") returned 6 [0048.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.281] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.281] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.282] lstrlenW (lpString="UxSms") returned 5 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.282] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.282] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.282] lstrlenW (lpString="VSS") returned 3 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.282] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.282] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.282] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.282] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.282] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.282] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.282] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.282] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.282] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.282] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.282] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.282] lstrlenW (lpString="Winmgmt") returned 7 [0048.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.283] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.283] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.283] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.283] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40c8638 | out: hHeap=0x5c0000) returned 1 [0048.283] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0048.285] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.286] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.287] lstrlenW (lpString="System") returned 6 [0048.287] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.287] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.287] lstrlenW (lpString="smss.exe") returned 8 [0048.288] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.288] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.288] lstrlenW (lpString="csrss.exe") returned 9 [0048.288] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.288] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.289] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.289] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.289] lstrlenW (lpString="wininit.exe") returned 11 [0048.289] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.289] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.289] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.290] lstrlenW (lpString="csrss.exe") returned 9 [0048.290] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.291] lstrlenW (lpString="winlogon.exe") returned 12 [0048.291] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.292] lstrlenW (lpString="services.exe") returned 12 [0048.292] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.292] lstrlenW (lpString="lsass.exe") returned 9 [0048.292] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.293] lstrlenW (lpString="lsm.exe") returned 7 [0048.293] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.294] lstrlenW (lpString="svchost.exe") returned 11 [0048.294] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.295] lstrlenW (lpString="svchost.exe") returned 11 [0048.295] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.295] lstrlenW (lpString="svchost.exe") returned 11 [0048.295] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.296] lstrlenW (lpString="svchost.exe") returned 11 [0048.296] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.297] lstrlenW (lpString="svchost.exe") returned 11 [0048.297] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.297] lstrlenW (lpString="audiodg.exe") returned 11 [0048.298] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.298] lstrlenW (lpString="svchost.exe") returned 11 [0048.298] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.299] lstrlenW (lpString="svchost.exe") returned 11 [0048.299] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.300] lstrlenW (lpString="dwm.exe") returned 7 [0048.300] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.300] lstrlenW (lpString="explorer.exe") returned 12 [0048.300] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.301] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.301] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.302] lstrlenW (lpString="taskhost.exe") returned 12 [0048.302] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.302] lstrlenW (lpString="svchost.exe") returned 11 [0048.302] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.303] lstrlenW (lpString="taskeng.exe") returned 11 [0048.303] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.304] lstrlenW (lpString="taskhost.exe") returned 12 [0048.304] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0048.305] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0048.305] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0048.305] lstrlenW (lpString="locationshumanities.exe") returned 23 [0048.305] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0048.306] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0048.306] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0048.307] lstrlenW (lpString="decreased.exe") returned 13 [0048.307] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0048.307] lstrlenW (lpString="marcus instrument.exe") returned 21 [0048.307] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0048.308] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0048.308] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0048.652] lstrlenW (lpString="hdtv.exe") returned 8 [0048.652] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0048.653] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0048.653] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0048.654] lstrlenW (lpString="adjusted.exe") returned 12 [0048.654] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0048.655] lstrlenW (lpString="width_worker.exe") returned 16 [0048.655] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0048.655] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0048.655] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0048.656] lstrlenW (lpString="licensed.exe") returned 12 [0048.656] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0048.657] lstrlenW (lpString="rocket.exe") returned 10 [0048.657] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0048.657] lstrlenW (lpString="alexander motel.exe") returned 19 [0048.657] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0048.658] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0048.658] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0048.659] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0048.659] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0048.659] lstrlenW (lpString="shall.exe") returned 9 [0048.660] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0048.660] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0048.660] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0048.661] lstrlenW (lpString="fax fixtures.exe") returned 16 [0048.661] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.662] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.662] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0048.662] lstrlenW (lpString="rruzcj.exe") returned 10 [0048.662] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.663] lstrlenW (lpString="cmd.exe") returned 7 [0048.663] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.664] lstrlenW (lpString="conhost.exe") returned 11 [0048.664] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.664] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.664] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.665] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.665] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.666] lstrlenW (lpString="svchost.exe") returned 11 [0048.666] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.667] CloseHandle (hObject=0x1f8) returned 1 [0048.667] Sleep (dwMilliseconds=0x1f4) [0049.389] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6430f8 [0049.390] EnumServicesStatusExW (in: hSCManager=0x6430f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0049.391] GetLastError () returned 0xea [0049.391] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x4088618 [0049.391] EnumServicesStatusExW (in: hSCManager=0x6430f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4088618, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4088618, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0049.392] CloseServiceHandle (hSCObject=0x6430f8) returned 1 [0049.392] lstrlenW (lpString="Appinfo") returned 7 [0049.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.392] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.392] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.392] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.392] lstrlenW (lpString="AudioSrv") returned 8 [0049.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.392] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.392] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.392] lstrlenW (lpString="BFE") returned 3 [0049.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.392] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.392] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.392] lstrlenW (lpString="CryptSvc") returned 8 [0049.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.393] lstrlenW (lpString="CscService") returned 10 [0049.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.393] lstrlenW (lpString="DcomLaunch") returned 10 [0049.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.393] lstrlenW (lpString="Dhcp") returned 4 [0049.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.393] lstrlenW (lpString="Dnscache") returned 8 [0049.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.393] lstrlenW (lpString="DPS") returned 3 [0049.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.394] lstrlenW (lpString="eventlog") returned 8 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.394] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.394] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.394] lstrlenW (lpString="EventSystem") returned 11 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.394] lstrlenW (lpString="gpsvc") returned 5 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.394] lstrlenW (lpString="iphlpsvc") returned 8 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.394] lstrlenW (lpString="LanmanServer") returned 12 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.394] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.395] lstrlenW (lpString="lmhosts") returned 7 [0049.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.395] lstrlenW (lpString="MMCSS") returned 5 [0049.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.395] lstrlenW (lpString="MpsSvc") returned 6 [0049.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.395] lstrlenW (lpString="Netman") returned 6 [0049.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.395] lstrlenW (lpString="netprofm") returned 8 [0049.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.395] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.395] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.396] lstrlenW (lpString="NlaSvc") returned 6 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.396] lstrlenW (lpString="nsi") returned 3 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.396] lstrlenW (lpString="PcaSvc") returned 6 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.396] lstrlenW (lpString="PlugPlay") returned 8 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.396] lstrlenW (lpString="Power") returned 5 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.396] lstrlenW (lpString="ProfSvc") returned 7 [0049.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.397] lstrlenW (lpString="RpcSs") returned 5 [0049.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.397] lstrlenW (lpString="SamSs") returned 5 [0049.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.397] lstrlenW (lpString="Schedule") returned 8 [0049.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.397] lstrlenW (lpString="SENS") returned 4 [0049.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.398] lstrlenW (lpString="Spooler") returned 7 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.398] lstrlenW (lpString="swprv") returned 5 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.398] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.398] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.398] lstrlenW (lpString="SysMain") returned 7 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.398] lstrlenW (lpString="Themes") returned 6 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.398] lstrlenW (lpString="TrkWks") returned 6 [0049.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.399] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.399] lstrlenW (lpString="UxSms") returned 5 [0049.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.399] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.399] lstrlenW (lpString="VSS") returned 3 [0049.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.399] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.399] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.399] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.399] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.399] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.399] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.399] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.400] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.400] lstrlenW (lpString="Winmgmt") returned 7 [0049.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.400] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.400] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.400] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.400] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088618 | out: hHeap=0x5c0000) returned 1 [0049.400] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0049.403] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.403] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.404] lstrlenW (lpString="System") returned 6 [0049.404] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.404] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.405] lstrlenW (lpString="smss.exe") returned 8 [0049.405] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.405] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.406] lstrlenW (lpString="csrss.exe") returned 9 [0049.406] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.406] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.406] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.406] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.407] lstrlenW (lpString="wininit.exe") returned 11 [0049.407] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.407] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.407] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.408] lstrlenW (lpString="csrss.exe") returned 9 [0049.408] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.408] lstrlenW (lpString="winlogon.exe") returned 12 [0049.408] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.409] lstrlenW (lpString="services.exe") returned 12 [0049.409] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.410] lstrlenW (lpString="lsass.exe") returned 9 [0049.410] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.410] lstrlenW (lpString="lsm.exe") returned 7 [0049.410] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.411] lstrlenW (lpString="svchost.exe") returned 11 [0049.411] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.412] lstrlenW (lpString="svchost.exe") returned 11 [0049.412] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.412] lstrlenW (lpString="svchost.exe") returned 11 [0049.412] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.413] lstrlenW (lpString="svchost.exe") returned 11 [0049.413] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.414] lstrlenW (lpString="svchost.exe") returned 11 [0049.414] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.414] lstrlenW (lpString="audiodg.exe") returned 11 [0049.415] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.415] lstrlenW (lpString="svchost.exe") returned 11 [0049.415] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.416] lstrlenW (lpString="svchost.exe") returned 11 [0049.416] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.417] lstrlenW (lpString="dwm.exe") returned 7 [0049.417] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.418] lstrlenW (lpString="explorer.exe") returned 12 [0049.418] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.418] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.418] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.419] lstrlenW (lpString="taskhost.exe") returned 12 [0049.419] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.420] lstrlenW (lpString="svchost.exe") returned 11 [0049.420] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.420] lstrlenW (lpString="taskeng.exe") returned 11 [0049.420] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.421] lstrlenW (lpString="taskhost.exe") returned 12 [0049.421] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0049.422] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0049.422] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0049.423] lstrlenW (lpString="locationshumanities.exe") returned 23 [0049.423] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0049.423] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0049.423] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0049.424] lstrlenW (lpString="decreased.exe") returned 13 [0049.424] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0049.425] lstrlenW (lpString="marcus instrument.exe") returned 21 [0049.425] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0049.425] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0049.425] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0049.426] lstrlenW (lpString="hdtv.exe") returned 8 [0049.426] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0049.427] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0049.427] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0049.428] lstrlenW (lpString="adjusted.exe") returned 12 [0049.428] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0049.428] lstrlenW (lpString="width_worker.exe") returned 16 [0049.428] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0049.429] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0049.429] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0049.430] lstrlenW (lpString="licensed.exe") returned 12 [0049.430] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0049.430] lstrlenW (lpString="rocket.exe") returned 10 [0049.431] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0049.431] lstrlenW (lpString="alexander motel.exe") returned 19 [0049.431] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0049.629] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0049.629] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0049.630] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0049.630] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0049.630] lstrlenW (lpString="shall.exe") returned 9 [0049.631] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0049.631] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0049.631] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0049.636] lstrlenW (lpString="fax fixtures.exe") returned 16 [0049.645] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.646] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.646] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0049.646] lstrlenW (lpString="rruzcj.exe") returned 10 [0049.646] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.647] lstrlenW (lpString="cmd.exe") returned 7 [0049.647] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.648] lstrlenW (lpString="conhost.exe") returned 11 [0049.648] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.649] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.649] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.649] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.649] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.650] lstrlenW (lpString="svchost.exe") returned 11 [0049.650] Process32NextW (in: hSnapshot=0x1c0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.651] CloseHandle (hObject=0x1c0) returned 1 [0049.651] Sleep (dwMilliseconds=0x1f4) [0050.391] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6430f8 [0050.391] EnumServicesStatusExW (in: hSCManager=0x6430f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0050.391] GetLastError () returned 0xea [0050.391] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0050.392] EnumServicesStatusExW (in: hSCManager=0x6430f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0050.392] CloseServiceHandle (hSCObject=0x6430f8) returned 1 [0050.392] lstrlenW (lpString="Appinfo") returned 7 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.393] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.393] lstrlenW (lpString="AudioSrv") returned 8 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.393] lstrlenW (lpString="BFE") returned 3 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.393] lstrlenW (lpString="CryptSvc") returned 8 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.393] lstrlenW (lpString="CscService") returned 10 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.394] lstrlenW (lpString="DcomLaunch") returned 10 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.394] lstrlenW (lpString="Dhcp") returned 4 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.394] lstrlenW (lpString="Dnscache") returned 8 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.394] lstrlenW (lpString="DPS") returned 3 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.394] lstrlenW (lpString="eventlog") returned 8 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.395] lstrlenW (lpString="EventSystem") returned 11 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.395] lstrlenW (lpString="gpsvc") returned 5 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.395] lstrlenW (lpString="iphlpsvc") returned 8 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.396] lstrlenW (lpString="LanmanServer") returned 12 [0050.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.396] lstrlenW (lpString="lmhosts") returned 7 [0050.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.396] lstrlenW (lpString="MMCSS") returned 5 [0050.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.396] lstrlenW (lpString="MpsSvc") returned 6 [0050.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.396] lstrlenW (lpString="Netman") returned 6 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.397] lstrlenW (lpString="netprofm") returned 8 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.397] lstrlenW (lpString="NlaSvc") returned 6 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.397] lstrlenW (lpString="nsi") returned 3 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.397] lstrlenW (lpString="PcaSvc") returned 6 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.397] lstrlenW (lpString="PlugPlay") returned 8 [0050.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.398] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.398] lstrlenW (lpString="Power") returned 5 [0050.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.398] lstrlenW (lpString="ProfSvc") returned 7 [0050.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.398] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.398] lstrlenW (lpString="RpcSs") returned 5 [0050.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.398] lstrlenW (lpString="SamSs") returned 5 [0050.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.399] lstrlenW (lpString="Schedule") returned 8 [0050.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.399] lstrlenW (lpString="SENS") returned 4 [0050.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.399] lstrlenW (lpString="Spooler") returned 7 [0050.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.399] lstrlenW (lpString="swprv") returned 5 [0050.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.400] lstrlenW (lpString="SysMain") returned 7 [0050.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.400] lstrlenW (lpString="Themes") returned 6 [0050.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.400] lstrlenW (lpString="TrkWks") returned 6 [0050.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.400] lstrlenW (lpString="UxSms") returned 5 [0050.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.400] lstrlenW (lpString="VSS") returned 3 [0050.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.400] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.400] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.401] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.401] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.401] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.401] lstrlenW (lpString="Winmgmt") returned 7 [0050.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.401] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.401] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0050.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0050.404] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.404] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.405] lstrlenW (lpString="System") returned 6 [0050.405] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.405] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.406] lstrlenW (lpString="smss.exe") returned 8 [0050.406] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.406] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.407] lstrlenW (lpString="csrss.exe") returned 9 [0050.407] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.407] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.407] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.407] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.408] lstrlenW (lpString="wininit.exe") returned 11 [0050.408] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.408] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.408] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.409] lstrlenW (lpString="csrss.exe") returned 9 [0050.409] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.409] lstrlenW (lpString="winlogon.exe") returned 12 [0050.409] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.410] lstrlenW (lpString="services.exe") returned 12 [0050.410] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.411] lstrlenW (lpString="lsass.exe") returned 9 [0050.411] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.411] lstrlenW (lpString="lsm.exe") returned 7 [0050.411] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.412] lstrlenW (lpString="svchost.exe") returned 11 [0050.412] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.413] lstrlenW (lpString="svchost.exe") returned 11 [0050.413] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.413] lstrlenW (lpString="svchost.exe") returned 11 [0050.413] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.414] lstrlenW (lpString="svchost.exe") returned 11 [0050.414] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.415] lstrlenW (lpString="svchost.exe") returned 11 [0050.415] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.416] lstrlenW (lpString="audiodg.exe") returned 11 [0050.416] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.416] lstrlenW (lpString="svchost.exe") returned 11 [0050.417] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.417] lstrlenW (lpString="svchost.exe") returned 11 [0050.417] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.418] lstrlenW (lpString="dwm.exe") returned 7 [0050.418] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.419] lstrlenW (lpString="explorer.exe") returned 12 [0050.419] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.419] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.419] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.420] lstrlenW (lpString="taskhost.exe") returned 12 [0050.420] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.421] lstrlenW (lpString="svchost.exe") returned 11 [0050.421] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.421] lstrlenW (lpString="taskeng.exe") returned 11 [0050.421] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.422] lstrlenW (lpString="taskhost.exe") returned 12 [0050.422] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0050.423] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0050.423] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0050.423] lstrlenW (lpString="locationshumanities.exe") returned 23 [0050.424] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0050.424] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0050.424] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0050.425] lstrlenW (lpString="decreased.exe") returned 13 [0050.425] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0050.426] lstrlenW (lpString="marcus instrument.exe") returned 21 [0050.426] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0050.426] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0050.426] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0050.427] lstrlenW (lpString="hdtv.exe") returned 8 [0050.427] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0050.428] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0050.428] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0050.428] lstrlenW (lpString="adjusted.exe") returned 12 [0050.428] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0050.429] lstrlenW (lpString="width_worker.exe") returned 16 [0050.429] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0050.430] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0050.430] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0050.647] lstrlenW (lpString="licensed.exe") returned 12 [0050.647] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0050.648] lstrlenW (lpString="rocket.exe") returned 10 [0050.648] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0050.648] lstrlenW (lpString="alexander motel.exe") returned 19 [0050.648] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0050.649] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0050.649] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0050.650] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0050.650] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0050.650] lstrlenW (lpString="shall.exe") returned 9 [0050.650] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0050.651] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0050.651] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0050.652] lstrlenW (lpString="fax fixtures.exe") returned 16 [0050.652] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.653] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.653] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0050.653] lstrlenW (lpString="rruzcj.exe") returned 10 [0050.653] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.654] lstrlenW (lpString="cmd.exe") returned 7 [0050.654] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.655] lstrlenW (lpString="conhost.exe") returned 11 [0050.655] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.655] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.655] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.656] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.656] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.657] lstrlenW (lpString="svchost.exe") returned 11 [0050.657] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.657] CloseHandle (hObject=0x1fc) returned 1 [0050.657] Sleep (dwMilliseconds=0x1f4) [0051.338] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643238 [0051.338] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0051.339] GetLastError () returned 0xea [0051.339] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0051.339] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0051.339] CloseServiceHandle (hSCObject=0x643238) returned 1 [0051.339] lstrlenW (lpString="Appinfo") returned 7 [0051.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.340] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.340] lstrlenW (lpString="AudioSrv") returned 8 [0051.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.340] lstrlenW (lpString="BFE") returned 3 [0051.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.340] lstrlenW (lpString="CryptSvc") returned 8 [0051.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.340] lstrlenW (lpString="CscService") returned 10 [0051.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.341] lstrlenW (lpString="DcomLaunch") returned 10 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.341] lstrlenW (lpString="Dhcp") returned 4 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.341] lstrlenW (lpString="Dnscache") returned 8 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.341] lstrlenW (lpString="DPS") returned 3 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.341] lstrlenW (lpString="eventlog") returned 8 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.341] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.341] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.341] lstrlenW (lpString="EventSystem") returned 11 [0051.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.342] lstrlenW (lpString="gpsvc") returned 5 [0051.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.342] lstrlenW (lpString="iphlpsvc") returned 8 [0051.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.342] lstrlenW (lpString="LanmanServer") returned 12 [0051.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.342] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.342] lstrlenW (lpString="lmhosts") returned 7 [0051.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.342] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.342] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.342] lstrlenW (lpString="MMCSS") returned 5 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.343] lstrlenW (lpString="MpsSvc") returned 6 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.343] lstrlenW (lpString="Netman") returned 6 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.343] lstrlenW (lpString="netprofm") returned 8 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.343] lstrlenW (lpString="NlaSvc") returned 6 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.343] lstrlenW (lpString="nsi") returned 3 [0051.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.343] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.343] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.344] lstrlenW (lpString="PcaSvc") returned 6 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.344] lstrlenW (lpString="PlugPlay") returned 8 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.344] lstrlenW (lpString="Power") returned 5 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.344] lstrlenW (lpString="ProfSvc") returned 7 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.344] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.344] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.344] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.344] lstrlenW (lpString="RpcSs") returned 5 [0051.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.345] lstrlenW (lpString="SamSs") returned 5 [0051.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.345] lstrlenW (lpString="Schedule") returned 8 [0051.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.345] lstrlenW (lpString="SENS") returned 4 [0051.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.345] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.345] lstrlenW (lpString="Spooler") returned 7 [0051.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.346] lstrlenW (lpString="swprv") returned 5 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.346] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.346] lstrlenW (lpString="SysMain") returned 7 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.346] lstrlenW (lpString="Themes") returned 6 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.346] lstrlenW (lpString="TrkWks") returned 6 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.346] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.346] lstrlenW (lpString="UxSms") returned 5 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.346] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.346] lstrlenW (lpString="VSS") returned 3 [0051.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.346] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.347] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.347] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.347] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.347] lstrlenW (lpString="Winmgmt") returned 7 [0051.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.347] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.347] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0051.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0051.350] Process32FirstW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.351] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.351] lstrlenW (lpString="System") returned 6 [0051.351] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.352] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.352] lstrlenW (lpString="smss.exe") returned 8 [0051.352] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.352] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.353] lstrlenW (lpString="csrss.exe") returned 9 [0051.353] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.353] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.353] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.353] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.354] lstrlenW (lpString="wininit.exe") returned 11 [0051.354] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.354] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.354] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.355] lstrlenW (lpString="csrss.exe") returned 9 [0051.355] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.355] lstrlenW (lpString="winlogon.exe") returned 12 [0051.355] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.356] lstrlenW (lpString="services.exe") returned 12 [0051.356] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.357] lstrlenW (lpString="lsass.exe") returned 9 [0051.357] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.357] lstrlenW (lpString="lsm.exe") returned 7 [0051.358] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.358] lstrlenW (lpString="svchost.exe") returned 11 [0051.358] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.359] lstrlenW (lpString="svchost.exe") returned 11 [0051.359] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.360] lstrlenW (lpString="svchost.exe") returned 11 [0051.360] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.360] lstrlenW (lpString="svchost.exe") returned 11 [0051.360] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.361] lstrlenW (lpString="svchost.exe") returned 11 [0051.361] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.362] lstrlenW (lpString="audiodg.exe") returned 11 [0051.362] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.362] lstrlenW (lpString="svchost.exe") returned 11 [0051.362] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.363] lstrlenW (lpString="svchost.exe") returned 11 [0051.363] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.364] lstrlenW (lpString="dwm.exe") returned 7 [0051.364] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.364] lstrlenW (lpString="explorer.exe") returned 12 [0051.364] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.365] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.366] lstrlenW (lpString="taskhost.exe") returned 12 [0051.366] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.371] lstrlenW (lpString="svchost.exe") returned 11 [0051.371] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.371] lstrlenW (lpString="taskeng.exe") returned 11 [0051.371] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.372] lstrlenW (lpString="taskhost.exe") returned 12 [0051.372] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0051.373] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0051.373] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0051.373] lstrlenW (lpString="locationshumanities.exe") returned 23 [0051.373] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0051.374] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0051.374] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0051.375] lstrlenW (lpString="decreased.exe") returned 13 [0051.375] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0051.375] lstrlenW (lpString="marcus instrument.exe") returned 21 [0051.375] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0051.376] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0051.376] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0051.377] lstrlenW (lpString="hdtv.exe") returned 8 [0051.377] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0051.377] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0051.377] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0051.378] lstrlenW (lpString="adjusted.exe") returned 12 [0051.378] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0051.379] lstrlenW (lpString="width_worker.exe") returned 16 [0051.379] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0051.379] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0051.379] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0051.380] lstrlenW (lpString="licensed.exe") returned 12 [0051.380] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0051.381] lstrlenW (lpString="rocket.exe") returned 10 [0051.381] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0051.381] lstrlenW (lpString="alexander motel.exe") returned 19 [0051.491] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0051.559] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0051.559] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0051.559] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0051.559] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0051.560] lstrlenW (lpString="shall.exe") returned 9 [0051.560] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0051.561] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0051.561] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0051.561] lstrlenW (lpString="fax fixtures.exe") returned 16 [0051.561] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.562] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.562] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0051.563] lstrlenW (lpString="rruzcj.exe") returned 10 [0051.563] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.563] lstrlenW (lpString="cmd.exe") returned 7 [0051.563] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.564] lstrlenW (lpString="conhost.exe") returned 11 [0051.564] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.565] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.565] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.565] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.565] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.566] lstrlenW (lpString="svchost.exe") returned 11 [0051.566] Process32NextW (in: hSnapshot=0x188, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.567] CloseHandle (hObject=0x188) returned 1 [0051.567] Sleep (dwMilliseconds=0x1f4) [0052.255] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643288 [0052.255] EnumServicesStatusExW (in: hSCManager=0x643288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0052.256] GetLastError () returned 0xea [0052.256] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x4026600 [0052.256] EnumServicesStatusExW (in: hSCManager=0x643288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4026600, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4026600, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0052.257] CloseServiceHandle (hSCObject=0x643288) returned 1 [0052.257] lstrlenW (lpString="Appinfo") returned 7 [0052.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.257] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.257] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.257] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.257] lstrlenW (lpString="AudioSrv") returned 8 [0052.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.257] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.257] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.257] lstrlenW (lpString="BFE") returned 3 [0052.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.257] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.257] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.257] lstrlenW (lpString="CryptSvc") returned 8 [0052.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.257] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.258] lstrlenW (lpString="CscService") returned 10 [0052.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.258] lstrlenW (lpString="DcomLaunch") returned 10 [0052.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.258] lstrlenW (lpString="Dhcp") returned 4 [0052.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.258] lstrlenW (lpString="Dnscache") returned 8 [0052.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.258] lstrlenW (lpString="DPS") returned 3 [0052.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.258] lstrlenW (lpString="eventlog") returned 8 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.259] lstrlenW (lpString="EventSystem") returned 11 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.259] lstrlenW (lpString="gpsvc") returned 5 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.259] lstrlenW (lpString="iphlpsvc") returned 8 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.259] lstrlenW (lpString="LanmanServer") returned 12 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.259] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.259] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.259] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.260] lstrlenW (lpString="lmhosts") returned 7 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.260] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.260] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.260] lstrlenW (lpString="MMCSS") returned 5 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.260] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.260] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.260] lstrlenW (lpString="MpsSvc") returned 6 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.260] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.260] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.260] lstrlenW (lpString="Netman") returned 6 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.260] lstrlenW (lpString="netprofm") returned 8 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.260] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.260] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.260] lstrlenW (lpString="NlaSvc") returned 6 [0052.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.261] lstrlenW (lpString="nsi") returned 3 [0052.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.261] lstrlenW (lpString="PcaSvc") returned 6 [0052.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.261] lstrlenW (lpString="PlugPlay") returned 8 [0052.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.261] lstrlenW (lpString="Power") returned 5 [0052.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.261] lstrlenW (lpString="ProfSvc") returned 7 [0052.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.262] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.262] lstrlenW (lpString="RpcSs") returned 5 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.262] lstrlenW (lpString="SamSs") returned 5 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.262] lstrlenW (lpString="Schedule") returned 8 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.262] lstrlenW (lpString="SENS") returned 4 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.262] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.263] lstrlenW (lpString="Spooler") returned 7 [0052.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.263] lstrlenW (lpString="swprv") returned 5 [0052.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.263] lstrlenW (lpString="SysMain") returned 7 [0052.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.263] lstrlenW (lpString="Themes") returned 6 [0052.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.263] lstrlenW (lpString="TrkWks") returned 6 [0052.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.263] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.263] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.263] lstrlenW (lpString="UxSms") returned 5 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.264] lstrlenW (lpString="VSS") returned 3 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.264] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.264] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.264] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.264] lstrlenW (lpString="Winmgmt") returned 7 [0052.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.265] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.265] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.265] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.265] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4026600 | out: hHeap=0x5c0000) returned 1 [0052.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0052.267] Process32FirstW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.268] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.268] lstrlenW (lpString="System") returned 6 [0052.268] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.268] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.268] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.269] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.269] lstrlenW (lpString="smss.exe") returned 8 [0052.269] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.269] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.270] lstrlenW (lpString="csrss.exe") returned 9 [0052.270] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.270] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.270] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.270] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.271] lstrlenW (lpString="wininit.exe") returned 11 [0052.271] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.271] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.271] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.272] lstrlenW (lpString="csrss.exe") returned 9 [0052.272] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.272] lstrlenW (lpString="winlogon.exe") returned 12 [0052.273] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.273] lstrlenW (lpString="services.exe") returned 12 [0052.273] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.274] lstrlenW (lpString="lsass.exe") returned 9 [0052.274] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.275] lstrlenW (lpString="lsm.exe") returned 7 [0052.275] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.275] lstrlenW (lpString="svchost.exe") returned 11 [0052.275] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.276] lstrlenW (lpString="svchost.exe") returned 11 [0052.276] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.277] lstrlenW (lpString="svchost.exe") returned 11 [0052.277] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.277] lstrlenW (lpString="svchost.exe") returned 11 [0052.277] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.278] lstrlenW (lpString="svchost.exe") returned 11 [0052.278] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.279] lstrlenW (lpString="audiodg.exe") returned 11 [0052.279] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.279] lstrlenW (lpString="svchost.exe") returned 11 [0052.279] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.280] lstrlenW (lpString="svchost.exe") returned 11 [0052.280] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.281] lstrlenW (lpString="dwm.exe") returned 7 [0052.281] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.281] lstrlenW (lpString="explorer.exe") returned 12 [0052.281] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.282] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.282] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.283] lstrlenW (lpString="taskhost.exe") returned 12 [0052.283] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.284] lstrlenW (lpString="svchost.exe") returned 11 [0052.284] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.284] lstrlenW (lpString="taskeng.exe") returned 11 [0052.284] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.285] lstrlenW (lpString="taskhost.exe") returned 12 [0052.285] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0052.286] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0052.286] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0052.287] lstrlenW (lpString="locationshumanities.exe") returned 23 [0052.287] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0052.287] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0052.287] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0052.288] lstrlenW (lpString="decreased.exe") returned 13 [0052.288] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0052.289] lstrlenW (lpString="marcus instrument.exe") returned 21 [0052.289] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0052.289] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0052.290] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0052.290] lstrlenW (lpString="hdtv.exe") returned 8 [0052.290] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0052.291] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0052.291] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0052.292] lstrlenW (lpString="adjusted.exe") returned 12 [0052.292] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0052.292] lstrlenW (lpString="width_worker.exe") returned 16 [0052.292] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0052.293] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0052.293] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0052.294] lstrlenW (lpString="licensed.exe") returned 12 [0052.294] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0052.294] lstrlenW (lpString="rocket.exe") returned 10 [0052.294] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0052.295] lstrlenW (lpString="alexander motel.exe") returned 19 [0052.295] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0052.296] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0052.296] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0052.296] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0052.296] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0052.297] lstrlenW (lpString="shall.exe") returned 9 [0052.297] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0052.298] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0052.298] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0052.298] lstrlenW (lpString="fax fixtures.exe") returned 16 [0052.298] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.299] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.299] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0052.300] lstrlenW (lpString="rruzcj.exe") returned 10 [0052.300] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.300] lstrlenW (lpString="cmd.exe") returned 7 [0052.301] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.301] lstrlenW (lpString="conhost.exe") returned 11 [0052.301] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.302] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.302] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.395] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.395] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.396] lstrlenW (lpString="svchost.exe") returned 11 [0052.396] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.396] CloseHandle (hObject=0x160) returned 1 [0052.396] Sleep (dwMilliseconds=0x1f4) [0052.935] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643378 [0052.935] EnumServicesStatusExW (in: hSCManager=0x643378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0052.935] GetLastError () returned 0xea [0052.935] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x46e0068 [0052.935] EnumServicesStatusExW (in: hSCManager=0x643378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46e0068, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46e0068, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0052.936] CloseServiceHandle (hSCObject=0x643378) returned 1 [0052.936] lstrlenW (lpString="Appinfo") returned 7 [0052.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.936] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.937] lstrlenW (lpString="AudioSrv") returned 8 [0052.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.937] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.937] lstrlenW (lpString="BFE") returned 3 [0052.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.937] lstrlenW (lpString="CryptSvc") returned 8 [0052.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.937] lstrlenW (lpString="CscService") returned 10 [0052.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.937] lstrlenW (lpString="DcomLaunch") returned 10 [0052.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.937] lstrlenW (lpString="Dhcp") returned 4 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.938] lstrlenW (lpString="Dnscache") returned 8 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.938] lstrlenW (lpString="DPS") returned 3 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.938] lstrlenW (lpString="eventlog") returned 8 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.938] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.938] lstrlenW (lpString="EventSystem") returned 11 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.938] lstrlenW (lpString="gpsvc") returned 5 [0052.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.939] lstrlenW (lpString="iphlpsvc") returned 8 [0052.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.939] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.939] lstrlenW (lpString="LanmanServer") returned 12 [0052.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.939] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.939] lstrlenW (lpString="lmhosts") returned 7 [0052.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.939] lstrlenW (lpString="MMCSS") returned 5 [0052.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.940] lstrlenW (lpString="MpsSvc") returned 6 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.940] lstrlenW (lpString="Netman") returned 6 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.940] lstrlenW (lpString="netprofm") returned 8 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.940] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.940] lstrlenW (lpString="NlaSvc") returned 6 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.940] lstrlenW (lpString="nsi") returned 3 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.940] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.940] lstrlenW (lpString="PcaSvc") returned 6 [0052.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.941] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.941] lstrlenW (lpString="PlugPlay") returned 8 [0052.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.941] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.941] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.941] lstrlenW (lpString="Power") returned 5 [0052.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.941] lstrlenW (lpString="ProfSvc") returned 7 [0052.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.941] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.941] lstrlenW (lpString="RpcSs") returned 5 [0052.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.942] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.942] lstrlenW (lpString="SamSs") returned 5 [0052.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.942] lstrlenW (lpString="Schedule") returned 8 [0052.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.942] lstrlenW (lpString="SENS") returned 4 [0052.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.942] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.943] lstrlenW (lpString="Spooler") returned 7 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.943] lstrlenW (lpString="swprv") returned 5 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.943] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.943] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.943] lstrlenW (lpString="SysMain") returned 7 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.943] lstrlenW (lpString="Themes") returned 6 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.943] lstrlenW (lpString="TrkWks") returned 6 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.943] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.943] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.943] lstrlenW (lpString="UxSms") returned 5 [0052.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.944] lstrlenW (lpString="VSS") returned 3 [0052.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.944] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.944] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.944] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.944] lstrlenW (lpString="Winmgmt") returned 7 [0052.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.945] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.945] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.945] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.945] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46e0068 | out: hHeap=0x5c0000) returned 1 [0052.945] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0052.947] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.948] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.948] lstrlenW (lpString="System") returned 6 [0052.948] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.949] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.949] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.949] lstrlenW (lpString="smss.exe") returned 8 [0052.949] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.949] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.950] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.950] lstrlenW (lpString="csrss.exe") returned 9 [0052.950] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.950] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.950] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.951] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.951] lstrlenW (lpString="wininit.exe") returned 11 [0052.951] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.951] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.951] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.952] lstrlenW (lpString="csrss.exe") returned 9 [0052.952] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.953] lstrlenW (lpString="winlogon.exe") returned 12 [0052.953] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.954] lstrlenW (lpString="services.exe") returned 12 [0052.954] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.954] lstrlenW (lpString="lsass.exe") returned 9 [0052.954] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.955] lstrlenW (lpString="lsm.exe") returned 7 [0052.955] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.956] lstrlenW (lpString="svchost.exe") returned 11 [0052.956] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.956] lstrlenW (lpString="svchost.exe") returned 11 [0052.956] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.957] lstrlenW (lpString="svchost.exe") returned 11 [0052.957] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.958] lstrlenW (lpString="svchost.exe") returned 11 [0052.958] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.958] lstrlenW (lpString="svchost.exe") returned 11 [0052.959] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.959] lstrlenW (lpString="audiodg.exe") returned 11 [0052.959] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.960] lstrlenW (lpString="svchost.exe") returned 11 [0052.960] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.961] lstrlenW (lpString="svchost.exe") returned 11 [0052.961] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.961] lstrlenW (lpString="dwm.exe") returned 7 [0052.961] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.962] lstrlenW (lpString="explorer.exe") returned 12 [0052.962] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.963] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.963] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.963] lstrlenW (lpString="taskhost.exe") returned 12 [0052.963] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.964] lstrlenW (lpString="svchost.exe") returned 11 [0052.964] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.965] lstrlenW (lpString="taskeng.exe") returned 11 [0052.965] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.965] lstrlenW (lpString="taskhost.exe") returned 12 [0052.965] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0052.966] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0052.966] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0052.967] lstrlenW (lpString="locationshumanities.exe") returned 23 [0052.967] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0052.968] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0052.968] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0052.968] lstrlenW (lpString="decreased.exe") returned 13 [0052.968] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0052.969] lstrlenW (lpString="marcus instrument.exe") returned 21 [0052.969] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0052.970] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0052.970] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0052.970] lstrlenW (lpString="hdtv.exe") returned 8 [0052.970] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0052.971] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0052.971] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0052.972] lstrlenW (lpString="adjusted.exe") returned 12 [0052.972] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0052.972] lstrlenW (lpString="width_worker.exe") returned 16 [0052.972] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0053.672] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0053.673] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0053.673] lstrlenW (lpString="licensed.exe") returned 12 [0053.673] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0053.674] lstrlenW (lpString="rocket.exe") returned 10 [0053.674] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0053.675] lstrlenW (lpString="alexander motel.exe") returned 19 [0053.675] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0053.675] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0053.675] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0053.676] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0053.676] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0053.677] lstrlenW (lpString="shall.exe") returned 9 [0053.677] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0053.678] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0053.678] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0053.678] lstrlenW (lpString="fax fixtures.exe") returned 16 [0053.678] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.679] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.679] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0053.680] lstrlenW (lpString="rruzcj.exe") returned 10 [0053.680] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.680] lstrlenW (lpString="cmd.exe") returned 7 [0053.680] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.681] lstrlenW (lpString="conhost.exe") returned 11 [0053.681] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.682] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.682] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.682] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.682] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.683] lstrlenW (lpString="svchost.exe") returned 11 [0053.683] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.684] CloseHandle (hObject=0x1f0) returned 1 [0053.684] Sleep (dwMilliseconds=0x1f4) [0054.471] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6432b0 [0054.472] EnumServicesStatusExW (in: hSCManager=0x6432b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0054.473] GetLastError () returned 0xea [0054.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x46e0068 [0054.473] EnumServicesStatusExW (in: hSCManager=0x6432b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46e0068, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46e0068, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0054.474] CloseServiceHandle (hSCObject=0x6432b0) returned 1 [0054.474] lstrlenW (lpString="Appinfo") returned 7 [0054.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.474] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.474] lstrlenW (lpString="AudioSrv") returned 8 [0054.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.474] lstrlenW (lpString="BFE") returned 3 [0054.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.474] lstrlenW (lpString="CryptSvc") returned 8 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.475] lstrlenW (lpString="CscService") returned 10 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.475] lstrlenW (lpString="DcomLaunch") returned 10 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.475] lstrlenW (lpString="Dhcp") returned 4 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.475] lstrlenW (lpString="Dnscache") returned 8 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.475] lstrlenW (lpString="DPS") returned 3 [0054.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.476] lstrlenW (lpString="eventlog") returned 8 [0054.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.476] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.476] lstrlenW (lpString="EventSystem") returned 11 [0054.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.476] lstrlenW (lpString="gpsvc") returned 5 [0054.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.476] lstrlenW (lpString="iphlpsvc") returned 8 [0054.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.476] lstrlenW (lpString="LanmanServer") returned 12 [0054.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.476] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.476] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.476] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.477] lstrlenW (lpString="lmhosts") returned 7 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.477] lstrlenW (lpString="MMCSS") returned 5 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.477] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.477] lstrlenW (lpString="MpsSvc") returned 6 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.477] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.477] lstrlenW (lpString="Netman") returned 6 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.477] lstrlenW (lpString="netprofm") returned 8 [0054.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.477] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.478] lstrlenW (lpString="NlaSvc") returned 6 [0054.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.478] lstrlenW (lpString="nsi") returned 3 [0054.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.478] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.478] lstrlenW (lpString="PcaSvc") returned 6 [0054.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.478] lstrlenW (lpString="PlugPlay") returned 8 [0054.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.478] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.478] lstrlenW (lpString="Power") returned 5 [0054.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.478] lstrlenW (lpString="ProfSvc") returned 7 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.479] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.479] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.479] lstrlenW (lpString="RpcSs") returned 5 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.479] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.479] lstrlenW (lpString="SamSs") returned 5 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.479] lstrlenW (lpString="Schedule") returned 8 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.479] lstrlenW (lpString="SENS") returned 4 [0054.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.480] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.480] lstrlenW (lpString="Spooler") returned 7 [0054.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.480] lstrlenW (lpString="swprv") returned 5 [0054.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.480] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.480] lstrlenW (lpString="SysMain") returned 7 [0054.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.480] lstrlenW (lpString="Themes") returned 6 [0054.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.480] lstrlenW (lpString="TrkWks") returned 6 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.481] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.481] lstrlenW (lpString="UxSms") returned 5 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.481] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.481] lstrlenW (lpString="VSS") returned 3 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.481] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.481] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.481] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.481] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.481] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.481] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.481] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.482] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.482] lstrlenW (lpString="Winmgmt") returned 7 [0054.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.482] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.482] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.482] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.482] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46e0068 | out: hHeap=0x5c0000) returned 1 [0054.482] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0054.485] Process32FirstW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.485] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.486] lstrlenW (lpString="System") returned 6 [0054.486] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.486] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.487] lstrlenW (lpString="smss.exe") returned 8 [0054.487] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.487] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.488] lstrlenW (lpString="csrss.exe") returned 9 [0054.488] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.488] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.488] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.488] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.489] lstrlenW (lpString="wininit.exe") returned 11 [0054.489] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.489] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.489] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.490] lstrlenW (lpString="csrss.exe") returned 9 [0054.490] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.491] lstrlenW (lpString="winlogon.exe") returned 12 [0054.491] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.491] lstrlenW (lpString="services.exe") returned 12 [0054.491] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.492] lstrlenW (lpString="lsass.exe") returned 9 [0054.492] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.493] lstrlenW (lpString="lsm.exe") returned 7 [0054.493] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.493] lstrlenW (lpString="svchost.exe") returned 11 [0054.493] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.494] lstrlenW (lpString="svchost.exe") returned 11 [0054.494] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.495] lstrlenW (lpString="svchost.exe") returned 11 [0054.495] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.496] lstrlenW (lpString="svchost.exe") returned 11 [0054.496] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.496] lstrlenW (lpString="svchost.exe") returned 11 [0054.496] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.497] lstrlenW (lpString="audiodg.exe") returned 11 [0054.497] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.498] lstrlenW (lpString="svchost.exe") returned 11 [0054.498] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.498] lstrlenW (lpString="svchost.exe") returned 11 [0054.498] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.499] lstrlenW (lpString="dwm.exe") returned 7 [0054.499] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.500] lstrlenW (lpString="explorer.exe") returned 12 [0054.500] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.500] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.501] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.501] lstrlenW (lpString="taskhost.exe") returned 12 [0054.501] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.502] lstrlenW (lpString="svchost.exe") returned 11 [0054.502] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.503] lstrlenW (lpString="taskeng.exe") returned 11 [0054.503] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.503] lstrlenW (lpString="taskhost.exe") returned 12 [0054.504] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0054.504] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0054.504] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0054.505] lstrlenW (lpString="locationshumanities.exe") returned 23 [0054.505] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0054.506] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0054.506] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0054.506] lstrlenW (lpString="decreased.exe") returned 13 [0054.506] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0054.565] lstrlenW (lpString="marcus instrument.exe") returned 21 [0054.565] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0054.565] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0054.565] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0054.566] lstrlenW (lpString="hdtv.exe") returned 8 [0054.566] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0054.567] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0054.567] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0054.567] lstrlenW (lpString="adjusted.exe") returned 12 [0054.567] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0054.568] lstrlenW (lpString="width_worker.exe") returned 16 [0054.568] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0054.569] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0054.569] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0054.570] lstrlenW (lpString="licensed.exe") returned 12 [0054.570] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0054.570] lstrlenW (lpString="rocket.exe") returned 10 [0054.570] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0054.571] lstrlenW (lpString="alexander motel.exe") returned 19 [0054.571] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0054.572] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0054.572] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0054.572] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0054.573] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0054.573] lstrlenW (lpString="shall.exe") returned 9 [0054.573] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0054.574] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0054.574] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0054.575] lstrlenW (lpString="fax fixtures.exe") returned 16 [0054.575] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.575] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.575] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0054.576] lstrlenW (lpString="rruzcj.exe") returned 10 [0054.576] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.577] lstrlenW (lpString="cmd.exe") returned 7 [0054.577] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.577] lstrlenW (lpString="conhost.exe") returned 11 [0054.577] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.578] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.578] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.580] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.580] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.580] lstrlenW (lpString="svchost.exe") returned 11 [0054.580] Process32NextW (in: hSnapshot=0x198, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.581] CloseHandle (hObject=0x198) returned 1 [0054.581] Sleep (dwMilliseconds=0x1f4) [0055.159] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x629f70 [0055.160] EnumServicesStatusExW (in: hSCManager=0x629f70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0055.160] GetLastError () returned 0xea [0055.160] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x4026600 [0055.160] EnumServicesStatusExW (in: hSCManager=0x629f70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4026600, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4026600, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0055.163] CloseServiceHandle (hSCObject=0x629f70) returned 1 [0055.163] lstrlenW (lpString="Appinfo") returned 7 [0055.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.163] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.163] lstrlenW (lpString="AudioSrv") returned 8 [0055.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.164] lstrlenW (lpString="BFE") returned 3 [0055.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.164] lstrlenW (lpString="CryptSvc") returned 8 [0055.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.164] lstrlenW (lpString="CscService") returned 10 [0055.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.164] lstrlenW (lpString="DcomLaunch") returned 10 [0055.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.164] lstrlenW (lpString="Dhcp") returned 4 [0055.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.165] lstrlenW (lpString="Dnscache") returned 8 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.165] lstrlenW (lpString="DPS") returned 3 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.165] lstrlenW (lpString="eventlog") returned 8 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.165] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.165] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.165] lstrlenW (lpString="EventSystem") returned 11 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.165] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.165] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.165] lstrlenW (lpString="gpsvc") returned 5 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.165] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.165] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.165] lstrlenW (lpString="iphlpsvc") returned 8 [0055.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.166] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.166] lstrlenW (lpString="LanmanServer") returned 12 [0055.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.166] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.166] lstrlenW (lpString="lmhosts") returned 7 [0055.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.166] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.166] lstrlenW (lpString="MMCSS") returned 5 [0055.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.166] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.166] lstrlenW (lpString="MpsSvc") returned 6 [0055.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.166] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.167] lstrlenW (lpString="Netman") returned 6 [0055.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.167] lstrlenW (lpString="netprofm") returned 8 [0055.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.167] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.167] lstrlenW (lpString="NlaSvc") returned 6 [0055.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.167] lstrlenW (lpString="nsi") returned 3 [0055.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.167] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.167] lstrlenW (lpString="PcaSvc") returned 6 [0055.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.167] lstrlenW (lpString="PlugPlay") returned 8 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.168] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.168] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.168] lstrlenW (lpString="Power") returned 5 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.168] lstrlenW (lpString="ProfSvc") returned 7 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.168] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.168] lstrlenW (lpString="RpcSs") returned 5 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.168] lstrlenW (lpString="SamSs") returned 5 [0055.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.169] lstrlenW (lpString="Schedule") returned 8 [0055.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.169] lstrlenW (lpString="SENS") returned 4 [0055.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.169] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.169] lstrlenW (lpString="Spooler") returned 7 [0055.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.169] lstrlenW (lpString="swprv") returned 5 [0055.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.169] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.169] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.170] lstrlenW (lpString="SysMain") returned 7 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.170] lstrlenW (lpString="Themes") returned 6 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.170] lstrlenW (lpString="TrkWks") returned 6 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.170] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.170] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.170] lstrlenW (lpString="UxSms") returned 5 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.170] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.170] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.170] lstrlenW (lpString="VSS") returned 3 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.170] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.170] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.170] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.171] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.171] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.171] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.171] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.171] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.171] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.171] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.171] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.171] lstrlenW (lpString="Winmgmt") returned 7 [0055.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.171] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.171] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.171] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.171] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4026600 | out: hHeap=0x5c0000) returned 1 [0055.171] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0055.174] Process32FirstW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.174] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.175] lstrlenW (lpString="System") returned 6 [0055.175] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.175] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.176] lstrlenW (lpString="smss.exe") returned 8 [0055.176] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.176] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.177] lstrlenW (lpString="csrss.exe") returned 9 [0055.177] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.177] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.177] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.177] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.178] lstrlenW (lpString="wininit.exe") returned 11 [0055.178] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.178] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.178] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.179] lstrlenW (lpString="csrss.exe") returned 9 [0055.179] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.179] lstrlenW (lpString="winlogon.exe") returned 12 [0055.179] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.180] lstrlenW (lpString="services.exe") returned 12 [0055.180] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.181] lstrlenW (lpString="lsass.exe") returned 9 [0055.181] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.181] lstrlenW (lpString="lsm.exe") returned 7 [0055.181] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.182] lstrlenW (lpString="svchost.exe") returned 11 [0055.182] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.183] lstrlenW (lpString="svchost.exe") returned 11 [0055.183] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.184] lstrlenW (lpString="svchost.exe") returned 11 [0055.184] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.184] lstrlenW (lpString="svchost.exe") returned 11 [0055.184] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.185] lstrlenW (lpString="svchost.exe") returned 11 [0055.185] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.186] lstrlenW (lpString="audiodg.exe") returned 11 [0055.186] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.186] lstrlenW (lpString="svchost.exe") returned 11 [0055.186] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.187] lstrlenW (lpString="svchost.exe") returned 11 [0055.187] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.188] lstrlenW (lpString="dwm.exe") returned 7 [0055.188] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.189] lstrlenW (lpString="explorer.exe") returned 12 [0055.189] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.189] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.189] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.190] lstrlenW (lpString="taskhost.exe") returned 12 [0055.190] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.191] lstrlenW (lpString="svchost.exe") returned 11 [0055.191] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.191] lstrlenW (lpString="taskeng.exe") returned 11 [0055.191] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.192] lstrlenW (lpString="taskhost.exe") returned 12 [0055.192] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0055.193] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0055.193] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0055.194] lstrlenW (lpString="locationshumanities.exe") returned 23 [0055.194] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0055.194] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0055.194] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0055.195] lstrlenW (lpString="decreased.exe") returned 13 [0055.195] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0055.196] lstrlenW (lpString="marcus instrument.exe") returned 21 [0055.196] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0055.196] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0055.196] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0055.197] lstrlenW (lpString="hdtv.exe") returned 8 [0055.197] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0055.198] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0055.198] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0055.251] lstrlenW (lpString="adjusted.exe") returned 12 [0055.251] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0055.252] lstrlenW (lpString="width_worker.exe") returned 16 [0055.252] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0055.252] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0055.252] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0055.253] lstrlenW (lpString="licensed.exe") returned 12 [0055.253] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0055.254] lstrlenW (lpString="rocket.exe") returned 10 [0055.254] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0055.254] lstrlenW (lpString="alexander motel.exe") returned 19 [0055.254] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0055.255] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0055.255] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0055.256] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0055.256] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0055.256] lstrlenW (lpString="shall.exe") returned 9 [0055.256] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0055.257] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0055.257] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0055.258] lstrlenW (lpString="fax fixtures.exe") returned 16 [0055.258] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.258] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.258] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0055.259] lstrlenW (lpString="rruzcj.exe") returned 10 [0055.259] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.260] lstrlenW (lpString="cmd.exe") returned 7 [0055.260] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.260] lstrlenW (lpString="conhost.exe") returned 11 [0055.261] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.261] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.261] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.262] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.262] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.263] lstrlenW (lpString="svchost.exe") returned 11 [0055.263] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.263] CloseHandle (hObject=0x208) returned 1 [0055.263] Sleep (dwMilliseconds=0x1f4) [0056.382] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a010 [0056.382] EnumServicesStatusExW (in: hSCManager=0x62a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0056.383] GetLastError () returned 0xea [0056.383] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x46e0068 [0056.383] EnumServicesStatusExW (in: hSCManager=0x62a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46e0068, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46e0068, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0056.384] CloseServiceHandle (hSCObject=0x62a010) returned 1 [0056.384] lstrlenW (lpString="Appinfo") returned 7 [0056.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.384] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.384] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.384] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.384] lstrlenW (lpString="AudioSrv") returned 8 [0056.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.384] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.384] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.384] lstrlenW (lpString="BFE") returned 3 [0056.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.384] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.384] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.384] lstrlenW (lpString="CryptSvc") returned 8 [0056.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.384] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.385] lstrlenW (lpString="CscService") returned 10 [0056.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.385] lstrlenW (lpString="DcomLaunch") returned 10 [0056.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.385] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.385] lstrlenW (lpString="Dhcp") returned 4 [0056.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.385] lstrlenW (lpString="Dnscache") returned 8 [0056.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.385] lstrlenW (lpString="DPS") returned 3 [0056.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.385] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.386] lstrlenW (lpString="eventlog") returned 8 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.386] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.386] lstrlenW (lpString="EventSystem") returned 11 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.386] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.386] lstrlenW (lpString="gpsvc") returned 5 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.386] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.386] lstrlenW (lpString="iphlpsvc") returned 8 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.386] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.386] lstrlenW (lpString="LanmanServer") returned 12 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.386] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.386] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.387] lstrlenW (lpString="lmhosts") returned 7 [0056.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.387] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.387] lstrlenW (lpString="MMCSS") returned 5 [0056.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.387] lstrlenW (lpString="MpsSvc") returned 6 [0056.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.387] lstrlenW (lpString="Netman") returned 6 [0056.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.387] lstrlenW (lpString="netprofm") returned 8 [0056.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.387] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.387] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.387] lstrlenW (lpString="NlaSvc") returned 6 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.388] lstrlenW (lpString="nsi") returned 3 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.388] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.388] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.388] lstrlenW (lpString="PcaSvc") returned 6 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.388] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.388] lstrlenW (lpString="PlugPlay") returned 8 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.388] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.388] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.388] lstrlenW (lpString="Power") returned 5 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.388] lstrlenW (lpString="ProfSvc") returned 7 [0056.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.389] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.389] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.389] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.389] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.389] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.389] lstrlenW (lpString="RpcSs") returned 5 [0056.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.389] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.389] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.389] lstrlenW (lpString="SamSs") returned 5 [0056.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.389] lstrlenW (lpString="Schedule") returned 8 [0056.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.389] lstrlenW (lpString="SENS") returned 4 [0056.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.390] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.390] lstrlenW (lpString="Spooler") returned 7 [0056.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.390] lstrlenW (lpString="swprv") returned 5 [0056.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.390] lstrlenW (lpString="SysMain") returned 7 [0056.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.390] lstrlenW (lpString="Themes") returned 6 [0056.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.390] lstrlenW (lpString="TrkWks") returned 6 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.391] lstrlenW (lpString="UxSms") returned 5 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.391] lstrlenW (lpString="VSS") returned 3 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.391] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.391] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.391] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.391] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.391] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.392] lstrlenW (lpString="Winmgmt") returned 7 [0056.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.392] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.392] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.392] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.392] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46e0068 | out: hHeap=0x5c0000) returned 1 [0056.392] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0056.394] Process32FirstW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.395] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.396] lstrlenW (lpString="System") returned 6 [0056.396] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.396] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.396] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.397] lstrlenW (lpString="smss.exe") returned 8 [0056.397] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.397] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.397] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.397] lstrlenW (lpString="csrss.exe") returned 9 [0056.397] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.398] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.398] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.398] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.398] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.398] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.398] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.398] lstrlenW (lpString="wininit.exe") returned 11 [0056.398] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.398] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.398] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.399] lstrlenW (lpString="csrss.exe") returned 9 [0056.399] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.400] lstrlenW (lpString="winlogon.exe") returned 12 [0056.400] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.401] lstrlenW (lpString="services.exe") returned 12 [0056.401] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.401] lstrlenW (lpString="lsass.exe") returned 9 [0056.401] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.402] lstrlenW (lpString="lsm.exe") returned 7 [0056.402] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.403] lstrlenW (lpString="svchost.exe") returned 11 [0056.403] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.404] lstrlenW (lpString="svchost.exe") returned 11 [0056.404] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.404] lstrlenW (lpString="svchost.exe") returned 11 [0056.404] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.405] lstrlenW (lpString="svchost.exe") returned 11 [0056.405] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.406] lstrlenW (lpString="svchost.exe") returned 11 [0056.406] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.407] lstrlenW (lpString="audiodg.exe") returned 11 [0056.407] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.407] lstrlenW (lpString="svchost.exe") returned 11 [0056.407] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.408] lstrlenW (lpString="svchost.exe") returned 11 [0056.408] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.409] lstrlenW (lpString="dwm.exe") returned 7 [0056.409] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.409] lstrlenW (lpString="explorer.exe") returned 12 [0056.409] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.410] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.410] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.411] lstrlenW (lpString="taskhost.exe") returned 12 [0056.411] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.411] lstrlenW (lpString="svchost.exe") returned 11 [0056.412] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.412] lstrlenW (lpString="taskeng.exe") returned 11 [0056.412] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.413] lstrlenW (lpString="taskhost.exe") returned 12 [0056.413] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0056.413] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0056.414] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0056.414] lstrlenW (lpString="locationshumanities.exe") returned 23 [0056.414] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0056.415] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0056.415] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0056.592] lstrlenW (lpString="decreased.exe") returned 13 [0056.592] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0056.603] lstrlenW (lpString="marcus instrument.exe") returned 21 [0056.603] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0056.604] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0056.604] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0056.605] lstrlenW (lpString="hdtv.exe") returned 8 [0056.605] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0056.605] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0056.605] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0056.606] lstrlenW (lpString="adjusted.exe") returned 12 [0056.606] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0056.607] lstrlenW (lpString="width_worker.exe") returned 16 [0056.607] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0056.608] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0056.608] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0056.608] lstrlenW (lpString="licensed.exe") returned 12 [0056.608] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0056.609] lstrlenW (lpString="rocket.exe") returned 10 [0056.609] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0056.610] lstrlenW (lpString="alexander motel.exe") returned 19 [0056.610] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0056.610] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0056.610] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0056.611] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0056.611] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0056.612] lstrlenW (lpString="shall.exe") returned 9 [0056.612] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0056.612] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0056.612] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0056.613] lstrlenW (lpString="fax fixtures.exe") returned 16 [0056.613] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.614] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.614] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0056.615] lstrlenW (lpString="rruzcj.exe") returned 10 [0056.615] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.615] lstrlenW (lpString="cmd.exe") returned 7 [0056.615] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.616] lstrlenW (lpString="conhost.exe") returned 11 [0056.616] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.617] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.617] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.617] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.617] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.618] lstrlenW (lpString="svchost.exe") returned 11 [0056.618] Process32NextW (in: hSnapshot=0x160, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.619] CloseHandle (hObject=0x160) returned 1 [0056.619] Sleep (dwMilliseconds=0x1f4) [0057.137] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x629f98 [0057.145] EnumServicesStatusExW (in: hSCManager=0x629f98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0057.146] GetLastError () returned 0xea [0057.146] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0057.146] EnumServicesStatusExW (in: hSCManager=0x629f98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0057.146] CloseServiceHandle (hSCObject=0x629f98) returned 1 [0057.147] lstrlenW (lpString="Appinfo") returned 7 [0057.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.147] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.147] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.147] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.147] lstrlenW (lpString="AudioSrv") returned 8 [0057.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.147] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.147] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.147] lstrlenW (lpString="BFE") returned 3 [0057.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.147] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.147] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.147] lstrlenW (lpString="CryptSvc") returned 8 [0057.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.147] lstrlenW (lpString="CscService") returned 10 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.148] lstrlenW (lpString="DcomLaunch") returned 10 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.148] lstrlenW (lpString="Dhcp") returned 4 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.148] lstrlenW (lpString="Dnscache") returned 8 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.148] lstrlenW (lpString="DPS") returned 3 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.148] lstrlenW (lpString="eventlog") returned 8 [0057.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.148] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.148] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.149] lstrlenW (lpString="EventSystem") returned 11 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.149] lstrlenW (lpString="gpsvc") returned 5 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.149] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.149] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.149] lstrlenW (lpString="iphlpsvc") returned 8 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.149] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.149] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.149] lstrlenW (lpString="LanmanServer") returned 12 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.149] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.149] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.149] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.149] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.149] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.149] lstrlenW (lpString="lmhosts") returned 7 [0057.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.150] lstrlenW (lpString="MMCSS") returned 5 [0057.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.150] lstrlenW (lpString="MpsSvc") returned 6 [0057.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.150] lstrlenW (lpString="Netman") returned 6 [0057.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.150] lstrlenW (lpString="netprofm") returned 8 [0057.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.150] lstrlenW (lpString="NlaSvc") returned 6 [0057.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.150] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.150] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.150] lstrlenW (lpString="nsi") returned 3 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.151] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.151] lstrlenW (lpString="PcaSvc") returned 6 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.151] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.151] lstrlenW (lpString="PlugPlay") returned 8 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.151] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.151] lstrlenW (lpString="Power") returned 5 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.151] lstrlenW (lpString="ProfSvc") returned 7 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.151] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.151] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.151] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.152] lstrlenW (lpString="RpcSs") returned 5 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.152] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.152] lstrlenW (lpString="SamSs") returned 5 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.152] lstrlenW (lpString="Schedule") returned 8 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.152] lstrlenW (lpString="SENS") returned 4 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.152] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.152] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.152] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.152] lstrlenW (lpString="Spooler") returned 7 [0057.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.153] lstrlenW (lpString="swprv") returned 5 [0057.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.153] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.153] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.153] lstrlenW (lpString="SysMain") returned 7 [0057.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.153] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.153] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.153] lstrlenW (lpString="Themes") returned 6 [0057.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.153] lstrlenW (lpString="TrkWks") returned 6 [0057.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.153] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.153] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.153] lstrlenW (lpString="UxSms") returned 5 [0057.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.154] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.154] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.154] lstrlenW (lpString="VSS") returned 3 [0057.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.154] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.154] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.154] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.154] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.154] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.154] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.154] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.154] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.154] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.154] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.154] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.154] lstrlenW (lpString="Winmgmt") returned 7 [0057.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.155] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.155] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.155] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0057.155] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c [0057.157] Process32FirstW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.158] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.158] lstrlenW (lpString="System") returned 6 [0057.158] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.159] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.159] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.159] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.159] lstrlenW (lpString="smss.exe") returned 8 [0057.159] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.159] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.159] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.160] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.160] lstrlenW (lpString="csrss.exe") returned 9 [0057.160] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.160] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.160] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.160] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.161] lstrlenW (lpString="wininit.exe") returned 11 [0057.161] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.161] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.161] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.161] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.162] lstrlenW (lpString="csrss.exe") returned 9 [0057.162] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.163] lstrlenW (lpString="winlogon.exe") returned 12 [0057.163] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.163] lstrlenW (lpString="services.exe") returned 12 [0057.163] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.164] lstrlenW (lpString="lsass.exe") returned 9 [0057.164] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.165] lstrlenW (lpString="lsm.exe") returned 7 [0057.165] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.165] lstrlenW (lpString="svchost.exe") returned 11 [0057.165] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.166] lstrlenW (lpString="svchost.exe") returned 11 [0057.166] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.167] lstrlenW (lpString="svchost.exe") returned 11 [0057.167] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.168] lstrlenW (lpString="svchost.exe") returned 11 [0057.168] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.168] lstrlenW (lpString="svchost.exe") returned 11 [0057.168] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.169] lstrlenW (lpString="audiodg.exe") returned 11 [0057.169] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.170] lstrlenW (lpString="svchost.exe") returned 11 [0057.170] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.170] lstrlenW (lpString="svchost.exe") returned 11 [0057.170] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.171] lstrlenW (lpString="dwm.exe") returned 7 [0057.171] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.172] lstrlenW (lpString="explorer.exe") returned 12 [0057.172] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.172] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.172] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.173] lstrlenW (lpString="taskhost.exe") returned 12 [0057.173] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.174] lstrlenW (lpString="svchost.exe") returned 11 [0057.174] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.174] lstrlenW (lpString="taskeng.exe") returned 11 [0057.174] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.175] lstrlenW (lpString="taskhost.exe") returned 12 [0057.175] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0057.176] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0057.176] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0057.176] lstrlenW (lpString="locationshumanities.exe") returned 23 [0057.176] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0057.177] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0057.177] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0057.178] lstrlenW (lpString="decreased.exe") returned 13 [0057.178] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0057.179] lstrlenW (lpString="marcus instrument.exe") returned 21 [0057.179] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0057.179] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0057.179] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0057.206] lstrlenW (lpString="hdtv.exe") returned 8 [0057.206] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0057.206] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0057.207] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0057.207] lstrlenW (lpString="adjusted.exe") returned 12 [0057.207] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0057.208] lstrlenW (lpString="width_worker.exe") returned 16 [0057.208] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0057.209] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0057.209] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0057.209] lstrlenW (lpString="licensed.exe") returned 12 [0057.209] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0057.210] lstrlenW (lpString="rocket.exe") returned 10 [0057.210] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0057.211] lstrlenW (lpString="alexander motel.exe") returned 19 [0057.211] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0057.211] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0057.211] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0057.212] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0057.212] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shall.exe")) returned 1 [0057.213] lstrlenW (lpString="shall.exe") returned 9 [0057.213] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sellingorientationdefensive.exe")) returned 1 [0057.214] lstrlenW (lpString="sellingorientationdefensive.exe") returned 31 [0057.214] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fax fixtures.exe")) returned 1 [0057.214] lstrlenW (lpString="fax fixtures.exe") returned 16 [0057.215] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.215] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.215] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rruzcj.exe")) returned 1 [0057.216] lstrlenW (lpString="rruzcj.exe") returned 10 [0057.216] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x97c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.217] lstrlenW (lpString="cmd.exe") returned 7 [0057.217] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.217] lstrlenW (lpString="conhost.exe") returned 11 [0057.217] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.233] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.233] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.233] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.233] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.234] lstrlenW (lpString="svchost.exe") returned 11 [0057.234] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.235] CloseHandle (hObject=0x22c) returned 1 [0057.235] Sleep (dwMilliseconds=0x1f4) [0057.917] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643238 [0057.919] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0057.919] GetLastError () returned 0xea [0057.919] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0057.919] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0057.920] CloseServiceHandle (hSCObject=0x643238) returned 1 [0057.920] lstrlenW (lpString="Appinfo") returned 7 [0057.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.920] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.920] lstrlenW (lpString="AudioSrv") returned 8 [0057.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.920] lstrlenW (lpString="BFE") returned 3 [0057.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.921] lstrlenW (lpString="CryptSvc") returned 8 [0057.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.921] lstrlenW (lpString="CscService") returned 10 [0057.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.921] lstrlenW (lpString="DcomLaunch") returned 10 [0057.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.921] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.921] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.921] lstrlenW (lpString="Dhcp") returned 4 [0057.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.921] lstrlenW (lpString="Dnscache") returned 8 [0057.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.921] lstrlenW (lpString="DPS") returned 3 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.922] lstrlenW (lpString="eventlog") returned 8 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.922] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.922] lstrlenW (lpString="EventSystem") returned 11 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.922] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.922] lstrlenW (lpString="gpsvc") returned 5 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.922] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.922] lstrlenW (lpString="iphlpsvc") returned 8 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.922] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.922] lstrlenW (lpString="LanmanServer") returned 12 [0057.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.922] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.923] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.923] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.923] lstrlenW (lpString="lmhosts") returned 7 [0057.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.923] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.923] lstrlenW (lpString="MMCSS") returned 5 [0057.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.923] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.923] lstrlenW (lpString="MpsSvc") returned 6 [0057.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.923] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.923] lstrlenW (lpString="Netman") returned 6 [0057.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.924] lstrlenW (lpString="netprofm") returned 8 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.924] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.924] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.924] lstrlenW (lpString="NlaSvc") returned 6 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.924] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.924] lstrlenW (lpString="nsi") returned 3 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.924] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.924] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.924] lstrlenW (lpString="PcaSvc") returned 6 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.924] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.924] lstrlenW (lpString="PlugPlay") returned 8 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.924] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.924] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.924] lstrlenW (lpString="Power") returned 5 [0057.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.925] lstrlenW (lpString="ProfSvc") returned 7 [0057.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.925] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.925] lstrlenW (lpString="RpcSs") returned 5 [0057.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.925] lstrlenW (lpString="SamSs") returned 5 [0057.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.925] lstrlenW (lpString="Schedule") returned 8 [0057.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.926] lstrlenW (lpString="SENS") returned 4 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.926] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.926] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.926] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.926] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.926] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.926] lstrlenW (lpString="Spooler") returned 7 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.926] lstrlenW (lpString="swprv") returned 5 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.926] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.926] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.926] lstrlenW (lpString="SysMain") returned 7 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.926] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.926] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.926] lstrlenW (lpString="Themes") returned 6 [0057.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.927] lstrlenW (lpString="TrkWks") returned 6 [0057.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.927] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.927] lstrlenW (lpString="UxSms") returned 5 [0057.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.927] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.927] lstrlenW (lpString="VSS") returned 3 [0057.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.927] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.927] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.927] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.927] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.927] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.928] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.928] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.928] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.928] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.928] lstrlenW (lpString="Winmgmt") returned 7 [0057.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.928] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.928] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.928] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.928] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0057.928] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0057.930] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.931] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.932] lstrlenW (lpString="System") returned 6 [0057.932] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.932] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.932] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.935] lstrlenW (lpString="smss.exe") returned 8 [0057.935] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.935] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.936] lstrlenW (lpString="csrss.exe") returned 9 [0057.936] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.936] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.936] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.936] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.936] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.936] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.936] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.937] lstrlenW (lpString="wininit.exe") returned 11 [0057.937] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.937] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.937] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.937] @NlsCompareInvariantNoCase@16 () [0057.937] @NlsCompareInvariantNoCase@16 () [0057.937] @NlsCompareInvariantNoCase@16 () [0057.937] @NlsCompareInvariantNoCase@16 () [0057.937] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.940] lstrlenW (lpString="csrss.exe") returned 9 [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] @NlsCompareInvariantNoCase@16 () [0057.940] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.942] lstrlenW (lpString="winlogon.exe") returned 12 [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] @NlsCompareInvariantNoCase@16 () [0057.942] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.943] lstrlenW (lpString="services.exe") returned 12 [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] @NlsCompareInvariantNoCase@16 () [0057.943] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.946] lstrlenW (lpString="lsass.exe") returned 9 [0057.946] @NlsCompareInvariantNoCase@16 () [0057.946] @NlsCompareInvariantNoCase@16 () [0057.946] @NlsCompareInvariantNoCase@16 () [0057.947] @NlsCompareInvariantNoCase@16 () [0057.949] @NlsCompareInvariantNoCase@16 () [0057.950] @NlsCompareInvariantNoCase@16 () [0057.950] @NlsCompareInvariantNoCase@16 () [0057.950] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.950] lstrlenW (lpString="lsm.exe") returned 7 [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.951] lstrlenW (lpString="svchost.exe") returned 11 [0057.951] @NlsCompareInvariantNoCase@16 () [0057.951] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.952] lstrlenW (lpString="svchost.exe") returned 11 [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.952] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.953] lstrlenW (lpString="svchost.exe") returned 11 [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.953] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.954] lstrlenW (lpString="svchost.exe") returned 11 [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.954] @NlsCompareInvariantNoCase@16 () [0057.955] @NlsCompareInvariantNoCase@16 () [0057.955] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.960] lstrlenW (lpString="svchost.exe") returned 11 [0057.960] @NlsCompareInvariantNoCase@16 () [0057.960] @NlsCompareInvariantNoCase@16 () [0057.961] @NlsCompareInvariantNoCase@16 () [0057.961] @NlsCompareInvariantNoCase@16 () [0057.961] @NlsCompareInvariantNoCase@16 () [0057.961] @NlsCompareInvariantNoCase@16 () [0057.961] @NlsCompareInvariantNoCase@16 () [0057.961] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.962] lstrlenW (lpString="audiodg.exe") returned 11 [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] @NlsCompareInvariantNoCase@16 () [0057.962] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.963] lstrlenW (lpString="svchost.exe") returned 11 [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] @NlsCompareInvariantNoCase@16 () [0057.963] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.964] lstrlenW (lpString="svchost.exe") returned 11 [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] @NlsCompareInvariantNoCase@16 () [0057.964] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.964] lstrlenW (lpString="dwm.exe") returned 7 [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] @NlsCompareInvariantNoCase@16 () [0057.965] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.966] lstrlenW (lpString="explorer.exe") returned 12 [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] @NlsCompareInvariantNoCase@16 () [0057.966] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.967] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] @NlsCompareInvariantNoCase@16 () [0057.967] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.968] lstrlenW (lpString="taskhost.exe") returned 12 [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] @NlsCompareInvariantNoCase@16 () [0057.968] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.969] lstrlenW (lpString="svchost.exe") returned 11 [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] @NlsCompareInvariantNoCase@16 () [0057.969] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.970] lstrlenW (lpString="taskeng.exe") returned 11 [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] @NlsCompareInvariantNoCase@16 () [0057.970] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.970] lstrlenW (lpString="taskhost.exe") returned 12 [0057.970] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] @NlsCompareInvariantNoCase@16 () [0057.971] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0058.268] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] @NlsCompareInvariantNoCase@16 () [0058.268] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0058.269] lstrlenW (lpString="locationshumanities.exe") returned 23 [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] @NlsCompareInvariantNoCase@16 () [0058.269] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0058.270] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] @NlsCompareInvariantNoCase@16 () [0058.270] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0058.271] lstrlenW (lpString="decreased.exe") returned 13 [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] @NlsCompareInvariantNoCase@16 () [0058.271] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0058.272] lstrlenW (lpString="marcus instrument.exe") returned 21 [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] @NlsCompareInvariantNoCase@16 () [0058.272] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0058.273] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] @NlsCompareInvariantNoCase@16 () [0058.273] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0058.274] lstrlenW (lpString="hdtv.exe") returned 8 [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] @NlsCompareInvariantNoCase@16 () [0058.274] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0058.275] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] @NlsCompareInvariantNoCase@16 () [0058.275] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0058.276] lstrlenW (lpString="adjusted.exe") returned 12 [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] @NlsCompareInvariantNoCase@16 () [0058.276] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0058.277] lstrlenW (lpString="width_worker.exe") returned 16 [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] @NlsCompareInvariantNoCase@16 () [0058.277] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0058.278] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] @NlsCompareInvariantNoCase@16 () [0058.278] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0058.279] lstrlenW (lpString="licensed.exe") returned 12 [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] @NlsCompareInvariantNoCase@16 () [0058.279] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0058.280] lstrlenW (lpString="rocket.exe") returned 10 [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] @NlsCompareInvariantNoCase@16 () [0058.280] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0058.281] lstrlenW (lpString="alexander motel.exe") returned 19 [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] @NlsCompareInvariantNoCase@16 () [0058.281] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0058.282] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] @NlsCompareInvariantNoCase@16 () [0058.282] Process32NextW (in: hSnapshot=0x1c8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0058.283] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0063.507] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x643238 [0063.521] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0063.526] GetLastError () returned 0xea [0063.528] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x64a468 [0063.528] EnumServicesStatusExW (in: hSCManager=0x643238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64a468, cbBufSize=0x12c6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64a468, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0063.539] CloseServiceHandle (hSCObject=0x643238) returned 1 [0063.543] lstrlenW (lpString="Appinfo") returned 7 [0063.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.543] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.544] lstrlenW (lpString="AudioSrv") returned 8 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.544] lstrlenW (lpString="BFE") returned 3 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.544] lstrlenW (lpString="CryptSvc") returned 8 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.544] lstrlenW (lpString="CscService") returned 10 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.544] lstrlenW (lpString="DcomLaunch") returned 10 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.545] lstrlenW (lpString="Dhcp") returned 4 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.545] lstrlenW (lpString="Dnscache") returned 8 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.545] lstrlenW (lpString="DPS") returned 3 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.545] lstrlenW (lpString="eventlog") returned 8 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.545] lstrlenW (lpString="EventSystem") returned 11 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.545] lstrlenW (lpString="gpsvc") returned 5 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.546] lstrlenW (lpString="iphlpsvc") returned 8 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.546] lstrlenW (lpString="LanmanServer") returned 12 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.546] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.546] lstrlenW (lpString="lmhosts") returned 7 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.546] lstrlenW (lpString="MMCSS") returned 5 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.547] lstrlenW (lpString="MpsSvc") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.547] lstrlenW (lpString="Netman") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.547] lstrlenW (lpString="netprofm") returned 8 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.547] lstrlenW (lpString="NlaSvc") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.547] lstrlenW (lpString="nsi") returned 3 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.547] lstrlenW (lpString="PcaSvc") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.548] lstrlenW (lpString="PlugPlay") returned 8 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.548] lstrlenW (lpString="Power") returned 5 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.548] lstrlenW (lpString="ProfSvc") returned 7 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.548] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.548] lstrlenW (lpString="RpcSs") returned 5 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.549] lstrlenW (lpString="SamSs") returned 5 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.549] lstrlenW (lpString="Schedule") returned 8 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.549] lstrlenW (lpString="SENS") returned 4 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.549] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.549] lstrlenW (lpString="Spooler") returned 7 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.550] lstrlenW (lpString="swprv") returned 5 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.550] lstrlenW (lpString="SysMain") returned 7 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.550] lstrlenW (lpString="Themes") returned 6 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.550] lstrlenW (lpString="TrkWks") returned 6 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.550] lstrlenW (lpString="UxSms") returned 5 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.551] lstrlenW (lpString="VSS") returned 3 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.551] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.551] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.551] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.551] lstrlenW (lpString="Winmgmt") returned 7 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.552] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.552] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a468 | out: hHeap=0x5c0000) returned 1 [0063.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0063.554] Process32FirstW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.555] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.555] lstrlenW (lpString="System") returned 6 [0063.555] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.556] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.556] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.556] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.556] lstrlenW (lpString="smss.exe") returned 8 [0063.556] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.557] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.557] lstrlenW (lpString="csrss.exe") returned 9 [0063.557] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.557] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.557] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0063.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0063.558] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.558] lstrlenW (lpString="wininit.exe") returned 11 [0063.558] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0063.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0063.558] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0063.558] @NlsCompareInvariantNoCase@16 () [0063.558] @NlsCompareInvariantNoCase@16 () [0063.558] @NlsCompareInvariantNoCase@16 () [0063.558] @NlsCompareInvariantNoCase@16 () [0063.558] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.559] lstrlenW (lpString="csrss.exe") returned 9 [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] @NlsCompareInvariantNoCase@16 () [0063.559] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.560] lstrlenW (lpString="winlogon.exe") returned 12 [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] @NlsCompareInvariantNoCase@16 () [0063.560] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.561] lstrlenW (lpString="services.exe") returned 12 [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] @NlsCompareInvariantNoCase@16 () [0063.561] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.562] lstrlenW (lpString="lsass.exe") returned 9 [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] @NlsCompareInvariantNoCase@16 () [0063.562] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.563] lstrlenW (lpString="lsm.exe") returned 7 [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] @NlsCompareInvariantNoCase@16 () [0063.563] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.564] lstrlenW (lpString="svchost.exe") returned 11 [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] @NlsCompareInvariantNoCase@16 () [0063.564] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.565] lstrlenW (lpString="svchost.exe") returned 11 [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] @NlsCompareInvariantNoCase@16 () [0063.565] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.566] lstrlenW (lpString="svchost.exe") returned 11 [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] @NlsCompareInvariantNoCase@16 () [0063.566] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.567] lstrlenW (lpString="svchost.exe") returned 11 [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.567] lstrlenW (lpString="svchost.exe") returned 11 [0063.567] @NlsCompareInvariantNoCase@16 () [0063.567] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.568] lstrlenW (lpString="audiodg.exe") returned 11 [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.568] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.569] lstrlenW (lpString="svchost.exe") returned 11 [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.569] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.570] lstrlenW (lpString="svchost.exe") returned 11 [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] @NlsCompareInvariantNoCase@16 () [0063.570] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.571] lstrlenW (lpString="dwm.exe") returned 7 [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] @NlsCompareInvariantNoCase@16 () [0063.571] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.572] lstrlenW (lpString="explorer.exe") returned 12 [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] @NlsCompareInvariantNoCase@16 () [0063.572] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.573] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] @NlsCompareInvariantNoCase@16 () [0063.573] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.669] lstrlenW (lpString="taskhost.exe") returned 12 [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] @NlsCompareInvariantNoCase@16 () [0063.669] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.670] lstrlenW (lpString="svchost.exe") returned 11 [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] @NlsCompareInvariantNoCase@16 () [0063.670] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.671] lstrlenW (lpString="taskeng.exe") returned 11 [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] @NlsCompareInvariantNoCase@16 () [0063.671] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.672] lstrlenW (lpString="taskhost.exe") returned 12 [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] @NlsCompareInvariantNoCase@16 () [0063.672] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0063.673] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] @NlsCompareInvariantNoCase@16 () [0063.673] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0063.674] lstrlenW (lpString="locationshumanities.exe") returned 23 [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] @NlsCompareInvariantNoCase@16 () [0063.674] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0063.675] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] @NlsCompareInvariantNoCase@16 () [0063.675] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0063.676] lstrlenW (lpString="decreased.exe") returned 13 [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] @NlsCompareInvariantNoCase@16 () [0063.676] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0063.677] lstrlenW (lpString="marcus instrument.exe") returned 21 [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] @NlsCompareInvariantNoCase@16 () [0063.677] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0063.678] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] @NlsCompareInvariantNoCase@16 () [0063.678] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0063.679] lstrlenW (lpString="hdtv.exe") returned 8 [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] @NlsCompareInvariantNoCase@16 () [0063.679] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0063.680] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] @NlsCompareInvariantNoCase@16 () [0063.680] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0063.680] lstrlenW (lpString="adjusted.exe") returned 12 [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] @NlsCompareInvariantNoCase@16 () [0063.681] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0063.681] lstrlenW (lpString="width_worker.exe") returned 16 [0063.681] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0063.682] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.682] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0063.683] lstrlenW (lpString="licensed.exe") returned 12 [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.683] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0063.684] lstrlenW (lpString="rocket.exe") returned 10 [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] @NlsCompareInvariantNoCase@16 () [0063.684] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0063.685] lstrlenW (lpString="alexander motel.exe") returned 19 [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] @NlsCompareInvariantNoCase@16 () [0063.685] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fixes-mc-money.exe")) returned 1 [0063.686] lstrlenW (lpString="fixes-mc-money.exe") returned 18 [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] @NlsCompareInvariantNoCase@16 () [0063.686] Process32NextW (in: hSnapshot=0x15c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x110, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ri_hint_vb.exe")) returned 1 [0063.687] lstrlenW (lpString="ri_hint_vb.exe") returned 14 [0108.081] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62a1f0 [0108.082] EnumServicesStatusExW (in: hSCManager=0x62a1f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0108.082] GetLastError () returned 0xea [0108.082] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1378) returned 0x6b46f0 [0108.082] EnumServicesStatusExW (in: hSCManager=0x62a1f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b46f0, cbBufSize=0x1378, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b46f0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0108.083] CloseServiceHandle (hSCObject=0x62a1f0) returned 1 [0108.083] lstrlenW (lpString="Appinfo") returned 7 [0108.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.083] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.083] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.083] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.084] lstrlenW (lpString="AudioSrv") returned 8 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0108.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0108.084] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0108.084] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0108.084] lstrlenW (lpString="BFE") returned 3 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.084] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.084] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.084] lstrlenW (lpString="CryptSvc") returned 8 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.084] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.084] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.084] lstrlenW (lpString="CscService") returned 10 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0108.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0108.084] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0108.084] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0108.084] lstrlenW (lpString="DcomLaunch") returned 10 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.084] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.084] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.084] lstrlenW (lpString="Dhcp") returned 4 [0108.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.085] lstrlenW (lpString="Dnscache") returned 8 [0108.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.085] lstrlenW (lpString="DPS") returned 3 [0108.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.085] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.085] lstrlenW (lpString="eventlog") returned 8 [0108.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0108.085] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0108.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0108.085] lstrlenW (lpString="EventSystem") returned 11 [0108.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.085] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.085] lstrlenW (lpString="FontCache") returned 9 [0108.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0108.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0108.085] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0108.086] lstrlenW (lpString="gpsvc") returned 5 [0108.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.086] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.086] lstrlenW (lpString="iphlpsvc") returned 8 [0108.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.086] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.086] lstrlenW (lpString="LanmanServer") returned 12 [0108.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.086] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.086] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.086] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.086] lstrlenW (lpString="lmhosts") returned 7 [0108.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.086] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.086] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.086] lstrlenW (lpString="MMCSS") returned 5 [0108.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0108.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0108.087] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0108.087] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0108.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0108.087] lstrlenW (lpString="MpsSvc") returned 6 [0108.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.087] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.087] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.087] lstrlenW (lpString="Netman") returned 6 [0108.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0108.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0108.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0108.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0108.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0108.087] lstrlenW (lpString="netprofm") returned 8 [0108.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.087] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.087] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.087] lstrlenW (lpString="NlaSvc") returned 6 [0108.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.087] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.087] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.088] lstrlenW (lpString="nsi") returned 3 [0108.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.089] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.089] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.090] lstrlenW (lpString="PcaSvc") returned 6 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.090] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.090] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.090] lstrlenW (lpString="PlugPlay") returned 8 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.090] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.090] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.090] lstrlenW (lpString="Power") returned 5 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.090] lstrlenW (lpString="ProfSvc") returned 7 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.090] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.090] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.090] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.090] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.090] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.090] lstrlenW (lpString="RpcSs") returned 5 [0108.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.091] lstrlenW (lpString="SamSs") returned 5 [0108.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.091] lstrlenW (lpString="Schedule") returned 8 [0108.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.091] lstrlenW (lpString="SENS") returned 4 [0108.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.091] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.091] lstrlenW (lpString="Spooler") returned 7 [0108.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.092] lstrlenW (lpString="sppsvc") returned 6 [0108.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0108.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0108.092] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0108.092] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0108.092] lstrlenW (lpString="swprv") returned 5 [0108.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0108.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0108.092] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0108.092] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0108.092] lstrlenW (lpString="SysMain") returned 7 [0108.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0108.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0108.092] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0108.092] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0108.092] lstrlenW (lpString="Themes") returned 6 [0108.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0108.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0108.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0108.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0108.092] lstrlenW (lpString="TrkWks") returned 6 [0108.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0108.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0108.092] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0108.092] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0108.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0108.092] lstrlenW (lpString="UxSms") returned 5 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0108.093] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0108.093] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0108.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0108.093] lstrlenW (lpString="VSS") returned 3 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0108.093] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0108.093] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0108.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0108.093] lstrlenW (lpString="WdiServiceHost") returned 14 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0108.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0108.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0108.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0108.093] lstrlenW (lpString="WdiSystemHost") returned 13 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0108.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0108.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0108.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0108.093] lstrlenW (lpString="WinDefend") returned 9 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0108.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0108.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0108.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0108.093] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0108.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0108.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0108.094] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0108.094] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0108.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0108.094] lstrlenW (lpString="Winmgmt") returned 7 [0108.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0108.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0108.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0108.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0108.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0108.094] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b46f0 | out: hHeap=0x5c0000) returned 1 [0108.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0108.096] Process32FirstW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.097] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.098] lstrlenW (lpString="System") returned 6 [0108.098] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0108.098] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0108.098] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.099] lstrlenW (lpString="smss.exe") returned 8 [0108.099] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0108.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0108.099] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.100] lstrlenW (lpString="csrss.exe") returned 9 [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] @NlsCompareInvariantNoCase@16 () [0108.100] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.100] lstrlenW (lpString="wininit.exe") returned 11 [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] @NlsCompareInvariantNoCase@16 () [0108.101] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.101] lstrlenW (lpString="csrss.exe") returned 9 [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] @NlsCompareInvariantNoCase@16 () [0108.102] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.102] lstrlenW (lpString="winlogon.exe") returned 12 [0108.102] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] @NlsCompareInvariantNoCase@16 () [0108.103] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.104] lstrlenW (lpString="services.exe") returned 12 [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] @NlsCompareInvariantNoCase@16 () [0108.104] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.105] lstrlenW (lpString="lsass.exe") returned 9 [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] @NlsCompareInvariantNoCase@16 () [0108.105] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0108.106] lstrlenW (lpString="lsm.exe") returned 7 [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] @NlsCompareInvariantNoCase@16 () [0108.106] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.107] lstrlenW (lpString="svchost.exe") returned 11 [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] @NlsCompareInvariantNoCase@16 () [0108.107] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.107] lstrlenW (lpString="svchost.exe") returned 11 [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] @NlsCompareInvariantNoCase@16 () [0108.108] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.108] lstrlenW (lpString="svchost.exe") returned 11 [0108.108] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.109] lstrlenW (lpString="svchost.exe") returned 11 [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.109] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.110] lstrlenW (lpString="svchost.exe") returned 11 [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.110] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.111] lstrlenW (lpString="audiodg.exe") returned 11 [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.111] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.112] lstrlenW (lpString="svchost.exe") returned 11 [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.112] @NlsCompareInvariantNoCase@16 () [0108.113] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.113] lstrlenW (lpString="svchost.exe") returned 11 [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] @NlsCompareInvariantNoCase@16 () [0108.113] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.114] lstrlenW (lpString="dwm.exe") returned 7 [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.114] @NlsCompareInvariantNoCase@16 () [0108.115] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.115] lstrlenW (lpString="explorer.exe") returned 12 [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] @NlsCompareInvariantNoCase@16 () [0108.115] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.116] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] @NlsCompareInvariantNoCase@16 () [0108.116] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0108.117] lstrlenW (lpString="taskhost.exe") returned 12 [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] @NlsCompareInvariantNoCase@16 () [0108.117] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.118] lstrlenW (lpString="svchost.exe") returned 11 [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] @NlsCompareInvariantNoCase@16 () [0108.118] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0108.300] lstrlenW (lpString="taskeng.exe") returned 11 [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] @NlsCompareInvariantNoCase@16 () [0108.300] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0108.303] lstrlenW (lpString="taskhost.exe") returned 12 [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] @NlsCompareInvariantNoCase@16 () [0108.303] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="first-nc-parking.exe")) returned 1 [0108.304] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] @NlsCompareInvariantNoCase@16 () [0108.304] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locationshumanities.exe")) returned 1 [0108.305] lstrlenW (lpString="locationshumanities.exe") returned 23 [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] @NlsCompareInvariantNoCase@16 () [0108.305] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absadministrationronald.exe")) returned 1 [0108.306] lstrlenW (lpString="absadministrationronald.exe") returned 27 [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] @NlsCompareInvariantNoCase@16 () [0108.306] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decreased.exe")) returned 1 [0108.307] lstrlenW (lpString="decreased.exe") returned 13 [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] @NlsCompareInvariantNoCase@16 () [0108.307] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="marcus instrument.exe")) returned 1 [0108.308] lstrlenW (lpString="marcus instrument.exe") returned 21 [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] @NlsCompareInvariantNoCase@16 () [0108.308] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="techniquesconsolidated.exe")) returned 1 [0108.309] lstrlenW (lpString="techniquesconsolidated.exe") returned 26 [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] @NlsCompareInvariantNoCase@16 () [0108.309] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hdtv.exe")) returned 1 [0108.310] lstrlenW (lpString="hdtv.exe") returned 8 [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] @NlsCompareInvariantNoCase@16 () [0108.310] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funky-java-applies.exe")) returned 1 [0108.311] lstrlenW (lpString="funky-java-applies.exe") returned 22 [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] @NlsCompareInvariantNoCase@16 () [0108.311] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjusted.exe")) returned 1 [0108.312] lstrlenW (lpString="adjusted.exe") returned 12 [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] @NlsCompareInvariantNoCase@16 () [0108.312] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="width_worker.exe")) returned 1 [0108.313] lstrlenW (lpString="width_worker.exe") returned 16 [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] @NlsCompareInvariantNoCase@16 () [0108.313] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="markers municipal assignments.exe")) returned 1 [0108.314] lstrlenW (lpString="markers municipal assignments.exe") returned 33 [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] @NlsCompareInvariantNoCase@16 () [0108.314] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="licensed.exe")) returned 1 [0108.315] lstrlenW (lpString="licensed.exe") returned 12 [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] @NlsCompareInvariantNoCase@16 () [0108.315] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rocket.exe")) returned 1 [0108.316] lstrlenW (lpString="rocket.exe") returned 10 [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] @NlsCompareInvariantNoCase@16 () [0108.316] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alexander motel.exe")) returned 1 [0108.317] lstrlenW (lpString="alexander motel.exe") returned 19 [0108.317] @NlsCompareInvariantNoCase@16 () [0108.317] @NlsCompareInvariantNoCase@16 () [0108.317] @NlsCompareInvariantNoCase@16 () [0108.317] @NlsCompareInvariantNoCase@16 () Thread: id = 5 os_tid = 0x99c [0032.189] WaitForSingleObject (hHandle=0x18f484, dwMilliseconds=0xffffffff) returned 0xffffffff [0032.189] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626cf0 | out: hHeap=0x5c0000) returned 1 Thread: id = 6 os_tid = 0x9a0 [0032.190] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626cf0 [0032.190] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x626cf0, Size=0x20) returned 0x629de0 [0032.190] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x629de0, Size=0x40) returned 0x615dc8 [0032.190] GetLogicalDrives () returned 0x4 [0032.190] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x671258 [0032.190] GetComputerNameW (in: lpBuffer=0x67125c, nSize=0x246ff6c | out: lpBuffer="XDUWTFONO", nSize=0x246ff6c) returned 1 [0032.191] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x681260 [0032.191] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x246ff3c | out: lphEnum=0x246ff3c*=0x627c10) returned 0x0 [0032.191] WNetEnumResourceW (in: hEnum=0x627c10, lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40) returned 0x103 [0032.191] WNetCloseEnum (hEnum=0x627c10) returned 0x0 [0032.191] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x246ff3c | out: lphEnum=0x246ff3c*=0x3fc2768) returned 0x0 [0038.033] WNetEnumResourceW (in: hEnum=0x3fc2768, lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40) returned 0x0 [0038.033] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x4028628 [0038.033] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x681260, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x627db0) returned 0x0 [0038.042] WNetEnumResourceW (in: hEnum=0x627db0, lpcCount=0x246ff0c, lpBuffer=0x4028628, lpBufferSize=0x246ff14 | out: lpcCount=0x246ff0c, lpBuffer=0x4028628, lpBufferSize=0x246ff14) returned 0x103 [0038.042] WNetCloseEnum (hEnum=0x627db0) returned 0x0 [0038.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x402b640 [0038.042] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x681280, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x0) returned 0x4b8 [0058.265] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x402e658 [0058.265] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6812a0, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x0) returned 0x4c6 [0058.268] WNetEnumResourceW (in: hEnum=0x3fc2768, lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x681260, lpBufferSize=0x246ff40) returned 0x103 [0058.268] WNetCloseEnum (hEnum=0x3fc2768) returned 0x0 [0058.268] GetLogicalDrives () returned 0x4 [0058.268] Sleep (dwMilliseconds=0x64) [0058.452] GetLogicalDrives () returned 0x4 [0058.452] Sleep (dwMilliseconds=0x64) [0058.751] GetLogicalDrives () returned 0x4 [0058.751] Sleep (dwMilliseconds=0x64) [0059.108] GetLogicalDrives () returned 0x4 [0059.108] Sleep (dwMilliseconds=0x64) [0059.213] GetLogicalDrives () returned 0x4 [0059.213] Sleep (dwMilliseconds=0x64) [0059.322] GetLogicalDrives () returned 0x4 [0059.322] Sleep (dwMilliseconds=0x64) [0059.502] GetLogicalDrives () returned 0x4 [0059.502] Sleep (dwMilliseconds=0x64) [0060.330] GetLogicalDrives () returned 0x4 [0060.330] Sleep (dwMilliseconds=0x64) [0060.708] GetLogicalDrives () returned 0x4 [0060.720] Sleep (dwMilliseconds=0x64) [0060.890] GetLogicalDrives () returned 0x4 [0060.890] Sleep (dwMilliseconds=0x64) [0061.403] GetLogicalDrives () returned 0x4 [0061.403] Sleep (dwMilliseconds=0x64) [0061.769] GetLogicalDrives () returned 0x4 [0061.770] Sleep (dwMilliseconds=0x64) [0061.902] GetLogicalDrives () returned 0x4 [0061.902] Sleep (dwMilliseconds=0x64) [0062.153] GetLogicalDrives () returned 0x4 [0062.153] Sleep (dwMilliseconds=0x64) [0062.367] GetLogicalDrives () returned 0x4 [0062.367] Sleep (dwMilliseconds=0x64) [0062.873] GetLogicalDrives () returned 0x4 [0062.873] Sleep (dwMilliseconds=0x64) [0063.579] GetLogicalDrives () returned 0x4 [0063.579] Sleep (dwMilliseconds=0x64) [0063.884] GetLogicalDrives () returned 0x4 [0063.884] Sleep (dwMilliseconds=0x64) [0063.991] GetLogicalDrives () returned 0x4 [0063.991] Sleep (dwMilliseconds=0x64) [0064.384] GetLogicalDrives () returned 0x4 [0064.386] Sleep (dwMilliseconds=0x64) [0064.786] GetLogicalDrives () returned 0x4 [0064.786] Sleep (dwMilliseconds=0x64) [0065.095] GetLogicalDrives () returned 0x4 [0065.095] Sleep (dwMilliseconds=0x64) [0065.954] GetLogicalDrives () returned 0x4 [0065.955] Sleep (dwMilliseconds=0x64) [0066.093] GetLogicalDrives () returned 0x4 [0066.093] Sleep (dwMilliseconds=0x64) [0066.286] GetLogicalDrives () returned 0x4 [0066.286] Sleep (dwMilliseconds=0x64) [0066.511] GetLogicalDrives () returned 0x4 [0066.511] Sleep (dwMilliseconds=0x64) [0067.436] GetLogicalDrives () returned 0x4 [0067.437] Sleep (dwMilliseconds=0x64) [0067.573] GetLogicalDrives () returned 0x4 [0067.573] Sleep (dwMilliseconds=0x64) [0067.725] GetLogicalDrives () returned 0x4 [0067.725] Sleep (dwMilliseconds=0x64) [0067.840] GetLogicalDrives () returned 0x4 [0067.840] Sleep (dwMilliseconds=0x64) [0068.373] GetLogicalDrives () returned 0x4 [0068.373] Sleep (dwMilliseconds=0x64) [0068.479] GetLogicalDrives () returned 0x4 [0068.480] Sleep (dwMilliseconds=0x64) [0068.589] GetLogicalDrives () returned 0x4 [0068.589] Sleep (dwMilliseconds=0x64) [0069.176] GetLogicalDrives () returned 0x4 [0069.176] Sleep (dwMilliseconds=0x64) [0069.329] GetLogicalDrives () returned 0x4 [0069.329] Sleep (dwMilliseconds=0x64) [0069.529] GetLogicalDrives () returned 0x4 [0069.529] Sleep (dwMilliseconds=0x64) [0070.026] GetLogicalDrives () returned 0x4 [0070.026] Sleep (dwMilliseconds=0x64) [0070.706] GetLogicalDrives () returned 0x4 [0070.706] Sleep (dwMilliseconds=0x64) [0071.089] GetLogicalDrives () returned 0x4 [0071.089] Sleep (dwMilliseconds=0x64) [0071.397] GetLogicalDrives () returned 0x4 [0071.397] Sleep (dwMilliseconds=0x64) [0071.631] GetLogicalDrives () returned 0x4 [0071.631] Sleep (dwMilliseconds=0x64) [0071.792] GetLogicalDrives () returned 0x4 [0071.792] Sleep (dwMilliseconds=0x64) [0071.934] GetLogicalDrives () returned 0x4 [0071.934] Sleep (dwMilliseconds=0x64) [0072.212] GetLogicalDrives () returned 0x4 [0072.212] Sleep (dwMilliseconds=0x64) [0072.408] GetLogicalDrives () returned 0x4 [0072.408] Sleep (dwMilliseconds=0x64) [0072.634] GetLogicalDrives () returned 0x4 [0072.634] Sleep (dwMilliseconds=0x64) [0073.205] GetLogicalDrives () returned 0x4 [0073.205] Sleep (dwMilliseconds=0x64) [0073.731] GetLogicalDrives () returned 0x4 [0073.731] Sleep (dwMilliseconds=0x64) [0073.831] GetLogicalDrives () returned 0x4 [0073.831] Sleep (dwMilliseconds=0x64) [0074.047] GetLogicalDrives () returned 0x4 [0074.047] Sleep (dwMilliseconds=0x64) [0074.155] GetLogicalDrives () returned 0x4 [0074.155] Sleep (dwMilliseconds=0x64) [0074.390] GetLogicalDrives () returned 0x4 [0074.390] Sleep (dwMilliseconds=0x64) [0074.756] GetLogicalDrives () returned 0x4 [0074.756] Sleep (dwMilliseconds=0x64) [0075.211] GetLogicalDrives () returned 0x4 [0075.211] Sleep (dwMilliseconds=0x64) [0075.332] GetLogicalDrives () returned 0x4 [0075.332] Sleep (dwMilliseconds=0x64) [0075.883] GetLogicalDrives () returned 0x4 [0075.883] Sleep (dwMilliseconds=0x64) [0075.986] GetLogicalDrives () returned 0x4 [0075.986] Sleep (dwMilliseconds=0x64) [0076.093] GetLogicalDrives () returned 0x4 [0076.093] Sleep (dwMilliseconds=0x64) [0076.274] GetLogicalDrives () returned 0x4 [0076.274] Sleep (dwMilliseconds=0x64) [0076.648] GetLogicalDrives () returned 0x4 [0076.648] Sleep (dwMilliseconds=0x64) [0076.777] GetLogicalDrives () returned 0x4 [0076.777] Sleep (dwMilliseconds=0x64) [0076.933] GetLogicalDrives () returned 0x4 [0076.933] Sleep (dwMilliseconds=0x64) [0077.445] GetLogicalDrives () returned 0x4 [0077.445] Sleep (dwMilliseconds=0x64) [0077.586] GetLogicalDrives () returned 0x4 [0077.586] Sleep (dwMilliseconds=0x64) [0077.683] GetLogicalDrives () returned 0x4 [0077.683] Sleep (dwMilliseconds=0x64) [0078.032] GetLogicalDrives () returned 0x4 [0078.032] Sleep (dwMilliseconds=0x64) [0078.432] GetLogicalDrives () returned 0x4 [0078.432] Sleep (dwMilliseconds=0x64) [0078.765] GetLogicalDrives () returned 0x4 [0078.765] Sleep (dwMilliseconds=0x64) [0079.182] GetLogicalDrives () returned 0x4 [0079.182] Sleep (dwMilliseconds=0x64) [0079.432] GetLogicalDrives () returned 0x4 [0079.451] Sleep (dwMilliseconds=0x64) [0079.724] GetLogicalDrives () returned 0x4 [0079.724] Sleep (dwMilliseconds=0x64) [0079.931] GetLogicalDrives () returned 0x4 [0079.938] Sleep (dwMilliseconds=0x64) [0080.062] GetLogicalDrives () returned 0x4 [0080.062] Sleep (dwMilliseconds=0x64) [0080.858] GetLogicalDrives () returned 0x4 [0080.858] Sleep (dwMilliseconds=0x64) [0081.021] GetLogicalDrives () returned 0x4 [0081.021] Sleep (dwMilliseconds=0x64) [0081.150] GetLogicalDrives () returned 0x4 [0081.150] Sleep (dwMilliseconds=0x64) [0081.817] GetLogicalDrives () returned 0x4 [0081.817] Sleep (dwMilliseconds=0x64) [0082.157] GetLogicalDrives () returned 0x4 [0082.157] Sleep (dwMilliseconds=0x64) [0082.388] GetLogicalDrives () returned 0x4 [0082.388] Sleep (dwMilliseconds=0x64) [0082.820] GetLogicalDrives () returned 0x4 [0083.184] Sleep (dwMilliseconds=0x64) [0083.545] GetLogicalDrives () returned 0x4 [0083.545] Sleep (dwMilliseconds=0x64) [0083.684] GetLogicalDrives () returned 0x4 [0083.684] Sleep (dwMilliseconds=0x64) [0083.871] GetLogicalDrives () returned 0x4 [0083.871] Sleep (dwMilliseconds=0x64) [0084.121] GetLogicalDrives () returned 0x4 [0084.121] Sleep (dwMilliseconds=0x64) [0084.253] GetLogicalDrives () returned 0x4 [0084.253] Sleep (dwMilliseconds=0x64) [0084.621] GetLogicalDrives () returned 0x4 [0084.621] Sleep (dwMilliseconds=0x64) [0085.132] GetLogicalDrives () returned 0x4 [0085.132] Sleep (dwMilliseconds=0x64) [0085.321] GetLogicalDrives () returned 0x4 [0085.321] Sleep (dwMilliseconds=0x64) [0085.590] GetLogicalDrives () returned 0x4 [0085.590] Sleep (dwMilliseconds=0x64) [0085.774] GetLogicalDrives () returned 0x4 [0085.774] Sleep (dwMilliseconds=0x64) [0085.989] GetLogicalDrives () returned 0x4 [0085.989] Sleep (dwMilliseconds=0x64) [0086.400] GetLogicalDrives () returned 0x4 [0086.400] Sleep (dwMilliseconds=0x64) [0086.981] GetLogicalDrives () returned 0x4 [0086.981] Sleep (dwMilliseconds=0x64) [0087.284] GetLogicalDrives () returned 0x4 [0087.284] Sleep (dwMilliseconds=0x64) [0087.457] GetLogicalDrives () returned 0x4 [0087.457] Sleep (dwMilliseconds=0x64) [0088.129] GetLogicalDrives () returned 0x4 [0088.129] Sleep (dwMilliseconds=0x64) [0088.230] GetLogicalDrives () returned 0x4 [0088.230] Sleep (dwMilliseconds=0x64) [0088.452] GetLogicalDrives () returned 0x4 [0088.452] Sleep (dwMilliseconds=0x64) [0088.709] GetLogicalDrives () returned 0x4 [0088.709] Sleep (dwMilliseconds=0x64) [0089.094] GetLogicalDrives () returned 0x4 [0089.094] Sleep (dwMilliseconds=0x64) [0089.436] GetLogicalDrives () returned 0x4 [0089.436] Sleep (dwMilliseconds=0x64) [0089.671] GetLogicalDrives () returned 0x4 [0089.671] Sleep (dwMilliseconds=0x64) [0089.871] GetLogicalDrives () returned 0x4 [0089.871] Sleep (dwMilliseconds=0x64) [0090.020] GetLogicalDrives () returned 0x4 [0090.020] Sleep (dwMilliseconds=0x64) [0090.262] GetLogicalDrives () returned 0x4 [0090.262] Sleep (dwMilliseconds=0x64) [0090.438] GetLogicalDrives () returned 0x4 [0090.438] Sleep (dwMilliseconds=0x64) [0090.581] GetLogicalDrives () returned 0x4 [0090.581] Sleep (dwMilliseconds=0x64) [0090.750] GetLogicalDrives () returned 0x4 [0090.750] Sleep (dwMilliseconds=0x64) [0090.897] GetLogicalDrives () returned 0x4 [0090.897] Sleep (dwMilliseconds=0x64) [0091.165] GetLogicalDrives () returned 0x4 [0091.165] Sleep (dwMilliseconds=0x64) [0091.356] GetLogicalDrives () returned 0x4 [0091.356] Sleep (dwMilliseconds=0x64) [0091.621] GetLogicalDrives () returned 0x4 [0091.621] Sleep (dwMilliseconds=0x64) [0092.005] GetLogicalDrives () returned 0x4 [0092.005] Sleep (dwMilliseconds=0x64) [0092.300] GetLogicalDrives () returned 0x4 [0092.300] Sleep (dwMilliseconds=0x64) [0092.521] GetLogicalDrives () returned 0x4 [0092.521] Sleep (dwMilliseconds=0x64) [0092.694] GetLogicalDrives () returned 0x4 [0092.694] Sleep (dwMilliseconds=0x64) [0092.856] GetLogicalDrives () returned 0x4 [0092.856] Sleep (dwMilliseconds=0x64) [0093.239] GetLogicalDrives () returned 0x4 [0093.246] Sleep (dwMilliseconds=0x64) [0093.367] GetLogicalDrives () returned 0x4 [0093.367] Sleep (dwMilliseconds=0x64) [0093.502] GetLogicalDrives () returned 0x4 [0093.502] Sleep (dwMilliseconds=0x64) [0093.771] GetLogicalDrives () returned 0x4 [0093.771] Sleep (dwMilliseconds=0x64) [0094.091] GetLogicalDrives () returned 0x4 [0094.091] Sleep (dwMilliseconds=0x64) [0094.211] GetLogicalDrives () returned 0x4 [0094.211] Sleep (dwMilliseconds=0x64) [0094.472] GetLogicalDrives () returned 0x4 [0094.472] Sleep (dwMilliseconds=0x64) [0094.793] GetLogicalDrives () returned 0x4 [0094.793] Sleep (dwMilliseconds=0x64) [0095.010] GetLogicalDrives () returned 0x4 [0095.010] Sleep (dwMilliseconds=0x64) [0095.122] GetLogicalDrives () returned 0x4 [0095.122] Sleep (dwMilliseconds=0x64) [0095.230] GetLogicalDrives () returned 0x4 [0095.230] Sleep (dwMilliseconds=0x64) [0095.413] GetLogicalDrives () returned 0x4 [0095.413] Sleep (dwMilliseconds=0x64) [0095.621] GetLogicalDrives () returned 0x4 [0095.621] Sleep (dwMilliseconds=0x64) [0095.730] GetLogicalDrives () returned 0x4 [0095.730] Sleep (dwMilliseconds=0x64) [0095.967] GetLogicalDrives () returned 0x4 [0095.967] Sleep (dwMilliseconds=0x64) [0096.097] GetLogicalDrives () returned 0x4 [0096.097] Sleep (dwMilliseconds=0x64) [0096.450] GetLogicalDrives () returned 0x4 [0096.450] Sleep (dwMilliseconds=0x64) [0096.775] GetLogicalDrives () returned 0x4 [0096.775] Sleep (dwMilliseconds=0x64) [0096.999] GetLogicalDrives () returned 0x4 [0096.999] Sleep (dwMilliseconds=0x64) [0097.107] GetLogicalDrives () returned 0x4 [0097.107] Sleep (dwMilliseconds=0x64) [0097.426] GetLogicalDrives () returned 0x4 [0097.426] Sleep (dwMilliseconds=0x64) [0097.560] GetLogicalDrives () returned 0x4 [0097.560] Sleep (dwMilliseconds=0x64) [0098.094] GetLogicalDrives () returned 0x4 [0098.094] Sleep (dwMilliseconds=0x64) [0098.213] GetLogicalDrives () returned 0x4 [0098.214] Sleep (dwMilliseconds=0x64) [0098.363] GetLogicalDrives () returned 0x4 [0098.363] Sleep (dwMilliseconds=0x64) [0098.695] GetLogicalDrives () returned 0x4 [0098.697] Sleep (dwMilliseconds=0x64) [0098.827] GetLogicalDrives () returned 0x4 [0098.827] Sleep (dwMilliseconds=0x64) [0099.010] GetLogicalDrives () returned 0x4 [0099.010] Sleep (dwMilliseconds=0x64) [0099.121] GetLogicalDrives () returned 0x4 [0099.121] Sleep (dwMilliseconds=0x64) [0099.275] GetLogicalDrives () returned 0x4 [0099.275] Sleep (dwMilliseconds=0x64) [0099.424] GetLogicalDrives () returned 0x4 [0099.424] Sleep (dwMilliseconds=0x64) [0099.576] GetLogicalDrives () returned 0x4 [0099.576] Sleep (dwMilliseconds=0x64) [0099.708] GetLogicalDrives () returned 0x4 [0099.708] Sleep (dwMilliseconds=0x64) [0099.946] GetLogicalDrives () returned 0x4 [0099.947] Sleep (dwMilliseconds=0x64) [0100.149] GetLogicalDrives () returned 0x4 [0100.149] Sleep (dwMilliseconds=0x64) [0100.375] GetLogicalDrives () returned 0x4 [0100.375] Sleep (dwMilliseconds=0x64) [0100.564] GetLogicalDrives () returned 0x4 [0100.564] Sleep (dwMilliseconds=0x64) [0100.725] GetLogicalDrives () returned 0x4 [0100.725] Sleep (dwMilliseconds=0x64) [0101.004] GetLogicalDrives () returned 0x4 [0101.004] Sleep (dwMilliseconds=0x64) [0101.141] GetLogicalDrives () returned 0x4 [0101.141] Sleep (dwMilliseconds=0x64) [0101.428] GetLogicalDrives () returned 0x4 [0101.428] Sleep (dwMilliseconds=0x64) [0101.544] GetLogicalDrives () returned 0x4 [0101.544] Sleep (dwMilliseconds=0x64) [0101.774] GetLogicalDrives () returned 0x4 [0101.774] Sleep (dwMilliseconds=0x64) [0101.942] GetLogicalDrives () returned 0x4 [0101.942] Sleep (dwMilliseconds=0x64) [0102.069] GetLogicalDrives () returned 0x4 [0102.069] Sleep (dwMilliseconds=0x64) [0102.287] GetLogicalDrives () returned 0x4 [0102.287] Sleep (dwMilliseconds=0x64) [0102.589] GetLogicalDrives () returned 0x4 [0102.589] Sleep (dwMilliseconds=0x64) [0102.895] GetLogicalDrives () returned 0x4 [0102.895] Sleep (dwMilliseconds=0x64) [0103.075] GetLogicalDrives () returned 0x4 [0103.075] Sleep (dwMilliseconds=0x64) [0103.425] GetLogicalDrives () returned 0x4 [0103.425] Sleep (dwMilliseconds=0x64) [0103.574] GetLogicalDrives () returned 0x4 [0103.574] Sleep (dwMilliseconds=0x64) [0103.723] GetLogicalDrives () returned 0x4 [0103.723] Sleep (dwMilliseconds=0x64) [0103.950] GetLogicalDrives () returned 0x4 [0103.950] Sleep (dwMilliseconds=0x64) [0104.086] GetLogicalDrives () returned 0x4 [0104.086] Sleep (dwMilliseconds=0x64) [0104.208] GetLogicalDrives () returned 0x4 [0104.208] Sleep (dwMilliseconds=0x64) [0104.427] GetLogicalDrives () returned 0x4 [0104.427] Sleep (dwMilliseconds=0x64) [0104.787] GetLogicalDrives () returned 0x4 [0104.787] Sleep (dwMilliseconds=0x64) [0105.010] GetLogicalDrives () returned 0x4 [0105.011] Sleep (dwMilliseconds=0x64) [0105.146] GetLogicalDrives () returned 0x4 [0105.146] Sleep (dwMilliseconds=0x64) [0105.408] GetLogicalDrives () returned 0x4 [0105.408] Sleep (dwMilliseconds=0x64) [0105.669] GetLogicalDrives () returned 0x4 [0105.669] Sleep (dwMilliseconds=0x64) [0106.007] GetLogicalDrives () returned 0x4 [0106.007] Sleep (dwMilliseconds=0x64) [0106.223] GetLogicalDrives () returned 0x4 [0106.256] Sleep (dwMilliseconds=0x64) [0106.385] GetLogicalDrives () returned 0x4 [0106.385] Sleep (dwMilliseconds=0x64) [0106.692] GetLogicalDrives () returned 0x4 [0106.692] Sleep (dwMilliseconds=0x64) [0107.096] GetLogicalDrives () returned 0x4 [0107.096] Sleep (dwMilliseconds=0x64) [0107.333] GetLogicalDrives () returned 0x4 [0107.333] Sleep (dwMilliseconds=0x64) [0107.460] GetLogicalDrives () returned 0x4 [0107.460] Sleep (dwMilliseconds=0x64) [0107.566] GetLogicalDrives () returned 0x4 [0107.566] Sleep (dwMilliseconds=0x64) [0107.993] GetLogicalDrives () returned 0x4 [0107.993] Sleep (dwMilliseconds=0x64) [0108.299] GetLogicalDrives () returned 0x4 [0108.299] Sleep (dwMilliseconds=0x64) [0108.506] GetLogicalDrives () returned 0x4 [0108.506] Sleep (dwMilliseconds=0x64) [0108.669] GetLogicalDrives () returned 0x4 [0108.669] Sleep (dwMilliseconds=0x64) [0108.949] GetLogicalDrives () returned 0x4 [0108.949] Sleep (dwMilliseconds=0x64) [0109.296] GetLogicalDrives () returned 0x4 [0109.296] Sleep (dwMilliseconds=0x64) [0109.587] GetLogicalDrives () returned 0x4 [0109.587] Sleep (dwMilliseconds=0x64) [0109.759] GetLogicalDrives () returned 0x4 [0109.759] Sleep (dwMilliseconds=0x64) [0109.912] GetLogicalDrives () returned 0x4 [0109.912] Sleep (dwMilliseconds=0x64) [0110.265] GetLogicalDrives () returned 0x4 [0110.265] Sleep (dwMilliseconds=0x64) [0110.433] GetLogicalDrives () returned 0x4 [0110.433] Sleep (dwMilliseconds=0x64) [0110.787] GetLogicalDrives () returned 0x4 [0110.787] Sleep (dwMilliseconds=0x64) [0110.934] GetLogicalDrives () returned 0x4 [0110.935] Sleep (dwMilliseconds=0x64) [0111.141] GetLogicalDrives () returned 0x4 [0111.141] Sleep (dwMilliseconds=0x64) [0111.246] GetLogicalDrives () returned 0x4 [0111.247] Sleep (dwMilliseconds=0x64) [0111.612] GetLogicalDrives () returned 0x4 [0111.612] Sleep (dwMilliseconds=0x64) [0112.080] GetLogicalDrives () returned 0x4 [0112.080] Sleep (dwMilliseconds=0x64) [0112.232] GetLogicalDrives () returned 0x4 [0112.232] Sleep (dwMilliseconds=0x64) [0112.446] GetLogicalDrives () returned 0x4 [0112.446] Sleep (dwMilliseconds=0x64) [0112.701] GetLogicalDrives () returned 0x4 [0112.701] Sleep (dwMilliseconds=0x64) [0112.813] GetLogicalDrives () returned 0x4 [0112.813] Sleep (dwMilliseconds=0x64) [0112.995] GetLogicalDrives () returned 0x4 [0112.995] Sleep (dwMilliseconds=0x64) [0113.505] GetLogicalDrives () returned 0x4 [0113.505] Sleep (dwMilliseconds=0x64) [0113.914] GetLogicalDrives () returned 0x4 [0113.914] Sleep (dwMilliseconds=0x64) [0114.239] GetLogicalDrives () returned 0x4 [0114.239] Sleep (dwMilliseconds=0x64) [0114.412] GetLogicalDrives () returned 0x4 [0114.412] Sleep (dwMilliseconds=0x64) [0114.627] GetLogicalDrives () returned 0x4 [0114.627] Sleep (dwMilliseconds=0x64) [0114.906] GetLogicalDrives () returned 0x4 [0114.906] Sleep (dwMilliseconds=0x64) [0115.235] GetLogicalDrives () returned 0x4 [0115.236] Sleep (dwMilliseconds=0x64) [0115.365] GetLogicalDrives () returned 0x4 [0115.365] Sleep (dwMilliseconds=0x64) [0115.506] GetLogicalDrives () returned 0x4 [0115.506] Sleep (dwMilliseconds=0x64) [0115.845] GetLogicalDrives () returned 0x4 [0115.845] Sleep (dwMilliseconds=0x64) [0116.269] GetLogicalDrives () returned 0x4 [0116.269] Sleep (dwMilliseconds=0x64) [0116.498] GetLogicalDrives () returned 0x4 [0116.498] Sleep (dwMilliseconds=0x64) [0116.626] GetLogicalDrives () returned 0x4 [0116.626] Sleep (dwMilliseconds=0x64) [0116.772] GetLogicalDrives () returned 0x4 [0116.772] Sleep (dwMilliseconds=0x64) [0117.113] GetLogicalDrives () returned 0x4 [0117.113] Sleep (dwMilliseconds=0x64) [0117.220] GetLogicalDrives () returned 0x4 [0117.221] Sleep (dwMilliseconds=0x64) [0117.519] GetLogicalDrives () returned 0x4 [0117.519] Sleep (dwMilliseconds=0x64) [0117.885] GetLogicalDrives () returned 0x4 [0117.885] Sleep (dwMilliseconds=0x64) [0118.286] GetLogicalDrives () returned 0x4 [0118.286] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x9a4 [0033.443] GetTickCount () returned 0x18fc0 [0033.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x643cb0 [0033.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x643cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0033.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x643cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0033.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x643cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0033.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x643cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0033.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6410c0 [0033.451] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6410c0, Size=0x20) returned 0x629ed0 [0033.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6410c0 [0033.451] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6410c0, Size=0x20) returned 0x629ef8 [0033.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.452] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.452] Wow64DisableWow64FsRedirection (in: OldValue=0x256ff84 | out: OldValue=0x256ff84*=0x0) returned 1 [0033.452] lstrlenW (lpString="kernel32.dll") returned 12 [0033.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629ed0 | out: hHeap=0x5c0000) returned 1 [0033.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629ef8 | out: hHeap=0x5c0000) returned 1 [0033.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x62c610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0033.454] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.711] GetTickCount () returned 0x1902d [0033.711] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.880] GetTickCount () returned 0x190d9 [0033.880] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.300] GetTickCount () returned 0x19240 [0034.300] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.801] GetTickCount () returned 0x193d5 [0034.801] GetTickCount () returned 0x193d5 [0034.801] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.789] GetTickCount () returned 0x195e8 [0035.789] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.490] GetTickCount () returned 0x19887 [0036.490] GetTickCount () returned 0x19887 [0036.490] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.831] GetTickCount () returned 0x199de [0036.831] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.489] GetTickCount () returned 0x19c6d [0037.489] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.794] GetTickCount () returned 0x19da5 [0037.794] GetTickCount () returned 0x19da5 [0037.794] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.097] GetTickCount () returned 0x19e9f [0038.097] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.449] GetTickCount () returned 0x19fd7 [0038.449] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.605] GetTickCount () returned 0x1a073 [0038.606] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.038] GetTickCount () returned 0x1a1f9 [0039.038] GetTickCount () returned 0x1a1f9 [0039.038] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.273] GetTickCount () returned 0x1a2b4 [0039.273] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.642] GetTickCount () returned 0x1a3ec [0039.642] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.081] GetTickCount () returned 0x1a581 [0040.081] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.419] GetTickCount () returned 0x1a6aa [0040.419] GetTickCount () returned 0x1a6aa [0040.419] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.564] GetTickCount () returned 0x1a736 [0040.564] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.690] GetTickCount () returned 0x1a7b3 [0040.690] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.899] GetTickCount () returned 0x1a88d [0040.899] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.097] GetTickCount () returned 0x1a949 [0041.097] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.422] GetTickCount () returned 0x1aa52 [0041.422] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.757] GetTickCount () returned 0x1ab2c [0041.757] GetTickCount () returned 0x1ab2c [0041.757] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.086] GetTickCount () returned 0x1ac74 [0042.086] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.557] GetTickCount () returned 0x1ae19 [0042.557] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.010] GetTickCount () returned 0x1afdd [0043.010] GetTickCount () returned 0x1afdd [0043.010] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.457] GetTickCount () returned 0x1b183 [0043.457] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.625] GetTickCount () returned 0x1b21f [0043.626] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.962] GetTickCount () returned 0x1b376 [0043.962] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.315] GetTickCount () returned 0x1b4dd [0044.315] GetTickCount () returned 0x1b4dd [0044.315] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.571] GetTickCount () returned 0x1b5d6 [0044.571] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.884] GetTickCount () returned 0x1b6ef [0044.884] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.291] GetTickCount () returned 0x1b865 [0045.291] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.532] GetTickCount () returned 0x1b95f [0045.532] GetTickCount () returned 0x1b95f [0045.532] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.758] GetTickCount () returned 0x1ba39 [0045.758] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.381] GetTickCount () returned 0x1bca9 [0046.381] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.749] GetTickCount () returned 0x1be20 [0046.749] GetTickCount () returned 0x1be20 [0046.749] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.048] GetTickCount () returned 0x1bf48 [0047.048] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.686] GetTickCount () returned 0x1c1c8 [0047.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.794] GetTickCount () returned 0x1c235 [0047.794] GetTickCount () returned 0x1c235 [0047.794] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.919] GetTickCount () returned 0x1c2b2 [0047.919] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.245] GetTickCount () returned 0x1c3ea [0048.245] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.667] GetTickCount () returned 0x1c58f [0048.667] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.000] GetTickCount () returned 0x1c6e6 [0049.001] GetTickCount () returned 0x1c6e6 [0049.001] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.388] GetTickCount () returned 0x1c86c [0049.388] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.651] GetTickCount () returned 0x1c975 [0049.651] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.915] GetTickCount () returned 0x1ca7f [0049.916] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.295] GetTickCount () returned 0x1cbf5 [0050.295] GetTickCount () returned 0x1cbf5 [0050.295] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.646] GetTickCount () returned 0x1cd4c [0050.646] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.827] GetTickCount () returned 0x1ce07 [0050.827] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.996] GetTickCount () returned 0x1ceb3 [0050.997] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.335] GetTickCount () returned 0x1d00a [0051.335] GetTickCount () returned 0x1d00a [0051.335] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.536] GetTickCount () returned 0x1d0c5 [0051.536] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.876] GetTickCount () returned 0x1d21d [0051.876] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.159] GetTickCount () returned 0x1d335 [0052.159] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.394] GetTickCount () returned 0x1d41f [0052.394] GetTickCount () returned 0x1d41f [0052.394] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.583] GetTickCount () returned 0x1d4ea [0052.583] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.930] GetTickCount () returned 0x1d641 [0052.930] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.686] GetTickCount () returned 0x1d92e [0053.686] GetTickCount () returned 0x1d92e [0053.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.968] GetTickCount () returned 0x1da47 [0053.968] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.346] GetTickCount () returned 0x1dbcd [0054.347] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.559] GetTickCount () returned 0x1dc98 [0054.559] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.959] GetTickCount () returned 0x1de2d [0054.959] GetTickCount () returned 0x1de2d [0054.959] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.088] GetTickCount () returned 0x1deaa [0055.088] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.245] GetTickCount () returned 0x1df46 [0055.245] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.478] GetTickCount () returned 0x1e030 [0055.478] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.381] GetTickCount () returned 0x1e3b9 [0056.381] GetTickCount () returned 0x1e3b9 [0056.381] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.602] GetTickCount () returned 0x1e493 [0056.602] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.719] GetTickCount () returned 0x1e510 [0056.719] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.905] GetTickCount () returned 0x1e5cb [0056.905] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x0 [0056.936] GetTickCount () returned 0x1e5eb [0056.936] Sleep (dwMilliseconds=0x64) [0057.113] GetTickCount () returned 0x1e696 [0057.113] Sleep (dwMilliseconds=0x64) [0057.894] GetTickCount () returned 0x1e9a2 [0057.894] GetTickCount () returned 0x1e9a2 [0057.894] Sleep (dwMilliseconds=0x64) [0058.287] GetTickCount () returned 0x1eb28 [0058.287] Sleep (dwMilliseconds=0x64) [0058.454] GetTickCount () returned 0x1ebd4 [0058.454] Sleep (dwMilliseconds=0x64) [0058.751] GetTickCount () returned 0x1ecfc [0058.751] Sleep (dwMilliseconds=0x64) [0059.109] GetTickCount () returned 0x1ee63 [0059.109] GetTickCount () returned 0x1ee63 [0059.109] Sleep (dwMilliseconds=0x64) [0059.213] GetTickCount () returned 0x1eed0 [0059.213] Sleep (dwMilliseconds=0x64) [0059.322] GetTickCount () returned 0x1ef3e [0059.322] Sleep (dwMilliseconds=0x64) [0059.502] GetTickCount () returned 0x1efe9 [0059.502] Sleep (dwMilliseconds=0x64) [0060.330] GetTickCount () returned 0x1f324 [0060.330] GetTickCount () returned 0x1f324 [0060.330] Sleep (dwMilliseconds=0x64) [0060.722] GetTickCount () returned 0x1f4aa [0060.732] Sleep (dwMilliseconds=0x64) [0060.890] GetTickCount () returned 0x1f556 [0060.890] Sleep (dwMilliseconds=0x64) [0061.403] GetTickCount () returned 0x1f758 [0061.403] GetTickCount () returned 0x1f758 [0061.403] Sleep (dwMilliseconds=0x64) [0061.770] GetTickCount () returned 0x1f8bf [0061.770] Sleep (dwMilliseconds=0x64) [0061.902] GetTickCount () returned 0x1f94c [0061.902] Sleep (dwMilliseconds=0x64) [0062.154] GetTickCount () returned 0x1fa45 [0062.154] Sleep (dwMilliseconds=0x64) [0062.373] GetTickCount () returned 0x1fb20 [0062.374] Sleep (dwMilliseconds=0x64) [0062.904] GetTickCount () returned 0x1fd32 [0062.904] GetTickCount () returned 0x1fd32 [0062.904] Sleep (dwMilliseconds=0x64) [0063.585] GetTickCount () returned 0x1ffe0 [0063.585] Sleep (dwMilliseconds=0x64) [0063.884] GetTickCount () returned 0x20109 [0063.884] Sleep (dwMilliseconds=0x64) [0063.991] GetTickCount () returned 0x20176 [0063.991] GetTickCount () returned 0x20176 [0063.991] Sleep (dwMilliseconds=0x64) [0064.396] GetTickCount () returned 0x2030c [0064.397] Sleep (dwMilliseconds=0x64) [0064.787] GetTickCount () returned 0x20492 [0064.787] Sleep (dwMilliseconds=0x64) [0065.122] GetTickCount () returned 0x205d9 [0065.122] GetTickCount () returned 0x205d9 [0065.122] Sleep (dwMilliseconds=0x64) [0065.959] GetTickCount () returned 0x20924 [0065.959] Sleep (dwMilliseconds=0x64) [0066.094] GetTickCount () returned 0x209b0 [0066.094] Sleep (dwMilliseconds=0x64) [0066.285] GetTickCount () returned 0x20a6b [0066.285] GetTickCount () returned 0x20a6b [0066.285] Sleep (dwMilliseconds=0x64) [0066.512] GetTickCount () returned 0x20b46 [0066.512] Sleep (dwMilliseconds=0x64) [0067.437] GetTickCount () returned 0x20eee [0067.437] GetTickCount () returned 0x20eee [0067.437] Sleep (dwMilliseconds=0x64) [0067.574] GetTickCount () returned 0x20f6a [0067.574] Sleep (dwMilliseconds=0x64) [0067.725] GetTickCount () returned 0x21006 [0067.725] Sleep (dwMilliseconds=0x64) [0067.841] GetTickCount () returned 0x21083 [0067.841] Sleep (dwMilliseconds=0x64) [0068.373] GetTickCount () returned 0x21296 [0068.373] Sleep (dwMilliseconds=0x64) [0068.480] GetTickCount () returned 0x21303 [0068.480] GetTickCount () returned 0x21303 [0068.480] Sleep (dwMilliseconds=0x64) [0068.589] GetTickCount () returned 0x21370 [0068.589] Sleep (dwMilliseconds=0x64) [0069.177] GetTickCount () returned 0x215b1 [0069.177] Sleep (dwMilliseconds=0x64) [0069.329] GetTickCount () returned 0x2164d [0069.329] Sleep (dwMilliseconds=0x64) [0069.529] GetTickCount () returned 0x21718 [0069.529] GetTickCount () returned 0x21718 [0069.530] Sleep (dwMilliseconds=0x64) [0070.027] GetTickCount () returned 0x2190b [0070.027] Sleep (dwMilliseconds=0x64) [0070.713] GetTickCount () returned 0x21bba [0070.713] GetTickCount () returned 0x21bba [0070.713] Sleep (dwMilliseconds=0x64) [0071.101] GetTickCount () returned 0x21d40 [0071.101] Sleep (dwMilliseconds=0x64) [0071.445] GetTickCount () returned 0x21e97 [0071.445] Sleep (dwMilliseconds=0x64) [0071.635] GetTickCount () returned 0x21f52 [0071.635] Sleep (dwMilliseconds=0x64) [0071.791] GetTickCount () returned 0x21fee [0071.791] GetTickCount () returned 0x21fee [0071.791] Sleep (dwMilliseconds=0x64) [0071.934] GetTickCount () returned 0x2207a [0071.934] Sleep (dwMilliseconds=0x64) [0072.212] GetTickCount () returned 0x22193 [0072.212] Sleep (dwMilliseconds=0x64) [0072.408] GetTickCount () returned 0x2224e [0072.408] Sleep (dwMilliseconds=0x64) [0072.642] GetTickCount () returned 0x22338 [0072.642] Sleep (dwMilliseconds=0x64) [0073.205] GetTickCount () returned 0x2256a [0073.205] GetTickCount () returned 0x2256a [0073.205] Sleep (dwMilliseconds=0x64) [0073.628] GetTickCount () returned 0x2271f [0073.724] Sleep (dwMilliseconds=0x64) [0073.830] GetTickCount () returned 0x227ea [0073.830] Sleep (dwMilliseconds=0x64) [0074.048] GetTickCount () returned 0x228b4 [0074.048] Sleep (dwMilliseconds=0x64) [0074.155] GetTickCount () returned 0x22922 [0074.155] Sleep (dwMilliseconds=0x64) [0074.397] GetTickCount () returned 0x22a1b [0074.397] GetTickCount () returned 0x22a1b [0074.397] Sleep (dwMilliseconds=0x64) [0074.756] GetTickCount () returned 0x22b82 [0074.756] Sleep (dwMilliseconds=0x64) [0075.211] GetTickCount () returned 0x22d46 [0075.211] Sleep (dwMilliseconds=0x64) [0075.332] GetTickCount () returned 0x22dc3 [0075.332] Sleep (dwMilliseconds=0x64) [0075.884] GetTickCount () returned 0x22fe5 [0075.884] GetTickCount () returned 0x22fe5 [0075.884] Sleep (dwMilliseconds=0x64) [0075.986] GetTickCount () returned 0x23052 [0075.986] Sleep (dwMilliseconds=0x64) [0076.093] GetTickCount () returned 0x230c0 [0076.093] Sleep (dwMilliseconds=0x64) [0076.275] GetTickCount () returned 0x2316b [0076.275] Sleep (dwMilliseconds=0x64) [0076.649] GetTickCount () returned 0x232e2 [0076.649] Sleep (dwMilliseconds=0x64) [0076.777] GetTickCount () returned 0x2335e [0076.777] Sleep (dwMilliseconds=0x64) [0076.934] GetTickCount () returned 0x233fa [0076.934] GetTickCount () returned 0x233fa [0076.934] Sleep (dwMilliseconds=0x64) [0077.445] GetTickCount () returned 0x235fd [0077.445] Sleep (dwMilliseconds=0x64) [0077.586] GetTickCount () returned 0x2368a [0077.586] Sleep (dwMilliseconds=0x64) [0077.684] GetTickCount () returned 0x236f7 [0077.684] Sleep (dwMilliseconds=0x64) [0078.038] GetTickCount () returned 0x2384e [0078.038] GetTickCount () returned 0x2384e [0078.038] Sleep (dwMilliseconds=0x64) [0078.432] GetTickCount () returned 0x239e4 [0078.432] Sleep (dwMilliseconds=0x64) [0078.766] GetTickCount () returned 0x23b2b [0078.766] Sleep (dwMilliseconds=0x64) [0079.182] GetTickCount () returned 0x23cd0 [0079.182] GetTickCount () returned 0x23cd0 [0079.182] Sleep (dwMilliseconds=0x64) [0079.451] GetTickCount () returned 0x23dda [0079.451] Sleep (dwMilliseconds=0x64) [0079.729] GetTickCount () returned 0x23ef2 [0079.729] Sleep (dwMilliseconds=0x64) [0079.939] GetTickCount () returned 0x23fbd [0079.939] Sleep (dwMilliseconds=0x64) [0080.050] GetTickCount () returned 0x2402a [0080.050] Sleep (dwMilliseconds=0x64) [0080.858] GetTickCount () returned 0x24356 [0080.858] GetTickCount () returned 0x24356 [0080.858] Sleep (dwMilliseconds=0x64) [0081.020] GetTickCount () returned 0x243f2 [0081.020] Sleep (dwMilliseconds=0x64) [0081.150] GetTickCount () returned 0x2447e [0081.150] Sleep (dwMilliseconds=0x64) [0081.818] GetTickCount () returned 0x2471d [0081.818] Sleep (dwMilliseconds=0x64) [0082.178] GetTickCount () returned 0x24884 [0082.178] GetTickCount () returned 0x24884 [0082.178] Sleep (dwMilliseconds=0x64) [0082.390] GetTickCount () returned 0x2494e [0082.390] Sleep (dwMilliseconds=0x64) [0083.184] GetTickCount () returned 0x24c6a [0083.184] Sleep (dwMilliseconds=0x64) [0083.564] GetTickCount () returned 0x24df0 [0083.564] GetTickCount () returned 0x24df0 [0083.564] Sleep (dwMilliseconds=0x64) [0083.811] GetTickCount () returned 0x24eda [0083.811] Sleep (dwMilliseconds=0x64) [0083.924] GetTickCount () returned 0x24f57 [0083.924] Sleep (dwMilliseconds=0x64) [0084.251] GetTickCount () returned 0x2509e [0084.251] Sleep (dwMilliseconds=0x64) [0084.621] GetTickCount () returned 0x25205 [0084.621] GetTickCount () returned 0x25205 [0084.621] Sleep (dwMilliseconds=0x64) [0085.131] GetTickCount () returned 0x25408 [0085.131] Sleep (dwMilliseconds=0x64) [0085.320] GetTickCount () returned 0x254c3 [0085.321] Sleep (dwMilliseconds=0x64) [0085.597] GetTickCount () returned 0x255dc [0085.597] Sleep (dwMilliseconds=0x64) [0085.774] GetTickCount () returned 0x25688 [0085.774] GetTickCount () returned 0x25688 [0085.774] Sleep (dwMilliseconds=0x64) [0085.989] GetTickCount () returned 0x25762 [0085.989] Sleep (dwMilliseconds=0x64) [0086.400] GetTickCount () returned 0x258f8 [0086.400] Sleep (dwMilliseconds=0x64) [0086.981] GetTickCount () returned 0x25b48 [0086.981] GetTickCount () returned 0x25b48 [0086.981] Sleep (dwMilliseconds=0x64) [0087.298] GetTickCount () returned 0x25c80 [0087.298] Sleep (dwMilliseconds=0x64) [0087.460] GetTickCount () returned 0x25d1c [0087.460] Sleep (dwMilliseconds=0x64) [0088.129] GetTickCount () returned 0x25fbb [0088.129] GetTickCount () returned 0x25fbb [0088.129] Sleep (dwMilliseconds=0x64) [0088.230] GetTickCount () returned 0x26028 [0088.230] Sleep (dwMilliseconds=0x64) [0088.452] GetTickCount () returned 0x26103 [0088.452] Sleep (dwMilliseconds=0x64) [0088.709] GetTickCount () returned 0x261fd [0088.709] Sleep (dwMilliseconds=0x64) [0089.095] GetTickCount () returned 0x26383 [0089.095] Sleep (dwMilliseconds=0x64) [0089.436] GetTickCount () returned 0x264da [0089.436] GetTickCount () returned 0x264da [0089.436] Sleep (dwMilliseconds=0x64) [0089.671] GetTickCount () returned 0x265c4 [0089.671] Sleep (dwMilliseconds=0x64) [0089.871] GetTickCount () returned 0x2668f [0089.871] Sleep (dwMilliseconds=0x64) [0090.020] GetTickCount () returned 0x2671b [0090.020] Sleep (dwMilliseconds=0x64) [0090.262] GetTickCount () returned 0x26815 [0090.262] Sleep (dwMilliseconds=0x64) [0090.438] GetTickCount () returned 0x268c0 [0090.438] Sleep (dwMilliseconds=0x64) [0090.581] GetTickCount () returned 0x2694d [0090.581] GetTickCount () returned 0x2694d [0090.581] Sleep (dwMilliseconds=0x64) [0090.750] GetTickCount () returned 0x269f8 [0090.750] Sleep (dwMilliseconds=0x64) [0090.897] GetTickCount () returned 0x26a94 [0090.897] Sleep (dwMilliseconds=0x64) [0091.165] GetTickCount () returned 0x26b9d [0091.165] Sleep (dwMilliseconds=0x64) [0091.356] GetTickCount () returned 0x26c59 [0091.356] Sleep (dwMilliseconds=0x64) [0091.621] GetTickCount () returned 0x26d62 [0091.621] GetTickCount () returned 0x26d62 [0091.621] Sleep (dwMilliseconds=0x64) [0092.005] GetTickCount () returned 0x26ee8 [0092.005] Sleep (dwMilliseconds=0x64) [0092.326] GetTickCount () returned 0x27020 [0092.326] Sleep (dwMilliseconds=0x64) [0092.524] GetTickCount () returned 0x270eb [0092.524] Sleep (dwMilliseconds=0x64) [0092.695] GetTickCount () returned 0x27196 [0092.695] GetTickCount () returned 0x27196 [0092.695] Sleep (dwMilliseconds=0x64) [0092.856] GetTickCount () returned 0x27232 [0092.856] Sleep (dwMilliseconds=0x64) [0093.247] GetTickCount () returned 0x273b8 [0093.247] Sleep (dwMilliseconds=0x64) [0093.367] GetTickCount () returned 0x27435 [0093.367] Sleep (dwMilliseconds=0x64) [0093.502] GetTickCount () returned 0x274c1 [0093.502] Sleep (dwMilliseconds=0x64) [0093.771] GetTickCount () returned 0x275cb [0093.772] GetTickCount () returned 0x275cb [0093.772] Sleep (dwMilliseconds=0x64) [0094.091] GetTickCount () returned 0x27703 [0094.091] Sleep (dwMilliseconds=0x64) [0094.212] GetTickCount () returned 0x2777f [0094.212] Sleep (dwMilliseconds=0x64) [0094.472] GetTickCount () returned 0x27889 [0094.472] Sleep (dwMilliseconds=0x64) [0094.800] GetTickCount () returned 0x279d0 [0094.800] Sleep (dwMilliseconds=0x64) [0095.043] GetTickCount () returned 0x27aba [0095.043] Sleep (dwMilliseconds=0x64) [0095.168] GetTickCount () returned 0x27b37 [0095.168] Sleep (dwMilliseconds=0x64) [0095.372] GetTickCount () returned 0x27c02 [0095.372] Sleep (dwMilliseconds=0x64) [0095.551] GetTickCount () returned 0x27cbd [0095.551] Sleep (dwMilliseconds=0x64) [0095.729] GetTickCount () returned 0x27d69 [0095.729] Sleep (dwMilliseconds=0x64) [0095.967] GetTickCount () returned 0x27e62 [0095.967] Sleep (dwMilliseconds=0x64) [0096.097] GetTickCount () returned 0x27edf [0096.097] Sleep (dwMilliseconds=0x64) [0096.402] GetTickCount () returned 0x28007 [0096.402] Sleep (dwMilliseconds=0x64) [0096.752] GetTickCount () returned 0x2816e [0096.752] Sleep (dwMilliseconds=0x64) [0096.999] GetTickCount () returned 0x28268 [0096.999] Sleep (dwMilliseconds=0x64) [0097.107] GetTickCount () returned 0x282d5 [0097.107] Sleep (dwMilliseconds=0x64) [0097.426] GetTickCount () returned 0x2840d [0097.426] Sleep (dwMilliseconds=0x64) [0097.559] GetTickCount () returned 0x28499 [0097.559] Sleep (dwMilliseconds=0x64) [0098.094] GetTickCount () returned 0x286ac [0098.094] Sleep (dwMilliseconds=0x64) [0098.213] GetTickCount () returned 0x28729 [0098.213] Sleep (dwMilliseconds=0x64) [0098.363] GetTickCount () returned 0x287b5 [0098.363] Sleep (dwMilliseconds=0x64) [0098.675] GetTickCount () returned 0x288ed [0098.675] Sleep (dwMilliseconds=0x64) [0098.826] GetTickCount () returned 0x28989 [0098.826] Sleep (dwMilliseconds=0x64) [0099.010] GetTickCount () returned 0x28a44 [0099.010] Sleep (dwMilliseconds=0x64) [0099.121] GetTickCount () returned 0x28ab1 [0099.121] Sleep (dwMilliseconds=0x64) [0099.275] GetTickCount () returned 0x28b4d [0099.275] Sleep (dwMilliseconds=0x64) [0099.425] GetTickCount () returned 0x28bda [0099.425] Sleep (dwMilliseconds=0x64) [0099.576] GetTickCount () returned 0x28c76 [0099.576] Sleep (dwMilliseconds=0x64) [0099.709] GetTickCount () returned 0x28cf3 [0099.709] Sleep (dwMilliseconds=0x64) [0099.952] GetTickCount () returned 0x28dec [0099.952] Sleep (dwMilliseconds=0x64) [0100.149] GetTickCount () returned 0x28eb7 [0100.149] Sleep (dwMilliseconds=0x64) [0100.375] GetTickCount () returned 0x28f91 [0100.375] Sleep (dwMilliseconds=0x64) [0100.579] GetTickCount () returned 0x2905c [0100.579] Sleep (dwMilliseconds=0x64) [0100.738] GetTickCount () returned 0x290f8 [0100.738] Sleep (dwMilliseconds=0x64) [0101.005] GetTickCount () returned 0x29201 [0101.005] Sleep (dwMilliseconds=0x64) [0101.141] GetTickCount () returned 0x2928e [0101.141] Sleep (dwMilliseconds=0x64) [0101.428] GetTickCount () returned 0x293b6 [0101.428] Sleep (dwMilliseconds=0x64) [0101.543] GetTickCount () returned 0x29423 [0101.543] Sleep (dwMilliseconds=0x64) [0101.774] GetTickCount () returned 0x2950d [0101.774] Sleep (dwMilliseconds=0x64) [0101.942] GetTickCount () returned 0x295b9 [0101.942] Sleep (dwMilliseconds=0x64) [0102.070] GetTickCount () returned 0x29665 [0102.113] Sleep (dwMilliseconds=0x64) [0102.315] GetTickCount () returned 0x29720 [0102.315] Sleep (dwMilliseconds=0x64) [0102.596] GetTickCount () returned 0x29848 [0102.596] Sleep (dwMilliseconds=0x64) [0102.895] GetTickCount () returned 0x29971 [0102.895] Sleep (dwMilliseconds=0x64) [0103.075] GetTickCount () returned 0x29a1c [0103.075] Sleep (dwMilliseconds=0x64) [0103.426] GetTickCount () returned 0x29b83 [0103.426] Sleep (dwMilliseconds=0x64) [0103.574] GetTickCount () returned 0x29c0f [0103.574] Sleep (dwMilliseconds=0x64) [0103.723] GetTickCount () returned 0x29cab [0103.723] Sleep (dwMilliseconds=0x64) [0103.950] GetTickCount () returned 0x29d86 [0103.950] Sleep (dwMilliseconds=0x64) [0104.085] GetTickCount () returned 0x29e12 [0104.085] Sleep (dwMilliseconds=0x64) [0104.207] GetTickCount () returned 0x29e8f [0104.207] Sleep (dwMilliseconds=0x64) [0104.426] GetTickCount () returned 0x29f69 [0104.426] Sleep (dwMilliseconds=0x64) [0104.765] GetTickCount () returned 0x2a0c1 [0104.765] Sleep (dwMilliseconds=0x64) [0105.010] GetTickCount () returned 0x2a1ab [0105.010] Sleep (dwMilliseconds=0x64) [0105.146] GetTickCount () returned 0x2a237 [0105.146] Sleep (dwMilliseconds=0x64) [0105.408] GetTickCount () returned 0x2a340 [0105.408] Sleep (dwMilliseconds=0x64) [0105.669] GetTickCount () returned 0x2a43a [0105.669] Sleep (dwMilliseconds=0x64) [0106.007] GetTickCount () returned 0x2a591 [0106.007] Sleep (dwMilliseconds=0x64) [0106.222] GetTickCount () returned 0x2a66b [0106.222] Sleep (dwMilliseconds=0x64) [0106.338] GetTickCount () returned 0x2a6d9 [0106.338] Sleep (dwMilliseconds=0x64) [0106.684] GetTickCount () returned 0x2a83f [0106.684] Sleep (dwMilliseconds=0x64) [0107.096] GetTickCount () returned 0x2a9d5 [0107.096] Sleep (dwMilliseconds=0x64) [0107.333] GetTickCount () returned 0x2aabf [0107.333] Sleep (dwMilliseconds=0x64) [0107.460] GetTickCount () returned 0x2ab3c [0107.460] Sleep (dwMilliseconds=0x64) [0107.566] GetTickCount () returned 0x2aba9 [0107.566] Sleep (dwMilliseconds=0x64) [0108.026] GetTickCount () returned 0x2ad7d [0108.026] Sleep (dwMilliseconds=0x64) [0108.322] GetTickCount () returned 0x2ae96 [0108.322] Sleep (dwMilliseconds=0x64) [0108.509] GetTickCount () returned 0x2af61 [0108.509] Sleep (dwMilliseconds=0x64) [0108.669] GetTickCount () returned 0x2affd [0108.669] Sleep (dwMilliseconds=0x64) [0108.949] GetTickCount () returned 0x2b115 [0108.949] Sleep (dwMilliseconds=0x64) [0109.306] GetTickCount () returned 0x2b27c [0109.306] Sleep (dwMilliseconds=0x64) [0109.588] GetTickCount () returned 0x2b395 [0109.588] Sleep (dwMilliseconds=0x64) [0109.759] GetTickCount () returned 0x2b441 [0109.759] Sleep (dwMilliseconds=0x64) [0109.912] GetTickCount () returned 0x2b4cd [0109.912] Sleep (dwMilliseconds=0x64) [0110.265] GetTickCount () returned 0x2b634 [0110.265] Sleep (dwMilliseconds=0x64) [0110.433] GetTickCount () returned 0x2b6df [0110.433] Sleep (dwMilliseconds=0x64) [0110.787] GetTickCount () returned 0x2b846 [0110.787] Sleep (dwMilliseconds=0x64) [0110.935] GetTickCount () returned 0x2b8d3 [0110.935] Sleep (dwMilliseconds=0x64) [0111.141] GetTickCount () returned 0x2b99d [0111.141] Sleep (dwMilliseconds=0x64) [0111.247] GetTickCount () returned 0x2ba0b [0111.247] Sleep (dwMilliseconds=0x64) [0111.612] GetTickCount () returned 0x2bb71 [0111.612] Sleep (dwMilliseconds=0x64) [0112.080] GetTickCount () returned 0x2bd45 [0112.080] Sleep (dwMilliseconds=0x64) [0112.233] GetTickCount () returned 0x2bde1 [0112.233] Sleep (dwMilliseconds=0x64) [0112.446] GetTickCount () returned 0x2bebc [0112.446] Sleep (dwMilliseconds=0x64) [0112.701] GetTickCount () returned 0x2bfb5 [0112.701] Sleep (dwMilliseconds=0x64) [0112.813] GetTickCount () returned 0x2c023 [0112.813] Sleep (dwMilliseconds=0x64) [0112.995] GetTickCount () returned 0x2c0de [0112.995] Sleep (dwMilliseconds=0x64) [0113.505] GetTickCount () returned 0x2c2e1 [0113.505] Sleep (dwMilliseconds=0x64) [0113.914] GetTickCount () returned 0x2c476 [0113.914] Sleep (dwMilliseconds=0x64) [0114.239] GetTickCount () returned 0x2c5be [0114.239] Sleep (dwMilliseconds=0x64) [0114.411] GetTickCount () returned 0x2c669 [0114.411] Sleep (dwMilliseconds=0x64) [0114.627] GetTickCount () returned 0x2c744 [0114.627] Sleep (dwMilliseconds=0x64) [0114.906] GetTickCount () returned 0x2c85d [0114.906] Sleep (dwMilliseconds=0x64) [0115.221] GetTickCount () returned 0x2c995 [0115.221] Sleep (dwMilliseconds=0x64) [0115.365] GetTickCount () returned 0x2ca21 [0115.365] Sleep (dwMilliseconds=0x64) [0115.506] GetTickCount () returned 0x2caad [0115.506] Sleep (dwMilliseconds=0x64) [0115.844] GetTickCount () returned 0x2cc05 [0115.844] Sleep (dwMilliseconds=0x64) [0116.268] GetTickCount () returned 0x2cdaa [0116.268] Sleep (dwMilliseconds=0x64) [0116.498] GetTickCount () returned 0x2ce94 [0116.498] Sleep (dwMilliseconds=0x64) [0116.625] GetTickCount () returned 0x2cf11 [0116.625] Sleep (dwMilliseconds=0x64) [0116.771] GetTickCount () returned 0x2cf9d [0116.771] Sleep (dwMilliseconds=0x64) [0117.113] GetTickCount () returned 0x2d0f4 [0117.113] Sleep (dwMilliseconds=0x64) [0117.220] GetTickCount () returned 0x2d161 [0117.220] Sleep (dwMilliseconds=0x64) [0117.500] GetTickCount () returned 0x2d27a [0117.501] Sleep (dwMilliseconds=0x64) [0117.885] GetTickCount () returned 0x2d400 [0117.885] Sleep (dwMilliseconds=0x64) [0118.286] GetTickCount () returned 0x2d586 [0118.286] Sleep (dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x9a8 [0033.443] GetTickCount () returned 0x18fc0 [0033.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x6451b8 [0033.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6451b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0033.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6451b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0033.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6451b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0033.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6451b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0033.452] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6410c0 [0033.452] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6410c0, Size=0x20) returned 0x629ef8 [0033.453] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6410c0 [0033.453] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6410c0, Size=0x20) returned 0x629ed0 [0033.453] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.453] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.453] Wow64DisableWow64FsRedirection (in: OldValue=0x26aff84 | out: OldValue=0x26aff84*=0x0) returned 1 [0033.453] lstrlenW (lpString="kernel32.dll") returned 12 [0033.453] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629ef8 | out: hHeap=0x5c0000) returned 1 [0033.453] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.453] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629ed0 | out: hHeap=0x5c0000) returned 1 [0033.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x64f248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0033.454] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0033.712] GetTickCount () returned 0x1902d [0033.712] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0033.880] GetTickCount () returned 0x190d9 [0033.880] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0034.300] GetTickCount () returned 0x19240 [0034.300] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0034.801] GetTickCount () returned 0x193d5 [0034.801] GetTickCount () returned 0x193d5 [0034.801] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0035.789] GetTickCount () returned 0x195e8 [0035.789] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0036.490] GetTickCount () returned 0x19887 [0036.490] GetTickCount () returned 0x19887 [0036.490] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0036.831] GetTickCount () returned 0x199de [0036.831] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0037.489] GetTickCount () returned 0x19c6d [0037.489] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0037.795] GetTickCount () returned 0x19da5 [0037.795] GetTickCount () returned 0x19da5 [0037.795] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.097] GetTickCount () returned 0x19e9f [0038.097] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.449] GetTickCount () returned 0x19fd7 [0038.450] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.606] GetTickCount () returned 0x1a073 [0038.606] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.038] GetTickCount () returned 0x1a1f9 [0039.038] GetTickCount () returned 0x1a1f9 [0039.038] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.273] GetTickCount () returned 0x1a2b4 [0039.273] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.642] GetTickCount () returned 0x1a3ec [0039.642] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.081] GetTickCount () returned 0x1a581 [0040.081] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.418] GetTickCount () returned 0x1a6aa [0040.419] GetTickCount () returned 0x1a6aa [0040.419] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.564] GetTickCount () returned 0x1a736 [0040.564] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.690] GetTickCount () returned 0x1a7b3 [0040.690] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.899] GetTickCount () returned 0x1a88d [0040.899] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.097] GetTickCount () returned 0x1a949 [0041.097] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.422] GetTickCount () returned 0x1aa52 [0041.422] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.757] GetTickCount () returned 0x1ab2c [0041.757] GetTickCount () returned 0x1ab2c [0041.757] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.086] GetTickCount () returned 0x1ac74 [0042.086] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.557] GetTickCount () returned 0x1ae19 [0042.557] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.010] GetTickCount () returned 0x1afdd [0043.010] GetTickCount () returned 0x1afdd [0043.010] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.457] GetTickCount () returned 0x1b183 [0043.457] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.626] GetTickCount () returned 0x1b21f [0043.626] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.962] GetTickCount () returned 0x1b376 [0043.962] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.315] GetTickCount () returned 0x1b4dd [0044.315] GetTickCount () returned 0x1b4dd [0044.315] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.571] GetTickCount () returned 0x1b5d6 [0044.571] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.881] GetTickCount () returned 0x1b6ef [0044.881] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.291] GetTickCount () returned 0x1b865 [0045.291] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.532] GetTickCount () returned 0x1b95f [0045.532] GetTickCount () returned 0x1b95f [0045.532] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.758] GetTickCount () returned 0x1ba39 [0045.758] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.381] GetTickCount () returned 0x1bca9 [0046.381] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.749] GetTickCount () returned 0x1be20 [0046.749] GetTickCount () returned 0x1be20 [0046.749] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.048] GetTickCount () returned 0x1bf48 [0047.048] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.686] GetTickCount () returned 0x1c1c8 [0047.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.794] GetTickCount () returned 0x1c235 [0047.794] GetTickCount () returned 0x1c235 [0047.794] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.920] GetTickCount () returned 0x1c2b2 [0047.920] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.245] GetTickCount () returned 0x1c3ea [0048.245] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.667] GetTickCount () returned 0x1c58f [0048.667] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.992] GetTickCount () returned 0x1c6e6 [0049.000] GetTickCount () returned 0x1c6e6 [0049.000] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.388] GetTickCount () returned 0x1c86c [0049.388] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.651] GetTickCount () returned 0x1c975 [0049.651] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.915] GetTickCount () returned 0x1ca7f [0049.915] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.295] GetTickCount () returned 0x1cbf5 [0050.295] GetTickCount () returned 0x1cbf5 [0050.295] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.646] GetTickCount () returned 0x1cd4c [0050.646] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.827] GetTickCount () returned 0x1ce07 [0050.827] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.996] GetTickCount () returned 0x1ceb3 [0050.996] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.335] GetTickCount () returned 0x1d00a [0051.335] GetTickCount () returned 0x1d00a [0051.335] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.536] GetTickCount () returned 0x1d0c5 [0051.536] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.876] GetTickCount () returned 0x1d21d [0051.876] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.159] GetTickCount () returned 0x1d335 [0052.159] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.394] GetTickCount () returned 0x1d41f [0052.394] GetTickCount () returned 0x1d41f [0052.394] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.583] GetTickCount () returned 0x1d4ea [0052.583] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.930] GetTickCount () returned 0x1d641 [0052.930] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.686] GetTickCount () returned 0x1d92e [0053.686] GetTickCount () returned 0x1d92e [0053.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.968] GetTickCount () returned 0x1da47 [0053.968] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.345] GetTickCount () returned 0x1dbcd [0054.346] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.559] GetTickCount () returned 0x1dc98 [0054.559] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.959] GetTickCount () returned 0x1de2d [0054.959] GetTickCount () returned 0x1de2d [0054.959] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.088] GetTickCount () returned 0x1deaa [0055.088] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.245] GetTickCount () returned 0x1df46 [0055.245] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.479] GetTickCount () returned 0x1e030 [0055.483] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.381] GetTickCount () returned 0x1e3b9 [0056.382] GetTickCount () returned 0x1e3b9 [0056.382] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.601] GetTickCount () returned 0x1e493 [0056.601] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.719] GetTickCount () returned 0x1e510 [0056.719] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.905] GetTickCount () returned 0x1e5cb [0056.905] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x0 [0056.936] GetTickCount () returned 0x1e5eb [0056.936] Sleep (dwMilliseconds=0x64) [0057.113] GetTickCount () returned 0x1e696 [0057.113] Sleep (dwMilliseconds=0x64) [0057.894] GetTickCount () returned 0x1e9a2 [0057.894] GetTickCount () returned 0x1e9a2 [0057.894] Sleep (dwMilliseconds=0x64) [0058.287] GetTickCount () returned 0x1eb28 [0058.287] Sleep (dwMilliseconds=0x64) [0058.455] GetTickCount () returned 0x1ebd4 [0058.455] Sleep (dwMilliseconds=0x64) [0058.751] GetTickCount () returned 0x1ecfc [0058.751] Sleep (dwMilliseconds=0x64) [0059.109] GetTickCount () returned 0x1ee63 [0059.109] GetTickCount () returned 0x1ee63 [0059.109] Sleep (dwMilliseconds=0x64) [0059.213] GetTickCount () returned 0x1eed0 [0059.213] Sleep (dwMilliseconds=0x64) [0059.323] GetTickCount () returned 0x1ef3e [0059.323] Sleep (dwMilliseconds=0x64) [0059.502] GetTickCount () returned 0x1efe9 [0059.502] Sleep (dwMilliseconds=0x64) [0060.331] GetTickCount () returned 0x1f324 [0060.331] GetTickCount () returned 0x1f324 [0060.331] Sleep (dwMilliseconds=0x64) [0060.732] GetTickCount () returned 0x1f4ba [0060.732] Sleep (dwMilliseconds=0x64) [0060.890] GetTickCount () returned 0x1f556 [0060.890] Sleep (dwMilliseconds=0x64) [0061.403] GetTickCount () returned 0x1f758 [0061.404] GetTickCount () returned 0x1f758 [0061.404] Sleep (dwMilliseconds=0x64) [0061.770] GetTickCount () returned 0x1f8bf [0061.770] Sleep (dwMilliseconds=0x64) [0061.902] GetTickCount () returned 0x1f94c [0061.903] Sleep (dwMilliseconds=0x64) [0062.154] GetTickCount () returned 0x1fa45 [0062.154] Sleep (dwMilliseconds=0x64) [0062.386] GetTickCount () returned 0x1fb2f [0062.386] Sleep (dwMilliseconds=0x64) [0062.904] GetTickCount () returned 0x1fd32 [0062.904] GetTickCount () returned 0x1fd32 [0062.904] Sleep (dwMilliseconds=0x64) [0063.585] GetTickCount () returned 0x1ffe0 [0063.585] Sleep (dwMilliseconds=0x64) [0063.884] GetTickCount () returned 0x20109 [0063.884] Sleep (dwMilliseconds=0x64) [0063.991] GetTickCount () returned 0x20176 [0063.991] GetTickCount () returned 0x20176 [0063.991] Sleep (dwMilliseconds=0x64) [0064.391] GetTickCount () returned 0x202fc [0064.392] Sleep (dwMilliseconds=0x64) [0064.786] GetTickCount () returned 0x20492 [0064.786] Sleep (dwMilliseconds=0x64) [0065.109] GetTickCount () returned 0x205ca [0065.109] GetTickCount () returned 0x205ca [0065.109] Sleep (dwMilliseconds=0x64) [0065.956] GetTickCount () returned 0x20924 [0065.956] Sleep (dwMilliseconds=0x64) [0066.094] GetTickCount () returned 0x209b0 [0066.094] Sleep (dwMilliseconds=0x64) [0066.286] GetTickCount () returned 0x20a6b [0066.286] GetTickCount () returned 0x20a6b [0066.286] Sleep (dwMilliseconds=0x64) [0066.512] GetTickCount () returned 0x20b46 [0066.512] Sleep (dwMilliseconds=0x64) [0067.437] GetTickCount () returned 0x20eee [0067.437] GetTickCount () returned 0x20eee [0067.437] Sleep (dwMilliseconds=0x64) [0067.574] GetTickCount () returned 0x20f6a [0067.574] Sleep (dwMilliseconds=0x64) [0067.725] GetTickCount () returned 0x21006 [0067.725] Sleep (dwMilliseconds=0x64) [0067.840] GetTickCount () returned 0x21083 [0067.841] Sleep (dwMilliseconds=0x64) [0068.373] GetTickCount () returned 0x21296 [0068.373] Sleep (dwMilliseconds=0x64) [0068.480] GetTickCount () returned 0x21303 [0068.480] GetTickCount () returned 0x21303 [0068.480] Sleep (dwMilliseconds=0x64) [0068.589] GetTickCount () returned 0x21370 [0068.589] Sleep (dwMilliseconds=0x64) [0069.177] GetTickCount () returned 0x215b1 [0069.177] Sleep (dwMilliseconds=0x64) [0069.329] GetTickCount () returned 0x2164d [0069.329] Sleep (dwMilliseconds=0x64) [0069.529] GetTickCount () returned 0x21718 [0069.529] GetTickCount () returned 0x21718 [0069.529] Sleep (dwMilliseconds=0x64) [0070.026] GetTickCount () returned 0x2190b [0070.027] Sleep (dwMilliseconds=0x64) [0070.713] GetTickCount () returned 0x21bba [0070.713] GetTickCount () returned 0x21bba [0070.713] Sleep (dwMilliseconds=0x64) [0071.101] GetTickCount () returned 0x21d40 [0071.101] Sleep (dwMilliseconds=0x64) [0071.445] GetTickCount () returned 0x21e97 [0071.445] Sleep (dwMilliseconds=0x64) [0071.634] GetTickCount () returned 0x21f52 [0071.634] Sleep (dwMilliseconds=0x64) [0071.792] GetTickCount () returned 0x21fee [0071.792] GetTickCount () returned 0x21fee [0071.792] Sleep (dwMilliseconds=0x64) [0071.934] GetTickCount () returned 0x2207a [0071.934] Sleep (dwMilliseconds=0x64) [0072.212] GetTickCount () returned 0x22193 [0072.212] Sleep (dwMilliseconds=0x64) [0072.408] GetTickCount () returned 0x2224e [0072.408] Sleep (dwMilliseconds=0x64) [0072.641] GetTickCount () returned 0x22338 [0072.641] Sleep (dwMilliseconds=0x64) [0073.205] GetTickCount () returned 0x2256a [0073.205] GetTickCount () returned 0x2256a [0073.205] Sleep (dwMilliseconds=0x64) [0073.724] GetTickCount () returned 0x2277c [0073.724] Sleep (dwMilliseconds=0x64) [0073.830] GetTickCount () returned 0x227ea [0073.831] Sleep (dwMilliseconds=0x64) [0074.047] GetTickCount () returned 0x228b4 [0074.047] Sleep (dwMilliseconds=0x64) [0074.155] GetTickCount () returned 0x22922 [0074.155] Sleep (dwMilliseconds=0x64) [0074.390] GetTickCount () returned 0x22a0c [0074.390] GetTickCount () returned 0x22a0c [0074.397] Sleep (dwMilliseconds=0x64) [0074.756] GetTickCount () returned 0x22b82 [0074.756] Sleep (dwMilliseconds=0x64) [0075.211] GetTickCount () returned 0x22d46 [0075.211] Sleep (dwMilliseconds=0x64) [0075.332] GetTickCount () returned 0x22dc3 [0075.332] Sleep (dwMilliseconds=0x64) [0075.883] GetTickCount () returned 0x22fe5 [0075.883] GetTickCount () returned 0x22fe5 [0075.883] Sleep (dwMilliseconds=0x64) [0075.986] GetTickCount () returned 0x23052 [0075.986] Sleep (dwMilliseconds=0x64) [0076.093] GetTickCount () returned 0x230c0 [0076.093] Sleep (dwMilliseconds=0x64) [0076.274] GetTickCount () returned 0x2316b [0076.274] Sleep (dwMilliseconds=0x64) [0076.649] GetTickCount () returned 0x232e2 [0076.649] Sleep (dwMilliseconds=0x64) [0076.777] GetTickCount () returned 0x2335e [0076.777] Sleep (dwMilliseconds=0x64) [0076.934] GetTickCount () returned 0x233fa [0076.934] GetTickCount () returned 0x233fa [0076.934] Sleep (dwMilliseconds=0x64) [0077.445] GetTickCount () returned 0x235fd [0077.445] Sleep (dwMilliseconds=0x64) [0077.586] GetTickCount () returned 0x2368a [0077.586] Sleep (dwMilliseconds=0x64) [0077.684] GetTickCount () returned 0x236f7 [0077.684] Sleep (dwMilliseconds=0x64) [0078.032] GetTickCount () returned 0x2384e [0078.038] GetTickCount () returned 0x2384e [0078.038] Sleep (dwMilliseconds=0x64) [0078.432] GetTickCount () returned 0x239e4 [0078.432] Sleep (dwMilliseconds=0x64) [0078.766] GetTickCount () returned 0x23b2b [0078.766] Sleep (dwMilliseconds=0x64) [0079.182] GetTickCount () returned 0x23cd0 [0079.182] GetTickCount () returned 0x23cd0 [0079.182] Sleep (dwMilliseconds=0x64) [0079.451] GetTickCount () returned 0x23dda [0079.451] Sleep (dwMilliseconds=0x64) [0079.728] GetTickCount () returned 0x23ef2 [0079.728] Sleep (dwMilliseconds=0x64) [0079.939] GetTickCount () returned 0x23fbd [0079.939] Sleep (dwMilliseconds=0x64) [0080.050] GetTickCount () returned 0x2402a [0080.050] Sleep (dwMilliseconds=0x64) [0080.858] GetTickCount () returned 0x24356 [0080.858] GetTickCount () returned 0x24356 [0080.858] Sleep (dwMilliseconds=0x64) [0081.021] GetTickCount () returned 0x243f2 [0081.021] Sleep (dwMilliseconds=0x64) [0081.150] GetTickCount () returned 0x2447e [0081.150] Sleep (dwMilliseconds=0x64) [0081.817] GetTickCount () returned 0x2471d [0081.817] Sleep (dwMilliseconds=0x64) [0082.163] GetTickCount () returned 0x24874 [0082.164] GetTickCount () returned 0x24874 [0082.164] Sleep (dwMilliseconds=0x64) [0082.390] GetTickCount () returned 0x2494e [0082.390] Sleep (dwMilliseconds=0x64) [0083.184] GetTickCount () returned 0x24c6a [0083.184] GetTickCount () returned 0x24c6a [0083.184] Sleep (dwMilliseconds=0x64) [0083.546] GetTickCount () returned 0x24dd1 [0083.546] Sleep (dwMilliseconds=0x64) [0083.684] GetTickCount () returned 0x24e5d [0083.684] Sleep (dwMilliseconds=0x64) [0083.871] GetTickCount () returned 0x24f18 [0083.871] Sleep (dwMilliseconds=0x64) [0084.174] GetTickCount () returned 0x25050 [0084.174] Sleep (dwMilliseconds=0x64) [0084.339] GetTickCount () returned 0x250ec [0084.339] GetTickCount () returned 0x250ec [0084.339] Sleep (dwMilliseconds=0x64) [0084.643] GetTickCount () returned 0x25224 [0084.643] Sleep (dwMilliseconds=0x64) [0085.132] GetTickCount () returned 0x25408 [0085.132] Sleep (dwMilliseconds=0x64) [0085.321] GetTickCount () returned 0x254c3 [0085.321] Sleep (dwMilliseconds=0x64) [0085.590] GetTickCount () returned 0x255cc [0085.590] GetTickCount () returned 0x255cc [0085.590] Sleep (dwMilliseconds=0x64) [0085.774] GetTickCount () returned 0x25688 [0085.774] Sleep (dwMilliseconds=0x64) [0085.989] GetTickCount () returned 0x25762 [0085.989] Sleep (dwMilliseconds=0x64) [0086.399] GetTickCount () returned 0x258f8 [0086.399] Sleep (dwMilliseconds=0x64) [0086.974] GetTickCount () returned 0x25b39 [0086.974] GetTickCount () returned 0x25b39 [0086.974] Sleep (dwMilliseconds=0x64) [0087.233] GetTickCount () returned 0x25c42 [0087.233] Sleep (dwMilliseconds=0x64) [0087.379] GetTickCount () returned 0x25cce [0087.379] Sleep (dwMilliseconds=0x64) [0087.597] GetTickCount () returned 0x25da9 [0087.598] Sleep (dwMilliseconds=0x64) [0088.186] GetTickCount () returned 0x25ffa [0088.186] GetTickCount () returned 0x25ffa [0088.186] Sleep (dwMilliseconds=0x64) [0088.435] GetTickCount () returned 0x260f3 [0088.435] Sleep (dwMilliseconds=0x64) [0088.623] GetTickCount () returned 0x261af [0088.623] Sleep (dwMilliseconds=0x64) [0088.904] GetTickCount () returned 0x262c7 [0088.905] Sleep (dwMilliseconds=0x64) [0089.097] GetTickCount () returned 0x26383 [0089.097] Sleep (dwMilliseconds=0x64) [0089.441] GetTickCount () returned 0x264da [0089.441] GetTickCount () returned 0x264da [0089.441] Sleep (dwMilliseconds=0x64) [0089.671] GetTickCount () returned 0x265c4 [0089.671] Sleep (dwMilliseconds=0x64) [0089.870] GetTickCount () returned 0x2668f [0089.870] Sleep (dwMilliseconds=0x64) [0090.020] GetTickCount () returned 0x2671b [0090.020] Sleep (dwMilliseconds=0x64) [0090.262] GetTickCount () returned 0x26815 [0090.262] Sleep (dwMilliseconds=0x64) [0090.437] GetTickCount () returned 0x268c0 [0090.438] Sleep (dwMilliseconds=0x64) [0090.581] GetTickCount () returned 0x2694d [0090.581] GetTickCount () returned 0x2694d [0090.581] Sleep (dwMilliseconds=0x64) [0090.750] GetTickCount () returned 0x269f8 [0090.750] Sleep (dwMilliseconds=0x64) [0090.898] GetTickCount () returned 0x26a94 [0090.898] Sleep (dwMilliseconds=0x64) [0091.165] GetTickCount () returned 0x26b9d [0091.166] Sleep (dwMilliseconds=0x64) [0091.356] GetTickCount () returned 0x26c59 [0091.356] Sleep (dwMilliseconds=0x64) [0091.621] GetTickCount () returned 0x26d62 [0091.621] GetTickCount () returned 0x26d62 [0091.621] Sleep (dwMilliseconds=0x64) [0092.005] GetTickCount () returned 0x26ee8 [0092.005] Sleep (dwMilliseconds=0x64) [0092.326] GetTickCount () returned 0x27020 [0092.326] Sleep (dwMilliseconds=0x64) [0092.524] GetTickCount () returned 0x270eb [0092.524] Sleep (dwMilliseconds=0x64) [0092.695] GetTickCount () returned 0x27196 [0092.695] GetTickCount () returned 0x27196 [0092.695] Sleep (dwMilliseconds=0x64) [0092.856] GetTickCount () returned 0x27232 [0092.856] Sleep (dwMilliseconds=0x64) [0093.253] GetTickCount () returned 0x273c8 [0093.253] Sleep (dwMilliseconds=0x64) [0093.501] GetTickCount () returned 0x274b2 [0093.501] Sleep (dwMilliseconds=0x64) [0093.749] GetTickCount () returned 0x275ab [0093.749] GetTickCount () returned 0x275ab [0093.749] Sleep (dwMilliseconds=0x64) [0094.060] GetTickCount () returned 0x276e3 [0094.060] Sleep (dwMilliseconds=0x64) [0094.205] GetTickCount () returned 0x2777f [0094.205] Sleep (dwMilliseconds=0x64) [0094.472] GetTickCount () returned 0x27889 [0094.472] Sleep (dwMilliseconds=0x64) [0094.793] GetTickCount () returned 0x279c1 [0094.793] Sleep (dwMilliseconds=0x64) [0095.004] GetTickCount () returned 0x27a9b [0095.004] Sleep (dwMilliseconds=0x64) [0095.122] GetTickCount () returned 0x27b08 [0095.122] Sleep (dwMilliseconds=0x64) [0095.230] GetTickCount () returned 0x27b75 [0095.230] Sleep (dwMilliseconds=0x64) [0095.412] GetTickCount () returned 0x27c31 [0095.413] Sleep (dwMilliseconds=0x64) [0095.620] GetTickCount () returned 0x27cfb [0095.620] Sleep (dwMilliseconds=0x64) [0095.729] GetTickCount () returned 0x27d69 [0095.729] Sleep (dwMilliseconds=0x64) [0095.967] GetTickCount () returned 0x27e62 [0095.967] Sleep (dwMilliseconds=0x64) [0096.097] GetTickCount () returned 0x27edf [0096.097] Sleep (dwMilliseconds=0x64) [0096.450] GetTickCount () returned 0x28046 [0096.450] Sleep (dwMilliseconds=0x64) [0096.774] GetTickCount () returned 0x2817e [0096.774] Sleep (dwMilliseconds=0x64) [0096.999] GetTickCount () returned 0x28268 [0096.999] Sleep (dwMilliseconds=0x64) [0097.107] GetTickCount () returned 0x282d5 [0097.107] Sleep (dwMilliseconds=0x64) [0097.426] GetTickCount () returned 0x2840d [0097.426] Sleep (dwMilliseconds=0x64) [0097.559] GetTickCount () returned 0x28499 [0097.559] Sleep (dwMilliseconds=0x64) [0098.094] GetTickCount () returned 0x286ac [0098.094] Sleep (dwMilliseconds=0x64) [0098.213] GetTickCount () returned 0x28729 [0098.213] Sleep (dwMilliseconds=0x64) [0098.363] GetTickCount () returned 0x287b5 [0098.363] Sleep (dwMilliseconds=0x64) [0098.689] GetTickCount () returned 0x288fd [0098.689] Sleep (dwMilliseconds=0x64) [0098.827] GetTickCount () returned 0x28989 [0098.827] Sleep (dwMilliseconds=0x64) [0099.010] GetTickCount () returned 0x28a44 [0099.010] Sleep (dwMilliseconds=0x64) [0099.121] GetTickCount () returned 0x28ab1 [0099.121] Sleep (dwMilliseconds=0x64) [0099.275] GetTickCount () returned 0x28b4d [0099.275] Sleep (dwMilliseconds=0x64) [0099.424] GetTickCount () returned 0x28bda [0099.425] Sleep (dwMilliseconds=0x64) [0099.576] GetTickCount () returned 0x28c76 [0099.576] Sleep (dwMilliseconds=0x64) [0099.708] GetTickCount () returned 0x28cf3 [0099.708] Sleep (dwMilliseconds=0x64) [0099.947] GetTickCount () returned 0x28dec [0099.947] Sleep (dwMilliseconds=0x64) [0100.149] GetTickCount () returned 0x28eb7 [0100.149] Sleep (dwMilliseconds=0x64) [0100.375] GetTickCount () returned 0x28f91 [0100.375] Sleep (dwMilliseconds=0x64) [0100.564] GetTickCount () returned 0x2904d [0100.564] Sleep (dwMilliseconds=0x64) [0100.725] GetTickCount () returned 0x290f8 [0100.725] Sleep (dwMilliseconds=0x64) [0101.005] GetTickCount () returned 0x29201 [0101.005] Sleep (dwMilliseconds=0x64) [0101.141] GetTickCount () returned 0x2928e [0101.141] Sleep (dwMilliseconds=0x64) [0101.428] GetTickCount () returned 0x293b6 [0101.428] Sleep (dwMilliseconds=0x64) [0101.543] GetTickCount () returned 0x29423 [0101.543] Sleep (dwMilliseconds=0x64) [0101.774] GetTickCount () returned 0x2950d [0101.774] Sleep (dwMilliseconds=0x64) [0101.942] GetTickCount () returned 0x295b9 [0101.942] Sleep (dwMilliseconds=0x64) [0102.069] GetTickCount () returned 0x29636 [0102.069] Sleep (dwMilliseconds=0x64) [0102.287] GetTickCount () returned 0x29710 [0102.287] Sleep (dwMilliseconds=0x64) [0102.589] GetTickCount () returned 0x29839 [0102.589] Sleep (dwMilliseconds=0x64) [0102.895] GetTickCount () returned 0x29971 [0102.895] Sleep (dwMilliseconds=0x64) [0103.075] GetTickCount () returned 0x29a1c [0103.075] Sleep (dwMilliseconds=0x64) [0103.425] GetTickCount () returned 0x29b83 [0103.425] Sleep (dwMilliseconds=0x64) [0103.574] GetTickCount () returned 0x29c0f [0103.574] Sleep (dwMilliseconds=0x64) [0103.723] GetTickCount () returned 0x29cab [0103.723] Sleep (dwMilliseconds=0x64) [0103.950] GetTickCount () returned 0x29d86 [0103.950] Sleep (dwMilliseconds=0x64) [0104.086] GetTickCount () returned 0x29e12 [0104.086] Sleep (dwMilliseconds=0x64) [0104.207] GetTickCount () returned 0x29e8f [0104.207] Sleep (dwMilliseconds=0x64) [0104.427] GetTickCount () returned 0x29f69 [0104.427] Sleep (dwMilliseconds=0x64) [0104.773] GetTickCount () returned 0x2a0c1 [0104.773] Sleep (dwMilliseconds=0x64) [0105.010] GetTickCount () returned 0x2a1ab [0105.010] Sleep (dwMilliseconds=0x64) [0105.146] GetTickCount () returned 0x2a237 [0105.146] Sleep (dwMilliseconds=0x64) [0105.408] GetTickCount () returned 0x2a340 [0105.408] Sleep (dwMilliseconds=0x64) [0105.669] GetTickCount () returned 0x2a43a [0105.669] Sleep (dwMilliseconds=0x64) [0106.007] GetTickCount () returned 0x2a591 [0106.007] Sleep (dwMilliseconds=0x64) [0106.222] GetTickCount () returned 0x2a66b [0106.222] Sleep (dwMilliseconds=0x64) [0106.338] GetTickCount () returned 0x2a6d9 [0106.338] Sleep (dwMilliseconds=0x64) [0106.684] GetTickCount () returned 0x2a83f [0106.684] Sleep (dwMilliseconds=0x64) [0107.096] GetTickCount () returned 0x2a9d5 [0107.096] Sleep (dwMilliseconds=0x64) [0107.333] GetTickCount () returned 0x2aabf [0107.333] Sleep (dwMilliseconds=0x64) [0107.460] GetTickCount () returned 0x2ab3c [0107.460] Sleep (dwMilliseconds=0x64) [0107.566] GetTickCount () returned 0x2aba9 [0107.566] Sleep (dwMilliseconds=0x64) [0108.026] GetTickCount () returned 0x2ad7d [0108.026] Sleep (dwMilliseconds=0x64) [0108.322] GetTickCount () returned 0x2ae96 [0108.322] Sleep (dwMilliseconds=0x64) [0108.506] GetTickCount () returned 0x2af51 [0108.506] Sleep (dwMilliseconds=0x64) [0108.669] GetTickCount () returned 0x2affd [0108.669] Sleep (dwMilliseconds=0x64) [0108.949] GetTickCount () returned 0x2b115 [0108.949] Sleep (dwMilliseconds=0x64) [0109.306] GetTickCount () returned 0x2b27c [0109.306] Sleep (dwMilliseconds=0x64) [0109.588] GetTickCount () returned 0x2b395 [0109.588] Sleep (dwMilliseconds=0x64) [0109.759] GetTickCount () returned 0x2b441 [0109.759] Sleep (dwMilliseconds=0x64) [0109.912] GetTickCount () returned 0x2b4cd [0109.912] Sleep (dwMilliseconds=0x64) [0110.265] GetTickCount () returned 0x2b634 [0110.265] Sleep (dwMilliseconds=0x64) [0110.433] GetTickCount () returned 0x2b6df [0110.433] Sleep (dwMilliseconds=0x64) [0110.787] GetTickCount () returned 0x2b846 [0110.787] Sleep (dwMilliseconds=0x64) [0110.935] GetTickCount () returned 0x2b8d3 [0110.935] Sleep (dwMilliseconds=0x64) [0111.141] GetTickCount () returned 0x2b99d [0111.141] Sleep (dwMilliseconds=0x64) [0111.247] GetTickCount () returned 0x2ba0b [0111.247] Sleep (dwMilliseconds=0x64) [0111.612] GetTickCount () returned 0x2bb71 [0111.612] Sleep (dwMilliseconds=0x64) [0112.080] GetTickCount () returned 0x2bd45 [0112.080] Sleep (dwMilliseconds=0x64) [0112.232] GetTickCount () returned 0x2bde1 [0112.232] Sleep (dwMilliseconds=0x64) [0112.446] GetTickCount () returned 0x2bebc [0112.446] Sleep (dwMilliseconds=0x64) [0112.701] GetTickCount () returned 0x2bfb5 [0112.701] Sleep (dwMilliseconds=0x64) [0112.813] GetTickCount () returned 0x2c023 [0112.813] Sleep (dwMilliseconds=0x64) [0112.995] GetTickCount () returned 0x2c0de [0112.995] Sleep (dwMilliseconds=0x64) [0113.505] GetTickCount () returned 0x2c2e1 [0113.505] Sleep (dwMilliseconds=0x64) [0113.914] GetTickCount () returned 0x2c476 [0113.914] Sleep (dwMilliseconds=0x64) [0114.239] GetTickCount () returned 0x2c5be [0114.239] Sleep (dwMilliseconds=0x64) [0114.412] GetTickCount () returned 0x2c669 [0114.412] Sleep (dwMilliseconds=0x64) [0114.627] GetTickCount () returned 0x2c744 [0114.627] Sleep (dwMilliseconds=0x64) [0114.906] GetTickCount () returned 0x2c85d [0114.906] Sleep (dwMilliseconds=0x64) [0115.221] GetTickCount () returned 0x2c995 [0115.221] Sleep (dwMilliseconds=0x64) [0115.365] GetTickCount () returned 0x2ca21 [0115.365] Sleep (dwMilliseconds=0x64) [0115.506] GetTickCount () returned 0x2caad [0115.506] Sleep (dwMilliseconds=0x64) [0115.845] GetTickCount () returned 0x2cc05 [0115.845] Sleep (dwMilliseconds=0x64) [0116.269] GetTickCount () returned 0x2cdaa [0116.269] Sleep (dwMilliseconds=0x64) [0116.498] GetTickCount () returned 0x2ce94 [0116.498] Sleep (dwMilliseconds=0x64) [0116.626] GetTickCount () returned 0x2cf11 [0116.626] Sleep (dwMilliseconds=0x64) [0116.771] GetTickCount () returned 0x2cf9d [0116.771] Sleep (dwMilliseconds=0x64) [0117.113] GetTickCount () returned 0x2d0f4 [0117.113] Sleep (dwMilliseconds=0x64) [0117.220] GetTickCount () returned 0x2d161 [0117.220] Sleep (dwMilliseconds=0x64) [0117.518] GetTickCount () returned 0x2d28a [0117.518] Sleep (dwMilliseconds=0x64) [0117.885] GetTickCount () returned 0x2d400 [0117.885] Sleep (dwMilliseconds=0x64) [0118.286] GetTickCount () returned 0x2d586 [0118.286] Sleep (dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x9c4 [0033.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x683a78 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x693a80 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641120 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x641650 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641138 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x35f0020 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641150 [0033.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641150, Size=0x20) returned 0x629f48 [0033.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641150 [0033.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641150, Size=0x20) returned 0x629f70 [0033.713] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.713] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.713] Wow64DisableWow64FsRedirection (in: OldValue=0x236ff58 | out: OldValue=0x236ff58*=0x0) returned 1 [0033.713] lstrlenW (lpString="kernel32.dll") returned 12 [0033.714] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.714] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.714] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.714] Sleep (dwMilliseconds=0x64) [0033.880] lstrcmpiW (lpString1=".ini", lpString2=".zoh") returned -1 [0033.880] lstrlenW (lpString="desktop.ini") returned 11 [0033.880] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0033.880] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=129) returned 1 [0033.880] CloseHandle (hObject=0x16c) returned 1 [0033.881] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0033.881] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.881] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0033.881] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.881] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.881] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0033.882] GetLastError () returned 0x0 [0033.882] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x81, lpOverlapped=0x0) returned 1 [0033.932] WriteFile (in: hFile=0x170, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x90, lpOverlapped=0x0) returned 1 [0033.933] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.933] WriteFile (in: hFile=0x170, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0033.933] SetEndOfFile (hFile=0x170) returned 1 [0033.933] CloseHandle (hObject=0x170) returned 1 [0033.934] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.934] SetEndOfFile (hFile=0x16c) returned 1 [0033.935] CloseHandle (hObject=0x16c) returned 1 [0033.935] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x26) returned 1 [0033.990] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0033.990] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.990] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.990] lstrlenW (lpString=".doc") returned 4 [0033.990] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.990] lstrlenW (lpString=".docx") returned 5 [0033.990] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.991] lstrlenW (lpString=".pdf") returned 4 [0033.991] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString=".xls") returned 4 [0033.991] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString=".xlsx") returned 5 [0033.991] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.991] lstrlenW (lpString=".ppt") returned 4 [0033.991] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString=".zip") returned 4 [0033.991] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString=".rar") returned 4 [0033.991] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString=".bz2") returned 4 [0033.991] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.991] lstrlenW (lpString=".7z") returned 3 [0033.991] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString=".dbf") returned 4 [0033.991] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString=".1cd") returned 4 [0033.991] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString=".jpg") returned 4 [0033.991] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.991] lstrlenW (lpString=".doc") returned 4 [0033.991] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.991] lstrlenW (lpString=".docx") returned 5 [0033.991] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.992] lstrlenW (lpString=".pdf") returned 4 [0033.992] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.992] lstrlenW (lpString=".xls") returned 4 [0033.992] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.992] lstrlenW (lpString=".xlsx") returned 5 [0033.992] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.992] lstrlenW (lpString=".ppt") returned 4 [0033.992] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.992] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.992] lstrlenW (lpString=".zip") returned 4 [0033.992] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.992] lstrlenW (lpString=".rar") returned 4 [0033.992] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.992] lstrlenW (lpString=".bz2") returned 4 [0033.992] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.992] lstrlenW (lpString=".7z") returned 3 [0033.992] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.992] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.992] lstrlenW (lpString=".dbf") returned 4 [0033.992] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.992] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.992] lstrlenW (lpString=".1cd") returned 4 [0033.992] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.992] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.992] lstrlenW (lpString=".jpg") returned 4 [0033.992] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.992] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0033.993] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0033.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.993] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1450) returned 1 [0033.993] CloseHandle (hObject=0x178) returned 1 [0033.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0033.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.994] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.994] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0033.994] GetLastError () returned 0x0 [0033.995] ReadFile (in: hFile=0x178, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.033] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.033] ReadFile (in: hFile=0x178, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.034] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0034.034] SetEndOfFile (hFile=0x16c) returned 1 [0034.034] CloseHandle (hObject=0x16c) returned 1 [0034.035] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.035] SetEndOfFile (hFile=0x178) returned 1 [0034.036] CloseHandle (hObject=0x178) returned 1 [0034.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.036] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0034.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.036] lstrlenW (lpString=".doc") returned 4 [0034.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.036] lstrlenW (lpString=".docx") returned 5 [0034.036] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.036] lstrlenW (lpString=".pdf") returned 4 [0034.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString=".xls") returned 4 [0034.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString=".xlsx") returned 5 [0034.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.037] lstrlenW (lpString=".ppt") returned 4 [0034.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString=".zip") returned 4 [0034.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.037] lstrlenW (lpString=".rar") returned 4 [0034.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString=".bz2") returned 4 [0034.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString=".7z") returned 3 [0034.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString=".dbf") returned 4 [0034.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString=".1cd") returned 4 [0034.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString=".jpg") returned 4 [0034.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.037] lstrlenW (lpString=".doc") returned 4 [0034.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.037] lstrlenW (lpString=".docx") returned 5 [0034.037] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.037] lstrlenW (lpString=".pdf") returned 4 [0034.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString=".xls") returned 4 [0034.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString=".xlsx") returned 5 [0034.038] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.038] lstrlenW (lpString=".ppt") returned 4 [0034.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.038] lstrlenW (lpString=".zip") returned 4 [0034.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.038] lstrlenW (lpString=".rar") returned 4 [0034.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString=".bz2") returned 4 [0034.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString=".7z") returned 3 [0034.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.038] lstrlenW (lpString=".dbf") returned 4 [0034.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.038] lstrlenW (lpString=".1cd") returned 4 [0034.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.038] lstrlenW (lpString=".jpg") returned 4 [0034.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.038] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.038] lstrlenW (lpString="Setup.xml") returned 9 [0034.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.301] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1608) returned 1 [0034.301] CloseHandle (hObject=0x170) returned 1 [0034.301] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.301] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.301] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.301] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.302] GetLastError () returned 0x0 [0034.302] ReadFile (in: hFile=0x170, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x648, lpOverlapped=0x0) returned 1 [0034.304] WriteFile (in: hFile=0x188, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.304] ReadFile (in: hFile=0x170, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.305] WriteFile (in: hFile=0x188, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.305] SetEndOfFile (hFile=0x188) returned 1 [0034.305] CloseHandle (hObject=0x188) returned 1 [0034.306] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.306] SetEndOfFile (hFile=0x170) returned 1 [0034.306] CloseHandle (hObject=0x170) returned 1 [0034.306] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.307] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.307] lstrlenW (lpString=".doc") returned 4 [0034.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".docx") returned 5 [0034.307] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.307] lstrlenW (lpString=".pdf") returned 4 [0034.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".xls") returned 4 [0034.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".xlsx") returned 5 [0034.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.307] lstrlenW (lpString=".ppt") returned 4 [0034.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.307] lstrlenW (lpString=".zip") returned 4 [0034.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.307] lstrlenW (lpString=".rar") returned 4 [0034.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".bz2") returned 4 [0034.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.307] lstrlenW (lpString=".7z") returned 3 [0034.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString=".dbf") returned 4 [0034.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString=".1cd") returned 4 [0034.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString=".jpg") returned 4 [0034.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString=".doc") returned 4 [0034.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".docx") returned 5 [0034.308] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.308] lstrlenW (lpString=".pdf") returned 4 [0034.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".xls") returned 4 [0034.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".xlsx") returned 5 [0034.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.308] lstrlenW (lpString=".ppt") returned 4 [0034.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.308] lstrlenW (lpString=".zip") returned 4 [0034.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.308] lstrlenW (lpString=".rar") returned 4 [0034.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".bz2") returned 4 [0034.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.308] lstrlenW (lpString=".7z") returned 3 [0034.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.309] lstrlenW (lpString=".dbf") returned 4 [0034.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.309] lstrlenW (lpString=".1cd") returned 4 [0034.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.309] lstrlenW (lpString=".jpg") returned 4 [0034.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.309] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.309] lstrlenW (lpString="WordMUI.xml") returned 11 [0034.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.628] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1800) returned 1 [0034.628] CloseHandle (hObject=0x19c) returned 1 [0034.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0034.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.628] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.628] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.629] GetLastError () returned 0x0 [0034.629] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x708, lpOverlapped=0x0) returned 1 [0034.630] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x710, lpOverlapped=0x0) returned 1 [0034.631] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.631] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.631] SetEndOfFile (hFile=0x1a0) returned 1 [0034.632] CloseHandle (hObject=0x1a0) returned 1 [0034.632] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.632] SetEndOfFile (hFile=0x19c) returned 1 [0034.633] CloseHandle (hObject=0x19c) returned 1 [0034.633] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.633] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString=".doc") returned 4 [0034.634] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString=".docx") returned 5 [0034.634] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.634] lstrlenW (lpString=".pdf") returned 4 [0034.634] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString=".xls") returned 4 [0034.634] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString=".xlsx") returned 5 [0034.634] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.634] lstrlenW (lpString=".ppt") returned 4 [0034.634] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString=".zip") returned 4 [0034.634] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.634] lstrlenW (lpString=".rar") returned 4 [0034.634] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString=".bz2") returned 4 [0034.634] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString=".7z") returned 3 [0034.634] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString=".dbf") returned 4 [0034.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString=".1cd") returned 4 [0034.634] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.634] lstrlenW (lpString=".jpg") returned 4 [0034.634] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString=".doc") returned 4 [0034.635] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString=".docx") returned 5 [0034.635] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.635] lstrlenW (lpString=".pdf") returned 4 [0034.635] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString=".xls") returned 4 [0034.635] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString=".xlsx") returned 5 [0034.635] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.635] lstrlenW (lpString=".ppt") returned 4 [0034.635] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString=".zip") returned 4 [0034.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.635] lstrlenW (lpString=".rar") returned 4 [0034.635] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString=".bz2") returned 4 [0034.635] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString=".7z") returned 3 [0034.635] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString=".dbf") returned 4 [0034.635] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString=".1cd") returned 4 [0034.635] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.635] lstrlenW (lpString=".jpg") returned 4 [0034.635] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.636] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.636] lstrlenW (lpString="Setup.xml") returned 9 [0034.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.636] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1852) returned 1 [0034.636] CloseHandle (hObject=0x19c) returned 1 [0034.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.637] GetLastError () returned 0x0 [0034.637] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x73c, lpOverlapped=0x0) returned 1 [0034.638] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x740, lpOverlapped=0x0) returned 1 [0034.639] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.639] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.639] SetEndOfFile (hFile=0x1a0) returned 1 [0034.639] CloseHandle (hObject=0x1a0) returned 1 [0034.640] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.640] SetEndOfFile (hFile=0x19c) returned 1 [0034.641] CloseHandle (hObject=0x19c) returned 1 [0034.641] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.641] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.641] lstrlenW (lpString=".doc") returned 4 [0034.641] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.641] lstrlenW (lpString=".docx") returned 5 [0034.641] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.641] lstrlenW (lpString=".pdf") returned 4 [0034.641] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.641] lstrlenW (lpString=".xls") returned 4 [0034.641] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".xlsx") returned 5 [0034.642] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.642] lstrlenW (lpString=".ppt") returned 4 [0034.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString=".zip") returned 4 [0034.642] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.642] lstrlenW (lpString=".rar") returned 4 [0034.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".bz2") returned 4 [0034.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".7z") returned 3 [0034.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString=".dbf") returned 4 [0034.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString=".1cd") returned 4 [0034.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString=".jpg") returned 4 [0034.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.642] lstrlenW (lpString=".doc") returned 4 [0034.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".docx") returned 5 [0034.642] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.642] lstrlenW (lpString=".pdf") returned 4 [0034.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".xls") returned 4 [0034.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.642] lstrlenW (lpString=".xlsx") returned 5 [0034.643] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.643] lstrlenW (lpString=".ppt") returned 4 [0034.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.643] lstrlenW (lpString=".zip") returned 4 [0034.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.643] lstrlenW (lpString=".rar") returned 4 [0034.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.643] lstrlenW (lpString=".bz2") returned 4 [0034.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.643] lstrlenW (lpString=".7z") returned 3 [0034.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.643] lstrlenW (lpString=".dbf") returned 4 [0034.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.643] lstrlenW (lpString=".1cd") returned 4 [0034.643] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.643] lstrlenW (lpString=".jpg") returned 4 [0034.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.643] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.643] lstrlenW (lpString="Setup.xml") returned 9 [0034.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.644] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6241) returned 1 [0034.644] CloseHandle (hObject=0x19c) returned 1 [0034.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.644] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.644] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.646] GetLastError () returned 0x0 [0034.646] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1861, lpOverlapped=0x0) returned 1 [0034.648] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0034.649] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.649] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.649] SetEndOfFile (hFile=0x1a0) returned 1 [0034.649] CloseHandle (hObject=0x1a0) returned 1 [0034.649] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.649] SetEndOfFile (hFile=0x19c) returned 1 [0034.650] CloseHandle (hObject=0x19c) returned 1 [0034.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.651] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.651] lstrlenW (lpString=".doc") returned 4 [0034.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".docx") returned 5 [0034.651] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.651] lstrlenW (lpString=".pdf") returned 4 [0034.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".xls") returned 4 [0034.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".xlsx") returned 5 [0034.651] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.651] lstrlenW (lpString=".ppt") returned 4 [0034.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.651] lstrlenW (lpString=".zip") returned 4 [0034.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.651] lstrlenW (lpString=".rar") returned 4 [0034.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".bz2") returned 4 [0034.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".7z") returned 3 [0034.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString=".dbf") returned 4 [0034.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString=".1cd") returned 4 [0034.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString=".jpg") returned 4 [0034.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString=".doc") returned 4 [0034.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".docx") returned 5 [0034.652] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.652] lstrlenW (lpString=".pdf") returned 4 [0034.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".xls") returned 4 [0034.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".xlsx") returned 5 [0034.652] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.652] lstrlenW (lpString=".ppt") returned 4 [0034.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.652] lstrlenW (lpString=".zip") returned 4 [0034.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.652] lstrlenW (lpString=".rar") returned 4 [0034.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".bz2") returned 4 [0034.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".7z") returned 3 [0034.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.653] lstrlenW (lpString=".dbf") returned 4 [0034.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.653] lstrlenW (lpString=".1cd") returned 4 [0034.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.653] lstrlenW (lpString=".jpg") returned 4 [0034.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.653] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.653] lstrlenW (lpString="VisioMUI.xml") returned 12 [0034.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.653] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9503) returned 1 [0034.653] CloseHandle (hObject=0x19c) returned 1 [0034.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0034.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.654] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.654] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.654] GetLastError () returned 0x0 [0034.654] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x251f, lpOverlapped=0x0) returned 1 [0035.439] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0035.440] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.440] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.440] SetEndOfFile (hFile=0x1a0) returned 1 [0035.440] CloseHandle (hObject=0x1a0) returned 1 [0035.441] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.441] SetEndOfFile (hFile=0x19c) returned 1 [0035.442] CloseHandle (hObject=0x19c) returned 1 [0035.442] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.442] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0035.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.443] lstrlenW (lpString=".doc") returned 4 [0035.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".docx") returned 5 [0035.443] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.443] lstrlenW (lpString=".pdf") returned 4 [0035.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".xls") returned 4 [0035.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".xlsx") returned 5 [0035.443] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.443] lstrlenW (lpString=".ppt") returned 4 [0035.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.443] lstrlenW (lpString=".zip") returned 4 [0035.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.443] lstrlenW (lpString=".rar") returned 4 [0035.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".bz2") returned 4 [0035.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".7z") returned 3 [0035.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.443] lstrlenW (lpString=".dbf") returned 4 [0035.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.443] lstrlenW (lpString=".1cd") returned 4 [0035.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString=".jpg") returned 4 [0035.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString=".doc") returned 4 [0035.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".docx") returned 5 [0035.444] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.444] lstrlenW (lpString=".pdf") returned 4 [0035.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".xls") returned 4 [0035.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".xlsx") returned 5 [0035.444] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.444] lstrlenW (lpString=".ppt") returned 4 [0035.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString=".zip") returned 4 [0035.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.444] lstrlenW (lpString=".rar") returned 4 [0035.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".bz2") returned 4 [0035.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".7z") returned 3 [0035.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString=".dbf") returned 4 [0035.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.444] lstrlenW (lpString=".1cd") returned 4 [0035.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0035.445] lstrlenW (lpString=".jpg") returned 4 [0035.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.445] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.445] lstrlenW (lpString="Setup.xml") returned 9 [0035.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0035.457] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1872) returned 1 [0035.457] CloseHandle (hObject=0x170) returned 1 [0035.457] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.457] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0035.457] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.457] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.458] GetLastError () returned 0x0 [0035.458] ReadFile (in: hFile=0x170, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x750, lpOverlapped=0x0) returned 1 [0035.489] WriteFile (in: hFile=0x188, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x760, lpOverlapped=0x0) returned 1 [0035.490] ReadFile (in: hFile=0x170, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.490] WriteFile (in: hFile=0x188, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.490] SetEndOfFile (hFile=0x188) returned 1 [0035.490] CloseHandle (hObject=0x188) returned 1 [0035.491] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.491] SetEndOfFile (hFile=0x170) returned 1 [0035.492] CloseHandle (hObject=0x170) returned 1 [0035.492] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.492] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.492] lstrlenW (lpString=".doc") returned 4 [0035.492] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.492] lstrlenW (lpString=".docx") returned 5 [0035.492] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.492] lstrlenW (lpString=".pdf") returned 4 [0035.492] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.492] lstrlenW (lpString=".xls") returned 4 [0035.492] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.492] lstrlenW (lpString=".xlsx") returned 5 [0035.492] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.492] lstrlenW (lpString=".ppt") returned 4 [0035.492] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".zip") returned 4 [0035.493] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.493] lstrlenW (lpString=".rar") returned 4 [0035.493] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString=".bz2") returned 4 [0035.493] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString=".7z") returned 3 [0035.493] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".dbf") returned 4 [0035.493] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".1cd") returned 4 [0035.493] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".jpg") returned 4 [0035.493] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".doc") returned 4 [0035.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString=".docx") returned 5 [0035.493] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.493] lstrlenW (lpString=".pdf") returned 4 [0035.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString=".xls") returned 4 [0035.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString=".xlsx") returned 5 [0035.493] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.493] lstrlenW (lpString=".ppt") returned 4 [0035.493] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.493] lstrlenW (lpString=".zip") returned 4 [0035.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.494] lstrlenW (lpString=".rar") returned 4 [0035.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.494] lstrlenW (lpString=".bz2") returned 4 [0035.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.494] lstrlenW (lpString=".7z") returned 3 [0035.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.494] lstrlenW (lpString=".dbf") returned 4 [0035.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.494] lstrlenW (lpString=".1cd") returned 4 [0035.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.494] lstrlenW (lpString=".jpg") returned 4 [0035.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.494] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.494] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0035.494] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.800] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5557) returned 1 [0035.800] CloseHandle (hObject=0x1ac) returned 1 [0035.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0035.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.800] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0035.801] GetLastError () returned 0x0 [0035.801] ReadFile (in: hFile=0x1ac, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0035.802] WriteFile (in: hFile=0x1b0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0035.803] ReadFile (in: hFile=0x1ac, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.803] WriteFile (in: hFile=0x1b0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.804] SetEndOfFile (hFile=0x1b0) returned 1 [0035.804] CloseHandle (hObject=0x1b0) returned 1 [0035.804] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.805] SetEndOfFile (hFile=0x1ac) returned 1 [0035.805] CloseHandle (hObject=0x1ac) returned 1 [0035.805] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.806] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0035.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.806] lstrlenW (lpString=".doc") returned 4 [0035.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString=".docx") returned 5 [0035.806] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.806] lstrlenW (lpString=".pdf") returned 4 [0035.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString=".xls") returned 4 [0035.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString=".xlsx") returned 5 [0035.806] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.806] lstrlenW (lpString=".ppt") returned 4 [0035.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.806] lstrlenW (lpString=".zip") returned 4 [0035.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.806] lstrlenW (lpString=".rar") returned 4 [0035.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString=".bz2") returned 4 [0035.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.806] lstrlenW (lpString=".7z") returned 3 [0035.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.806] lstrlenW (lpString=".dbf") returned 4 [0035.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString=".1cd") returned 4 [0035.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString=".jpg") returned 4 [0035.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString=".doc") returned 4 [0035.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString=".docx") returned 5 [0035.807] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.807] lstrlenW (lpString=".pdf") returned 4 [0035.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString=".xls") returned 4 [0035.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString=".xlsx") returned 5 [0035.807] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.807] lstrlenW (lpString=".ppt") returned 4 [0035.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString=".zip") returned 4 [0035.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.807] lstrlenW (lpString=".rar") returned 4 [0035.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString=".bz2") returned 4 [0035.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString=".7z") returned 3 [0035.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.807] lstrlenW (lpString=".dbf") returned 4 [0035.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.808] lstrlenW (lpString=".1cd") returned 4 [0035.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.808] lstrlenW (lpString=".jpg") returned 4 [0035.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.855] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.855] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0035.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.578] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16852) returned 1 [0036.578] CloseHandle (hObject=0x19c) returned 1 [0036.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0036.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.579] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.579] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.579] GetLastError () returned 0x0 [0036.579] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0036.581] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0036.582] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.582] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.582] SetEndOfFile (hFile=0x164) returned 1 [0036.583] CloseHandle (hObject=0x164) returned 1 [0036.583] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.584] SetEndOfFile (hFile=0x19c) returned 1 [0036.584] CloseHandle (hObject=0x19c) returned 1 [0036.584] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.585] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0036.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.585] lstrlenW (lpString=".doc") returned 4 [0036.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.585] lstrlenW (lpString=".docx") returned 5 [0036.585] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.585] lstrlenW (lpString=".pdf") returned 4 [0036.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.585] lstrlenW (lpString=".xls") returned 4 [0036.585] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.585] lstrlenW (lpString=".xlsx") returned 5 [0036.585] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.585] lstrlenW (lpString=".ppt") returned 4 [0036.585] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.585] lstrlenW (lpString=".zip") returned 4 [0036.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.586] lstrlenW (lpString=".rar") returned 4 [0036.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString=".bz2") returned 4 [0036.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString=".7z") returned 3 [0036.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString=".dbf") returned 4 [0036.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString=".1cd") returned 4 [0036.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString=".jpg") returned 4 [0036.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString=".doc") returned 4 [0036.586] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString=".docx") returned 5 [0036.586] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.586] lstrlenW (lpString=".pdf") returned 4 [0036.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString=".xls") returned 4 [0036.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString=".xlsx") returned 5 [0036.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.586] lstrlenW (lpString=".ppt") returned 4 [0036.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.586] lstrlenW (lpString=".zip") returned 4 [0036.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.587] lstrlenW (lpString=".rar") returned 4 [0036.587] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.587] lstrlenW (lpString=".bz2") returned 4 [0036.587] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.587] lstrlenW (lpString=".7z") returned 3 [0036.587] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.587] lstrlenW (lpString=".dbf") returned 4 [0036.587] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.587] lstrlenW (lpString=".1cd") returned 4 [0036.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0036.587] lstrlenW (lpString=".jpg") returned 4 [0036.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.587] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.587] lstrlenW (lpString="Setup.xml") returned 9 [0036.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.587] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20577) returned 1 [0036.588] CloseHandle (hObject=0x19c) returned 1 [0036.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.588] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.588] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.588] GetLastError () returned 0x0 [0036.588] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5061, lpOverlapped=0x0) returned 1 [0036.590] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0036.592] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.592] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.592] SetEndOfFile (hFile=0x164) returned 1 [0036.592] CloseHandle (hObject=0x164) returned 1 [0036.593] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.593] SetEndOfFile (hFile=0x19c) returned 1 [0036.594] CloseHandle (hObject=0x19c) returned 1 [0036.594] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.594] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.594] lstrlenW (lpString=".doc") returned 4 [0036.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString=".docx") returned 5 [0036.595] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.595] lstrlenW (lpString=".pdf") returned 4 [0036.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString=".xls") returned 4 [0036.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString=".xlsx") returned 5 [0036.595] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.595] lstrlenW (lpString=".ppt") returned 4 [0036.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.595] lstrlenW (lpString=".zip") returned 4 [0036.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.595] lstrlenW (lpString=".rar") returned 4 [0036.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString=".bz2") returned 4 [0036.595] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString=".7z") returned 3 [0036.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.595] lstrlenW (lpString=".dbf") returned 4 [0036.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.595] lstrlenW (lpString=".1cd") returned 4 [0036.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.595] lstrlenW (lpString=".jpg") returned 4 [0036.595] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.596] lstrlenW (lpString=".doc") returned 4 [0036.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString=".docx") returned 5 [0036.596] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.596] lstrlenW (lpString=".pdf") returned 4 [0036.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString=".xls") returned 4 [0036.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString=".xlsx") returned 5 [0036.596] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.596] lstrlenW (lpString=".ppt") returned 4 [0036.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.596] lstrlenW (lpString=".zip") returned 4 [0036.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.596] lstrlenW (lpString=".rar") returned 4 [0036.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString=".bz2") returned 4 [0036.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString=".7z") returned 3 [0036.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.596] lstrlenW (lpString=".dbf") returned 4 [0036.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.596] lstrlenW (lpString=".1cd") returned 4 [0036.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.596] lstrlenW (lpString=".jpg") returned 4 [0036.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.597] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.597] lstrlenW (lpString="VisiorWW.xml") returned 12 [0036.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.597] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8723) returned 1 [0036.597] CloseHandle (hObject=0x19c) returned 1 [0036.597] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0036.598] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.598] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.598] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.598] GetLastError () returned 0x0 [0036.598] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2213, lpOverlapped=0x0) returned 1 [0036.600] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0036.601] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.601] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.601] SetEndOfFile (hFile=0x164) returned 1 [0036.601] CloseHandle (hObject=0x164) returned 1 [0036.602] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.602] SetEndOfFile (hFile=0x19c) returned 1 [0036.603] CloseHandle (hObject=0x19c) returned 1 [0036.603] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.603] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0036.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.603] lstrlenW (lpString=".doc") returned 4 [0036.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.603] lstrlenW (lpString=".docx") returned 5 [0036.603] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.603] lstrlenW (lpString=".pdf") returned 4 [0036.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.603] lstrlenW (lpString=".xls") returned 4 [0036.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.603] lstrlenW (lpString=".xlsx") returned 5 [0036.603] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.603] lstrlenW (lpString=".ppt") returned 4 [0036.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.603] lstrlenW (lpString=".zip") returned 4 [0036.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.604] lstrlenW (lpString=".rar") returned 4 [0036.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString=".bz2") returned 4 [0036.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString=".7z") returned 3 [0036.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString=".dbf") returned 4 [0036.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString=".1cd") returned 4 [0036.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString=".jpg") returned 4 [0036.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString=".doc") returned 4 [0036.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString=".docx") returned 5 [0036.604] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.604] lstrlenW (lpString=".pdf") returned 4 [0036.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString=".xls") returned 4 [0036.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString=".xlsx") returned 5 [0036.604] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.604] lstrlenW (lpString=".ppt") returned 4 [0036.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.604] lstrlenW (lpString=".zip") returned 4 [0036.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.605] lstrlenW (lpString=".rar") returned 4 [0036.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.605] lstrlenW (lpString=".bz2") returned 4 [0036.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.605] lstrlenW (lpString=".7z") returned 3 [0036.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.605] lstrlenW (lpString=".dbf") returned 4 [0036.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.605] lstrlenW (lpString=".1cd") returned 4 [0036.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.605] lstrlenW (lpString=".jpg") returned 4 [0036.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.605] lstrcmpiW (lpString1=".EPS", lpString2=".zoh") returned -1 [0036.605] lstrlenW (lpString="MS.EPS") returned 6 [0036.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.606] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15067) returned 1 [0036.607] CloseHandle (hObject=0x19c) returned 1 [0036.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0036.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.607] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.607] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.607] GetLastError () returned 0x0 [0036.607] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0036.609] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0036.610] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.610] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.610] SetEndOfFile (hFile=0x164) returned 1 [0036.610] CloseHandle (hObject=0x164) returned 1 [0036.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.611] SetEndOfFile (hFile=0x19c) returned 1 [0036.612] CloseHandle (hObject=0x19c) returned 1 [0036.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0036.612] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0036.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.612] lstrlenW (lpString=".doc") returned 4 [0036.613] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0036.613] lstrlenW (lpString=".docx") returned 5 [0036.613] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0036.613] lstrlenW (lpString=".pdf") returned 4 [0036.613] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString=".xls") returned 4 [0036.613] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString=".xlsx") returned 5 [0036.613] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0036.613] lstrlenW (lpString=".ppt") returned 4 [0036.613] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.613] lstrlenW (lpString=".zip") returned 4 [0036.613] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString=".rar") returned 4 [0036.613] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString=".bz2") returned 4 [0036.613] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0036.613] lstrlenW (lpString=".7z") returned 3 [0036.613] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.613] lstrlenW (lpString=".dbf") returned 4 [0036.613] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.613] lstrlenW (lpString=".1cd") returned 4 [0036.613] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.613] lstrlenW (lpString=".jpg") returned 4 [0036.613] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.614] lstrlenW (lpString=".doc") returned 4 [0036.614] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0036.614] lstrlenW (lpString=".docx") returned 5 [0036.614] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0036.614] lstrlenW (lpString=".pdf") returned 4 [0036.614] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0036.614] lstrlenW (lpString=".xls") returned 4 [0036.614] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0036.614] lstrlenW (lpString=".xlsx") returned 5 [0036.614] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0036.614] lstrlenW (lpString=".ppt") returned 4 [0036.614] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0036.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.614] lstrlenW (lpString=".zip") returned 4 [0036.614] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0036.614] lstrlenW (lpString=".rar") returned 4 [0036.614] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0036.614] lstrlenW (lpString=".bz2") returned 4 [0036.614] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0036.614] lstrlenW (lpString=".7z") returned 3 [0036.614] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0036.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.614] lstrlenW (lpString=".dbf") returned 4 [0036.614] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0036.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.614] lstrlenW (lpString=".1cd") returned 4 [0036.614] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0036.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0036.614] lstrlenW (lpString=".jpg") returned 4 [0036.614] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0036.615] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0036.615] lstrlenW (lpString="MS.GIF") returned 6 [0036.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.615] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1069) returned 1 [0036.615] CloseHandle (hObject=0x19c) returned 1 [0036.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0036.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0036.615] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.615] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.615] GetLastError () returned 0x0 [0036.615] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x42d, lpOverlapped=0x0) returned 1 [0036.966] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x430, lpOverlapped=0x0) returned 1 [0036.966] ReadFile (in: hFile=0x19c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.967] WriteFile (in: hFile=0x164, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.967] SetEndOfFile (hFile=0x164) returned 1 [0036.967] CloseHandle (hObject=0x164) returned 1 [0036.967] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.968] SetEndOfFile (hFile=0x19c) returned 1 [0036.968] CloseHandle (hObject=0x19c) returned 1 [0036.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0036.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0036.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.969] lstrlenW (lpString=".doc") returned 4 [0036.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0036.969] lstrlenW (lpString=".docx") returned 5 [0036.969] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0036.969] lstrlenW (lpString=".pdf") returned 4 [0036.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0036.969] lstrlenW (lpString=".xls") returned 4 [0036.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0036.969] lstrlenW (lpString=".xlsx") returned 5 [0036.969] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0036.969] lstrlenW (lpString=".ppt") returned 4 [0036.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0036.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.969] lstrlenW (lpString=".zip") returned 4 [0036.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0036.969] lstrlenW (lpString=".rar") returned 4 [0036.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0036.969] lstrlenW (lpString=".bz2") returned 4 [0036.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0036.969] lstrlenW (lpString=".7z") returned 3 [0036.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0036.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.969] lstrlenW (lpString=".dbf") returned 4 [0036.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString=".1cd") returned 4 [0036.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString=".jpg") returned 4 [0036.970] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString=".doc") returned 4 [0036.970] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0036.970] lstrlenW (lpString=".docx") returned 5 [0036.970] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0036.970] lstrlenW (lpString=".pdf") returned 4 [0036.970] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString=".xls") returned 4 [0036.970] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString=".xlsx") returned 5 [0036.970] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0036.970] lstrlenW (lpString=".ppt") returned 4 [0036.970] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString=".zip") returned 4 [0036.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString=".rar") returned 4 [0036.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0036.970] lstrlenW (lpString=".bz2") returned 4 [0036.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0036.970] lstrlenW (lpString=".7z") returned 3 [0036.970] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.970] lstrlenW (lpString=".dbf") returned 4 [0036.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0036.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.971] lstrlenW (lpString=".1cd") returned 4 [0036.971] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0036.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0036.971] lstrlenW (lpString=".jpg") returned 4 [0036.971] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0036.971] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0036.971] lstrlenW (lpString="boxed-split.avi") returned 15 [0036.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.175] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=62976) returned 1 [0037.175] CloseHandle (hObject=0x1b0) returned 1 [0037.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0037.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString=".doc") returned 4 [0037.176] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".docx") returned 5 [0037.176] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.176] lstrlenW (lpString=".pdf") returned 4 [0037.176] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".xls") returned 4 [0037.176] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".xlsx") returned 5 [0037.176] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.176] lstrlenW (lpString=".ppt") returned 4 [0037.176] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString=".zip") returned 4 [0037.176] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".rar") returned 4 [0037.176] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".bz2") returned 4 [0037.176] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString=".7z") returned 3 [0037.176] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString=".dbf") returned 4 [0037.176] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString=".1cd") returned 4 [0037.176] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString=".jpg") returned 4 [0037.176] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.177] lstrlenW (lpString=".doc") returned 4 [0037.177] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".docx") returned 5 [0037.177] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.177] lstrlenW (lpString=".pdf") returned 4 [0037.177] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".xls") returned 4 [0037.177] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".xlsx") returned 5 [0037.177] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.177] lstrlenW (lpString=".ppt") returned 4 [0037.177] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.177] lstrlenW (lpString=".zip") returned 4 [0037.177] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".rar") returned 4 [0037.177] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".bz2") returned 4 [0037.177] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString=".7z") returned 3 [0037.177] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.177] lstrlenW (lpString=".dbf") returned 4 [0037.177] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.177] lstrlenW (lpString=".1cd") returned 4 [0037.177] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.177] lstrlenW (lpString=".jpg") returned 4 [0037.177] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.177] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.178] lstrlenW (lpString="oskmenu.xml") returned 11 [0037.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.178] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=215) returned 1 [0037.178] CloseHandle (hObject=0x1b0) returned 1 [0037.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0037.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.178] lstrlenW (lpString=".doc") returned 4 [0037.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.178] lstrlenW (lpString=".docx") returned 5 [0037.178] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0037.178] lstrlenW (lpString=".pdf") returned 4 [0037.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.178] lstrlenW (lpString=".xls") returned 4 [0037.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.178] lstrlenW (lpString=".xlsx") returned 5 [0037.178] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0037.178] lstrlenW (lpString=".ppt") returned 4 [0037.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.178] lstrlenW (lpString=".zip") returned 4 [0037.179] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.179] lstrlenW (lpString=".rar") returned 4 [0037.179] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString=".bz2") returned 4 [0037.179] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString=".7z") returned 3 [0037.179] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString=".dbf") returned 4 [0037.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString=".1cd") returned 4 [0037.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString=".jpg") returned 4 [0037.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString=".doc") returned 4 [0037.179] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString=".docx") returned 5 [0037.179] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0037.179] lstrlenW (lpString=".pdf") returned 4 [0037.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString=".xls") returned 4 [0037.179] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString=".xlsx") returned 5 [0037.179] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0037.179] lstrlenW (lpString=".ppt") returned 4 [0037.179] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.179] lstrlenW (lpString=".zip") returned 4 [0037.179] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.179] lstrlenW (lpString=".rar") returned 4 [0037.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.180] lstrlenW (lpString=".bz2") returned 4 [0037.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.180] lstrlenW (lpString=".7z") returned 3 [0037.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.180] lstrlenW (lpString=".dbf") returned 4 [0037.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.180] lstrlenW (lpString=".1cd") returned 4 [0037.180] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0037.180] lstrlenW (lpString=".jpg") returned 4 [0037.180] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.180] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.180] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0037.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.186] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1437) returned 1 [0037.186] CloseHandle (hObject=0x174) returned 1 [0037.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0037.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString=".doc") returned 4 [0037.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString=".docx") returned 5 [0037.187] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0037.187] lstrlenW (lpString=".pdf") returned 4 [0037.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString=".xls") returned 4 [0037.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString=".xlsx") returned 5 [0037.187] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0037.187] lstrlenW (lpString=".ppt") returned 4 [0037.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString=".zip") returned 4 [0037.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.187] lstrlenW (lpString=".rar") returned 4 [0037.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString=".bz2") returned 4 [0037.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString=".7z") returned 3 [0037.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString=".dbf") returned 4 [0037.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString=".1cd") returned 4 [0037.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.187] lstrlenW (lpString=".jpg") returned 4 [0037.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString=".doc") returned 4 [0037.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString=".docx") returned 5 [0037.188] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0037.188] lstrlenW (lpString=".pdf") returned 4 [0037.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString=".xls") returned 4 [0037.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString=".xlsx") returned 5 [0037.188] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0037.188] lstrlenW (lpString=".ppt") returned 4 [0037.188] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString=".zip") returned 4 [0037.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.188] lstrlenW (lpString=".rar") returned 4 [0037.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString=".bz2") returned 4 [0037.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString=".7z") returned 3 [0037.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString=".dbf") returned 4 [0037.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString=".1cd") returned 4 [0037.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0037.188] lstrlenW (lpString=".jpg") returned 4 [0037.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.189] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.189] lstrlenW (lpString="osknumpad.xml") returned 13 [0037.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.200] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=219) returned 1 [0037.200] CloseHandle (hObject=0x174) returned 1 [0037.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0037.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.201] lstrlenW (lpString=".doc") returned 4 [0037.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".docx") returned 5 [0037.201] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0037.201] lstrlenW (lpString=".pdf") returned 4 [0037.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".xls") returned 4 [0037.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".xlsx") returned 5 [0037.201] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0037.201] lstrlenW (lpString=".ppt") returned 4 [0037.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".zip") returned 4 [0037.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.202] lstrlenW (lpString=".rar") returned 4 [0037.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString=".bz2") returned 4 [0037.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString=".7z") returned 3 [0037.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".dbf") returned 4 [0037.202] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".1cd") returned 4 [0037.202] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".jpg") returned 4 [0037.202] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".doc") returned 4 [0037.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString=".docx") returned 5 [0037.202] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0037.202] lstrlenW (lpString=".pdf") returned 4 [0037.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString=".xls") returned 4 [0037.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString=".xlsx") returned 5 [0037.202] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0037.202] lstrlenW (lpString=".ppt") returned 4 [0037.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.202] lstrlenW (lpString=".zip") returned 4 [0037.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.203] lstrlenW (lpString=".rar") returned 4 [0037.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.203] lstrlenW (lpString=".bz2") returned 4 [0037.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.203] lstrlenW (lpString=".7z") returned 3 [0037.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.203] lstrlenW (lpString=".dbf") returned 4 [0037.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.203] lstrlenW (lpString=".1cd") returned 4 [0037.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0037.203] lstrlenW (lpString=".jpg") returned 4 [0037.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.203] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.203] lstrlenW (lpString="oskpredbase.xml") returned 15 [0037.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.204] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=924) returned 1 [0037.204] CloseHandle (hObject=0x174) returned 1 [0037.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0037.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.204] lstrlenW (lpString=".doc") returned 4 [0037.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.204] lstrlenW (lpString=".docx") returned 5 [0037.204] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0037.205] lstrlenW (lpString=".pdf") returned 4 [0037.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString=".xls") returned 4 [0037.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString=".xlsx") returned 5 [0037.205] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0037.205] lstrlenW (lpString=".ppt") returned 4 [0037.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString=".zip") returned 4 [0037.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.205] lstrlenW (lpString=".rar") returned 4 [0037.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString=".bz2") returned 4 [0037.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString=".7z") returned 3 [0037.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString=".dbf") returned 4 [0037.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString=".1cd") returned 4 [0037.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString=".jpg") returned 4 [0037.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.205] lstrlenW (lpString=".doc") returned 4 [0037.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.205] lstrlenW (lpString=".docx") returned 5 [0037.205] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0037.205] lstrlenW (lpString=".pdf") returned 4 [0037.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString=".xls") returned 4 [0037.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString=".xlsx") returned 5 [0037.206] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0037.206] lstrlenW (lpString=".ppt") returned 4 [0037.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.206] lstrlenW (lpString=".zip") returned 4 [0037.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.206] lstrlenW (lpString=".rar") returned 4 [0037.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString=".bz2") returned 4 [0037.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString=".7z") returned 3 [0037.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.206] lstrlenW (lpString=".dbf") returned 4 [0037.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.206] lstrlenW (lpString=".1cd") returned 4 [0037.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0037.206] lstrlenW (lpString=".jpg") returned 4 [0037.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.206] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.206] lstrlenW (lpString="oskpred.xml") returned 11 [0037.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0037.207] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=215) returned 1 [0037.207] CloseHandle (hObject=0x174) returned 1 [0037.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0037.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0037.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0037.207] lstrlenW (lpString=".doc") returned 4 [0037.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.207] lstrlenW (lpString=".docx") returned 5 [0037.207] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0037.207] lstrlenW (lpString=".pdf") returned 4 [0037.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.207] lstrlenW (lpString=".xls") returned 4 [0037.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.207] lstrlenW (lpString=".xlsx") returned 5 [0037.207] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0037.207] lstrlenW (lpString=".ppt") returned 4 [0037.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0037.207] lstrlenW (lpString=".zip") returned 4 [0037.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.207] lstrlenW (lpString=".rar") returned 4 [0037.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.208] lstrlenW (lpString=".bz2") returned 4 [0037.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.208] lstrlenW (lpString=".7z") returned 3 [0037.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0037.208] lstrlenW (lpString=".dbf") returned 4 [0037.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.208] NtCreateFile (FileHandle=0x236febc, DesiredAccess=0x80100080, ObjectAttributes=0x236fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x236fe88), IoStatusBlock=0x236fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.208] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=749) returned 1 [0037.208] CloseHandle (hObject=0x174) returned 1 [0037.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0037.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.208] NtCreateFile (FileHandle=0x236febc, DesiredAccess=0x80100080, ObjectAttributes=0x236fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x236fe88), IoStatusBlock=0x236fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0038.097] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=749) returned 1 [0038.098] CloseHandle (hObject=0x16c) returned 1 [0038.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0038.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.098] NtCreateFile (FileHandle=0x236febc, DesiredAccess=0x80100080, ObjectAttributes=0x236fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x236fe88), IoStatusBlock=0x236fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0038.118] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=207) returned 1 [0038.118] CloseHandle (hObject=0x16c) returned 1 [0038.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0038.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.119] NtCreateFile (FileHandle=0x236febc, DesiredAccess=0x80100080, ObjectAttributes=0x236fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x236fe88), IoStatusBlock=0x236fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.637] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=815680) returned 1 [0039.637] CloseHandle (hObject=0x1c8) returned 1 [0039.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0039.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.637] NtCreateFile (FileHandle=0x236febc, DesiredAccess=0x80100080, ObjectAttributes=0x236fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x236fe88), IoStatusBlock=0x236fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.638] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1349) returned 1 [0039.638] CloseHandle (hObject=0x1c8) returned 1 [0039.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0039.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.638] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.638] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.639] GetLastError () returned 0x0 [0039.639] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x545, lpOverlapped=0x0) returned 1 [0039.643] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0039.644] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.644] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.644] SetEndOfFile (hFile=0x1cc) returned 1 [0039.644] CloseHandle (hObject=0x1cc) returned 1 [0039.645] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.645] SetEndOfFile (hFile=0x1c8) returned 1 [0039.646] CloseHandle (hObject=0x1c8) returned 1 [0039.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0039.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.646] lstrlenW (lpString=".doc") returned 4 [0039.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.646] lstrlenW (lpString=".docx") returned 5 [0039.646] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.646] lstrlenW (lpString=".pdf") returned 4 [0039.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.646] lstrlenW (lpString=".xls") returned 4 [0039.646] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.646] lstrlenW (lpString=".xlsx") returned 5 [0039.646] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.646] lstrlenW (lpString=".ppt") returned 4 [0039.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString=".zip") returned 4 [0039.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.647] lstrlenW (lpString=".rar") returned 4 [0039.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".bz2") returned 4 [0039.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".7z") returned 3 [0039.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString=".dbf") returned 4 [0039.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString=".1cd") returned 4 [0039.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString=".jpg") returned 4 [0039.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.647] lstrlenW (lpString=".doc") returned 4 [0039.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".docx") returned 5 [0039.647] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.647] lstrlenW (lpString=".pdf") returned 4 [0039.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".xls") returned 4 [0039.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".xlsx") returned 5 [0039.647] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.647] lstrlenW (lpString=".ppt") returned 4 [0039.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.648] lstrlenW (lpString=".zip") returned 4 [0039.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.648] lstrlenW (lpString=".rar") returned 4 [0039.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".bz2") returned 4 [0039.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".7z") returned 3 [0039.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.648] lstrlenW (lpString=".dbf") returned 4 [0039.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.648] lstrlenW (lpString=".1cd") returned 4 [0039.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0039.648] lstrlenW (lpString=".jpg") returned 4 [0039.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.648] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.648] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0039.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.649] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=819) returned 1 [0039.649] CloseHandle (hObject=0x1c8) returned 1 [0039.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0039.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.649] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.650] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.650] GetLastError () returned 0x0 [0039.650] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x333, lpOverlapped=0x0) returned 1 [0039.655] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x340, lpOverlapped=0x0) returned 1 [0039.656] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.656] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0039.656] SetEndOfFile (hFile=0x1cc) returned 1 [0039.656] CloseHandle (hObject=0x1cc) returned 1 [0039.657] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.657] SetEndOfFile (hFile=0x1c8) returned 1 [0039.658] CloseHandle (hObject=0x1c8) returned 1 [0039.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.658] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0039.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.658] lstrlenW (lpString=".doc") returned 4 [0039.658] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.658] lstrlenW (lpString=".docx") returned 5 [0039.658] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.658] lstrlenW (lpString=".pdf") returned 4 [0039.658] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString=".xls") returned 4 [0039.659] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString=".xlsx") returned 5 [0039.659] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.659] lstrlenW (lpString=".ppt") returned 4 [0039.659] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.659] lstrlenW (lpString=".zip") returned 4 [0039.659] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.659] lstrlenW (lpString=".rar") returned 4 [0039.659] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString=".bz2") returned 4 [0039.659] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString=".7z") returned 3 [0039.659] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.659] lstrlenW (lpString=".dbf") returned 4 [0039.659] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.659] lstrlenW (lpString=".1cd") returned 4 [0039.659] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.659] lstrlenW (lpString=".jpg") returned 4 [0039.659] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.660] lstrlenW (lpString=".doc") returned 4 [0039.660] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString=".docx") returned 5 [0039.660] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.660] lstrlenW (lpString=".pdf") returned 4 [0039.660] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString=".xls") returned 4 [0039.660] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString=".xlsx") returned 5 [0039.660] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.660] lstrlenW (lpString=".ppt") returned 4 [0039.660] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.660] lstrlenW (lpString=".zip") returned 4 [0039.660] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.660] lstrlenW (lpString=".rar") returned 4 [0039.660] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString=".bz2") returned 4 [0039.660] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString=".7z") returned 3 [0039.660] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.660] lstrlenW (lpString=".dbf") returned 4 [0039.660] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.660] lstrlenW (lpString=".1cd") returned 4 [0039.660] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.661] lstrlenW (lpString=".jpg") returned 4 [0039.661] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.661] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.661] lstrlenW (lpString="SETUP.XML") returned 9 [0039.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.662] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2624) returned 1 [0039.662] CloseHandle (hObject=0x1c8) returned 1 [0039.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0039.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.662] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.662] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.663] GetLastError () returned 0x0 [0039.663] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa40, lpOverlapped=0x0) returned 1 [0039.664] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0039.666] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.666] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.666] SetEndOfFile (hFile=0x1cc) returned 1 [0039.666] CloseHandle (hObject=0x1cc) returned 1 [0039.667] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.667] SetEndOfFile (hFile=0x1c8) returned 1 [0039.668] CloseHandle (hObject=0x1c8) returned 1 [0039.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.668] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0039.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.668] lstrlenW (lpString=".doc") returned 4 [0039.668] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.668] lstrlenW (lpString=".docx") returned 5 [0039.668] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.669] lstrlenW (lpString=".pdf") returned 4 [0039.669] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString=".xls") returned 4 [0039.669] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString=".xlsx") returned 5 [0039.669] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.669] lstrlenW (lpString=".ppt") returned 4 [0039.669] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.669] lstrlenW (lpString=".zip") returned 4 [0039.669] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.669] lstrlenW (lpString=".rar") returned 4 [0039.669] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString=".bz2") returned 4 [0039.669] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString=".7z") returned 3 [0039.669] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.669] lstrlenW (lpString=".dbf") returned 4 [0039.669] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.669] lstrlenW (lpString=".1cd") returned 4 [0039.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.669] lstrlenW (lpString=".jpg") returned 4 [0039.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.670] lstrlenW (lpString=".doc") returned 4 [0039.670] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString=".docx") returned 5 [0039.670] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.670] lstrlenW (lpString=".pdf") returned 4 [0039.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString=".xls") returned 4 [0039.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString=".xlsx") returned 5 [0039.670] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.670] lstrlenW (lpString=".ppt") returned 4 [0039.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.670] lstrlenW (lpString=".zip") returned 4 [0039.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.670] lstrlenW (lpString=".rar") returned 4 [0039.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString=".bz2") returned 4 [0039.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString=".7z") returned 3 [0039.670] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.670] lstrlenW (lpString=".dbf") returned 4 [0039.670] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.671] lstrlenW (lpString=".1cd") returned 4 [0039.671] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0039.671] lstrlenW (lpString=".jpg") returned 4 [0039.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.671] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.671] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0039.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.671] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1565) returned 1 [0039.671] CloseHandle (hObject=0x1c8) returned 1 [0039.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0039.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.672] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.672] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.672] GetLastError () returned 0x0 [0039.672] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x61d, lpOverlapped=0x0) returned 1 [0039.707] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x620, lpOverlapped=0x0) returned 1 [0039.708] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.708] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.709] SetEndOfFile (hFile=0x1cc) returned 1 [0039.709] CloseHandle (hObject=0x1cc) returned 1 [0039.710] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.710] SetEndOfFile (hFile=0x1c8) returned 1 [0039.711] CloseHandle (hObject=0x1c8) returned 1 [0039.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.711] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0039.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.711] lstrlenW (lpString=".doc") returned 4 [0039.711] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.711] lstrlenW (lpString=".docx") returned 5 [0039.712] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.712] lstrlenW (lpString=".pdf") returned 4 [0039.712] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString=".xls") returned 4 [0039.712] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString=".xlsx") returned 5 [0039.712] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.712] lstrlenW (lpString=".ppt") returned 4 [0039.712] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.712] lstrlenW (lpString=".zip") returned 4 [0039.712] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.712] lstrlenW (lpString=".rar") returned 4 [0039.712] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString=".bz2") returned 4 [0039.712] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString=".7z") returned 3 [0039.712] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.712] lstrlenW (lpString=".dbf") returned 4 [0039.712] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.712] lstrlenW (lpString=".1cd") returned 4 [0039.712] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.712] lstrlenW (lpString=".jpg") returned 4 [0039.712] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.713] lstrlenW (lpString=".doc") returned 4 [0039.713] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.713] lstrlenW (lpString=".docx") returned 5 [0039.713] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.713] lstrlenW (lpString=".pdf") returned 4 [0039.713] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.713] lstrlenW (lpString=".xls") returned 4 [0039.713] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.713] lstrlenW (lpString=".xlsx") returned 5 [0039.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.713] lstrlenW (lpString=".ppt") returned 4 [0039.713] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.713] lstrlenW (lpString=".zip") returned 4 [0039.713] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.713] lstrlenW (lpString=".rar") returned 4 [0039.713] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.714] lstrlenW (lpString=".bz2") returned 4 [0039.714] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.714] lstrlenW (lpString=".7z") returned 3 [0039.714] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.714] lstrlenW (lpString=".dbf") returned 4 [0039.714] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.714] lstrlenW (lpString=".1cd") returned 4 [0039.714] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0039.714] lstrlenW (lpString=".jpg") returned 4 [0039.714] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.714] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.714] lstrlenW (lpString="SETUP.XML") returned 9 [0039.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.715] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2296) returned 1 [0039.715] CloseHandle (hObject=0x1c8) returned 1 [0039.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0039.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.716] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.716] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.721] GetLastError () returned 0x0 [0039.721] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0039.723] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x900, lpOverlapped=0x0) returned 1 [0039.724] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.724] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.724] SetEndOfFile (hFile=0x1cc) returned 1 [0039.724] CloseHandle (hObject=0x1cc) returned 1 [0039.725] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.725] SetEndOfFile (hFile=0x1c8) returned 1 [0039.726] CloseHandle (hObject=0x1c8) returned 1 [0039.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0039.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.727] lstrlenW (lpString=".doc") returned 4 [0039.727] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString=".docx") returned 5 [0039.727] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.727] lstrlenW (lpString=".pdf") returned 4 [0039.727] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString=".xls") returned 4 [0039.727] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString=".xlsx") returned 5 [0039.727] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.727] lstrlenW (lpString=".ppt") returned 4 [0039.727] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.727] lstrlenW (lpString=".zip") returned 4 [0039.727] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.727] lstrlenW (lpString=".rar") returned 4 [0039.727] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString=".bz2") returned 4 [0039.727] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString=".7z") returned 3 [0039.727] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.727] lstrlenW (lpString=".dbf") returned 4 [0039.727] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.727] lstrlenW (lpString=".1cd") returned 4 [0039.728] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.728] lstrlenW (lpString=".jpg") returned 4 [0039.728] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.728] lstrlenW (lpString=".doc") returned 4 [0039.728] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString=".docx") returned 5 [0039.728] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.728] lstrlenW (lpString=".pdf") returned 4 [0039.728] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString=".xls") returned 4 [0039.728] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString=".xlsx") returned 5 [0039.728] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.728] lstrlenW (lpString=".ppt") returned 4 [0039.728] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.775] lstrlenW (lpString=".zip") returned 4 [0039.776] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.776] lstrlenW (lpString=".rar") returned 4 [0039.776] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.776] lstrlenW (lpString=".bz2") returned 4 [0039.776] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.776] lstrlenW (lpString=".7z") returned 3 [0039.776] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.776] lstrlenW (lpString=".dbf") returned 4 [0039.776] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.776] lstrlenW (lpString=".1cd") returned 4 [0039.776] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0039.776] lstrlenW (lpString=".jpg") returned 4 [0039.776] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.776] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.776] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0039.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.777] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=913) returned 1 [0039.777] CloseHandle (hObject=0x1c8) returned 1 [0039.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0039.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.777] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.777] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.779] GetLastError () returned 0x0 [0039.779] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x391, lpOverlapped=0x0) returned 1 [0039.781] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0039.782] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.782] WriteFile (in: hFile=0x1cc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.782] SetEndOfFile (hFile=0x1cc) returned 1 [0039.783] CloseHandle (hObject=0x1cc) returned 1 [0039.783] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.783] SetEndOfFile (hFile=0x1c8) returned 1 [0039.784] CloseHandle (hObject=0x1c8) returned 1 [0039.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0039.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.785] lstrlenW (lpString=".doc") returned 4 [0039.785] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".docx") returned 5 [0039.785] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.785] lstrlenW (lpString=".pdf") returned 4 [0039.785] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".xls") returned 4 [0039.785] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString=".xlsx") returned 5 [0039.785] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.785] lstrlenW (lpString=".ppt") returned 4 [0039.785] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.785] lstrlenW (lpString=".zip") returned 4 [0039.785] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.785] lstrlenW (lpString=".rar") returned 4 [0039.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".bz2") returned 4 [0039.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".7z") returned 3 [0039.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.786] lstrlenW (lpString=".dbf") returned 4 [0039.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.786] lstrlenW (lpString=".1cd") returned 4 [0039.786] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.786] lstrlenW (lpString=".jpg") returned 4 [0039.786] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.786] lstrlenW (lpString=".doc") returned 4 [0039.786] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".docx") returned 5 [0039.786] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.786] lstrlenW (lpString=".pdf") returned 4 [0039.786] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".xls") returned 4 [0039.786] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.786] lstrlenW (lpString=".xlsx") returned 5 [0039.786] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.787] lstrlenW (lpString=".ppt") returned 4 [0039.787] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.787] lstrlenW (lpString=".zip") returned 4 [0039.787] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.787] lstrlenW (lpString=".rar") returned 4 [0039.787] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString=".bz2") returned 4 [0039.787] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString=".7z") returned 3 [0039.787] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.787] lstrlenW (lpString=".dbf") returned 4 [0039.787] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.787] lstrlenW (lpString=".1cd") returned 4 [0039.787] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0039.787] lstrlenW (lpString=".jpg") returned 4 [0039.787] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.787] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.787] lstrlenW (lpString="SETUP.XML") returned 9 [0039.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0040.081] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1452) returned 1 [0040.081] CloseHandle (hObject=0x1cc) returned 1 [0040.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0040.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0040.082] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.082] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.083] GetLastError () returned 0x0 [0040.083] ReadFile (in: hFile=0x1cc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0040.084] WriteFile (in: hFile=0x1d0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.085] ReadFile (in: hFile=0x1cc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.085] WriteFile (in: hFile=0x1d0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.085] SetEndOfFile (hFile=0x1d0) returned 1 [0040.085] CloseHandle (hObject=0x1d0) returned 1 [0040.087] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.087] SetEndOfFile (hFile=0x1cc) returned 1 [0040.087] CloseHandle (hObject=0x1cc) returned 1 [0040.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0040.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.088] lstrlenW (lpString=".doc") returned 4 [0040.088] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.088] lstrlenW (lpString=".docx") returned 5 [0040.088] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.088] lstrlenW (lpString=".pdf") returned 4 [0040.088] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.088] lstrlenW (lpString=".xls") returned 4 [0040.088] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.088] lstrlenW (lpString=".xlsx") returned 5 [0040.088] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.088] lstrlenW (lpString=".ppt") returned 4 [0040.088] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.088] lstrlenW (lpString=".zip") returned 4 [0040.088] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.089] lstrlenW (lpString=".rar") returned 4 [0040.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString=".bz2") returned 4 [0040.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString=".7z") returned 3 [0040.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString=".dbf") returned 4 [0040.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString=".1cd") returned 4 [0040.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString=".jpg") returned 4 [0040.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString=".doc") returned 4 [0040.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString=".docx") returned 5 [0040.089] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.089] lstrlenW (lpString=".pdf") returned 4 [0040.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString=".xls") returned 4 [0040.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString=".xlsx") returned 5 [0040.089] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.089] lstrlenW (lpString=".ppt") returned 4 [0040.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.089] lstrlenW (lpString=".zip") returned 4 [0040.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.090] lstrlenW (lpString=".rar") returned 4 [0040.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.090] lstrlenW (lpString=".bz2") returned 4 [0040.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.090] lstrlenW (lpString=".7z") returned 3 [0040.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.090] lstrlenW (lpString=".dbf") returned 4 [0040.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.090] lstrlenW (lpString=".1cd") returned 4 [0040.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.090] lstrlenW (lpString=".jpg") returned 4 [0040.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.090] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.090] lstrlenW (lpString="BRANDING.XML") returned 12 [0040.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0040.092] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=596341) returned 1 [0040.092] CloseHandle (hObject=0x1cc) returned 1 [0040.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0040.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0040.092] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.092] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.092] GetLastError () returned 0x0 [0040.092] ReadFile (in: hFile=0x1cc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x91975, lpOverlapped=0x0) returned 1 [0040.105] WriteFile (in: hFile=0x1d0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0040.115] ReadFile (in: hFile=0x1cc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.115] WriteFile (in: hFile=0x1d0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.115] SetEndOfFile (hFile=0x1d0) returned 1 [0040.115] CloseHandle (hObject=0x1d0) returned 1 [0040.308] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.308] SetEndOfFile (hFile=0x1cc) returned 1 [0040.313] CloseHandle (hObject=0x1cc) returned 1 [0040.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0040.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.314] lstrlenW (lpString=".doc") returned 4 [0040.314] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString=".docx") returned 5 [0040.314] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0040.314] lstrlenW (lpString=".pdf") returned 4 [0040.314] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString=".xls") returned 4 [0040.314] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString=".xlsx") returned 5 [0040.314] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0040.314] lstrlenW (lpString=".ppt") returned 4 [0040.314] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.314] lstrlenW (lpString=".zip") returned 4 [0040.314] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.314] lstrlenW (lpString=".rar") returned 4 [0040.314] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString=".bz2") returned 4 [0040.314] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString=".7z") returned 3 [0040.314] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.314] lstrlenW (lpString=".dbf") returned 4 [0040.314] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString=".1cd") returned 4 [0040.315] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString=".jpg") returned 4 [0040.315] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString=".doc") returned 4 [0040.315] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString=".docx") returned 5 [0040.315] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0040.315] lstrlenW (lpString=".pdf") returned 4 [0040.315] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString=".xls") returned 4 [0040.315] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString=".xlsx") returned 5 [0040.315] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0040.315] lstrlenW (lpString=".ppt") returned 4 [0040.315] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString=".zip") returned 4 [0040.315] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.315] lstrlenW (lpString=".rar") returned 4 [0040.315] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString=".bz2") returned 4 [0040.315] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString=".7z") returned 3 [0040.315] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.315] lstrlenW (lpString=".dbf") returned 4 [0040.315] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.316] lstrlenW (lpString=".1cd") returned 4 [0040.316] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0040.316] lstrlenW (lpString=".jpg") returned 4 [0040.316] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.316] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0040.316] lstrlenW (lpString="OCT.CHM") returned 7 [0040.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0040.580] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=71236) returned 1 [0040.588] CloseHandle (hObject=0x1f8) returned 1 [0040.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0040.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0040.596] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.602] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.602] GetLastError () returned 0x0 [0040.602] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x11644, lpOverlapped=0x0) returned 1 [0040.740] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0040.742] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.742] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0040.742] SetEndOfFile (hFile=0x1f4) returned 1 [0040.742] CloseHandle (hObject=0x1f4) returned 1 [0040.743] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.743] SetEndOfFile (hFile=0x1f8) returned 1 [0040.744] CloseHandle (hObject=0x1f8) returned 1 [0040.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.745] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0040.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.780] lstrlenW (lpString=".doc") returned 4 [0040.780] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString=".docx") returned 5 [0040.780] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0040.780] lstrlenW (lpString=".pdf") returned 4 [0040.780] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString=".xls") returned 4 [0040.780] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString=".xlsx") returned 5 [0040.780] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0040.780] lstrlenW (lpString=".ppt") returned 4 [0040.780] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.780] lstrlenW (lpString=".zip") returned 4 [0040.780] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString=".rar") returned 4 [0040.780] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.780] lstrlenW (lpString=".bz2") returned 4 [0040.781] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.781] lstrlenW (lpString=".7z") returned 3 [0040.781] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString=".dbf") returned 4 [0040.781] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString=".1cd") returned 4 [0040.781] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString=".jpg") returned 4 [0040.781] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString=".doc") returned 4 [0040.781] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString=".docx") returned 5 [0040.781] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0040.781] lstrlenW (lpString=".pdf") returned 4 [0040.781] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString=".xls") returned 4 [0040.781] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString=".xlsx") returned 5 [0040.781] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0040.781] lstrlenW (lpString=".ppt") returned 4 [0040.781] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.781] lstrlenW (lpString=".zip") returned 4 [0040.781] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString=".rar") returned 4 [0040.781] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.781] lstrlenW (lpString=".bz2") returned 4 [0040.781] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.782] lstrlenW (lpString=".7z") returned 3 [0040.782] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.782] lstrlenW (lpString=".dbf") returned 4 [0040.782] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.782] lstrlenW (lpString=".1cd") returned 4 [0040.782] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0040.782] lstrlenW (lpString=".jpg") returned 4 [0040.782] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.782] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.782] lstrlenW (lpString="Office32MUI.XML") returned 15 [0040.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0040.785] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1383) returned 1 [0040.785] CloseHandle (hObject=0x1ec) returned 1 [0040.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0040.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0040.785] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.785] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.789] GetLastError () returned 0x0 [0040.789] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x567, lpOverlapped=0x0) returned 1 [0041.040] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x570, lpOverlapped=0x0) returned 1 [0041.379] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.379] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0041.380] SetEndOfFile (hFile=0x1fc) returned 1 [0041.380] CloseHandle (hObject=0x1fc) returned 1 [0041.381] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.381] SetEndOfFile (hFile=0x1ec) returned 1 [0041.381] CloseHandle (hObject=0x1ec) returned 1 [0041.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0041.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.383] lstrlenW (lpString=".doc") returned 4 [0041.383] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString=".docx") returned 5 [0041.383] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.383] lstrlenW (lpString=".pdf") returned 4 [0041.383] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString=".xls") returned 4 [0041.383] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString=".xlsx") returned 5 [0041.383] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.383] lstrlenW (lpString=".ppt") returned 4 [0041.383] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.383] lstrlenW (lpString=".zip") returned 4 [0041.383] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.383] lstrlenW (lpString=".rar") returned 4 [0041.383] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString=".bz2") returned 4 [0041.383] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.383] lstrlenW (lpString=".7z") returned 3 [0041.383] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString=".dbf") returned 4 [0041.384] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString=".1cd") returned 4 [0041.384] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString=".jpg") returned 4 [0041.384] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString=".doc") returned 4 [0041.384] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString=".docx") returned 5 [0041.384] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.384] lstrlenW (lpString=".pdf") returned 4 [0041.384] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString=".xls") returned 4 [0041.384] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString=".xlsx") returned 5 [0041.384] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.384] lstrlenW (lpString=".ppt") returned 4 [0041.384] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.384] lstrlenW (lpString=".zip") returned 4 [0041.384] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.384] lstrlenW (lpString=".rar") returned 4 [0041.384] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString=".bz2") returned 4 [0041.384] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.384] lstrlenW (lpString=".7z") returned 3 [0041.384] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.385] lstrlenW (lpString=".dbf") returned 4 [0041.385] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.385] lstrlenW (lpString=".1cd") returned 4 [0041.385] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0041.385] lstrlenW (lpString=".jpg") returned 4 [0041.385] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.385] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.385] lstrlenW (lpString="SETUP.XML") returned 9 [0041.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0041.911] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1886) returned 1 [0041.917] CloseHandle (hObject=0x1bc) returned 1 [0041.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0041.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0041.927] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.927] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.927] GetLastError () returned 0x0 [0041.929] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x75e, lpOverlapped=0x0) returned 1 [0042.037] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x760, lpOverlapped=0x0) returned 1 [0042.038] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.038] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.039] SetEndOfFile (hFile=0x1f4) returned 1 [0042.039] CloseHandle (hObject=0x1f4) returned 1 [0042.039] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.039] SetEndOfFile (hFile=0x1bc) returned 1 [0042.040] CloseHandle (hObject=0x1bc) returned 1 [0042.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.041] lstrlenW (lpString=".doc") returned 4 [0042.041] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString=".docx") returned 5 [0042.041] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.041] lstrlenW (lpString=".pdf") returned 4 [0042.041] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString=".xls") returned 4 [0042.041] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString=".xlsx") returned 5 [0042.041] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.041] lstrlenW (lpString=".ppt") returned 4 [0042.041] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.041] lstrlenW (lpString=".zip") returned 4 [0042.041] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.041] lstrlenW (lpString=".rar") returned 4 [0042.041] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString=".bz2") returned 4 [0042.041] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString=".7z") returned 3 [0042.041] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.041] lstrlenW (lpString=".dbf") returned 4 [0042.041] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.041] lstrlenW (lpString=".1cd") returned 4 [0042.042] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString=".jpg") returned 4 [0042.042] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString=".doc") returned 4 [0042.042] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString=".docx") returned 5 [0042.042] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.042] lstrlenW (lpString=".pdf") returned 4 [0042.042] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString=".xls") returned 4 [0042.042] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString=".xlsx") returned 5 [0042.042] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.042] lstrlenW (lpString=".ppt") returned 4 [0042.042] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString=".zip") returned 4 [0042.042] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.042] lstrlenW (lpString=".rar") returned 4 [0042.042] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString=".bz2") returned 4 [0042.042] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString=".7z") returned 3 [0042.042] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString=".dbf") returned 4 [0042.042] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.042] lstrlenW (lpString=".1cd") returned 4 [0042.042] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0042.043] lstrlenW (lpString=".jpg") returned 4 [0042.043] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.043] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.043] lstrlenW (lpString="Proofing.XML") returned 12 [0042.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.234] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=811) returned 1 [0042.234] CloseHandle (hObject=0x1f0) returned 1 [0042.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0042.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.234] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.235] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0042.235] GetLastError () returned 0x0 [0042.235] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x32b, lpOverlapped=0x0) returned 1 [0042.236] WriteFile (in: hFile=0x1c4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x330, lpOverlapped=0x0) returned 1 [0042.237] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.237] WriteFile (in: hFile=0x1c4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.238] SetEndOfFile (hFile=0x1c4) returned 1 [0042.238] CloseHandle (hObject=0x1c4) returned 1 [0042.238] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.238] SetEndOfFile (hFile=0x1f0) returned 1 [0042.239] CloseHandle (hObject=0x1f0) returned 1 [0042.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0042.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.240] lstrlenW (lpString=".doc") returned 4 [0042.240] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString=".docx") returned 5 [0042.240] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0042.240] lstrlenW (lpString=".pdf") returned 4 [0042.240] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString=".xls") returned 4 [0042.240] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString=".xlsx") returned 5 [0042.240] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0042.240] lstrlenW (lpString=".ppt") returned 4 [0042.240] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.240] lstrlenW (lpString=".zip") returned 4 [0042.240] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.240] lstrlenW (lpString=".rar") returned 4 [0042.240] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString=".bz2") returned 4 [0042.240] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString=".7z") returned 3 [0042.240] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.240] lstrlenW (lpString=".dbf") returned 4 [0042.240] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.240] lstrlenW (lpString=".1cd") returned 4 [0042.240] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString=".jpg") returned 4 [0042.241] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString=".doc") returned 4 [0042.241] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString=".docx") returned 5 [0042.241] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0042.241] lstrlenW (lpString=".pdf") returned 4 [0042.241] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString=".xls") returned 4 [0042.241] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString=".xlsx") returned 5 [0042.241] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0042.241] lstrlenW (lpString=".ppt") returned 4 [0042.241] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString=".zip") returned 4 [0042.241] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.241] lstrlenW (lpString=".rar") returned 4 [0042.241] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString=".bz2") returned 4 [0042.241] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString=".7z") returned 3 [0042.241] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString=".dbf") returned 4 [0042.241] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.241] lstrlenW (lpString=".1cd") returned 4 [0042.241] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0042.242] lstrlenW (lpString=".jpg") returned 4 [0042.242] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.242] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.242] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0042.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.242] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1450) returned 1 [0042.242] CloseHandle (hObject=0x1f0) returned 1 [0042.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0042.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.242] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.242] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0042.244] GetLastError () returned 0x0 [0042.244] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0042.246] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.246] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.246] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0042.247] SetEndOfFile (hFile=0x1c8) returned 1 [0042.247] CloseHandle (hObject=0x1c8) returned 1 [0042.247] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.247] SetEndOfFile (hFile=0x1f0) returned 1 [0042.248] CloseHandle (hObject=0x1f0) returned 1 [0042.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.249] lstrlenW (lpString=".doc") returned 4 [0042.249] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString=".docx") returned 5 [0042.249] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.249] lstrlenW (lpString=".pdf") returned 4 [0042.249] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString=".xls") returned 4 [0042.249] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString=".xlsx") returned 5 [0042.249] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.249] lstrlenW (lpString=".ppt") returned 4 [0042.249] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.249] lstrlenW (lpString=".zip") returned 4 [0042.249] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.249] lstrlenW (lpString=".rar") returned 4 [0042.249] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString=".bz2") returned 4 [0042.249] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString=".7z") returned 3 [0042.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.249] lstrlenW (lpString=".dbf") returned 4 [0042.249] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.249] lstrlenW (lpString=".1cd") returned 4 [0042.249] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString=".jpg") returned 4 [0042.250] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString=".doc") returned 4 [0042.250] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString=".docx") returned 5 [0042.250] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.250] lstrlenW (lpString=".pdf") returned 4 [0042.250] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString=".xls") returned 4 [0042.250] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString=".xlsx") returned 5 [0042.250] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.250] lstrlenW (lpString=".ppt") returned 4 [0042.250] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString=".zip") returned 4 [0042.250] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.250] lstrlenW (lpString=".rar") returned 4 [0042.250] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString=".bz2") returned 4 [0042.250] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString=".7z") returned 3 [0042.250] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString=".dbf") returned 4 [0042.250] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.250] lstrlenW (lpString=".1cd") returned 4 [0042.250] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.251] lstrlenW (lpString=".jpg") returned 4 [0042.251] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.251] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.251] lstrlenW (lpString="SETUP.XML") returned 9 [0042.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.259] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1608) returned 1 [0042.259] CloseHandle (hObject=0x1f0) returned 1 [0042.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0042.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.259] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.259] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0042.259] GetLastError () returned 0x0 [0042.259] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x648, lpOverlapped=0x0) returned 1 [0042.261] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x650, lpOverlapped=0x0) returned 1 [0042.262] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.262] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.262] SetEndOfFile (hFile=0x1c8) returned 1 [0042.262] CloseHandle (hObject=0x1c8) returned 1 [0042.263] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.263] SetEndOfFile (hFile=0x1f0) returned 1 [0042.263] CloseHandle (hObject=0x1f0) returned 1 [0042.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.264] lstrlenW (lpString=".doc") returned 4 [0042.264] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString=".docx") returned 5 [0042.264] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.264] lstrlenW (lpString=".pdf") returned 4 [0042.264] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString=".xls") returned 4 [0042.264] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString=".xlsx") returned 5 [0042.264] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.264] lstrlenW (lpString=".ppt") returned 4 [0042.264] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.264] lstrlenW (lpString=".zip") returned 4 [0042.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.264] lstrlenW (lpString=".rar") returned 4 [0042.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString=".bz2") returned 4 [0042.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.264] lstrlenW (lpString=".7z") returned 3 [0042.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString=".dbf") returned 4 [0042.265] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString=".1cd") returned 4 [0042.265] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString=".jpg") returned 4 [0042.265] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString=".doc") returned 4 [0042.265] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString=".docx") returned 5 [0042.265] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.265] lstrlenW (lpString=".pdf") returned 4 [0042.265] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString=".xls") returned 4 [0042.265] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString=".xlsx") returned 5 [0042.265] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.265] lstrlenW (lpString=".ppt") returned 4 [0042.265] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.265] lstrlenW (lpString=".zip") returned 4 [0042.265] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.265] lstrlenW (lpString=".rar") returned 4 [0042.265] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString=".bz2") returned 4 [0042.265] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.265] lstrlenW (lpString=".7z") returned 3 [0042.266] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.266] lstrlenW (lpString=".dbf") returned 4 [0042.266] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.266] lstrlenW (lpString=".1cd") returned 4 [0042.266] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.266] lstrlenW (lpString=".jpg") returned 4 [0042.266] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.266] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.266] lstrlenW (lpString="SETUP.XML") returned 9 [0042.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.153] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6241) returned 1 [0043.154] CloseHandle (hObject=0x1f0) returned 1 [0043.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0043.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.154] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.154] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.536] GetLastError () returned 0x0 [0043.536] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1861, lpOverlapped=0x0) returned 1 [0043.537] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0043.538] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.538] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.538] SetEndOfFile (hFile=0x1fc) returned 1 [0043.539] CloseHandle (hObject=0x1fc) returned 1 [0043.539] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.539] SetEndOfFile (hFile=0x1f0) returned 1 [0043.539] CloseHandle (hObject=0x1f0) returned 1 [0043.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0043.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.540] lstrlenW (lpString=".doc") returned 4 [0043.540] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".docx") returned 5 [0043.540] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.540] lstrlenW (lpString=".pdf") returned 4 [0043.540] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".xls") returned 4 [0043.540] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".xlsx") returned 5 [0043.540] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.541] lstrlenW (lpString=".ppt") returned 4 [0043.541] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString=".zip") returned 4 [0043.541] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.541] lstrlenW (lpString=".rar") returned 4 [0043.541] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".bz2") returned 4 [0043.541] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".7z") returned 3 [0043.541] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString=".dbf") returned 4 [0043.541] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString=".1cd") returned 4 [0043.541] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString=".jpg") returned 4 [0043.541] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.541] lstrlenW (lpString=".doc") returned 4 [0043.541] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".docx") returned 5 [0043.541] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.541] lstrlenW (lpString=".pdf") returned 4 [0043.541] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".xls") returned 4 [0043.542] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString=".xlsx") returned 5 [0043.542] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.542] lstrlenW (lpString=".ppt") returned 4 [0043.542] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.542] lstrlenW (lpString=".zip") returned 4 [0043.542] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.542] lstrlenW (lpString=".rar") returned 4 [0043.542] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString=".bz2") returned 4 [0043.542] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString=".7z") returned 3 [0043.542] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.542] lstrlenW (lpString=".dbf") returned 4 [0043.542] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.542] lstrlenW (lpString=".1cd") returned 4 [0043.542] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0043.542] lstrlenW (lpString=".jpg") returned 4 [0043.542] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.542] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0043.542] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0043.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.364] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6406) returned 1 [0044.364] CloseHandle (hObject=0x1f4) returned 1 [0044.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0044.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.364] lstrlenW (lpString=".doc") returned 4 [0044.364] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.364] lstrlenW (lpString=".docx") returned 5 [0044.364] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.364] lstrlenW (lpString=".pdf") returned 4 [0044.364] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.364] lstrlenW (lpString=".xls") returned 4 [0044.364] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.364] lstrlenW (lpString=".xlsx") returned 5 [0044.365] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.365] lstrlenW (lpString=".ppt") returned 4 [0044.365] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString=".zip") returned 4 [0044.365] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.365] lstrlenW (lpString=".rar") returned 4 [0044.365] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.365] lstrlenW (lpString=".bz2") returned 4 [0044.365] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.365] lstrlenW (lpString=".7z") returned 3 [0044.365] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString=".dbf") returned 4 [0044.365] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString=".1cd") returned 4 [0044.365] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString=".jpg") returned 4 [0044.365] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.365] lstrlenW (lpString=".doc") returned 4 [0044.365] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.365] lstrlenW (lpString=".docx") returned 5 [0044.365] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.365] lstrlenW (lpString=".pdf") returned 4 [0044.365] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.365] lstrlenW (lpString=".xls") returned 4 [0044.365] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.365] lstrlenW (lpString=".xlsx") returned 5 [0044.365] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.366] lstrlenW (lpString=".ppt") returned 4 [0044.366] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.366] lstrlenW (lpString=".zip") returned 4 [0044.366] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.366] lstrlenW (lpString=".rar") returned 4 [0044.366] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.366] lstrlenW (lpString=".bz2") returned 4 [0044.366] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.366] lstrlenW (lpString=".7z") returned 3 [0044.366] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.366] lstrlenW (lpString=".dbf") returned 4 [0044.366] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.366] lstrlenW (lpString=".1cd") returned 4 [0044.366] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0044.366] lstrlenW (lpString=".jpg") returned 4 [0044.366] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.366] lstrcmpiW (lpString1=".wmf", lpString2=".zoh") returned -1 [0044.366] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0044.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.367] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2920) returned 1 [0044.367] CloseHandle (hObject=0x1f4) returned 1 [0044.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0044.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.367] lstrlenW (lpString=".doc") returned 4 [0044.367] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0044.367] lstrlenW (lpString=".docx") returned 5 [0044.367] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0044.367] lstrlenW (lpString=".pdf") returned 4 [0044.367] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0044.367] lstrlenW (lpString=".xls") returned 4 [0044.367] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0044.367] lstrlenW (lpString=".xlsx") returned 5 [0044.367] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0044.367] lstrlenW (lpString=".ppt") returned 4 [0044.367] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0044.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.367] lstrlenW (lpString=".zip") returned 4 [0044.367] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0044.367] lstrlenW (lpString=".rar") returned 4 [0044.367] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0044.367] lstrlenW (lpString=".bz2") returned 4 [0044.367] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0044.367] lstrlenW (lpString=".7z") returned 3 [0044.367] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0044.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".dbf") returned 4 [0044.368] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".1cd") returned 4 [0044.368] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".jpg") returned 4 [0044.368] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".doc") returned 4 [0044.368] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString=".docx") returned 5 [0044.368] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0044.368] lstrlenW (lpString=".pdf") returned 4 [0044.368] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString=".xls") returned 4 [0044.368] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0044.368] lstrlenW (lpString=".xlsx") returned 5 [0044.368] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0044.368] lstrlenW (lpString=".ppt") returned 4 [0044.368] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".zip") returned 4 [0044.368] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0044.368] lstrlenW (lpString=".rar") returned 4 [0044.368] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString=".bz2") returned 4 [0044.368] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0044.368] lstrlenW (lpString=".7z") returned 3 [0044.368] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0044.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.368] lstrlenW (lpString=".dbf") returned 4 [0044.369] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0044.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.369] lstrlenW (lpString=".1cd") returned 4 [0044.369] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0044.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0044.369] lstrlenW (lpString=".jpg") returned 4 [0044.369] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0044.369] lstrcmpiW (lpString1=".wmf", lpString2=".zoh") returned -1 [0044.369] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0044.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.369] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7498) returned 1 [0044.369] CloseHandle (hObject=0x1f4) returned 1 [0044.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0044.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.369] lstrlenW (lpString=".doc") returned 4 [0044.370] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString=".docx") returned 5 [0044.370] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0044.370] lstrlenW (lpString=".pdf") returned 4 [0044.370] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString=".xls") returned 4 [0044.370] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0044.370] lstrlenW (lpString=".xlsx") returned 5 [0044.370] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0044.370] lstrlenW (lpString=".ppt") returned 4 [0044.370] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString=".zip") returned 4 [0044.370] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0044.370] lstrlenW (lpString=".rar") returned 4 [0044.370] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString=".bz2") returned 4 [0044.370] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString=".7z") returned 3 [0044.370] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString=".dbf") returned 4 [0044.370] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString=".1cd") returned 4 [0044.370] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString=".jpg") returned 4 [0044.370] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.370] lstrlenW (lpString=".doc") returned 4 [0044.370] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0044.370] lstrlenW (lpString=".docx") returned 5 [0044.371] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0044.371] lstrlenW (lpString=".pdf") returned 4 [0044.371] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString=".xls") returned 4 [0044.371] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0044.371] lstrlenW (lpString=".xlsx") returned 5 [0044.371] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0044.371] lstrlenW (lpString=".ppt") returned 4 [0044.371] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.371] lstrlenW (lpString=".zip") returned 4 [0044.371] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0044.371] lstrlenW (lpString=".rar") returned 4 [0044.371] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString=".bz2") returned 4 [0044.371] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString=".7z") returned 3 [0044.371] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0044.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.371] lstrlenW (lpString=".dbf") returned 4 [0044.371] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.371] lstrlenW (lpString=".1cd") returned 4 [0044.371] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0044.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0044.371] lstrlenW (lpString=".jpg") returned 4 [0044.371] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0044.371] lstrcmpiW (lpString1=".htm", lpString2=".zoh") returned -1 [0044.371] lstrlenW (lpString="Hand Prints.htm") returned 15 [0044.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.372] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=235) returned 1 [0044.372] CloseHandle (hObject=0x1f4) returned 1 [0044.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0044.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString=".doc") returned 4 [0044.373] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.373] lstrlenW (lpString=".docx") returned 5 [0044.373] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.373] lstrlenW (lpString=".pdf") returned 4 [0044.373] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.373] lstrlenW (lpString=".xls") returned 4 [0044.373] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.373] lstrlenW (lpString=".xlsx") returned 5 [0044.373] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.373] lstrlenW (lpString=".ppt") returned 4 [0044.373] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString=".zip") returned 4 [0044.373] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.373] lstrlenW (lpString=".rar") returned 4 [0044.373] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.373] lstrlenW (lpString=".bz2") returned 4 [0044.373] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.373] lstrlenW (lpString=".7z") returned 3 [0044.373] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString=".dbf") returned 4 [0044.373] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString=".1cd") returned 4 [0044.373] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.373] lstrlenW (lpString=".jpg") returned 4 [0044.374] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.374] lstrlenW (lpString=".doc") returned 4 [0044.374] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.374] lstrlenW (lpString=".docx") returned 5 [0044.374] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.374] lstrlenW (lpString=".pdf") returned 4 [0044.374] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString=".xls") returned 4 [0044.374] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString=".xlsx") returned 5 [0044.374] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.374] lstrlenW (lpString=".ppt") returned 4 [0044.374] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.374] lstrlenW (lpString=".zip") returned 4 [0044.374] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString=".rar") returned 4 [0044.374] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.374] lstrlenW (lpString=".bz2") returned 4 [0044.374] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.374] lstrlenW (lpString=".7z") returned 3 [0044.374] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.374] lstrlenW (lpString=".dbf") returned 4 [0044.374] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.374] lstrlenW (lpString=".1cd") returned 4 [0044.374] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.377] lstrlenW (lpString=".jpg") returned 4 [0044.377] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.377] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0044.377] lstrlenW (lpString="HandPrints.jpg") returned 14 [0044.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.377] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4222) returned 1 [0044.377] CloseHandle (hObject=0x1f4) returned 1 [0044.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0044.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.377] lstrlenW (lpString=".doc") returned 4 [0044.378] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.378] lstrlenW (lpString=".docx") returned 5 [0044.378] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.378] lstrlenW (lpString=".pdf") returned 4 [0044.378] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.378] lstrlenW (lpString=".xls") returned 4 [0044.378] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.378] lstrlenW (lpString=".xlsx") returned 5 [0044.378] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.378] lstrlenW (lpString=".ppt") returned 4 [0044.378] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString=".zip") returned 4 [0044.378] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.378] lstrlenW (lpString=".rar") returned 4 [0044.378] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.378] lstrlenW (lpString=".bz2") returned 4 [0044.378] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.378] lstrlenW (lpString=".7z") returned 3 [0044.378] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString=".dbf") returned 4 [0044.378] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString=".1cd") returned 4 [0044.378] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString=".jpg") returned 4 [0044.378] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.378] lstrlenW (lpString=".doc") returned 4 [0044.378] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.378] lstrlenW (lpString=".docx") returned 5 [0044.379] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.379] lstrlenW (lpString=".pdf") returned 4 [0044.379] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.379] lstrlenW (lpString=".xls") returned 4 [0044.379] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.379] lstrlenW (lpString=".xlsx") returned 5 [0044.379] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.379] lstrlenW (lpString=".ppt") returned 4 [0044.379] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.379] lstrlenW (lpString=".zip") returned 4 [0044.379] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.379] lstrlenW (lpString=".rar") returned 4 [0044.379] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.379] lstrlenW (lpString=".bz2") returned 4 [0044.379] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.379] lstrlenW (lpString=".7z") returned 3 [0044.379] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.379] lstrlenW (lpString=".dbf") returned 4 [0044.379] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.379] lstrlenW (lpString=".1cd") returned 4 [0044.379] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.379] lstrlenW (lpString=".jpg") returned 4 [0044.379] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.379] lstrcmpiW (lpString1=".emf", lpString2=".zoh") returned -1 [0044.379] lstrlenW (lpString="Memo.emf") returned 8 [0044.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.380] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=152300) returned 1 [0044.380] CloseHandle (hObject=0x1f4) returned 1 [0044.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0044.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.381] lstrlenW (lpString=".doc") returned 4 [0044.381] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0044.381] lstrlenW (lpString=".docx") returned 5 [0044.381] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1 [0044.381] lstrlenW (lpString=".pdf") returned 4 [0044.381] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0044.381] lstrlenW (lpString=".xls") returned 4 [0044.381] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0044.381] lstrlenW (lpString=".xlsx") returned 5 [0044.381] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1 [0044.381] lstrlenW (lpString=".ppt") returned 4 [0044.381] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0044.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.381] lstrlenW (lpString=".zip") returned 4 [0044.381] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0044.381] lstrlenW (lpString=".rar") returned 4 [0044.381] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0044.381] lstrlenW (lpString=".bz2") returned 4 [0044.381] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0044.381] lstrlenW (lpString=".7z") returned 3 [0044.381] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0044.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.381] lstrlenW (lpString=".dbf") returned 4 [0044.381] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0044.382] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2209) returned 1 [0044.382] CloseHandle (hObject=0x1f4) returned 1 [0044.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0044.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.382] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4192) returned 1 [0044.382] CloseHandle (hObject=0x1f4) returned 1 [0044.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0044.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.567] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26036) returned 1 [0044.567] CloseHandle (hObject=0x16c) returned 1 [0044.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0044.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.880] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2848) returned 1 [0044.880] CloseHandle (hObject=0x1ec) returned 1 [0044.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0044.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.881] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.881] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.217] GetLastError () returned 0x0 [0045.217] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb20, lpOverlapped=0x0) returned 1 [0045.219] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0045.220] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.220] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.220] SetEndOfFile (hFile=0x1f4) returned 1 [0045.220] CloseHandle (hObject=0x1f4) returned 1 [0045.220] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.220] SetEndOfFile (hFile=0x1ec) returned 1 [0045.221] CloseHandle (hObject=0x1ec) returned 1 [0045.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0045.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.222] lstrlenW (lpString=".doc") returned 4 [0045.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.222] lstrlenW (lpString=".docx") returned 5 [0045.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.222] lstrlenW (lpString=".pdf") returned 4 [0045.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.222] lstrlenW (lpString=".xls") returned 4 [0045.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.222] lstrlenW (lpString=".xlsx") returned 5 [0045.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.222] lstrlenW (lpString=".ppt") returned 4 [0045.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.222] lstrlenW (lpString=".zip") returned 4 [0045.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.222] lstrlenW (lpString=".rar") returned 4 [0045.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.222] lstrlenW (lpString=".bz2") returned 4 [0045.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.222] lstrlenW (lpString=".7z") returned 3 [0045.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.222] lstrlenW (lpString=".dbf") returned 4 [0045.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.222] lstrlenW (lpString=".1cd") returned 4 [0045.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString=".jpg") returned 4 [0045.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString=".doc") returned 4 [0045.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.223] lstrlenW (lpString=".docx") returned 5 [0045.223] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.223] lstrlenW (lpString=".pdf") returned 4 [0045.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString=".xls") returned 4 [0045.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString=".xlsx") returned 5 [0045.223] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.223] lstrlenW (lpString=".ppt") returned 4 [0045.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString=".zip") returned 4 [0045.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString=".rar") returned 4 [0045.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.223] lstrlenW (lpString=".bz2") returned 4 [0045.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.223] lstrlenW (lpString=".7z") returned 3 [0045.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString=".dbf") returned 4 [0045.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.223] lstrlenW (lpString=".1cd") returned 4 [0045.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0045.224] lstrlenW (lpString=".jpg") returned 4 [0045.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.224] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.224] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.224] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1925) returned 1 [0045.224] CloseHandle (hObject=0x1ec) returned 1 [0045.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0045.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.225] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.225] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.226] GetLastError () returned 0x0 [0045.226] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x785, lpOverlapped=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x790, lpOverlapped=0x0) returned 1 [0045.229] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.229] SetEndOfFile (hFile=0x1f4) returned 1 [0045.229] CloseHandle (hObject=0x1f4) returned 1 [0045.229] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.229] SetEndOfFile (hFile=0x1ec) returned 1 [0045.230] CloseHandle (hObject=0x1ec) returned 1 [0045.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.230] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0045.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.230] lstrlenW (lpString=".doc") returned 4 [0045.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.230] lstrlenW (lpString=".docx") returned 5 [0045.230] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.230] lstrlenW (lpString=".pdf") returned 4 [0045.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString=".xls") returned 4 [0045.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString=".xlsx") returned 5 [0045.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.231] lstrlenW (lpString=".ppt") returned 4 [0045.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString=".zip") returned 4 [0045.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString=".rar") returned 4 [0045.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString=".bz2") returned 4 [0045.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.231] lstrlenW (lpString=".7z") returned 3 [0045.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString=".dbf") returned 4 [0045.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString=".1cd") returned 4 [0045.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString=".jpg") returned 4 [0045.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.231] lstrlenW (lpString=".doc") returned 4 [0045.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.231] lstrlenW (lpString=".docx") returned 5 [0045.231] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.231] lstrlenW (lpString=".pdf") returned 4 [0045.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.232] lstrlenW (lpString=".xls") returned 4 [0045.232] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.232] lstrlenW (lpString=".xlsx") returned 5 [0045.232] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.232] lstrlenW (lpString=".ppt") returned 4 [0045.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.232] lstrlenW (lpString=".zip") returned 4 [0045.232] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.232] lstrlenW (lpString=".rar") returned 4 [0045.232] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.232] lstrlenW (lpString=".bz2") returned 4 [0045.232] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.232] lstrlenW (lpString=".7z") returned 3 [0045.232] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.232] lstrlenW (lpString=".dbf") returned 4 [0045.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.232] lstrlenW (lpString=".1cd") returned 4 [0045.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0045.232] lstrlenW (lpString=".jpg") returned 4 [0045.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.232] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.232] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.233] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27407) returned 1 [0045.233] CloseHandle (hObject=0x1ec) returned 1 [0045.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0045.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.234] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.234] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.234] GetLastError () returned 0x0 [0045.234] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0045.236] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0045.237] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.237] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.237] SetEndOfFile (hFile=0x1f4) returned 1 [0045.237] CloseHandle (hObject=0x1f4) returned 1 [0045.238] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.238] SetEndOfFile (hFile=0x1ec) returned 1 [0045.238] CloseHandle (hObject=0x1ec) returned 1 [0045.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.239] lstrlenW (lpString=".doc") returned 4 [0045.239] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.239] lstrlenW (lpString=".docx") returned 5 [0045.239] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.239] lstrlenW (lpString=".pdf") returned 4 [0045.239] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.239] lstrlenW (lpString=".xls") returned 4 [0045.239] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.239] lstrlenW (lpString=".xlsx") returned 5 [0045.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.239] lstrlenW (lpString=".ppt") returned 4 [0045.239] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.239] lstrlenW (lpString=".zip") returned 4 [0045.239] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.239] lstrlenW (lpString=".rar") returned 4 [0045.239] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.240] lstrlenW (lpString=".bz2") returned 4 [0045.240] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString=".7z") returned 3 [0045.240] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString=".dbf") returned 4 [0045.240] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString=".1cd") returned 4 [0045.240] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString=".jpg") returned 4 [0045.240] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString=".doc") returned 4 [0045.240] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString=".docx") returned 5 [0045.240] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.240] lstrlenW (lpString=".pdf") returned 4 [0045.240] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.240] lstrlenW (lpString=".xls") returned 4 [0045.240] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.240] lstrlenW (lpString=".xlsx") returned 5 [0045.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.240] lstrlenW (lpString=".ppt") returned 4 [0045.240] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.240] lstrlenW (lpString=".zip") returned 4 [0045.240] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.240] lstrlenW (lpString=".rar") returned 4 [0045.241] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.241] lstrlenW (lpString=".bz2") returned 4 [0045.241] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.241] lstrlenW (lpString=".7z") returned 3 [0045.241] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.241] lstrlenW (lpString=".dbf") returned 4 [0045.241] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.241] lstrlenW (lpString=".1cd") returned 4 [0045.241] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0045.241] lstrlenW (lpString=".jpg") returned 4 [0045.241] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.241] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.241] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.241] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3479) returned 1 [0045.242] CloseHandle (hObject=0x1ec) returned 1 [0045.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0045.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.242] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.242] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.243] GetLastError () returned 0x0 [0045.244] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd97, lpOverlapped=0x0) returned 1 [0045.245] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0045.246] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.246] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.246] SetEndOfFile (hFile=0x1f4) returned 1 [0045.246] CloseHandle (hObject=0x1f4) returned 1 [0045.246] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.246] SetEndOfFile (hFile=0x1ec) returned 1 [0045.247] CloseHandle (hObject=0x1ec) returned 1 [0045.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.248] lstrlenW (lpString=".doc") returned 4 [0045.248] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.248] lstrlenW (lpString=".docx") returned 5 [0045.248] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.248] lstrlenW (lpString=".pdf") returned 4 [0045.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.248] lstrlenW (lpString=".xls") returned 4 [0045.248] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.248] lstrlenW (lpString=".xlsx") returned 5 [0045.248] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.248] lstrlenW (lpString=".ppt") returned 4 [0045.248] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.248] lstrlenW (lpString=".zip") returned 4 [0045.248] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.248] lstrlenW (lpString=".rar") returned 4 [0045.248] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.248] lstrlenW (lpString=".bz2") returned 4 [0045.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.248] lstrlenW (lpString=".7z") returned 3 [0045.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.248] lstrlenW (lpString=".dbf") returned 4 [0045.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.248] lstrlenW (lpString=".1cd") returned 4 [0045.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString=".jpg") returned 4 [0045.249] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString=".doc") returned 4 [0045.249] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.249] lstrlenW (lpString=".docx") returned 5 [0045.249] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.249] lstrlenW (lpString=".pdf") returned 4 [0045.249] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString=".xls") returned 4 [0045.249] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString=".xlsx") returned 5 [0045.249] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.249] lstrlenW (lpString=".ppt") returned 4 [0045.249] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString=".zip") returned 4 [0045.249] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString=".rar") returned 4 [0045.249] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.249] lstrlenW (lpString=".bz2") returned 4 [0045.249] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.249] lstrlenW (lpString=".7z") returned 3 [0045.249] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString=".dbf") returned 4 [0045.249] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.249] lstrlenW (lpString=".1cd") returned 4 [0045.250] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0045.250] lstrlenW (lpString=".jpg") returned 4 [0045.250] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.250] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.250] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.250] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31837) returned 1 [0045.250] CloseHandle (hObject=0x1ec) returned 1 [0045.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0045.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.250] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.251] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.423] GetLastError () returned 0x0 [0045.423] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0045.425] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0045.428] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.428] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.428] SetEndOfFile (hFile=0x200) returned 1 [0045.428] CloseHandle (hObject=0x200) returned 1 [0045.429] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.429] SetEndOfFile (hFile=0x1ec) returned 1 [0045.430] CloseHandle (hObject=0x1ec) returned 1 [0045.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0045.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.430] lstrlenW (lpString=".doc") returned 4 [0045.430] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.430] lstrlenW (lpString=".docx") returned 5 [0045.430] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.430] lstrlenW (lpString=".pdf") returned 4 [0045.430] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.430] lstrlenW (lpString=".xls") returned 4 [0045.430] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.430] lstrlenW (lpString=".xlsx") returned 5 [0045.430] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.430] lstrlenW (lpString=".ppt") returned 4 [0045.430] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString=".zip") returned 4 [0045.431] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.431] lstrlenW (lpString=".rar") returned 4 [0045.431] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.431] lstrlenW (lpString=".bz2") returned 4 [0045.431] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString=".7z") returned 3 [0045.431] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString=".dbf") returned 4 [0045.431] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString=".1cd") returned 4 [0045.431] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString=".jpg") returned 4 [0045.431] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.431] lstrlenW (lpString=".doc") returned 4 [0045.431] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString=".docx") returned 5 [0045.431] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.431] lstrlenW (lpString=".pdf") returned 4 [0045.431] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.431] lstrlenW (lpString=".xls") returned 4 [0045.431] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.431] lstrlenW (lpString=".xlsx") returned 5 [0045.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.431] lstrlenW (lpString=".ppt") returned 4 [0045.431] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.432] lstrlenW (lpString=".zip") returned 4 [0045.432] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.432] lstrlenW (lpString=".rar") returned 4 [0045.432] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.432] lstrlenW (lpString=".bz2") returned 4 [0045.432] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.432] lstrlenW (lpString=".7z") returned 3 [0045.432] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.432] lstrlenW (lpString=".dbf") returned 4 [0045.432] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.432] lstrlenW (lpString=".1cd") returned 4 [0045.432] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0045.432] lstrlenW (lpString=".jpg") returned 4 [0045.432] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.432] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.432] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.433] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2044) returned 1 [0045.433] CloseHandle (hObject=0x1ec) returned 1 [0045.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0045.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.433] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.433] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.435] GetLastError () returned 0x0 [0045.435] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0045.437] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x800, lpOverlapped=0x0) returned 1 [0045.437] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.437] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.438] SetEndOfFile (hFile=0x200) returned 1 [0045.438] CloseHandle (hObject=0x200) returned 1 [0045.438] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.438] SetEndOfFile (hFile=0x1ec) returned 1 [0045.439] CloseHandle (hObject=0x1ec) returned 1 [0045.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.439] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0045.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.439] lstrlenW (lpString=".doc") returned 4 [0045.439] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.439] lstrlenW (lpString=".docx") returned 5 [0045.439] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.439] lstrlenW (lpString=".pdf") returned 4 [0045.439] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.439] lstrlenW (lpString=".xls") returned 4 [0045.439] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.439] lstrlenW (lpString=".xlsx") returned 5 [0045.439] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.440] lstrlenW (lpString=".ppt") returned 4 [0045.440] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString=".zip") returned 4 [0045.440] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString=".rar") returned 4 [0045.440] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString=".bz2") returned 4 [0045.440] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.440] lstrlenW (lpString=".7z") returned 3 [0045.440] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString=".dbf") returned 4 [0045.440] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString=".1cd") returned 4 [0045.440] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString=".jpg") returned 4 [0045.440] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.440] lstrlenW (lpString=".doc") returned 4 [0045.440] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.440] lstrlenW (lpString=".docx") returned 5 [0045.440] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.440] lstrlenW (lpString=".pdf") returned 4 [0045.440] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString=".xls") returned 4 [0045.440] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.440] lstrlenW (lpString=".xlsx") returned 5 [0045.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.441] lstrlenW (lpString=".ppt") returned 4 [0045.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.441] lstrlenW (lpString=".zip") returned 4 [0045.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.441] lstrlenW (lpString=".rar") returned 4 [0045.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.441] lstrlenW (lpString=".bz2") returned 4 [0045.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.441] lstrlenW (lpString=".7z") returned 3 [0045.441] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.441] lstrlenW (lpString=".dbf") returned 4 [0045.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.441] lstrlenW (lpString=".1cd") returned 4 [0045.441] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.441] lstrlenW (lpString=".jpg") returned 4 [0045.441] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.441] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.441] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.442] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29925) returned 1 [0045.442] CloseHandle (hObject=0x1ec) returned 1 [0045.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0045.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.442] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.442] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.442] GetLastError () returned 0x0 [0045.442] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0045.444] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0045.445] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.446] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.446] SetEndOfFile (hFile=0x200) returned 1 [0045.446] CloseHandle (hObject=0x200) returned 1 [0045.446] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.446] SetEndOfFile (hFile=0x1ec) returned 1 [0045.447] CloseHandle (hObject=0x1ec) returned 1 [0045.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0045.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.447] lstrlenW (lpString=".doc") returned 4 [0045.447] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.447] lstrlenW (lpString=".docx") returned 5 [0045.447] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.447] lstrlenW (lpString=".pdf") returned 4 [0045.448] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString=".xls") returned 4 [0045.448] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.448] lstrlenW (lpString=".xlsx") returned 5 [0045.448] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.448] lstrlenW (lpString=".ppt") returned 4 [0045.448] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString=".zip") returned 4 [0045.448] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.448] lstrlenW (lpString=".rar") returned 4 [0045.448] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.448] lstrlenW (lpString=".bz2") returned 4 [0045.448] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString=".7z") returned 3 [0045.448] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString=".dbf") returned 4 [0045.448] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString=".1cd") returned 4 [0045.448] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString=".jpg") returned 4 [0045.448] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.448] lstrlenW (lpString=".doc") returned 4 [0045.448] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.448] lstrlenW (lpString=".docx") returned 5 [0045.448] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.449] lstrlenW (lpString=".pdf") returned 4 [0045.449] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.449] lstrlenW (lpString=".xls") returned 4 [0045.449] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.449] lstrlenW (lpString=".xlsx") returned 5 [0045.449] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.449] lstrlenW (lpString=".ppt") returned 4 [0045.449] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.449] lstrlenW (lpString=".zip") returned 4 [0045.449] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.449] lstrlenW (lpString=".rar") returned 4 [0045.449] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.449] lstrlenW (lpString=".bz2") returned 4 [0045.449] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.449] lstrlenW (lpString=".7z") returned 3 [0045.449] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.449] lstrlenW (lpString=".dbf") returned 4 [0045.449] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.449] lstrlenW (lpString=".1cd") returned 4 [0045.449] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.449] lstrlenW (lpString=".jpg") returned 4 [0045.449] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.449] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.450] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.450] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1363) returned 1 [0045.450] CloseHandle (hObject=0x1ec) returned 1 [0045.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0045.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.450] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.450] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.452] GetLastError () returned 0x0 [0045.452] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x553, lpOverlapped=0x0) returned 1 [0045.454] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x560, lpOverlapped=0x0) returned 1 [0045.455] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.455] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.455] SetEndOfFile (hFile=0x200) returned 1 [0045.456] CloseHandle (hObject=0x200) returned 1 [0045.456] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.456] SetEndOfFile (hFile=0x1ec) returned 1 [0045.456] CloseHandle (hObject=0x1ec) returned 1 [0045.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.457] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0045.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.457] lstrlenW (lpString=".doc") returned 4 [0045.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.457] lstrlenW (lpString=".docx") returned 5 [0045.457] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.457] lstrlenW (lpString=".pdf") returned 4 [0045.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.457] lstrlenW (lpString=".xls") returned 4 [0045.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.457] lstrlenW (lpString=".xlsx") returned 5 [0045.457] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.457] lstrlenW (lpString=".ppt") returned 4 [0045.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.457] lstrlenW (lpString=".zip") returned 4 [0045.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.457] lstrlenW (lpString=".rar") returned 4 [0045.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.458] lstrlenW (lpString=".bz2") returned 4 [0045.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.458] lstrlenW (lpString=".7z") returned 3 [0045.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString=".dbf") returned 4 [0045.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString=".1cd") returned 4 [0045.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString=".jpg") returned 4 [0045.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString=".doc") returned 4 [0045.458] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.458] lstrlenW (lpString=".docx") returned 5 [0045.458] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.458] lstrlenW (lpString=".pdf") returned 4 [0045.458] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.458] lstrlenW (lpString=".xls") returned 4 [0045.458] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.458] lstrlenW (lpString=".xlsx") returned 5 [0045.458] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.458] lstrlenW (lpString=".ppt") returned 4 [0045.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.458] lstrlenW (lpString=".zip") returned 4 [0045.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.459] lstrlenW (lpString=".rar") returned 4 [0045.459] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.459] lstrlenW (lpString=".bz2") returned 4 [0045.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.459] lstrlenW (lpString=".7z") returned 3 [0045.459] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.459] lstrlenW (lpString=".dbf") returned 4 [0045.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.459] lstrlenW (lpString=".1cd") returned 4 [0045.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0045.459] lstrlenW (lpString=".jpg") returned 4 [0045.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.459] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.459] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.459] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20371) returned 1 [0045.459] CloseHandle (hObject=0x1ec) returned 1 [0045.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0045.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.460] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.460] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.460] GetLastError () returned 0x0 [0045.460] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0045.682] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0045.683] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.683] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.683] SetEndOfFile (hFile=0x200) returned 1 [0045.683] CloseHandle (hObject=0x200) returned 1 [0045.683] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.683] SetEndOfFile (hFile=0x1ec) returned 1 [0045.684] CloseHandle (hObject=0x1ec) returned 1 [0045.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0045.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.685] lstrlenW (lpString=".doc") returned 4 [0045.685] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.685] lstrlenW (lpString=".docx") returned 5 [0045.685] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.685] lstrlenW (lpString=".pdf") returned 4 [0045.685] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.685] lstrlenW (lpString=".xls") returned 4 [0045.685] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.685] lstrlenW (lpString=".xlsx") returned 5 [0045.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.685] lstrlenW (lpString=".ppt") returned 4 [0045.685] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.685] lstrlenW (lpString=".zip") returned 4 [0045.685] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.685] lstrlenW (lpString=".rar") returned 4 [0045.685] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.685] lstrlenW (lpString=".bz2") returned 4 [0045.686] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString=".7z") returned 3 [0045.686] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString=".dbf") returned 4 [0045.686] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString=".1cd") returned 4 [0045.686] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString=".jpg") returned 4 [0045.686] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString=".doc") returned 4 [0045.686] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString=".docx") returned 5 [0045.686] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.686] lstrlenW (lpString=".pdf") returned 4 [0045.686] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.686] lstrlenW (lpString=".xls") returned 4 [0045.686] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.686] lstrlenW (lpString=".xlsx") returned 5 [0045.686] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.686] lstrlenW (lpString=".ppt") returned 4 [0045.686] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.686] lstrlenW (lpString=".zip") returned 4 [0045.686] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.686] lstrlenW (lpString=".rar") returned 4 [0045.687] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.687] lstrlenW (lpString=".bz2") returned 4 [0045.687] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.687] lstrlenW (lpString=".7z") returned 3 [0045.687] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.687] lstrlenW (lpString=".dbf") returned 4 [0045.687] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.687] lstrlenW (lpString=".1cd") returned 4 [0045.687] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0045.687] lstrlenW (lpString=".jpg") returned 4 [0045.687] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.687] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.687] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.688] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1287) returned 1 [0045.688] CloseHandle (hObject=0x1ec) returned 1 [0045.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0045.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.688] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.688] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0045.824] GetLastError () returned 0x0 [0045.824] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x507, lpOverlapped=0x0) returned 1 [0045.843] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x510, lpOverlapped=0x0) returned 1 [0045.844] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.844] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.844] SetEndOfFile (hFile=0x208) returned 1 [0045.844] CloseHandle (hObject=0x208) returned 1 [0045.845] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.845] SetEndOfFile (hFile=0x1ec) returned 1 [0045.845] CloseHandle (hObject=0x1ec) returned 1 [0045.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0045.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.848] lstrlenW (lpString=".doc") returned 4 [0045.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.848] lstrlenW (lpString=".docx") returned 5 [0045.848] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.848] lstrlenW (lpString=".pdf") returned 4 [0045.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.848] lstrlenW (lpString=".xls") returned 4 [0045.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.848] lstrlenW (lpString=".xlsx") returned 5 [0045.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.848] lstrlenW (lpString=".ppt") returned 4 [0045.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString=".zip") returned 4 [0045.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString=".rar") returned 4 [0045.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString=".bz2") returned 4 [0045.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.849] lstrlenW (lpString=".7z") returned 3 [0045.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString=".dbf") returned 4 [0045.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString=".1cd") returned 4 [0045.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString=".jpg") returned 4 [0045.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.849] lstrlenW (lpString=".doc") returned 4 [0045.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.849] lstrlenW (lpString=".docx") returned 5 [0045.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.849] lstrlenW (lpString=".pdf") returned 4 [0045.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString=".xls") returned 4 [0045.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.849] lstrlenW (lpString=".xlsx") returned 5 [0045.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.850] lstrlenW (lpString=".ppt") returned 4 [0045.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.850] lstrlenW (lpString=".zip") returned 4 [0045.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.850] lstrlenW (lpString=".rar") returned 4 [0045.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.850] lstrlenW (lpString=".bz2") returned 4 [0045.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.850] lstrlenW (lpString=".7z") returned 3 [0045.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.850] lstrlenW (lpString=".dbf") returned 4 [0045.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.850] lstrlenW (lpString=".1cd") returned 4 [0045.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0045.850] lstrlenW (lpString=".jpg") returned 4 [0045.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.850] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.850] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.851] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1347) returned 1 [0045.851] CloseHandle (hObject=0x1ec) returned 1 [0045.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0045.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.851] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.851] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0045.853] GetLastError () returned 0x0 [0045.853] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.854] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.855] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.855] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.855] SetEndOfFile (hFile=0x208) returned 1 [0045.855] CloseHandle (hObject=0x208) returned 1 [0045.855] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.856] SetEndOfFile (hFile=0x1ec) returned 1 [0045.856] CloseHandle (hObject=0x1ec) returned 1 [0045.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.857] lstrlenW (lpString=".doc") returned 4 [0045.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.857] lstrlenW (lpString=".docx") returned 5 [0045.857] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.857] lstrlenW (lpString=".pdf") returned 4 [0045.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.857] lstrlenW (lpString=".xls") returned 4 [0045.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.857] lstrlenW (lpString=".xlsx") returned 5 [0045.857] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.857] lstrlenW (lpString=".ppt") returned 4 [0045.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.857] lstrlenW (lpString=".zip") returned 4 [0045.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.857] lstrlenW (lpString=".rar") returned 4 [0045.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.857] lstrlenW (lpString=".bz2") returned 4 [0045.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.858] lstrlenW (lpString=".7z") returned 3 [0045.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString=".dbf") returned 4 [0045.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString=".1cd") returned 4 [0045.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString=".jpg") returned 4 [0045.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString=".doc") returned 4 [0045.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.858] lstrlenW (lpString=".docx") returned 5 [0045.858] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.858] lstrlenW (lpString=".pdf") returned 4 [0045.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.858] lstrlenW (lpString=".xls") returned 4 [0045.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.858] lstrlenW (lpString=".xlsx") returned 5 [0045.858] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.858] lstrlenW (lpString=".ppt") returned 4 [0045.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.858] lstrlenW (lpString=".zip") returned 4 [0045.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.858] lstrlenW (lpString=".rar") returned 4 [0045.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.859] lstrlenW (lpString=".bz2") returned 4 [0045.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.859] lstrlenW (lpString=".7z") returned 3 [0045.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.859] lstrlenW (lpString=".dbf") returned 4 [0045.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.859] lstrlenW (lpString=".1cd") returned 4 [0045.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.859] lstrlenW (lpString=".jpg") returned 4 [0045.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.859] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.859] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.860] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26402) returned 1 [0045.860] CloseHandle (hObject=0x1ec) returned 1 [0045.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0045.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.860] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.860] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0045.860] GetLastError () returned 0x0 [0045.861] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6722, lpOverlapped=0x0) returned 1 [0045.862] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0045.864] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.864] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.864] SetEndOfFile (hFile=0x208) returned 1 [0045.864] CloseHandle (hObject=0x208) returned 1 [0045.864] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.864] SetEndOfFile (hFile=0x1ec) returned 1 [0045.865] CloseHandle (hObject=0x1ec) returned 1 [0045.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.865] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0045.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.865] lstrlenW (lpString=".doc") returned 4 [0045.865] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString=".docx") returned 5 [0045.866] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.866] lstrlenW (lpString=".pdf") returned 4 [0045.866] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString=".xls") returned 4 [0045.866] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.866] lstrlenW (lpString=".xlsx") returned 5 [0045.866] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.866] lstrlenW (lpString=".ppt") returned 4 [0045.866] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString=".zip") returned 4 [0045.866] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.866] lstrlenW (lpString=".rar") returned 4 [0045.866] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.866] lstrlenW (lpString=".bz2") returned 4 [0045.866] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString=".7z") returned 3 [0045.866] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString=".dbf") returned 4 [0045.866] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString=".1cd") returned 4 [0045.866] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString=".jpg") returned 4 [0045.866] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.866] lstrlenW (lpString=".doc") returned 4 [0045.867] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.867] lstrlenW (lpString=".docx") returned 5 [0045.867] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.867] lstrlenW (lpString=".pdf") returned 4 [0045.867] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.867] lstrlenW (lpString=".xls") returned 4 [0045.867] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.867] lstrlenW (lpString=".xlsx") returned 5 [0045.867] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.867] lstrlenW (lpString=".ppt") returned 4 [0045.867] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.867] lstrlenW (lpString=".zip") returned 4 [0045.867] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.867] lstrlenW (lpString=".rar") returned 4 [0045.867] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.867] lstrlenW (lpString=".bz2") returned 4 [0045.867] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.867] lstrlenW (lpString=".7z") returned 3 [0045.867] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.867] lstrlenW (lpString=".dbf") returned 4 [0045.867] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.867] lstrlenW (lpString=".1cd") returned 4 [0045.867] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.867] lstrlenW (lpString=".jpg") returned 4 [0045.867] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.868] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.868] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.868] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1354) returned 1 [0045.868] CloseHandle (hObject=0x1ec) returned 1 [0045.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0045.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0045.868] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.868] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.458] GetLastError () returned 0x0 [0046.458] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x54a, lpOverlapped=0x0) returned 1 [0046.460] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0046.461] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.461] WriteFile (in: hFile=0x208, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.461] SetEndOfFile (hFile=0x208) returned 1 [0046.461] CloseHandle (hObject=0x208) returned 1 [0046.461] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.461] SetEndOfFile (hFile=0x1ec) returned 1 [0046.462] CloseHandle (hObject=0x1ec) returned 1 [0046.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0046.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.463] lstrlenW (lpString=".doc") returned 4 [0046.463] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.463] lstrlenW (lpString=".docx") returned 5 [0046.463] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.463] lstrlenW (lpString=".pdf") returned 4 [0046.463] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.463] lstrlenW (lpString=".xls") returned 4 [0046.463] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.463] lstrlenW (lpString=".xlsx") returned 5 [0046.463] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.463] lstrlenW (lpString=".ppt") returned 4 [0046.463] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.463] lstrlenW (lpString=".zip") returned 4 [0046.463] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.463] lstrlenW (lpString=".rar") returned 4 [0046.463] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.463] lstrlenW (lpString=".bz2") returned 4 [0046.463] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.463] lstrlenW (lpString=".7z") returned 3 [0046.463] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.463] lstrlenW (lpString=".dbf") returned 4 [0046.463] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.463] lstrlenW (lpString=".1cd") returned 4 [0046.464] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.464] lstrlenW (lpString=".jpg") returned 4 [0046.464] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.464] lstrlenW (lpString=".doc") returned 4 [0046.464] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.464] lstrlenW (lpString=".docx") returned 5 [0046.464] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.464] lstrlenW (lpString=".pdf") returned 4 [0046.464] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString=".xls") returned 4 [0046.464] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString=".xlsx") returned 5 [0046.464] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.464] lstrlenW (lpString=".ppt") returned 4 [0046.464] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.464] lstrlenW (lpString=".zip") returned 4 [0046.464] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString=".rar") returned 4 [0046.464] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.464] lstrlenW (lpString=".bz2") returned 4 [0046.464] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.464] lstrlenW (lpString=".7z") returned 3 [0046.464] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.464] lstrlenW (lpString=".dbf") returned 4 [0046.464] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.465] lstrlenW (lpString=".1cd") returned 4 [0046.465] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0046.465] lstrlenW (lpString=".jpg") returned 4 [0046.465] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.465] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.465] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.465] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5120) returned 1 [0046.465] CloseHandle (hObject=0x1ec) returned 1 [0046.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0046.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.466] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.466] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.751] GetLastError () returned 0x0 [0046.751] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1400, lpOverlapped=0x0) returned 1 [0046.884] WriteFile (in: hFile=0x204, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0046.886] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.886] WriteFile (in: hFile=0x204, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.886] SetEndOfFile (hFile=0x204) returned 1 [0046.886] CloseHandle (hObject=0x204) returned 1 [0046.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.886] SetEndOfFile (hFile=0x1ec) returned 1 [0046.887] CloseHandle (hObject=0x1ec) returned 1 [0046.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0046.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.887] lstrlenW (lpString=".doc") returned 4 [0046.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.887] lstrlenW (lpString=".docx") returned 5 [0046.888] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.888] lstrlenW (lpString=".pdf") returned 4 [0046.888] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString=".xls") returned 4 [0046.888] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString=".xlsx") returned 5 [0046.888] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.888] lstrlenW (lpString=".ppt") returned 4 [0046.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.888] lstrlenW (lpString=".zip") returned 4 [0046.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString=".rar") returned 4 [0046.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString=".bz2") returned 4 [0046.888] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.888] lstrlenW (lpString=".7z") returned 3 [0046.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.888] lstrlenW (lpString=".dbf") returned 4 [0046.888] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.888] lstrlenW (lpString=".1cd") returned 4 [0046.888] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.888] lstrlenW (lpString=".jpg") returned 4 [0046.888] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.889] lstrlenW (lpString=".doc") returned 4 [0046.889] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.889] lstrlenW (lpString=".docx") returned 5 [0046.889] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.889] lstrlenW (lpString=".pdf") returned 4 [0046.889] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.889] lstrlenW (lpString=".xls") returned 4 [0046.889] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.889] lstrlenW (lpString=".xlsx") returned 5 [0046.889] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.889] lstrlenW (lpString=".ppt") returned 4 [0046.889] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.889] lstrlenW (lpString=".zip") returned 4 [0046.890] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.890] lstrlenW (lpString=".rar") returned 4 [0046.890] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.890] lstrlenW (lpString=".bz2") returned 4 [0046.890] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.890] lstrlenW (lpString=".7z") returned 3 [0046.890] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.890] lstrlenW (lpString=".dbf") returned 4 [0046.890] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.890] lstrlenW (lpString=".1cd") returned 4 [0046.890] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0046.890] lstrlenW (lpString=".jpg") returned 4 [0046.890] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.890] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0046.890] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.092] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19485) returned 1 [0047.092] CloseHandle (hObject=0x1f8) returned 1 [0047.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0047.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.093] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.093] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0047.093] GetLastError () returned 0x0 [0047.093] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0047.611] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0047.613] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.613] WriteFile (in: hFile=0x200, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.613] SetEndOfFile (hFile=0x200) returned 1 [0047.613] CloseHandle (hObject=0x200) returned 1 [0047.613] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.613] SetEndOfFile (hFile=0x1f8) returned 1 [0047.614] CloseHandle (hObject=0x1f8) returned 1 [0047.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0047.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0047.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.615] lstrlenW (lpString=".doc") returned 4 [0047.615] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.615] lstrlenW (lpString=".docx") returned 5 [0047.615] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.615] lstrlenW (lpString=".pdf") returned 4 [0047.615] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.615] lstrlenW (lpString=".xls") returned 4 [0047.615] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.615] lstrlenW (lpString=".xlsx") returned 5 [0047.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.615] lstrlenW (lpString=".ppt") returned 4 [0047.615] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.615] lstrlenW (lpString=".zip") returned 4 [0047.615] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.615] lstrlenW (lpString=".rar") returned 4 [0047.615] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.615] lstrlenW (lpString=".bz2") returned 4 [0047.615] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.615] lstrlenW (lpString=".7z") returned 3 [0047.615] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.615] lstrlenW (lpString=".dbf") returned 4 [0047.615] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.615] lstrlenW (lpString=".1cd") returned 4 [0047.615] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.616] lstrlenW (lpString=".jpg") returned 4 [0047.616] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.616] lstrlenW (lpString=".doc") returned 4 [0047.616] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.616] lstrlenW (lpString=".docx") returned 5 [0047.616] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.616] lstrlenW (lpString=".pdf") returned 4 [0047.616] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.616] lstrlenW (lpString=".xls") returned 4 [0047.616] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.616] lstrlenW (lpString=".xlsx") returned 5 [0047.616] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.616] lstrlenW (lpString=".ppt") returned 4 [0047.616] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.616] lstrlenW (lpString=".zip") returned 4 [0047.616] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.616] lstrlenW (lpString=".rar") returned 4 [0047.616] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.616] lstrlenW (lpString=".bz2") returned 4 [0047.616] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.616] lstrlenW (lpString=".7z") returned 3 [0047.616] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.616] lstrlenW (lpString=".dbf") returned 4 [0047.617] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.617] lstrlenW (lpString=".1cd") returned 4 [0047.617] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.617] lstrlenW (lpString=".jpg") returned 4 [0047.617] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.617] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0047.617] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0047.782] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=48115) returned 1 [0047.782] CloseHandle (hObject=0x200) returned 1 [0047.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0047.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0047.782] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.783] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.783] GetLastError () returned 0x0 [0047.783] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0047.912] WriteFile (in: hFile=0x204, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0047.913] ReadFile (in: hFile=0x200, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.913] WriteFile (in: hFile=0x204, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.913] SetEndOfFile (hFile=0x204) returned 1 [0047.914] CloseHandle (hObject=0x204) returned 1 [0047.914] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.914] SetEndOfFile (hFile=0x200) returned 1 [0047.915] CloseHandle (hObject=0x200) returned 1 [0047.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0047.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.915] lstrlenW (lpString=".doc") returned 4 [0047.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.916] lstrlenW (lpString=".docx") returned 5 [0047.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.916] lstrlenW (lpString=".pdf") returned 4 [0047.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.916] lstrlenW (lpString=".xls") returned 4 [0047.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.916] lstrlenW (lpString=".xlsx") returned 5 [0047.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.916] lstrlenW (lpString=".ppt") returned 4 [0047.916] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.916] lstrlenW (lpString=".zip") returned 4 [0047.916] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.916] lstrlenW (lpString=".rar") returned 4 [0047.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.916] lstrlenW (lpString=".bz2") returned 4 [0047.916] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.916] lstrlenW (lpString=".7z") returned 3 [0047.916] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.916] lstrlenW (lpString=".dbf") returned 4 [0047.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.916] lstrlenW (lpString=".1cd") returned 4 [0047.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.916] lstrlenW (lpString=".jpg") returned 4 [0047.917] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.917] lstrlenW (lpString=".doc") returned 4 [0047.917] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.917] lstrlenW (lpString=".docx") returned 5 [0047.917] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.917] lstrlenW (lpString=".pdf") returned 4 [0047.917] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.917] lstrlenW (lpString=".xls") returned 4 [0047.917] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.917] lstrlenW (lpString=".xlsx") returned 5 [0047.917] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.917] lstrlenW (lpString=".ppt") returned 4 [0047.917] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.917] lstrlenW (lpString=".zip") returned 4 [0047.917] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.917] lstrlenW (lpString=".rar") returned 4 [0047.917] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.917] lstrlenW (lpString=".bz2") returned 4 [0047.917] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.917] lstrlenW (lpString=".7z") returned 3 [0047.917] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.917] lstrlenW (lpString=".dbf") returned 4 [0047.918] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.918] lstrlenW (lpString=".1cd") returned 4 [0047.918] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.918] lstrlenW (lpString=".jpg") returned 4 [0047.918] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.918] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0047.918] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.590] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11573) returned 1 [0048.604] CloseHandle (hObject=0x21c) returned 1 [0048.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0048.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.604] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.604] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.606] GetLastError () returned 0x0 [0048.606] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0048.615] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.616] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.616] SetEndOfFile (hFile=0x1f0) returned 1 [0048.616] CloseHandle (hObject=0x1f0) returned 1 [0048.616] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.616] SetEndOfFile (hFile=0x21c) returned 1 [0048.617] CloseHandle (hObject=0x21c) returned 1 [0048.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.617] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.617] lstrlenW (lpString=".doc") returned 4 [0048.617] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.617] lstrlenW (lpString=".docx") returned 5 [0048.617] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.618] lstrlenW (lpString=".pdf") returned 4 [0048.618] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString=".xls") returned 4 [0048.618] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.618] lstrlenW (lpString=".xlsx") returned 5 [0048.618] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.618] lstrlenW (lpString=".ppt") returned 4 [0048.618] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString=".zip") returned 4 [0048.618] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.618] lstrlenW (lpString=".rar") returned 4 [0048.618] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.618] lstrlenW (lpString=".bz2") returned 4 [0048.618] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString=".7z") returned 3 [0048.618] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString=".dbf") returned 4 [0048.618] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString=".1cd") returned 4 [0048.618] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString=".jpg") returned 4 [0048.618] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.618] lstrlenW (lpString=".doc") returned 4 [0048.618] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.618] lstrlenW (lpString=".docx") returned 5 [0048.619] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.619] lstrlenW (lpString=".pdf") returned 4 [0048.619] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.619] lstrlenW (lpString=".xls") returned 4 [0048.619] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.619] lstrlenW (lpString=".xlsx") returned 5 [0048.619] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.619] lstrlenW (lpString=".ppt") returned 4 [0048.619] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.619] lstrlenW (lpString=".zip") returned 4 [0048.619] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.619] lstrlenW (lpString=".rar") returned 4 [0048.619] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.619] lstrlenW (lpString=".bz2") returned 4 [0048.619] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.619] lstrlenW (lpString=".7z") returned 3 [0048.619] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.619] lstrlenW (lpString=".dbf") returned 4 [0048.619] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.619] lstrlenW (lpString=".1cd") returned 4 [0048.619] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.619] lstrlenW (lpString=".jpg") returned 4 [0048.619] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.619] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.619] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.620] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1423) returned 1 [0048.620] CloseHandle (hObject=0x21c) returned 1 [0048.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0048.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.620] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.620] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.622] GetLastError () returned 0x0 [0048.622] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x58f, lpOverlapped=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x590, lpOverlapped=0x0) returned 1 [0048.624] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.624] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.624] SetEndOfFile (hFile=0x1f0) returned 1 [0048.624] CloseHandle (hObject=0x1f0) returned 1 [0048.625] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.625] SetEndOfFile (hFile=0x21c) returned 1 [0048.625] CloseHandle (hObject=0x21c) returned 1 [0048.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.626] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0048.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.626] lstrlenW (lpString=".doc") returned 4 [0048.626] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.626] lstrlenW (lpString=".docx") returned 5 [0048.626] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.626] lstrlenW (lpString=".pdf") returned 4 [0048.626] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.626] lstrlenW (lpString=".xls") returned 4 [0048.626] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.626] lstrlenW (lpString=".xlsx") returned 5 [0048.626] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.626] lstrlenW (lpString=".ppt") returned 4 [0048.626] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.626] lstrlenW (lpString=".zip") returned 4 [0048.626] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.626] lstrlenW (lpString=".rar") returned 4 [0048.626] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.626] lstrlenW (lpString=".bz2") returned 4 [0048.626] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.626] lstrlenW (lpString=".7z") returned 3 [0048.627] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString=".dbf") returned 4 [0048.627] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString=".1cd") returned 4 [0048.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString=".jpg") returned 4 [0048.627] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString=".doc") returned 4 [0048.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.627] lstrlenW (lpString=".docx") returned 5 [0048.627] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.627] lstrlenW (lpString=".pdf") returned 4 [0048.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString=".xls") returned 4 [0048.627] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString=".xlsx") returned 5 [0048.627] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.627] lstrlenW (lpString=".ppt") returned 4 [0048.627] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.627] lstrlenW (lpString=".zip") returned 4 [0048.627] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString=".rar") returned 4 [0048.627] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.627] lstrlenW (lpString=".bz2") returned 4 [0048.627] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.627] lstrlenW (lpString=".7z") returned 3 [0048.628] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.628] lstrlenW (lpString=".dbf") returned 4 [0048.628] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.628] lstrlenW (lpString=".1cd") returned 4 [0048.628] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.628] lstrlenW (lpString=".jpg") returned 4 [0048.628] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.628] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.628] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.628] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15737) returned 1 [0048.628] CloseHandle (hObject=0x21c) returned 1 [0048.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0048.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.629] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.629] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.629] GetLastError () returned 0x0 [0048.629] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0048.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0048.632] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.632] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.632] SetEndOfFile (hFile=0x1f0) returned 1 [0048.632] CloseHandle (hObject=0x1f0) returned 1 [0048.632] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.632] SetEndOfFile (hFile=0x21c) returned 1 [0048.633] CloseHandle (hObject=0x21c) returned 1 [0048.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0048.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.634] lstrlenW (lpString=".doc") returned 4 [0048.634] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.634] lstrlenW (lpString=".docx") returned 5 [0048.634] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.634] lstrlenW (lpString=".pdf") returned 4 [0048.634] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.634] lstrlenW (lpString=".xls") returned 4 [0048.634] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.634] lstrlenW (lpString=".xlsx") returned 5 [0048.634] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.634] lstrlenW (lpString=".ppt") returned 4 [0048.634] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.634] lstrlenW (lpString=".zip") returned 4 [0048.634] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.634] lstrlenW (lpString=".rar") returned 4 [0048.634] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.634] lstrlenW (lpString=".bz2") returned 4 [0048.634] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.634] lstrlenW (lpString=".7z") returned 3 [0048.634] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.634] lstrlenW (lpString=".dbf") returned 4 [0048.634] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.634] lstrlenW (lpString=".1cd") returned 4 [0048.635] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString=".jpg") returned 4 [0048.635] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString=".doc") returned 4 [0048.635] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString=".docx") returned 5 [0048.635] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.635] lstrlenW (lpString=".pdf") returned 4 [0048.635] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString=".xls") returned 4 [0048.635] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.635] lstrlenW (lpString=".xlsx") returned 5 [0048.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.635] lstrlenW (lpString=".ppt") returned 4 [0048.635] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString=".zip") returned 4 [0048.635] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.635] lstrlenW (lpString=".rar") returned 4 [0048.635] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.635] lstrlenW (lpString=".bz2") returned 4 [0048.635] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString=".7z") returned 3 [0048.635] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString=".dbf") returned 4 [0048.635] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.635] lstrlenW (lpString=".1cd") returned 4 [0048.635] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.636] lstrlenW (lpString=".jpg") returned 4 [0048.636] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.636] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.636] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.636] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3970) returned 1 [0048.636] CloseHandle (hObject=0x21c) returned 1 [0048.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0048.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.637] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.637] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.638] GetLastError () returned 0x0 [0048.638] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf82, lpOverlapped=0x0) returned 1 [0048.640] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0048.641] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.641] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.641] SetEndOfFile (hFile=0x1f0) returned 1 [0048.641] CloseHandle (hObject=0x1f0) returned 1 [0048.641] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.641] SetEndOfFile (hFile=0x21c) returned 1 [0048.642] CloseHandle (hObject=0x21c) returned 1 [0048.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString=".doc") returned 4 [0048.643] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.643] lstrlenW (lpString=".docx") returned 5 [0048.643] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.643] lstrlenW (lpString=".pdf") returned 4 [0048.643] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.643] lstrlenW (lpString=".xls") returned 4 [0048.643] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.643] lstrlenW (lpString=".xlsx") returned 5 [0048.643] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.643] lstrlenW (lpString=".ppt") returned 4 [0048.643] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString=".zip") returned 4 [0048.643] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.643] lstrlenW (lpString=".rar") returned 4 [0048.643] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.643] lstrlenW (lpString=".bz2") returned 4 [0048.643] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.643] lstrlenW (lpString=".7z") returned 3 [0048.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString=".dbf") returned 4 [0048.643] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString=".1cd") returned 4 [0048.643] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.643] lstrlenW (lpString=".jpg") returned 4 [0048.643] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString=".doc") returned 4 [0048.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.644] lstrlenW (lpString=".docx") returned 5 [0048.644] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.644] lstrlenW (lpString=".pdf") returned 4 [0048.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString=".xls") returned 4 [0048.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString=".xlsx") returned 5 [0048.644] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.644] lstrlenW (lpString=".ppt") returned 4 [0048.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString=".zip") returned 4 [0048.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString=".rar") returned 4 [0048.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.644] lstrlenW (lpString=".bz2") returned 4 [0048.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.644] lstrlenW (lpString=".7z") returned 3 [0048.644] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString=".dbf") returned 4 [0048.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString=".1cd") returned 4 [0048.644] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.644] lstrlenW (lpString=".jpg") returned 4 [0048.644] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.645] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.645] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.645] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=53115) returned 1 [0048.645] CloseHandle (hObject=0x21c) returned 1 [0048.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0048.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.645] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.645] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.646] GetLastError () returned 0x0 [0048.646] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0048.865] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0048.866] ReadFile (in: hFile=0x21c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.866] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.867] SetEndOfFile (hFile=0x1f0) returned 1 [0048.867] CloseHandle (hObject=0x1f0) returned 1 [0048.867] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.867] SetEndOfFile (hFile=0x21c) returned 1 [0048.868] CloseHandle (hObject=0x21c) returned 1 [0048.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.868] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0048.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.868] lstrlenW (lpString=".doc") returned 4 [0048.868] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.868] lstrlenW (lpString=".docx") returned 5 [0048.868] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.869] lstrlenW (lpString=".pdf") returned 4 [0048.869] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString=".xls") returned 4 [0048.869] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.869] lstrlenW (lpString=".xlsx") returned 5 [0048.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.869] lstrlenW (lpString=".ppt") returned 4 [0048.869] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString=".zip") returned 4 [0048.869] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.869] lstrlenW (lpString=".rar") returned 4 [0048.869] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.869] lstrlenW (lpString=".bz2") returned 4 [0048.869] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString=".7z") returned 3 [0048.869] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString=".dbf") returned 4 [0048.869] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString=".1cd") returned 4 [0048.869] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString=".jpg") returned 4 [0048.869] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.869] lstrlenW (lpString=".doc") returned 4 [0048.869] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.869] lstrlenW (lpString=".docx") returned 5 [0048.869] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.870] lstrlenW (lpString=".pdf") returned 4 [0048.870] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.870] lstrlenW (lpString=".xls") returned 4 [0048.870] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.870] lstrlenW (lpString=".xlsx") returned 5 [0048.870] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.870] lstrlenW (lpString=".ppt") returned 4 [0048.870] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.870] lstrlenW (lpString=".zip") returned 4 [0048.870] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.870] lstrlenW (lpString=".rar") returned 4 [0048.870] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.870] lstrlenW (lpString=".bz2") returned 4 [0048.870] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.870] lstrlenW (lpString=".7z") returned 3 [0048.870] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.870] lstrlenW (lpString=".dbf") returned 4 [0048.870] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.870] lstrlenW (lpString=".1cd") returned 4 [0048.870] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.870] lstrlenW (lpString=".jpg") returned 4 [0048.870] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.870] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.870] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.097] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31975) returned 1 [0049.097] CloseHandle (hObject=0x1ec) returned 1 [0049.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0049.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.111] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.111] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.130] GetLastError () returned 0x0 [0049.130] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0049.132] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0049.134] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.134] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.134] SetEndOfFile (hFile=0x210) returned 1 [0049.134] CloseHandle (hObject=0x210) returned 1 [0049.134] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.134] SetEndOfFile (hFile=0x1ec) returned 1 [0049.195] CloseHandle (hObject=0x1ec) returned 1 [0049.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.195] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.195] lstrlenW (lpString=".doc") returned 4 [0049.195] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.195] lstrlenW (lpString=".docx") returned 5 [0049.195] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.195] lstrlenW (lpString=".pdf") returned 4 [0049.195] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.195] lstrlenW (lpString=".xls") returned 4 [0049.195] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.196] lstrlenW (lpString=".xlsx") returned 5 [0049.196] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.196] lstrlenW (lpString=".ppt") returned 4 [0049.196] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString=".zip") returned 4 [0049.196] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.196] lstrlenW (lpString=".rar") returned 4 [0049.196] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.196] lstrlenW (lpString=".bz2") returned 4 [0049.196] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.196] lstrlenW (lpString=".7z") returned 3 [0049.196] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString=".dbf") returned 4 [0049.196] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString=".1cd") returned 4 [0049.196] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString=".jpg") returned 4 [0049.196] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.196] lstrlenW (lpString=".doc") returned 4 [0049.196] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.196] lstrlenW (lpString=".docx") returned 5 [0049.196] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.196] lstrlenW (lpString=".pdf") returned 4 [0049.196] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.197] lstrlenW (lpString=".xls") returned 4 [0049.197] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.197] lstrlenW (lpString=".xlsx") returned 5 [0049.197] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.197] lstrlenW (lpString=".ppt") returned 4 [0049.197] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.197] lstrlenW (lpString=".zip") returned 4 [0049.197] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.197] lstrlenW (lpString=".rar") returned 4 [0049.197] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.197] lstrlenW (lpString=".bz2") returned 4 [0049.197] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.197] lstrlenW (lpString=".7z") returned 3 [0049.197] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.197] lstrlenW (lpString=".dbf") returned 4 [0049.197] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.197] lstrlenW (lpString=".1cd") returned 4 [0049.197] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.197] lstrlenW (lpString=".jpg") returned 4 [0049.197] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.197] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.198] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.198] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2527) returned 1 [0049.198] CloseHandle (hObject=0x1ec) returned 1 [0049.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0049.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.199] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.199] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.201] GetLastError () returned 0x0 [0049.201] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9df, lpOverlapped=0x0) returned 1 [0049.203] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0049.206] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.206] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.206] SetEndOfFile (hFile=0x210) returned 1 [0049.206] CloseHandle (hObject=0x210) returned 1 [0049.207] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.207] SetEndOfFile (hFile=0x1ec) returned 1 [0049.207] CloseHandle (hObject=0x1ec) returned 1 [0049.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0049.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.208] lstrlenW (lpString=".doc") returned 4 [0049.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.208] lstrlenW (lpString=".docx") returned 5 [0049.208] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.208] lstrlenW (lpString=".pdf") returned 4 [0049.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.208] lstrlenW (lpString=".xls") returned 4 [0049.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.208] lstrlenW (lpString=".xlsx") returned 5 [0049.208] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.208] lstrlenW (lpString=".ppt") returned 4 [0049.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.208] lstrlenW (lpString=".zip") returned 4 [0049.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.208] lstrlenW (lpString=".rar") returned 4 [0049.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.208] lstrlenW (lpString=".bz2") returned 4 [0049.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.209] lstrlenW (lpString=".7z") returned 3 [0049.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString=".dbf") returned 4 [0049.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString=".1cd") returned 4 [0049.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString=".jpg") returned 4 [0049.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString=".doc") returned 4 [0049.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.209] lstrlenW (lpString=".docx") returned 5 [0049.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.209] lstrlenW (lpString=".pdf") returned 4 [0049.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString=".xls") returned 4 [0049.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString=".xlsx") returned 5 [0049.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.209] lstrlenW (lpString=".ppt") returned 4 [0049.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.209] lstrlenW (lpString=".zip") returned 4 [0049.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString=".rar") returned 4 [0049.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString=".bz2") returned 4 [0049.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString=".7z") returned 3 [0049.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.210] lstrlenW (lpString=".dbf") returned 4 [0049.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.210] lstrlenW (lpString=".1cd") returned 4 [0049.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.210] lstrlenW (lpString=".jpg") returned 4 [0049.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.211] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19525) returned 1 [0049.211] CloseHandle (hObject=0x1ec) returned 1 [0049.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0049.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.211] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.211] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.211] GetLastError () returned 0x0 [0049.212] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0049.214] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0049.215] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.215] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.215] SetEndOfFile (hFile=0x210) returned 1 [0049.215] CloseHandle (hObject=0x210) returned 1 [0049.215] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.215] SetEndOfFile (hFile=0x1ec) returned 1 [0049.216] CloseHandle (hObject=0x1ec) returned 1 [0049.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.217] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0049.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.217] lstrlenW (lpString=".doc") returned 4 [0049.217] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.217] lstrlenW (lpString=".docx") returned 5 [0049.217] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.217] lstrlenW (lpString=".pdf") returned 4 [0049.217] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.217] lstrlenW (lpString=".xls") returned 4 [0049.217] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.217] lstrlenW (lpString=".xlsx") returned 5 [0049.217] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.217] lstrlenW (lpString=".ppt") returned 4 [0049.217] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.217] lstrlenW (lpString=".zip") returned 4 [0049.217] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.217] lstrlenW (lpString=".rar") returned 4 [0049.217] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.217] lstrlenW (lpString=".bz2") returned 4 [0049.217] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.217] lstrlenW (lpString=".7z") returned 3 [0049.217] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.218] lstrlenW (lpString=".dbf") returned 4 [0049.218] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.218] lstrlenW (lpString=".1cd") returned 4 [0049.218] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.218] lstrlenW (lpString=".jpg") returned 4 [0049.218] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.218] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1737) returned 1 [0049.218] CloseHandle (hObject=0x1ec) returned 1 [0049.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0049.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.219] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.219] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.220] GetLastError () returned 0x0 [0049.220] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0049.222] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0049.223] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.223] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.223] SetEndOfFile (hFile=0x210) returned 1 [0049.223] CloseHandle (hObject=0x210) returned 1 [0049.223] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.223] SetEndOfFile (hFile=0x1ec) returned 1 [0049.224] CloseHandle (hObject=0x1ec) returned 1 [0049.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.224] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0049.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.224] lstrlenW (lpString=".doc") returned 4 [0049.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.224] lstrlenW (lpString=".docx") returned 5 [0049.224] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.225] lstrlenW (lpString=".pdf") returned 4 [0049.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.225] lstrlenW (lpString=".xls") returned 4 [0049.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.225] lstrlenW (lpString=".xlsx") returned 5 [0049.225] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.225] lstrlenW (lpString=".ppt") returned 4 [0049.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.225] lstrlenW (lpString=".zip") returned 4 [0049.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.225] lstrlenW (lpString=".rar") returned 4 [0049.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.225] lstrlenW (lpString=".bz2") returned 4 [0049.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.225] lstrlenW (lpString=".7z") returned 3 [0049.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.225] lstrlenW (lpString=".dbf") returned 4 [0049.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.225] lstrlenW (lpString=".1cd") returned 4 [0049.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.225] lstrlenW (lpString=".jpg") returned 4 [0049.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.226] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33479) returned 1 [0049.226] CloseHandle (hObject=0x1ec) returned 1 [0049.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0049.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.226] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.226] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.226] GetLastError () returned 0x0 [0049.226] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0049.433] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0049.906] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.906] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.906] SetEndOfFile (hFile=0x210) returned 1 [0049.906] CloseHandle (hObject=0x210) returned 1 [0049.906] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.906] SetEndOfFile (hFile=0x1ec) returned 1 [0049.907] CloseHandle (hObject=0x1ec) returned 1 [0049.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0049.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.908] lstrlenW (lpString=".doc") returned 4 [0049.908] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.908] lstrlenW (lpString=".docx") returned 5 [0049.908] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.908] lstrlenW (lpString=".pdf") returned 4 [0049.908] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.908] lstrlenW (lpString=".xls") returned 4 [0049.908] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.908] lstrlenW (lpString=".xlsx") returned 5 [0049.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.908] lstrlenW (lpString=".ppt") returned 4 [0049.908] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.908] lstrlenW (lpString=".zip") returned 4 [0049.908] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.908] lstrlenW (lpString=".rar") returned 4 [0049.908] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.908] lstrlenW (lpString=".bz2") returned 4 [0049.908] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.908] lstrlenW (lpString=".7z") returned 3 [0049.908] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.908] lstrlenW (lpString=".dbf") returned 4 [0049.909] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.909] lstrlenW (lpString=".1cd") returned 4 [0049.909] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.909] lstrlenW (lpString=".jpg") returned 4 [0049.909] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.998] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=58026) returned 1 [0049.998] CloseHandle (hObject=0x1ec) returned 1 [0049.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0049.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.998] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.999] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.999] GetLastError () returned 0x0 [0049.999] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0050.001] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0050.003] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.003] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.003] SetEndOfFile (hFile=0x210) returned 1 [0050.003] CloseHandle (hObject=0x210) returned 1 [0050.003] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.003] SetEndOfFile (hFile=0x1ec) returned 1 [0050.004] CloseHandle (hObject=0x1ec) returned 1 [0050.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0050.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.005] lstrlenW (lpString=".doc") returned 4 [0050.005] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString=".docx") returned 5 [0050.005] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.005] lstrlenW (lpString=".pdf") returned 4 [0050.005] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString=".xls") returned 4 [0050.005] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString=".xlsx") returned 5 [0050.005] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.005] lstrlenW (lpString=".ppt") returned 4 [0050.005] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.005] lstrlenW (lpString=".zip") returned 4 [0050.005] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString=".rar") returned 4 [0050.005] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.005] lstrlenW (lpString=".bz2") returned 4 [0050.005] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.006] lstrlenW (lpString=".7z") returned 3 [0050.006] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.006] lstrlenW (lpString=".dbf") returned 4 [0050.006] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.006] lstrlenW (lpString=".1cd") returned 4 [0050.006] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.006] lstrlenW (lpString=".jpg") returned 4 [0050.006] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.006] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=123956) returned 1 [0050.006] CloseHandle (hObject=0x1ec) returned 1 [0050.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0050.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.007] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.007] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.007] GetLastError () returned 0x0 [0050.007] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0050.011] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0050.013] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.013] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.013] SetEndOfFile (hFile=0x210) returned 1 [0050.013] CloseHandle (hObject=0x210) returned 1 [0050.014] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.014] SetEndOfFile (hFile=0x1ec) returned 1 [0050.015] CloseHandle (hObject=0x1ec) returned 1 [0050.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString=".doc") returned 4 [0050.016] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".docx") returned 5 [0050.016] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.016] lstrlenW (lpString=".pdf") returned 4 [0050.016] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".xls") returned 4 [0050.016] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".xlsx") returned 5 [0050.016] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.016] lstrlenW (lpString=".ppt") returned 4 [0050.016] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString=".zip") returned 4 [0050.016] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".rar") returned 4 [0050.016] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".bz2") returned 4 [0050.016] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.016] lstrlenW (lpString=".7z") returned 3 [0050.016] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString=".dbf") returned 4 [0050.016] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString=".1cd") returned 4 [0050.016] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.016] lstrlenW (lpString=".jpg") returned 4 [0050.016] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.017] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=416918) returned 1 [0050.017] CloseHandle (hObject=0x1ec) returned 1 [0050.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0050.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.018] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.018] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.018] GetLastError () returned 0x0 [0050.018] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0050.030] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0050.037] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.037] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.037] SetEndOfFile (hFile=0x210) returned 1 [0050.037] CloseHandle (hObject=0x210) returned 1 [0050.037] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.037] SetEndOfFile (hFile=0x1ec) returned 1 [0050.319] CloseHandle (hObject=0x1ec) returned 1 [0050.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0050.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.319] lstrlenW (lpString=".doc") returned 4 [0050.319] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.319] lstrlenW (lpString=".docx") returned 5 [0050.319] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.319] lstrlenW (lpString=".pdf") returned 4 [0050.319] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.319] lstrlenW (lpString=".xls") returned 4 [0050.319] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.319] lstrlenW (lpString=".xlsx") returned 5 [0050.319] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.319] lstrlenW (lpString=".ppt") returned 4 [0050.319] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.319] lstrlenW (lpString=".zip") returned 4 [0050.319] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.320] lstrlenW (lpString=".rar") returned 4 [0050.320] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.320] lstrlenW (lpString=".bz2") returned 4 [0050.320] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.320] lstrlenW (lpString=".7z") returned 3 [0050.320] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.320] lstrlenW (lpString=".dbf") returned 4 [0050.320] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.320] lstrlenW (lpString=".1cd") returned 4 [0050.320] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.320] lstrlenW (lpString=".jpg") returned 4 [0050.320] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.639] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14610) returned 1 [0050.639] CloseHandle (hObject=0x1f4) returned 1 [0050.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0050.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.639] lstrlenW (lpString=".doc") returned 4 [0050.639] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.639] lstrlenW (lpString=".docx") returned 5 [0050.639] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.639] lstrlenW (lpString=".pdf") returned 4 [0050.639] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.639] lstrlenW (lpString=".xls") returned 4 [0050.639] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.639] lstrlenW (lpString=".xlsx") returned 5 [0050.639] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.639] lstrlenW (lpString=".ppt") returned 4 [0050.639] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.640] lstrlenW (lpString=".zip") returned 4 [0050.640] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.640] lstrlenW (lpString=".rar") returned 4 [0050.640] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.640] lstrlenW (lpString=".bz2") returned 4 [0050.640] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.640] lstrlenW (lpString=".7z") returned 3 [0050.640] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.640] lstrlenW (lpString=".dbf") returned 4 [0050.640] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.640] lstrlenW (lpString=".1cd") returned 4 [0050.640] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.640] lstrlenW (lpString=".jpg") returned 4 [0050.640] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.825] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3304) returned 1 [0050.825] CloseHandle (hObject=0x1f0) returned 1 [0050.826] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0050.826] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.826] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.826] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.826] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.826] lstrlenW (lpString=".doc") returned 4 [0050.826] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.826] lstrlenW (lpString=".docx") returned 5 [0050.826] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.826] lstrlenW (lpString=".pdf") returned 4 [0050.826] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.826] lstrlenW (lpString=".xls") returned 4 [0050.826] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.826] lstrlenW (lpString=".xlsx") returned 5 [0050.826] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.826] lstrlenW (lpString=".ppt") returned 4 [0050.826] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.826] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.826] lstrlenW (lpString=".zip") returned 4 [0050.826] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.826] lstrlenW (lpString=".rar") returned 4 [0050.826] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.826] lstrlenW (lpString=".bz2") returned 4 [0050.826] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.826] lstrlenW (lpString=".7z") returned 3 [0050.827] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.827] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.827] lstrlenW (lpString=".dbf") returned 4 [0050.827] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.827] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.827] lstrlenW (lpString=".1cd") returned 4 [0050.827] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.827] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0050.827] lstrlenW (lpString=".jpg") returned 4 [0050.827] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.230] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=49904) returned 1 [0051.230] CloseHandle (hObject=0x180) returned 1 [0051.230] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0051.230] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.230] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.230] lstrlenW (lpString=".doc") returned 4 [0051.231] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.231] lstrlenW (lpString=".docx") returned 5 [0051.231] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0051.231] lstrlenW (lpString=".pdf") returned 4 [0051.231] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.231] lstrlenW (lpString=".xls") returned 4 [0051.231] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.231] lstrlenW (lpString=".xlsx") returned 5 [0051.231] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0051.231] lstrlenW (lpString=".ppt") returned 4 [0051.231] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.231] lstrlenW (lpString=".zip") returned 4 [0051.231] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.231] lstrlenW (lpString=".rar") returned 4 [0051.231] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.231] lstrlenW (lpString=".bz2") returned 4 [0051.231] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.231] lstrlenW (lpString=".7z") returned 3 [0051.231] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.231] lstrlenW (lpString=".dbf") returned 4 [0051.231] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.231] lstrlenW (lpString=".1cd") returned 4 [0051.231] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0051.231] lstrlenW (lpString=".jpg") returned 4 [0051.231] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.234] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=77208) returned 1 [0051.234] CloseHandle (hObject=0x180) returned 1 [0051.234] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0051.234] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.234] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.234] lstrlenW (lpString=".doc") returned 4 [0051.234] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.234] lstrlenW (lpString=".docx") returned 5 [0051.234] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0051.234] lstrlenW (lpString=".pdf") returned 4 [0051.234] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.234] lstrlenW (lpString=".xls") returned 4 [0051.234] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.235] lstrlenW (lpString=".xlsx") returned 5 [0051.235] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0051.235] lstrlenW (lpString=".ppt") returned 4 [0051.235] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.235] lstrlenW (lpString=".zip") returned 4 [0051.235] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.235] lstrlenW (lpString=".rar") returned 4 [0051.235] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.235] lstrlenW (lpString=".bz2") returned 4 [0051.235] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.235] lstrlenW (lpString=".7z") returned 3 [0051.235] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.235] lstrlenW (lpString=".dbf") returned 4 [0051.235] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.235] lstrlenW (lpString=".1cd") returned 4 [0051.235] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0051.235] lstrlenW (lpString=".jpg") returned 4 [0051.235] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.235] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=85208) returned 1 [0051.235] CloseHandle (hObject=0x180) returned 1 [0051.235] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0051.236] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.236] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.236] lstrlenW (lpString=".doc") returned 4 [0051.236] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString=".docx") returned 5 [0051.236] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.236] lstrlenW (lpString=".pdf") returned 4 [0051.236] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString=".xls") returned 4 [0051.236] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.236] lstrlenW (lpString=".xlsx") returned 5 [0051.236] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.236] lstrlenW (lpString=".ppt") returned 4 [0051.236] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.236] lstrlenW (lpString=".zip") returned 4 [0051.236] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.236] lstrlenW (lpString=".rar") returned 4 [0051.236] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString=".bz2") returned 4 [0051.236] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString=".7z") returned 3 [0051.236] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.236] lstrlenW (lpString=".dbf") returned 4 [0051.236] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.236] lstrlenW (lpString=".1cd") returned 4 [0051.236] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0051.237] lstrlenW (lpString=".jpg") returned 4 [0051.237] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.237] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=157208) returned 1 [0051.237] CloseHandle (hObject=0x180) returned 1 [0051.237] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0051.237] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.237] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.237] lstrlenW (lpString=".doc") returned 4 [0051.237] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.237] lstrlenW (lpString=".docx") returned 5 [0051.237] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0051.237] lstrlenW (lpString=".pdf") returned 4 [0051.237] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.237] lstrlenW (lpString=".xls") returned 4 [0051.237] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.237] lstrlenW (lpString=".xlsx") returned 5 [0051.237] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0051.238] lstrlenW (lpString=".ppt") returned 4 [0051.238] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.238] lstrlenW (lpString=".zip") returned 4 [0051.238] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.238] lstrlenW (lpString=".rar") returned 4 [0051.238] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.238] lstrlenW (lpString=".bz2") returned 4 [0051.238] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.238] lstrlenW (lpString=".7z") returned 3 [0051.238] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.238] lstrlenW (lpString=".dbf") returned 4 [0051.238] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.238] lstrlenW (lpString=".1cd") returned 4 [0051.238] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0051.238] lstrlenW (lpString=".jpg") returned 4 [0051.238] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.238] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=165208) returned 1 [0051.238] CloseHandle (hObject=0x180) returned 1 [0051.238] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0051.238] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.239] lstrlenW (lpString=".doc") returned 4 [0051.239] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString=".docx") returned 5 [0051.239] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.239] lstrlenW (lpString=".pdf") returned 4 [0051.239] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString=".xls") returned 4 [0051.239] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.239] lstrlenW (lpString=".xlsx") returned 5 [0051.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.239] lstrlenW (lpString=".ppt") returned 4 [0051.239] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.239] lstrlenW (lpString=".zip") returned 4 [0051.239] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.239] lstrlenW (lpString=".rar") returned 4 [0051.239] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString=".bz2") returned 4 [0051.239] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString=".7z") returned 3 [0051.239] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.239] lstrlenW (lpString=".dbf") returned 4 [0051.239] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.239] lstrlenW (lpString=".1cd") returned 4 [0051.239] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0051.240] lstrlenW (lpString=".jpg") returned 4 [0051.240] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.241] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=189214) returned 1 [0051.241] CloseHandle (hObject=0x180) returned 1 [0051.241] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0051.241] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.242] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString=".doc") returned 4 [0051.242] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString=".docx") returned 5 [0051.242] lstrcmpiW (lpString1=".docx", lpString2="b.wmv") returned -1 [0051.242] lstrlenW (lpString=".pdf") returned 4 [0051.242] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString=".xls") returned 4 [0051.242] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.242] lstrlenW (lpString=".xlsx") returned 5 [0051.242] lstrcmpiW (lpString1=".xlsx", lpString2="b.wmv") returned -1 [0051.242] lstrlenW (lpString=".ppt") returned 4 [0051.242] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString=".zip") returned 4 [0051.242] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.242] lstrlenW (lpString=".rar") returned 4 [0051.242] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString=".bz2") returned 4 [0051.242] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString=".7z") returned 3 [0051.242] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString=".dbf") returned 4 [0051.242] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString=".1cd") returned 4 [0051.242] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 73 [0051.242] lstrlenW (lpString=".jpg") returned 4 [0051.243] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.243] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=237208) returned 1 [0051.243] CloseHandle (hObject=0x180) returned 1 [0051.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0051.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.243] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.243] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.243] lstrlenW (lpString=".doc") returned 4 [0051.243] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.243] lstrlenW (lpString=".docx") returned 5 [0051.243] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.243] lstrlenW (lpString=".pdf") returned 4 [0051.243] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.243] lstrlenW (lpString=".xls") returned 4 [0051.243] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.243] lstrlenW (lpString=".xlsx") returned 5 [0051.243] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.243] lstrlenW (lpString=".ppt") returned 4 [0051.243] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.243] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.243] lstrlenW (lpString=".zip") returned 4 [0051.244] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.244] lstrlenW (lpString=".rar") returned 4 [0051.244] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.244] lstrlenW (lpString=".bz2") returned 4 [0051.244] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.244] lstrlenW (lpString=".7z") returned 3 [0051.244] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.244] lstrlenW (lpString=".dbf") returned 4 [0051.244] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.244] lstrlenW (lpString=".1cd") returned 4 [0051.244] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 77 [0051.244] lstrlenW (lpString=".jpg") returned 4 [0051.244] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.244] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1545) returned 1 [0051.244] CloseHandle (hObject=0x180) returned 1 [0051.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0051.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString=".doc") returned 4 [0051.245] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.245] lstrlenW (lpString=".docx") returned 5 [0051.245] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.245] lstrlenW (lpString=".pdf") returned 4 [0051.245] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.245] lstrlenW (lpString=".xls") returned 4 [0051.245] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.245] lstrlenW (lpString=".xlsx") returned 5 [0051.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.245] lstrlenW (lpString=".ppt") returned 4 [0051.245] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString=".zip") returned 4 [0051.245] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.245] lstrlenW (lpString=".rar") returned 4 [0051.245] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.245] lstrlenW (lpString=".bz2") returned 4 [0051.245] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.245] lstrlenW (lpString=".7z") returned 3 [0051.245] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString=".dbf") returned 4 [0051.245] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString=".1cd") returned 4 [0051.245] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0051.245] lstrlenW (lpString=".jpg") returned 4 [0051.245] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.246] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9115) returned 1 [0051.246] CloseHandle (hObject=0x180) returned 1 [0051.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0051.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.246] lstrlenW (lpString=".doc") returned 4 [0051.246] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.246] lstrlenW (lpString=".docx") returned 5 [0051.246] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0051.246] lstrlenW (lpString=".pdf") returned 4 [0051.246] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.246] lstrlenW (lpString=".xls") returned 4 [0051.246] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.246] lstrlenW (lpString=".xlsx") returned 5 [0051.246] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0051.246] lstrlenW (lpString=".ppt") returned 4 [0051.246] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.246] lstrlenW (lpString=".zip") returned 4 [0051.246] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.246] lstrlenW (lpString=".rar") returned 4 [0051.247] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.247] lstrlenW (lpString=".bz2") returned 4 [0051.247] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.247] lstrlenW (lpString=".7z") returned 3 [0051.247] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.247] lstrlenW (lpString=".dbf") returned 4 [0051.247] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.247] lstrlenW (lpString=".1cd") returned 4 [0051.247] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 71 [0051.247] lstrlenW (lpString=".jpg") returned 4 [0051.247] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.248] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1369) returned 1 [0051.248] CloseHandle (hObject=0x180) returned 1 [0051.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0051.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.248] lstrlenW (lpString=".doc") returned 4 [0051.248] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.248] lstrlenW (lpString=".docx") returned 5 [0051.248] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.248] lstrlenW (lpString=".pdf") returned 4 [0051.248] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.248] lstrlenW (lpString=".xls") returned 4 [0051.248] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.248] lstrlenW (lpString=".xlsx") returned 5 [0051.248] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.248] lstrlenW (lpString=".ppt") returned 4 [0051.248] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.248] lstrlenW (lpString=".zip") returned 4 [0051.248] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.248] lstrlenW (lpString=".rar") returned 4 [0051.248] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.248] lstrlenW (lpString=".bz2") returned 4 [0051.249] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.249] lstrlenW (lpString=".7z") returned 3 [0051.249] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.249] lstrlenW (lpString=".dbf") returned 4 [0051.249] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.249] lstrlenW (lpString=".1cd") returned 4 [0051.249] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0051.249] lstrlenW (lpString=".jpg") returned 4 [0051.249] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.249] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1285) returned 1 [0051.249] CloseHandle (hObject=0x180) returned 1 [0051.249] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0051.249] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.249] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 68 [0051.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 68 [0051.250] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4726) returned 1 [0051.250] CloseHandle (hObject=0x1a8) returned 1 [0051.250] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0051.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.251] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27281) returned 1 [0051.251] CloseHandle (hObject=0x1a8) returned 1 [0051.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0051.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.252] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3878) returned 1 [0051.252] CloseHandle (hObject=0x1a8) returned 1 [0051.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0051.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.253] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5059) returned 1 [0051.253] CloseHandle (hObject=0x1a8) returned 1 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.253] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.253] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27281) returned 1 [0051.253] CloseHandle (hObject=0x1a8) returned 1 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0051.253] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.253] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.254] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0051.254] CloseHandle (hObject=0x1a8) returned 1 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.254] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.254] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3878) returned 1 [0051.254] CloseHandle (hObject=0x1a8) returned 1 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.254] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.255] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3215) returned 1 [0051.255] CloseHandle (hObject=0x1a8) returned 1 [0051.255] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0051.255] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.256] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.256] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5059) returned 1 [0051.256] CloseHandle (hObject=0x1a8) returned 1 [0051.256] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0051.256] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.256] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.256] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0051.256] CloseHandle (hObject=0x1a8) returned 1 [0051.256] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0051.256] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.257] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=23711) returned 1 [0051.257] CloseHandle (hObject=0x1a8) returned 1 [0051.257] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0051.257] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.263] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0051.263] CloseHandle (hObject=0x1a8) returned 1 [0051.263] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0051.263] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.264] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2820) returned 1 [0051.264] CloseHandle (hObject=0x180) returned 1 [0051.264] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0051.264] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.265] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0051.265] CloseHandle (hObject=0x180) returned 1 [0051.265] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0051.266] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.773] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0051.773] CloseHandle (hObject=0x17c) returned 1 [0051.774] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0051.774] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.033] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10254) returned 1 [0052.033] CloseHandle (hObject=0x180) returned 1 [0052.033] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0052.033] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.033] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.033] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2374) returned 1 [0052.033] CloseHandle (hObject=0x180) returned 1 [0052.034] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0052.034] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.034] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27581) returned 1 [0052.034] CloseHandle (hObject=0x180) returned 1 [0052.034] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0052.034] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.034] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2899) returned 1 [0052.035] CloseHandle (hObject=0x180) returned 1 [0052.035] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0052.035] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.035] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.035] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10888) returned 1 [0052.035] CloseHandle (hObject=0x180) returned 1 [0052.035] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0052.035] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.035] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.036] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=108525) returned 1 [0052.036] CloseHandle (hObject=0x180) returned 1 [0052.036] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0052.036] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.037] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20346) returned 1 [0052.037] CloseHandle (hObject=0x180) returned 1 [0052.037] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0052.037] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.037] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=233668) returned 1 [0052.037] CloseHandle (hObject=0x180) returned 1 [0052.039] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0052.039] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.039] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.040] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4968) returned 1 [0052.040] CloseHandle (hObject=0x180) returned 1 [0052.040] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0052.040] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.042] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3143) returned 1 [0052.042] CloseHandle (hObject=0x180) returned 1 [0052.042] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0052.043] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.043] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4842) returned 1 [0052.043] CloseHandle (hObject=0x180) returned 1 [0052.044] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0052.044] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.044] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.044] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.044] CloseHandle (hObject=0x180) returned 1 [0052.044] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0052.044] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.044] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.044] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.044] CloseHandle (hObject=0x180) returned 1 [0052.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.045] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.045] CloseHandle (hObject=0x180) returned 1 [0052.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0052.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.046] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.046] CloseHandle (hObject=0x180) returned 1 [0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.046] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.047] CloseHandle (hObject=0x180) returned 1 [0052.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0052.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.047] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.047] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.047] CloseHandle (hObject=0x180) returned 1 [0052.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.047] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.047] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.048] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0052.048] CloseHandle (hObject=0x180) returned 1 [0052.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0052.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.048] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.049] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2821) returned 1 [0052.049] CloseHandle (hObject=0x180) returned 1 [0052.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0052.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.050] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6203) returned 1 [0052.050] CloseHandle (hObject=0x180) returned 1 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.050] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.050] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.050] CloseHandle (hObject=0x180) returned 1 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.051] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.051] CloseHandle (hObject=0x180) returned 1 [0052.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.051] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.051] CloseHandle (hObject=0x180) returned 1 [0052.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0052.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.052] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.052] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.052] CloseHandle (hObject=0x180) returned 1 [0052.052] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.052] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.052] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.052] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.052] CloseHandle (hObject=0x180) returned 1 [0052.052] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.053] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.053] CloseHandle (hObject=0x180) returned 1 [0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.053] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.053] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27789) returned 1 [0052.053] CloseHandle (hObject=0x180) returned 1 [0052.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0052.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.055] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3823) returned 1 [0052.055] CloseHandle (hObject=0x180) returned 1 [0052.055] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0052.055] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.056] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4456) returned 1 [0052.056] CloseHandle (hObject=0x180) returned 1 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.056] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3076) returned 1 [0052.056] CloseHandle (hObject=0x180) returned 1 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.057] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=693292) returned 1 [0052.057] CloseHandle (hObject=0x180) returned 1 [0052.057] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0052.057] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.058] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=781292) returned 1 [0052.058] CloseHandle (hObject=0x180) returned 1 [0052.058] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0052.058] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.058] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4525) returned 1 [0052.058] CloseHandle (hObject=0x180) returned 1 [0052.058] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0052.058] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.059] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3055) returned 1 [0052.059] CloseHandle (hObject=0x180) returned 1 [0052.059] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0052.059] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.060] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=25243) returned 1 [0052.060] CloseHandle (hObject=0x180) returned 1 [0052.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0052.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.060] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6922) returned 1 [0052.060] CloseHandle (hObject=0x180) returned 1 [0052.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0052.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.061] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.061] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4959) returned 1 [0052.061] CloseHandle (hObject=0x180) returned 1 [0052.061] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0052.061] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.061] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.061] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4503) returned 1 [0052.061] CloseHandle (hObject=0x180) returned 1 [0052.061] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0052.061] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.062] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3082) returned 1 [0052.062] CloseHandle (hObject=0x180) returned 1 [0052.062] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0052.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.063] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3108) returned 1 [0052.063] CloseHandle (hObject=0x180) returned 1 [0052.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0052.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.063] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=533292) returned 1 [0052.063] CloseHandle (hObject=0x180) returned 1 [0052.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0052.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.064] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=613292) returned 1 [0052.064] CloseHandle (hObject=0x180) returned 1 [0052.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0052.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.065] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=153) returned 1 [0052.065] CloseHandle (hObject=0x180) returned 1 [0052.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0052.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.065] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=132) returned 1 [0052.065] CloseHandle (hObject=0x180) returned 1 [0052.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0052.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.066] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.066] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1741316) returned 1 [0052.066] CloseHandle (hObject=0x180) returned 1 [0052.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20 [0052.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.066] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.067] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1901316) returned 1 [0052.067] CloseHandle (hObject=0x180) returned 1 [0052.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20 [0052.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.067] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.452] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=709220) returned 1 [0052.452] CloseHandle (hObject=0x224) returned 1 [0052.460] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0052.461] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.618] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=195804) returned 1 [0052.618] CloseHandle (hObject=0x224) returned 1 [0052.619] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0052.619] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.685] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.685] CloseHandle (hObject=0x160) returned 1 [0052.685] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0052.685] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.685] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.685] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.686] CloseHandle (hObject=0x160) returned 1 [0052.686] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0052.686] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.686] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.686] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.686] CloseHandle (hObject=0x160) returned 1 [0052.686] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0052.686] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.686] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.687] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.687] CloseHandle (hObject=0x160) returned 1 [0052.687] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0052.687] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.687] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.688] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.688] CloseHandle (hObject=0x160) returned 1 [0052.688] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0052.688] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.688] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.688] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.688] CloseHandle (hObject=0x160) returned 1 [0052.688] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0052.688] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.688] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.689] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.689] CloseHandle (hObject=0x160) returned 1 [0052.689] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0052.689] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.689] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.690] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0052.690] CloseHandle (hObject=0x160) returned 1 [0052.690] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0052.690] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.690] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2820) returned 1 [0052.690] CloseHandle (hObject=0x160) returned 1 [0052.691] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0052.691] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.691] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.694] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=23215) returned 1 [0052.694] CloseHandle (hObject=0x160) returned 1 [0052.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0052.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.694] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.694] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6431) returned 1 [0052.694] CloseHandle (hObject=0x160) returned 1 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.695] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.695] CloseHandle (hObject=0x160) returned 1 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.695] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.695] CloseHandle (hObject=0x160) returned 1 [0052.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.696] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.696] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.696] CloseHandle (hObject=0x160) returned 1 [0052.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0052.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.696] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.696] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.697] CloseHandle (hObject=0x160) returned 1 [0052.697] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.697] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.697] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.697] CloseHandle (hObject=0x160) returned 1 [0052.697] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0052.697] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.698] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.698] CloseHandle (hObject=0x160) returned 1 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.698] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.698] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=543910) returned 1 [0052.698] CloseHandle (hObject=0x160) returned 1 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.698] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.699] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=542466) returned 1 [0052.699] CloseHandle (hObject=0x160) returned 1 [0052.699] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0052.699] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.699] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5072) returned 1 [0052.699] CloseHandle (hObject=0x160) returned 1 [0052.699] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0052.699] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.700] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3462) returned 1 [0052.700] CloseHandle (hObject=0x160) returned 1 [0052.700] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0052.700] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.700] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.701] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3390) returned 1 [0052.701] CloseHandle (hObject=0x160) returned 1 [0052.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0052.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.701] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.701] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3214) returned 1 [0052.701] CloseHandle (hObject=0x160) returned 1 [0052.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0052.702] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.703] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0052.703] CloseHandle (hObject=0x160) returned 1 [0052.703] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0052.703] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.703] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.703] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2820) returned 1 [0052.703] CloseHandle (hObject=0x160) returned 1 [0052.703] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0052.703] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.703] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.704] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.704] CloseHandle (hObject=0x160) returned 1 [0052.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0052.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.704] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.704] CloseHandle (hObject=0x160) returned 1 [0052.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.705] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.705] CloseHandle (hObject=0x160) returned 1 [0052.705] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0052.705] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.705] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.705] CloseHandle (hObject=0x160) returned 1 [0052.705] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.706] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.706] CloseHandle (hObject=0x160) returned 1 [0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.706] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.706] CloseHandle (hObject=0x160) returned 1 [0052.706] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.707] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=21627) returned 1 [0052.707] CloseHandle (hObject=0x160) returned 1 [0052.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0052.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.708] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0052.708] CloseHandle (hObject=0x160) returned 1 [0052.708] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0052.708] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.708] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.709] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=51801) returned 1 [0052.709] CloseHandle (hObject=0x220) returned 1 [0052.709] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0052.709] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.709] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.710] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.710] CloseHandle (hObject=0x220) returned 1 [0052.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0052.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.710] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.710] CloseHandle (hObject=0x220) returned 1 [0052.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.711] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.711] CloseHandle (hObject=0x220) returned 1 [0052.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0052.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.711] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.711] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.711] CloseHandle (hObject=0x220) returned 1 [0052.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.712] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.712] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.712] CloseHandle (hObject=0x220) returned 1 [0052.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0052.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.712] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.712] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.712] CloseHandle (hObject=0x220) returned 1 [0052.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.712] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.713] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.713] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=96025) returned 1 [0052.713] CloseHandle (hObject=0x220) returned 1 [0052.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0052.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.713] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.713] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2864) returned 1 [0052.713] CloseHandle (hObject=0x220) returned 1 [0052.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0052.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.714] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.714] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4815) returned 1 [0052.714] CloseHandle (hObject=0x220) returned 1 [0052.714] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0052.714] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.714] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.715] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3030) returned 1 [0052.715] CloseHandle (hObject=0x160) returned 1 [0052.715] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0052.715] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.715] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.715] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4815) returned 1 [0052.715] CloseHandle (hObject=0x160) returned 1 [0052.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0052.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.716] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.716] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3024) returned 1 [0052.716] CloseHandle (hObject=0x160) returned 1 [0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.718] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.718] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4866) returned 1 [0052.718] CloseHandle (hObject=0x160) returned 1 [0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0052.718] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.718] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.719] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3011) returned 1 [0052.719] CloseHandle (hObject=0x160) returned 1 [0052.719] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0052.719] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.719] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.720] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19112) returned 1 [0052.720] CloseHandle (hObject=0x160) returned 1 [0052.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0052.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.720] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.720] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6423) returned 1 [0052.720] CloseHandle (hObject=0x160) returned 1 [0052.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0052.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.720] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.721] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=169722) returned 1 [0052.721] CloseHandle (hObject=0x160) returned 1 [0052.721] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0052.721] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.721] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.722] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2910) returned 1 [0052.722] CloseHandle (hObject=0x160) returned 1 [0052.722] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0052.722] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.722] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.723] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4621) returned 1 [0052.723] CloseHandle (hObject=0x160) returned 1 [0052.723] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.724] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.724] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27964) returned 1 [0052.724] CloseHandle (hObject=0x160) returned 1 [0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.724] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.724] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2978) returned 1 [0052.724] CloseHandle (hObject=0x160) returned 1 [0052.724] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0052.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.725] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.725] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3808) returned 1 [0052.725] CloseHandle (hObject=0x160) returned 1 [0052.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0052.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.725] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.726] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3810) returned 1 [0052.726] CloseHandle (hObject=0x160) returned 1 [0052.726] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0052.726] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.726] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.726] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3819) returned 1 [0052.726] CloseHandle (hObject=0x160) returned 1 [0052.727] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0052.727] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.727] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.727] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3133) returned 1 [0052.727] CloseHandle (hObject=0x160) returned 1 [0052.727] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0052.727] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.727] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.727] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3518) returned 1 [0052.727] CloseHandle (hObject=0x160) returned 1 [0052.728] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0052.728] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.728] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.729] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3119) returned 1 [0052.729] CloseHandle (hObject=0x160) returned 1 [0052.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0052.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.729] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.729] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5477696) returned 1 [0052.729] CloseHandle (hObject=0x160) returned 1 [0052.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0x20 [0052.729] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.729] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.730] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5749696) returned 1 [0052.730] CloseHandle (hObject=0x160) returned 1 [0052.730] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0x20 [0052.730] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.730] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.730] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1829606) returned 1 [0052.730] CloseHandle (hObject=0x160) returned 1 [0052.730] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0x20 [0052.730] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.730] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.731] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1837606) returned 1 [0052.731] CloseHandle (hObject=0x160) returned 1 [0052.731] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0052.731] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.732] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.732] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1589606) returned 1 [0052.732] CloseHandle (hObject=0x160) returned 1 [0052.732] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0x20 [0052.732] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.732] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.732] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1613606) returned 1 [0052.732] CloseHandle (hObject=0x160) returned 1 [0052.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0x20 [0052.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.733] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.733] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6717684) returned 1 [0052.733] CloseHandle (hObject=0x160) returned 1 [0052.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0x20 [0052.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.733] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.734] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6765684) returned 1 [0052.734] CloseHandle (hObject=0x160) returned 1 [0052.734] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0x20 [0052.734] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.734] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.735] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2925684) returned 1 [0052.735] CloseHandle (hObject=0x160) returned 1 [0052.735] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0x20 [0052.735] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.735] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.735] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3037684) returned 1 [0052.735] CloseHandle (hObject=0x160) returned 1 [0052.735] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0052.735] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.735] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0052.736] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9170) returned 1 [0052.736] CloseHandle (hObject=0x160) returned 1 [0052.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0052.736] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.736] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.737] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4570) returned 1 [0052.737] CloseHandle (hObject=0x160) returned 1 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.737] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.737] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6440) returned 1 [0052.737] CloseHandle (hObject=0x160) returned 1 [0052.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0052.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.738] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2821) returned 1 [0052.738] CloseHandle (hObject=0x160) returned 1 [0052.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0052.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.739] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5620) returned 1 [0052.739] CloseHandle (hObject=0x160) returned 1 [0052.739] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0052.739] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.739] lstrlenW (lpString=".doc") returned 4 [0052.739] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.739] lstrlenW (lpString=".docx") returned 5 [0052.739] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.739] lstrlenW (lpString=".pdf") returned 4 [0052.739] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.740] lstrlenW (lpString=".xls") returned 4 [0052.740] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.740] lstrlenW (lpString=".xlsx") returned 5 [0052.740] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.740] lstrlenW (lpString=".ppt") returned 4 [0052.740] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.740] lstrlenW (lpString=".zip") returned 4 [0052.740] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.740] lstrlenW (lpString=".rar") returned 4 [0052.740] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.740] lstrlenW (lpString=".bz2") returned 4 [0052.740] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.740] lstrlenW (lpString=".7z") returned 3 [0052.740] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.740] lstrlenW (lpString=".dbf") returned 4 [0052.740] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.740] lstrlenW (lpString=".1cd") returned 4 [0052.740] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 75 [0052.740] lstrlenW (lpString=".jpg") returned 4 [0052.740] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.740] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5182) returned 1 [0052.740] CloseHandle (hObject=0x160) returned 1 [0052.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.741] lstrlenW (lpString=".doc") returned 4 [0052.741] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.741] lstrlenW (lpString=".docx") returned 5 [0052.741] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0052.741] lstrlenW (lpString=".pdf") returned 4 [0052.741] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.741] lstrlenW (lpString=".xls") returned 4 [0052.741] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.741] lstrlenW (lpString=".xlsx") returned 5 [0052.741] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0052.741] lstrlenW (lpString=".ppt") returned 4 [0052.741] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.741] lstrlenW (lpString=".zip") returned 4 [0052.741] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.741] lstrlenW (lpString=".rar") returned 4 [0052.741] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.741] lstrlenW (lpString=".bz2") returned 4 [0052.741] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.741] lstrlenW (lpString=".7z") returned 3 [0052.741] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.741] lstrlenW (lpString=".dbf") returned 4 [0052.741] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.742] lstrlenW (lpString=".1cd") returned 4 [0052.742] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 70 [0052.742] lstrlenW (lpString=".jpg") returned 4 [0052.742] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.742] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5088) returned 1 [0052.742] CloseHandle (hObject=0x160) returned 1 [0052.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.742] lstrlenW (lpString=".doc") returned 4 [0052.742] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.742] lstrlenW (lpString=".docx") returned 5 [0052.742] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.742] lstrlenW (lpString=".pdf") returned 4 [0052.742] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.742] lstrlenW (lpString=".xls") returned 4 [0052.742] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.742] lstrlenW (lpString=".xlsx") returned 5 [0052.743] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.743] lstrlenW (lpString=".ppt") returned 4 [0052.743] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.743] lstrlenW (lpString=".zip") returned 4 [0052.743] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.743] lstrlenW (lpString=".rar") returned 4 [0052.743] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.743] lstrlenW (lpString=".bz2") returned 4 [0052.743] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.743] lstrlenW (lpString=".7z") returned 3 [0052.743] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.743] lstrlenW (lpString=".dbf") returned 4 [0052.743] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.743] lstrlenW (lpString=".1cd") returned 4 [0052.743] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.743] lstrlenW (lpString=".jpg") returned 4 [0052.743] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.743] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0052.743] CloseHandle (hObject=0x160) returned 1 [0052.744] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.744] lstrlenW (lpString=".doc") returned 4 [0052.744] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.744] lstrlenW (lpString=".docx") returned 5 [0052.744] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.744] lstrlenW (lpString=".pdf") returned 4 [0052.744] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.744] lstrlenW (lpString=".xls") returned 4 [0052.744] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.744] lstrlenW (lpString=".xlsx") returned 5 [0052.744] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.744] lstrlenW (lpString=".ppt") returned 4 [0052.744] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.744] lstrlenW (lpString=".zip") returned 4 [0052.744] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.744] lstrlenW (lpString=".rar") returned 4 [0052.744] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.744] lstrlenW (lpString=".bz2") returned 4 [0052.744] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.744] lstrlenW (lpString=".7z") returned 3 [0052.744] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.744] lstrlenW (lpString=".dbf") returned 4 [0052.744] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.744] lstrlenW (lpString=".1cd") returned 4 [0052.744] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.745] lstrlenW (lpString=".jpg") returned 4 [0052.745] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.745] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0052.745] CloseHandle (hObject=0x160) returned 1 [0052.745] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.745] lstrlenW (lpString=".doc") returned 4 [0052.745] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.745] lstrlenW (lpString=".docx") returned 5 [0052.745] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.745] lstrlenW (lpString=".pdf") returned 4 [0052.745] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.745] lstrlenW (lpString=".xls") returned 4 [0052.745] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.745] lstrlenW (lpString=".xlsx") returned 5 [0052.745] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.746] lstrlenW (lpString=".ppt") returned 4 [0052.746] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.746] lstrlenW (lpString=".zip") returned 4 [0052.746] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.746] lstrlenW (lpString=".rar") returned 4 [0052.746] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.746] lstrlenW (lpString=".bz2") returned 4 [0052.746] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.746] lstrlenW (lpString=".7z") returned 3 [0052.746] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.746] lstrlenW (lpString=".dbf") returned 4 [0052.746] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.746] lstrlenW (lpString=".1cd") returned 4 [0052.746] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 86 [0052.746] lstrlenW (lpString=".jpg") returned 4 [0052.746] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.746] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0052.746] CloseHandle (hObject=0x160) returned 1 [0052.747] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.747] lstrlenW (lpString=".doc") returned 4 [0052.747] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.747] lstrlenW (lpString=".docx") returned 5 [0052.747] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.747] lstrlenW (lpString=".pdf") returned 4 [0052.747] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.747] lstrlenW (lpString=".xls") returned 4 [0052.747] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.747] lstrlenW (lpString=".xlsx") returned 5 [0052.747] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.747] lstrlenW (lpString=".ppt") returned 4 [0052.747] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.747] lstrlenW (lpString=".zip") returned 4 [0052.747] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.747] lstrlenW (lpString=".rar") returned 4 [0052.747] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.747] lstrlenW (lpString=".bz2") returned 4 [0052.747] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.747] lstrlenW (lpString=".7z") returned 3 [0052.747] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.747] lstrlenW (lpString=".dbf") returned 4 [0052.747] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.747] lstrlenW (lpString=".1cd") returned 4 [0052.747] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 92 [0052.748] lstrlenW (lpString=".jpg") returned 4 [0052.748] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.748] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4955) returned 1 [0052.748] CloseHandle (hObject=0x160) returned 1 [0052.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.748] lstrlenW (lpString=".doc") returned 4 [0052.748] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.748] lstrlenW (lpString=".docx") returned 5 [0052.748] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.748] lstrlenW (lpString=".pdf") returned 4 [0052.748] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.748] lstrlenW (lpString=".xls") returned 4 [0052.748] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.748] lstrlenW (lpString=".xlsx") returned 5 [0052.748] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.748] lstrlenW (lpString=".ppt") returned 4 [0052.748] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.749] lstrlenW (lpString=".zip") returned 4 [0052.749] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.749] lstrlenW (lpString=".rar") returned 4 [0052.749] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.749] lstrlenW (lpString=".bz2") returned 4 [0052.749] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.749] lstrlenW (lpString=".7z") returned 3 [0052.749] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.749] lstrlenW (lpString=".dbf") returned 4 [0052.749] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.749] lstrlenW (lpString=".1cd") returned 4 [0052.749] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 83 [0052.749] lstrlenW (lpString=".jpg") returned 4 [0052.749] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.749] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3081) returned 1 [0052.749] CloseHandle (hObject=0x160) returned 1 [0052.749] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString=".doc") returned 4 [0052.750] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.750] lstrlenW (lpString=".docx") returned 5 [0052.750] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.750] lstrlenW (lpString=".pdf") returned 4 [0052.750] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.750] lstrlenW (lpString=".xls") returned 4 [0052.750] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.750] lstrlenW (lpString=".xlsx") returned 5 [0052.750] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.750] lstrlenW (lpString=".ppt") returned 4 [0052.750] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString=".zip") returned 4 [0052.750] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.750] lstrlenW (lpString=".rar") returned 4 [0052.750] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.750] lstrlenW (lpString=".bz2") returned 4 [0052.750] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.750] lstrlenW (lpString=".7z") returned 3 [0052.750] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString=".dbf") returned 4 [0052.750] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString=".1cd") returned 4 [0052.750] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 89 [0052.750] lstrlenW (lpString=".jpg") returned 4 [0052.750] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.751] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24791) returned 1 [0052.751] CloseHandle (hObject=0x160) returned 1 [0052.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.751] lstrlenW (lpString=".doc") returned 4 [0052.751] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.751] lstrlenW (lpString=".docx") returned 5 [0052.751] lstrcmpiW (lpString1=".docx", lpString2="h.png") returned -1 [0052.751] lstrlenW (lpString=".pdf") returned 4 [0052.751] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.751] lstrlenW (lpString=".xls") returned 4 [0052.751] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.751] lstrlenW (lpString=".xlsx") returned 5 [0052.751] lstrcmpiW (lpString1=".xlsx", lpString2="h.png") returned -1 [0052.751] lstrlenW (lpString=".ppt") returned 4 [0052.751] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.751] lstrlenW (lpString=".zip") returned 4 [0052.752] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.752] lstrlenW (lpString=".rar") returned 4 [0052.752] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.752] lstrlenW (lpString=".bz2") returned 4 [0052.752] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.752] lstrlenW (lpString=".7z") returned 3 [0052.752] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.752] lstrlenW (lpString=".dbf") returned 4 [0052.752] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.752] lstrlenW (lpString=".1cd") returned 4 [0052.752] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 67 [0052.752] lstrlenW (lpString=".jpg") returned 4 [0052.752] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.015] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=28701) returned 1 [0053.015] CloseHandle (hObject=0x224) returned 1 [0053.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.015] lstrlenW (lpString=".doc") returned 4 [0053.015] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.015] lstrlenW (lpString=".docx") returned 5 [0053.015] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0053.015] lstrlenW (lpString=".pdf") returned 4 [0053.015] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.015] lstrlenW (lpString=".xls") returned 4 [0053.015] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.015] lstrlenW (lpString=".xlsx") returned 5 [0053.015] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0053.015] lstrlenW (lpString=".ppt") returned 4 [0053.015] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.015] lstrlenW (lpString=".zip") returned 4 [0053.016] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.016] lstrlenW (lpString=".rar") returned 4 [0053.016] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.016] lstrlenW (lpString=".bz2") returned 4 [0053.016] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.016] lstrlenW (lpString=".7z") returned 3 [0053.016] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.016] lstrlenW (lpString=".dbf") returned 4 [0053.016] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.016] lstrlenW (lpString=".1cd") returned 4 [0053.016] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 76 [0053.016] lstrlenW (lpString=".jpg") returned 4 [0053.016] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.029] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8120) returned 1 [0053.029] CloseHandle (hObject=0x224) returned 1 [0053.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.030] lstrlenW (lpString=".doc") returned 4 [0053.030] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.030] lstrlenW (lpString=".docx") returned 5 [0053.030] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.030] lstrlenW (lpString=".pdf") returned 4 [0053.030] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.030] lstrlenW (lpString=".xls") returned 4 [0053.030] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.030] lstrlenW (lpString=".xlsx") returned 5 [0053.030] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.030] lstrlenW (lpString=".ppt") returned 4 [0053.030] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.030] lstrlenW (lpString=".zip") returned 4 [0053.030] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.030] lstrlenW (lpString=".rar") returned 4 [0053.030] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.030] lstrlenW (lpString=".bz2") returned 4 [0053.030] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.030] lstrlenW (lpString=".7z") returned 3 [0053.030] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.031] lstrlenW (lpString=".dbf") returned 4 [0053.031] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.031] lstrlenW (lpString=".1cd") returned 4 [0053.031] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0053.031] lstrlenW (lpString=".jpg") returned 4 [0053.031] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.031] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8406) returned 1 [0053.031] CloseHandle (hObject=0x224) returned 1 [0053.031] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.031] lstrlenW (lpString=".doc") returned 4 [0053.031] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.031] lstrlenW (lpString=".docx") returned 5 [0053.031] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0053.032] lstrlenW (lpString=".pdf") returned 4 [0053.032] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.032] lstrlenW (lpString=".xls") returned 4 [0053.032] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.032] lstrlenW (lpString=".xlsx") returned 5 [0053.032] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0053.032] lstrlenW (lpString=".ppt") returned 4 [0053.032] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.032] lstrlenW (lpString=".zip") returned 4 [0053.032] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.032] lstrlenW (lpString=".rar") returned 4 [0053.032] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.032] lstrlenW (lpString=".bz2") returned 4 [0053.032] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.032] lstrlenW (lpString=".7z") returned 3 [0053.032] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.032] lstrlenW (lpString=".dbf") returned 4 [0053.032] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.032] lstrlenW (lpString=".1cd") returned 4 [0053.032] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0053.032] lstrlenW (lpString=".jpg") returned 4 [0053.032] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.032] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=962) returned 1 [0053.032] CloseHandle (hObject=0x224) returned 1 [0053.033] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.033] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.033] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.033] lstrlenW (lpString=".doc") returned 4 [0053.033] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.033] lstrlenW (lpString=".docx") returned 5 [0053.033] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.033] lstrlenW (lpString=".pdf") returned 4 [0053.033] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.033] lstrlenW (lpString=".xls") returned 4 [0053.033] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.033] lstrlenW (lpString=".xlsx") returned 5 [0053.033] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.033] lstrlenW (lpString=".ppt") returned 4 [0053.033] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.033] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.033] lstrlenW (lpString=".zip") returned 4 [0053.033] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.033] lstrlenW (lpString=".rar") returned 4 [0053.033] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.033] lstrlenW (lpString=".bz2") returned 4 [0053.033] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.033] lstrlenW (lpString=".7z") returned 3 [0053.033] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.034] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.034] lstrlenW (lpString=".dbf") returned 4 [0053.034] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.034] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.034] lstrlenW (lpString=".1cd") returned 4 [0053.034] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.034] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0053.034] lstrlenW (lpString=".jpg") returned 4 [0053.034] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.034] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=716) returned 1 [0053.034] CloseHandle (hObject=0x224) returned 1 [0053.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.034] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0053.034] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0053.035] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=293917) returned 1 [0053.035] CloseHandle (hObject=0x224) returned 1 [0053.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.036] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=70262) returned 1 [0053.036] CloseHandle (hObject=0x224) returned 1 [0053.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.036] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=201323) returned 1 [0053.036] CloseHandle (hObject=0x224) returned 1 [0053.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.037] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=69268) returned 1 [0053.037] CloseHandle (hObject=0x224) returned 1 [0053.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.687] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=363512) returned 1 [0053.687] CloseHandle (hObject=0x1f0) returned 1 [0053.687] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.002] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=34076) returned 1 [0055.002] CloseHandle (hObject=0x220) returned 1 [0055.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.009] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.011] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.011] GetLastError () returned 0x0 [0055.011] ReadFile (in: hFile=0x220, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x851c, lpOverlapped=0x0) returned 1 [0055.038] WriteFile (in: hFile=0x17c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0055.039] ReadFile (in: hFile=0x220, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.039] WriteFile (in: hFile=0x17c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.039] SetEndOfFile (hFile=0x17c) returned 1 [0055.039] CloseHandle (hObject=0x17c) returned 1 [0055.039] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.039] SetEndOfFile (hFile=0x220) returned 1 [0055.040] CloseHandle (hObject=0x220) returned 1 [0055.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.264] lstrlenW (lpString=".doc") returned 4 [0055.264] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString=".docx") returned 5 [0055.264] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.264] lstrlenW (lpString=".pdf") returned 4 [0055.264] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString=".xls") returned 4 [0055.264] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString=".xlsx") returned 5 [0055.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.264] lstrlenW (lpString=".ppt") returned 4 [0055.264] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.264] lstrlenW (lpString=".zip") returned 4 [0055.264] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.264] lstrlenW (lpString=".rar") returned 4 [0055.264] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString=".bz2") returned 4 [0055.264] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString=".7z") returned 3 [0055.264] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.264] lstrlenW (lpString=".dbf") returned 4 [0055.264] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.264] lstrlenW (lpString=".1cd") returned 4 [0055.264] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0055.265] lstrlenW (lpString=".jpg") returned 4 [0055.265] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.387] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8097) returned 1 [0055.387] CloseHandle (hObject=0x1fc) returned 1 [0055.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0055.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.387] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.387] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.388] GetLastError () returned 0x0 [0055.388] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0055.398] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0055.405] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.405] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.405] SetEndOfFile (hFile=0x228) returned 1 [0055.405] CloseHandle (hObject=0x228) returned 1 [0055.405] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.405] SetEndOfFile (hFile=0x1fc) returned 1 [0055.409] CloseHandle (hObject=0x1fc) returned 1 [0055.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.409] lstrlenW (lpString=".doc") returned 4 [0055.409] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.409] lstrlenW (lpString=".docx") returned 5 [0055.409] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.409] lstrlenW (lpString=".pdf") returned 4 [0055.409] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.409] lstrlenW (lpString=".xls") returned 4 [0055.409] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.409] lstrlenW (lpString=".xlsx") returned 5 [0055.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.410] lstrlenW (lpString=".ppt") returned 4 [0055.410] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.410] lstrlenW (lpString=".zip") returned 4 [0055.410] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.410] lstrlenW (lpString=".rar") returned 4 [0055.410] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.410] lstrlenW (lpString=".bz2") returned 4 [0055.410] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.410] lstrlenW (lpString=".7z") returned 3 [0055.410] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.410] lstrlenW (lpString=".dbf") returned 4 [0055.410] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.410] lstrlenW (lpString=".1cd") returned 4 [0055.410] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0055.410] lstrlenW (lpString=".jpg") returned 4 [0055.410] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.410] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7583) returned 1 [0055.410] CloseHandle (hObject=0x1fc) returned 1 [0055.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0055.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.411] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.411] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.411] GetLastError () returned 0x0 [0055.411] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0055.416] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0055.417] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.417] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.418] SetEndOfFile (hFile=0x228) returned 1 [0055.418] CloseHandle (hObject=0x228) returned 1 [0055.418] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.418] SetEndOfFile (hFile=0x1fc) returned 1 [0055.419] CloseHandle (hObject=0x1fc) returned 1 [0055.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.419] lstrlenW (lpString=".doc") returned 4 [0055.419] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.419] lstrlenW (lpString=".docx") returned 5 [0055.419] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.419] lstrlenW (lpString=".pdf") returned 4 [0055.419] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.419] lstrlenW (lpString=".xls") returned 4 [0055.419] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.419] lstrlenW (lpString=".xlsx") returned 5 [0055.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.420] lstrlenW (lpString=".ppt") returned 4 [0055.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.420] lstrlenW (lpString=".zip") returned 4 [0055.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.420] lstrlenW (lpString=".rar") returned 4 [0055.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.420] lstrlenW (lpString=".bz2") returned 4 [0055.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.420] lstrlenW (lpString=".7z") returned 3 [0055.420] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.420] lstrlenW (lpString=".dbf") returned 4 [0055.420] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.420] lstrlenW (lpString=".1cd") returned 4 [0055.420] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0055.420] lstrlenW (lpString=".jpg") returned 4 [0055.420] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.420] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13254) returned 1 [0055.420] CloseHandle (hObject=0x1fc) returned 1 [0055.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0055.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.421] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.421] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.421] GetLastError () returned 0x0 [0055.421] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0055.423] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0055.424] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.424] WriteFile (in: hFile=0x228, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.424] SetEndOfFile (hFile=0x228) returned 1 [0055.424] CloseHandle (hObject=0x228) returned 1 [0055.424] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.424] SetEndOfFile (hFile=0x1fc) returned 1 [0055.425] CloseHandle (hObject=0x1fc) returned 1 [0055.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0055.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.427] lstrlenW (lpString=".doc") returned 4 [0055.428] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.428] lstrlenW (lpString=".docx") returned 5 [0055.428] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.428] lstrlenW (lpString=".pdf") returned 4 [0055.428] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.428] lstrlenW (lpString=".xls") returned 4 [0055.428] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.428] lstrlenW (lpString=".xlsx") returned 5 [0055.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.428] lstrlenW (lpString=".ppt") returned 4 [0055.428] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.428] lstrlenW (lpString=".zip") returned 4 [0055.428] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.428] lstrlenW (lpString=".rar") returned 4 [0055.428] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.428] lstrlenW (lpString=".bz2") returned 4 [0055.428] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.428] lstrlenW (lpString=".7z") returned 3 [0055.428] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.428] lstrlenW (lpString=".dbf") returned 4 [0055.428] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.428] lstrlenW (lpString=".1cd") returned 4 [0055.428] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.428] lstrlenW (lpString=".jpg") returned 4 [0055.428] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.429] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8582) returned 1 [0055.429] CloseHandle (hObject=0x1f8) returned 1 [0055.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0055.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.430] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.430] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.430] GetLastError () returned 0x0 [0055.430] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2186, lpOverlapped=0x0) returned 1 [0055.432] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0055.433] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.433] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.433] SetEndOfFile (hFile=0x1fc) returned 1 [0055.433] CloseHandle (hObject=0x1fc) returned 1 [0055.433] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.433] SetEndOfFile (hFile=0x1f8) returned 1 [0055.434] CloseHandle (hObject=0x1f8) returned 1 [0055.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString=".doc") returned 4 [0055.435] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.435] lstrlenW (lpString=".docx") returned 5 [0055.435] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.435] lstrlenW (lpString=".pdf") returned 4 [0055.435] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.435] lstrlenW (lpString=".xls") returned 4 [0055.435] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.435] lstrlenW (lpString=".xlsx") returned 5 [0055.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.435] lstrlenW (lpString=".ppt") returned 4 [0055.435] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString=".zip") returned 4 [0055.435] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.435] lstrlenW (lpString=".rar") returned 4 [0055.435] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.435] lstrlenW (lpString=".bz2") returned 4 [0055.435] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.435] lstrlenW (lpString=".7z") returned 3 [0055.435] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString=".dbf") returned 4 [0055.435] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString=".1cd") returned 4 [0055.435] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.435] lstrlenW (lpString=".jpg") returned 4 [0055.435] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.436] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4894) returned 1 [0055.436] CloseHandle (hObject=0x1f8) returned 1 [0055.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0055.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.436] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.436] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.436] GetLastError () returned 0x0 [0055.436] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x131e, lpOverlapped=0x0) returned 1 [0055.438] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0055.439] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.439] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.439] SetEndOfFile (hFile=0x1fc) returned 1 [0055.439] CloseHandle (hObject=0x1fc) returned 1 [0055.439] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.439] SetEndOfFile (hFile=0x1f8) returned 1 [0055.440] CloseHandle (hObject=0x1f8) returned 1 [0055.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString=".doc") returned 4 [0055.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.441] lstrlenW (lpString=".docx") returned 5 [0055.441] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.441] lstrlenW (lpString=".pdf") returned 4 [0055.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.441] lstrlenW (lpString=".xls") returned 4 [0055.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.441] lstrlenW (lpString=".xlsx") returned 5 [0055.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.441] lstrlenW (lpString=".ppt") returned 4 [0055.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString=".zip") returned 4 [0055.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.441] lstrlenW (lpString=".rar") returned 4 [0055.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.441] lstrlenW (lpString=".bz2") returned 4 [0055.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.441] lstrlenW (lpString=".7z") returned 3 [0055.441] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString=".dbf") returned 4 [0055.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString=".1cd") returned 4 [0055.441] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.441] lstrlenW (lpString=".jpg") returned 4 [0055.441] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.442] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5375) returned 1 [0055.442] CloseHandle (hObject=0x1f8) returned 1 [0055.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0055.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.442] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.442] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.443] GetLastError () returned 0x0 [0055.443] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0056.359] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0056.360] ReadFile (in: hFile=0x1f8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.360] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.360] SetEndOfFile (hFile=0x1fc) returned 1 [0056.594] CloseHandle (hObject=0x1fc) returned 1 [0056.733] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.733] SetEndOfFile (hFile=0x1f8) returned 1 [0056.875] CloseHandle (hObject=0x1f8) returned 1 [0056.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.875] lstrlenW (lpString=".doc") returned 4 [0056.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.875] lstrlenW (lpString=".docx") returned 5 [0056.875] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.875] lstrlenW (lpString=".pdf") returned 4 [0056.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.875] lstrlenW (lpString=".xls") returned 4 [0056.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.876] lstrlenW (lpString=".xlsx") returned 5 [0056.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.876] lstrlenW (lpString=".ppt") returned 4 [0056.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.876] lstrlenW (lpString=".zip") returned 4 [0056.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.876] lstrlenW (lpString=".rar") returned 4 [0056.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.876] lstrlenW (lpString=".bz2") returned 4 [0056.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.876] lstrlenW (lpString=".7z") returned 3 [0056.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.876] lstrlenW (lpString=".dbf") returned 4 [0056.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.876] lstrlenW (lpString=".1cd") returned 4 [0056.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0056.876] lstrlenW (lpString=".jpg") returned 4 [0056.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.235] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26332) returned 1 [0057.235] CloseHandle (hObject=0x22c) returned 1 [0057.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0057.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.235] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.236] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.236] GetLastError () returned 0x0 [0057.236] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0057.248] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0057.249] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.249] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.250] SetEndOfFile (hFile=0x160) returned 1 [0057.250] CloseHandle (hObject=0x160) returned 1 [0057.250] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.250] SetEndOfFile (hFile=0x22c) returned 1 [0057.251] CloseHandle (hObject=0x22c) returned 1 [0057.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0057.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.251] lstrlenW (lpString=".doc") returned 4 [0057.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.251] lstrlenW (lpString=".docx") returned 5 [0057.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.251] lstrlenW (lpString=".pdf") returned 4 [0057.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.251] lstrlenW (lpString=".xls") returned 4 [0057.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.252] lstrlenW (lpString=".xlsx") returned 5 [0057.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.252] lstrlenW (lpString=".ppt") returned 4 [0057.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.252] lstrlenW (lpString=".zip") returned 4 [0057.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.252] lstrlenW (lpString=".rar") returned 4 [0057.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.252] lstrlenW (lpString=".bz2") returned 4 [0057.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.252] lstrlenW (lpString=".7z") returned 3 [0057.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.252] lstrlenW (lpString=".dbf") returned 4 [0057.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.252] lstrlenW (lpString=".1cd") returned 4 [0057.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0057.252] lstrlenW (lpString=".jpg") returned 4 [0057.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.252] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3012) returned 1 [0057.252] CloseHandle (hObject=0x22c) returned 1 [0057.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0057.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.253] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.253] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.253] GetLastError () returned 0x0 [0057.253] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0057.263] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0057.264] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.264] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.264] SetEndOfFile (hFile=0x160) returned 1 [0057.264] CloseHandle (hObject=0x160) returned 1 [0057.265] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.265] SetEndOfFile (hFile=0x22c) returned 1 [0057.265] CloseHandle (hObject=0x22c) returned 1 [0057.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.266] lstrlenW (lpString=".doc") returned 4 [0057.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.266] lstrlenW (lpString=".docx") returned 5 [0057.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.266] lstrlenW (lpString=".pdf") returned 4 [0057.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.266] lstrlenW (lpString=".xls") returned 4 [0057.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.266] lstrlenW (lpString=".xlsx") returned 5 [0057.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.266] lstrlenW (lpString=".ppt") returned 4 [0057.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.266] lstrlenW (lpString=".zip") returned 4 [0057.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.266] lstrlenW (lpString=".rar") returned 4 [0057.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.266] lstrlenW (lpString=".bz2") returned 4 [0057.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.266] lstrlenW (lpString=".7z") returned 3 [0057.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.266] lstrlenW (lpString=".dbf") returned 4 [0057.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.267] lstrlenW (lpString=".1cd") returned 4 [0057.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0057.267] lstrlenW (lpString=".jpg") returned 4 [0057.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.267] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2756) returned 1 [0057.267] CloseHandle (hObject=0x22c) returned 1 [0057.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0057.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.267] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.267] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.268] GetLastError () returned 0x0 [0057.268] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xac4, lpOverlapped=0x0) returned 1 [0057.270] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0057.271] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.271] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x160) returned 1 [0057.271] CloseHandle (hObject=0x160) returned 1 [0057.271] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x22c) returned 1 [0057.272] CloseHandle (hObject=0x22c) returned 1 [0057.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.273] lstrlenW (lpString=".doc") returned 4 [0057.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString=".docx") returned 5 [0057.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.273] lstrlenW (lpString=".pdf") returned 4 [0057.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString=".xls") returned 4 [0057.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.273] lstrlenW (lpString=".xlsx") returned 5 [0057.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.273] lstrlenW (lpString=".ppt") returned 4 [0057.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.273] lstrlenW (lpString=".zip") returned 4 [0057.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.273] lstrlenW (lpString=".rar") returned 4 [0057.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString=".bz2") returned 4 [0057.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString=".7z") returned 3 [0057.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.273] lstrlenW (lpString=".dbf") returned 4 [0057.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.274] lstrlenW (lpString=".1cd") returned 4 [0057.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0057.274] lstrlenW (lpString=".jpg") returned 4 [0057.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.274] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7372) returned 1 [0057.274] CloseHandle (hObject=0x22c) returned 1 [0057.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0057.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.274] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.274] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.275] GetLastError () returned 0x0 [0057.275] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0057.276] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0057.277] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.277] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.277] SetEndOfFile (hFile=0x160) returned 1 [0057.277] CloseHandle (hObject=0x160) returned 1 [0057.277] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.278] SetEndOfFile (hFile=0x22c) returned 1 [0057.278] CloseHandle (hObject=0x22c) returned 1 [0057.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0057.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.279] lstrlenW (lpString=".doc") returned 4 [0057.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.279] lstrlenW (lpString=".docx") returned 5 [0057.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.279] lstrlenW (lpString=".pdf") returned 4 [0057.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.279] lstrlenW (lpString=".xls") returned 4 [0057.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.279] lstrlenW (lpString=".xlsx") returned 5 [0057.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.279] lstrlenW (lpString=".ppt") returned 4 [0057.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.280] lstrlenW (lpString=".zip") returned 4 [0057.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.280] lstrlenW (lpString=".rar") returned 4 [0057.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.280] lstrlenW (lpString=".bz2") returned 4 [0057.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.280] lstrlenW (lpString=".7z") returned 3 [0057.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.280] lstrlenW (lpString=".dbf") returned 4 [0057.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.280] lstrlenW (lpString=".1cd") returned 4 [0057.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0057.280] lstrlenW (lpString=".jpg") returned 4 [0057.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.281] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7540) returned 1 [0057.281] CloseHandle (hObject=0x22c) returned 1 [0057.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0057.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.281] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.281] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.282] GetLastError () returned 0x0 [0057.282] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0057.290] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0057.292] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.292] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.292] SetEndOfFile (hFile=0x160) returned 1 [0057.292] CloseHandle (hObject=0x160) returned 1 [0057.292] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.292] SetEndOfFile (hFile=0x22c) returned 1 [0057.293] CloseHandle (hObject=0x22c) returned 1 [0057.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0057.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.294] lstrlenW (lpString=".doc") returned 4 [0057.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.294] lstrlenW (lpString=".docx") returned 5 [0057.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.294] lstrlenW (lpString=".pdf") returned 4 [0057.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.294] lstrlenW (lpString=".xls") returned 4 [0057.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.294] lstrlenW (lpString=".xlsx") returned 5 [0057.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.294] lstrlenW (lpString=".ppt") returned 4 [0057.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.294] lstrlenW (lpString=".zip") returned 4 [0057.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.294] lstrlenW (lpString=".rar") returned 4 [0057.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.294] lstrlenW (lpString=".bz2") returned 4 [0057.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.294] lstrlenW (lpString=".7z") returned 3 [0057.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.295] lstrlenW (lpString=".dbf") returned 4 [0057.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.295] lstrlenW (lpString=".1cd") returned 4 [0057.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.295] lstrlenW (lpString=".jpg") returned 4 [0057.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.288] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2108) returned 1 [0058.288] CloseHandle (hObject=0x1c8) returned 1 [0058.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0058.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.288] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.288] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.289] GetLastError () returned 0x0 [0058.289] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x83c, lpOverlapped=0x0) returned 1 [0058.291] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x840, lpOverlapped=0x0) returned 1 [0058.291] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.292] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.292] SetEndOfFile (hFile=0x22c) returned 1 [0058.292] CloseHandle (hObject=0x22c) returned 1 [0058.292] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.292] SetEndOfFile (hFile=0x1c8) returned 1 [0058.293] CloseHandle (hObject=0x1c8) returned 1 [0058.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.293] lstrlenW (lpString=".doc") returned 4 [0058.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString=".docx") returned 5 [0058.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.293] lstrlenW (lpString=".pdf") returned 4 [0058.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString=".xls") returned 4 [0058.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.294] lstrlenW (lpString=".xlsx") returned 5 [0058.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.294] lstrlenW (lpString=".ppt") returned 4 [0058.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.294] lstrlenW (lpString=".zip") returned 4 [0058.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.294] lstrlenW (lpString=".rar") returned 4 [0058.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString=".bz2") returned 4 [0058.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString=".7z") returned 3 [0058.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.294] lstrlenW (lpString=".dbf") returned 4 [0058.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.294] lstrlenW (lpString=".1cd") returned 4 [0058.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.294] lstrlenW (lpString=".jpg") returned 4 [0058.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.295] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5004) returned 1 [0058.295] CloseHandle (hObject=0x1c8) returned 1 [0058.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0058.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.295] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.295] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.295] GetLastError () returned 0x0 [0058.295] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x138c, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0058.298] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.298] SetEndOfFile (hFile=0x22c) returned 1 [0058.298] CloseHandle (hObject=0x22c) returned 1 [0058.298] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.298] SetEndOfFile (hFile=0x1c8) returned 1 [0058.299] CloseHandle (hObject=0x1c8) returned 1 [0058.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString=".doc") returned 4 [0058.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".docx") returned 5 [0058.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.300] lstrlenW (lpString=".pdf") returned 4 [0058.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".xls") returned 4 [0058.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.300] lstrlenW (lpString=".xlsx") returned 5 [0058.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.300] lstrlenW (lpString=".ppt") returned 4 [0058.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString=".zip") returned 4 [0058.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.300] lstrlenW (lpString=".rar") returned 4 [0058.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".bz2") returned 4 [0058.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".7z") returned 3 [0058.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString=".dbf") returned 4 [0058.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString=".1cd") returned 4 [0058.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.300] lstrlenW (lpString=".jpg") returned 4 [0058.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.301] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4870) returned 1 [0058.301] CloseHandle (hObject=0x1c8) returned 1 [0058.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0058.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.302] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.302] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.302] GetLastError () returned 0x0 [0058.302] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1306, lpOverlapped=0x0) returned 1 [0058.338] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0058.347] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.347] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.347] SetEndOfFile (hFile=0x22c) returned 1 [0058.353] CloseHandle (hObject=0x22c) returned 1 [0058.353] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.358] SetEndOfFile (hFile=0x1c8) returned 1 [0058.368] CloseHandle (hObject=0x1c8) returned 1 [0058.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0058.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.382] lstrlenW (lpString=".doc") returned 4 [0058.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.382] lstrlenW (lpString=".docx") returned 5 [0058.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.382] lstrlenW (lpString=".pdf") returned 4 [0058.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.382] lstrlenW (lpString=".xls") returned 4 [0058.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.382] lstrlenW (lpString=".xlsx") returned 5 [0058.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.383] lstrlenW (lpString=".ppt") returned 4 [0058.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.383] lstrlenW (lpString=".zip") returned 4 [0058.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.383] lstrlenW (lpString=".rar") returned 4 [0058.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.383] lstrlenW (lpString=".bz2") returned 4 [0058.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.383] lstrlenW (lpString=".7z") returned 3 [0058.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.383] lstrlenW (lpString=".dbf") returned 4 [0058.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.383] lstrlenW (lpString=".1cd") returned 4 [0058.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0058.383] lstrlenW (lpString=".jpg") returned 4 [0058.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.389] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16676) returned 1 [0058.397] CloseHandle (hObject=0x150) returned 1 [0058.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0058.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.404] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.404] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.411] GetLastError () returned 0x0 [0058.411] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4124, lpOverlapped=0x0) returned 1 [0058.413] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0058.414] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.414] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.414] SetEndOfFile (hFile=0x160) returned 1 [0058.414] CloseHandle (hObject=0x160) returned 1 [0058.415] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.415] SetEndOfFile (hFile=0x150) returned 1 [0058.416] CloseHandle (hObject=0x150) returned 1 [0058.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0058.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.416] lstrlenW (lpString=".doc") returned 4 [0058.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.416] lstrlenW (lpString=".docx") returned 5 [0058.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.416] lstrlenW (lpString=".pdf") returned 4 [0058.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.416] lstrlenW (lpString=".xls") returned 4 [0058.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.416] lstrlenW (lpString=".xlsx") returned 5 [0058.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.416] lstrlenW (lpString=".ppt") returned 4 [0058.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.416] lstrlenW (lpString=".zip") returned 4 [0058.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.417] lstrlenW (lpString=".rar") returned 4 [0058.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.417] lstrlenW (lpString=".bz2") returned 4 [0058.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.417] lstrlenW (lpString=".7z") returned 3 [0058.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.417] lstrlenW (lpString=".dbf") returned 4 [0058.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.417] lstrlenW (lpString=".1cd") returned 4 [0058.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0058.417] lstrlenW (lpString=".jpg") returned 4 [0058.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.417] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24778) returned 1 [0058.417] CloseHandle (hObject=0x150) returned 1 [0058.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0058.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.418] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.418] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.418] GetLastError () returned 0x0 [0058.418] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0058.420] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0058.421] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.421] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.422] SetEndOfFile (hFile=0x160) returned 1 [0058.422] CloseHandle (hObject=0x160) returned 1 [0058.422] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.422] SetEndOfFile (hFile=0x150) returned 1 [0058.423] CloseHandle (hObject=0x150) returned 1 [0058.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0058.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.423] lstrlenW (lpString=".doc") returned 4 [0058.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.423] lstrlenW (lpString=".docx") returned 5 [0058.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.423] lstrlenW (lpString=".pdf") returned 4 [0058.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.423] lstrlenW (lpString=".xls") returned 4 [0058.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.423] lstrlenW (lpString=".xlsx") returned 5 [0058.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.424] lstrlenW (lpString=".ppt") returned 4 [0058.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.424] lstrlenW (lpString=".zip") returned 4 [0058.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.424] lstrlenW (lpString=".rar") returned 4 [0058.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.424] lstrlenW (lpString=".bz2") returned 4 [0058.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.424] lstrlenW (lpString=".7z") returned 3 [0058.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.424] lstrlenW (lpString=".dbf") returned 4 [0058.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.424] lstrlenW (lpString=".1cd") returned 4 [0058.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0058.424] lstrlenW (lpString=".jpg") returned 4 [0058.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.424] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=47996) returned 1 [0058.424] CloseHandle (hObject=0x150) returned 1 [0058.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0058.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.425] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.425] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.425] GetLastError () returned 0x0 [0058.425] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0058.428] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0058.429] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.429] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.429] SetEndOfFile (hFile=0x160) returned 1 [0058.429] CloseHandle (hObject=0x160) returned 1 [0058.430] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.430] SetEndOfFile (hFile=0x150) returned 1 [0058.431] CloseHandle (hObject=0x150) returned 1 [0058.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0058.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.431] lstrlenW (lpString=".doc") returned 4 [0058.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.431] lstrlenW (lpString=".docx") returned 5 [0058.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.431] lstrlenW (lpString=".pdf") returned 4 [0058.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.431] lstrlenW (lpString=".xls") returned 4 [0058.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.431] lstrlenW (lpString=".xlsx") returned 5 [0058.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.431] lstrlenW (lpString=".ppt") returned 4 [0058.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.432] lstrlenW (lpString=".zip") returned 4 [0058.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.432] lstrlenW (lpString=".rar") returned 4 [0058.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.432] lstrlenW (lpString=".bz2") returned 4 [0058.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.432] lstrlenW (lpString=".7z") returned 3 [0058.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.432] lstrlenW (lpString=".dbf") returned 4 [0058.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.432] lstrlenW (lpString=".1cd") returned 4 [0058.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0058.432] lstrlenW (lpString=".jpg") returned 4 [0058.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.432] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=40206) returned 1 [0058.432] CloseHandle (hObject=0x150) returned 1 [0058.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0058.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.433] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.433] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.433] GetLastError () returned 0x0 [0058.433] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0058.436] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0058.437] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.437] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.437] SetEndOfFile (hFile=0x160) returned 1 [0058.437] CloseHandle (hObject=0x160) returned 1 [0058.438] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.438] SetEndOfFile (hFile=0x150) returned 1 [0058.439] CloseHandle (hObject=0x150) returned 1 [0058.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0058.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.439] lstrlenW (lpString=".doc") returned 4 [0058.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.439] lstrlenW (lpString=".docx") returned 5 [0058.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.439] lstrlenW (lpString=".pdf") returned 4 [0058.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.439] lstrlenW (lpString=".xls") returned 4 [0058.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.439] lstrlenW (lpString=".xlsx") returned 5 [0058.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.439] lstrlenW (lpString=".ppt") returned 4 [0058.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.440] lstrlenW (lpString=".zip") returned 4 [0058.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.440] lstrlenW (lpString=".rar") returned 4 [0058.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.440] lstrlenW (lpString=".bz2") returned 4 [0058.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.440] lstrlenW (lpString=".7z") returned 3 [0058.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.440] lstrlenW (lpString=".dbf") returned 4 [0058.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.440] lstrlenW (lpString=".1cd") returned 4 [0058.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0058.440] lstrlenW (lpString=".jpg") returned 4 [0058.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.440] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14540) returned 1 [0058.440] CloseHandle (hObject=0x150) returned 1 [0058.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0058.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.441] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.441] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.187] GetLastError () returned 0x0 [0059.187] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0059.345] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0059.346] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.346] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.346] SetEndOfFile (hFile=0x22c) returned 1 [0059.346] CloseHandle (hObject=0x22c) returned 1 [0059.346] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.346] SetEndOfFile (hFile=0x150) returned 1 [0059.347] CloseHandle (hObject=0x150) returned 1 [0059.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.348] lstrlenW (lpString=".doc") returned 4 [0059.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString=".docx") returned 5 [0059.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.348] lstrlenW (lpString=".pdf") returned 4 [0059.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString=".xls") returned 4 [0059.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.348] lstrlenW (lpString=".xlsx") returned 5 [0059.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.348] lstrlenW (lpString=".ppt") returned 4 [0059.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.348] lstrlenW (lpString=".zip") returned 4 [0059.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.348] lstrlenW (lpString=".rar") returned 4 [0059.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString=".bz2") returned 4 [0059.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString=".7z") returned 3 [0059.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.348] lstrlenW (lpString=".dbf") returned 4 [0059.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.348] lstrlenW (lpString=".1cd") returned 4 [0059.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0059.349] lstrlenW (lpString=".jpg") returned 4 [0059.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.349] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13515) returned 1 [0059.349] CloseHandle (hObject=0x150) returned 1 [0059.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0059.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0059.349] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.349] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.350] GetLastError () returned 0x0 [0059.350] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0059.363] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.365] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.365] SetEndOfFile (hFile=0x22c) returned 1 [0059.502] CloseHandle (hObject=0x22c) returned 1 [0060.275] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.275] SetEndOfFile (hFile=0x150) returned 1 [0060.486] CloseHandle (hObject=0x150) returned 1 [0060.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0060.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.487] lstrlenW (lpString=".doc") returned 4 [0060.487] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.487] lstrlenW (lpString=".docx") returned 5 [0060.487] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.487] lstrlenW (lpString=".pdf") returned 4 [0060.487] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.487] lstrlenW (lpString=".xls") returned 4 [0060.487] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.487] lstrlenW (lpString=".xlsx") returned 5 [0060.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.487] lstrlenW (lpString=".ppt") returned 4 [0060.487] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.487] lstrlenW (lpString=".zip") returned 4 [0060.487] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.487] lstrlenW (lpString=".rar") returned 4 [0060.487] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.487] lstrlenW (lpString=".bz2") returned 4 [0060.487] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.487] lstrlenW (lpString=".7z") returned 3 [0060.487] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.487] lstrlenW (lpString=".dbf") returned 4 [0060.487] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.488] lstrlenW (lpString=".1cd") returned 4 [0060.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0060.488] lstrlenW (lpString=".jpg") returned 4 [0060.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.488] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11058) returned 1 [0060.488] CloseHandle (hObject=0x150) returned 1 [0060.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0060.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.489] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.489] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0060.489] GetLastError () returned 0x0 [0060.489] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0060.493] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.493] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.493] SetEndOfFile (hFile=0x1bc) returned 1 [0060.493] CloseHandle (hObject=0x1bc) returned 1 [0060.493] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.493] SetEndOfFile (hFile=0x150) returned 1 [0060.494] CloseHandle (hObject=0x150) returned 1 [0060.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.495] lstrlenW (lpString=".doc") returned 4 [0060.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString=".docx") returned 5 [0060.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.495] lstrlenW (lpString=".pdf") returned 4 [0060.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString=".xls") returned 4 [0060.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.495] lstrlenW (lpString=".xlsx") returned 5 [0060.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.495] lstrlenW (lpString=".ppt") returned 4 [0060.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.495] lstrlenW (lpString=".zip") returned 4 [0060.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.495] lstrlenW (lpString=".rar") returned 4 [0060.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString=".bz2") returned 4 [0060.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString=".7z") returned 3 [0060.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.495] lstrlenW (lpString=".dbf") returned 4 [0060.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.495] lstrlenW (lpString=".1cd") returned 4 [0060.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0060.496] lstrlenW (lpString=".jpg") returned 4 [0060.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.496] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12520) returned 1 [0060.496] CloseHandle (hObject=0x1bc) returned 1 [0060.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0060.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0060.497] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.497] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.497] GetLastError () returned 0x0 [0060.497] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0060.499] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0060.500] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.500] SetEndOfFile (hFile=0x1fc) returned 1 [0060.501] CloseHandle (hObject=0x1fc) returned 1 [0060.501] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.501] SetEndOfFile (hFile=0x1bc) returned 1 [0060.502] CloseHandle (hObject=0x1bc) returned 1 [0060.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0060.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.502] lstrlenW (lpString=".doc") returned 4 [0060.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.502] lstrlenW (lpString=".docx") returned 5 [0060.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.502] lstrlenW (lpString=".pdf") returned 4 [0060.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.502] lstrlenW (lpString=".xls") returned 4 [0060.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.502] lstrlenW (lpString=".xlsx") returned 5 [0060.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.502] lstrlenW (lpString=".ppt") returned 4 [0060.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.502] lstrlenW (lpString=".zip") returned 4 [0060.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.503] lstrlenW (lpString=".rar") returned 4 [0060.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.503] lstrlenW (lpString=".bz2") returned 4 [0060.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.503] lstrlenW (lpString=".7z") returned 3 [0060.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.503] lstrlenW (lpString=".dbf") returned 4 [0060.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.503] lstrlenW (lpString=".1cd") returned 4 [0060.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0060.503] lstrlenW (lpString=".jpg") returned 4 [0060.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.504] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9818) returned 1 [0060.504] CloseHandle (hObject=0x1bc) returned 1 [0060.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0060.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0060.504] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.504] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.505] GetLastError () returned 0x0 [0060.505] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x265a, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0060.507] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.507] SetEndOfFile (hFile=0x1fc) returned 1 [0060.507] CloseHandle (hObject=0x1fc) returned 1 [0060.508] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.508] SetEndOfFile (hFile=0x1bc) returned 1 [0060.508] CloseHandle (hObject=0x1bc) returned 1 [0060.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0060.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.509] lstrlenW (lpString=".doc") returned 4 [0060.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.509] lstrlenW (lpString=".docx") returned 5 [0060.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.509] lstrlenW (lpString=".pdf") returned 4 [0060.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.509] lstrlenW (lpString=".xls") returned 4 [0060.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.509] lstrlenW (lpString=".xlsx") returned 5 [0060.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.509] lstrlenW (lpString=".ppt") returned 4 [0060.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.509] lstrlenW (lpString=".zip") returned 4 [0060.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.509] lstrlenW (lpString=".rar") returned 4 [0060.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.509] lstrlenW (lpString=".bz2") returned 4 [0060.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.510] lstrlenW (lpString=".7z") returned 3 [0060.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.510] lstrlenW (lpString=".dbf") returned 4 [0060.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.510] lstrlenW (lpString=".1cd") returned 4 [0060.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0060.510] lstrlenW (lpString=".jpg") returned 4 [0060.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.510] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7862) returned 1 [0060.510] CloseHandle (hObject=0x1bc) returned 1 [0060.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0060.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0060.511] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.511] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.511] GetLastError () returned 0x0 [0060.511] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0060.755] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0060.756] ReadFile (in: hFile=0x1bc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.757] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.757] SetEndOfFile (hFile=0x1fc) returned 1 [0060.762] CloseHandle (hObject=0x1fc) returned 1 [0060.762] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.762] SetEndOfFile (hFile=0x1bc) returned 1 [0060.762] CloseHandle (hObject=0x1bc) returned 1 [0060.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0060.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.765] lstrlenW (lpString=".doc") returned 4 [0060.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.765] lstrlenW (lpString=".docx") returned 5 [0060.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.765] lstrlenW (lpString=".pdf") returned 4 [0060.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.765] lstrlenW (lpString=".xls") returned 4 [0060.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.766] lstrlenW (lpString=".xlsx") returned 5 [0060.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.766] lstrlenW (lpString=".ppt") returned 4 [0060.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.766] lstrlenW (lpString=".zip") returned 4 [0060.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.766] lstrlenW (lpString=".rar") returned 4 [0060.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.766] lstrlenW (lpString=".bz2") returned 4 [0060.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.766] lstrlenW (lpString=".7z") returned 3 [0060.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.766] lstrlenW (lpString=".dbf") returned 4 [0060.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.766] lstrlenW (lpString=".1cd") returned 4 [0060.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0060.766] lstrlenW (lpString=".jpg") returned 4 [0060.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.901] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2556) returned 1 [0061.901] CloseHandle (hObject=0x16c) returned 1 [0061.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0061.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0061.902] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.902] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.946] GetLastError () returned 0x0 [0061.946] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0061.987] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0061.988] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.988] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.988] SetEndOfFile (hFile=0x150) returned 1 [0062.180] CloseHandle (hObject=0x150) returned 1 [0062.180] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.187] SetEndOfFile (hFile=0x16c) returned 1 [0062.210] CloseHandle (hObject=0x16c) returned 1 [0062.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0062.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.309] lstrlenW (lpString=".doc") returned 4 [0062.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.316] lstrlenW (lpString=".docx") returned 5 [0062.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.322] lstrlenW (lpString=".pdf") returned 4 [0062.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.322] lstrlenW (lpString=".xls") returned 4 [0062.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.322] lstrlenW (lpString=".xlsx") returned 5 [0062.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.323] lstrlenW (lpString=".ppt") returned 4 [0062.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.323] lstrlenW (lpString=".zip") returned 4 [0062.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.323] lstrlenW (lpString=".rar") returned 4 [0062.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.323] lstrlenW (lpString=".bz2") returned 4 [0062.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.323] lstrlenW (lpString=".7z") returned 3 [0062.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.323] lstrlenW (lpString=".dbf") returned 4 [0062.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.323] lstrlenW (lpString=".1cd") returned 4 [0062.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0062.323] lstrlenW (lpString=".jpg") returned 4 [0062.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.324] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3350) returned 1 [0062.324] CloseHandle (hObject=0x22c) returned 1 [0062.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0062.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.324] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.324] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.325] GetLastError () returned 0x0 [0062.325] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd16, lpOverlapped=0x0) returned 1 [0062.326] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0062.327] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.327] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0062.327] SetEndOfFile (hFile=0x214) returned 1 [0062.327] CloseHandle (hObject=0x214) returned 1 [0062.327] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.327] SetEndOfFile (hFile=0x22c) returned 1 [0062.328] CloseHandle (hObject=0x22c) returned 1 [0062.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString=".doc") returned 4 [0062.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString=".docx") returned 5 [0062.329] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0062.329] lstrlenW (lpString=".pdf") returned 4 [0062.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString=".xls") returned 4 [0062.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.329] lstrlenW (lpString=".xlsx") returned 5 [0062.329] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0062.329] lstrlenW (lpString=".ppt") returned 4 [0062.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString=".zip") returned 4 [0062.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.329] lstrlenW (lpString=".rar") returned 4 [0062.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString=".bz2") returned 4 [0062.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString=".7z") returned 3 [0062.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString=".dbf") returned 4 [0062.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString=".1cd") returned 4 [0062.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0062.329] lstrlenW (lpString=".jpg") returned 4 [0062.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.330] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29004) returned 1 [0062.330] CloseHandle (hObject=0x22c) returned 1 [0062.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0062.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.330] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.330] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.331] GetLastError () returned 0x0 [0062.331] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x714c, lpOverlapped=0x0) returned 1 [0062.333] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0062.334] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.334] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.334] SetEndOfFile (hFile=0x214) returned 1 [0062.335] CloseHandle (hObject=0x214) returned 1 [0062.335] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.335] SetEndOfFile (hFile=0x22c) returned 1 [0062.336] CloseHandle (hObject=0x22c) returned 1 [0062.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0062.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.336] lstrlenW (lpString=".doc") returned 4 [0062.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.336] lstrlenW (lpString=".docx") returned 5 [0062.336] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0062.336] lstrlenW (lpString=".pdf") returned 4 [0062.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.336] lstrlenW (lpString=".xls") returned 4 [0062.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.336] lstrlenW (lpString=".xlsx") returned 5 [0062.336] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0062.336] lstrlenW (lpString=".ppt") returned 4 [0062.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.337] lstrlenW (lpString=".zip") returned 4 [0062.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.337] lstrlenW (lpString=".rar") returned 4 [0062.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.337] lstrlenW (lpString=".bz2") returned 4 [0062.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.337] lstrlenW (lpString=".7z") returned 3 [0062.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.337] lstrlenW (lpString=".dbf") returned 4 [0062.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.337] lstrlenW (lpString=".1cd") returned 4 [0062.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0062.337] lstrlenW (lpString=".jpg") returned 4 [0062.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.337] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1330) returned 1 [0062.337] CloseHandle (hObject=0x22c) returned 1 [0062.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0062.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.338] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.338] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.338] GetLastError () returned 0x0 [0062.338] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x532, lpOverlapped=0x0) returned 1 [0062.340] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x540, lpOverlapped=0x0) returned 1 [0062.340] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.341] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.341] SetEndOfFile (hFile=0x214) returned 1 [0062.341] CloseHandle (hObject=0x214) returned 1 [0062.341] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.341] SetEndOfFile (hFile=0x22c) returned 1 [0062.342] CloseHandle (hObject=0x22c) returned 1 [0062.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0062.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.342] lstrlenW (lpString=".doc") returned 4 [0062.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.342] lstrlenW (lpString=".docx") returned 5 [0062.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.342] lstrlenW (lpString=".pdf") returned 4 [0062.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.342] lstrlenW (lpString=".xls") returned 4 [0062.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.342] lstrlenW (lpString=".xlsx") returned 5 [0062.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.343] lstrlenW (lpString=".ppt") returned 4 [0062.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.343] lstrlenW (lpString=".zip") returned 4 [0062.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.343] lstrlenW (lpString=".rar") returned 4 [0062.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.343] lstrlenW (lpString=".bz2") returned 4 [0062.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.343] lstrlenW (lpString=".7z") returned 3 [0062.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.343] lstrlenW (lpString=".dbf") returned 4 [0062.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.343] lstrlenW (lpString=".1cd") returned 4 [0062.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0062.343] lstrlenW (lpString=".jpg") returned 4 [0062.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.344] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1444) returned 1 [0062.344] CloseHandle (hObject=0x22c) returned 1 [0062.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0062.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.344] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.344] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.345] GetLastError () returned 0x0 [0062.345] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0062.346] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0062.347] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.347] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.347] SetEndOfFile (hFile=0x214) returned 1 [0062.347] CloseHandle (hObject=0x214) returned 1 [0062.347] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.348] SetEndOfFile (hFile=0x22c) returned 1 [0062.348] CloseHandle (hObject=0x22c) returned 1 [0062.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.349] lstrlenW (lpString=".doc") returned 4 [0062.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.349] lstrlenW (lpString=".docx") returned 5 [0062.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.349] lstrlenW (lpString=".pdf") returned 4 [0062.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.349] lstrlenW (lpString=".xls") returned 4 [0062.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.349] lstrlenW (lpString=".xlsx") returned 5 [0062.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.349] lstrlenW (lpString=".ppt") returned 4 [0062.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.349] lstrlenW (lpString=".zip") returned 4 [0062.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.349] lstrlenW (lpString=".rar") returned 4 [0062.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.349] lstrlenW (lpString=".bz2") returned 4 [0062.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.349] lstrlenW (lpString=".7z") returned 3 [0062.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.349] lstrlenW (lpString=".dbf") returned 4 [0062.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.350] lstrlenW (lpString=".1cd") returned 4 [0062.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0062.350] lstrlenW (lpString=".jpg") returned 4 [0062.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.350] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7974) returned 1 [0062.350] CloseHandle (hObject=0x22c) returned 1 [0062.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0062.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.350] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.350] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.351] GetLastError () returned 0x0 [0062.351] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0062.352] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0062.353] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.353] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.354] SetEndOfFile (hFile=0x214) returned 1 [0062.354] CloseHandle (hObject=0x214) returned 1 [0062.354] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.354] SetEndOfFile (hFile=0x22c) returned 1 [0062.355] CloseHandle (hObject=0x22c) returned 1 [0062.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0062.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.355] lstrlenW (lpString=".doc") returned 4 [0062.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.355] lstrlenW (lpString=".docx") returned 5 [0062.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.355] lstrlenW (lpString=".pdf") returned 4 [0062.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.355] lstrlenW (lpString=".xls") returned 4 [0062.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.355] lstrlenW (lpString=".xlsx") returned 5 [0062.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.356] lstrlenW (lpString=".ppt") returned 4 [0062.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.356] lstrlenW (lpString=".zip") returned 4 [0062.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.356] lstrlenW (lpString=".rar") returned 4 [0062.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.356] lstrlenW (lpString=".bz2") returned 4 [0062.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.356] lstrlenW (lpString=".7z") returned 3 [0062.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.356] lstrlenW (lpString=".dbf") returned 4 [0062.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.356] lstrlenW (lpString=".1cd") returned 4 [0062.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0062.356] lstrlenW (lpString=".jpg") returned 4 [0062.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.356] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2378) returned 1 [0062.356] CloseHandle (hObject=0x22c) returned 1 [0062.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0062.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.357] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.357] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.357] GetLastError () returned 0x0 [0062.357] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x94a, lpOverlapped=0x0) returned 1 [0062.458] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x950, lpOverlapped=0x0) returned 1 [0062.459] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.459] WriteFile (in: hFile=0x214, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.459] SetEndOfFile (hFile=0x214) returned 1 [0062.459] CloseHandle (hObject=0x214) returned 1 [0062.459] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.459] SetEndOfFile (hFile=0x22c) returned 1 [0062.460] CloseHandle (hObject=0x22c) returned 1 [0062.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0062.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.960] lstrlenW (lpString=".doc") returned 4 [0062.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.960] lstrlenW (lpString=".docx") returned 5 [0062.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.960] lstrlenW (lpString=".pdf") returned 4 [0062.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.966] lstrlenW (lpString=".xls") returned 4 [0062.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.966] lstrlenW (lpString=".xlsx") returned 5 [0062.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.966] lstrlenW (lpString=".ppt") returned 4 [0062.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.967] lstrlenW (lpString=".zip") returned 4 [0062.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.973] lstrlenW (lpString=".rar") returned 4 [0062.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.973] lstrlenW (lpString=".bz2") returned 4 [0062.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.979] lstrlenW (lpString=".7z") returned 3 [0062.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.979] lstrlenW (lpString=".dbf") returned 4 [0062.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.980] lstrlenW (lpString=".1cd") returned 4 [0062.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0062.980] lstrlenW (lpString=".jpg") returned 4 [0062.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.980] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10538) returned 1 [0062.980] CloseHandle (hObject=0x150) returned 1 [0062.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0062.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.980] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.980] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0062.981] GetLastError () returned 0x0 [0062.981] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x292a, lpOverlapped=0x0) returned 1 [0062.985] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0062.986] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.986] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.986] SetEndOfFile (hFile=0x160) returned 1 [0062.986] CloseHandle (hObject=0x160) returned 1 [0062.986] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.986] SetEndOfFile (hFile=0x150) returned 1 [0062.987] CloseHandle (hObject=0x150) returned 1 [0062.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0062.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.988] lstrlenW (lpString=".doc") returned 4 [0062.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.988] lstrlenW (lpString=".docx") returned 5 [0062.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.988] lstrlenW (lpString=".pdf") returned 4 [0062.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.988] lstrlenW (lpString=".xls") returned 4 [0062.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.988] lstrlenW (lpString=".xlsx") returned 5 [0062.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.988] lstrlenW (lpString=".ppt") returned 4 [0062.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.988] lstrlenW (lpString=".zip") returned 4 [0062.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.988] lstrlenW (lpString=".rar") returned 4 [0062.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.988] lstrlenW (lpString=".bz2") returned 4 [0062.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.988] lstrlenW (lpString=".7z") returned 3 [0062.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.989] lstrlenW (lpString=".dbf") returned 4 [0062.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.989] lstrlenW (lpString=".1cd") returned 4 [0062.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.989] lstrlenW (lpString=".jpg") returned 4 [0062.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.989] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4236) returned 1 [0062.989] CloseHandle (hObject=0x150) returned 1 [0062.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0062.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.989] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.989] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0062.990] GetLastError () returned 0x0 [0062.990] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x108c, lpOverlapped=0x0) returned 1 [0062.991] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0062.992] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.992] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.993] SetEndOfFile (hFile=0x160) returned 1 [0062.993] CloseHandle (hObject=0x160) returned 1 [0062.993] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.993] SetEndOfFile (hFile=0x150) returned 1 [0062.994] CloseHandle (hObject=0x150) returned 1 [0062.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0062.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.994] lstrlenW (lpString=".doc") returned 4 [0062.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.994] lstrlenW (lpString=".docx") returned 5 [0062.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.994] lstrlenW (lpString=".pdf") returned 4 [0062.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.994] lstrlenW (lpString=".xls") returned 4 [0062.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.994] lstrlenW (lpString=".xlsx") returned 5 [0062.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.994] lstrlenW (lpString=".ppt") returned 4 [0062.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.994] lstrlenW (lpString=".zip") returned 4 [0062.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.994] lstrlenW (lpString=".rar") returned 4 [0062.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.995] lstrlenW (lpString=".bz2") returned 4 [0062.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.995] lstrlenW (lpString=".7z") returned 3 [0062.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.995] lstrlenW (lpString=".dbf") returned 4 [0062.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.995] lstrlenW (lpString=".1cd") returned 4 [0062.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.995] lstrlenW (lpString=".jpg") returned 4 [0062.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.996] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3564) returned 1 [0062.996] CloseHandle (hObject=0x150) returned 1 [0062.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0062.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.996] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.996] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0062.997] GetLastError () returned 0x0 [0062.997] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xdec, lpOverlapped=0x0) returned 1 [0062.998] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0062.999] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.999] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.999] SetEndOfFile (hFile=0x160) returned 1 [0062.999] CloseHandle (hObject=0x160) returned 1 [0062.999] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.999] SetEndOfFile (hFile=0x150) returned 1 [0063.000] CloseHandle (hObject=0x150) returned 1 [0063.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString=".doc") returned 4 [0063.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString=".docx") returned 5 [0063.001] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0063.001] lstrlenW (lpString=".pdf") returned 4 [0063.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString=".xls") returned 4 [0063.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.001] lstrlenW (lpString=".xlsx") returned 5 [0063.001] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0063.001] lstrlenW (lpString=".ppt") returned 4 [0063.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString=".zip") returned 4 [0063.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.001] lstrlenW (lpString=".rar") returned 4 [0063.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString=".bz2") returned 4 [0063.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString=".7z") returned 3 [0063.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString=".dbf") returned 4 [0063.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString=".1cd") returned 4 [0063.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0063.001] lstrlenW (lpString=".jpg") returned 4 [0063.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.003] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2422) returned 1 [0063.003] CloseHandle (hObject=0x160) returned 1 [0063.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0063.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.004] GetLastError () returned 0x0 [0063.004] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x976, lpOverlapped=0x0) returned 1 [0063.005] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x980, lpOverlapped=0x0) returned 1 [0063.006] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.006] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.006] SetEndOfFile (hFile=0x158) returned 1 [0063.007] CloseHandle (hObject=0x158) returned 1 [0063.007] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.007] SetEndOfFile (hFile=0x160) returned 1 [0063.007] CloseHandle (hObject=0x160) returned 1 [0063.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0063.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.008] lstrlenW (lpString=".doc") returned 4 [0063.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.008] lstrlenW (lpString=".docx") returned 5 [0063.008] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0063.008] lstrlenW (lpString=".pdf") returned 4 [0063.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.008] lstrlenW (lpString=".xls") returned 4 [0063.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.008] lstrlenW (lpString=".xlsx") returned 5 [0063.008] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0063.008] lstrlenW (lpString=".ppt") returned 4 [0063.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.008] lstrlenW (lpString=".zip") returned 4 [0063.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.008] lstrlenW (lpString=".rar") returned 4 [0063.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.008] lstrlenW (lpString=".bz2") returned 4 [0063.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.009] lstrlenW (lpString=".7z") returned 3 [0063.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.009] lstrlenW (lpString=".dbf") returned 4 [0063.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.009] lstrlenW (lpString=".1cd") returned 4 [0063.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0063.009] lstrlenW (lpString=".jpg") returned 4 [0063.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.010] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2262) returned 1 [0063.010] CloseHandle (hObject=0x160) returned 1 [0063.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0063.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.010] GetLastError () returned 0x0 [0063.011] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0063.585] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0063.586] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.586] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.586] SetEndOfFile (hFile=0x158) returned 1 [0063.907] CloseHandle (hObject=0x158) returned 1 [0063.907] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.907] SetEndOfFile (hFile=0x160) returned 1 [0063.908] CloseHandle (hObject=0x160) returned 1 [0063.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0063.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.919] lstrlenW (lpString=".doc") returned 4 [0063.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.919] lstrlenW (lpString=".docx") returned 5 [0063.919] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0063.919] lstrlenW (lpString=".pdf") returned 4 [0063.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.919] lstrlenW (lpString=".xls") returned 4 [0063.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.922] lstrlenW (lpString=".xlsx") returned 5 [0063.922] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0063.922] lstrlenW (lpString=".ppt") returned 4 [0063.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.922] lstrlenW (lpString=".zip") returned 4 [0063.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.922] lstrlenW (lpString=".rar") returned 4 [0063.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.922] lstrlenW (lpString=".bz2") returned 4 [0063.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.922] lstrlenW (lpString=".7z") returned 3 [0063.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.923] lstrlenW (lpString=".dbf") returned 4 [0063.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.923] lstrlenW (lpString=".1cd") returned 4 [0063.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0063.923] lstrlenW (lpString=".jpg") returned 4 [0063.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.945] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29628) returned 1 [0063.945] CloseHandle (hObject=0x1f4) returned 1 [0063.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0063.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.959] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.959] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0063.965] GetLastError () returned 0x0 [0063.965] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0063.987] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0064.782] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x1bc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.782] SetEndOfFile (hFile=0x1bc) returned 1 [0064.783] CloseHandle (hObject=0x1bc) returned 1 [0064.783] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.783] SetEndOfFile (hFile=0x1f4) returned 1 [0064.784] CloseHandle (hObject=0x1f4) returned 1 [0064.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0064.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.882] lstrlenW (lpString=".doc") returned 4 [0064.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.883] lstrlenW (lpString=".docx") returned 5 [0064.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.883] lstrlenW (lpString=".pdf") returned 4 [0064.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.895] lstrlenW (lpString=".xls") returned 4 [0064.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.895] lstrlenW (lpString=".xlsx") returned 5 [0064.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.895] lstrlenW (lpString=".ppt") returned 4 [0064.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.895] lstrlenW (lpString=".zip") returned 4 [0064.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.896] lstrlenW (lpString=".rar") returned 4 [0064.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.896] lstrlenW (lpString=".bz2") returned 4 [0064.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.896] lstrlenW (lpString=".7z") returned 3 [0064.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.896] lstrlenW (lpString=".dbf") returned 4 [0064.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.896] lstrlenW (lpString=".1cd") returned 4 [0064.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0064.896] lstrlenW (lpString=".jpg") returned 4 [0064.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.896] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20784) returned 1 [0064.896] CloseHandle (hObject=0x190) returned 1 [0064.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0064.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.897] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.897] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.897] GetLastError () returned 0x0 [0064.897] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5130, lpOverlapped=0x0) returned 1 [0064.900] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0064.901] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.901] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.901] SetEndOfFile (hFile=0x1ec) returned 1 [0064.901] CloseHandle (hObject=0x1ec) returned 1 [0064.901] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.901] SetEndOfFile (hFile=0x190) returned 1 [0064.902] CloseHandle (hObject=0x190) returned 1 [0064.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0064.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.903] lstrlenW (lpString=".doc") returned 4 [0064.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString=".docx") returned 5 [0064.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.903] lstrlenW (lpString=".pdf") returned 4 [0064.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString=".xls") returned 4 [0064.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.903] lstrlenW (lpString=".xlsx") returned 5 [0064.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.903] lstrlenW (lpString=".ppt") returned 4 [0064.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.903] lstrlenW (lpString=".zip") returned 4 [0064.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.903] lstrlenW (lpString=".rar") returned 4 [0064.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString=".bz2") returned 4 [0064.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString=".7z") returned 3 [0064.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.903] lstrlenW (lpString=".dbf") returned 4 [0064.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.903] lstrlenW (lpString=".1cd") returned 4 [0064.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0064.903] lstrlenW (lpString=".jpg") returned 4 [0064.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.904] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24588) returned 1 [0064.904] CloseHandle (hObject=0x190) returned 1 [0064.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0064.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.904] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.904] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.904] GetLastError () returned 0x0 [0064.904] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x600c, lpOverlapped=0x0) returned 1 [0064.910] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0064.911] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.911] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.911] SetEndOfFile (hFile=0x1ec) returned 1 [0064.911] CloseHandle (hObject=0x1ec) returned 1 [0064.911] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.911] SetEndOfFile (hFile=0x190) returned 1 [0064.912] CloseHandle (hObject=0x190) returned 1 [0064.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0064.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.912] lstrlenW (lpString=".doc") returned 4 [0064.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.912] lstrlenW (lpString=".docx") returned 5 [0064.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.912] lstrlenW (lpString=".pdf") returned 4 [0064.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString=".xls") returned 4 [0064.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.913] lstrlenW (lpString=".xlsx") returned 5 [0064.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.913] lstrlenW (lpString=".ppt") returned 4 [0064.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.913] lstrlenW (lpString=".zip") returned 4 [0064.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.913] lstrlenW (lpString=".rar") returned 4 [0064.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString=".bz2") returned 4 [0064.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString=".7z") returned 3 [0064.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.913] lstrlenW (lpString=".dbf") returned 4 [0064.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.913] lstrlenW (lpString=".1cd") returned 4 [0064.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0064.913] lstrlenW (lpString=".jpg") returned 4 [0064.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.914] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2226) returned 1 [0064.914] CloseHandle (hObject=0x190) returned 1 [0064.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0064.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.914] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.914] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.914] GetLastError () returned 0x0 [0064.914] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0064.917] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.918] SetEndOfFile (hFile=0x1ec) returned 1 [0064.918] CloseHandle (hObject=0x1ec) returned 1 [0064.918] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.918] SetEndOfFile (hFile=0x190) returned 1 [0064.918] CloseHandle (hObject=0x190) returned 1 [0064.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0064.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.919] lstrlenW (lpString=".doc") returned 4 [0064.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.919] lstrlenW (lpString=".docx") returned 5 [0064.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.919] lstrlenW (lpString=".pdf") returned 4 [0064.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.919] lstrlenW (lpString=".xls") returned 4 [0064.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.919] lstrlenW (lpString=".xlsx") returned 5 [0064.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.919] lstrlenW (lpString=".ppt") returned 4 [0064.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.919] lstrlenW (lpString=".zip") returned 4 [0064.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.919] lstrlenW (lpString=".rar") returned 4 [0064.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.919] lstrlenW (lpString=".bz2") returned 4 [0064.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.920] lstrlenW (lpString=".7z") returned 3 [0064.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.920] lstrlenW (lpString=".dbf") returned 4 [0064.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.920] lstrlenW (lpString=".1cd") returned 4 [0064.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0064.920] lstrlenW (lpString=".jpg") returned 4 [0064.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.920] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14820) returned 1 [0064.920] CloseHandle (hObject=0x190) returned 1 [0064.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0064.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.920] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.921] GetLastError () returned 0x0 [0064.921] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0064.924] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.924] SetEndOfFile (hFile=0x1ec) returned 1 [0064.924] CloseHandle (hObject=0x1ec) returned 1 [0064.924] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.924] SetEndOfFile (hFile=0x190) returned 1 [0064.925] CloseHandle (hObject=0x190) returned 1 [0064.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.926] lstrlenW (lpString=".doc") returned 4 [0064.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString=".docx") returned 5 [0064.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.926] lstrlenW (lpString=".pdf") returned 4 [0064.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString=".xls") returned 4 [0064.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.926] lstrlenW (lpString=".xlsx") returned 5 [0064.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.926] lstrlenW (lpString=".ppt") returned 4 [0064.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.926] lstrlenW (lpString=".zip") returned 4 [0064.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.926] lstrlenW (lpString=".rar") returned 4 [0064.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString=".bz2") returned 4 [0064.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString=".7z") returned 3 [0064.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.926] lstrlenW (lpString=".dbf") returned 4 [0064.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.926] lstrlenW (lpString=".1cd") returned 4 [0064.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0064.927] lstrlenW (lpString=".jpg") returned 4 [0064.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.927] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3692) returned 1 [0064.927] CloseHandle (hObject=0x190) returned 1 [0064.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0064.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.927] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.927] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.928] GetLastError () returned 0x0 [0064.928] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0064.929] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0064.930] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.930] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.930] SetEndOfFile (hFile=0x1ec) returned 1 [0064.930] CloseHandle (hObject=0x1ec) returned 1 [0064.930] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.930] SetEndOfFile (hFile=0x190) returned 1 [0064.931] CloseHandle (hObject=0x190) returned 1 [0064.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0064.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.931] lstrlenW (lpString=".doc") returned 4 [0064.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString=".docx") returned 5 [0064.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.932] lstrlenW (lpString=".pdf") returned 4 [0064.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString=".xls") returned 4 [0064.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.932] lstrlenW (lpString=".xlsx") returned 5 [0064.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.932] lstrlenW (lpString=".ppt") returned 4 [0064.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.932] lstrlenW (lpString=".zip") returned 4 [0064.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.932] lstrlenW (lpString=".rar") returned 4 [0064.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString=".bz2") returned 4 [0064.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString=".7z") returned 3 [0064.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.932] lstrlenW (lpString=".dbf") returned 4 [0064.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.932] lstrlenW (lpString=".1cd") returned 4 [0064.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0064.932] lstrlenW (lpString=".jpg") returned 4 [0064.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.933] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3632) returned 1 [0064.933] CloseHandle (hObject=0x190) returned 1 [0064.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0064.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.933] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.934] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.934] GetLastError () returned 0x0 [0064.934] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe30, lpOverlapped=0x0) returned 1 [0064.935] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0064.936] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.936] SetEndOfFile (hFile=0x1ec) returned 1 [0064.937] CloseHandle (hObject=0x1ec) returned 1 [0064.937] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.937] SetEndOfFile (hFile=0x190) returned 1 [0064.937] CloseHandle (hObject=0x190) returned 1 [0064.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.938] lstrlenW (lpString=".doc") returned 4 [0064.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.938] lstrlenW (lpString=".docx") returned 5 [0064.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.938] lstrlenW (lpString=".pdf") returned 4 [0064.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.938] lstrlenW (lpString=".xls") returned 4 [0064.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.938] lstrlenW (lpString=".xlsx") returned 5 [0064.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.938] lstrlenW (lpString=".ppt") returned 4 [0064.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.938] lstrlenW (lpString=".zip") returned 4 [0064.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.938] lstrlenW (lpString=".rar") returned 4 [0064.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.939] lstrlenW (lpString=".bz2") returned 4 [0064.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.939] lstrlenW (lpString=".7z") returned 3 [0064.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.939] lstrlenW (lpString=".dbf") returned 4 [0064.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.939] lstrlenW (lpString=".1cd") returned 4 [0064.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0064.939] lstrlenW (lpString=".jpg") returned 4 [0064.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.940] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3616) returned 1 [0064.940] CloseHandle (hObject=0x190) returned 1 [0064.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0064.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.941] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.941] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.941] GetLastError () returned 0x0 [0064.941] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe20, lpOverlapped=0x0) returned 1 [0065.130] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe30, lpOverlapped=0x0) returned 1 [0065.131] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.131] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.131] SetEndOfFile (hFile=0x1ec) returned 1 [0065.177] CloseHandle (hObject=0x1ec) returned 1 [0065.177] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.177] SetEndOfFile (hFile=0x190) returned 1 [0065.178] CloseHandle (hObject=0x190) returned 1 [0065.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.083] lstrlenW (lpString=".doc") returned 4 [0066.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.083] lstrlenW (lpString=".docx") returned 5 [0066.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.084] lstrlenW (lpString=".pdf") returned 4 [0066.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.084] lstrlenW (lpString=".xls") returned 4 [0066.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.084] lstrlenW (lpString=".xlsx") returned 5 [0066.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.084] lstrlenW (lpString=".ppt") returned 4 [0066.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.085] lstrlenW (lpString=".zip") returned 4 [0066.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.085] lstrlenW (lpString=".rar") returned 4 [0066.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.085] lstrlenW (lpString=".bz2") returned 4 [0066.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.085] lstrlenW (lpString=".7z") returned 3 [0066.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.085] lstrlenW (lpString=".dbf") returned 4 [0066.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.085] lstrlenW (lpString=".1cd") returned 4 [0066.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0066.085] lstrlenW (lpString=".jpg") returned 4 [0066.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.349] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2004) returned 1 [0066.356] CloseHandle (hObject=0x158) returned 1 [0066.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0066.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.382] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.382] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.383] GetLastError () returned 0x0 [0066.383] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7d4, lpOverlapped=0x0) returned 1 [0066.384] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0066.385] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.385] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.385] SetEndOfFile (hFile=0x160) returned 1 [0066.386] CloseHandle (hObject=0x160) returned 1 [0066.386] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.386] SetEndOfFile (hFile=0x158) returned 1 [0066.386] CloseHandle (hObject=0x158) returned 1 [0066.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0066.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.387] lstrlenW (lpString=".doc") returned 4 [0066.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.387] lstrlenW (lpString=".docx") returned 5 [0066.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.387] lstrlenW (lpString=".pdf") returned 4 [0066.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.387] lstrlenW (lpString=".xls") returned 4 [0066.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.387] lstrlenW (lpString=".xlsx") returned 5 [0066.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.387] lstrlenW (lpString=".ppt") returned 4 [0066.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.387] lstrlenW (lpString=".zip") returned 4 [0066.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.387] lstrlenW (lpString=".rar") returned 4 [0066.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.387] lstrlenW (lpString=".bz2") returned 4 [0066.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.387] lstrlenW (lpString=".7z") returned 3 [0066.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.387] lstrlenW (lpString=".dbf") returned 4 [0066.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.388] lstrlenW (lpString=".1cd") returned 4 [0066.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0066.388] lstrlenW (lpString=".jpg") returned 4 [0066.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.388] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2296) returned 1 [0066.388] CloseHandle (hObject=0x158) returned 1 [0066.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0066.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.388] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.388] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.389] GetLastError () returned 0x0 [0066.389] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0066.391] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x900, lpOverlapped=0x0) returned 1 [0066.391] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.391] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.391] SetEndOfFile (hFile=0x160) returned 1 [0066.392] CloseHandle (hObject=0x160) returned 1 [0066.392] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.392] SetEndOfFile (hFile=0x158) returned 1 [0066.393] CloseHandle (hObject=0x158) returned 1 [0066.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0066.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.393] lstrlenW (lpString=".doc") returned 4 [0066.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.393] lstrlenW (lpString=".docx") returned 5 [0066.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.393] lstrlenW (lpString=".pdf") returned 4 [0066.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.393] lstrlenW (lpString=".xls") returned 4 [0066.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.393] lstrlenW (lpString=".xlsx") returned 5 [0066.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.393] lstrlenW (lpString=".ppt") returned 4 [0066.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.393] lstrlenW (lpString=".zip") returned 4 [0066.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.394] lstrlenW (lpString=".rar") returned 4 [0066.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.394] lstrlenW (lpString=".bz2") returned 4 [0066.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.394] lstrlenW (lpString=".7z") returned 3 [0066.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.394] lstrlenW (lpString=".dbf") returned 4 [0066.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.394] lstrlenW (lpString=".1cd") returned 4 [0066.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0066.394] lstrlenW (lpString=".jpg") returned 4 [0066.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.394] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8564) returned 1 [0066.394] CloseHandle (hObject=0x158) returned 1 [0066.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0066.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.395] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.395] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.395] GetLastError () returned 0x0 [0066.395] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2174, lpOverlapped=0x0) returned 1 [0066.397] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0066.398] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.398] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.398] SetEndOfFile (hFile=0x160) returned 1 [0066.398] CloseHandle (hObject=0x160) returned 1 [0066.398] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.398] SetEndOfFile (hFile=0x158) returned 1 [0066.399] CloseHandle (hObject=0x158) returned 1 [0066.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0066.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.399] lstrlenW (lpString=".doc") returned 4 [0066.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.399] lstrlenW (lpString=".docx") returned 5 [0066.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.399] lstrlenW (lpString=".pdf") returned 4 [0066.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.399] lstrlenW (lpString=".xls") returned 4 [0066.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.400] lstrlenW (lpString=".xlsx") returned 5 [0066.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.400] lstrlenW (lpString=".ppt") returned 4 [0066.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.400] lstrlenW (lpString=".zip") returned 4 [0066.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.400] lstrlenW (lpString=".rar") returned 4 [0066.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.400] lstrlenW (lpString=".bz2") returned 4 [0066.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.400] lstrlenW (lpString=".7z") returned 3 [0066.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.400] lstrlenW (lpString=".dbf") returned 4 [0066.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.400] lstrlenW (lpString=".1cd") returned 4 [0066.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0066.400] lstrlenW (lpString=".jpg") returned 4 [0066.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.403] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1768) returned 1 [0066.403] CloseHandle (hObject=0x158) returned 1 [0066.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0066.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.403] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.403] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.403] GetLastError () returned 0x0 [0066.403] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0066.405] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0066.406] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.406] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.406] SetEndOfFile (hFile=0x160) returned 1 [0066.406] CloseHandle (hObject=0x160) returned 1 [0066.406] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.406] SetEndOfFile (hFile=0x158) returned 1 [0066.407] CloseHandle (hObject=0x158) returned 1 [0066.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0066.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.407] lstrlenW (lpString=".doc") returned 4 [0066.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.407] lstrlenW (lpString=".docx") returned 5 [0066.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.408] lstrlenW (lpString=".pdf") returned 4 [0066.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString=".xls") returned 4 [0066.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.408] lstrlenW (lpString=".xlsx") returned 5 [0066.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.408] lstrlenW (lpString=".ppt") returned 4 [0066.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.408] lstrlenW (lpString=".zip") returned 4 [0066.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.408] lstrlenW (lpString=".rar") returned 4 [0066.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString=".bz2") returned 4 [0066.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString=".7z") returned 3 [0066.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.408] lstrlenW (lpString=".dbf") returned 4 [0066.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.408] lstrlenW (lpString=".1cd") returned 4 [0066.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0066.408] lstrlenW (lpString=".jpg") returned 4 [0066.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.409] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=900) returned 1 [0066.409] CloseHandle (hObject=0x158) returned 1 [0066.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0066.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.409] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.409] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.410] GetLastError () returned 0x0 [0066.410] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x384, lpOverlapped=0x0) returned 1 [0066.411] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x390, lpOverlapped=0x0) returned 1 [0066.412] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.412] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.413] SetEndOfFile (hFile=0x160) returned 1 [0066.413] CloseHandle (hObject=0x160) returned 1 [0066.413] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.413] SetEndOfFile (hFile=0x158) returned 1 [0066.413] CloseHandle (hObject=0x158) returned 1 [0066.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.414] lstrlenW (lpString=".doc") returned 4 [0066.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".docx") returned 5 [0066.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.414] lstrlenW (lpString=".pdf") returned 4 [0066.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".xls") returned 4 [0066.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.414] lstrlenW (lpString=".xlsx") returned 5 [0066.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.414] lstrlenW (lpString=".ppt") returned 4 [0066.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.414] lstrlenW (lpString=".zip") returned 4 [0066.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.414] lstrlenW (lpString=".rar") returned 4 [0066.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".bz2") returned 4 [0066.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".7z") returned 3 [0066.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.415] lstrlenW (lpString=".dbf") returned 4 [0066.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.415] lstrlenW (lpString=".1cd") returned 4 [0066.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0066.415] lstrlenW (lpString=".jpg") returned 4 [0066.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.415] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2524) returned 1 [0066.415] CloseHandle (hObject=0x158) returned 1 [0066.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0066.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0066.415] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.416] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0066.416] GetLastError () returned 0x0 [0066.416] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9dc, lpOverlapped=0x0) returned 1 [0066.530] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0066.531] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.531] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.531] SetEndOfFile (hFile=0x160) returned 1 [0067.463] CloseHandle (hObject=0x160) returned 1 [0067.463] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.463] SetEndOfFile (hFile=0x158) returned 1 [0067.464] CloseHandle (hObject=0x158) returned 1 [0067.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0067.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.567] lstrlenW (lpString=".doc") returned 4 [0067.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.567] lstrlenW (lpString=".docx") returned 5 [0067.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.567] lstrlenW (lpString=".pdf") returned 4 [0067.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.567] lstrlenW (lpString=".xls") returned 4 [0067.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.567] lstrlenW (lpString=".xlsx") returned 5 [0067.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.568] lstrlenW (lpString=".ppt") returned 4 [0067.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.568] lstrlenW (lpString=".zip") returned 4 [0067.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.568] lstrlenW (lpString=".rar") returned 4 [0067.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.568] lstrlenW (lpString=".bz2") returned 4 [0067.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.568] lstrlenW (lpString=".7z") returned 3 [0067.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.568] lstrlenW (lpString=".dbf") returned 4 [0067.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.568] lstrlenW (lpString=".1cd") returned 4 [0067.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0067.568] lstrlenW (lpString=".jpg") returned 4 [0067.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.208] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6938) returned 1 [0068.208] CloseHandle (hObject=0x150) returned 1 [0068.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0068.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.219] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.221] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.227] GetLastError () returned 0x0 [0068.227] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0068.274] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0068.275] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.275] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.275] SetEndOfFile (hFile=0x15c) returned 1 [0068.275] CloseHandle (hObject=0x15c) returned 1 [0068.275] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.275] SetEndOfFile (hFile=0x150) returned 1 [0068.276] CloseHandle (hObject=0x150) returned 1 [0068.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0068.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.416] lstrlenW (lpString=".doc") returned 4 [0068.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.416] lstrlenW (lpString=".docx") returned 5 [0068.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.416] lstrlenW (lpString=".pdf") returned 4 [0068.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.416] lstrlenW (lpString=".xls") returned 4 [0068.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.417] lstrlenW (lpString=".xlsx") returned 5 [0068.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.417] lstrlenW (lpString=".ppt") returned 4 [0068.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.417] lstrlenW (lpString=".zip") returned 4 [0068.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.417] lstrlenW (lpString=".rar") returned 4 [0068.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString=".bz2") returned 4 [0068.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString=".7z") returned 3 [0068.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.417] lstrlenW (lpString=".dbf") returned 4 [0068.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.417] lstrlenW (lpString=".1cd") returned 4 [0068.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.417] lstrlenW (lpString=".jpg") returned 4 [0068.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString=".pdf") returned 4 [0068.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.417] lstrlenW (lpString=".xls") returned 4 [0068.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.417] lstrlenW (lpString=".xlsx") returned 5 [0068.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.418] lstrlenW (lpString=".ppt") returned 4 [0068.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.418] lstrlenW (lpString=".zip") returned 4 [0068.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.418] lstrlenW (lpString=".rar") returned 4 [0068.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.418] lstrlenW (lpString=".bz2") returned 4 [0068.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.418] lstrlenW (lpString=".7z") returned 3 [0068.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.418] lstrlenW (lpString=".dbf") returned 4 [0068.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.418] lstrlenW (lpString=".1cd") returned 4 [0068.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0068.418] lstrlenW (lpString=".jpg") returned 4 [0068.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.418] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") [0068.447] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17850) returned 1 [0068.447] CloseHandle (hObject=0x16c) returned 1 [0068.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0068.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0068.447] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.447] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0068.448] GetLastError () returned 0x0 [0068.448] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0068.681] WriteFile (in: hFile=0x154, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0068.682] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.682] WriteFile (in: hFile=0x154, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.682] SetEndOfFile (hFile=0x154) returned 1 [0068.682] CloseHandle (hObject=0x154) returned 1 [0068.682] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.682] SetEndOfFile (hFile=0x16c) returned 1 [0068.683] CloseHandle (hObject=0x16c) returned 1 [0068.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0068.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.684] lstrlenW (lpString=".doc") returned 4 [0068.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.684] lstrlenW (lpString=".docx") returned 5 [0068.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.684] lstrlenW (lpString=".pdf") returned 4 [0068.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.684] lstrlenW (lpString=".xls") returned 4 [0068.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.684] lstrlenW (lpString=".xlsx") returned 5 [0068.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.684] lstrlenW (lpString=".ppt") returned 4 [0068.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.684] lstrlenW (lpString=".zip") returned 4 [0068.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.685] lstrlenW (lpString=".rar") returned 4 [0068.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".bz2") returned 4 [0068.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".7z") returned 3 [0068.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.685] lstrlenW (lpString=".dbf") returned 4 [0068.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.685] lstrlenW (lpString=".1cd") returned 4 [0068.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.685] lstrlenW (lpString=".jpg") returned 4 [0068.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".pdf") returned 4 [0068.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".xls") returned 4 [0068.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.685] lstrlenW (lpString=".xlsx") returned 5 [0068.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.685] lstrlenW (lpString=".ppt") returned 4 [0068.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.685] lstrlenW (lpString=".zip") returned 4 [0068.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.685] lstrlenW (lpString=".rar") returned 4 [0068.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".bz2") returned 4 [0068.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.685] lstrlenW (lpString=".7z") returned 3 [0068.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.686] lstrlenW (lpString=".dbf") returned 4 [0068.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.686] lstrlenW (lpString=".1cd") returned 4 [0068.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0068.686] lstrlenW (lpString=".jpg") returned 4 [0068.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.686] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") [0068.686] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14194) returned 1 [0068.686] CloseHandle (hObject=0x16c) returned 1 [0068.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0068.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0068.686] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.687] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0068.687] GetLastError () returned 0x0 [0068.687] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3772, lpOverlapped=0x0) returned 1 [0068.788] WriteFile (in: hFile=0x154, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0068.789] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.789] WriteFile (in: hFile=0x154, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.789] SetEndOfFile (hFile=0x154) returned 1 [0069.203] CloseHandle (hObject=0x154) returned 1 [0069.203] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.203] SetEndOfFile (hFile=0x16c) returned 1 [0069.204] CloseHandle (hObject=0x16c) returned 1 [0069.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0069.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.337] lstrlenW (lpString=".doc") returned 4 [0069.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.337] lstrlenW (lpString=".docx") returned 5 [0069.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.337] lstrlenW (lpString=".pdf") returned 4 [0069.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.337] lstrlenW (lpString=".xls") returned 4 [0069.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.337] lstrlenW (lpString=".xlsx") returned 5 [0069.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.337] lstrlenW (lpString=".ppt") returned 4 [0069.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.338] lstrlenW (lpString=".zip") returned 4 [0069.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.338] lstrlenW (lpString=".rar") returned 4 [0069.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString=".bz2") returned 4 [0069.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString=".7z") returned 3 [0069.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.338] lstrlenW (lpString=".dbf") returned 4 [0069.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.338] lstrlenW (lpString=".1cd") returned 4 [0069.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.338] lstrlenW (lpString=".jpg") returned 4 [0069.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString=".pdf") returned 4 [0069.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString=".xls") returned 4 [0069.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.338] lstrlenW (lpString=".xlsx") returned 5 [0069.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.338] lstrlenW (lpString=".ppt") returned 4 [0069.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.338] lstrlenW (lpString=".zip") returned 4 [0069.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.338] lstrlenW (lpString=".rar") returned 4 [0069.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.338] lstrlenW (lpString=".bz2") returned 4 [0069.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.339] lstrlenW (lpString=".7z") returned 3 [0069.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.339] lstrlenW (lpString=".dbf") returned 4 [0069.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.339] lstrlenW (lpString=".1cd") returned 4 [0069.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0069.339] lstrlenW (lpString=".jpg") returned 4 [0069.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.339] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") [0070.099] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6068) returned 1 [0070.099] CloseHandle (hObject=0x1f4) returned 1 [0070.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0070.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.100] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.100] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.121] GetLastError () returned 0x0 [0070.121] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0070.123] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0070.124] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.124] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.124] SetEndOfFile (hFile=0x158) returned 1 [0070.124] CloseHandle (hObject=0x158) returned 1 [0070.124] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.124] SetEndOfFile (hFile=0x1f4) returned 1 [0070.125] CloseHandle (hObject=0x1f4) returned 1 [0070.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString=".doc") returned 4 [0070.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString=".docx") returned 5 [0070.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.126] lstrlenW (lpString=".pdf") returned 4 [0070.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString=".xls") returned 4 [0070.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.126] lstrlenW (lpString=".xlsx") returned 5 [0070.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.126] lstrlenW (lpString=".ppt") returned 4 [0070.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString=".zip") returned 4 [0070.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.126] lstrlenW (lpString=".rar") returned 4 [0070.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString=".bz2") returned 4 [0070.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString=".7z") returned 3 [0070.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString=".dbf") returned 4 [0070.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString=".1cd") returned 4 [0070.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.126] lstrlenW (lpString=".jpg") returned 4 [0070.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString=".pdf") returned 4 [0070.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString=".xls") returned 4 [0070.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.127] lstrlenW (lpString=".xlsx") returned 5 [0070.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.127] lstrlenW (lpString=".ppt") returned 4 [0070.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.127] lstrlenW (lpString=".zip") returned 4 [0070.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.127] lstrlenW (lpString=".rar") returned 4 [0070.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString=".bz2") returned 4 [0070.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString=".7z") returned 3 [0070.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.127] lstrlenW (lpString=".dbf") returned 4 [0070.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.127] lstrlenW (lpString=".1cd") returned 4 [0070.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0070.127] lstrlenW (lpString=".jpg") returned 4 [0070.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.127] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") [0070.128] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8552) returned 1 [0070.128] CloseHandle (hObject=0x1f4) returned 1 [0070.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0070.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.129] GetLastError () returned 0x0 [0070.129] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2168, lpOverlapped=0x0) returned 1 [0070.130] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0070.131] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.131] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.131] SetEndOfFile (hFile=0x158) returned 1 [0070.131] CloseHandle (hObject=0x158) returned 1 [0070.131] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.132] SetEndOfFile (hFile=0x1f4) returned 1 [0070.132] CloseHandle (hObject=0x1f4) returned 1 [0070.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0070.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.140] lstrlenW (lpString=".doc") returned 4 [0070.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.140] lstrlenW (lpString=".docx") returned 5 [0070.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.140] lstrlenW (lpString=".pdf") returned 4 [0070.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.140] lstrlenW (lpString=".xls") returned 4 [0070.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.140] lstrlenW (lpString=".xlsx") returned 5 [0070.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.140] lstrlenW (lpString=".ppt") returned 4 [0070.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.140] lstrlenW (lpString=".zip") returned 4 [0070.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.140] lstrlenW (lpString=".rar") returned 4 [0070.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.140] lstrlenW (lpString=".bz2") returned 4 [0070.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString=".7z") returned 3 [0070.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.141] lstrlenW (lpString=".dbf") returned 4 [0070.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.141] lstrlenW (lpString=".1cd") returned 4 [0070.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.141] lstrlenW (lpString=".jpg") returned 4 [0070.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString=".pdf") returned 4 [0070.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString=".xls") returned 4 [0070.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.141] lstrlenW (lpString=".xlsx") returned 5 [0070.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.141] lstrlenW (lpString=".ppt") returned 4 [0070.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.141] lstrlenW (lpString=".zip") returned 4 [0070.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.141] lstrlenW (lpString=".rar") returned 4 [0070.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString=".bz2") returned 4 [0070.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString=".7z") returned 3 [0070.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.141] lstrlenW (lpString=".dbf") returned 4 [0070.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.142] lstrlenW (lpString=".1cd") returned 4 [0070.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0070.142] lstrlenW (lpString=".jpg") returned 4 [0070.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.142] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") [0070.142] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8424) returned 1 [0070.142] CloseHandle (hObject=0x1f4) returned 1 [0070.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0070.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.143] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.143] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.143] GetLastError () returned 0x0 [0070.143] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x20e8, lpOverlapped=0x0) returned 1 [0070.145] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0070.146] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.146] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.146] SetEndOfFile (hFile=0x158) returned 1 [0070.146] CloseHandle (hObject=0x158) returned 1 [0070.146] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.146] SetEndOfFile (hFile=0x1f4) returned 1 [0070.147] CloseHandle (hObject=0x1f4) returned 1 [0070.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.147] lstrlenW (lpString=".doc") returned 4 [0070.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString=".docx") returned 5 [0070.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.148] lstrlenW (lpString=".pdf") returned 4 [0070.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString=".xls") returned 4 [0070.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.148] lstrlenW (lpString=".xlsx") returned 5 [0070.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.148] lstrlenW (lpString=".ppt") returned 4 [0070.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.148] lstrlenW (lpString=".zip") returned 4 [0070.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.148] lstrlenW (lpString=".rar") returned 4 [0070.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString=".bz2") returned 4 [0070.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString=".7z") returned 3 [0070.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.148] lstrlenW (lpString=".dbf") returned 4 [0070.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.148] lstrlenW (lpString=".1cd") returned 4 [0070.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.148] lstrlenW (lpString=".jpg") returned 4 [0070.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString=".pdf") returned 4 [0070.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.148] lstrlenW (lpString=".xls") returned 4 [0070.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.149] lstrlenW (lpString=".xlsx") returned 5 [0070.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.149] lstrlenW (lpString=".ppt") returned 4 [0070.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.149] lstrlenW (lpString=".zip") returned 4 [0070.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.149] lstrlenW (lpString=".rar") returned 4 [0070.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.149] lstrlenW (lpString=".bz2") returned 4 [0070.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.149] lstrlenW (lpString=".7z") returned 3 [0070.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.149] lstrlenW (lpString=".dbf") returned 4 [0070.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.149] lstrlenW (lpString=".1cd") returned 4 [0070.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0070.149] lstrlenW (lpString=".jpg") returned 4 [0070.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.149] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") [0070.150] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10816) returned 1 [0070.150] CloseHandle (hObject=0x1f4) returned 1 [0070.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0070.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.150] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.150] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.150] GetLastError () returned 0x0 [0070.150] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a40, lpOverlapped=0x0) returned 1 [0070.152] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0070.153] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.153] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.153] SetEndOfFile (hFile=0x158) returned 1 [0070.154] CloseHandle (hObject=0x158) returned 1 [0070.154] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.154] SetEndOfFile (hFile=0x1f4) returned 1 [0070.154] CloseHandle (hObject=0x1f4) returned 1 [0070.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.155] lstrlenW (lpString=".doc") returned 4 [0070.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.155] lstrlenW (lpString=".docx") returned 5 [0070.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.155] lstrlenW (lpString=".pdf") returned 4 [0070.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.155] lstrlenW (lpString=".xls") returned 4 [0070.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.155] lstrlenW (lpString=".xlsx") returned 5 [0070.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.155] lstrlenW (lpString=".ppt") returned 4 [0070.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.155] lstrlenW (lpString=".zip") returned 4 [0070.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.155] lstrlenW (lpString=".rar") returned 4 [0070.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.155] lstrlenW (lpString=".bz2") returned 4 [0070.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString=".7z") returned 3 [0070.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.156] lstrlenW (lpString=".dbf") returned 4 [0070.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.156] lstrlenW (lpString=".1cd") returned 4 [0070.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.156] lstrlenW (lpString=".jpg") returned 4 [0070.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString=".pdf") returned 4 [0070.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString=".xls") returned 4 [0070.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.156] lstrlenW (lpString=".xlsx") returned 5 [0070.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.156] lstrlenW (lpString=".ppt") returned 4 [0070.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.156] lstrlenW (lpString=".zip") returned 4 [0070.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.156] lstrlenW (lpString=".rar") returned 4 [0070.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString=".bz2") returned 4 [0070.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.156] lstrlenW (lpString=".7z") returned 3 [0070.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.156] lstrlenW (lpString=".dbf") returned 4 [0070.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.157] lstrlenW (lpString=".1cd") returned 4 [0070.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0070.157] lstrlenW (lpString=".jpg") returned 4 [0070.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.157] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") [0070.157] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7878) returned 1 [0070.157] CloseHandle (hObject=0x1f4) returned 1 [0070.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0070.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.157] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.158] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.158] GetLastError () returned 0x0 [0070.158] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0070.159] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0070.160] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.160] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.161] SetEndOfFile (hFile=0x158) returned 1 [0070.161] CloseHandle (hObject=0x158) returned 1 [0070.161] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.161] SetEndOfFile (hFile=0x1f4) returned 1 [0070.162] CloseHandle (hObject=0x1f4) returned 1 [0070.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0070.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.162] lstrlenW (lpString=".doc") returned 4 [0070.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.162] lstrlenW (lpString=".docx") returned 5 [0070.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.162] lstrlenW (lpString=".pdf") returned 4 [0070.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.162] lstrlenW (lpString=".xls") returned 4 [0070.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.162] lstrlenW (lpString=".xlsx") returned 5 [0070.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.162] lstrlenW (lpString=".ppt") returned 4 [0070.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.163] lstrlenW (lpString=".zip") returned 4 [0070.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.163] lstrlenW (lpString=".rar") returned 4 [0070.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString=".bz2") returned 4 [0070.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString=".7z") returned 3 [0070.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.163] lstrlenW (lpString=".dbf") returned 4 [0070.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.163] lstrlenW (lpString=".1cd") returned 4 [0070.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.163] lstrlenW (lpString=".jpg") returned 4 [0070.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString=".pdf") returned 4 [0070.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString=".xls") returned 4 [0070.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.163] lstrlenW (lpString=".xlsx") returned 5 [0070.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.163] lstrlenW (lpString=".ppt") returned 4 [0070.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.163] lstrlenW (lpString=".zip") returned 4 [0070.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.163] lstrlenW (lpString=".rar") returned 4 [0070.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.163] lstrlenW (lpString=".bz2") returned 4 [0070.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.164] lstrlenW (lpString=".7z") returned 3 [0070.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.164] lstrlenW (lpString=".dbf") returned 4 [0070.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.164] lstrlenW (lpString=".1cd") returned 4 [0070.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0070.713] lstrlenW (lpString=".jpg") returned 4 [0070.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.713] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") [0070.714] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1472) returned 1 [0070.714] CloseHandle (hObject=0x160) returned 1 [0070.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0070.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.714] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.714] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.714] GetLastError () returned 0x0 [0070.714] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0070.732] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0070.732] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.733] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.733] SetEndOfFile (hFile=0x150) returned 1 [0070.735] CloseHandle (hObject=0x150) returned 1 [0070.735] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.735] SetEndOfFile (hFile=0x160) returned 1 [0070.750] CloseHandle (hObject=0x160) returned 1 [0070.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString=".doc") returned 4 [0070.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString=".docx") returned 5 [0070.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.758] lstrlenW (lpString=".pdf") returned 4 [0070.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString=".xls") returned 4 [0070.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.758] lstrlenW (lpString=".xlsx") returned 5 [0070.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.758] lstrlenW (lpString=".ppt") returned 4 [0070.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString=".zip") returned 4 [0070.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.758] lstrlenW (lpString=".rar") returned 4 [0070.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString=".bz2") returned 4 [0070.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString=".7z") returned 3 [0070.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString=".dbf") returned 4 [0070.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString=".1cd") returned 4 [0070.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.758] lstrlenW (lpString=".jpg") returned 4 [0070.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString=".pdf") returned 4 [0070.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString=".xls") returned 4 [0070.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.759] lstrlenW (lpString=".xlsx") returned 5 [0070.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.759] lstrlenW (lpString=".ppt") returned 4 [0070.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.759] lstrlenW (lpString=".zip") returned 4 [0070.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.759] lstrlenW (lpString=".rar") returned 4 [0070.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString=".bz2") returned 4 [0070.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString=".7z") returned 3 [0070.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.759] lstrlenW (lpString=".dbf") returned 4 [0070.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.759] lstrlenW (lpString=".1cd") returned 4 [0070.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0070.759] lstrlenW (lpString=".jpg") returned 4 [0070.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.759] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") [0070.763] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9010) returned 1 [0070.763] CloseHandle (hObject=0x160) returned 1 [0070.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0070.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.763] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.763] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.763] GetLastError () returned 0x0 [0070.763] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2332, lpOverlapped=0x0) returned 1 [0070.765] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.766] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.766] SetEndOfFile (hFile=0x150) returned 1 [0070.766] CloseHandle (hObject=0x150) returned 1 [0070.766] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.766] SetEndOfFile (hFile=0x160) returned 1 [0070.767] CloseHandle (hObject=0x160) returned 1 [0070.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString=".doc") returned 4 [0070.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString=".docx") returned 5 [0070.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.768] lstrlenW (lpString=".pdf") returned 4 [0070.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString=".xls") returned 4 [0070.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.768] lstrlenW (lpString=".xlsx") returned 5 [0070.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.768] lstrlenW (lpString=".ppt") returned 4 [0070.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString=".zip") returned 4 [0070.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.768] lstrlenW (lpString=".rar") returned 4 [0070.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString=".bz2") returned 4 [0070.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString=".7z") returned 3 [0070.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString=".dbf") returned 4 [0070.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString=".1cd") returned 4 [0070.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.768] lstrlenW (lpString=".jpg") returned 4 [0070.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString=".pdf") returned 4 [0070.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString=".xls") returned 4 [0070.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.769] lstrlenW (lpString=".xlsx") returned 5 [0070.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.769] lstrlenW (lpString=".ppt") returned 4 [0070.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.769] lstrlenW (lpString=".zip") returned 4 [0070.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.769] lstrlenW (lpString=".rar") returned 4 [0070.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString=".bz2") returned 4 [0070.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString=".7z") returned 3 [0070.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.769] lstrlenW (lpString=".dbf") returned 4 [0070.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.769] lstrlenW (lpString=".1cd") returned 4 [0070.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0070.769] lstrlenW (lpString=".jpg") returned 4 [0070.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.769] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") [0070.770] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=42704) returned 1 [0070.770] CloseHandle (hObject=0x160) returned 1 [0070.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0070.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.770] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.770] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.770] GetLastError () returned 0x0 [0070.770] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0070.773] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0070.775] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.775] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.775] SetEndOfFile (hFile=0x150) returned 1 [0070.775] CloseHandle (hObject=0x150) returned 1 [0070.775] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.775] SetEndOfFile (hFile=0x160) returned 1 [0070.776] CloseHandle (hObject=0x160) returned 1 [0070.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0070.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.776] lstrlenW (lpString=".doc") returned 4 [0070.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".docx") returned 5 [0070.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.777] lstrlenW (lpString=".pdf") returned 4 [0070.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".xls") returned 4 [0070.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.777] lstrlenW (lpString=".xlsx") returned 5 [0070.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.777] lstrlenW (lpString=".ppt") returned 4 [0070.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.777] lstrlenW (lpString=".zip") returned 4 [0070.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.777] lstrlenW (lpString=".rar") returned 4 [0070.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".bz2") returned 4 [0070.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".7z") returned 3 [0070.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.777] lstrlenW (lpString=".dbf") returned 4 [0070.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.777] lstrlenW (lpString=".1cd") returned 4 [0070.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.777] lstrlenW (lpString=".jpg") returned 4 [0070.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".pdf") returned 4 [0070.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.777] lstrlenW (lpString=".xls") returned 4 [0070.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.778] lstrlenW (lpString=".xlsx") returned 5 [0070.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.778] lstrlenW (lpString=".ppt") returned 4 [0070.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.778] lstrlenW (lpString=".zip") returned 4 [0070.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.778] lstrlenW (lpString=".rar") returned 4 [0070.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.778] lstrlenW (lpString=".bz2") returned 4 [0070.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.778] lstrlenW (lpString=".7z") returned 3 [0070.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.778] lstrlenW (lpString=".dbf") returned 4 [0070.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.778] lstrlenW (lpString=".1cd") returned 4 [0070.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0070.778] lstrlenW (lpString=".jpg") returned 4 [0070.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.778] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") [0070.779] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15164) returned 1 [0070.779] CloseHandle (hObject=0x160) returned 1 [0070.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0070.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.779] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.780] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.780] GetLastError () returned 0x0 [0070.780] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0070.782] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0070.783] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.783] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.783] SetEndOfFile (hFile=0x150) returned 1 [0070.783] CloseHandle (hObject=0x150) returned 1 [0070.783] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.783] SetEndOfFile (hFile=0x160) returned 1 [0070.784] CloseHandle (hObject=0x160) returned 1 [0070.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString=".doc") returned 4 [0070.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString=".docx") returned 5 [0070.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.785] lstrlenW (lpString=".pdf") returned 4 [0070.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString=".xls") returned 4 [0070.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.785] lstrlenW (lpString=".xlsx") returned 5 [0070.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.785] lstrlenW (lpString=".ppt") returned 4 [0070.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString=".zip") returned 4 [0070.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.785] lstrlenW (lpString=".rar") returned 4 [0070.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString=".bz2") returned 4 [0070.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString=".7z") returned 3 [0070.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString=".dbf") returned 4 [0070.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString=".1cd") returned 4 [0070.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.785] lstrlenW (lpString=".jpg") returned 4 [0070.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString=".pdf") returned 4 [0070.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString=".xls") returned 4 [0070.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.786] lstrlenW (lpString=".xlsx") returned 5 [0070.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.786] lstrlenW (lpString=".ppt") returned 4 [0070.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.786] lstrlenW (lpString=".zip") returned 4 [0070.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.786] lstrlenW (lpString=".rar") returned 4 [0070.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString=".bz2") returned 4 [0070.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString=".7z") returned 3 [0070.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.786] lstrlenW (lpString=".dbf") returned 4 [0070.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.786] lstrlenW (lpString=".1cd") returned 4 [0070.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0070.786] lstrlenW (lpString=".jpg") returned 4 [0070.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.786] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") [0070.787] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4634) returned 1 [0070.787] CloseHandle (hObject=0x160) returned 1 [0070.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0070.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.787] GetLastError () returned 0x0 [0070.787] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x121a, lpOverlapped=0x0) returned 1 [0070.789] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0070.790] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.790] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.790] SetEndOfFile (hFile=0x150) returned 1 [0070.790] CloseHandle (hObject=0x150) returned 1 [0070.790] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.790] SetEndOfFile (hFile=0x160) returned 1 [0070.791] CloseHandle (hObject=0x160) returned 1 [0070.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0070.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString=".doc") returned 4 [0070.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString=".docx") returned 5 [0070.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.792] lstrlenW (lpString=".pdf") returned 4 [0070.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString=".xls") returned 4 [0070.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.792] lstrlenW (lpString=".xlsx") returned 5 [0070.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.792] lstrlenW (lpString=".ppt") returned 4 [0070.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString=".zip") returned 4 [0070.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.792] lstrlenW (lpString=".rar") returned 4 [0070.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString=".bz2") returned 4 [0070.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString=".7z") returned 3 [0070.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString=".dbf") returned 4 [0070.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString=".1cd") returned 4 [0070.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.792] lstrlenW (lpString=".jpg") returned 4 [0070.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.792] lstrlenW (lpString=".pdf") returned 4 [0070.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString=".xls") returned 4 [0070.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.793] lstrlenW (lpString=".xlsx") returned 5 [0070.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.793] lstrlenW (lpString=".ppt") returned 4 [0070.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.793] lstrlenW (lpString=".zip") returned 4 [0070.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.793] lstrlenW (lpString=".rar") returned 4 [0070.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString=".bz2") returned 4 [0070.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString=".7z") returned 3 [0070.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.793] lstrlenW (lpString=".dbf") returned 4 [0070.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.793] lstrlenW (lpString=".1cd") returned 4 [0070.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0070.793] lstrlenW (lpString=".jpg") returned 4 [0070.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.793] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") [0070.794] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2412) returned 1 [0070.794] CloseHandle (hObject=0x160) returned 1 [0070.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0070.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0070.794] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.794] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0070.794] GetLastError () returned 0x0 [0070.794] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x96c, lpOverlapped=0x0) returned 1 [0071.088] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x970, lpOverlapped=0x0) returned 1 [0071.089] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.089] SetEndOfFile (hFile=0x150) returned 1 [0071.416] CloseHandle (hObject=0x150) returned 1 [0071.416] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.416] SetEndOfFile (hFile=0x160) returned 1 [0071.445] CloseHandle (hObject=0x160) returned 1 [0071.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0071.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.490] lstrlenW (lpString=".doc") returned 4 [0071.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".docx") returned 5 [0071.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.491] lstrlenW (lpString=".pdf") returned 4 [0071.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".xls") returned 4 [0071.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.491] lstrlenW (lpString=".xlsx") returned 5 [0071.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.491] lstrlenW (lpString=".ppt") returned 4 [0071.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.491] lstrlenW (lpString=".zip") returned 4 [0071.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.491] lstrlenW (lpString=".rar") returned 4 [0071.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".bz2") returned 4 [0071.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".7z") returned 3 [0071.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.491] lstrlenW (lpString=".dbf") returned 4 [0071.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.491] lstrlenW (lpString=".1cd") returned 4 [0071.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.491] lstrlenW (lpString=".jpg") returned 4 [0071.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".pdf") returned 4 [0071.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.491] lstrlenW (lpString=".xls") returned 4 [0071.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.492] lstrlenW (lpString=".xlsx") returned 5 [0071.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.492] lstrlenW (lpString=".ppt") returned 4 [0071.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.492] lstrlenW (lpString=".zip") returned 4 [0071.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.492] lstrlenW (lpString=".rar") returned 4 [0071.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString=".bz2") returned 4 [0071.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString=".7z") returned 3 [0071.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.492] lstrlenW (lpString=".dbf") returned 4 [0071.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.492] lstrlenW (lpString=".1cd") returned 4 [0071.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0071.492] lstrlenW (lpString=".jpg") returned 4 [0071.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.492] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") [0071.787] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10316) returned 1 [0071.787] CloseHandle (hObject=0x1c0) returned 1 [0071.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0071.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.788] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.788] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.076] GetLastError () returned 0x0 [0072.076] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x284c, lpOverlapped=0x0) returned 1 [0072.078] WriteFile (in: hFile=0x190, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0072.079] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.079] WriteFile (in: hFile=0x190, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.079] SetEndOfFile (hFile=0x190) returned 1 [0072.079] CloseHandle (hObject=0x190) returned 1 [0072.079] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.079] SetEndOfFile (hFile=0x1c0) returned 1 [0072.080] CloseHandle (hObject=0x1c0) returned 1 [0072.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0072.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.080] lstrlenW (lpString=".doc") returned 4 [0072.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.080] lstrlenW (lpString=".docx") returned 5 [0072.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.080] lstrlenW (lpString=".pdf") returned 4 [0072.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.080] lstrlenW (lpString=".xls") returned 4 [0072.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.080] lstrlenW (lpString=".xlsx") returned 5 [0072.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.081] lstrlenW (lpString=".ppt") returned 4 [0072.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.081] lstrlenW (lpString=".zip") returned 4 [0072.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.081] lstrlenW (lpString=".rar") returned 4 [0072.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString=".bz2") returned 4 [0072.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString=".7z") returned 3 [0072.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.081] lstrlenW (lpString=".dbf") returned 4 [0072.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.081] lstrlenW (lpString=".1cd") returned 4 [0072.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.081] lstrlenW (lpString=".jpg") returned 4 [0072.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString=".pdf") returned 4 [0072.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString=".xls") returned 4 [0072.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.081] lstrlenW (lpString=".xlsx") returned 5 [0072.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.081] lstrlenW (lpString=".ppt") returned 4 [0072.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.081] lstrlenW (lpString=".zip") returned 4 [0072.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.081] lstrlenW (lpString=".rar") returned 4 [0072.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.082] lstrlenW (lpString=".bz2") returned 4 [0072.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.082] lstrlenW (lpString=".7z") returned 3 [0072.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.082] lstrlenW (lpString=".dbf") returned 4 [0072.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.082] lstrlenW (lpString=".1cd") returned 4 [0072.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0072.082] lstrlenW (lpString=".jpg") returned 4 [0072.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.082] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") [0072.082] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=30414) returned 1 [0072.082] CloseHandle (hObject=0x1c0) returned 1 [0072.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0072.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0072.083] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.083] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.083] GetLastError () returned 0x0 [0072.083] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0072.123] WriteFile (in: hFile=0x190, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0072.124] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.124] WriteFile (in: hFile=0x190, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.124] SetEndOfFile (hFile=0x190) returned 1 [0072.124] CloseHandle (hObject=0x190) returned 1 [0072.124] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.124] SetEndOfFile (hFile=0x1c0) returned 1 [0072.125] CloseHandle (hObject=0x1c0) returned 1 [0072.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.126] lstrlenW (lpString=".doc") returned 4 [0072.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString=".docx") returned 5 [0072.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.126] lstrlenW (lpString=".pdf") returned 4 [0072.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString=".xls") returned 4 [0072.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.126] lstrlenW (lpString=".xlsx") returned 5 [0072.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.126] lstrlenW (lpString=".ppt") returned 4 [0072.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.126] lstrlenW (lpString=".zip") returned 4 [0072.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.126] lstrlenW (lpString=".rar") returned 4 [0072.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString=".bz2") returned 4 [0072.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString=".7z") returned 3 [0072.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.126] lstrlenW (lpString=".dbf") returned 4 [0072.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.126] lstrlenW (lpString=".1cd") returned 4 [0072.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.127] lstrlenW (lpString=".jpg") returned 4 [0072.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString=".pdf") returned 4 [0072.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString=".xls") returned 4 [0072.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.127] lstrlenW (lpString=".xlsx") returned 5 [0072.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.127] lstrlenW (lpString=".ppt") returned 4 [0072.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.127] lstrlenW (lpString=".zip") returned 4 [0072.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.127] lstrlenW (lpString=".rar") returned 4 [0072.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString=".bz2") returned 4 [0072.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString=".7z") returned 3 [0072.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.127] lstrlenW (lpString=".dbf") returned 4 [0072.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.127] lstrlenW (lpString=".1cd") returned 4 [0072.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0072.127] lstrlenW (lpString=".jpg") returned 4 [0072.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.127] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") [0073.626] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31180) returned 1 [0073.626] CloseHandle (hObject=0x22c) returned 1 [0073.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0073.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.626] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.626] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.626] GetLastError () returned 0x0 [0073.627] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0073.629] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0073.630] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.630] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.630] SetEndOfFile (hFile=0x1fc) returned 1 [0073.630] CloseHandle (hObject=0x1fc) returned 1 [0073.631] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.631] SetEndOfFile (hFile=0x22c) returned 1 [0073.632] CloseHandle (hObject=0x22c) returned 1 [0073.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0073.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString=".doc") returned 4 [0073.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString=".docx") returned 5 [0073.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.633] lstrlenW (lpString=".pdf") returned 4 [0073.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString=".xls") returned 4 [0073.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.633] lstrlenW (lpString=".xlsx") returned 5 [0073.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.633] lstrlenW (lpString=".ppt") returned 4 [0073.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString=".zip") returned 4 [0073.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.633] lstrlenW (lpString=".rar") returned 4 [0073.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString=".bz2") returned 4 [0073.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString=".7z") returned 3 [0073.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString=".dbf") returned 4 [0073.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString=".1cd") returned 4 [0073.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.633] lstrlenW (lpString=".jpg") returned 4 [0073.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString=".pdf") returned 4 [0073.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString=".xls") returned 4 [0073.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.634] lstrlenW (lpString=".xlsx") returned 5 [0073.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.634] lstrlenW (lpString=".ppt") returned 4 [0073.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.634] lstrlenW (lpString=".zip") returned 4 [0073.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.634] lstrlenW (lpString=".rar") returned 4 [0073.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString=".bz2") returned 4 [0073.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString=".7z") returned 3 [0073.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.634] lstrlenW (lpString=".dbf") returned 4 [0073.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.634] lstrlenW (lpString=".1cd") returned 4 [0073.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0073.634] lstrlenW (lpString=".jpg") returned 4 [0073.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.634] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") [0073.635] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3016) returned 1 [0073.635] CloseHandle (hObject=0x22c) returned 1 [0073.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0073.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.635] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.635] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.635] GetLastError () returned 0x0 [0073.635] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0073.650] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0073.651] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.651] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.651] SetEndOfFile (hFile=0x1fc) returned 1 [0073.661] CloseHandle (hObject=0x1fc) returned 1 [0073.661] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.661] SetEndOfFile (hFile=0x22c) returned 1 [0073.661] CloseHandle (hObject=0x22c) returned 1 [0073.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.662] lstrlenW (lpString=".doc") returned 4 [0073.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.662] lstrlenW (lpString=".docx") returned 5 [0073.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.662] lstrlenW (lpString=".pdf") returned 4 [0073.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.662] lstrlenW (lpString=".xls") returned 4 [0073.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.662] lstrlenW (lpString=".xlsx") returned 5 [0073.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.662] lstrlenW (lpString=".ppt") returned 4 [0073.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.662] lstrlenW (lpString=".zip") returned 4 [0073.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.662] lstrlenW (lpString=".rar") returned 4 [0073.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.662] lstrlenW (lpString=".bz2") returned 4 [0073.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString=".7z") returned 3 [0073.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.663] lstrlenW (lpString=".dbf") returned 4 [0073.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.663] lstrlenW (lpString=".1cd") returned 4 [0073.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.663] lstrlenW (lpString=".jpg") returned 4 [0073.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString=".pdf") returned 4 [0073.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString=".xls") returned 4 [0073.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.663] lstrlenW (lpString=".xlsx") returned 5 [0073.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.663] lstrlenW (lpString=".ppt") returned 4 [0073.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.663] lstrlenW (lpString=".zip") returned 4 [0073.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.663] lstrlenW (lpString=".rar") returned 4 [0073.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString=".bz2") returned 4 [0073.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString=".7z") returned 3 [0073.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.663] lstrlenW (lpString=".dbf") returned 4 [0073.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.664] lstrlenW (lpString=".1cd") returned 4 [0073.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0073.664] lstrlenW (lpString=".jpg") returned 4 [0073.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.664] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") [0073.664] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14688) returned 1 [0073.664] CloseHandle (hObject=0x22c) returned 1 [0073.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0073.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.664] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.664] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.665] GetLastError () returned 0x0 [0073.665] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3960, lpOverlapped=0x0) returned 1 [0073.675] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0073.676] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.676] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.676] SetEndOfFile (hFile=0x1fc) returned 1 [0073.676] CloseHandle (hObject=0x1fc) returned 1 [0073.676] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.677] SetEndOfFile (hFile=0x22c) returned 1 [0073.677] CloseHandle (hObject=0x22c) returned 1 [0073.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.678] lstrlenW (lpString=".doc") returned 4 [0073.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".docx") returned 5 [0073.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.678] lstrlenW (lpString=".pdf") returned 4 [0073.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".xls") returned 4 [0073.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.678] lstrlenW (lpString=".xlsx") returned 5 [0073.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.678] lstrlenW (lpString=".ppt") returned 4 [0073.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.678] lstrlenW (lpString=".zip") returned 4 [0073.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.678] lstrlenW (lpString=".rar") returned 4 [0073.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".bz2") returned 4 [0073.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".7z") returned 3 [0073.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".dbf") returned 4 [0073.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".1cd") returned 4 [0073.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".jpg") returned 4 [0073.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString=".pdf") returned 4 [0073.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString=".xls") returned 4 [0073.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.679] lstrlenW (lpString=".xlsx") returned 5 [0073.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.679] lstrlenW (lpString=".ppt") returned 4 [0073.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".zip") returned 4 [0073.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.679] lstrlenW (lpString=".rar") returned 4 [0073.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString=".bz2") returned 4 [0073.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString=".7z") returned 3 [0073.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".dbf") returned 4 [0073.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.679] lstrlenW (lpString=".1cd") returned 4 [0073.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0073.680] lstrlenW (lpString=".jpg") returned 4 [0073.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.680] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") [0073.680] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3718) returned 1 [0073.680] CloseHandle (hObject=0x22c) returned 1 [0073.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0073.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.680] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.680] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.681] GetLastError () returned 0x0 [0073.681] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe86, lpOverlapped=0x0) returned 1 [0073.690] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0073.691] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.691] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.691] SetEndOfFile (hFile=0x1fc) returned 1 [0073.691] CloseHandle (hObject=0x1fc) returned 1 [0073.691] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.691] SetEndOfFile (hFile=0x22c) returned 1 [0073.692] CloseHandle (hObject=0x22c) returned 1 [0073.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0073.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.692] lstrlenW (lpString=".doc") returned 4 [0073.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.692] lstrlenW (lpString=".docx") returned 5 [0073.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.692] lstrlenW (lpString=".pdf") returned 4 [0073.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.692] lstrlenW (lpString=".xls") returned 4 [0073.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.692] lstrlenW (lpString=".xlsx") returned 5 [0073.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.693] lstrlenW (lpString=".ppt") returned 4 [0073.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.693] lstrlenW (lpString=".zip") returned 4 [0073.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.693] lstrlenW (lpString=".rar") returned 4 [0073.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString=".bz2") returned 4 [0073.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString=".7z") returned 3 [0073.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.693] lstrlenW (lpString=".dbf") returned 4 [0073.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.693] lstrlenW (lpString=".1cd") returned 4 [0073.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.693] lstrlenW (lpString=".jpg") returned 4 [0073.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString=".pdf") returned 4 [0073.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString=".xls") returned 4 [0073.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.693] lstrlenW (lpString=".xlsx") returned 5 [0073.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.693] lstrlenW (lpString=".ppt") returned 4 [0073.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.693] lstrlenW (lpString=".zip") returned 4 [0073.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.694] lstrlenW (lpString=".rar") returned 4 [0073.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.694] lstrlenW (lpString=".bz2") returned 4 [0073.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.694] lstrlenW (lpString=".7z") returned 3 [0073.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.694] lstrlenW (lpString=".dbf") returned 4 [0073.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.694] lstrlenW (lpString=".1cd") returned 4 [0073.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0073.694] lstrlenW (lpString=".jpg") returned 4 [0073.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.694] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") [0073.694] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1468) returned 1 [0073.694] CloseHandle (hObject=0x22c) returned 1 [0073.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0073.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.695] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.695] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.695] GetLastError () returned 0x0 [0073.695] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0073.697] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0073.698] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.698] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.698] SetEndOfFile (hFile=0x1fc) returned 1 [0073.698] CloseHandle (hObject=0x1fc) returned 1 [0073.698] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.698] SetEndOfFile (hFile=0x22c) returned 1 [0073.699] CloseHandle (hObject=0x22c) returned 1 [0073.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.699] lstrlenW (lpString=".doc") returned 4 [0073.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".docx") returned 5 [0073.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.700] lstrlenW (lpString=".pdf") returned 4 [0073.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".xls") returned 4 [0073.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.700] lstrlenW (lpString=".xlsx") returned 5 [0073.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.700] lstrlenW (lpString=".ppt") returned 4 [0073.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.700] lstrlenW (lpString=".zip") returned 4 [0073.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.700] lstrlenW (lpString=".rar") returned 4 [0073.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".bz2") returned 4 [0073.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".7z") returned 3 [0073.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.700] lstrlenW (lpString=".dbf") returned 4 [0073.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.700] lstrlenW (lpString=".1cd") returned 4 [0073.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.700] lstrlenW (lpString=".jpg") returned 4 [0073.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".pdf") returned 4 [0073.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.700] lstrlenW (lpString=".xls") returned 4 [0073.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.701] lstrlenW (lpString=".xlsx") returned 5 [0073.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.701] lstrlenW (lpString=".ppt") returned 4 [0073.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.701] lstrlenW (lpString=".zip") returned 4 [0073.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.701] lstrlenW (lpString=".rar") returned 4 [0073.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.701] lstrlenW (lpString=".bz2") returned 4 [0073.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.701] lstrlenW (lpString=".7z") returned 3 [0073.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.701] lstrlenW (lpString=".dbf") returned 4 [0073.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.701] lstrlenW (lpString=".1cd") returned 4 [0073.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0073.701] lstrlenW (lpString=".jpg") returned 4 [0073.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.701] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") [0073.701] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1400) returned 1 [0073.702] CloseHandle (hObject=0x22c) returned 1 [0073.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0073.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0073.702] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.702] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.702] GetLastError () returned 0x0 [0073.702] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x578, lpOverlapped=0x0) returned 1 [0073.767] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x580, lpOverlapped=0x0) returned 1 [0073.768] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.768] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.768] SetEndOfFile (hFile=0x1fc) returned 1 [0073.768] CloseHandle (hObject=0x1fc) returned 1 [0073.768] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.769] SetEndOfFile (hFile=0x22c) returned 1 [0073.769] CloseHandle (hObject=0x22c) returned 1 [0073.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.770] lstrlenW (lpString=".doc") returned 4 [0073.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".docx") returned 5 [0073.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.770] lstrlenW (lpString=".pdf") returned 4 [0073.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".xls") returned 4 [0073.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.770] lstrlenW (lpString=".xlsx") returned 5 [0073.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.770] lstrlenW (lpString=".ppt") returned 4 [0073.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.770] lstrlenW (lpString=".zip") returned 4 [0073.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.770] lstrlenW (lpString=".rar") returned 4 [0073.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".bz2") returned 4 [0073.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".7z") returned 3 [0073.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.770] lstrlenW (lpString=".dbf") returned 4 [0073.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".1cd") returned 4 [0073.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".jpg") returned 4 [0073.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString=".pdf") returned 4 [0073.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString=".xls") returned 4 [0073.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.771] lstrlenW (lpString=".xlsx") returned 5 [0073.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.771] lstrlenW (lpString=".ppt") returned 4 [0073.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".zip") returned 4 [0073.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.771] lstrlenW (lpString=".rar") returned 4 [0073.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString=".bz2") returned 4 [0073.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString=".7z") returned 3 [0073.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".dbf") returned 4 [0073.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".1cd") returned 4 [0073.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0073.771] lstrlenW (lpString=".jpg") returned 4 [0073.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.772] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") [0074.229] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1568) returned 1 [0074.229] CloseHandle (hObject=0x1c0) returned 1 [0074.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0074.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.230] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.230] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.230] GetLastError () returned 0x0 [0074.230] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x620, lpOverlapped=0x0) returned 1 [0074.234] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x630, lpOverlapped=0x0) returned 1 [0074.235] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.235] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.235] SetEndOfFile (hFile=0x180) returned 1 [0074.235] CloseHandle (hObject=0x180) returned 1 [0074.235] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.235] SetEndOfFile (hFile=0x1c0) returned 1 [0074.236] CloseHandle (hObject=0x1c0) returned 1 [0074.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0074.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.237] lstrlenW (lpString=".doc") returned 4 [0074.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString=".docx") returned 5 [0074.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.237] lstrlenW (lpString=".pdf") returned 4 [0074.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString=".xls") returned 4 [0074.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.237] lstrlenW (lpString=".xlsx") returned 5 [0074.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.237] lstrlenW (lpString=".ppt") returned 4 [0074.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.237] lstrlenW (lpString=".zip") returned 4 [0074.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.237] lstrlenW (lpString=".rar") returned 4 [0074.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString=".bz2") returned 4 [0074.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString=".7z") returned 3 [0074.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.237] lstrlenW (lpString=".dbf") returned 4 [0074.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.237] lstrlenW (lpString=".1cd") returned 4 [0074.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.237] lstrlenW (lpString=".jpg") returned 4 [0074.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.237] lstrlenW (lpString=".pdf") returned 4 [0074.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString=".xls") returned 4 [0074.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.238] lstrlenW (lpString=".xlsx") returned 5 [0074.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.238] lstrlenW (lpString=".ppt") returned 4 [0074.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.238] lstrlenW (lpString=".zip") returned 4 [0074.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.238] lstrlenW (lpString=".rar") returned 4 [0074.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString=".bz2") returned 4 [0074.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString=".7z") returned 3 [0074.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.238] lstrlenW (lpString=".dbf") returned 4 [0074.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.238] lstrlenW (lpString=".1cd") returned 4 [0074.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0074.238] lstrlenW (lpString=".jpg") returned 4 [0074.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.238] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") [0074.239] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4340) returned 1 [0074.239] CloseHandle (hObject=0x1c0) returned 1 [0074.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0074.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.239] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.239] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.239] GetLastError () returned 0x0 [0074.240] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0074.248] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0074.249] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.249] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.249] SetEndOfFile (hFile=0x180) returned 1 [0074.250] CloseHandle (hObject=0x180) returned 1 [0074.250] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.250] SetEndOfFile (hFile=0x1c0) returned 1 [0074.250] CloseHandle (hObject=0x1c0) returned 1 [0074.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.251] lstrlenW (lpString=".doc") returned 4 [0074.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.251] lstrlenW (lpString=".docx") returned 5 [0074.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.251] lstrlenW (lpString=".pdf") returned 4 [0074.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.251] lstrlenW (lpString=".xls") returned 4 [0074.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.251] lstrlenW (lpString=".xlsx") returned 5 [0074.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.252] lstrlenW (lpString=".ppt") returned 4 [0074.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.252] lstrlenW (lpString=".zip") returned 4 [0074.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.252] lstrlenW (lpString=".rar") returned 4 [0074.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString=".bz2") returned 4 [0074.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString=".7z") returned 3 [0074.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.252] lstrlenW (lpString=".dbf") returned 4 [0074.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.252] lstrlenW (lpString=".1cd") returned 4 [0074.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.252] lstrlenW (lpString=".jpg") returned 4 [0074.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString=".pdf") returned 4 [0074.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString=".xls") returned 4 [0074.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.252] lstrlenW (lpString=".xlsx") returned 5 [0074.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.252] lstrlenW (lpString=".ppt") returned 4 [0074.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.252] lstrlenW (lpString=".zip") returned 4 [0074.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.253] lstrlenW (lpString=".rar") returned 4 [0074.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.253] lstrlenW (lpString=".bz2") returned 4 [0074.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.253] lstrlenW (lpString=".7z") returned 3 [0074.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.253] lstrlenW (lpString=".dbf") returned 4 [0074.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.253] lstrlenW (lpString=".1cd") returned 4 [0074.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0074.253] lstrlenW (lpString=".jpg") returned 4 [0074.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.253] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") [0074.253] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7098) returned 1 [0074.253] CloseHandle (hObject=0x1c0) returned 1 [0074.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0074.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.254] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.254] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.254] GetLastError () returned 0x0 [0074.254] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0074.261] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0074.262] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.262] SetEndOfFile (hFile=0x180) returned 1 [0074.262] CloseHandle (hObject=0x180) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.262] SetEndOfFile (hFile=0x1c0) returned 1 [0074.263] CloseHandle (hObject=0x1c0) returned 1 [0074.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0074.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.263] lstrlenW (lpString=".doc") returned 4 [0074.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.263] lstrlenW (lpString=".docx") returned 5 [0074.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.263] lstrlenW (lpString=".pdf") returned 4 [0074.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.263] lstrlenW (lpString=".xls") returned 4 [0074.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.263] lstrlenW (lpString=".xlsx") returned 5 [0074.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.264] lstrlenW (lpString=".ppt") returned 4 [0074.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.264] lstrlenW (lpString=".zip") returned 4 [0074.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.264] lstrlenW (lpString=".rar") returned 4 [0074.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString=".bz2") returned 4 [0074.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString=".7z") returned 3 [0074.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.264] lstrlenW (lpString=".dbf") returned 4 [0074.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.264] lstrlenW (lpString=".1cd") returned 4 [0074.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.264] lstrlenW (lpString=".jpg") returned 4 [0074.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString=".pdf") returned 4 [0074.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString=".xls") returned 4 [0074.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.264] lstrlenW (lpString=".xlsx") returned 5 [0074.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.264] lstrlenW (lpString=".ppt") returned 4 [0074.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.264] lstrlenW (lpString=".zip") returned 4 [0074.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.264] lstrlenW (lpString=".rar") returned 4 [0074.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.265] lstrlenW (lpString=".bz2") returned 4 [0074.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.265] lstrlenW (lpString=".7z") returned 3 [0074.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.265] lstrlenW (lpString=".dbf") returned 4 [0074.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.265] lstrlenW (lpString=".1cd") returned 4 [0074.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0074.265] lstrlenW (lpString=".jpg") returned 4 [0074.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.265] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") [0074.266] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1148) returned 1 [0074.266] CloseHandle (hObject=0x1c0) returned 1 [0074.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0074.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.266] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.266] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.267] GetLastError () returned 0x0 [0074.267] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x47c, lpOverlapped=0x0) returned 1 [0074.282] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x480, lpOverlapped=0x0) returned 1 [0074.283] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.283] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.283] SetEndOfFile (hFile=0x180) returned 1 [0074.283] CloseHandle (hObject=0x180) returned 1 [0074.284] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.284] SetEndOfFile (hFile=0x1c0) returned 1 [0074.284] CloseHandle (hObject=0x1c0) returned 1 [0074.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0074.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.285] lstrlenW (lpString=".doc") returned 4 [0074.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.285] lstrlenW (lpString=".docx") returned 5 [0074.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.285] lstrlenW (lpString=".pdf") returned 4 [0074.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.285] lstrlenW (lpString=".xls") returned 4 [0074.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.285] lstrlenW (lpString=".xlsx") returned 5 [0074.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.285] lstrlenW (lpString=".ppt") returned 4 [0074.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.285] lstrlenW (lpString=".zip") returned 4 [0074.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.285] lstrlenW (lpString=".rar") returned 4 [0074.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.285] lstrlenW (lpString=".bz2") returned 4 [0074.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.285] lstrlenW (lpString=".7z") returned 3 [0074.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.285] lstrlenW (lpString=".dbf") returned 4 [0074.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".1cd") returned 4 [0074.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".jpg") returned 4 [0074.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString=".pdf") returned 4 [0074.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString=".xls") returned 4 [0074.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.286] lstrlenW (lpString=".xlsx") returned 5 [0074.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.286] lstrlenW (lpString=".ppt") returned 4 [0074.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".zip") returned 4 [0074.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.286] lstrlenW (lpString=".rar") returned 4 [0074.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString=".bz2") returned 4 [0074.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString=".7z") returned 3 [0074.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".dbf") returned 4 [0074.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".1cd") returned 4 [0074.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0074.286] lstrlenW (lpString=".jpg") returned 4 [0074.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.287] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") [0074.287] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5000) returned 1 [0074.287] CloseHandle (hObject=0x1c0) returned 1 [0074.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0074.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.287] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.287] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.288] GetLastError () returned 0x0 [0074.288] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1388, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0074.291] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.291] SetEndOfFile (hFile=0x180) returned 1 [0074.291] CloseHandle (hObject=0x180) returned 1 [0074.291] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.291] SetEndOfFile (hFile=0x1c0) returned 1 [0074.292] CloseHandle (hObject=0x1c0) returned 1 [0074.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0074.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.292] lstrlenW (lpString=".doc") returned 4 [0074.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.292] lstrlenW (lpString=".docx") returned 5 [0074.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.292] lstrlenW (lpString=".pdf") returned 4 [0074.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.292] lstrlenW (lpString=".xls") returned 4 [0074.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.293] lstrlenW (lpString=".xlsx") returned 5 [0074.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.293] lstrlenW (lpString=".ppt") returned 4 [0074.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.293] lstrlenW (lpString=".zip") returned 4 [0074.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.293] lstrlenW (lpString=".rar") returned 4 [0074.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString=".bz2") returned 4 [0074.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString=".7z") returned 3 [0074.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.293] lstrlenW (lpString=".dbf") returned 4 [0074.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.293] lstrlenW (lpString=".1cd") returned 4 [0074.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.293] lstrlenW (lpString=".jpg") returned 4 [0074.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString=".pdf") returned 4 [0074.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString=".xls") returned 4 [0074.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.293] lstrlenW (lpString=".xlsx") returned 5 [0074.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.293] lstrlenW (lpString=".ppt") returned 4 [0074.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.294] lstrlenW (lpString=".zip") returned 4 [0074.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.294] lstrlenW (lpString=".rar") returned 4 [0074.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.294] lstrlenW (lpString=".bz2") returned 4 [0074.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.294] lstrlenW (lpString=".7z") returned 3 [0074.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.294] lstrlenW (lpString=".dbf") returned 4 [0074.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.294] lstrlenW (lpString=".1cd") returned 4 [0074.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0074.294] lstrlenW (lpString=".jpg") returned 4 [0074.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.294] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") [0074.295] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7340) returned 1 [0074.295] CloseHandle (hObject=0x1c0) returned 1 [0074.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0074.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.295] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.295] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.296] GetLastError () returned 0x0 [0074.296] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0074.398] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0074.399] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.399] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.399] SetEndOfFile (hFile=0x180) returned 1 [0074.399] CloseHandle (hObject=0x180) returned 1 [0074.399] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.399] SetEndOfFile (hFile=0x1c0) returned 1 [0074.400] CloseHandle (hObject=0x1c0) returned 1 [0074.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0074.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.400] lstrlenW (lpString=".doc") returned 4 [0074.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.400] lstrlenW (lpString=".docx") returned 5 [0074.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.400] lstrlenW (lpString=".pdf") returned 4 [0074.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.400] lstrlenW (lpString=".xls") returned 4 [0074.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.401] lstrlenW (lpString=".xlsx") returned 5 [0074.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.401] lstrlenW (lpString=".ppt") returned 4 [0074.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.401] lstrlenW (lpString=".zip") returned 4 [0074.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.401] lstrlenW (lpString=".rar") returned 4 [0074.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString=".bz2") returned 4 [0074.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString=".7z") returned 3 [0074.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.401] lstrlenW (lpString=".dbf") returned 4 [0074.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.401] lstrlenW (lpString=".1cd") returned 4 [0074.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.401] lstrlenW (lpString=".jpg") returned 4 [0074.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString=".pdf") returned 4 [0074.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.401] lstrlenW (lpString=".xls") returned 4 [0074.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.401] lstrlenW (lpString=".xlsx") returned 5 [0074.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.401] lstrlenW (lpString=".ppt") returned 4 [0074.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.402] lstrlenW (lpString=".zip") returned 4 [0074.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.402] lstrlenW (lpString=".rar") returned 4 [0074.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.402] lstrlenW (lpString=".bz2") returned 4 [0074.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.402] lstrlenW (lpString=".7z") returned 3 [0074.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.402] lstrlenW (lpString=".dbf") returned 4 [0074.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.402] lstrlenW (lpString=".1cd") returned 4 [0074.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0074.402] lstrlenW (lpString=".jpg") returned 4 [0074.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.402] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") [0074.402] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26706) returned 1 [0074.402] CloseHandle (hObject=0x1c0) returned 1 [0074.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0074.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.403] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.403] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.403] GetLastError () returned 0x0 [0074.403] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6852, lpOverlapped=0x0) returned 1 [0074.405] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6860, lpOverlapped=0x0) returned 1 [0074.406] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.406] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.406] SetEndOfFile (hFile=0x180) returned 1 [0074.407] CloseHandle (hObject=0x180) returned 1 [0074.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.407] SetEndOfFile (hFile=0x1c0) returned 1 [0074.408] CloseHandle (hObject=0x1c0) returned 1 [0074.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0074.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.408] lstrlenW (lpString=".doc") returned 4 [0074.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.408] lstrlenW (lpString=".docx") returned 5 [0074.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.408] lstrlenW (lpString=".pdf") returned 4 [0074.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.408] lstrlenW (lpString=".xls") returned 4 [0074.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.408] lstrlenW (lpString=".xlsx") returned 5 [0074.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.409] lstrlenW (lpString=".ppt") returned 4 [0074.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.409] lstrlenW (lpString=".zip") returned 4 [0074.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.409] lstrlenW (lpString=".rar") returned 4 [0074.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString=".bz2") returned 4 [0074.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString=".7z") returned 3 [0074.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.409] lstrlenW (lpString=".dbf") returned 4 [0074.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.409] lstrlenW (lpString=".1cd") returned 4 [0074.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.409] lstrlenW (lpString=".jpg") returned 4 [0074.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString=".pdf") returned 4 [0074.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString=".xls") returned 4 [0074.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.409] lstrlenW (lpString=".xlsx") returned 5 [0074.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.409] lstrlenW (lpString=".ppt") returned 4 [0074.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.409] lstrlenW (lpString=".zip") returned 4 [0074.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.410] lstrlenW (lpString=".rar") returned 4 [0074.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.410] lstrlenW (lpString=".bz2") returned 4 [0074.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.410] lstrlenW (lpString=".7z") returned 3 [0074.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.410] lstrlenW (lpString=".dbf") returned 4 [0074.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.410] lstrlenW (lpString=".1cd") returned 4 [0074.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0074.410] lstrlenW (lpString=".jpg") returned 4 [0074.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.410] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") [0074.410] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2704) returned 1 [0074.410] CloseHandle (hObject=0x1c0) returned 1 [0074.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0074.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.411] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.411] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.411] GetLastError () returned 0x0 [0074.411] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa90, lpOverlapped=0x0) returned 1 [0074.413] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0074.413] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.413] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.414] SetEndOfFile (hFile=0x180) returned 1 [0074.414] CloseHandle (hObject=0x180) returned 1 [0074.414] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.414] SetEndOfFile (hFile=0x1c0) returned 1 [0074.415] CloseHandle (hObject=0x1c0) returned 1 [0074.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.415] lstrlenW (lpString=".doc") returned 4 [0074.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.415] lstrlenW (lpString=".docx") returned 5 [0074.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.415] lstrlenW (lpString=".pdf") returned 4 [0074.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.415] lstrlenW (lpString=".xls") returned 4 [0074.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.415] lstrlenW (lpString=".xlsx") returned 5 [0074.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.415] lstrlenW (lpString=".ppt") returned 4 [0074.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.415] lstrlenW (lpString=".zip") returned 4 [0074.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.415] lstrlenW (lpString=".rar") returned 4 [0074.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.415] lstrlenW (lpString=".bz2") returned 4 [0074.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString=".7z") returned 3 [0074.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.416] lstrlenW (lpString=".dbf") returned 4 [0074.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.416] lstrlenW (lpString=".1cd") returned 4 [0074.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.416] lstrlenW (lpString=".jpg") returned 4 [0074.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString=".pdf") returned 4 [0074.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString=".xls") returned 4 [0074.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.416] lstrlenW (lpString=".xlsx") returned 5 [0074.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.416] lstrlenW (lpString=".ppt") returned 4 [0074.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.416] lstrlenW (lpString=".zip") returned 4 [0074.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.416] lstrlenW (lpString=".rar") returned 4 [0074.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString=".bz2") returned 4 [0074.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString=".7z") returned 3 [0074.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.416] lstrlenW (lpString=".dbf") returned 4 [0074.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.417] lstrlenW (lpString=".1cd") returned 4 [0074.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0074.417] lstrlenW (lpString=".jpg") returned 4 [0074.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.417] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") [0074.417] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1324) returned 1 [0074.417] CloseHandle (hObject=0x1c0) returned 1 [0074.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0074.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.418] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.418] GetLastError () returned 0x0 [0074.418] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x52c, lpOverlapped=0x0) returned 1 [0074.451] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x530, lpOverlapped=0x0) returned 1 [0074.452] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.452] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.452] SetEndOfFile (hFile=0x180) returned 1 [0074.452] CloseHandle (hObject=0x180) returned 1 [0074.452] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.452] SetEndOfFile (hFile=0x1c0) returned 1 [0074.453] CloseHandle (hObject=0x1c0) returned 1 [0074.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.454] lstrlenW (lpString=".doc") returned 4 [0074.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString=".docx") returned 5 [0074.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.454] lstrlenW (lpString=".pdf") returned 4 [0074.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString=".xls") returned 4 [0074.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.454] lstrlenW (lpString=".xlsx") returned 5 [0074.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.454] lstrlenW (lpString=".ppt") returned 4 [0074.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.454] lstrlenW (lpString=".zip") returned 4 [0074.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.454] lstrlenW (lpString=".rar") returned 4 [0074.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString=".bz2") returned 4 [0074.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString=".7z") returned 3 [0074.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.454] lstrlenW (lpString=".dbf") returned 4 [0074.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.454] lstrlenW (lpString=".1cd") returned 4 [0074.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".jpg") returned 4 [0074.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".doc") returned 4 [0074.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString=".docx") returned 5 [0074.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.455] lstrlenW (lpString=".pdf") returned 4 [0074.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString=".xls") returned 4 [0074.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.455] lstrlenW (lpString=".xlsx") returned 5 [0074.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.455] lstrlenW (lpString=".ppt") returned 4 [0074.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".zip") returned 4 [0074.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.455] lstrlenW (lpString=".rar") returned 4 [0074.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString=".bz2") returned 4 [0074.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString=".7z") returned 3 [0074.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".dbf") returned 4 [0074.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".1cd") returned 4 [0074.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0074.455] lstrlenW (lpString=".jpg") returned 4 [0074.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.456] lstrlenW (lpString="HH02298_.WMF") returned 12 [0074.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.456] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5552) returned 1 [0074.456] CloseHandle (hObject=0x1c0) returned 1 [0074.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0074.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.457] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.457] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.457] GetLastError () returned 0x0 [0074.457] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15b0, lpOverlapped=0x0) returned 1 [0074.459] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0074.460] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.460] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.460] SetEndOfFile (hFile=0x180) returned 1 [0074.460] CloseHandle (hObject=0x180) returned 1 [0074.460] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.460] SetEndOfFile (hFile=0x1c0) returned 1 [0074.461] CloseHandle (hObject=0x1c0) returned 1 [0074.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0074.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.461] lstrlenW (lpString=".doc") returned 4 [0074.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.461] lstrlenW (lpString=".docx") returned 5 [0074.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.461] lstrlenW (lpString=".pdf") returned 4 [0074.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.461] lstrlenW (lpString=".xls") returned 4 [0074.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.461] lstrlenW (lpString=".xlsx") returned 5 [0074.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.462] lstrlenW (lpString=".ppt") returned 4 [0074.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString=".zip") returned 4 [0074.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.462] lstrlenW (lpString=".rar") returned 4 [0074.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString=".bz2") returned 4 [0074.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString=".7z") returned 3 [0074.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString=".dbf") returned 4 [0074.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString=".1cd") returned 4 [0074.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString=".jpg") returned 4 [0074.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.462] lstrlenW (lpString=".doc") returned 4 [0074.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString=".docx") returned 5 [0074.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.462] lstrlenW (lpString=".pdf") returned 4 [0074.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.462] lstrlenW (lpString=".xls") returned 4 [0074.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.462] lstrlenW (lpString=".xlsx") returned 5 [0074.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.463] lstrlenW (lpString=".ppt") returned 4 [0074.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.463] lstrlenW (lpString=".zip") returned 4 [0074.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.463] lstrlenW (lpString=".rar") returned 4 [0074.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString=".bz2") returned 4 [0074.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString=".7z") returned 3 [0074.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.463] lstrlenW (lpString=".dbf") returned 4 [0074.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.463] lstrlenW (lpString=".1cd") returned 4 [0074.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0074.463] lstrlenW (lpString=".jpg") returned 4 [0074.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.463] lstrlenW (lpString="HH02312_.WMF") returned 12 [0074.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.464] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4970) returned 1 [0074.464] CloseHandle (hObject=0x1c0) returned 1 [0074.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0074.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.464] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.464] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.465] GetLastError () returned 0x0 [0074.465] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x136a, lpOverlapped=0x0) returned 1 [0074.490] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0074.491] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.491] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.491] SetEndOfFile (hFile=0x180) returned 1 [0074.493] CloseHandle (hObject=0x180) returned 1 [0074.493] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.493] SetEndOfFile (hFile=0x1c0) returned 1 [0074.494] CloseHandle (hObject=0x1c0) returned 1 [0074.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0074.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.498] lstrlenW (lpString=".doc") returned 4 [0074.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.498] lstrlenW (lpString=".docx") returned 5 [0074.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.498] lstrlenW (lpString=".pdf") returned 4 [0074.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.498] lstrlenW (lpString=".xls") returned 4 [0074.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.498] lstrlenW (lpString=".xlsx") returned 5 [0074.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.498] lstrlenW (lpString=".ppt") returned 4 [0074.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString=".zip") returned 4 [0074.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.499] lstrlenW (lpString=".rar") returned 4 [0074.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString=".bz2") returned 4 [0074.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString=".7z") returned 3 [0074.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString=".dbf") returned 4 [0074.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString=".1cd") returned 4 [0074.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString=".jpg") returned 4 [0074.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.499] lstrlenW (lpString=".doc") returned 4 [0074.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString=".docx") returned 5 [0074.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.499] lstrlenW (lpString=".pdf") returned 4 [0074.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.499] lstrlenW (lpString=".xls") returned 4 [0074.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.499] lstrlenW (lpString=".xlsx") returned 5 [0074.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.499] lstrlenW (lpString=".ppt") returned 4 [0074.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.500] lstrlenW (lpString=".zip") returned 4 [0074.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.500] lstrlenW (lpString=".rar") returned 4 [0074.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString=".bz2") returned 4 [0074.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString=".7z") returned 3 [0074.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.500] lstrlenW (lpString=".dbf") returned 4 [0074.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.500] lstrlenW (lpString=".1cd") returned 4 [0074.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0074.500] lstrlenW (lpString=".jpg") returned 4 [0074.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.500] lstrlenW (lpString="HM00116_.WMF") returned 12 [0074.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.501] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15852) returned 1 [0074.502] CloseHandle (hObject=0x154) returned 1 [0074.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0074.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.502] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.502] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.502] GetLastError () returned 0x0 [0074.502] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3dec, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0074.508] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.508] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.508] SetEndOfFile (hFile=0x1ec) returned 1 [0074.508] CloseHandle (hObject=0x1ec) returned 1 [0074.508] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.509] SetEndOfFile (hFile=0x154) returned 1 [0074.509] CloseHandle (hObject=0x154) returned 1 [0074.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0074.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.510] lstrlenW (lpString=".doc") returned 4 [0074.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.510] lstrlenW (lpString=".docx") returned 5 [0074.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.510] lstrlenW (lpString=".pdf") returned 4 [0074.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.510] lstrlenW (lpString=".xls") returned 4 [0074.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.510] lstrlenW (lpString=".xlsx") returned 5 [0074.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.510] lstrlenW (lpString=".ppt") returned 4 [0074.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.510] lstrlenW (lpString=".zip") returned 4 [0074.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.510] lstrlenW (lpString=".rar") returned 4 [0074.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.510] lstrlenW (lpString=".bz2") returned 4 [0074.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.510] lstrlenW (lpString=".7z") returned 3 [0074.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString=".dbf") returned 4 [0074.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString=".1cd") returned 4 [0074.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString=".jpg") returned 4 [0074.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString=".doc") returned 4 [0074.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString=".docx") returned 5 [0074.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.511] lstrlenW (lpString=".pdf") returned 4 [0074.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString=".xls") returned 4 [0074.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.511] lstrlenW (lpString=".xlsx") returned 5 [0074.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.511] lstrlenW (lpString=".ppt") returned 4 [0074.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.511] lstrlenW (lpString=".zip") returned 4 [0074.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.511] lstrlenW (lpString=".rar") returned 4 [0074.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString=".bz2") returned 4 [0074.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.511] lstrlenW (lpString=".7z") returned 3 [0074.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.512] lstrlenW (lpString=".dbf") returned 4 [0074.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.512] lstrlenW (lpString=".1cd") returned 4 [0074.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0074.512] lstrlenW (lpString=".jpg") returned 4 [0074.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.512] lstrlenW (lpString="HM00172_.WMF") returned 12 [0074.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.512] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2832) returned 1 [0074.512] CloseHandle (hObject=0x154) returned 1 [0074.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0074.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.513] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.513] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.513] GetLastError () returned 0x0 [0074.513] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb10, lpOverlapped=0x0) returned 1 [0074.533] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0074.534] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.534] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.534] SetEndOfFile (hFile=0x1ec) returned 1 [0074.534] CloseHandle (hObject=0x1ec) returned 1 [0074.534] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.534] SetEndOfFile (hFile=0x154) returned 1 [0074.535] CloseHandle (hObject=0x154) returned 1 [0074.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0074.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.543] lstrlenW (lpString=".doc") returned 4 [0074.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString=".docx") returned 5 [0074.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.544] lstrlenW (lpString=".pdf") returned 4 [0074.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString=".xls") returned 4 [0074.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.544] lstrlenW (lpString=".xlsx") returned 5 [0074.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.544] lstrlenW (lpString=".ppt") returned 4 [0074.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString=".zip") returned 4 [0074.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.544] lstrlenW (lpString=".rar") returned 4 [0074.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString=".bz2") returned 4 [0074.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString=".7z") returned 3 [0074.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString=".dbf") returned 4 [0074.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString=".1cd") returned 4 [0074.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString=".jpg") returned 4 [0074.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.544] lstrlenW (lpString=".doc") returned 4 [0074.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.544] lstrlenW (lpString=".docx") returned 5 [0074.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.545] lstrlenW (lpString=".pdf") returned 4 [0074.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString=".xls") returned 4 [0074.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.545] lstrlenW (lpString=".xlsx") returned 5 [0074.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.545] lstrlenW (lpString=".ppt") returned 4 [0074.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.545] lstrlenW (lpString=".zip") returned 4 [0074.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.545] lstrlenW (lpString=".rar") returned 4 [0074.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString=".bz2") returned 4 [0074.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString=".7z") returned 3 [0074.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.545] lstrlenW (lpString=".dbf") returned 4 [0074.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.545] lstrlenW (lpString=".1cd") returned 4 [0074.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0074.545] lstrlenW (lpString=".jpg") returned 4 [0074.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.545] lstrlenW (lpString="IN00118_.WMF") returned 12 [0074.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.555] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=792) returned 1 [0074.555] CloseHandle (hObject=0x1f4) returned 1 [0074.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0074.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.557] GetLastError () returned 0x0 [0074.557] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x318, lpOverlapped=0x0) returned 1 [0074.626] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x320, lpOverlapped=0x0) returned 1 [0074.627] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.627] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.627] SetEndOfFile (hFile=0x158) returned 1 [0074.627] CloseHandle (hObject=0x158) returned 1 [0074.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.627] SetEndOfFile (hFile=0x1f4) returned 1 [0074.628] CloseHandle (hObject=0x1f4) returned 1 [0074.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0074.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.628] lstrlenW (lpString=".doc") returned 4 [0074.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.628] lstrlenW (lpString=".docx") returned 5 [0074.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.628] lstrlenW (lpString=".pdf") returned 4 [0074.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.628] lstrlenW (lpString=".xls") returned 4 [0074.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.628] lstrlenW (lpString=".xlsx") returned 5 [0074.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.629] lstrlenW (lpString=".ppt") returned 4 [0074.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString=".zip") returned 4 [0074.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.629] lstrlenW (lpString=".rar") returned 4 [0074.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString=".bz2") returned 4 [0074.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString=".7z") returned 3 [0074.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString=".dbf") returned 4 [0074.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString=".1cd") returned 4 [0074.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString=".jpg") returned 4 [0074.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.629] lstrlenW (lpString=".doc") returned 4 [0074.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString=".docx") returned 5 [0074.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.629] lstrlenW (lpString=".pdf") returned 4 [0074.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.629] lstrlenW (lpString=".xls") returned 4 [0074.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.629] lstrlenW (lpString=".xlsx") returned 5 [0074.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.630] lstrlenW (lpString=".ppt") returned 4 [0074.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.630] lstrlenW (lpString=".zip") returned 4 [0074.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.630] lstrlenW (lpString=".rar") returned 4 [0074.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString=".bz2") returned 4 [0074.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString=".7z") returned 3 [0074.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.630] lstrlenW (lpString=".dbf") returned 4 [0074.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.630] lstrlenW (lpString=".1cd") returned 4 [0074.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0074.630] lstrlenW (lpString=".jpg") returned 4 [0074.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.630] lstrlenW (lpString="IN00346_.WMF") returned 12 [0074.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.631] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=696) returned 1 [0074.631] CloseHandle (hObject=0x1f4) returned 1 [0074.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0074.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.631] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.631] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.631] GetLastError () returned 0x0 [0074.631] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2b8, lpOverlapped=0x0) returned 1 [0074.632] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0074.633] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.633] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.633] SetEndOfFile (hFile=0x158) returned 1 [0074.634] CloseHandle (hObject=0x158) returned 1 [0074.634] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.634] SetEndOfFile (hFile=0x1f4) returned 1 [0074.634] CloseHandle (hObject=0x1f4) returned 1 [0074.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0074.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.636] lstrlenW (lpString=".doc") returned 4 [0074.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.636] lstrlenW (lpString=".docx") returned 5 [0074.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.637] lstrlenW (lpString=".pdf") returned 4 [0074.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString=".xls") returned 4 [0074.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.637] lstrlenW (lpString=".xlsx") returned 5 [0074.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.637] lstrlenW (lpString=".ppt") returned 4 [0074.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString=".zip") returned 4 [0074.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.637] lstrlenW (lpString=".rar") returned 4 [0074.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString=".bz2") returned 4 [0074.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString=".7z") returned 3 [0074.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString=".dbf") returned 4 [0074.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString=".1cd") returned 4 [0074.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString=".jpg") returned 4 [0074.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.637] lstrlenW (lpString=".doc") returned 4 [0074.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString=".docx") returned 5 [0074.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.638] lstrlenW (lpString=".pdf") returned 4 [0074.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString=".xls") returned 4 [0074.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.638] lstrlenW (lpString=".xlsx") returned 5 [0074.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.638] lstrlenW (lpString=".ppt") returned 4 [0074.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.638] lstrlenW (lpString=".zip") returned 4 [0074.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.638] lstrlenW (lpString=".rar") returned 4 [0074.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString=".bz2") returned 4 [0074.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString=".7z") returned 3 [0074.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.638] lstrlenW (lpString=".dbf") returned 4 [0074.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.638] lstrlenW (lpString=".1cd") returned 4 [0074.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0074.638] lstrlenW (lpString=".jpg") returned 4 [0074.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.639] lstrlenW (lpString="IN00351_.WMF") returned 12 [0074.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.639] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1928) returned 1 [0074.639] CloseHandle (hObject=0x1f4) returned 1 [0074.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0074.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.639] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.639] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.640] GetLastError () returned 0x0 [0074.640] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x788, lpOverlapped=0x0) returned 1 [0074.761] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x790, lpOverlapped=0x0) returned 1 [0074.762] ReadFile (in: hFile=0x1f4, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.762] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.762] SetEndOfFile (hFile=0x158) returned 1 [0075.249] CloseHandle (hObject=0x158) returned 1 [0075.253] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.253] SetEndOfFile (hFile=0x1f4) returned 1 [0075.255] CloseHandle (hObject=0x1f4) returned 1 [0075.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString=".doc") returned 4 [0075.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString=".docx") returned 5 [0075.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.330] lstrlenW (lpString=".pdf") returned 4 [0075.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString=".xls") returned 4 [0075.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.330] lstrlenW (lpString=".xlsx") returned 5 [0075.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.330] lstrlenW (lpString=".ppt") returned 4 [0075.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString=".zip") returned 4 [0075.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.330] lstrlenW (lpString=".rar") returned 4 [0075.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString=".bz2") returned 4 [0075.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString=".7z") returned 3 [0075.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString=".dbf") returned 4 [0075.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString=".1cd") returned 4 [0075.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.330] lstrlenW (lpString=".jpg") returned 4 [0075.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.330] lstrlenW (lpString=".pdf") returned 4 [0075.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString=".xls") returned 4 [0075.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.331] lstrlenW (lpString=".xlsx") returned 5 [0075.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.331] lstrlenW (lpString=".ppt") returned 4 [0075.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.331] lstrlenW (lpString=".zip") returned 4 [0075.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.331] lstrlenW (lpString=".rar") returned 4 [0075.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString=".bz2") returned 4 [0075.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString=".7z") returned 3 [0075.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.331] lstrlenW (lpString=".dbf") returned 4 [0075.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.331] lstrlenW (lpString=".1cd") returned 4 [0075.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0075.331] lstrlenW (lpString=".jpg") returned 4 [0075.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.331] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") [0075.412] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33434) returned 1 [0075.412] CloseHandle (hObject=0x22c) returned 1 [0075.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0075.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.701] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.701] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.701] GetLastError () returned 0x0 [0075.702] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x829a, lpOverlapped=0x0) returned 1 [0075.703] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0075.705] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.705] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.705] SetEndOfFile (hFile=0x16c) returned 1 [0075.705] CloseHandle (hObject=0x16c) returned 1 [0075.705] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.705] SetEndOfFile (hFile=0x22c) returned 1 [0075.706] CloseHandle (hObject=0x22c) returned 1 [0075.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.707] lstrlenW (lpString=".doc") returned 4 [0075.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString=".docx") returned 5 [0075.707] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0075.707] lstrlenW (lpString=".pdf") returned 4 [0075.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString=".xls") returned 4 [0075.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.707] lstrlenW (lpString=".xlsx") returned 5 [0075.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0075.707] lstrlenW (lpString=".ppt") returned 4 [0075.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.707] lstrlenW (lpString=".zip") returned 4 [0075.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.707] lstrlenW (lpString=".rar") returned 4 [0075.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString=".bz2") returned 4 [0075.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString=".7z") returned 3 [0075.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.707] lstrlenW (lpString=".dbf") returned 4 [0075.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.707] lstrlenW (lpString=".1cd") returned 4 [0075.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0075.708] lstrlenW (lpString=".jpg") returned 4 [0075.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.708] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") [0075.708] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=28212) returned 1 [0075.708] CloseHandle (hObject=0x22c) returned 1 [0075.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0075.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.709] GetLastError () returned 0x0 [0075.709] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6e34, lpOverlapped=0x0) returned 1 [0075.737] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0075.739] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.739] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.739] SetEndOfFile (hFile=0x16c) returned 1 [0075.742] CloseHandle (hObject=0x16c) returned 1 [0075.742] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.742] SetEndOfFile (hFile=0x22c) returned 1 [0075.743] CloseHandle (hObject=0x22c) returned 1 [0075.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.745] lstrlenW (lpString=".doc") returned 4 [0075.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".docx") returned 5 [0075.745] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0075.745] lstrlenW (lpString=".pdf") returned 4 [0075.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".xls") returned 4 [0075.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.745] lstrlenW (lpString=".xlsx") returned 5 [0075.745] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0075.745] lstrlenW (lpString=".ppt") returned 4 [0075.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.745] lstrlenW (lpString=".zip") returned 4 [0075.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.745] lstrlenW (lpString=".rar") returned 4 [0075.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".bz2") returned 4 [0075.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".7z") returned 3 [0075.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.745] lstrlenW (lpString=".dbf") returned 4 [0075.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.745] lstrlenW (lpString=".1cd") returned 4 [0075.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0075.746] lstrlenW (lpString=".jpg") returned 4 [0075.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.746] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") [0075.747] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17638) returned 1 [0075.747] CloseHandle (hObject=0x22c) returned 1 [0075.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0075.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.747] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.747] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.748] GetLastError () returned 0x0 [0075.748] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x44e6, lpOverlapped=0x0) returned 1 [0075.750] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0075.752] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.752] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.752] SetEndOfFile (hFile=0x16c) returned 1 [0075.752] CloseHandle (hObject=0x16c) returned 1 [0075.752] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.752] SetEndOfFile (hFile=0x22c) returned 1 [0075.753] CloseHandle (hObject=0x22c) returned 1 [0075.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString=".doc") returned 4 [0075.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString=".docx") returned 5 [0075.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0075.754] lstrlenW (lpString=".pdf") returned 4 [0075.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString=".xls") returned 4 [0075.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.754] lstrlenW (lpString=".xlsx") returned 5 [0075.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0075.754] lstrlenW (lpString=".ppt") returned 4 [0075.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString=".zip") returned 4 [0075.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.754] lstrlenW (lpString=".rar") returned 4 [0075.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString=".bz2") returned 4 [0075.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString=".7z") returned 3 [0075.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString=".dbf") returned 4 [0075.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString=".1cd") returned 4 [0075.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0075.754] lstrlenW (lpString=".jpg") returned 4 [0075.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.755] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") [0075.755] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3332) returned 1 [0075.755] CloseHandle (hObject=0x22c) returned 1 [0075.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0075.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.755] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.755] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.756] GetLastError () returned 0x0 [0075.756] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd04, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0075.759] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.759] SetEndOfFile (hFile=0x16c) returned 1 [0075.759] CloseHandle (hObject=0x16c) returned 1 [0075.759] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.759] SetEndOfFile (hFile=0x22c) returned 1 [0075.760] CloseHandle (hObject=0x22c) returned 1 [0075.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0075.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.763] lstrlenW (lpString=".doc") returned 4 [0075.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.763] lstrlenW (lpString=".docx") returned 5 [0075.763] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0075.763] lstrlenW (lpString=".pdf") returned 4 [0075.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.763] lstrlenW (lpString=".xls") returned 4 [0075.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.763] lstrlenW (lpString=".xlsx") returned 5 [0075.763] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0075.765] lstrlenW (lpString=".ppt") returned 4 [0075.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.765] lstrlenW (lpString=".zip") returned 4 [0075.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.765] lstrlenW (lpString=".rar") returned 4 [0075.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.766] lstrlenW (lpString=".bz2") returned 4 [0075.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.766] lstrlenW (lpString=".7z") returned 3 [0075.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.766] lstrlenW (lpString=".dbf") returned 4 [0075.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.766] lstrlenW (lpString=".1cd") returned 4 [0075.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0075.766] lstrlenW (lpString=".jpg") returned 4 [0075.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.766] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") [0075.766] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1456) returned 1 [0075.766] CloseHandle (hObject=0x22c) returned 1 [0075.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0075.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.767] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.767] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.767] GetLastError () returned 0x0 [0075.767] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5b0, lpOverlapped=0x0) returned 1 [0075.769] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0075.770] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.770] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.770] SetEndOfFile (hFile=0x16c) returned 1 [0075.770] CloseHandle (hObject=0x16c) returned 1 [0075.770] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.770] SetEndOfFile (hFile=0x22c) returned 1 [0075.771] CloseHandle (hObject=0x22c) returned 1 [0075.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0075.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.771] lstrlenW (lpString=".doc") returned 4 [0075.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.771] lstrlenW (lpString=".docx") returned 5 [0075.771] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0075.771] lstrlenW (lpString=".pdf") returned 4 [0075.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.771] lstrlenW (lpString=".xls") returned 4 [0075.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.771] lstrlenW (lpString=".xlsx") returned 5 [0075.772] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0075.772] lstrlenW (lpString=".ppt") returned 4 [0075.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.772] lstrlenW (lpString=".zip") returned 4 [0075.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.772] lstrlenW (lpString=".rar") returned 4 [0075.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.772] lstrlenW (lpString=".bz2") returned 4 [0075.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.772] lstrlenW (lpString=".7z") returned 3 [0075.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.772] lstrlenW (lpString=".dbf") returned 4 [0075.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.772] lstrlenW (lpString=".1cd") returned 4 [0075.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0075.772] lstrlenW (lpString=".jpg") returned 4 [0075.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.772] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") [0075.772] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5314) returned 1 [0075.773] CloseHandle (hObject=0x22c) returned 1 [0075.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0075.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0075.773] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.773] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0075.773] GetLastError () returned 0x0 [0075.773] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x14c2, lpOverlapped=0x0) returned 1 [0075.917] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0075.918] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.918] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.918] SetEndOfFile (hFile=0x16c) returned 1 [0075.926] CloseHandle (hObject=0x16c) returned 1 [0075.926] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.926] SetEndOfFile (hFile=0x22c) returned 1 [0075.927] CloseHandle (hObject=0x22c) returned 1 [0075.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.943] lstrlenW (lpString=".doc") returned 4 [0075.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".docx") returned 5 [0075.943] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0075.943] lstrlenW (lpString=".pdf") returned 4 [0075.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".xls") returned 4 [0075.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.943] lstrlenW (lpString=".xlsx") returned 5 [0075.943] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0075.943] lstrlenW (lpString=".ppt") returned 4 [0075.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.943] lstrlenW (lpString=".zip") returned 4 [0075.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.943] lstrlenW (lpString=".rar") returned 4 [0075.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString=".bz2") returned 4 [0075.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString=".7z") returned 3 [0075.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.944] lstrlenW (lpString=".dbf") returned 4 [0075.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.944] lstrlenW (lpString=".1cd") returned 4 [0075.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0075.944] lstrlenW (lpString=".jpg") returned 4 [0075.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.944] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") [0076.090] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6934) returned 1 [0076.090] CloseHandle (hObject=0x22c) returned 1 [0076.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0076.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.092] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.092] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.192] GetLastError () returned 0x0 [0076.192] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0076.243] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0076.244] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.244] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.244] SetEndOfFile (hFile=0x180) returned 1 [0076.244] CloseHandle (hObject=0x180) returned 1 [0076.244] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.244] SetEndOfFile (hFile=0x22c) returned 1 [0076.245] CloseHandle (hObject=0x22c) returned 1 [0076.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0076.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.245] lstrlenW (lpString=".doc") returned 4 [0076.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString=".docx") returned 5 [0076.246] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0076.246] lstrlenW (lpString=".pdf") returned 4 [0076.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString=".xls") returned 4 [0076.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.246] lstrlenW (lpString=".xlsx") returned 5 [0076.246] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0076.246] lstrlenW (lpString=".ppt") returned 4 [0076.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.246] lstrlenW (lpString=".zip") returned 4 [0076.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.246] lstrlenW (lpString=".rar") returned 4 [0076.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString=".bz2") returned 4 [0076.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString=".7z") returned 3 [0076.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.246] lstrlenW (lpString=".dbf") returned 4 [0076.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.246] lstrlenW (lpString=".1cd") returned 4 [0076.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0076.246] lstrlenW (lpString=".jpg") returned 4 [0076.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.246] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") [0076.247] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26160) returned 1 [0076.247] CloseHandle (hObject=0x22c) returned 1 [0076.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0076.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.247] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.247] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.248] GetLastError () returned 0x0 [0076.248] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6630, lpOverlapped=0x0) returned 1 [0076.634] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6640, lpOverlapped=0x0) returned 1 [0076.638] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.638] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.671] SetEndOfFile (hFile=0x180) returned 1 [0076.690] CloseHandle (hObject=0x180) returned 1 [0076.690] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.690] SetEndOfFile (hFile=0x22c) returned 1 [0076.691] CloseHandle (hObject=0x22c) returned 1 [0076.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0076.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.694] lstrlenW (lpString=".doc") returned 4 [0076.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.694] lstrlenW (lpString=".docx") returned 5 [0076.694] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0076.694] lstrlenW (lpString=".pdf") returned 4 [0076.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.694] lstrlenW (lpString=".xls") returned 4 [0076.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.694] lstrlenW (lpString=".xlsx") returned 5 [0076.694] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0076.694] lstrlenW (lpString=".ppt") returned 4 [0076.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.694] lstrlenW (lpString=".zip") returned 4 [0076.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.695] lstrlenW (lpString=".rar") returned 4 [0076.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".bz2") returned 4 [0076.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".7z") returned 3 [0076.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.695] lstrlenW (lpString=".dbf") returned 4 [0076.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.695] lstrlenW (lpString=".1cd") returned 4 [0076.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0076.695] lstrlenW (lpString=".jpg") returned 4 [0076.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.695] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") [0076.733] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=64767) returned 1 [0076.733] CloseHandle (hObject=0x160) returned 1 [0076.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0076.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0076.733] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.733] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.740] GetLastError () returned 0x0 [0076.740] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0077.224] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0077.227] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.227] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.227] SetEndOfFile (hFile=0x15c) returned 1 [0077.237] CloseHandle (hObject=0x15c) returned 1 [0077.237] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.237] SetEndOfFile (hFile=0x160) returned 1 [0077.238] CloseHandle (hObject=0x160) returned 1 [0077.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0077.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.239] lstrlenW (lpString=".doc") returned 4 [0077.239] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.239] lstrlenW (lpString=".docx") returned 5 [0077.239] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0077.239] lstrlenW (lpString=".pdf") returned 4 [0077.239] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.239] lstrlenW (lpString=".xls") returned 4 [0077.239] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.239] lstrlenW (lpString=".xlsx") returned 5 [0077.239] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0077.239] lstrlenW (lpString=".ppt") returned 4 [0077.239] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.240] lstrlenW (lpString=".zip") returned 4 [0077.240] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.240] lstrlenW (lpString=".rar") returned 4 [0077.240] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.240] lstrlenW (lpString=".bz2") returned 4 [0077.240] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.240] lstrlenW (lpString=".7z") returned 3 [0077.240] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.240] lstrlenW (lpString=".dbf") returned 4 [0077.240] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.240] lstrlenW (lpString=".1cd") returned 4 [0077.240] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0077.240] lstrlenW (lpString=".jpg") returned 4 [0077.240] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.240] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") [0077.240] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3394) returned 1 [0077.241] CloseHandle (hObject=0x160) returned 1 [0077.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0077.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.241] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.241] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.241] GetLastError () returned 0x0 [0077.241] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd42, lpOverlapped=0x0) returned 1 [0077.434] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0077.435] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.435] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.435] SetEndOfFile (hFile=0x15c) returned 1 [0077.435] CloseHandle (hObject=0x15c) returned 1 [0077.435] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.435] SetEndOfFile (hFile=0x160) returned 1 [0077.440] CloseHandle (hObject=0x160) returned 1 [0077.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.441] lstrlenW (lpString=".doc") returned 4 [0077.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString=".docx") returned 5 [0077.441] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0077.441] lstrlenW (lpString=".pdf") returned 4 [0077.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString=".xls") returned 4 [0077.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.441] lstrlenW (lpString=".xlsx") returned 5 [0077.441] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0077.441] lstrlenW (lpString=".ppt") returned 4 [0077.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.441] lstrlenW (lpString=".zip") returned 4 [0077.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.441] lstrlenW (lpString=".rar") returned 4 [0077.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString=".bz2") returned 4 [0077.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString=".7z") returned 3 [0077.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.441] lstrlenW (lpString=".dbf") returned 4 [0077.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.441] lstrlenW (lpString=".1cd") returned 4 [0077.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0077.442] lstrlenW (lpString=".jpg") returned 4 [0077.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.442] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") [0077.475] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1198) returned 1 [0077.475] CloseHandle (hObject=0x160) returned 1 [0077.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0077.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.475] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.475] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.476] GetLastError () returned 0x0 [0077.476] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4ae, lpOverlapped=0x0) returned 1 [0077.494] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0077.495] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.495] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.495] SetEndOfFile (hFile=0x150) returned 1 [0077.495] CloseHandle (hObject=0x150) returned 1 [0077.495] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.495] SetEndOfFile (hFile=0x160) returned 1 [0077.496] CloseHandle (hObject=0x160) returned 1 [0077.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString=".doc") returned 4 [0077.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString=".docx") returned 5 [0077.497] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0077.497] lstrlenW (lpString=".pdf") returned 4 [0077.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString=".xls") returned 4 [0077.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.497] lstrlenW (lpString=".xlsx") returned 5 [0077.497] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0077.497] lstrlenW (lpString=".ppt") returned 4 [0077.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString=".zip") returned 4 [0077.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.497] lstrlenW (lpString=".rar") returned 4 [0077.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString=".bz2") returned 4 [0077.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString=".7z") returned 3 [0077.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString=".dbf") returned 4 [0077.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString=".1cd") returned 4 [0077.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0077.497] lstrlenW (lpString=".jpg") returned 4 [0077.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.498] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") [0077.498] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4118) returned 1 [0077.498] CloseHandle (hObject=0x160) returned 1 [0077.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0077.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.498] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.498] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.499] GetLastError () returned 0x0 [0077.499] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1016, lpOverlapped=0x0) returned 1 [0077.513] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0077.514] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.514] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.514] SetEndOfFile (hFile=0x150) returned 1 [0077.515] CloseHandle (hObject=0x150) returned 1 [0077.515] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.515] SetEndOfFile (hFile=0x160) returned 1 [0077.515] CloseHandle (hObject=0x160) returned 1 [0077.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0077.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.516] lstrlenW (lpString=".doc") returned 4 [0077.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.516] lstrlenW (lpString=".docx") returned 5 [0077.516] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0077.516] lstrlenW (lpString=".pdf") returned 4 [0077.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.516] lstrlenW (lpString=".xls") returned 4 [0077.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.516] lstrlenW (lpString=".xlsx") returned 5 [0077.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0077.516] lstrlenW (lpString=".ppt") returned 4 [0077.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.516] lstrlenW (lpString=".zip") returned 4 [0077.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.516] lstrlenW (lpString=".rar") returned 4 [0077.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.516] lstrlenW (lpString=".bz2") returned 4 [0077.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.517] lstrlenW (lpString=".7z") returned 3 [0077.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.517] lstrlenW (lpString=".dbf") returned 4 [0077.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.517] lstrlenW (lpString=".1cd") returned 4 [0077.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0077.517] lstrlenW (lpString=".jpg") returned 4 [0077.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.517] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") [0077.517] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24528) returned 1 [0077.517] CloseHandle (hObject=0x160) returned 1 [0077.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0077.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.518] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.518] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.518] GetLastError () returned 0x0 [0077.518] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0077.538] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0077.539] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.539] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.539] SetEndOfFile (hFile=0x150) returned 1 [0077.539] CloseHandle (hObject=0x150) returned 1 [0077.540] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.540] SetEndOfFile (hFile=0x160) returned 1 [0077.540] CloseHandle (hObject=0x160) returned 1 [0077.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0077.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.542] lstrlenW (lpString=".doc") returned 4 [0077.542] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.542] lstrlenW (lpString=".docx") returned 5 [0077.542] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0077.542] lstrlenW (lpString=".pdf") returned 4 [0077.542] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.542] lstrlenW (lpString=".xls") returned 4 [0077.542] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.542] lstrlenW (lpString=".xlsx") returned 5 [0077.542] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0077.542] lstrlenW (lpString=".ppt") returned 4 [0077.542] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.542] lstrlenW (lpString=".zip") returned 4 [0077.542] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.542] lstrlenW (lpString=".rar") returned 4 [0077.542] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.542] lstrlenW (lpString=".bz2") returned 4 [0077.542] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.542] lstrlenW (lpString=".7z") returned 3 [0077.542] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.543] lstrlenW (lpString=".dbf") returned 4 [0077.543] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.543] lstrlenW (lpString=".1cd") returned 4 [0077.543] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0077.543] lstrlenW (lpString=".jpg") returned 4 [0077.543] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.543] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") [0077.543] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=62367) returned 1 [0077.543] CloseHandle (hObject=0x160) returned 1 [0077.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0077.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.544] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.544] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.544] GetLastError () returned 0x0 [0077.544] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0077.548] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.549] SetEndOfFile (hFile=0x150) returned 1 [0077.549] CloseHandle (hObject=0x150) returned 1 [0077.549] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.549] SetEndOfFile (hFile=0x160) returned 1 [0077.550] CloseHandle (hObject=0x160) returned 1 [0077.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0077.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.551] lstrlenW (lpString=".doc") returned 4 [0077.551] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.551] lstrlenW (lpString=".docx") returned 5 [0077.551] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0077.551] lstrlenW (lpString=".pdf") returned 4 [0077.551] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.551] lstrlenW (lpString=".xls") returned 4 [0077.551] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.551] lstrlenW (lpString=".xlsx") returned 5 [0077.551] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0077.551] lstrlenW (lpString=".ppt") returned 4 [0077.551] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.551] lstrlenW (lpString=".zip") returned 4 [0077.551] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.551] lstrlenW (lpString=".rar") returned 4 [0077.551] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.551] lstrlenW (lpString=".bz2") returned 4 [0077.551] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.551] lstrlenW (lpString=".7z") returned 3 [0077.551] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.551] lstrlenW (lpString=".dbf") returned 4 [0077.551] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.551] lstrlenW (lpString=".1cd") returned 4 [0077.551] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0077.552] lstrlenW (lpString=".jpg") returned 4 [0077.552] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.552] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") [0077.552] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17964) returned 1 [0077.552] CloseHandle (hObject=0x160) returned 1 [0077.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0077.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.552] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.552] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.553] GetLastError () returned 0x0 [0077.553] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x462c, lpOverlapped=0x0) returned 1 [0077.572] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0077.574] ReadFile (in: hFile=0x160, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.574] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.574] SetEndOfFile (hFile=0x150) returned 1 [0077.574] CloseHandle (hObject=0x150) returned 1 [0077.574] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.574] SetEndOfFile (hFile=0x160) returned 1 [0077.575] CloseHandle (hObject=0x160) returned 1 [0077.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0077.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.575] lstrlenW (lpString=".doc") returned 4 [0077.576] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.576] lstrlenW (lpString=".docx") returned 5 [0077.576] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0077.576] lstrlenW (lpString=".pdf") returned 4 [0077.576] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.576] lstrlenW (lpString=".xls") returned 4 [0077.576] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.576] lstrlenW (lpString=".xlsx") returned 5 [0077.576] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0077.576] lstrlenW (lpString=".ppt") returned 4 [0077.576] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.576] lstrlenW (lpString=".zip") returned 4 [0077.576] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.576] lstrlenW (lpString=".rar") returned 4 [0077.576] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.576] lstrlenW (lpString=".bz2") returned 4 [0077.576] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.576] lstrlenW (lpString=".7z") returned 3 [0077.576] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.576] lstrlenW (lpString=".dbf") returned 4 [0077.576] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.576] lstrlenW (lpString=".1cd") returned 4 [0077.576] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0077.576] lstrlenW (lpString=".jpg") returned 4 [0077.576] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.576] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") [0077.636] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14337) returned 1 [0077.636] CloseHandle (hObject=0x190) returned 1 [0077.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0077.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.636] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.636] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.637] GetLastError () returned 0x0 [0077.637] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3801, lpOverlapped=0x0) returned 1 [0077.747] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3810, lpOverlapped=0x0) returned 1 [0077.788] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.789] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.789] SetEndOfFile (hFile=0x158) returned 1 [0077.789] CloseHandle (hObject=0x158) returned 1 [0077.789] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.789] SetEndOfFile (hFile=0x190) returned 1 [0077.790] CloseHandle (hObject=0x190) returned 1 [0077.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0077.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.790] lstrlenW (lpString=".doc") returned 4 [0077.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.790] lstrlenW (lpString=".docx") returned 5 [0077.790] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0077.791] lstrlenW (lpString=".pdf") returned 4 [0077.791] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.791] lstrlenW (lpString=".xls") returned 4 [0077.791] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.791] lstrlenW (lpString=".xlsx") returned 5 [0077.791] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0077.791] lstrlenW (lpString=".ppt") returned 4 [0077.791] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.791] lstrlenW (lpString=".zip") returned 4 [0077.791] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.791] lstrlenW (lpString=".rar") returned 4 [0077.791] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.791] lstrlenW (lpString=".bz2") returned 4 [0077.791] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.791] lstrlenW (lpString=".7z") returned 3 [0077.791] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.791] lstrlenW (lpString=".dbf") returned 4 [0077.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.791] lstrlenW (lpString=".1cd") returned 4 [0077.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0077.791] lstrlenW (lpString=".jpg") returned 4 [0077.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.791] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") [0077.792] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33975) returned 1 [0077.792] CloseHandle (hObject=0x190) returned 1 [0077.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0077.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.793] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.793] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.793] GetLastError () returned 0x0 [0077.793] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x84b7, lpOverlapped=0x0) returned 1 [0077.855] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0077.856] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.857] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.857] SetEndOfFile (hFile=0x158) returned 1 [0077.857] CloseHandle (hObject=0x158) returned 1 [0077.857] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.857] SetEndOfFile (hFile=0x190) returned 1 [0077.858] CloseHandle (hObject=0x190) returned 1 [0077.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.858] lstrlenW (lpString=".doc") returned 4 [0077.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.858] lstrlenW (lpString=".docx") returned 5 [0077.858] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0077.858] lstrlenW (lpString=".pdf") returned 4 [0077.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.859] lstrlenW (lpString=".xls") returned 4 [0077.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.859] lstrlenW (lpString=".xlsx") returned 5 [0077.859] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0077.859] lstrlenW (lpString=".ppt") returned 4 [0077.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.859] lstrlenW (lpString=".zip") returned 4 [0077.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.859] lstrlenW (lpString=".rar") returned 4 [0077.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.859] lstrlenW (lpString=".bz2") returned 4 [0077.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.859] lstrlenW (lpString=".7z") returned 3 [0077.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.859] lstrlenW (lpString=".dbf") returned 4 [0077.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.859] lstrlenW (lpString=".1cd") returned 4 [0077.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0077.859] lstrlenW (lpString=".jpg") returned 4 [0077.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.859] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") [0077.860] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16543) returned 1 [0077.860] CloseHandle (hObject=0x190) returned 1 [0077.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0077.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.861] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.861] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.861] GetLastError () returned 0x0 [0077.862] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x409f, lpOverlapped=0x0) returned 1 [0077.863] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0077.872] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.873] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.873] SetEndOfFile (hFile=0x158) returned 1 [0077.874] CloseHandle (hObject=0x158) returned 1 [0077.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.875] SetEndOfFile (hFile=0x190) returned 1 [0077.878] CloseHandle (hObject=0x190) returned 1 [0077.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString=".doc") returned 4 [0077.881] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.881] lstrlenW (lpString=".docx") returned 5 [0077.881] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0077.881] lstrlenW (lpString=".pdf") returned 4 [0077.881] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.881] lstrlenW (lpString=".xls") returned 4 [0077.881] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.881] lstrlenW (lpString=".xlsx") returned 5 [0077.881] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0077.881] lstrlenW (lpString=".ppt") returned 4 [0077.881] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString=".zip") returned 4 [0077.881] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.881] lstrlenW (lpString=".rar") returned 4 [0077.881] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.881] lstrlenW (lpString=".bz2") returned 4 [0077.881] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.881] lstrlenW (lpString=".7z") returned 3 [0077.881] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString=".dbf") returned 4 [0077.881] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString=".1cd") returned 4 [0077.881] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0077.881] lstrlenW (lpString=".jpg") returned 4 [0077.882] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.882] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") [0077.882] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=51401) returned 1 [0077.882] CloseHandle (hObject=0x190) returned 1 [0077.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0077.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.883] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.883] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.883] GetLastError () returned 0x0 [0077.883] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0077.892] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0077.899] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.900] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.900] SetEndOfFile (hFile=0x158) returned 1 [0077.902] CloseHandle (hObject=0x158) returned 1 [0077.902] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.902] SetEndOfFile (hFile=0x190) returned 1 [0077.912] CloseHandle (hObject=0x190) returned 1 [0077.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0077.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.913] lstrlenW (lpString=".doc") returned 4 [0077.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.913] lstrlenW (lpString=".docx") returned 5 [0077.913] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0077.913] lstrlenW (lpString=".pdf") returned 4 [0077.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.913] lstrlenW (lpString=".xls") returned 4 [0077.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.913] lstrlenW (lpString=".xlsx") returned 5 [0077.913] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0077.913] lstrlenW (lpString=".ppt") returned 4 [0077.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.913] lstrlenW (lpString=".zip") returned 4 [0077.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.913] lstrlenW (lpString=".rar") returned 4 [0077.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.913] lstrlenW (lpString=".bz2") returned 4 [0077.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.914] lstrlenW (lpString=".7z") returned 3 [0077.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.914] lstrlenW (lpString=".dbf") returned 4 [0077.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.914] lstrlenW (lpString=".1cd") returned 4 [0077.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0077.914] lstrlenW (lpString=".jpg") returned 4 [0077.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.914] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") [0077.914] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4967) returned 1 [0077.914] CloseHandle (hObject=0x190) returned 1 [0077.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0077.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.915] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.915] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.915] GetLastError () returned 0x0 [0077.915] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1367, lpOverlapped=0x0) returned 1 [0078.069] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0078.070] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.070] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.070] SetEndOfFile (hFile=0x158) returned 1 [0078.070] CloseHandle (hObject=0x158) returned 1 [0078.070] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.070] SetEndOfFile (hFile=0x190) returned 1 [0078.071] CloseHandle (hObject=0x190) returned 1 [0078.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.119] lstrlenW (lpString=".doc") returned 4 [0078.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.120] lstrlenW (lpString=".docx") returned 5 [0078.120] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0078.120] lstrlenW (lpString=".pdf") returned 4 [0078.120] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.120] lstrlenW (lpString=".xls") returned 4 [0078.120] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.120] lstrlenW (lpString=".xlsx") returned 5 [0078.120] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0078.120] lstrlenW (lpString=".ppt") returned 4 [0078.120] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.120] lstrlenW (lpString=".zip") returned 4 [0078.120] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.120] lstrlenW (lpString=".rar") returned 4 [0078.120] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.120] lstrlenW (lpString=".bz2") returned 4 [0078.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.120] lstrlenW (lpString=".7z") returned 3 [0078.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.120] lstrlenW (lpString=".dbf") returned 4 [0078.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.120] lstrlenW (lpString=".1cd") returned 4 [0078.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0078.121] lstrlenW (lpString=".jpg") returned 4 [0078.121] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.121] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") [0078.131] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15988) returned 1 [0078.131] CloseHandle (hObject=0x190) returned 1 [0078.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0078.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.131] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.131] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.132] GetLastError () returned 0x0 [0078.132] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0078.154] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0078.155] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.155] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.155] SetEndOfFile (hFile=0x158) returned 1 [0078.155] CloseHandle (hObject=0x158) returned 1 [0078.155] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.156] SetEndOfFile (hFile=0x190) returned 1 [0078.156] CloseHandle (hObject=0x190) returned 1 [0078.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.157] lstrlenW (lpString=".doc") returned 4 [0078.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString=".docx") returned 5 [0078.157] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.157] lstrlenW (lpString=".pdf") returned 4 [0078.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString=".xls") returned 4 [0078.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.157] lstrlenW (lpString=".xlsx") returned 5 [0078.157] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.157] lstrlenW (lpString=".ppt") returned 4 [0078.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.157] lstrlenW (lpString=".zip") returned 4 [0078.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.157] lstrlenW (lpString=".rar") returned 4 [0078.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString=".bz2") returned 4 [0078.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString=".7z") returned 3 [0078.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.157] lstrlenW (lpString=".dbf") returned 4 [0078.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.158] lstrlenW (lpString=".1cd") returned 4 [0078.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0078.158] lstrlenW (lpString=".jpg") returned 4 [0078.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.158] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") [0078.158] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11216) returned 1 [0078.158] CloseHandle (hObject=0x190) returned 1 [0078.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0078.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.159] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.159] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.159] GetLastError () returned 0x0 [0078.159] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0078.189] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0078.190] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.190] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.190] SetEndOfFile (hFile=0x158) returned 1 [0078.190] CloseHandle (hObject=0x158) returned 1 [0078.190] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.190] SetEndOfFile (hFile=0x190) returned 1 [0078.191] CloseHandle (hObject=0x190) returned 1 [0078.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString=".doc") returned 4 [0078.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString=".docx") returned 5 [0078.192] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.192] lstrlenW (lpString=".pdf") returned 4 [0078.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString=".xls") returned 4 [0078.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.192] lstrlenW (lpString=".xlsx") returned 5 [0078.192] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.192] lstrlenW (lpString=".ppt") returned 4 [0078.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString=".zip") returned 4 [0078.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.192] lstrlenW (lpString=".rar") returned 4 [0078.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString=".bz2") returned 4 [0078.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString=".7z") returned 3 [0078.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString=".dbf") returned 4 [0078.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString=".1cd") returned 4 [0078.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0078.192] lstrlenW (lpString=".jpg") returned 4 [0078.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.193] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") [0078.193] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17344) returned 1 [0078.193] CloseHandle (hObject=0x190) returned 1 [0078.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0078.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.194] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.194] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.194] GetLastError () returned 0x0 [0078.194] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x43c0, lpOverlapped=0x0) returned 1 [0078.205] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0078.206] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.206] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.207] SetEndOfFile (hFile=0x158) returned 1 [0078.207] CloseHandle (hObject=0x158) returned 1 [0078.207] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.207] SetEndOfFile (hFile=0x190) returned 1 [0078.208] CloseHandle (hObject=0x190) returned 1 [0078.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.208] lstrlenW (lpString=".doc") returned 4 [0078.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.208] lstrlenW (lpString=".docx") returned 5 [0078.208] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.208] lstrlenW (lpString=".pdf") returned 4 [0078.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.208] lstrlenW (lpString=".xls") returned 4 [0078.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.208] lstrlenW (lpString=".xlsx") returned 5 [0078.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.208] lstrlenW (lpString=".ppt") returned 4 [0078.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.208] lstrlenW (lpString=".zip") returned 4 [0078.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.209] lstrlenW (lpString=".rar") returned 4 [0078.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.209] lstrlenW (lpString=".bz2") returned 4 [0078.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.209] lstrlenW (lpString=".7z") returned 3 [0078.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.209] lstrlenW (lpString=".dbf") returned 4 [0078.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.209] lstrlenW (lpString=".1cd") returned 4 [0078.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0078.209] lstrlenW (lpString=".jpg") returned 4 [0078.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.209] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") [0078.216] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=44948) returned 1 [0078.216] CloseHandle (hObject=0x190) returned 1 [0078.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0078.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.217] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.217] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.223] GetLastError () returned 0x0 [0078.223] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xaf94, lpOverlapped=0x0) returned 1 [0078.268] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0078.277] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.278] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.278] SetEndOfFile (hFile=0x158) returned 1 [0078.278] CloseHandle (hObject=0x158) returned 1 [0078.278] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.278] SetEndOfFile (hFile=0x190) returned 1 [0078.279] CloseHandle (hObject=0x190) returned 1 [0078.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0078.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.280] lstrlenW (lpString=".doc") returned 4 [0078.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.280] lstrlenW (lpString=".docx") returned 5 [0078.280] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.280] lstrlenW (lpString=".pdf") returned 4 [0078.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.280] lstrlenW (lpString=".xls") returned 4 [0078.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.280] lstrlenW (lpString=".xlsx") returned 5 [0078.280] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.280] lstrlenW (lpString=".ppt") returned 4 [0078.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.280] lstrlenW (lpString=".zip") returned 4 [0078.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.280] lstrlenW (lpString=".rar") returned 4 [0078.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.280] lstrlenW (lpString=".bz2") returned 4 [0078.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.281] lstrlenW (lpString=".7z") returned 3 [0078.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.281] lstrlenW (lpString=".dbf") returned 4 [0078.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.281] lstrlenW (lpString=".1cd") returned 4 [0078.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0078.281] lstrlenW (lpString=".jpg") returned 4 [0078.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.281] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") [0078.282] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11532) returned 1 [0078.282] CloseHandle (hObject=0x190) returned 1 [0078.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0078.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.282] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.282] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.283] GetLastError () returned 0x0 [0078.283] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0078.300] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0078.301] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.301] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.301] SetEndOfFile (hFile=0x158) returned 1 [0078.301] CloseHandle (hObject=0x158) returned 1 [0078.301] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.301] SetEndOfFile (hFile=0x190) returned 1 [0078.302] CloseHandle (hObject=0x190) returned 1 [0078.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0078.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.302] lstrlenW (lpString=".doc") returned 4 [0078.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString=".docx") returned 5 [0078.303] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.303] lstrlenW (lpString=".pdf") returned 4 [0078.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString=".xls") returned 4 [0078.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.303] lstrlenW (lpString=".xlsx") returned 5 [0078.303] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.303] lstrlenW (lpString=".ppt") returned 4 [0078.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.303] lstrlenW (lpString=".zip") returned 4 [0078.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.303] lstrlenW (lpString=".rar") returned 4 [0078.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString=".bz2") returned 4 [0078.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString=".7z") returned 3 [0078.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.303] lstrlenW (lpString=".dbf") returned 4 [0078.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.303] lstrlenW (lpString=".1cd") returned 4 [0078.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0078.303] lstrlenW (lpString=".jpg") returned 4 [0078.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.303] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") [0078.310] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4628) returned 1 [0078.310] CloseHandle (hObject=0x1f0) returned 1 [0078.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0078.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.310] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.310] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.310] GetLastError () returned 0x0 [0078.310] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1214, lpOverlapped=0x0) returned 1 [0078.318] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0078.319] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.319] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.319] SetEndOfFile (hFile=0x1fc) returned 1 [0078.319] CloseHandle (hObject=0x1fc) returned 1 [0078.319] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.319] SetEndOfFile (hFile=0x1f0) returned 1 [0078.320] CloseHandle (hObject=0x1f0) returned 1 [0078.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0078.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.320] lstrlenW (lpString=".doc") returned 4 [0078.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.320] lstrlenW (lpString=".docx") returned 5 [0078.320] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.320] lstrlenW (lpString=".pdf") returned 4 [0078.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.320] lstrlenW (lpString=".xls") returned 4 [0078.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.321] lstrlenW (lpString=".xlsx") returned 5 [0078.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.321] lstrlenW (lpString=".ppt") returned 4 [0078.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.321] lstrlenW (lpString=".zip") returned 4 [0078.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.321] lstrlenW (lpString=".rar") returned 4 [0078.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.321] lstrlenW (lpString=".bz2") returned 4 [0078.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.321] lstrlenW (lpString=".7z") returned 3 [0078.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.321] lstrlenW (lpString=".dbf") returned 4 [0078.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.321] lstrlenW (lpString=".1cd") returned 4 [0078.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0078.321] lstrlenW (lpString=".jpg") returned 4 [0078.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.322] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") [0078.322] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17728) returned 1 [0078.322] CloseHandle (hObject=0x1f0) returned 1 [0078.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0078.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.322] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.322] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.323] GetLastError () returned 0x0 [0078.323] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4540, lpOverlapped=0x0) returned 1 [0078.332] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0078.333] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.333] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.333] SetEndOfFile (hFile=0x1fc) returned 1 [0078.333] CloseHandle (hObject=0x1fc) returned 1 [0078.333] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.333] SetEndOfFile (hFile=0x1f0) returned 1 [0078.334] CloseHandle (hObject=0x1f0) returned 1 [0078.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.335] lstrlenW (lpString=".doc") returned 4 [0078.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString=".docx") returned 5 [0078.335] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.335] lstrlenW (lpString=".pdf") returned 4 [0078.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString=".xls") returned 4 [0078.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.335] lstrlenW (lpString=".xlsx") returned 5 [0078.335] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.335] lstrlenW (lpString=".ppt") returned 4 [0078.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.335] lstrlenW (lpString=".zip") returned 4 [0078.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.335] lstrlenW (lpString=".rar") returned 4 [0078.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString=".bz2") returned 4 [0078.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString=".7z") returned 3 [0078.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.335] lstrlenW (lpString=".dbf") returned 4 [0078.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.335] lstrlenW (lpString=".1cd") returned 4 [0078.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0078.336] lstrlenW (lpString=".jpg") returned 4 [0078.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.336] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") [0078.339] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11540) returned 1 [0078.339] CloseHandle (hObject=0x1f0) returned 1 [0078.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0078.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.339] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.339] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.340] GetLastError () returned 0x0 [0078.340] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2d14, lpOverlapped=0x0) returned 1 [0078.343] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0078.344] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.344] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.344] SetEndOfFile (hFile=0x1fc) returned 1 [0078.344] CloseHandle (hObject=0x1fc) returned 1 [0078.344] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.344] SetEndOfFile (hFile=0x1f0) returned 1 [0078.345] CloseHandle (hObject=0x1f0) returned 1 [0078.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0078.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.345] lstrlenW (lpString=".doc") returned 4 [0078.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.345] lstrlenW (lpString=".docx") returned 5 [0078.345] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.345] lstrlenW (lpString=".pdf") returned 4 [0078.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.345] lstrlenW (lpString=".xls") returned 4 [0078.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.345] lstrlenW (lpString=".xlsx") returned 5 [0078.345] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.345] lstrlenW (lpString=".ppt") returned 4 [0078.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.346] lstrlenW (lpString=".zip") returned 4 [0078.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.346] lstrlenW (lpString=".rar") returned 4 [0078.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.346] lstrlenW (lpString=".bz2") returned 4 [0078.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.346] lstrlenW (lpString=".7z") returned 3 [0078.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.346] lstrlenW (lpString=".dbf") returned 4 [0078.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.346] lstrlenW (lpString=".1cd") returned 4 [0078.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0078.346] lstrlenW (lpString=".jpg") returned 4 [0078.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.346] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") [0078.346] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4796) returned 1 [0078.347] CloseHandle (hObject=0x1f0) returned 1 [0078.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0078.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.347] GetLastError () returned 0x0 [0078.347] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x12bc, lpOverlapped=0x0) returned 1 [0078.442] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0078.443] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.443] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.443] SetEndOfFile (hFile=0x1fc) returned 1 [0078.443] CloseHandle (hObject=0x1fc) returned 1 [0078.444] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.444] SetEndOfFile (hFile=0x1f0) returned 1 [0078.444] CloseHandle (hObject=0x1f0) returned 1 [0078.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0078.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.450] lstrlenW (lpString=".doc") returned 4 [0078.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.450] lstrlenW (lpString=".docx") returned 5 [0078.450] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.450] lstrlenW (lpString=".pdf") returned 4 [0078.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.450] lstrlenW (lpString=".xls") returned 4 [0078.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.450] lstrlenW (lpString=".xlsx") returned 5 [0078.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.451] lstrlenW (lpString=".ppt") returned 4 [0078.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.451] lstrlenW (lpString=".zip") returned 4 [0078.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.451] lstrlenW (lpString=".rar") returned 4 [0078.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.451] lstrlenW (lpString=".bz2") returned 4 [0078.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.451] lstrlenW (lpString=".7z") returned 3 [0078.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.451] lstrlenW (lpString=".dbf") returned 4 [0078.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.451] lstrlenW (lpString=".1cd") returned 4 [0078.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0078.451] lstrlenW (lpString=".jpg") returned 4 [0078.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.451] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") [0079.228] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12380) returned 1 [0079.228] CloseHandle (hObject=0x154) returned 1 [0079.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0079.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0079.229] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.229] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0079.229] GetLastError () returned 0x0 [0079.229] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x305c, lpOverlapped=0x0) returned 1 [0079.324] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3060, lpOverlapped=0x0) returned 1 [0079.327] ReadFile (in: hFile=0x154, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.327] WriteFile (in: hFile=0x160, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.327] SetEndOfFile (hFile=0x160) returned 1 [0079.327] CloseHandle (hObject=0x160) returned 1 [0079.327] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.327] SetEndOfFile (hFile=0x154) returned 1 [0079.328] CloseHandle (hObject=0x154) returned 1 [0079.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0079.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.328] lstrlenW (lpString=".doc") returned 4 [0079.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.328] lstrlenW (lpString=".docx") returned 5 [0079.328] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.329] lstrlenW (lpString=".pdf") returned 4 [0079.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString=".xls") returned 4 [0079.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.329] lstrlenW (lpString=".xlsx") returned 5 [0079.329] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.329] lstrlenW (lpString=".ppt") returned 4 [0079.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.329] lstrlenW (lpString=".zip") returned 4 [0079.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.329] lstrlenW (lpString=".rar") returned 4 [0079.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString=".bz2") returned 4 [0079.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString=".7z") returned 3 [0079.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.329] lstrlenW (lpString=".dbf") returned 4 [0079.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.329] lstrlenW (lpString=".1cd") returned 4 [0079.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0079.329] lstrlenW (lpString=".jpg") returned 4 [0079.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.329] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") [0079.380] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8252) returned 1 [0079.380] CloseHandle (hObject=0x150) returned 1 [0079.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0079.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.381] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.381] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.382] GetLastError () returned 0x0 [0079.382] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x203c, lpOverlapped=0x0) returned 1 [0079.386] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0079.387] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.387] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.387] SetEndOfFile (hFile=0x1c0) returned 1 [0079.387] CloseHandle (hObject=0x1c0) returned 1 [0079.387] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.387] SetEndOfFile (hFile=0x150) returned 1 [0079.388] CloseHandle (hObject=0x150) returned 1 [0079.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0079.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.388] lstrlenW (lpString=".doc") returned 4 [0079.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString=".docx") returned 5 [0079.389] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.389] lstrlenW (lpString=".pdf") returned 4 [0079.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString=".xls") returned 4 [0079.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.389] lstrlenW (lpString=".xlsx") returned 5 [0079.389] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.389] lstrlenW (lpString=".ppt") returned 4 [0079.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.389] lstrlenW (lpString=".zip") returned 4 [0079.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.389] lstrlenW (lpString=".rar") returned 4 [0079.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString=".bz2") returned 4 [0079.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString=".7z") returned 3 [0079.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.389] lstrlenW (lpString=".dbf") returned 4 [0079.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.389] lstrlenW (lpString=".1cd") returned 4 [0079.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0079.389] lstrlenW (lpString=".jpg") returned 4 [0079.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.389] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") [0079.390] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4944) returned 1 [0079.390] CloseHandle (hObject=0x150) returned 1 [0079.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0079.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.390] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.390] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.391] GetLastError () returned 0x0 [0079.391] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1350, lpOverlapped=0x0) returned 1 [0079.400] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0079.401] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.401] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.401] SetEndOfFile (hFile=0x1c0) returned 1 [0079.401] CloseHandle (hObject=0x1c0) returned 1 [0079.401] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.401] SetEndOfFile (hFile=0x150) returned 1 [0079.402] CloseHandle (hObject=0x150) returned 1 [0079.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0079.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.403] lstrlenW (lpString=".doc") returned 4 [0079.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString=".docx") returned 5 [0079.403] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.403] lstrlenW (lpString=".pdf") returned 4 [0079.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString=".xls") returned 4 [0079.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.403] lstrlenW (lpString=".xlsx") returned 5 [0079.403] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.403] lstrlenW (lpString=".ppt") returned 4 [0079.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.403] lstrlenW (lpString=".zip") returned 4 [0079.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.403] lstrlenW (lpString=".rar") returned 4 [0079.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString=".bz2") returned 4 [0079.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString=".7z") returned 3 [0079.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.403] lstrlenW (lpString=".dbf") returned 4 [0079.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.403] lstrlenW (lpString=".1cd") returned 4 [0079.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0079.404] lstrlenW (lpString=".jpg") returned 4 [0079.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.404] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") [0079.407] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3328) returned 1 [0079.407] CloseHandle (hObject=0x150) returned 1 [0079.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0079.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.408] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.408] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.408] GetLastError () returned 0x0 [0079.408] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd00, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0079.434] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.434] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.434] SetEndOfFile (hFile=0x1c0) returned 1 [0079.434] CloseHandle (hObject=0x1c0) returned 1 [0079.434] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.434] SetEndOfFile (hFile=0x150) returned 1 [0079.435] CloseHandle (hObject=0x150) returned 1 [0079.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.436] lstrlenW (lpString=".doc") returned 4 [0079.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".docx") returned 5 [0079.436] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.436] lstrlenW (lpString=".pdf") returned 4 [0079.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".xls") returned 4 [0079.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.436] lstrlenW (lpString=".xlsx") returned 5 [0079.436] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.436] lstrlenW (lpString=".ppt") returned 4 [0079.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.436] lstrlenW (lpString=".zip") returned 4 [0079.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.436] lstrlenW (lpString=".rar") returned 4 [0079.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".bz2") returned 4 [0079.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".7z") returned 3 [0079.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.436] lstrlenW (lpString=".dbf") returned 4 [0079.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.437] lstrlenW (lpString=".1cd") returned 4 [0079.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0079.437] lstrlenW (lpString=".jpg") returned 4 [0079.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.437] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") [0079.437] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6244) returned 1 [0079.437] CloseHandle (hObject=0x150) returned 1 [0079.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0079.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.438] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.438] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.438] GetLastError () returned 0x0 [0079.438] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1864, lpOverlapped=0x0) returned 1 [0079.440] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0079.441] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.441] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.441] SetEndOfFile (hFile=0x1c0) returned 1 [0079.441] CloseHandle (hObject=0x1c0) returned 1 [0079.441] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.441] SetEndOfFile (hFile=0x150) returned 1 [0079.442] CloseHandle (hObject=0x150) returned 1 [0079.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0079.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.443] lstrlenW (lpString=".doc") returned 4 [0079.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.443] lstrlenW (lpString=".docx") returned 5 [0079.443] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.443] lstrlenW (lpString=".pdf") returned 4 [0079.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.443] lstrlenW (lpString=".xls") returned 4 [0079.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.443] lstrlenW (lpString=".xlsx") returned 5 [0079.443] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.443] lstrlenW (lpString=".ppt") returned 4 [0079.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.443] lstrlenW (lpString=".zip") returned 4 [0079.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.443] lstrlenW (lpString=".rar") returned 4 [0079.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.443] lstrlenW (lpString=".bz2") returned 4 [0079.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.443] lstrlenW (lpString=".7z") returned 3 [0079.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.443] lstrlenW (lpString=".dbf") returned 4 [0079.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.444] lstrlenW (lpString=".1cd") returned 4 [0079.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0079.444] lstrlenW (lpString=".jpg") returned 4 [0079.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.444] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") [0079.444] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=18728) returned 1 [0079.444] CloseHandle (hObject=0x150) returned 1 [0079.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0079.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.445] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.445] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.445] GetLastError () returned 0x0 [0079.445] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4928, lpOverlapped=0x0) returned 1 [0079.567] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4930, lpOverlapped=0x0) returned 1 [0079.568] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.568] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.568] SetEndOfFile (hFile=0x1c0) returned 1 [0079.568] CloseHandle (hObject=0x1c0) returned 1 [0079.568] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.568] SetEndOfFile (hFile=0x150) returned 1 [0079.569] CloseHandle (hObject=0x150) returned 1 [0079.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0079.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.570] lstrlenW (lpString=".doc") returned 4 [0079.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString=".docx") returned 5 [0079.570] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.570] lstrlenW (lpString=".pdf") returned 4 [0079.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString=".xls") returned 4 [0079.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.570] lstrlenW (lpString=".xlsx") returned 5 [0079.570] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.570] lstrlenW (lpString=".ppt") returned 4 [0079.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.570] lstrlenW (lpString=".zip") returned 4 [0079.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.570] lstrlenW (lpString=".rar") returned 4 [0079.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString=".bz2") returned 4 [0079.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString=".7z") returned 3 [0079.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.570] lstrlenW (lpString=".dbf") returned 4 [0079.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.571] lstrlenW (lpString=".1cd") returned 4 [0079.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0079.571] lstrlenW (lpString=".jpg") returned 4 [0079.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.571] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") [0079.571] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=21548) returned 1 [0079.571] CloseHandle (hObject=0x150) returned 1 [0079.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0079.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.572] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.572] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.572] GetLastError () returned 0x0 [0079.572] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x542c, lpOverlapped=0x0) returned 1 [0079.582] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5430, lpOverlapped=0x0) returned 1 [0079.583] ReadFile (in: hFile=0x150, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.583] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.583] SetEndOfFile (hFile=0x1c0) returned 1 [0079.593] CloseHandle (hObject=0x1c0) returned 1 [0079.593] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.593] SetEndOfFile (hFile=0x150) returned 1 [0079.603] CloseHandle (hObject=0x150) returned 1 [0079.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0079.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.604] lstrlenW (lpString=".doc") returned 4 [0079.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.604] lstrlenW (lpString=".docx") returned 5 [0079.604] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.604] lstrlenW (lpString=".pdf") returned 4 [0079.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.604] lstrlenW (lpString=".xls") returned 4 [0079.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.604] lstrlenW (lpString=".xlsx") returned 5 [0079.604] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.604] lstrlenW (lpString=".ppt") returned 4 [0079.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.604] lstrlenW (lpString=".zip") returned 4 [0079.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.604] lstrlenW (lpString=".rar") returned 4 [0079.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.604] lstrlenW (lpString=".bz2") returned 4 [0079.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.604] lstrlenW (lpString=".7z") returned 3 [0079.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.604] lstrlenW (lpString=".dbf") returned 4 [0079.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.605] lstrlenW (lpString=".1cd") returned 4 [0079.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0079.605] lstrlenW (lpString=".jpg") returned 4 [0079.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.605] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") [0079.609] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8240) returned 1 [0079.609] CloseHandle (hObject=0x1f0) returned 1 [0079.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0079.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.610] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.623] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.630] GetLastError () returned 0x0 [0079.637] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2030, lpOverlapped=0x0) returned 1 [0079.639] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0079.640] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.640] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.640] SetEndOfFile (hFile=0x1fc) returned 1 [0079.640] CloseHandle (hObject=0x1fc) returned 1 [0079.640] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.640] SetEndOfFile (hFile=0x1f0) returned 1 [0079.641] CloseHandle (hObject=0x1f0) returned 1 [0079.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0079.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.641] lstrlenW (lpString=".doc") returned 4 [0079.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.641] lstrlenW (lpString=".docx") returned 5 [0079.641] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.641] lstrlenW (lpString=".pdf") returned 4 [0079.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.641] lstrlenW (lpString=".xls") returned 4 [0079.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.641] lstrlenW (lpString=".xlsx") returned 5 [0079.641] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.642] lstrlenW (lpString=".ppt") returned 4 [0079.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.642] lstrlenW (lpString=".zip") returned 4 [0079.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.642] lstrlenW (lpString=".rar") returned 4 [0079.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.642] lstrlenW (lpString=".bz2") returned 4 [0079.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.642] lstrlenW (lpString=".7z") returned 3 [0079.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.642] lstrlenW (lpString=".dbf") returned 4 [0079.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.642] lstrlenW (lpString=".1cd") returned 4 [0079.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0079.642] lstrlenW (lpString=".jpg") returned 4 [0079.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.642] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") [0079.643] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11900) returned 1 [0079.643] CloseHandle (hObject=0x1f0) returned 1 [0079.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0079.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.643] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.643] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.644] GetLastError () returned 0x0 [0079.644] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0079.646] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0079.647] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.647] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.647] SetEndOfFile (hFile=0x1fc) returned 1 [0079.647] CloseHandle (hObject=0x1fc) returned 1 [0079.647] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.647] SetEndOfFile (hFile=0x1f0) returned 1 [0079.648] CloseHandle (hObject=0x1f0) returned 1 [0079.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0079.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.648] lstrlenW (lpString=".doc") returned 4 [0079.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.648] lstrlenW (lpString=".docx") returned 5 [0079.649] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.649] lstrlenW (lpString=".pdf") returned 4 [0079.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.649] lstrlenW (lpString=".xls") returned 4 [0079.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.649] lstrlenW (lpString=".xlsx") returned 5 [0079.649] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.649] lstrlenW (lpString=".ppt") returned 4 [0079.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.649] lstrlenW (lpString=".zip") returned 4 [0079.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.649] lstrlenW (lpString=".rar") returned 4 [0079.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.649] lstrlenW (lpString=".bz2") returned 4 [0079.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.649] lstrlenW (lpString=".7z") returned 3 [0079.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.649] lstrlenW (lpString=".dbf") returned 4 [0079.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.649] lstrlenW (lpString=".1cd") returned 4 [0079.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0079.650] lstrlenW (lpString=".jpg") returned 4 [0079.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.650] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") [0079.650] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19600) returned 1 [0079.650] CloseHandle (hObject=0x1f0) returned 1 [0079.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0079.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.650] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.650] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.651] GetLastError () returned 0x0 [0079.651] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4c90, lpOverlapped=0x0) returned 1 [0079.653] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0079.654] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.654] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.654] SetEndOfFile (hFile=0x1fc) returned 1 [0079.654] CloseHandle (hObject=0x1fc) returned 1 [0079.657] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.657] SetEndOfFile (hFile=0x1f0) returned 1 [0079.658] CloseHandle (hObject=0x1f0) returned 1 [0079.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0079.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.658] lstrlenW (lpString=".doc") returned 4 [0079.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.658] lstrlenW (lpString=".docx") returned 5 [0079.658] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0079.658] lstrlenW (lpString=".pdf") returned 4 [0079.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.658] lstrlenW (lpString=".xls") returned 4 [0079.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.658] lstrlenW (lpString=".xlsx") returned 5 [0079.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0079.658] lstrlenW (lpString=".ppt") returned 4 [0079.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.658] lstrlenW (lpString=".zip") returned 4 [0079.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.659] lstrlenW (lpString=".rar") returned 4 [0079.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.659] lstrlenW (lpString=".bz2") returned 4 [0079.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.659] lstrlenW (lpString=".7z") returned 3 [0079.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.659] lstrlenW (lpString=".dbf") returned 4 [0079.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.659] lstrlenW (lpString=".1cd") returned 4 [0079.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0079.659] lstrlenW (lpString=".jpg") returned 4 [0079.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.659] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") [0080.343] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2148) returned 1 [0080.347] CloseHandle (hObject=0x1c0) returned 1 [0080.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0080.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.408] GetLastError () returned 0x0 [0080.408] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x864, lpOverlapped=0x0) returned 1 [0080.423] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x870, lpOverlapped=0x0) returned 1 [0080.424] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.424] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.424] SetEndOfFile (hFile=0x180) returned 1 [0080.424] CloseHandle (hObject=0x180) returned 1 [0080.424] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.424] SetEndOfFile (hFile=0x1c0) returned 1 [0080.425] CloseHandle (hObject=0x1c0) returned 1 [0080.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0080.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.426] lstrlenW (lpString=".doc") returned 4 [0080.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString=".docx") returned 5 [0080.426] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0080.426] lstrlenW (lpString=".pdf") returned 4 [0080.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString=".xls") returned 4 [0080.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.426] lstrlenW (lpString=".xlsx") returned 5 [0080.426] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0080.426] lstrlenW (lpString=".ppt") returned 4 [0080.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.426] lstrlenW (lpString=".zip") returned 4 [0080.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.426] lstrlenW (lpString=".rar") returned 4 [0080.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString=".bz2") returned 4 [0080.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString=".7z") returned 3 [0080.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.426] lstrlenW (lpString=".dbf") returned 4 [0080.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.426] lstrlenW (lpString=".1cd") returned 4 [0080.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0080.426] lstrlenW (lpString=".jpg") returned 4 [0080.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.426] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") [0080.427] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7632) returned 1 [0080.427] CloseHandle (hObject=0x1c0) returned 1 [0080.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0080.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.428] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.428] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.428] GetLastError () returned 0x0 [0080.428] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0080.430] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0080.431] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.431] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.431] SetEndOfFile (hFile=0x180) returned 1 [0080.432] CloseHandle (hObject=0x180) returned 1 [0080.432] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.432] SetEndOfFile (hFile=0x1c0) returned 1 [0080.432] CloseHandle (hObject=0x1c0) returned 1 [0080.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0080.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.433] lstrlenW (lpString=".doc") returned 4 [0080.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.433] lstrlenW (lpString=".docx") returned 5 [0080.433] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0080.433] lstrlenW (lpString=".pdf") returned 4 [0080.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.433] lstrlenW (lpString=".xls") returned 4 [0080.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.433] lstrlenW (lpString=".xlsx") returned 5 [0080.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0080.433] lstrlenW (lpString=".ppt") returned 4 [0080.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.433] lstrlenW (lpString=".zip") returned 4 [0080.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.433] lstrlenW (lpString=".rar") returned 4 [0080.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.433] lstrlenW (lpString=".bz2") returned 4 [0080.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.434] lstrlenW (lpString=".7z") returned 3 [0080.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.434] lstrlenW (lpString=".dbf") returned 4 [0080.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.434] lstrlenW (lpString=".1cd") returned 4 [0080.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0080.434] lstrlenW (lpString=".jpg") returned 4 [0080.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.434] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") [0080.435] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9048) returned 1 [0080.435] CloseHandle (hObject=0x1c0) returned 1 [0080.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0080.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.435] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.435] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.436] GetLastError () returned 0x0 [0080.436] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2358, lpOverlapped=0x0) returned 1 [0080.445] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0080.799] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.801] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.807] SetEndOfFile (hFile=0x180) returned 1 [0080.810] CloseHandle (hObject=0x180) returned 1 [0080.810] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.810] SetEndOfFile (hFile=0x1c0) returned 1 [0080.811] CloseHandle (hObject=0x1c0) returned 1 [0080.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0080.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.812] lstrlenW (lpString=".doc") returned 4 [0080.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.812] lstrlenW (lpString=".docx") returned 5 [0080.812] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0080.812] lstrlenW (lpString=".pdf") returned 4 [0080.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.812] lstrlenW (lpString=".xls") returned 4 [0080.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.812] lstrlenW (lpString=".xlsx") returned 5 [0080.813] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0080.813] lstrlenW (lpString=".ppt") returned 4 [0080.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.813] lstrlenW (lpString=".zip") returned 4 [0080.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.813] lstrlenW (lpString=".rar") returned 4 [0080.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.813] lstrlenW (lpString=".bz2") returned 4 [0080.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.813] lstrlenW (lpString=".7z") returned 3 [0080.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.813] lstrlenW (lpString=".dbf") returned 4 [0080.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.813] lstrlenW (lpString=".1cd") returned 4 [0080.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0080.813] lstrlenW (lpString=".jpg") returned 4 [0080.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.813] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") [0080.814] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14132) returned 1 [0080.814] CloseHandle (hObject=0x1c0) returned 1 [0080.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0080.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.815] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.815] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0080.816] GetLastError () returned 0x0 [0080.816] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3734, lpOverlapped=0x0) returned 1 [0080.883] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0080.884] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.884] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.884] SetEndOfFile (hFile=0x180) returned 1 [0081.021] CloseHandle (hObject=0x180) returned 1 [0081.021] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.021] SetEndOfFile (hFile=0x1c0) returned 1 [0081.022] CloseHandle (hObject=0x1c0) returned 1 [0081.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.810] lstrlenW (lpString=".doc") returned 4 [0081.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.810] lstrlenW (lpString=".docx") returned 5 [0081.810] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0081.810] lstrlenW (lpString=".pdf") returned 4 [0081.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString=".xls") returned 4 [0081.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.811] lstrlenW (lpString=".xlsx") returned 5 [0081.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0081.811] lstrlenW (lpString=".ppt") returned 4 [0081.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.811] lstrlenW (lpString=".zip") returned 4 [0081.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.811] lstrlenW (lpString=".rar") returned 4 [0081.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString=".bz2") returned 4 [0081.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString=".7z") returned 3 [0081.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.811] lstrlenW (lpString=".dbf") returned 4 [0081.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.811] lstrlenW (lpString=".1cd") returned 4 [0081.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0081.811] lstrlenW (lpString=".jpg") returned 4 [0081.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.811] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") [0082.005] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13456) returned 1 [0082.006] CloseHandle (hObject=0x180) returned 1 [0082.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0082.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0082.006] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.006] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0082.006] GetLastError () returned 0x0 [0082.006] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3490, lpOverlapped=0x0) returned 1 [0082.151] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0082.152] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.152] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.152] SetEndOfFile (hFile=0x1c8) returned 1 [0082.152] CloseHandle (hObject=0x1c8) returned 1 [0082.152] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.152] SetEndOfFile (hFile=0x180) returned 1 [0082.153] CloseHandle (hObject=0x180) returned 1 [0082.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString=".doc") returned 4 [0082.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString=".docx") returned 5 [0082.154] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0082.154] lstrlenW (lpString=".pdf") returned 4 [0082.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString=".xls") returned 4 [0082.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.154] lstrlenW (lpString=".xlsx") returned 5 [0082.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0082.154] lstrlenW (lpString=".ppt") returned 4 [0082.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString=".zip") returned 4 [0082.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.154] lstrlenW (lpString=".rar") returned 4 [0082.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString=".bz2") returned 4 [0082.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString=".7z") returned 3 [0082.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString=".dbf") returned 4 [0082.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString=".1cd") returned 4 [0082.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0082.154] lstrlenW (lpString=".jpg") returned 4 [0082.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.155] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") [0082.155] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13436) returned 1 [0082.155] CloseHandle (hObject=0x180) returned 1 [0082.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0082.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0082.155] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.155] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0082.156] GetLastError () returned 0x0 [0082.156] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x347c, lpOverlapped=0x0) returned 1 [0082.158] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3480, lpOverlapped=0x0) returned 1 [0082.159] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.159] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.159] SetEndOfFile (hFile=0x1c8) returned 1 [0082.159] CloseHandle (hObject=0x1c8) returned 1 [0082.159] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.159] SetEndOfFile (hFile=0x180) returned 1 [0082.160] CloseHandle (hObject=0x180) returned 1 [0082.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0082.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.160] lstrlenW (lpString=".doc") returned 4 [0082.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.160] lstrlenW (lpString=".docx") returned 5 [0082.160] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0082.160] lstrlenW (lpString=".pdf") returned 4 [0082.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.160] lstrlenW (lpString=".xls") returned 4 [0082.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.161] lstrlenW (lpString=".xlsx") returned 5 [0082.161] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0082.161] lstrlenW (lpString=".ppt") returned 4 [0082.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.161] lstrlenW (lpString=".zip") returned 4 [0082.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.161] lstrlenW (lpString=".rar") returned 4 [0082.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.161] lstrlenW (lpString=".bz2") returned 4 [0082.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.161] lstrlenW (lpString=".7z") returned 3 [0082.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.161] lstrlenW (lpString=".dbf") returned 4 [0082.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.161] lstrlenW (lpString=".1cd") returned 4 [0082.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0082.161] lstrlenW (lpString=".jpg") returned 4 [0082.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.161] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") [0082.162] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12308) returned 1 [0082.162] CloseHandle (hObject=0x180) returned 1 [0082.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0082.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0082.162] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.162] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0082.162] GetLastError () returned 0x0 [0082.163] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3014, lpOverlapped=0x0) returned 1 [0082.164] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3020, lpOverlapped=0x0) returned 1 [0082.165] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.165] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.165] SetEndOfFile (hFile=0x1c8) returned 1 [0082.166] CloseHandle (hObject=0x1c8) returned 1 [0082.166] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.166] SetEndOfFile (hFile=0x180) returned 1 [0082.166] CloseHandle (hObject=0x180) returned 1 [0082.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0082.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.167] lstrlenW (lpString=".doc") returned 4 [0082.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.167] lstrlenW (lpString=".docx") returned 5 [0082.167] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0082.167] lstrlenW (lpString=".pdf") returned 4 [0082.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.167] lstrlenW (lpString=".xls") returned 4 [0082.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.167] lstrlenW (lpString=".xlsx") returned 5 [0082.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0082.167] lstrlenW (lpString=".ppt") returned 4 [0082.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.167] lstrlenW (lpString=".zip") returned 4 [0082.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.167] lstrlenW (lpString=".rar") returned 4 [0082.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.167] lstrlenW (lpString=".bz2") returned 4 [0082.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.167] lstrlenW (lpString=".7z") returned 3 [0082.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.168] lstrlenW (lpString=".dbf") returned 4 [0082.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.168] lstrlenW (lpString=".1cd") returned 4 [0082.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0082.168] lstrlenW (lpString=".jpg") returned 4 [0082.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.168] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") [0082.168] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2460) returned 1 [0082.168] CloseHandle (hObject=0x180) returned 1 [0082.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0082.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0082.169] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.169] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0082.169] GetLastError () returned 0x0 [0082.169] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x99c, lpOverlapped=0x0) returned 1 [0082.179] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0082.180] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.180] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.180] SetEndOfFile (hFile=0x1c8) returned 1 [0082.180] CloseHandle (hObject=0x1c8) returned 1 [0082.180] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.180] SetEndOfFile (hFile=0x180) returned 1 [0082.181] CloseHandle (hObject=0x180) returned 1 [0082.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString=".doc") returned 4 [0082.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString=".docx") returned 5 [0082.182] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0082.182] lstrlenW (lpString=".pdf") returned 4 [0082.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString=".xls") returned 4 [0082.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.182] lstrlenW (lpString=".xlsx") returned 5 [0082.182] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0082.182] lstrlenW (lpString=".ppt") returned 4 [0082.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString=".zip") returned 4 [0082.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.182] lstrlenW (lpString=".rar") returned 4 [0082.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString=".bz2") returned 4 [0082.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString=".7z") returned 3 [0082.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString=".dbf") returned 4 [0082.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString=".1cd") returned 4 [0082.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0082.182] lstrlenW (lpString=".jpg") returned 4 [0082.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.183] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") [0083.440] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4136) returned 1 [0083.440] CloseHandle (hObject=0x210) returned 1 [0083.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0083.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.440] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.440] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.441] GetLastError () returned 0x0 [0083.441] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1028, lpOverlapped=0x0) returned 1 [0083.445] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1030, lpOverlapped=0x0) returned 1 [0083.446] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.446] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.446] SetEndOfFile (hFile=0x150) returned 1 [0083.446] CloseHandle (hObject=0x150) returned 1 [0083.446] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.446] SetEndOfFile (hFile=0x210) returned 1 [0083.447] CloseHandle (hObject=0x210) returned 1 [0083.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0083.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.447] lstrlenW (lpString=".doc") returned 4 [0083.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString=".docx") returned 5 [0083.448] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0083.448] lstrlenW (lpString=".pdf") returned 4 [0083.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString=".xls") returned 4 [0083.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.448] lstrlenW (lpString=".xlsx") returned 5 [0083.448] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0083.448] lstrlenW (lpString=".ppt") returned 4 [0083.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.448] lstrlenW (lpString=".zip") returned 4 [0083.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.448] lstrlenW (lpString=".rar") returned 4 [0083.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString=".bz2") returned 4 [0083.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString=".7z") returned 3 [0083.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.448] lstrlenW (lpString=".dbf") returned 4 [0083.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.448] lstrlenW (lpString=".1cd") returned 4 [0083.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0083.448] lstrlenW (lpString=".jpg") returned 4 [0083.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.448] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") [0083.449] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6532) returned 1 [0083.449] CloseHandle (hObject=0x210) returned 1 [0083.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0083.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.450] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.450] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.450] GetLastError () returned 0x0 [0083.450] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1984, lpOverlapped=0x0) returned 1 [0083.452] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1990, lpOverlapped=0x0) returned 1 [0083.453] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.453] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.453] SetEndOfFile (hFile=0x150) returned 1 [0083.453] CloseHandle (hObject=0x150) returned 1 [0083.453] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.453] SetEndOfFile (hFile=0x210) returned 1 [0083.454] CloseHandle (hObject=0x210) returned 1 [0083.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0083.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.454] lstrlenW (lpString=".doc") returned 4 [0083.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.454] lstrlenW (lpString=".docx") returned 5 [0083.454] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.454] lstrlenW (lpString=".pdf") returned 4 [0083.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString=".xls") returned 4 [0083.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.455] lstrlenW (lpString=".xlsx") returned 5 [0083.455] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.455] lstrlenW (lpString=".ppt") returned 4 [0083.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.455] lstrlenW (lpString=".zip") returned 4 [0083.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.455] lstrlenW (lpString=".rar") returned 4 [0083.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString=".bz2") returned 4 [0083.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString=".7z") returned 3 [0083.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.455] lstrlenW (lpString=".dbf") returned 4 [0083.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.455] lstrlenW (lpString=".1cd") returned 4 [0083.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0083.455] lstrlenW (lpString=".jpg") returned 4 [0083.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.455] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") [0083.456] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4244) returned 1 [0083.456] CloseHandle (hObject=0x210) returned 1 [0083.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0083.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.457] GetLastError () returned 0x0 [0083.457] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1094, lpOverlapped=0x0) returned 1 [0083.458] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0083.459] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.459] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.459] SetEndOfFile (hFile=0x150) returned 1 [0083.459] CloseHandle (hObject=0x150) returned 1 [0083.459] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.460] SetEndOfFile (hFile=0x210) returned 1 [0083.460] CloseHandle (hObject=0x210) returned 1 [0083.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0083.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.461] lstrlenW (lpString=".doc") returned 4 [0083.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString=".docx") returned 5 [0083.461] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0083.461] lstrlenW (lpString=".pdf") returned 4 [0083.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString=".xls") returned 4 [0083.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.461] lstrlenW (lpString=".xlsx") returned 5 [0083.461] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0083.461] lstrlenW (lpString=".ppt") returned 4 [0083.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.461] lstrlenW (lpString=".zip") returned 4 [0083.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.461] lstrlenW (lpString=".rar") returned 4 [0083.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString=".bz2") returned 4 [0083.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString=".7z") returned 3 [0083.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.461] lstrlenW (lpString=".dbf") returned 4 [0083.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.461] lstrlenW (lpString=".1cd") returned 4 [0083.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0083.462] lstrlenW (lpString=".jpg") returned 4 [0083.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.462] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") [0083.462] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5076) returned 1 [0083.462] CloseHandle (hObject=0x210) returned 1 [0083.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0083.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.465] GetLastError () returned 0x0 [0083.465] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13d4, lpOverlapped=0x0) returned 1 [0083.467] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0083.468] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.468] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.468] SetEndOfFile (hFile=0x150) returned 1 [0083.468] CloseHandle (hObject=0x150) returned 1 [0083.468] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.468] SetEndOfFile (hFile=0x210) returned 1 [0083.469] CloseHandle (hObject=0x210) returned 1 [0083.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0083.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.469] lstrlenW (lpString=".doc") returned 4 [0083.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.469] lstrlenW (lpString=".docx") returned 5 [0083.469] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0083.469] lstrlenW (lpString=".pdf") returned 4 [0083.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.469] lstrlenW (lpString=".xls") returned 4 [0083.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.469] lstrlenW (lpString=".xlsx") returned 5 [0083.469] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0083.470] lstrlenW (lpString=".ppt") returned 4 [0083.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.470] lstrlenW (lpString=".zip") returned 4 [0083.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.470] lstrlenW (lpString=".rar") returned 4 [0083.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.470] lstrlenW (lpString=".bz2") returned 4 [0083.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.470] lstrlenW (lpString=".7z") returned 3 [0083.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.470] lstrlenW (lpString=".dbf") returned 4 [0083.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.470] lstrlenW (lpString=".1cd") returned 4 [0083.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0083.470] lstrlenW (lpString=".jpg") returned 4 [0083.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.470] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") [0083.471] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=23672) returned 1 [0083.471] CloseHandle (hObject=0x210) returned 1 [0083.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0083.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.471] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.471] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.472] GetLastError () returned 0x0 [0083.472] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5c78, lpOverlapped=0x0) returned 1 [0083.474] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0083.475] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.475] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.475] SetEndOfFile (hFile=0x150) returned 1 [0083.476] CloseHandle (hObject=0x150) returned 1 [0083.476] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.476] SetEndOfFile (hFile=0x210) returned 1 [0083.476] CloseHandle (hObject=0x210) returned 1 [0083.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0083.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.477] lstrlenW (lpString=".doc") returned 4 [0083.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.477] lstrlenW (lpString=".docx") returned 5 [0083.477] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0083.477] lstrlenW (lpString=".pdf") returned 4 [0083.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.477] lstrlenW (lpString=".xls") returned 4 [0083.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.477] lstrlenW (lpString=".xlsx") returned 5 [0083.477] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0083.477] lstrlenW (lpString=".ppt") returned 4 [0083.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.477] lstrlenW (lpString=".zip") returned 4 [0083.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.477] lstrlenW (lpString=".rar") returned 4 [0083.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.477] lstrlenW (lpString=".bz2") returned 4 [0083.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.477] lstrlenW (lpString=".7z") returned 3 [0083.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.478] lstrlenW (lpString=".dbf") returned 4 [0083.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.478] lstrlenW (lpString=".1cd") returned 4 [0083.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0083.478] lstrlenW (lpString=".jpg") returned 4 [0083.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.478] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") [0083.478] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7964) returned 1 [0083.478] CloseHandle (hObject=0x210) returned 1 [0083.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0083.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.479] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.479] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.479] GetLastError () returned 0x0 [0083.479] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0083.643] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0083.644] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.644] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.644] SetEndOfFile (hFile=0x150) returned 1 [0083.869] CloseHandle (hObject=0x150) returned 1 [0083.869] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.869] SetEndOfFile (hFile=0x210) returned 1 [0083.870] CloseHandle (hObject=0x210) returned 1 [0083.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0083.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.969] lstrlenW (lpString=".doc") returned 4 [0083.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.969] lstrlenW (lpString=".docx") returned 5 [0083.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.969] lstrlenW (lpString=".pdf") returned 4 [0083.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.975] lstrlenW (lpString=".xls") returned 4 [0083.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.975] lstrlenW (lpString=".xlsx") returned 5 [0083.975] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.975] lstrlenW (lpString=".ppt") returned 4 [0083.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.976] lstrlenW (lpString=".zip") returned 4 [0083.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.976] lstrlenW (lpString=".rar") returned 4 [0083.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.992] lstrlenW (lpString=".bz2") returned 4 [0083.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.992] lstrlenW (lpString=".7z") returned 3 [0083.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.992] lstrlenW (lpString=".dbf") returned 4 [0083.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.998] lstrlenW (lpString=".1cd") returned 4 [0083.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0083.998] lstrlenW (lpString=".jpg") returned 4 [0083.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.999] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") [0083.999] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4200) returned 1 [0083.999] CloseHandle (hObject=0x1c8) returned 1 [0083.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0083.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0083.999] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.999] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0084.000] GetLastError () returned 0x0 [0084.000] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1068, lpOverlapped=0x0) returned 1 [0084.002] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0084.003] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.003] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.003] SetEndOfFile (hFile=0x22c) returned 1 [0084.003] CloseHandle (hObject=0x22c) returned 1 [0084.003] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.004] SetEndOfFile (hFile=0x1c8) returned 1 [0084.004] CloseHandle (hObject=0x1c8) returned 1 [0084.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0084.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.005] lstrlenW (lpString=".doc") returned 4 [0084.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString=".docx") returned 5 [0084.005] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0084.005] lstrlenW (lpString=".pdf") returned 4 [0084.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString=".xls") returned 4 [0084.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.005] lstrlenW (lpString=".xlsx") returned 5 [0084.005] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0084.005] lstrlenW (lpString=".ppt") returned 4 [0084.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.005] lstrlenW (lpString=".zip") returned 4 [0084.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.005] lstrlenW (lpString=".rar") returned 4 [0084.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString=".bz2") returned 4 [0084.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString=".7z") returned 3 [0084.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.005] lstrlenW (lpString=".dbf") returned 4 [0084.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.005] lstrlenW (lpString=".1cd") returned 4 [0084.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0084.006] lstrlenW (lpString=".jpg") returned 4 [0084.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.006] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") [0084.006] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10836) returned 1 [0084.006] CloseHandle (hObject=0x1c8) returned 1 [0084.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0084.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0084.006] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.006] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0084.007] GetLastError () returned 0x0 [0084.007] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a54, lpOverlapped=0x0) returned 1 [0084.019] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0084.020] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.020] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.020] SetEndOfFile (hFile=0x22c) returned 1 [0084.020] CloseHandle (hObject=0x22c) returned 1 [0084.020] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.020] SetEndOfFile (hFile=0x1c8) returned 1 [0084.021] CloseHandle (hObject=0x1c8) returned 1 [0084.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0084.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.021] lstrlenW (lpString=".doc") returned 4 [0084.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString=".docx") returned 5 [0084.022] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0084.022] lstrlenW (lpString=".pdf") returned 4 [0084.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString=".xls") returned 4 [0084.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.022] lstrlenW (lpString=".xlsx") returned 5 [0084.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0084.022] lstrlenW (lpString=".ppt") returned 4 [0084.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.022] lstrlenW (lpString=".zip") returned 4 [0084.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.022] lstrlenW (lpString=".rar") returned 4 [0084.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString=".bz2") returned 4 [0084.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString=".7z") returned 3 [0084.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.022] lstrlenW (lpString=".dbf") returned 4 [0084.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.022] lstrlenW (lpString=".1cd") returned 4 [0084.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0084.022] lstrlenW (lpString=".jpg") returned 4 [0084.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.022] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") [0084.023] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11404) returned 1 [0084.023] CloseHandle (hObject=0x1c8) returned 1 [0084.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0084.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0084.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0084.024] GetLastError () returned 0x0 [0084.024] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0084.031] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0084.033] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.033] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.033] SetEndOfFile (hFile=0x22c) returned 1 [0084.033] CloseHandle (hObject=0x22c) returned 1 [0084.033] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.033] SetEndOfFile (hFile=0x1c8) returned 1 [0084.034] CloseHandle (hObject=0x1c8) returned 1 [0084.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0084.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.034] lstrlenW (lpString=".doc") returned 4 [0084.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString=".docx") returned 5 [0084.035] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0084.035] lstrlenW (lpString=".pdf") returned 4 [0084.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString=".xls") returned 4 [0084.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.035] lstrlenW (lpString=".xlsx") returned 5 [0084.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0084.035] lstrlenW (lpString=".ppt") returned 4 [0084.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.035] lstrlenW (lpString=".zip") returned 4 [0084.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.035] lstrlenW (lpString=".rar") returned 4 [0084.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString=".bz2") returned 4 [0084.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString=".7z") returned 3 [0084.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.035] lstrlenW (lpString=".dbf") returned 4 [0084.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.035] lstrlenW (lpString=".1cd") returned 4 [0084.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0084.035] lstrlenW (lpString=".jpg") returned 4 [0084.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.035] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") [0084.065] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12204) returned 1 [0084.065] CloseHandle (hObject=0x1f0) returned 1 [0084.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0084.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.065] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.065] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0084.066] GetLastError () returned 0x0 [0084.066] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2fac, lpOverlapped=0x0) returned 1 [0084.068] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0084.069] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.069] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.069] SetEndOfFile (hFile=0x180) returned 1 [0084.069] CloseHandle (hObject=0x180) returned 1 [0084.070] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.070] SetEndOfFile (hFile=0x1f0) returned 1 [0084.070] CloseHandle (hObject=0x1f0) returned 1 [0084.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0084.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.071] lstrlenW (lpString=".doc") returned 4 [0084.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.071] lstrlenW (lpString=".docx") returned 5 [0084.071] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0084.071] lstrlenW (lpString=".pdf") returned 4 [0084.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.071] lstrlenW (lpString=".xls") returned 4 [0084.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.071] lstrlenW (lpString=".xlsx") returned 5 [0084.071] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0084.071] lstrlenW (lpString=".ppt") returned 4 [0084.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.071] lstrlenW (lpString=".zip") returned 4 [0084.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.071] lstrlenW (lpString=".rar") returned 4 [0084.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.071] lstrlenW (lpString=".bz2") returned 4 [0084.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.072] lstrlenW (lpString=".7z") returned 3 [0084.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.072] lstrlenW (lpString=".dbf") returned 4 [0084.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.072] lstrlenW (lpString=".1cd") returned 4 [0084.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0084.072] lstrlenW (lpString=".jpg") returned 4 [0084.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.072] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") [0084.073] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14008) returned 1 [0084.073] CloseHandle (hObject=0x1f0) returned 1 [0084.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0084.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.073] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.073] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0084.074] GetLastError () returned 0x0 [0084.074] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x36b8, lpOverlapped=0x0) returned 1 [0084.076] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x36c0, lpOverlapped=0x0) returned 1 [0084.077] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.077] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.077] SetEndOfFile (hFile=0x180) returned 1 [0084.077] CloseHandle (hObject=0x180) returned 1 [0084.077] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.077] SetEndOfFile (hFile=0x1f0) returned 1 [0084.078] CloseHandle (hObject=0x1f0) returned 1 [0084.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0084.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.078] lstrlenW (lpString=".doc") returned 4 [0084.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.078] lstrlenW (lpString=".docx") returned 5 [0084.079] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0084.079] lstrlenW (lpString=".pdf") returned 4 [0084.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.079] lstrlenW (lpString=".xls") returned 4 [0084.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.079] lstrlenW (lpString=".xlsx") returned 5 [0084.079] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0084.079] lstrlenW (lpString=".ppt") returned 4 [0084.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.079] lstrlenW (lpString=".zip") returned 4 [0084.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.079] lstrlenW (lpString=".rar") returned 4 [0084.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.079] lstrlenW (lpString=".bz2") returned 4 [0084.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.079] lstrlenW (lpString=".7z") returned 3 [0084.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.251] lstrlenW (lpString=".dbf") returned 4 [0084.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.251] lstrlenW (lpString=".1cd") returned 4 [0084.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0084.252] lstrlenW (lpString=".jpg") returned 4 [0084.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.252] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") [0084.252] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4788) returned 1 [0084.252] CloseHandle (hObject=0x190) returned 1 [0084.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0084.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.252] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.252] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0085.127] GetLastError () returned 0x0 [0085.127] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x12b4, lpOverlapped=0x0) returned 1 [0085.150] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0085.151] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.151] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.152] SetEndOfFile (hFile=0x150) returned 1 [0085.152] CloseHandle (hObject=0x150) returned 1 [0085.152] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.152] SetEndOfFile (hFile=0x190) returned 1 [0085.153] CloseHandle (hObject=0x190) returned 1 [0085.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0085.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.153] lstrlenW (lpString=".doc") returned 4 [0085.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.153] lstrlenW (lpString=".docx") returned 5 [0085.153] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0085.153] lstrlenW (lpString=".pdf") returned 4 [0085.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.153] lstrlenW (lpString=".xls") returned 4 [0085.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.153] lstrlenW (lpString=".xlsx") returned 5 [0085.153] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0085.153] lstrlenW (lpString=".ppt") returned 4 [0085.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.153] lstrlenW (lpString=".zip") returned 4 [0085.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.154] lstrlenW (lpString=".rar") returned 4 [0085.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.154] lstrlenW (lpString=".bz2") returned 4 [0085.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.154] lstrlenW (lpString=".7z") returned 3 [0085.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.154] lstrlenW (lpString=".dbf") returned 4 [0085.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.154] lstrlenW (lpString=".1cd") returned 4 [0085.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0085.154] lstrlenW (lpString=".jpg") returned 4 [0085.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.154] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") [0085.555] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16710) returned 1 [0085.555] CloseHandle (hObject=0x1fc) returned 1 [0085.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0085.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.565] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.565] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.571] GetLastError () returned 0x0 [0085.573] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4146, lpOverlapped=0x0) returned 1 [0085.583] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4150, lpOverlapped=0x0) returned 1 [0085.585] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.585] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.585] SetEndOfFile (hFile=0x1f0) returned 1 [0085.585] CloseHandle (hObject=0x1f0) returned 1 [0085.585] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.585] SetEndOfFile (hFile=0x1fc) returned 1 [0085.586] CloseHandle (hObject=0x1fc) returned 1 [0085.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0085.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.586] lstrlenW (lpString=".doc") returned 4 [0085.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.586] lstrlenW (lpString=".docx") returned 5 [0085.586] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0085.586] lstrlenW (lpString=".pdf") returned 4 [0085.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.586] lstrlenW (lpString=".xls") returned 4 [0085.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.587] lstrlenW (lpString=".xlsx") returned 5 [0085.587] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0085.587] lstrlenW (lpString=".ppt") returned 4 [0085.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.587] lstrlenW (lpString=".zip") returned 4 [0085.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.587] lstrlenW (lpString=".rar") returned 4 [0085.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.587] lstrlenW (lpString=".bz2") returned 4 [0085.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.587] lstrlenW (lpString=".7z") returned 3 [0085.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.587] lstrlenW (lpString=".dbf") returned 4 [0085.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.587] lstrlenW (lpString=".1cd") returned 4 [0085.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0085.587] lstrlenW (lpString=".jpg") returned 4 [0085.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.587] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") [0085.588] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33958) returned 1 [0085.588] CloseHandle (hObject=0x1fc) returned 1 [0085.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0085.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.589] GetLastError () returned 0x0 [0085.589] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x84a6, lpOverlapped=0x0) returned 1 [0085.591] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x84b0, lpOverlapped=0x0) returned 1 [0085.592] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.592] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.592] SetEndOfFile (hFile=0x1f0) returned 1 [0085.593] CloseHandle (hObject=0x1f0) returned 1 [0085.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.593] SetEndOfFile (hFile=0x1fc) returned 1 [0085.594] CloseHandle (hObject=0x1fc) returned 1 [0085.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0085.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.594] lstrlenW (lpString=".doc") returned 4 [0085.594] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.594] lstrlenW (lpString=".docx") returned 5 [0085.594] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0085.594] lstrlenW (lpString=".pdf") returned 4 [0085.594] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.594] lstrlenW (lpString=".xls") returned 4 [0085.594] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.594] lstrlenW (lpString=".xlsx") returned 5 [0085.594] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0085.594] lstrlenW (lpString=".ppt") returned 4 [0085.594] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.594] lstrlenW (lpString=".zip") returned 4 [0085.594] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.595] lstrlenW (lpString=".rar") returned 4 [0085.595] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.595] lstrlenW (lpString=".bz2") returned 4 [0085.595] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.595] lstrlenW (lpString=".7z") returned 3 [0085.595] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.595] lstrlenW (lpString=".dbf") returned 4 [0085.595] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.595] lstrlenW (lpString=".1cd") returned 4 [0085.595] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0085.595] lstrlenW (lpString=".jpg") returned 4 [0085.595] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.595] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") [0085.595] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=39542) returned 1 [0085.595] CloseHandle (hObject=0x1fc) returned 1 [0085.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0085.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.596] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.596] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.596] GetLastError () returned 0x0 [0085.596] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9a76, lpOverlapped=0x0) returned 1 [0085.599] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0085.600] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.600] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.600] SetEndOfFile (hFile=0x1f0) returned 1 [0085.600] CloseHandle (hObject=0x1f0) returned 1 [0085.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.600] SetEndOfFile (hFile=0x1fc) returned 1 [0085.601] CloseHandle (hObject=0x1fc) returned 1 [0085.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0085.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.602] lstrlenW (lpString=".doc") returned 4 [0085.602] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.602] lstrlenW (lpString=".docx") returned 5 [0085.602] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0085.602] lstrlenW (lpString=".pdf") returned 4 [0085.602] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.602] lstrlenW (lpString=".xls") returned 4 [0085.602] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.602] lstrlenW (lpString=".xlsx") returned 5 [0085.602] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0085.602] lstrlenW (lpString=".ppt") returned 4 [0085.602] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.602] lstrlenW (lpString=".zip") returned 4 [0085.602] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.602] lstrlenW (lpString=".rar") returned 4 [0085.602] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.602] lstrlenW (lpString=".bz2") returned 4 [0085.602] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.602] lstrlenW (lpString=".7z") returned 3 [0085.602] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.602] lstrlenW (lpString=".dbf") returned 4 [0085.603] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.603] lstrlenW (lpString=".1cd") returned 4 [0085.603] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0085.603] lstrlenW (lpString=".jpg") returned 4 [0085.603] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.603] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") [0085.603] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=46508) returned 1 [0085.603] CloseHandle (hObject=0x1fc) returned 1 [0085.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0085.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.604] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.604] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.604] GetLastError () returned 0x0 [0085.604] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0085.607] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb5b0, lpOverlapped=0x0) returned 1 [0085.608] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.609] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.609] SetEndOfFile (hFile=0x1f0) returned 1 [0085.609] CloseHandle (hObject=0x1f0) returned 1 [0085.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.609] SetEndOfFile (hFile=0x1fc) returned 1 [0085.610] CloseHandle (hObject=0x1fc) returned 1 [0085.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.610] lstrlenW (lpString=".doc") returned 4 [0085.610] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.610] lstrlenW (lpString=".docx") returned 5 [0085.610] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0085.610] lstrlenW (lpString=".pdf") returned 4 [0085.610] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.610] lstrlenW (lpString=".xls") returned 4 [0085.611] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.611] lstrlenW (lpString=".xlsx") returned 5 [0085.611] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0085.611] lstrlenW (lpString=".ppt") returned 4 [0085.611] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.611] lstrlenW (lpString=".zip") returned 4 [0085.611] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.611] lstrlenW (lpString=".rar") returned 4 [0085.611] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.611] lstrlenW (lpString=".bz2") returned 4 [0085.611] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.611] lstrlenW (lpString=".7z") returned 3 [0085.611] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.611] lstrlenW (lpString=".dbf") returned 4 [0085.611] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.611] lstrlenW (lpString=".1cd") returned 4 [0085.611] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0085.611] lstrlenW (lpString=".jpg") returned 4 [0085.611] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.611] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") [0085.612] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=43674) returned 1 [0085.612] CloseHandle (hObject=0x1fc) returned 1 [0085.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0085.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.612] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.612] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.613] GetLastError () returned 0x0 [0085.613] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0085.616] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xaaa0, lpOverlapped=0x0) returned 1 [0085.617] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.617] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.617] SetEndOfFile (hFile=0x1f0) returned 1 [0085.617] CloseHandle (hObject=0x1f0) returned 1 [0085.617] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.617] SetEndOfFile (hFile=0x1fc) returned 1 [0085.618] CloseHandle (hObject=0x1fc) returned 1 [0085.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.619] lstrlenW (lpString=".doc") returned 4 [0085.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.619] lstrlenW (lpString=".docx") returned 5 [0085.619] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0085.619] lstrlenW (lpString=".pdf") returned 4 [0085.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.619] lstrlenW (lpString=".xls") returned 4 [0085.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.619] lstrlenW (lpString=".xlsx") returned 5 [0085.619] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0085.619] lstrlenW (lpString=".ppt") returned 4 [0085.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.619] lstrlenW (lpString=".zip") returned 4 [0085.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.619] lstrlenW (lpString=".rar") returned 4 [0085.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.619] lstrlenW (lpString=".bz2") returned 4 [0085.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.619] lstrlenW (lpString=".7z") returned 3 [0085.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.619] lstrlenW (lpString=".dbf") returned 4 [0085.620] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.620] lstrlenW (lpString=".1cd") returned 4 [0085.620] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0085.620] lstrlenW (lpString=".jpg") returned 4 [0085.620] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.620] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") [0085.620] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=67540) returned 1 [0085.620] CloseHandle (hObject=0x1fc) returned 1 [0085.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0085.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.621] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.621] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.621] GetLastError () returned 0x0 [0085.621] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x107d4, lpOverlapped=0x0) returned 1 [0085.759] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x107e0, lpOverlapped=0x0) returned 1 [0085.760] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.761] WriteFile (in: hFile=0x1f0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.761] SetEndOfFile (hFile=0x1f0) returned 1 [0085.786] CloseHandle (hObject=0x1f0) returned 1 [0086.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.007] SetEndOfFile (hFile=0x1fc) returned 1 [0086.008] CloseHandle (hObject=0x1fc) returned 1 [0086.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0086.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.398] lstrlenW (lpString=".doc") returned 4 [0086.398] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0086.398] lstrlenW (lpString=".docx") returned 5 [0086.398] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0086.398] lstrlenW (lpString=".pdf") returned 4 [0086.398] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0086.398] lstrlenW (lpString=".xls") returned 4 [0086.398] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0086.398] lstrlenW (lpString=".xlsx") returned 5 [0086.399] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0086.399] lstrlenW (lpString=".ppt") returned 4 [0086.399] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0086.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.399] lstrlenW (lpString=".zip") returned 4 [0086.399] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0086.399] lstrlenW (lpString=".rar") returned 4 [0086.399] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0086.399] lstrlenW (lpString=".bz2") returned 4 [0086.399] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0086.399] lstrlenW (lpString=".7z") returned 3 [0086.399] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0086.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.399] lstrlenW (lpString=".dbf") returned 4 [0086.399] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0086.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.399] lstrlenW (lpString=".1cd") returned 4 [0086.399] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0086.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0086.399] lstrlenW (lpString=".jpg") returned 4 [0086.399] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0086.399] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") [0086.474] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6752) returned 1 [0086.475] CloseHandle (hObject=0x1f0) returned 1 [0086.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0086.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.475] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.475] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.475] GetLastError () returned 0x0 [0086.475] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1a60, lpOverlapped=0x0) returned 1 [0086.862] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.864] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.864] SetEndOfFile (hFile=0x210) returned 1 [0086.864] CloseHandle (hObject=0x210) returned 1 [0086.864] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.864] SetEndOfFile (hFile=0x1f0) returned 1 [0086.865] CloseHandle (hObject=0x1f0) returned 1 [0086.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0086.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.865] lstrlenW (lpString=".doc") returned 4 [0086.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString=".docx") returned 5 [0086.866] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.866] lstrlenW (lpString=".pdf") returned 4 [0086.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString=".xls") returned 4 [0086.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.866] lstrlenW (lpString=".xlsx") returned 5 [0086.866] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.866] lstrlenW (lpString=".ppt") returned 4 [0086.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.866] lstrlenW (lpString=".zip") returned 4 [0086.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.866] lstrlenW (lpString=".rar") returned 4 [0086.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString=".bz2") returned 4 [0086.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString=".7z") returned 3 [0086.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.866] lstrlenW (lpString=".dbf") returned 4 [0086.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.866] lstrlenW (lpString=".1cd") returned 4 [0086.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.866] lstrlenW (lpString=".jpg") returned 4 [0086.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.866] @NlsCompareInvariantNoCase@16 () [0086.866] lstrlenW (lpString=".docx") returned 5 [0086.866] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.867] lstrlenW (lpString=".pdf") returned 4 [0086.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString=".xls") returned 4 [0086.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.867] lstrlenW (lpString=".xlsx") returned 5 [0086.867] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.867] lstrlenW (lpString=".ppt") returned 4 [0086.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.867] lstrlenW (lpString=".zip") returned 4 [0086.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.867] lstrlenW (lpString=".rar") returned 4 [0086.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString=".bz2") returned 4 [0086.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString=".7z") returned 3 [0086.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.867] lstrlenW (lpString=".dbf") returned 4 [0086.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.867] lstrlenW (lpString=".1cd") returned 4 [0086.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0086.867] lstrlenW (lpString=".jpg") returned 4 [0086.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.867] @NlsCompareInvariantNoCase@16 () [0086.867] lstrlenW (lpString="J0151581.WMF") returned 12 [0086.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.876] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10752) returned 1 [0086.876] CloseHandle (hObject=0x22c) returned 1 [0086.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0086.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.876] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.876] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0086.877] GetLastError () returned 0x0 [0086.877] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a00, lpOverlapped=0x0) returned 1 [0086.880] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0086.881] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.881] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.881] SetEndOfFile (hFile=0x15c) returned 1 [0086.881] CloseHandle (hObject=0x15c) returned 1 [0086.881] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.881] SetEndOfFile (hFile=0x22c) returned 1 [0086.882] CloseHandle (hObject=0x22c) returned 1 [0086.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.882] lstrlenW (lpString=".doc") returned 4 [0086.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString=".docx") returned 5 [0086.883] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.883] lstrlenW (lpString=".pdf") returned 4 [0086.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString=".xls") returned 4 [0086.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.883] lstrlenW (lpString=".xlsx") returned 5 [0086.883] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.883] lstrlenW (lpString=".ppt") returned 4 [0086.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.883] lstrlenW (lpString=".zip") returned 4 [0086.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.883] lstrlenW (lpString=".rar") returned 4 [0086.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString=".bz2") returned 4 [0086.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString=".7z") returned 3 [0086.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.883] lstrlenW (lpString=".dbf") returned 4 [0086.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.883] lstrlenW (lpString=".1cd") returned 4 [0086.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.883] lstrlenW (lpString=".jpg") returned 4 [0086.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.883] @NlsCompareInvariantNoCase@16 () [0086.883] lstrlenW (lpString=".docx") returned 5 [0086.883] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.883] lstrlenW (lpString=".pdf") returned 4 [0086.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString=".xls") returned 4 [0086.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.884] lstrlenW (lpString=".xlsx") returned 5 [0086.884] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.884] lstrlenW (lpString=".ppt") returned 4 [0086.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.884] lstrlenW (lpString=".zip") returned 4 [0086.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.884] lstrlenW (lpString=".rar") returned 4 [0086.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString=".bz2") returned 4 [0086.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString=".7z") returned 3 [0086.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.884] lstrlenW (lpString=".dbf") returned 4 [0086.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.884] lstrlenW (lpString=".1cd") returned 4 [0086.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0086.884] lstrlenW (lpString=".jpg") returned 4 [0086.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.884] @NlsCompareInvariantNoCase@16 () [0086.884] lstrlenW (lpString="J0152430.WMF") returned 12 [0086.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.885] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14132) returned 1 [0086.885] CloseHandle (hObject=0x22c) returned 1 [0086.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0086.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.886] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.886] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0086.886] GetLastError () returned 0x0 [0086.886] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3734, lpOverlapped=0x0) returned 1 [0086.888] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0086.889] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.889] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.889] SetEndOfFile (hFile=0x15c) returned 1 [0086.889] CloseHandle (hObject=0x15c) returned 1 [0086.889] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.889] SetEndOfFile (hFile=0x22c) returned 1 [0086.890] CloseHandle (hObject=0x22c) returned 1 [0086.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0086.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.891] lstrlenW (lpString=".doc") returned 4 [0086.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString=".docx") returned 5 [0086.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.891] lstrlenW (lpString=".pdf") returned 4 [0086.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString=".xls") returned 4 [0086.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.891] lstrlenW (lpString=".xlsx") returned 5 [0086.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.891] lstrlenW (lpString=".ppt") returned 4 [0086.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.891] lstrlenW (lpString=".zip") returned 4 [0086.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.891] lstrlenW (lpString=".rar") returned 4 [0086.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString=".bz2") returned 4 [0086.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString=".7z") returned 3 [0086.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.891] lstrlenW (lpString=".dbf") returned 4 [0086.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.891] lstrlenW (lpString=".1cd") returned 4 [0086.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.892] lstrlenW (lpString=".jpg") returned 4 [0086.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.892] @NlsCompareInvariantNoCase@16 () [0086.892] lstrlenW (lpString=".docx") returned 5 [0086.892] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.892] lstrlenW (lpString=".pdf") returned 4 [0086.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString=".xls") returned 4 [0086.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.892] lstrlenW (lpString=".xlsx") returned 5 [0086.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.892] lstrlenW (lpString=".ppt") returned 4 [0086.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.892] lstrlenW (lpString=".zip") returned 4 [0086.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.892] lstrlenW (lpString=".rar") returned 4 [0086.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString=".bz2") returned 4 [0086.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString=".7z") returned 3 [0086.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.892] lstrlenW (lpString=".dbf") returned 4 [0086.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.892] lstrlenW (lpString=".1cd") returned 4 [0086.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0086.892] lstrlenW (lpString=".jpg") returned 4 [0086.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.892] @NlsCompareInvariantNoCase@16 () [0086.893] lstrlenW (lpString="J0152432.WMF") returned 12 [0086.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.893] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16492) returned 1 [0086.893] CloseHandle (hObject=0x22c) returned 1 [0086.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0086.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0086.894] GetLastError () returned 0x0 [0086.894] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x406c, lpOverlapped=0x0) returned 1 [0086.896] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4070, lpOverlapped=0x0) returned 1 [0086.897] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.897] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.897] SetEndOfFile (hFile=0x15c) returned 1 [0086.897] CloseHandle (hObject=0x15c) returned 1 [0086.897] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.897] SetEndOfFile (hFile=0x22c) returned 1 [0086.898] CloseHandle (hObject=0x22c) returned 1 [0086.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0086.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString=".doc") returned 4 [0086.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString=".docx") returned 5 [0086.899] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0086.899] lstrlenW (lpString=".pdf") returned 4 [0086.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString=".xls") returned 4 [0086.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.899] lstrlenW (lpString=".xlsx") returned 5 [0086.899] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0086.899] lstrlenW (lpString=".ppt") returned 4 [0086.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString=".zip") returned 4 [0086.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.899] lstrlenW (lpString=".rar") returned 4 [0086.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString=".bz2") returned 4 [0086.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString=".7z") returned 3 [0086.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString=".dbf") returned 4 [0086.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString=".1cd") returned 4 [0086.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.899] lstrlenW (lpString=".jpg") returned 4 [0086.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.900] @NlsCompareInvariantNoCase@16 () [0086.900] lstrlenW (lpString=".docx") returned 5 [0086.900] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0086.900] lstrlenW (lpString=".pdf") returned 4 [0086.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString=".xls") returned 4 [0086.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.900] lstrlenW (lpString=".xlsx") returned 5 [0086.900] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0086.900] lstrlenW (lpString=".ppt") returned 4 [0086.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.900] lstrlenW (lpString=".zip") returned 4 [0086.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.900] lstrlenW (lpString=".rar") returned 4 [0086.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString=".bz2") returned 4 [0086.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString=".7z") returned 3 [0086.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.900] lstrlenW (lpString=".dbf") returned 4 [0086.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.900] lstrlenW (lpString=".1cd") returned 4 [0086.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0086.900] lstrlenW (lpString=".jpg") returned 4 [0086.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.900] @NlsCompareInvariantNoCase@16 () [0086.900] lstrlenW (lpString="J0152436.WMF") returned 12 [0086.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.901] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11340) returned 1 [0086.901] CloseHandle (hObject=0x22c) returned 1 [0086.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0086.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.901] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.901] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0086.902] GetLastError () returned 0x0 [0086.902] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0087.010] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2c50, lpOverlapped=0x0) returned 1 [0087.111] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.111] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.111] SetEndOfFile (hFile=0x15c) returned 1 [0087.111] CloseHandle (hObject=0x15c) returned 1 [0087.111] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.111] SetEndOfFile (hFile=0x22c) returned 1 [0087.112] CloseHandle (hObject=0x22c) returned 1 [0087.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0087.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.112] lstrlenW (lpString=".doc") returned 4 [0087.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.112] lstrlenW (lpString=".docx") returned 5 [0087.112] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.112] lstrlenW (lpString=".pdf") returned 4 [0087.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.112] lstrlenW (lpString=".xls") returned 4 [0087.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.113] lstrlenW (lpString=".xlsx") returned 5 [0087.113] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.113] lstrlenW (lpString=".ppt") returned 4 [0087.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.113] lstrlenW (lpString=".zip") returned 4 [0087.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.113] lstrlenW (lpString=".rar") returned 4 [0087.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.113] lstrlenW (lpString=".bz2") returned 4 [0087.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.113] lstrlenW (lpString=".7z") returned 3 [0087.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.113] lstrlenW (lpString=".dbf") returned 4 [0087.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.113] lstrlenW (lpString=".1cd") returned 4 [0087.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0087.113] lstrlenW (lpString=".jpg") returned 4 [0087.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.113] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") [0087.114] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=30812) returned 1 [0087.114] CloseHandle (hObject=0x22c) returned 1 [0087.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0087.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0087.114] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.114] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0087.115] GetLastError () returned 0x0 [0087.115] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x785c, lpOverlapped=0x0) returned 1 [0087.117] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0087.118] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.118] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.118] SetEndOfFile (hFile=0x15c) returned 1 [0087.119] CloseHandle (hObject=0x15c) returned 1 [0087.119] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.119] SetEndOfFile (hFile=0x22c) returned 1 [0087.120] CloseHandle (hObject=0x22c) returned 1 [0087.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0087.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.120] lstrlenW (lpString=".doc") returned 4 [0087.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.120] lstrlenW (lpString=".docx") returned 5 [0087.120] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.120] lstrlenW (lpString=".pdf") returned 4 [0087.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.120] lstrlenW (lpString=".xls") returned 4 [0087.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.120] lstrlenW (lpString=".xlsx") returned 5 [0087.120] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.120] lstrlenW (lpString=".ppt") returned 4 [0087.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.120] lstrlenW (lpString=".zip") returned 4 [0087.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.120] lstrlenW (lpString=".rar") returned 4 [0087.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.121] lstrlenW (lpString=".bz2") returned 4 [0087.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.121] lstrlenW (lpString=".7z") returned 3 [0087.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.121] lstrlenW (lpString=".dbf") returned 4 [0087.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.121] lstrlenW (lpString=".1cd") returned 4 [0087.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0087.121] lstrlenW (lpString=".jpg") returned 4 [0087.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.121] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") [0087.121] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=34676) returned 1 [0087.121] CloseHandle (hObject=0x22c) returned 1 [0087.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0087.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0087.122] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.122] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0087.122] GetLastError () returned 0x0 [0087.122] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8774, lpOverlapped=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8780, lpOverlapped=0x0) returned 1 [0087.126] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.126] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.126] SetEndOfFile (hFile=0x15c) returned 1 [0087.126] CloseHandle (hObject=0x15c) returned 1 [0087.127] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.127] SetEndOfFile (hFile=0x22c) returned 1 [0087.127] CloseHandle (hObject=0x22c) returned 1 [0087.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0087.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.128] lstrlenW (lpString=".doc") returned 4 [0087.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.128] lstrlenW (lpString=".docx") returned 5 [0087.128] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.128] lstrlenW (lpString=".pdf") returned 4 [0087.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.128] lstrlenW (lpString=".xls") returned 4 [0087.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.128] lstrlenW (lpString=".xlsx") returned 5 [0087.128] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.128] lstrlenW (lpString=".ppt") returned 4 [0087.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.128] lstrlenW (lpString=".zip") returned 4 [0087.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.128] lstrlenW (lpString=".rar") returned 4 [0087.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.128] lstrlenW (lpString=".bz2") returned 4 [0087.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.128] lstrlenW (lpString=".7z") returned 3 [0087.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.129] lstrlenW (lpString=".dbf") returned 4 [0087.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.129] lstrlenW (lpString=".1cd") returned 4 [0087.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0087.129] lstrlenW (lpString=".jpg") returned 4 [0087.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.129] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") [0087.129] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1268) returned 1 [0087.129] CloseHandle (hObject=0x22c) returned 1 [0087.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0087.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0087.130] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.130] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0087.130] GetLastError () returned 0x0 [0087.130] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0087.132] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x500, lpOverlapped=0x0) returned 1 [0087.133] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.133] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.133] SetEndOfFile (hFile=0x15c) returned 1 [0087.133] CloseHandle (hObject=0x15c) returned 1 [0087.133] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.133] SetEndOfFile (hFile=0x22c) returned 1 [0087.134] CloseHandle (hObject=0x22c) returned 1 [0087.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.135] lstrlenW (lpString=".doc") returned 4 [0087.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.135] lstrlenW (lpString=".docx") returned 5 [0087.135] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0087.135] lstrlenW (lpString=".pdf") returned 4 [0087.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.135] lstrlenW (lpString=".xls") returned 4 [0087.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.135] lstrlenW (lpString=".xlsx") returned 5 [0087.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0087.135] lstrlenW (lpString=".ppt") returned 4 [0087.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.135] lstrlenW (lpString=".zip") returned 4 [0087.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.135] lstrlenW (lpString=".rar") returned 4 [0087.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.135] lstrlenW (lpString=".bz2") returned 4 [0087.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.135] lstrlenW (lpString=".7z") returned 3 [0087.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.135] lstrlenW (lpString=".dbf") returned 4 [0087.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.136] lstrlenW (lpString=".1cd") returned 4 [0087.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0087.136] lstrlenW (lpString=".jpg") returned 4 [0087.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.136] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") [0087.136] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1348) returned 1 [0087.136] CloseHandle (hObject=0x22c) returned 1 [0087.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0087.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0087.137] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.149] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0087.150] GetLastError () returned 0x0 [0087.150] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x544, lpOverlapped=0x0) returned 1 [0087.156] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0087.156] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.157] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.157] SetEndOfFile (hFile=0x15c) returned 1 [0087.157] CloseHandle (hObject=0x15c) returned 1 [0087.157] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.157] SetEndOfFile (hFile=0x22c) returned 1 [0087.158] CloseHandle (hObject=0x22c) returned 1 [0087.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0087.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.158] lstrlenW (lpString=".doc") returned 4 [0087.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.158] lstrlenW (lpString=".docx") returned 5 [0087.158] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0087.158] lstrlenW (lpString=".pdf") returned 4 [0087.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.158] lstrlenW (lpString=".xls") returned 4 [0087.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.158] lstrlenW (lpString=".xlsx") returned 5 [0087.158] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0087.158] lstrlenW (lpString=".ppt") returned 4 [0087.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.158] lstrlenW (lpString=".zip") returned 4 [0087.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.159] lstrlenW (lpString=".rar") returned 4 [0087.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.159] lstrlenW (lpString=".bz2") returned 4 [0087.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.159] lstrlenW (lpString=".7z") returned 3 [0087.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.159] lstrlenW (lpString=".dbf") returned 4 [0087.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.159] lstrlenW (lpString=".1cd") returned 4 [0087.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0087.159] lstrlenW (lpString=".jpg") returned 4 [0087.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.159] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") [0087.160] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7320) returned 1 [0087.160] CloseHandle (hObject=0x22c) returned 1 [0087.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0087.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0087.160] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0087.161] GetLastError () returned 0x0 [0087.161] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1c98, lpOverlapped=0x0) returned 1 [0087.306] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0087.336] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.336] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.336] SetEndOfFile (hFile=0x15c) returned 1 [0087.336] CloseHandle (hObject=0x15c) returned 1 [0087.336] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.336] SetEndOfFile (hFile=0x22c) returned 1 [0087.337] CloseHandle (hObject=0x22c) returned 1 [0087.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.337] lstrlenW (lpString=".doc") returned 4 [0087.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString=".docx") returned 5 [0087.337] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.337] lstrlenW (lpString=".pdf") returned 4 [0087.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString=".xls") returned 4 [0087.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.337] lstrlenW (lpString=".xlsx") returned 5 [0087.337] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.338] lstrlenW (lpString=".ppt") returned 4 [0087.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.338] lstrlenW (lpString=".zip") returned 4 [0087.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.338] lstrlenW (lpString=".rar") returned 4 [0087.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.338] lstrlenW (lpString=".bz2") returned 4 [0087.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.338] lstrlenW (lpString=".7z") returned 3 [0087.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.338] lstrlenW (lpString=".dbf") returned 4 [0087.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.338] lstrlenW (lpString=".1cd") returned 4 [0087.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0087.338] lstrlenW (lpString=".jpg") returned 4 [0087.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.338] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") [0088.576] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33068) returned 1 [0088.576] CloseHandle (hObject=0x158) returned 1 [0088.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0088.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.093] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.093] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.353] GetLastError () returned 0x0 [0089.353] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x812c, lpOverlapped=0x0) returned 1 [0089.355] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8130, lpOverlapped=0x0) returned 1 [0089.357] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.357] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.357] SetEndOfFile (hFile=0x1c8) returned 1 [0089.357] CloseHandle (hObject=0x1c8) returned 1 [0089.357] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.357] SetEndOfFile (hFile=0x1c0) returned 1 [0089.358] CloseHandle (hObject=0x1c0) returned 1 [0089.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0089.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.359] lstrlenW (lpString=".doc") returned 4 [0089.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString=".docx") returned 5 [0089.359] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.359] lstrlenW (lpString=".pdf") returned 4 [0089.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString=".xls") returned 4 [0089.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.359] lstrlenW (lpString=".xlsx") returned 5 [0089.359] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.359] lstrlenW (lpString=".ppt") returned 4 [0089.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.359] lstrlenW (lpString=".zip") returned 4 [0089.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.359] lstrlenW (lpString=".rar") returned 4 [0089.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString=".bz2") returned 4 [0089.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString=".7z") returned 3 [0089.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.359] lstrlenW (lpString=".dbf") returned 4 [0089.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.359] lstrlenW (lpString=".1cd") returned 4 [0089.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0089.360] lstrlenW (lpString=".jpg") returned 4 [0089.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.360] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") [0089.360] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12528) returned 1 [0089.360] CloseHandle (hObject=0x1c0) returned 1 [0089.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0089.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.360] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.361] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.361] GetLastError () returned 0x0 [0089.361] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x30f0, lpOverlapped=0x0) returned 1 [0089.365] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0089.366] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.366] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.367] SetEndOfFile (hFile=0x1c8) returned 1 [0089.367] CloseHandle (hObject=0x1c8) returned 1 [0089.367] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.367] SetEndOfFile (hFile=0x1c0) returned 1 [0089.368] CloseHandle (hObject=0x1c0) returned 1 [0089.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0089.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.368] lstrlenW (lpString=".doc") returned 4 [0089.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.368] lstrlenW (lpString=".docx") returned 5 [0089.369] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0089.369] lstrlenW (lpString=".pdf") returned 4 [0089.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString=".xls") returned 4 [0089.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.369] lstrlenW (lpString=".xlsx") returned 5 [0089.369] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0089.369] lstrlenW (lpString=".ppt") returned 4 [0089.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.369] lstrlenW (lpString=".zip") returned 4 [0089.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.369] lstrlenW (lpString=".rar") returned 4 [0089.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString=".bz2") returned 4 [0089.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString=".7z") returned 3 [0089.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.369] lstrlenW (lpString=".dbf") returned 4 [0089.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.369] lstrlenW (lpString=".1cd") returned 4 [0089.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0089.369] lstrlenW (lpString=".jpg") returned 4 [0089.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.369] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") [0089.370] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1376) returned 1 [0089.371] CloseHandle (hObject=0x1c0) returned 1 [0089.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0089.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.371] GetLastError () returned 0x0 [0089.372] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x560, lpOverlapped=0x0) returned 1 [0089.373] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x570, lpOverlapped=0x0) returned 1 [0089.374] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.374] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.374] SetEndOfFile (hFile=0x1c8) returned 1 [0089.374] CloseHandle (hObject=0x1c8) returned 1 [0089.374] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.374] SetEndOfFile (hFile=0x1c0) returned 1 [0089.375] CloseHandle (hObject=0x1c0) returned 1 [0089.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0089.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.376] lstrlenW (lpString=".doc") returned 4 [0089.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString=".docx") returned 5 [0089.376] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.376] lstrlenW (lpString=".pdf") returned 4 [0089.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString=".xls") returned 4 [0089.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.376] lstrlenW (lpString=".xlsx") returned 5 [0089.376] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.376] lstrlenW (lpString=".ppt") returned 4 [0089.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.376] lstrlenW (lpString=".zip") returned 4 [0089.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.376] lstrlenW (lpString=".rar") returned 4 [0089.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString=".bz2") returned 4 [0089.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString=".7z") returned 3 [0089.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.376] lstrlenW (lpString=".dbf") returned 4 [0089.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.376] lstrlenW (lpString=".1cd") returned 4 [0089.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0089.377] lstrlenW (lpString=".jpg") returned 4 [0089.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.377] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") [0089.378] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=46702) returned 1 [0089.378] CloseHandle (hObject=0x1c0) returned 1 [0089.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0089.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.378] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.378] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.379] GetLastError () returned 0x0 [0089.379] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb66e, lpOverlapped=0x0) returned 1 [0089.381] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb670, lpOverlapped=0x0) returned 1 [0089.383] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.383] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.383] SetEndOfFile (hFile=0x1c8) returned 1 [0089.383] CloseHandle (hObject=0x1c8) returned 1 [0089.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.383] SetEndOfFile (hFile=0x1c0) returned 1 [0089.393] CloseHandle (hObject=0x1c0) returned 1 [0089.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0089.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.393] lstrlenW (lpString=".doc") returned 4 [0089.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.393] lstrlenW (lpString=".docx") returned 5 [0089.393] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.393] lstrlenW (lpString=".pdf") returned 4 [0089.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString=".xls") returned 4 [0089.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.394] lstrlenW (lpString=".xlsx") returned 5 [0089.394] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.394] lstrlenW (lpString=".ppt") returned 4 [0089.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.394] lstrlenW (lpString=".zip") returned 4 [0089.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.394] lstrlenW (lpString=".rar") returned 4 [0089.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString=".bz2") returned 4 [0089.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString=".7z") returned 3 [0089.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.394] lstrlenW (lpString=".dbf") returned 4 [0089.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.394] lstrlenW (lpString=".1cd") returned 4 [0089.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0089.394] lstrlenW (lpString=".jpg") returned 4 [0089.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.394] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") [0089.395] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=21716) returned 1 [0089.395] CloseHandle (hObject=0x1c0) returned 1 [0089.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0089.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.396] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.396] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.396] GetLastError () returned 0x0 [0089.396] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x54d4, lpOverlapped=0x0) returned 1 [0089.568] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x54e0, lpOverlapped=0x0) returned 1 [0089.569] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.569] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.570] SetEndOfFile (hFile=0x1c8) returned 1 [0089.784] CloseHandle (hObject=0x1c8) returned 1 [0089.784] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.784] SetEndOfFile (hFile=0x1c0) returned 1 [0089.785] CloseHandle (hObject=0x1c0) returned 1 [0089.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0089.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.937] lstrlenW (lpString=".doc") returned 4 [0089.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.937] lstrlenW (lpString=".docx") returned 5 [0089.937] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.937] lstrlenW (lpString=".pdf") returned 4 [0089.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.937] lstrlenW (lpString=".xls") returned 4 [0089.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.937] lstrlenW (lpString=".xlsx") returned 5 [0089.941] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.941] lstrlenW (lpString=".ppt") returned 4 [0089.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.941] lstrlenW (lpString=".zip") returned 4 [0089.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.941] lstrlenW (lpString=".rar") returned 4 [0089.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.941] lstrlenW (lpString=".bz2") returned 4 [0089.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.941] lstrlenW (lpString=".7z") returned 3 [0089.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.941] lstrlenW (lpString=".dbf") returned 4 [0089.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.941] lstrlenW (lpString=".1cd") returned 4 [0089.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0089.941] lstrlenW (lpString=".jpg") returned 4 [0089.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.941] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") [0090.071] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12696) returned 1 [0090.071] CloseHandle (hObject=0x1c8) returned 1 [0090.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0090.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.075] GetLastError () returned 0x0 [0090.075] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3198, lpOverlapped=0x0) returned 1 [0090.077] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0090.078] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.078] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.078] SetEndOfFile (hFile=0x158) returned 1 [0090.078] CloseHandle (hObject=0x158) returned 1 [0090.078] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.078] SetEndOfFile (hFile=0x1c8) returned 1 [0090.079] CloseHandle (hObject=0x1c8) returned 1 [0090.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0090.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.080] lstrlenW (lpString=".doc") returned 4 [0090.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString=".docx") returned 5 [0090.080] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0090.080] lstrlenW (lpString=".pdf") returned 4 [0090.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString=".xls") returned 4 [0090.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.080] lstrlenW (lpString=".xlsx") returned 5 [0090.080] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0090.080] lstrlenW (lpString=".ppt") returned 4 [0090.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.080] lstrlenW (lpString=".zip") returned 4 [0090.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.080] lstrlenW (lpString=".rar") returned 4 [0090.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString=".bz2") returned 4 [0090.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString=".7z") returned 3 [0090.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.080] lstrlenW (lpString=".dbf") returned 4 [0090.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.080] lstrlenW (lpString=".1cd") returned 4 [0090.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0090.081] lstrlenW (lpString=".jpg") returned 4 [0090.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.081] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") [0090.081] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9736) returned 1 [0090.081] CloseHandle (hObject=0x1c8) returned 1 [0090.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0090.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.082] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.082] GetLastError () returned 0x0 [0090.082] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2608, lpOverlapped=0x0) returned 1 [0090.084] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0090.085] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.085] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.085] SetEndOfFile (hFile=0x158) returned 1 [0090.085] CloseHandle (hObject=0x158) returned 1 [0090.085] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.085] SetEndOfFile (hFile=0x1c8) returned 1 [0090.086] CloseHandle (hObject=0x1c8) returned 1 [0090.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString=".doc") returned 4 [0090.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString=".docx") returned 5 [0090.087] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.087] lstrlenW (lpString=".pdf") returned 4 [0090.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString=".xls") returned 4 [0090.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.087] lstrlenW (lpString=".xlsx") returned 5 [0090.087] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.087] lstrlenW (lpString=".ppt") returned 4 [0090.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString=".zip") returned 4 [0090.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.087] lstrlenW (lpString=".rar") returned 4 [0090.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString=".bz2") returned 4 [0090.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString=".7z") returned 3 [0090.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString=".dbf") returned 4 [0090.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString=".1cd") returned 4 [0090.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0090.087] lstrlenW (lpString=".jpg") returned 4 [0090.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.088] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") [0090.088] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5100) returned 1 [0090.088] CloseHandle (hObject=0x1c8) returned 1 [0090.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0090.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.088] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.088] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.089] GetLastError () returned 0x0 [0090.089] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13ec, lpOverlapped=0x0) returned 1 [0090.090] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0090.091] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.091] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.091] SetEndOfFile (hFile=0x158) returned 1 [0090.092] CloseHandle (hObject=0x158) returned 1 [0090.092] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.092] SetEndOfFile (hFile=0x1c8) returned 1 [0090.092] CloseHandle (hObject=0x1c8) returned 1 [0090.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0090.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.093] lstrlenW (lpString=".doc") returned 4 [0090.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.093] lstrlenW (lpString=".docx") returned 5 [0090.093] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.093] lstrlenW (lpString=".pdf") returned 4 [0090.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.093] lstrlenW (lpString=".xls") returned 4 [0090.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.093] lstrlenW (lpString=".xlsx") returned 5 [0090.093] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.093] lstrlenW (lpString=".ppt") returned 4 [0090.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.093] lstrlenW (lpString=".zip") returned 4 [0090.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.093] lstrlenW (lpString=".rar") returned 4 [0090.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.093] lstrlenW (lpString=".bz2") returned 4 [0090.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.093] lstrlenW (lpString=".7z") returned 3 [0090.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.094] lstrlenW (lpString=".dbf") returned 4 [0090.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.094] lstrlenW (lpString=".1cd") returned 4 [0090.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0090.094] lstrlenW (lpString=".jpg") returned 4 [0090.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.094] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") [0090.094] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24982) returned 1 [0090.094] CloseHandle (hObject=0x1c8) returned 1 [0090.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0090.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.095] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.095] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.095] GetLastError () returned 0x0 [0090.095] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6196, lpOverlapped=0x0) returned 1 [0090.097] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0090.098] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.098] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.099] SetEndOfFile (hFile=0x158) returned 1 [0090.099] CloseHandle (hObject=0x158) returned 1 [0090.099] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.099] SetEndOfFile (hFile=0x1c8) returned 1 [0090.100] CloseHandle (hObject=0x1c8) returned 1 [0090.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0090.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.100] lstrlenW (lpString=".doc") returned 4 [0090.100] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.100] lstrlenW (lpString=".docx") returned 5 [0090.100] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0090.100] lstrlenW (lpString=".pdf") returned 4 [0090.100] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.100] lstrlenW (lpString=".xls") returned 4 [0090.100] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.100] lstrlenW (lpString=".xlsx") returned 5 [0090.100] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0090.100] lstrlenW (lpString=".ppt") returned 4 [0090.100] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.100] lstrlenW (lpString=".zip") returned 4 [0090.100] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.101] lstrlenW (lpString=".rar") returned 4 [0090.101] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.101] lstrlenW (lpString=".bz2") returned 4 [0090.101] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.101] lstrlenW (lpString=".7z") returned 3 [0090.101] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.101] lstrlenW (lpString=".dbf") returned 4 [0090.101] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.101] lstrlenW (lpString=".1cd") returned 4 [0090.101] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0090.101] lstrlenW (lpString=".jpg") returned 4 [0090.101] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.101] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") [0090.102] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=46461) returned 1 [0090.102] CloseHandle (hObject=0x1c8) returned 1 [0090.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0090.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.102] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.102] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.102] GetLastError () returned 0x0 [0090.102] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb57d, lpOverlapped=0x0) returned 1 [0090.105] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb580, lpOverlapped=0x0) returned 1 [0090.107] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.107] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.107] SetEndOfFile (hFile=0x158) returned 1 [0090.107] CloseHandle (hObject=0x158) returned 1 [0090.107] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.107] SetEndOfFile (hFile=0x1c8) returned 1 [0090.108] CloseHandle (hObject=0x1c8) returned 1 [0090.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0090.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.108] lstrlenW (lpString=".doc") returned 4 [0090.108] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.108] lstrlenW (lpString=".docx") returned 5 [0090.108] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0090.108] lstrlenW (lpString=".pdf") returned 4 [0090.109] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.109] lstrlenW (lpString=".xls") returned 4 [0090.109] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.109] lstrlenW (lpString=".xlsx") returned 5 [0090.109] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0090.109] lstrlenW (lpString=".ppt") returned 4 [0090.109] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.109] lstrlenW (lpString=".zip") returned 4 [0090.109] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.109] lstrlenW (lpString=".rar") returned 4 [0090.109] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.109] lstrlenW (lpString=".bz2") returned 4 [0090.109] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.109] lstrlenW (lpString=".7z") returned 3 [0090.109] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.109] lstrlenW (lpString=".dbf") returned 4 [0090.109] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.109] lstrlenW (lpString=".1cd") returned 4 [0090.109] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0090.109] lstrlenW (lpString=".jpg") returned 4 [0090.109] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.109] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") [0090.110] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14552) returned 1 [0090.110] CloseHandle (hObject=0x1c8) returned 1 [0090.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0090.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.111] GetLastError () returned 0x0 [0090.111] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x38d8, lpOverlapped=0x0) returned 1 [0090.260] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x38e0, lpOverlapped=0x0) returned 1 [0090.261] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.261] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.262] SetEndOfFile (hFile=0x158) returned 1 [0090.279] CloseHandle (hObject=0x158) returned 1 [0090.279] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.280] SetEndOfFile (hFile=0x1c8) returned 1 [0090.280] CloseHandle (hObject=0x1c8) returned 1 [0090.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString=".doc") returned 4 [0090.440] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.440] lstrlenW (lpString=".docx") returned 5 [0090.440] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0090.440] lstrlenW (lpString=".pdf") returned 4 [0090.440] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.440] lstrlenW (lpString=".xls") returned 4 [0090.440] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.440] lstrlenW (lpString=".xlsx") returned 5 [0090.440] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0090.440] lstrlenW (lpString=".ppt") returned 4 [0090.440] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString=".zip") returned 4 [0090.440] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.440] lstrlenW (lpString=".rar") returned 4 [0090.440] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.440] lstrlenW (lpString=".bz2") returned 4 [0090.440] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.440] lstrlenW (lpString=".7z") returned 3 [0090.440] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString=".dbf") returned 4 [0090.440] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString=".1cd") returned 4 [0090.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0090.440] lstrlenW (lpString=".jpg") returned 4 [0090.441] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.441] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") [0090.748] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32110) returned 1 [0090.749] CloseHandle (hObject=0x1f0) returned 1 [0090.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0090.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0090.749] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.749] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0090.749] GetLastError () returned 0x0 [0090.749] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7d6e, lpOverlapped=0x0) returned 1 [0090.851] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7d70, lpOverlapped=0x0) returned 1 [0090.852] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.852] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.852] SetEndOfFile (hFile=0x210) returned 1 [0090.852] CloseHandle (hObject=0x210) returned 1 [0090.853] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.853] SetEndOfFile (hFile=0x1f0) returned 1 [0090.854] CloseHandle (hObject=0x1f0) returned 1 [0090.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0090.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.854] lstrlenW (lpString=".doc") returned 4 [0090.854] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.854] lstrlenW (lpString=".docx") returned 5 [0090.854] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0090.854] lstrlenW (lpString=".pdf") returned 4 [0090.854] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.854] lstrlenW (lpString=".xls") returned 4 [0090.854] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.854] lstrlenW (lpString=".xlsx") returned 5 [0090.854] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0090.854] lstrlenW (lpString=".ppt") returned 4 [0090.854] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.854] lstrlenW (lpString=".zip") returned 4 [0090.854] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.854] lstrlenW (lpString=".rar") returned 4 [0090.854] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.854] lstrlenW (lpString=".bz2") returned 4 [0090.855] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.855] lstrlenW (lpString=".7z") returned 3 [0090.855] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.855] lstrlenW (lpString=".dbf") returned 4 [0090.855] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.855] lstrlenW (lpString=".1cd") returned 4 [0090.855] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0090.855] lstrlenW (lpString=".jpg") returned 4 [0090.855] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.855] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") [0090.855] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24430) returned 1 [0090.855] CloseHandle (hObject=0x1f0) returned 1 [0090.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0090.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0090.856] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.856] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0090.856] GetLastError () returned 0x0 [0090.856] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5f6e, lpOverlapped=0x0) returned 1 [0090.938] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5f70, lpOverlapped=0x0) returned 1 [0090.939] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.939] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.940] SetEndOfFile (hFile=0x210) returned 1 [0090.992] CloseHandle (hObject=0x210) returned 1 [0090.992] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.992] SetEndOfFile (hFile=0x1f0) returned 1 [0090.993] CloseHandle (hObject=0x1f0) returned 1 [0090.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0090.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.993] lstrlenW (lpString=".doc") returned 4 [0090.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.993] lstrlenW (lpString=".docx") returned 5 [0090.993] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.993] lstrlenW (lpString=".pdf") returned 4 [0090.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString=".xls") returned 4 [0090.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.994] lstrlenW (lpString=".xlsx") returned 5 [0090.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.994] lstrlenW (lpString=".ppt") returned 4 [0090.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.994] lstrlenW (lpString=".zip") returned 4 [0090.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.994] lstrlenW (lpString=".rar") returned 4 [0090.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString=".bz2") returned 4 [0090.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString=".7z") returned 3 [0090.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.994] lstrlenW (lpString=".dbf") returned 4 [0090.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.994] lstrlenW (lpString=".1cd") returned 4 [0090.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0090.994] lstrlenW (lpString=".jpg") returned 4 [0090.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.994] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") [0090.995] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7304) returned 1 [0090.995] CloseHandle (hObject=0x1f0) returned 1 [0090.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0090.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0090.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0090.996] GetLastError () returned 0x0 [0090.997] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1c88, lpOverlapped=0x0) returned 1 [0090.998] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0090.999] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.999] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.999] SetEndOfFile (hFile=0x210) returned 1 [0090.999] CloseHandle (hObject=0x210) returned 1 [0091.000] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.000] SetEndOfFile (hFile=0x1f0) returned 1 [0091.000] CloseHandle (hObject=0x1f0) returned 1 [0091.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0091.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.001] lstrlenW (lpString=".doc") returned 4 [0091.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.001] lstrlenW (lpString=".docx") returned 5 [0091.001] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.001] lstrlenW (lpString=".pdf") returned 4 [0091.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.001] lstrlenW (lpString=".xls") returned 4 [0091.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.001] lstrlenW (lpString=".xlsx") returned 5 [0091.001] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.001] lstrlenW (lpString=".ppt") returned 4 [0091.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.001] lstrlenW (lpString=".zip") returned 4 [0091.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.001] lstrlenW (lpString=".rar") returned 4 [0091.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.001] lstrlenW (lpString=".bz2") returned 4 [0091.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.001] lstrlenW (lpString=".7z") returned 3 [0091.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.002] lstrlenW (lpString=".dbf") returned 4 [0091.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.002] lstrlenW (lpString=".1cd") returned 4 [0091.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0091.002] lstrlenW (lpString=".jpg") returned 4 [0091.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.002] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") [0091.003] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20038) returned 1 [0091.003] CloseHandle (hObject=0x1f0) returned 1 [0091.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0091.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0091.004] GetLastError () returned 0x0 [0091.004] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4e46, lpOverlapped=0x0) returned 1 [0091.006] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4e50, lpOverlapped=0x0) returned 1 [0091.008] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.008] SetEndOfFile (hFile=0x210) returned 1 [0091.008] CloseHandle (hObject=0x210) returned 1 [0091.008] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.008] SetEndOfFile (hFile=0x1f0) returned 1 [0091.009] CloseHandle (hObject=0x1f0) returned 1 [0091.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0091.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.009] lstrlenW (lpString=".doc") returned 4 [0091.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.009] lstrlenW (lpString=".docx") returned 5 [0091.009] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.009] lstrlenW (lpString=".pdf") returned 4 [0091.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.009] lstrlenW (lpString=".xls") returned 4 [0091.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.009] lstrlenW (lpString=".xlsx") returned 5 [0091.010] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.010] lstrlenW (lpString=".ppt") returned 4 [0091.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.010] lstrlenW (lpString=".zip") returned 4 [0091.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.010] lstrlenW (lpString=".rar") returned 4 [0091.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.010] lstrlenW (lpString=".bz2") returned 4 [0091.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.010] lstrlenW (lpString=".7z") returned 3 [0091.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.010] lstrlenW (lpString=".dbf") returned 4 [0091.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.010] lstrlenW (lpString=".1cd") returned 4 [0091.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0091.010] lstrlenW (lpString=".jpg") returned 4 [0091.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.010] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") [0091.011] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27096) returned 1 [0091.011] CloseHandle (hObject=0x1f0) returned 1 [0091.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0091.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.011] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.011] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0091.012] GetLastError () returned 0x0 [0091.012] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x69d8, lpOverlapped=0x0) returned 1 [0091.014] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x69e0, lpOverlapped=0x0) returned 1 [0091.015] ReadFile (in: hFile=0x1f0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.015] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.015] SetEndOfFile (hFile=0x210) returned 1 [0091.015] CloseHandle (hObject=0x210) returned 1 [0091.015] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.015] SetEndOfFile (hFile=0x1f0) returned 1 [0091.016] CloseHandle (hObject=0x1f0) returned 1 [0091.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString=".doc") returned 4 [0091.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString=".docx") returned 5 [0091.017] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0091.017] lstrlenW (lpString=".pdf") returned 4 [0091.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString=".xls") returned 4 [0091.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.017] lstrlenW (lpString=".xlsx") returned 5 [0091.017] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0091.017] lstrlenW (lpString=".ppt") returned 4 [0091.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString=".zip") returned 4 [0091.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.017] lstrlenW (lpString=".rar") returned 4 [0091.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString=".bz2") returned 4 [0091.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString=".7z") returned 3 [0091.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString=".dbf") returned 4 [0091.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString=".1cd") returned 4 [0091.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0091.017] lstrlenW (lpString=".jpg") returned 4 [0091.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.018] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") [0092.385] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=25312) returned 1 [0092.385] CloseHandle (hObject=0x210) returned 1 [0092.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0092.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.392] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.392] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.408] GetLastError () returned 0x0 [0092.408] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x62e0, lpOverlapped=0x0) returned 1 [0092.411] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x62f0, lpOverlapped=0x0) returned 1 [0092.413] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.413] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.413] SetEndOfFile (hFile=0x150) returned 1 [0092.413] CloseHandle (hObject=0x150) returned 1 [0092.413] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.413] SetEndOfFile (hFile=0x210) returned 1 [0092.414] CloseHandle (hObject=0x210) returned 1 [0092.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.414] lstrlenW (lpString=".doc") returned 4 [0092.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.414] lstrlenW (lpString=".docx") returned 5 [0092.415] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0092.415] lstrlenW (lpString=".pdf") returned 4 [0092.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString=".xls") returned 4 [0092.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.415] lstrlenW (lpString=".xlsx") returned 5 [0092.415] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0092.415] lstrlenW (lpString=".ppt") returned 4 [0092.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.415] lstrlenW (lpString=".zip") returned 4 [0092.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.415] lstrlenW (lpString=".rar") returned 4 [0092.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString=".bz2") returned 4 [0092.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString=".7z") returned 3 [0092.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.415] lstrlenW (lpString=".dbf") returned 4 [0092.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.415] lstrlenW (lpString=".1cd") returned 4 [0092.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0092.415] lstrlenW (lpString=".jpg") returned 4 [0092.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.415] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") [0092.417] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7572) returned 1 [0092.417] CloseHandle (hObject=0x210) returned 1 [0092.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0092.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.417] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.417] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.418] GetLastError () returned 0x0 [0092.418] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1d94, lpOverlapped=0x0) returned 1 [0092.419] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0092.420] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.420] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.420] SetEndOfFile (hFile=0x150) returned 1 [0092.420] CloseHandle (hObject=0x150) returned 1 [0092.420] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.421] SetEndOfFile (hFile=0x210) returned 1 [0092.421] CloseHandle (hObject=0x210) returned 1 [0092.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0092.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.422] lstrlenW (lpString=".doc") returned 4 [0092.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.422] lstrlenW (lpString=".docx") returned 5 [0092.422] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0092.422] lstrlenW (lpString=".pdf") returned 4 [0092.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.422] lstrlenW (lpString=".xls") returned 4 [0092.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.422] lstrlenW (lpString=".xlsx") returned 5 [0092.422] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0092.422] lstrlenW (lpString=".ppt") returned 4 [0092.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.422] lstrlenW (lpString=".zip") returned 4 [0092.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.422] lstrlenW (lpString=".rar") returned 4 [0092.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.422] lstrlenW (lpString=".bz2") returned 4 [0092.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.422] lstrlenW (lpString=".7z") returned 3 [0092.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.422] lstrlenW (lpString=".dbf") returned 4 [0092.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.423] lstrlenW (lpString=".1cd") returned 4 [0092.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0092.423] lstrlenW (lpString=".jpg") returned 4 [0092.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.423] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") [0092.423] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8732) returned 1 [0092.423] CloseHandle (hObject=0x210) returned 1 [0092.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0092.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.424] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.424] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.424] GetLastError () returned 0x0 [0092.424] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x221c, lpOverlapped=0x0) returned 1 [0092.426] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0092.427] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.427] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.427] SetEndOfFile (hFile=0x150) returned 1 [0092.427] CloseHandle (hObject=0x150) returned 1 [0092.427] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.427] SetEndOfFile (hFile=0x210) returned 1 [0092.428] CloseHandle (hObject=0x210) returned 1 [0092.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0092.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.428] lstrlenW (lpString=".doc") returned 4 [0092.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString=".docx") returned 5 [0092.429] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.429] lstrlenW (lpString=".pdf") returned 4 [0092.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString=".xls") returned 4 [0092.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.429] lstrlenW (lpString=".xlsx") returned 5 [0092.429] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.429] lstrlenW (lpString=".ppt") returned 4 [0092.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.429] lstrlenW (lpString=".zip") returned 4 [0092.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.429] lstrlenW (lpString=".rar") returned 4 [0092.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString=".bz2") returned 4 [0092.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString=".7z") returned 3 [0092.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.429] lstrlenW (lpString=".dbf") returned 4 [0092.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.429] lstrlenW (lpString=".1cd") returned 4 [0092.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0092.429] lstrlenW (lpString=".jpg") returned 4 [0092.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.429] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") [0092.430] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2732) returned 1 [0092.430] CloseHandle (hObject=0x210) returned 1 [0092.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0092.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.431] GetLastError () returned 0x0 [0092.431] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xaac, lpOverlapped=0x0) returned 1 [0092.432] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0092.433] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.433] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.433] SetEndOfFile (hFile=0x150) returned 1 [0092.433] CloseHandle (hObject=0x150) returned 1 [0092.434] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.434] SetEndOfFile (hFile=0x210) returned 1 [0092.434] CloseHandle (hObject=0x210) returned 1 [0092.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0092.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.435] lstrlenW (lpString=".doc") returned 4 [0092.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.435] lstrlenW (lpString=".docx") returned 5 [0092.435] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0092.435] lstrlenW (lpString=".pdf") returned 4 [0092.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.435] lstrlenW (lpString=".xls") returned 4 [0092.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.435] lstrlenW (lpString=".xlsx") returned 5 [0092.435] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0092.435] lstrlenW (lpString=".ppt") returned 4 [0092.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.435] lstrlenW (lpString=".zip") returned 4 [0092.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.435] lstrlenW (lpString=".rar") returned 4 [0092.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.435] lstrlenW (lpString=".bz2") returned 4 [0092.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.435] lstrlenW (lpString=".7z") returned 3 [0092.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.435] lstrlenW (lpString=".dbf") returned 4 [0092.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.436] lstrlenW (lpString=".1cd") returned 4 [0092.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0092.436] lstrlenW (lpString=".jpg") returned 4 [0092.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.436] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") [0092.437] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9108) returned 1 [0092.437] CloseHandle (hObject=0x210) returned 1 [0092.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0092.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.437] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.437] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.438] GetLastError () returned 0x0 [0092.438] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2394, lpOverlapped=0x0) returned 1 [0092.439] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x23a0, lpOverlapped=0x0) returned 1 [0092.440] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.440] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.440] SetEndOfFile (hFile=0x150) returned 1 [0092.440] CloseHandle (hObject=0x150) returned 1 [0092.441] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.441] SetEndOfFile (hFile=0x210) returned 1 [0092.442] CloseHandle (hObject=0x210) returned 1 [0092.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0092.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.442] lstrlenW (lpString=".doc") returned 4 [0092.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.442] lstrlenW (lpString=".docx") returned 5 [0092.442] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.442] lstrlenW (lpString=".pdf") returned 4 [0092.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.442] lstrlenW (lpString=".xls") returned 4 [0092.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.442] lstrlenW (lpString=".xlsx") returned 5 [0092.442] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.442] lstrlenW (lpString=".ppt") returned 4 [0092.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.442] lstrlenW (lpString=".zip") returned 4 [0092.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.442] lstrlenW (lpString=".rar") returned 4 [0092.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.443] lstrlenW (lpString=".bz2") returned 4 [0092.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.443] lstrlenW (lpString=".7z") returned 3 [0092.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.443] lstrlenW (lpString=".dbf") returned 4 [0092.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.443] lstrlenW (lpString=".1cd") returned 4 [0092.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0092.443] lstrlenW (lpString=".jpg") returned 4 [0092.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.443] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") [0092.443] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10820) returned 1 [0092.443] CloseHandle (hObject=0x210) returned 1 [0092.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0092.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.444] GetLastError () returned 0x0 [0092.444] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a44, lpOverlapped=0x0) returned 1 [0092.524] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0092.525] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.525] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.525] SetEndOfFile (hFile=0x150) returned 1 [0092.547] CloseHandle (hObject=0x150) returned 1 [0092.555] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.555] SetEndOfFile (hFile=0x210) returned 1 [0092.582] CloseHandle (hObject=0x210) returned 1 [0092.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0092.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.693] lstrlenW (lpString=".doc") returned 4 [0092.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.693] lstrlenW (lpString=".docx") returned 5 [0092.693] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0092.693] lstrlenW (lpString=".pdf") returned 4 [0092.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.693] lstrlenW (lpString=".xls") returned 4 [0092.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.694] lstrlenW (lpString=".xlsx") returned 5 [0092.694] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0092.694] lstrlenW (lpString=".ppt") returned 4 [0092.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.694] lstrlenW (lpString=".zip") returned 4 [0092.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.694] lstrlenW (lpString=".rar") returned 4 [0092.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.694] lstrlenW (lpString=".bz2") returned 4 [0092.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.694] lstrlenW (lpString=".7z") returned 3 [0092.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.694] lstrlenW (lpString=".dbf") returned 4 [0092.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.694] lstrlenW (lpString=".1cd") returned 4 [0092.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0092.694] lstrlenW (lpString=".jpg") returned 4 [0092.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.694] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") [0093.126] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5824) returned 1 [0093.126] CloseHandle (hObject=0x16c) returned 1 [0093.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0093.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.221] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.221] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.238] GetLastError () returned 0x0 [0093.238] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x16c0, lpOverlapped=0x0) returned 1 [0093.239] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0093.240] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.240] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.240] SetEndOfFile (hFile=0x1ec) returned 1 [0093.240] CloseHandle (hObject=0x1ec) returned 1 [0093.241] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.241] SetEndOfFile (hFile=0x16c) returned 1 [0093.241] CloseHandle (hObject=0x16c) returned 1 [0093.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0093.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.242] lstrlenW (lpString=".doc") returned 4 [0093.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.242] lstrlenW (lpString=".docx") returned 5 [0093.242] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.242] lstrlenW (lpString=".pdf") returned 4 [0093.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.242] lstrlenW (lpString=".xls") returned 4 [0093.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.242] lstrlenW (lpString=".xlsx") returned 5 [0093.242] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.242] lstrlenW (lpString=".ppt") returned 4 [0093.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.242] lstrlenW (lpString=".zip") returned 4 [0093.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.242] lstrlenW (lpString=".rar") returned 4 [0093.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.242] lstrlenW (lpString=".bz2") returned 4 [0093.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.242] lstrlenW (lpString=".7z") returned 3 [0093.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.243] lstrlenW (lpString=".dbf") returned 4 [0093.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.243] lstrlenW (lpString=".1cd") returned 4 [0093.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0093.243] lstrlenW (lpString=".jpg") returned 4 [0093.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.243] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") [0093.244] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3680) returned 1 [0093.244] CloseHandle (hObject=0x16c) returned 1 [0093.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0093.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.245] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.245] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.245] GetLastError () returned 0x0 [0093.245] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe60, lpOverlapped=0x0) returned 1 [0093.247] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0093.248] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.248] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.248] SetEndOfFile (hFile=0x1ec) returned 1 [0093.248] CloseHandle (hObject=0x1ec) returned 1 [0093.248] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.248] SetEndOfFile (hFile=0x16c) returned 1 [0093.249] CloseHandle (hObject=0x16c) returned 1 [0093.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0093.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString=".doc") returned 4 [0093.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString=".docx") returned 5 [0093.250] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.250] lstrlenW (lpString=".pdf") returned 4 [0093.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString=".xls") returned 4 [0093.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.250] lstrlenW (lpString=".xlsx") returned 5 [0093.250] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.250] lstrlenW (lpString=".ppt") returned 4 [0093.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString=".zip") returned 4 [0093.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.250] lstrlenW (lpString=".rar") returned 4 [0093.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString=".bz2") returned 4 [0093.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString=".7z") returned 3 [0093.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString=".dbf") returned 4 [0093.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString=".1cd") returned 4 [0093.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0093.250] lstrlenW (lpString=".jpg") returned 4 [0093.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.251] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") [0093.251] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3004) returned 1 [0093.251] CloseHandle (hObject=0x16c) returned 1 [0093.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0093.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.251] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.251] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.252] GetLastError () returned 0x0 [0093.252] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbbc, lpOverlapped=0x0) returned 1 [0093.254] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0093.255] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.255] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.255] SetEndOfFile (hFile=0x1ec) returned 1 [0093.255] CloseHandle (hObject=0x1ec) returned 1 [0093.255] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.255] SetEndOfFile (hFile=0x16c) returned 1 [0093.256] CloseHandle (hObject=0x16c) returned 1 [0093.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0093.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.256] lstrlenW (lpString=".doc") returned 4 [0093.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.256] lstrlenW (lpString=".docx") returned 5 [0093.256] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.256] lstrlenW (lpString=".pdf") returned 4 [0093.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.256] lstrlenW (lpString=".xls") returned 4 [0093.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.256] lstrlenW (lpString=".xlsx") returned 5 [0093.257] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.257] lstrlenW (lpString=".ppt") returned 4 [0093.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.257] lstrlenW (lpString=".zip") returned 4 [0093.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.257] lstrlenW (lpString=".rar") returned 4 [0093.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.257] lstrlenW (lpString=".bz2") returned 4 [0093.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.257] lstrlenW (lpString=".7z") returned 3 [0093.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.257] lstrlenW (lpString=".dbf") returned 4 [0093.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.257] lstrlenW (lpString=".1cd") returned 4 [0093.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0093.257] lstrlenW (lpString=".jpg") returned 4 [0093.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.257] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") [0093.258] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4750) returned 1 [0093.258] CloseHandle (hObject=0x16c) returned 1 [0093.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0093.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.258] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.258] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.259] GetLastError () returned 0x0 [0093.259] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x128e, lpOverlapped=0x0) returned 1 [0093.260] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1290, lpOverlapped=0x0) returned 1 [0093.261] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.261] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.261] SetEndOfFile (hFile=0x1ec) returned 1 [0093.262] CloseHandle (hObject=0x1ec) returned 1 [0093.262] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.262] SetEndOfFile (hFile=0x16c) returned 1 [0093.263] CloseHandle (hObject=0x16c) returned 1 [0093.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0093.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.263] lstrlenW (lpString=".doc") returned 4 [0093.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.263] lstrlenW (lpString=".docx") returned 5 [0093.264] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.264] lstrlenW (lpString=".pdf") returned 4 [0093.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString=".xls") returned 4 [0093.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.264] lstrlenW (lpString=".xlsx") returned 5 [0093.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.264] lstrlenW (lpString=".ppt") returned 4 [0093.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.264] lstrlenW (lpString=".zip") returned 4 [0093.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.264] lstrlenW (lpString=".rar") returned 4 [0093.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString=".bz2") returned 4 [0093.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString=".7z") returned 3 [0093.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.264] lstrlenW (lpString=".dbf") returned 4 [0093.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.264] lstrlenW (lpString=".1cd") returned 4 [0093.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0093.264] lstrlenW (lpString=".jpg") returned 4 [0093.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.264] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") [0093.266] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5326) returned 1 [0093.266] CloseHandle (hObject=0x16c) returned 1 [0093.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0093.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.266] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.266] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.267] GetLastError () returned 0x0 [0093.267] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x14ce, lpOverlapped=0x0) returned 1 [0093.268] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0093.269] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.269] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.269] SetEndOfFile (hFile=0x1ec) returned 1 [0093.269] CloseHandle (hObject=0x1ec) returned 1 [0093.269] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.269] SetEndOfFile (hFile=0x16c) returned 1 [0093.270] CloseHandle (hObject=0x16c) returned 1 [0093.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0093.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString=".doc") returned 4 [0093.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString=".docx") returned 5 [0093.271] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.271] lstrlenW (lpString=".pdf") returned 4 [0093.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString=".xls") returned 4 [0093.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.271] lstrlenW (lpString=".xlsx") returned 5 [0093.271] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.271] lstrlenW (lpString=".ppt") returned 4 [0093.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString=".zip") returned 4 [0093.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.271] lstrlenW (lpString=".rar") returned 4 [0093.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString=".bz2") returned 4 [0093.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString=".7z") returned 3 [0093.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString=".dbf") returned 4 [0093.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString=".1cd") returned 4 [0093.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0093.271] lstrlenW (lpString=".jpg") returned 4 [0093.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.271] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") [0093.272] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3826) returned 1 [0093.272] CloseHandle (hObject=0x16c) returned 1 [0093.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0093.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.272] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.272] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.273] GetLastError () returned 0x0 [0093.273] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xef2, lpOverlapped=0x0) returned 1 [0093.378] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf00, lpOverlapped=0x0) returned 1 [0093.379] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.379] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.379] SetEndOfFile (hFile=0x1ec) returned 1 [0093.382] CloseHandle (hObject=0x1ec) returned 1 [0093.382] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.382] SetEndOfFile (hFile=0x16c) returned 1 [0093.391] CloseHandle (hObject=0x16c) returned 1 [0093.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0093.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.398] lstrlenW (lpString=".doc") returned 4 [0093.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString=".docx") returned 5 [0093.399] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.399] lstrlenW (lpString=".pdf") returned 4 [0093.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString=".xls") returned 4 [0093.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.399] lstrlenW (lpString=".xlsx") returned 5 [0093.399] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.399] lstrlenW (lpString=".ppt") returned 4 [0093.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.399] lstrlenW (lpString=".zip") returned 4 [0093.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.399] lstrlenW (lpString=".rar") returned 4 [0093.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString=".bz2") returned 4 [0093.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString=".7z") returned 3 [0093.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.399] lstrlenW (lpString=".dbf") returned 4 [0093.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.399] lstrlenW (lpString=".1cd") returned 4 [0093.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0093.399] lstrlenW (lpString=".jpg") returned 4 [0093.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.399] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") [0093.441] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=34912) returned 1 [0093.441] CloseHandle (hObject=0x190) returned 1 [0093.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0093.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.441] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.441] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.442] GetLastError () returned 0x0 [0093.442] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8860, lpOverlapped=0x0) returned 1 [0093.450] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0093.451] ReadFile (in: hFile=0x190, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.451] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.451] SetEndOfFile (hFile=0x150) returned 1 [0093.452] CloseHandle (hObject=0x150) returned 1 [0093.452] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.452] SetEndOfFile (hFile=0x190) returned 1 [0093.453] CloseHandle (hObject=0x190) returned 1 [0093.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0093.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.453] lstrlenW (lpString=".doc") returned 4 [0093.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.453] lstrlenW (lpString=".docx") returned 5 [0093.453] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0093.453] lstrlenW (lpString=".pdf") returned 4 [0093.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.453] lstrlenW (lpString=".xls") returned 4 [0093.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.453] lstrlenW (lpString=".xlsx") returned 5 [0093.453] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0093.453] lstrlenW (lpString=".ppt") returned 4 [0093.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.454] lstrlenW (lpString=".zip") returned 4 [0093.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.454] lstrlenW (lpString=".rar") returned 4 [0093.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".bz2") returned 4 [0093.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".7z") returned 3 [0093.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.454] lstrlenW (lpString=".dbf") returned 4 [0093.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.454] lstrlenW (lpString=".1cd") returned 4 [0093.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0093.454] lstrlenW (lpString=".jpg") returned 4 [0093.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.454] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") [0093.460] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=40300) returned 1 [0093.460] CloseHandle (hObject=0x16c) returned 1 [0093.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0093.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.461] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.461] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.461] GetLastError () returned 0x0 [0093.461] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9d6c, lpOverlapped=0x0) returned 1 [0093.465] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9d70, lpOverlapped=0x0) returned 1 [0093.467] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.467] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.467] SetEndOfFile (hFile=0x1ec) returned 1 [0093.467] CloseHandle (hObject=0x1ec) returned 1 [0093.467] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.467] SetEndOfFile (hFile=0x16c) returned 1 [0093.468] CloseHandle (hObject=0x16c) returned 1 [0093.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0093.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.468] lstrlenW (lpString=".doc") returned 4 [0093.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.468] lstrlenW (lpString=".docx") returned 5 [0093.469] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.469] lstrlenW (lpString=".pdf") returned 4 [0093.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString=".xls") returned 4 [0093.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.469] lstrlenW (lpString=".xlsx") returned 5 [0093.469] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.469] lstrlenW (lpString=".ppt") returned 4 [0093.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.469] lstrlenW (lpString=".zip") returned 4 [0093.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.469] lstrlenW (lpString=".rar") returned 4 [0093.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString=".bz2") returned 4 [0093.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString=".7z") returned 3 [0093.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.469] lstrlenW (lpString=".dbf") returned 4 [0093.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.469] lstrlenW (lpString=".1cd") returned 4 [0093.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0093.469] lstrlenW (lpString=".jpg") returned 4 [0093.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.469] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") [0093.470] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=44552) returned 1 [0093.470] CloseHandle (hObject=0x16c) returned 1 [0093.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 0x20 [0093.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.470] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.470] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.471] GetLastError () returned 0x0 [0093.471] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xae08, lpOverlapped=0x0) returned 1 [0093.474] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xae10, lpOverlapped=0x0) returned 1 [0093.475] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.475] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.475] SetEndOfFile (hFile=0x1ec) returned 1 [0093.475] CloseHandle (hObject=0x1ec) returned 1 [0093.475] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.475] SetEndOfFile (hFile=0x16c) returned 1 [0093.476] CloseHandle (hObject=0x16c) returned 1 [0093.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 1 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.477] lstrlenW (lpString=".doc") returned 4 [0093.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString=".docx") returned 5 [0093.477] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.477] lstrlenW (lpString=".pdf") returned 4 [0093.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString=".xls") returned 4 [0093.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.477] lstrlenW (lpString=".xlsx") returned 5 [0093.477] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.477] lstrlenW (lpString=".ppt") returned 4 [0093.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.477] lstrlenW (lpString=".zip") returned 4 [0093.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.477] lstrlenW (lpString=".rar") returned 4 [0093.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString=".bz2") returned 4 [0093.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString=".7z") returned 3 [0093.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.477] lstrlenW (lpString=".dbf") returned 4 [0093.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.477] lstrlenW (lpString=".1cd") returned 4 [0093.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0093.478] lstrlenW (lpString=".jpg") returned 4 [0093.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.478] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") [0093.478] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=57722) returned 1 [0093.478] CloseHandle (hObject=0x16c) returned 1 [0093.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 0x20 [0093.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.478] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.479] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.479] GetLastError () returned 0x0 [0093.479] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe17a, lpOverlapped=0x0) returned 1 [0093.482] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe180, lpOverlapped=0x0) returned 1 [0093.483] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.484] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.484] SetEndOfFile (hFile=0x1ec) returned 1 [0093.484] CloseHandle (hObject=0x1ec) returned 1 [0093.484] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.484] SetEndOfFile (hFile=0x16c) returned 1 [0093.485] CloseHandle (hObject=0x16c) returned 1 [0093.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0093.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.485] lstrlenW (lpString=".doc") returned 4 [0093.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.485] lstrlenW (lpString=".docx") returned 5 [0093.486] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.486] lstrlenW (lpString=".pdf") returned 4 [0093.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.486] lstrlenW (lpString=".xls") returned 4 [0093.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.486] lstrlenW (lpString=".xlsx") returned 5 [0093.486] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.486] lstrlenW (lpString=".ppt") returned 4 [0093.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.486] lstrlenW (lpString=".zip") returned 4 [0093.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.502] lstrlenW (lpString=".rar") returned 4 [0093.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.502] lstrlenW (lpString=".bz2") returned 4 [0093.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.502] lstrlenW (lpString=".7z") returned 3 [0093.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.502] lstrlenW (lpString=".dbf") returned 4 [0093.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.502] lstrlenW (lpString=".1cd") returned 4 [0093.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0093.502] lstrlenW (lpString=".jpg") returned 4 [0093.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.502] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") [0093.505] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=50046) returned 1 [0093.505] CloseHandle (hObject=0x158) returned 1 [0093.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 0x20 [0093.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.506] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.506] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.506] GetLastError () returned 0x0 [0093.506] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc37e, lpOverlapped=0x0) returned 1 [0093.509] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc380, lpOverlapped=0x0) returned 1 [0093.510] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.510] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.510] SetEndOfFile (hFile=0x1fc) returned 1 [0093.511] CloseHandle (hObject=0x1fc) returned 1 [0093.511] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.511] SetEndOfFile (hFile=0x158) returned 1 [0093.512] CloseHandle (hObject=0x158) returned 1 [0093.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 1 [0093.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.512] lstrlenW (lpString=".doc") returned 4 [0093.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.512] lstrlenW (lpString=".docx") returned 5 [0093.512] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.512] lstrlenW (lpString=".pdf") returned 4 [0093.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.512] lstrlenW (lpString=".xls") returned 4 [0093.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.512] lstrlenW (lpString=".xlsx") returned 5 [0093.512] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.512] lstrlenW (lpString=".ppt") returned 4 [0093.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.513] lstrlenW (lpString=".zip") returned 4 [0093.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.513] lstrlenW (lpString=".rar") returned 4 [0093.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.513] lstrlenW (lpString=".bz2") returned 4 [0093.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.513] lstrlenW (lpString=".7z") returned 3 [0093.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.513] lstrlenW (lpString=".dbf") returned 4 [0093.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.513] lstrlenW (lpString=".1cd") returned 4 [0093.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0093.513] lstrlenW (lpString=".jpg") returned 4 [0093.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.513] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") [0093.514] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26154) returned 1 [0093.514] CloseHandle (hObject=0x158) returned 1 [0093.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 0x20 [0093.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.514] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.514] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.514] GetLastError () returned 0x0 [0093.514] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x662a, lpOverlapped=0x0) returned 1 [0093.516] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6630, lpOverlapped=0x0) returned 1 [0093.518] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.518] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.518] SetEndOfFile (hFile=0x1fc) returned 1 [0093.518] CloseHandle (hObject=0x1fc) returned 1 [0093.518] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.518] SetEndOfFile (hFile=0x158) returned 1 [0093.519] CloseHandle (hObject=0x158) returned 1 [0093.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0093.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.520] lstrlenW (lpString=".doc") returned 4 [0093.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString=".docx") returned 5 [0093.520] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.520] lstrlenW (lpString=".pdf") returned 4 [0093.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString=".xls") returned 4 [0093.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.520] lstrlenW (lpString=".xlsx") returned 5 [0093.520] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.520] lstrlenW (lpString=".ppt") returned 4 [0093.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.520] lstrlenW (lpString=".zip") returned 4 [0093.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.520] lstrlenW (lpString=".rar") returned 4 [0093.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString=".bz2") returned 4 [0093.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString=".7z") returned 3 [0093.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.520] lstrlenW (lpString=".dbf") returned 4 [0093.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.520] lstrlenW (lpString=".1cd") returned 4 [0093.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0093.520] lstrlenW (lpString=".jpg") returned 4 [0093.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.520] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") [0093.521] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16676) returned 1 [0093.521] CloseHandle (hObject=0x158) returned 1 [0093.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 0x20 [0093.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.521] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.521] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.522] GetLastError () returned 0x0 [0093.522] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4124, lpOverlapped=0x0) returned 1 [0093.524] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0093.525] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.525] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.525] SetEndOfFile (hFile=0x1fc) returned 1 [0093.525] CloseHandle (hObject=0x1fc) returned 1 [0093.525] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.525] SetEndOfFile (hFile=0x158) returned 1 [0093.526] CloseHandle (hObject=0x158) returned 1 [0093.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString=".doc") returned 4 [0093.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString=".docx") returned 5 [0093.527] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.527] lstrlenW (lpString=".pdf") returned 4 [0093.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString=".xls") returned 4 [0093.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.527] lstrlenW (lpString=".xlsx") returned 5 [0093.527] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.527] lstrlenW (lpString=".ppt") returned 4 [0093.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString=".zip") returned 4 [0093.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.527] lstrlenW (lpString=".rar") returned 4 [0093.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString=".bz2") returned 4 [0093.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString=".7z") returned 3 [0093.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString=".dbf") returned 4 [0093.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString=".1cd") returned 4 [0093.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0093.527] lstrlenW (lpString=".jpg") returned 4 [0093.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.527] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") [0093.528] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5060) returned 1 [0093.528] CloseHandle (hObject=0x158) returned 1 [0093.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 0x20 [0093.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.528] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.528] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.529] GetLastError () returned 0x0 [0093.529] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13c4, lpOverlapped=0x0) returned 1 [0093.540] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0093.541] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.541] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.541] SetEndOfFile (hFile=0x1fc) returned 1 [0093.542] CloseHandle (hObject=0x1fc) returned 1 [0093.544] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.544] SetEndOfFile (hFile=0x158) returned 1 [0093.545] CloseHandle (hObject=0x158) returned 1 [0093.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0093.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.545] lstrlenW (lpString=".doc") returned 4 [0093.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.545] lstrlenW (lpString=".docx") returned 5 [0093.545] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0093.545] lstrlenW (lpString=".pdf") returned 4 [0093.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.545] lstrlenW (lpString=".xls") returned 4 [0093.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.545] lstrlenW (lpString=".xlsx") returned 5 [0093.545] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0093.546] lstrlenW (lpString=".ppt") returned 4 [0093.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.546] lstrlenW (lpString=".zip") returned 4 [0093.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.546] lstrlenW (lpString=".rar") returned 4 [0093.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.546] lstrlenW (lpString=".bz2") returned 4 [0093.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.546] lstrlenW (lpString=".7z") returned 3 [0093.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.546] lstrlenW (lpString=".dbf") returned 4 [0093.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.546] lstrlenW (lpString=".1cd") returned 4 [0093.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0093.546] lstrlenW (lpString=".jpg") returned 4 [0093.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.546] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") [0093.547] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10776) returned 1 [0093.547] CloseHandle (hObject=0x158) returned 1 [0093.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 0x20 [0093.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.547] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.547] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.548] GetLastError () returned 0x0 [0093.548] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a18, lpOverlapped=0x0) returned 1 [0093.752] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a20, lpOverlapped=0x0) returned 1 [0093.773] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.773] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.773] SetEndOfFile (hFile=0x1fc) returned 1 [0093.773] CloseHandle (hObject=0x1fc) returned 1 [0093.773] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.774] SetEndOfFile (hFile=0x158) returned 1 [0093.774] CloseHandle (hObject=0x158) returned 1 [0093.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0093.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0093.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0093.984] lstrlenW (lpString=".doc") returned 4 [0093.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.984] lstrlenW (lpString=".docx") returned 5 [0093.984] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.984] lstrlenW (lpString=".pdf") returned 4 [0093.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.984] lstrlenW (lpString=".xls") returned 4 [0093.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.991] lstrlenW (lpString=".xlsx") returned 5 [0093.991] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.991] lstrlenW (lpString=".ppt") returned 4 [0093.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0093.997] lstrlenW (lpString=".zip") returned 4 [0093.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.997] lstrlenW (lpString=".rar") returned 4 [0093.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".bz2") returned 4 [0093.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".7z") returned 3 [0093.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0093.997] lstrlenW (lpString=".dbf") returned 4 [0094.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0094.005] lstrlenW (lpString=".1cd") returned 4 [0094.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0094.005] lstrlenW (lpString=".jpg") returned 4 [0094.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.013] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") [0094.014] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9676) returned 1 [0094.014] CloseHandle (hObject=0x1c0) returned 1 [0094.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 0x20 [0094.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.014] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.014] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.015] GetLastError () returned 0x0 [0094.015] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x25cc, lpOverlapped=0x0) returned 1 [0094.017] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0094.018] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.018] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.018] SetEndOfFile (hFile=0x150) returned 1 [0094.018] CloseHandle (hObject=0x150) returned 1 [0094.018] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.018] SetEndOfFile (hFile=0x1c0) returned 1 [0094.019] CloseHandle (hObject=0x1c0) returned 1 [0094.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0094.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString=".doc") returned 4 [0094.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString=".docx") returned 5 [0094.020] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.020] lstrlenW (lpString=".pdf") returned 4 [0094.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString=".xls") returned 4 [0094.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.020] lstrlenW (lpString=".xlsx") returned 5 [0094.020] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.020] lstrlenW (lpString=".ppt") returned 4 [0094.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString=".zip") returned 4 [0094.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.020] lstrlenW (lpString=".rar") returned 4 [0094.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString=".bz2") returned 4 [0094.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString=".7z") returned 3 [0094.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString=".dbf") returned 4 [0094.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString=".1cd") returned 4 [0094.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0094.020] lstrlenW (lpString=".jpg") returned 4 [0094.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.020] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") [0094.021] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6554) returned 1 [0094.021] CloseHandle (hObject=0x1c0) returned 1 [0094.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 0x20 [0094.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.021] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.021] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.022] GetLastError () returned 0x0 [0094.022] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x199a, lpOverlapped=0x0) returned 1 [0094.024] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x19a0, lpOverlapped=0x0) returned 1 [0094.024] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.025] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.025] SetEndOfFile (hFile=0x150) returned 1 [0094.025] CloseHandle (hObject=0x150) returned 1 [0094.025] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.025] SetEndOfFile (hFile=0x1c0) returned 1 [0094.026] CloseHandle (hObject=0x1c0) returned 1 [0094.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.026] lstrlenW (lpString=".doc") returned 4 [0094.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".docx") returned 5 [0094.026] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.026] lstrlenW (lpString=".pdf") returned 4 [0094.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".xls") returned 4 [0094.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.026] lstrlenW (lpString=".xlsx") returned 5 [0094.026] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.026] lstrlenW (lpString=".ppt") returned 4 [0094.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.027] lstrlenW (lpString=".zip") returned 4 [0094.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.027] lstrlenW (lpString=".rar") returned 4 [0094.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString=".bz2") returned 4 [0094.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString=".7z") returned 3 [0094.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.027] lstrlenW (lpString=".dbf") returned 4 [0094.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.027] lstrlenW (lpString=".1cd") returned 4 [0094.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0094.027] lstrlenW (lpString=".jpg") returned 4 [0094.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.027] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") [0094.028] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2060) returned 1 [0094.028] CloseHandle (hObject=0x1c0) returned 1 [0094.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 0x20 [0094.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.028] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.028] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.029] GetLastError () returned 0x0 [0094.029] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x80c, lpOverlapped=0x0) returned 1 [0094.030] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x810, lpOverlapped=0x0) returned 1 [0094.031] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.031] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.031] SetEndOfFile (hFile=0x150) returned 1 [0094.032] CloseHandle (hObject=0x150) returned 1 [0094.032] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.032] SetEndOfFile (hFile=0x1c0) returned 1 [0094.033] CloseHandle (hObject=0x1c0) returned 1 [0094.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 1 [0094.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.033] lstrlenW (lpString=".doc") returned 4 [0094.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.033] lstrlenW (lpString=".docx") returned 5 [0094.033] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.033] lstrlenW (lpString=".pdf") returned 4 [0094.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.033] lstrlenW (lpString=".xls") returned 4 [0094.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.033] lstrlenW (lpString=".xlsx") returned 5 [0094.033] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.034] lstrlenW (lpString=".ppt") returned 4 [0094.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.034] lstrlenW (lpString=".zip") returned 4 [0094.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.034] lstrlenW (lpString=".rar") returned 4 [0094.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".bz2") returned 4 [0094.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".7z") returned 3 [0094.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.034] lstrlenW (lpString=".dbf") returned 4 [0094.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.034] lstrlenW (lpString=".1cd") returned 4 [0094.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0094.034] lstrlenW (lpString=".jpg") returned 4 [0094.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.034] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") [0094.035] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7498) returned 1 [0094.035] CloseHandle (hObject=0x1c0) returned 1 [0094.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 0x20 [0094.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.035] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.035] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.036] GetLastError () returned 0x0 [0094.036] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1d4a, lpOverlapped=0x0) returned 1 [0094.037] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0094.038] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.038] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.038] SetEndOfFile (hFile=0x150) returned 1 [0094.038] CloseHandle (hObject=0x150) returned 1 [0094.039] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.039] SetEndOfFile (hFile=0x1c0) returned 1 [0094.039] CloseHandle (hObject=0x1c0) returned 1 [0094.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0094.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.040] lstrlenW (lpString=".doc") returned 4 [0094.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.040] lstrlenW (lpString=".docx") returned 5 [0094.040] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.040] lstrlenW (lpString=".pdf") returned 4 [0094.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.040] lstrlenW (lpString=".xls") returned 4 [0094.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.040] lstrlenW (lpString=".xlsx") returned 5 [0094.040] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.040] lstrlenW (lpString=".ppt") returned 4 [0094.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.040] lstrlenW (lpString=".zip") returned 4 [0094.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.040] lstrlenW (lpString=".rar") returned 4 [0094.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.040] lstrlenW (lpString=".bz2") returned 4 [0094.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.040] lstrlenW (lpString=".7z") returned 3 [0094.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.040] lstrlenW (lpString=".dbf") returned 4 [0094.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.041] lstrlenW (lpString=".1cd") returned 4 [0094.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0094.041] lstrlenW (lpString=".jpg") returned 4 [0094.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.041] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") [0094.041] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2652) returned 1 [0094.041] CloseHandle (hObject=0x1c0) returned 1 [0094.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 0x20 [0094.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.042] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.042] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.042] GetLastError () returned 0x0 [0094.042] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa5c, lpOverlapped=0x0) returned 1 [0094.044] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0094.044] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.045] WriteFile (in: hFile=0x150, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.045] SetEndOfFile (hFile=0x150) returned 1 [0094.045] CloseHandle (hObject=0x150) returned 1 [0094.045] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.045] SetEndOfFile (hFile=0x1c0) returned 1 [0094.046] CloseHandle (hObject=0x1c0) returned 1 [0094.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0094.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.046] lstrlenW (lpString=".doc") returned 4 [0094.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.046] lstrlenW (lpString=".docx") returned 5 [0094.046] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.046] lstrlenW (lpString=".pdf") returned 4 [0094.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.046] lstrlenW (lpString=".xls") returned 4 [0094.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.046] lstrlenW (lpString=".xlsx") returned 5 [0094.046] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.046] lstrlenW (lpString=".ppt") returned 4 [0094.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.047] lstrlenW (lpString=".zip") returned 4 [0094.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.047] lstrlenW (lpString=".rar") returned 4 [0094.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.047] lstrlenW (lpString=".bz2") returned 4 [0094.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.047] lstrlenW (lpString=".7z") returned 3 [0094.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.047] lstrlenW (lpString=".dbf") returned 4 [0094.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.047] lstrlenW (lpString=".1cd") returned 4 [0094.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0094.047] lstrlenW (lpString=".jpg") returned 4 [0094.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.047] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") [0094.203] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3840) returned 1 [0094.203] CloseHandle (hObject=0x1c0) returned 1 [0094.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 0x20 [0094.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.203] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.204] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.397] GetLastError () returned 0x0 [0094.397] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf00, lpOverlapped=0x0) returned 1 [0094.432] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf10, lpOverlapped=0x0) returned 1 [0094.434] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.434] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.434] SetEndOfFile (hFile=0x158) returned 1 [0094.434] CloseHandle (hObject=0x158) returned 1 [0094.434] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.434] SetEndOfFile (hFile=0x1c0) returned 1 [0094.435] CloseHandle (hObject=0x1c0) returned 1 [0094.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0094.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.435] lstrlenW (lpString=".doc") returned 4 [0094.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString=".docx") returned 5 [0094.436] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.436] lstrlenW (lpString=".pdf") returned 4 [0094.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString=".xls") returned 4 [0094.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.436] lstrlenW (lpString=".xlsx") returned 5 [0094.436] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.436] lstrlenW (lpString=".ppt") returned 4 [0094.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.436] lstrlenW (lpString=".zip") returned 4 [0094.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.436] lstrlenW (lpString=".rar") returned 4 [0094.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString=".bz2") returned 4 [0094.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString=".7z") returned 3 [0094.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.436] lstrlenW (lpString=".dbf") returned 4 [0094.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.436] lstrlenW (lpString=".1cd") returned 4 [0094.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0094.436] lstrlenW (lpString=".jpg") returned 4 [0094.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.436] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") [0094.437] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=42120) returned 1 [0094.437] CloseHandle (hObject=0x1c0) returned 1 [0094.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 0x20 [0094.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.437] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.438] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.438] GetLastError () returned 0x0 [0094.438] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa488, lpOverlapped=0x0) returned 1 [0094.486] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa490, lpOverlapped=0x0) returned 1 [0094.488] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.488] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.488] SetEndOfFile (hFile=0x158) returned 1 [0094.488] CloseHandle (hObject=0x158) returned 1 [0094.488] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.488] SetEndOfFile (hFile=0x1c0) returned 1 [0094.489] CloseHandle (hObject=0x1c0) returned 1 [0094.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 1 [0094.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.490] lstrlenW (lpString=".doc") returned 4 [0094.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.490] lstrlenW (lpString=".docx") returned 5 [0094.490] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.490] lstrlenW (lpString=".pdf") returned 4 [0094.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.490] lstrlenW (lpString=".xls") returned 4 [0094.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.490] lstrlenW (lpString=".xlsx") returned 5 [0094.490] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.490] lstrlenW (lpString=".ppt") returned 4 [0094.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.490] lstrlenW (lpString=".zip") returned 4 [0094.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.490] lstrlenW (lpString=".rar") returned 4 [0094.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.490] lstrlenW (lpString=".bz2") returned 4 [0094.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.491] lstrlenW (lpString=".7z") returned 3 [0094.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.491] lstrlenW (lpString=".dbf") returned 4 [0094.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.491] lstrlenW (lpString=".1cd") returned 4 [0094.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0094.491] lstrlenW (lpString=".jpg") returned 4 [0094.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.491] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") [0094.492] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8006) returned 1 [0094.492] CloseHandle (hObject=0x1c0) returned 1 [0094.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 0x20 [0094.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.492] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.492] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.493] GetLastError () returned 0x0 [0094.493] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1f46, lpOverlapped=0x0) returned 1 [0094.513] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0094.514] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.514] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.514] SetEndOfFile (hFile=0x158) returned 1 [0094.514] CloseHandle (hObject=0x158) returned 1 [0094.514] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.514] SetEndOfFile (hFile=0x1c0) returned 1 [0094.515] CloseHandle (hObject=0x1c0) returned 1 [0094.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.516] lstrlenW (lpString=".doc") returned 4 [0094.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.516] lstrlenW (lpString=".docx") returned 5 [0094.516] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.516] lstrlenW (lpString=".pdf") returned 4 [0094.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.516] lstrlenW (lpString=".xls") returned 4 [0094.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.516] lstrlenW (lpString=".xlsx") returned 5 [0094.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.516] lstrlenW (lpString=".ppt") returned 4 [0094.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.516] lstrlenW (lpString=".zip") returned 4 [0094.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.516] lstrlenW (lpString=".rar") returned 4 [0094.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.516] lstrlenW (lpString=".bz2") returned 4 [0094.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.517] lstrlenW (lpString=".7z") returned 3 [0094.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.517] lstrlenW (lpString=".dbf") returned 4 [0094.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.517] lstrlenW (lpString=".1cd") returned 4 [0094.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0094.517] lstrlenW (lpString=".jpg") returned 4 [0094.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.517] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") [0094.759] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=39738) returned 1 [0094.759] CloseHandle (hObject=0x1ec) returned 1 [0094.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 0x20 [0094.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.759] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.759] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.760] GetLastError () returned 0x0 [0094.760] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9b3a, lpOverlapped=0x0) returned 1 [0094.763] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9b40, lpOverlapped=0x0) returned 1 [0094.764] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.764] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.764] SetEndOfFile (hFile=0x210) returned 1 [0094.764] CloseHandle (hObject=0x210) returned 1 [0094.764] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.764] SetEndOfFile (hFile=0x1ec) returned 1 [0094.766] CloseHandle (hObject=0x1ec) returned 1 [0094.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 1 [0094.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.766] lstrlenW (lpString=".doc") returned 4 [0094.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.766] lstrlenW (lpString=".docx") returned 5 [0094.766] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0094.766] lstrlenW (lpString=".pdf") returned 4 [0094.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.766] lstrlenW (lpString=".xls") returned 4 [0094.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.766] lstrlenW (lpString=".xlsx") returned 5 [0094.766] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0094.766] lstrlenW (lpString=".ppt") returned 4 [0094.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.767] lstrlenW (lpString=".zip") returned 4 [0094.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.767] lstrlenW (lpString=".rar") returned 4 [0094.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.767] lstrlenW (lpString=".bz2") returned 4 [0094.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.767] lstrlenW (lpString=".7z") returned 3 [0094.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.767] lstrlenW (lpString=".dbf") returned 4 [0094.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.767] lstrlenW (lpString=".1cd") returned 4 [0094.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0094.767] lstrlenW (lpString=".jpg") returned 4 [0094.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.767] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") [0094.768] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14346) returned 1 [0094.768] CloseHandle (hObject=0x1ec) returned 1 [0094.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 0x20 [0094.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.768] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.768] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.770] GetLastError () returned 0x0 [0094.770] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x380a, lpOverlapped=0x0) returned 1 [0094.773] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3810, lpOverlapped=0x0) returned 1 [0094.774] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.774] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.774] SetEndOfFile (hFile=0x210) returned 1 [0094.774] CloseHandle (hObject=0x210) returned 1 [0094.774] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.774] SetEndOfFile (hFile=0x1ec) returned 1 [0094.775] CloseHandle (hObject=0x1ec) returned 1 [0094.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 1 [0094.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.775] lstrlenW (lpString=".doc") returned 4 [0094.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.775] lstrlenW (lpString=".docx") returned 5 [0094.775] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.775] lstrlenW (lpString=".pdf") returned 4 [0094.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString=".xls") returned 4 [0094.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.776] lstrlenW (lpString=".xlsx") returned 5 [0094.776] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.776] lstrlenW (lpString=".ppt") returned 4 [0094.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.776] lstrlenW (lpString=".zip") returned 4 [0094.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.776] lstrlenW (lpString=".rar") returned 4 [0094.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString=".bz2") returned 4 [0094.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString=".7z") returned 3 [0094.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.776] lstrlenW (lpString=".dbf") returned 4 [0094.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.776] lstrlenW (lpString=".1cd") returned 4 [0094.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0094.776] lstrlenW (lpString=".jpg") returned 4 [0094.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.776] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") [0094.777] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=35228) returned 1 [0094.777] CloseHandle (hObject=0x1ec) returned 1 [0094.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 0x20 [0094.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.777] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.777] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.778] GetLastError () returned 0x0 [0094.778] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x899c, lpOverlapped=0x0) returned 1 [0094.912] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x89a0, lpOverlapped=0x0) returned 1 [0094.913] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.913] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.913] SetEndOfFile (hFile=0x210) returned 1 [0094.913] CloseHandle (hObject=0x210) returned 1 [0094.913] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.913] SetEndOfFile (hFile=0x1ec) returned 1 [0094.914] CloseHandle (hObject=0x1ec) returned 1 [0094.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 1 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString=".doc") returned 4 [0094.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString=".docx") returned 5 [0094.915] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0094.915] lstrlenW (lpString=".pdf") returned 4 [0094.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString=".xls") returned 4 [0094.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.915] lstrlenW (lpString=".xlsx") returned 5 [0094.915] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0094.915] lstrlenW (lpString=".ppt") returned 4 [0094.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString=".zip") returned 4 [0094.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.915] lstrlenW (lpString=".rar") returned 4 [0094.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString=".bz2") returned 4 [0094.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString=".7z") returned 3 [0094.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString=".dbf") returned 4 [0094.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString=".1cd") returned 4 [0094.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 63 [0094.915] lstrlenW (lpString=".jpg") returned 4 [0094.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.916] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") [0094.916] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5048) returned 1 [0094.916] CloseHandle (hObject=0x1ec) returned 1 [0094.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 0x20 [0094.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.917] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.917] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.917] GetLastError () returned 0x0 [0094.917] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13b8, lpOverlapped=0x0) returned 1 [0094.919] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13c0, lpOverlapped=0x0) returned 1 [0094.920] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.920] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.920] SetEndOfFile (hFile=0x210) returned 1 [0094.920] CloseHandle (hObject=0x210) returned 1 [0094.920] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.920] SetEndOfFile (hFile=0x1ec) returned 1 [0094.921] CloseHandle (hObject=0x1ec) returned 1 [0094.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 1 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString=".doc") returned 4 [0094.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString=".docx") returned 5 [0094.922] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.922] lstrlenW (lpString=".pdf") returned 4 [0094.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString=".xls") returned 4 [0094.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.922] lstrlenW (lpString=".xlsx") returned 5 [0094.922] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.922] lstrlenW (lpString=".ppt") returned 4 [0094.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString=".zip") returned 4 [0094.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.922] lstrlenW (lpString=".rar") returned 4 [0094.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString=".bz2") returned 4 [0094.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString=".7z") returned 3 [0094.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString=".dbf") returned 4 [0094.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString=".1cd") returned 4 [0094.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 63 [0094.922] lstrlenW (lpString=".jpg") returned 4 [0094.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.923] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") [0094.923] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4740) returned 1 [0094.923] CloseHandle (hObject=0x1ec) returned 1 [0094.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 0x20 [0094.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.923] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.923] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.924] GetLastError () returned 0x0 [0094.924] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1284, lpOverlapped=0x0) returned 1 [0094.926] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1290, lpOverlapped=0x0) returned 1 [0094.927] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.927] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.927] SetEndOfFile (hFile=0x210) returned 1 [0094.927] CloseHandle (hObject=0x210) returned 1 [0094.927] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.927] SetEndOfFile (hFile=0x1ec) returned 1 [0094.928] CloseHandle (hObject=0x1ec) returned 1 [0094.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.928] lstrlenW (lpString=".doc") returned 4 [0094.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".docx") returned 5 [0094.928] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0094.928] lstrlenW (lpString=".pdf") returned 4 [0094.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".xls") returned 4 [0094.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.928] lstrlenW (lpString=".xlsx") returned 5 [0094.928] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0094.928] lstrlenW (lpString=".ppt") returned 4 [0094.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.928] lstrlenW (lpString=".zip") returned 4 [0094.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.929] lstrlenW (lpString=".rar") returned 4 [0094.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".bz2") returned 4 [0094.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".7z") returned 3 [0094.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.929] lstrlenW (lpString=".dbf") returned 4 [0094.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.929] lstrlenW (lpString=".1cd") returned 4 [0094.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 63 [0094.929] lstrlenW (lpString=".jpg") returned 4 [0094.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.929] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") [0094.930] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5884) returned 1 [0094.930] CloseHandle (hObject=0x1ec) returned 1 [0094.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 0x20 [0094.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.930] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.930] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.930] GetLastError () returned 0x0 [0094.931] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0094.936] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0094.947] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.948] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.950] SetEndOfFile (hFile=0x210) returned 1 [0094.950] CloseHandle (hObject=0x210) returned 1 [0094.952] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.952] SetEndOfFile (hFile=0x1ec) returned 1 [0094.953] CloseHandle (hObject=0x1ec) returned 1 [0094.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.953] lstrlenW (lpString=".doc") returned 4 [0094.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.953] lstrlenW (lpString=".docx") returned 5 [0094.953] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.953] lstrlenW (lpString=".pdf") returned 4 [0094.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.953] lstrlenW (lpString=".xls") returned 4 [0094.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.953] lstrlenW (lpString=".xlsx") returned 5 [0094.953] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.953] lstrlenW (lpString=".ppt") returned 4 [0094.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.953] lstrlenW (lpString=".zip") returned 4 [0094.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.953] lstrlenW (lpString=".rar") returned 4 [0094.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.954] lstrlenW (lpString=".bz2") returned 4 [0094.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.954] lstrlenW (lpString=".7z") returned 3 [0094.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.954] lstrlenW (lpString=".dbf") returned 4 [0094.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.954] lstrlenW (lpString=".1cd") returned 4 [0094.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 63 [0094.954] lstrlenW (lpString=".jpg") returned 4 [0094.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.954] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") [0094.955] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4756) returned 1 [0094.955] CloseHandle (hObject=0x1ec) returned 1 [0094.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 0x20 [0094.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.955] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.955] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.956] GetLastError () returned 0x0 [0094.956] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1294, lpOverlapped=0x0) returned 1 [0094.957] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x12a0, lpOverlapped=0x0) returned 1 [0094.958] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.958] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.958] SetEndOfFile (hFile=0x210) returned 1 [0094.958] CloseHandle (hObject=0x210) returned 1 [0094.958] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.958] SetEndOfFile (hFile=0x1ec) returned 1 [0094.959] CloseHandle (hObject=0x1ec) returned 1 [0094.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 1 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString=".doc") returned 4 [0094.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString=".docx") returned 5 [0094.960] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.960] lstrlenW (lpString=".pdf") returned 4 [0094.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString=".xls") returned 4 [0094.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.960] lstrlenW (lpString=".xlsx") returned 5 [0094.960] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.960] lstrlenW (lpString=".ppt") returned 4 [0094.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString=".zip") returned 4 [0094.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.960] lstrlenW (lpString=".rar") returned 4 [0094.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString=".bz2") returned 4 [0094.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString=".7z") returned 3 [0094.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString=".dbf") returned 4 [0094.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString=".1cd") returned 4 [0094.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 63 [0094.960] lstrlenW (lpString=".jpg") returned 4 [0094.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.961] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") [0094.961] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5220) returned 1 [0094.962] CloseHandle (hObject=0x1ec) returned 1 [0094.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 0x20 [0094.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.962] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.962] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.962] GetLastError () returned 0x0 [0094.962] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1464, lpOverlapped=0x0) returned 1 [0095.075] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1470, lpOverlapped=0x0) returned 1 [0095.076] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.076] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.077] SetEndOfFile (hFile=0x210) returned 1 [0095.077] CloseHandle (hObject=0x210) returned 1 [0095.077] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.077] SetEndOfFile (hFile=0x1ec) returned 1 [0095.078] CloseHandle (hObject=0x1ec) returned 1 [0095.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 1 [0095.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.078] lstrlenW (lpString=".doc") returned 4 [0095.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.078] lstrlenW (lpString=".docx") returned 5 [0095.078] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0095.078] lstrlenW (lpString=".pdf") returned 4 [0095.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.078] lstrlenW (lpString=".xls") returned 4 [0095.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.078] lstrlenW (lpString=".xlsx") returned 5 [0095.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0095.078] lstrlenW (lpString=".ppt") returned 4 [0095.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.079] lstrlenW (lpString=".zip") returned 4 [0095.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.079] lstrlenW (lpString=".rar") returned 4 [0095.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.079] lstrlenW (lpString=".bz2") returned 4 [0095.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.079] lstrlenW (lpString=".7z") returned 3 [0095.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.079] lstrlenW (lpString=".dbf") returned 4 [0095.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.079] lstrlenW (lpString=".1cd") returned 4 [0095.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 63 [0095.079] lstrlenW (lpString=".jpg") returned 4 [0095.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.079] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") [0095.080] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2350) returned 1 [0095.080] CloseHandle (hObject=0x1ec) returned 1 [0095.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 0x20 [0095.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.080] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.080] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.081] GetLastError () returned 0x0 [0095.081] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x92e, lpOverlapped=0x0) returned 1 [0095.082] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x930, lpOverlapped=0x0) returned 1 [0095.083] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.083] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.083] SetEndOfFile (hFile=0x210) returned 1 [0095.083] CloseHandle (hObject=0x210) returned 1 [0095.083] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.084] SetEndOfFile (hFile=0x1ec) returned 1 [0095.084] CloseHandle (hObject=0x1ec) returned 1 [0095.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 1 [0095.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.085] lstrlenW (lpString=".doc") returned 4 [0095.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString=".docx") returned 5 [0095.085] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.085] lstrlenW (lpString=".pdf") returned 4 [0095.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString=".xls") returned 4 [0095.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.085] lstrlenW (lpString=".xlsx") returned 5 [0095.085] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.085] lstrlenW (lpString=".ppt") returned 4 [0095.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.085] lstrlenW (lpString=".zip") returned 4 [0095.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.085] lstrlenW (lpString=".rar") returned 4 [0095.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString=".bz2") returned 4 [0095.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString=".7z") returned 3 [0095.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.085] lstrlenW (lpString=".dbf") returned 4 [0095.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.085] lstrlenW (lpString=".1cd") returned 4 [0095.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 63 [0095.086] lstrlenW (lpString=".jpg") returned 4 [0095.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.086] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") [0095.086] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2638) returned 1 [0095.086] CloseHandle (hObject=0x1ec) returned 1 [0095.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 0x20 [0095.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.087] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.087] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.087] GetLastError () returned 0x0 [0095.087] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa4e, lpOverlapped=0x0) returned 1 [0095.089] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0095.090] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.090] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.090] SetEndOfFile (hFile=0x210) returned 1 [0095.090] CloseHandle (hObject=0x210) returned 1 [0095.090] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.090] SetEndOfFile (hFile=0x1ec) returned 1 [0095.091] CloseHandle (hObject=0x1ec) returned 1 [0095.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 1 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString=".doc") returned 4 [0095.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString=".docx") returned 5 [0095.092] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.092] lstrlenW (lpString=".pdf") returned 4 [0095.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString=".xls") returned 4 [0095.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.092] lstrlenW (lpString=".xlsx") returned 5 [0095.092] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.092] lstrlenW (lpString=".ppt") returned 4 [0095.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString=".zip") returned 4 [0095.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.092] lstrlenW (lpString=".rar") returned 4 [0095.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString=".bz2") returned 4 [0095.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString=".7z") returned 3 [0095.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString=".dbf") returned 4 [0095.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString=".1cd") returned 4 [0095.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 63 [0095.092] lstrlenW (lpString=".jpg") returned 4 [0095.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.093] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") [0095.093] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2342) returned 1 [0095.093] CloseHandle (hObject=0x1ec) returned 1 [0095.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 0x20 [0095.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.093] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.093] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.094] GetLastError () returned 0x0 [0095.094] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x926, lpOverlapped=0x0) returned 1 [0095.096] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x930, lpOverlapped=0x0) returned 1 [0095.097] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.097] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.097] SetEndOfFile (hFile=0x210) returned 1 [0095.097] CloseHandle (hObject=0x210) returned 1 [0095.097] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.097] SetEndOfFile (hFile=0x1ec) returned 1 [0095.098] CloseHandle (hObject=0x1ec) returned 1 [0095.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 1 [0095.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.098] lstrlenW (lpString=".doc") returned 4 [0095.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.098] lstrlenW (lpString=".docx") returned 5 [0095.098] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0095.098] lstrlenW (lpString=".pdf") returned 4 [0095.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.098] lstrlenW (lpString=".xls") returned 4 [0095.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.098] lstrlenW (lpString=".xlsx") returned 5 [0095.098] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0095.098] lstrlenW (lpString=".ppt") returned 4 [0095.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.099] lstrlenW (lpString=".zip") returned 4 [0095.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.099] lstrlenW (lpString=".rar") returned 4 [0095.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.099] lstrlenW (lpString=".bz2") returned 4 [0095.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.099] lstrlenW (lpString=".7z") returned 3 [0095.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.099] lstrlenW (lpString=".dbf") returned 4 [0095.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.099] lstrlenW (lpString=".1cd") returned 4 [0095.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 63 [0095.099] lstrlenW (lpString=".jpg") returned 4 [0095.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.099] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") [0095.100] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2738) returned 1 [0095.100] CloseHandle (hObject=0x1ec) returned 1 [0095.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 0x20 [0095.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.100] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.100] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.100] GetLastError () returned 0x0 [0095.101] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xab2, lpOverlapped=0x0) returned 1 [0095.102] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xac0, lpOverlapped=0x0) returned 1 [0095.103] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.103] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.103] SetEndOfFile (hFile=0x210) returned 1 [0095.103] CloseHandle (hObject=0x210) returned 1 [0095.103] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.103] SetEndOfFile (hFile=0x1ec) returned 1 [0095.104] CloseHandle (hObject=0x1ec) returned 1 [0095.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 1 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString=".doc") returned 4 [0095.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString=".docx") returned 5 [0095.105] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0095.105] lstrlenW (lpString=".pdf") returned 4 [0095.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString=".xls") returned 4 [0095.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.105] lstrlenW (lpString=".xlsx") returned 5 [0095.105] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0095.105] lstrlenW (lpString=".ppt") returned 4 [0095.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString=".zip") returned 4 [0095.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.105] lstrlenW (lpString=".rar") returned 4 [0095.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString=".bz2") returned 4 [0095.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString=".7z") returned 3 [0095.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString=".dbf") returned 4 [0095.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString=".1cd") returned 4 [0095.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 63 [0095.105] lstrlenW (lpString=".jpg") returned 4 [0095.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.106] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") [0095.106] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2090) returned 1 [0095.106] CloseHandle (hObject=0x1ec) returned 1 [0095.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 0x20 [0095.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.106] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.106] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.107] GetLastError () returned 0x0 [0095.107] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x82a, lpOverlapped=0x0) returned 1 [0095.108] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x830, lpOverlapped=0x0) returned 1 [0095.109] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.110] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.110] SetEndOfFile (hFile=0x210) returned 1 [0095.110] CloseHandle (hObject=0x210) returned 1 [0095.110] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.110] SetEndOfFile (hFile=0x1ec) returned 1 [0095.111] CloseHandle (hObject=0x1ec) returned 1 [0095.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 1 [0095.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.111] lstrlenW (lpString=".doc") returned 4 [0095.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.111] lstrlenW (lpString=".docx") returned 5 [0095.111] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.111] lstrlenW (lpString=".pdf") returned 4 [0095.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.111] lstrlenW (lpString=".xls") returned 4 [0095.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.111] lstrlenW (lpString=".xlsx") returned 5 [0095.111] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.111] lstrlenW (lpString=".ppt") returned 4 [0095.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.111] lstrlenW (lpString=".zip") returned 4 [0095.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.111] lstrlenW (lpString=".rar") returned 4 [0095.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.112] lstrlenW (lpString=".bz2") returned 4 [0095.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.112] lstrlenW (lpString=".7z") returned 3 [0095.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.112] lstrlenW (lpString=".dbf") returned 4 [0095.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.112] lstrlenW (lpString=".1cd") returned 4 [0095.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 63 [0095.112] lstrlenW (lpString=".jpg") returned 4 [0095.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.112] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") [0095.251] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3262) returned 1 [0095.251] CloseHandle (hObject=0x180) returned 1 [0095.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 0x20 [0095.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.253] GetLastError () returned 0x0 [0095.253] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xcbe, lpOverlapped=0x0) returned 1 [0095.255] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0095.255] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.255] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.256] SetEndOfFile (hFile=0x22c) returned 1 [0095.256] CloseHandle (hObject=0x22c) returned 1 [0095.256] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.256] SetEndOfFile (hFile=0x180) returned 1 [0095.257] CloseHandle (hObject=0x180) returned 1 [0095.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 1 [0095.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.257] lstrlenW (lpString=".doc") returned 4 [0095.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.257] lstrlenW (lpString=".docx") returned 5 [0095.257] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0095.257] lstrlenW (lpString=".pdf") returned 4 [0095.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.257] lstrlenW (lpString=".xls") returned 4 [0095.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.257] lstrlenW (lpString=".xlsx") returned 5 [0095.257] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0095.257] lstrlenW (lpString=".ppt") returned 4 [0095.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.257] lstrlenW (lpString=".zip") returned 4 [0095.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.257] lstrlenW (lpString=".rar") returned 4 [0095.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.258] lstrlenW (lpString=".bz2") returned 4 [0095.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.258] lstrlenW (lpString=".7z") returned 3 [0095.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.258] lstrlenW (lpString=".dbf") returned 4 [0095.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.258] lstrlenW (lpString=".1cd") returned 4 [0095.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 63 [0095.258] lstrlenW (lpString=".jpg") returned 4 [0095.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.258] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") [0095.258] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=69644) returned 1 [0095.258] CloseHandle (hObject=0x180) returned 1 [0095.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 0x20 [0095.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.259] GetLastError () returned 0x0 [0095.259] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1100c, lpOverlapped=0x0) returned 1 [0095.262] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x11010, lpOverlapped=0x0) returned 1 [0095.265] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.265] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.265] SetEndOfFile (hFile=0x22c) returned 1 [0095.265] CloseHandle (hObject=0x22c) returned 1 [0095.265] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.265] SetEndOfFile (hFile=0x180) returned 1 [0095.266] CloseHandle (hObject=0x180) returned 1 [0095.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 1 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString=".doc") returned 4 [0095.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString=".docx") returned 5 [0095.267] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.267] lstrlenW (lpString=".pdf") returned 4 [0095.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString=".xls") returned 4 [0095.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.267] lstrlenW (lpString=".xlsx") returned 5 [0095.267] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.267] lstrlenW (lpString=".ppt") returned 4 [0095.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString=".zip") returned 4 [0095.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.267] lstrlenW (lpString=".rar") returned 4 [0095.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString=".bz2") returned 4 [0095.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString=".7z") returned 3 [0095.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString=".dbf") returned 4 [0095.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString=".1cd") returned 4 [0095.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 63 [0095.267] lstrlenW (lpString=".jpg") returned 4 [0095.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.268] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") [0095.269] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2786) returned 1 [0095.269] CloseHandle (hObject=0x180) returned 1 [0095.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 0x20 [0095.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.269] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.269] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.270] GetLastError () returned 0x0 [0095.270] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xae2, lpOverlapped=0x0) returned 1 [0095.271] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0095.272] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.272] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.272] SetEndOfFile (hFile=0x22c) returned 1 [0095.272] CloseHandle (hObject=0x22c) returned 1 [0095.272] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.273] SetEndOfFile (hFile=0x180) returned 1 [0095.273] CloseHandle (hObject=0x180) returned 1 [0095.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.274] lstrlenW (lpString=".doc") returned 4 [0095.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString=".docx") returned 5 [0095.274] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.274] lstrlenW (lpString=".pdf") returned 4 [0095.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString=".xls") returned 4 [0095.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.274] lstrlenW (lpString=".xlsx") returned 5 [0095.274] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.274] lstrlenW (lpString=".ppt") returned 4 [0095.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.274] lstrlenW (lpString=".zip") returned 4 [0095.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.274] lstrlenW (lpString=".rar") returned 4 [0095.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString=".bz2") returned 4 [0095.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString=".7z") returned 3 [0095.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.274] lstrlenW (lpString=".dbf") returned 4 [0095.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.274] lstrlenW (lpString=".1cd") returned 4 [0095.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 63 [0095.275] lstrlenW (lpString=".jpg") returned 4 [0095.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.275] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") [0095.275] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3926) returned 1 [0095.275] CloseHandle (hObject=0x180) returned 1 [0095.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 0x20 [0095.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.275] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.276] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.276] GetLastError () returned 0x0 [0095.276] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf56, lpOverlapped=0x0) returned 1 [0095.280] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf60, lpOverlapped=0x0) returned 1 [0095.281] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.281] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.281] SetEndOfFile (hFile=0x22c) returned 1 [0095.282] CloseHandle (hObject=0x22c) returned 1 [0095.282] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.282] SetEndOfFile (hFile=0x180) returned 1 [0095.282] CloseHandle (hObject=0x180) returned 1 [0095.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 1 [0095.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.289] lstrlenW (lpString=".doc") returned 4 [0095.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.289] lstrlenW (lpString=".docx") returned 5 [0095.289] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.289] lstrlenW (lpString=".pdf") returned 4 [0095.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.289] lstrlenW (lpString=".xls") returned 4 [0095.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.289] lstrlenW (lpString=".xlsx") returned 5 [0095.289] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.289] lstrlenW (lpString=".ppt") returned 4 [0095.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.289] lstrlenW (lpString=".zip") returned 4 [0095.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.290] lstrlenW (lpString=".rar") returned 4 [0095.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.290] lstrlenW (lpString=".bz2") returned 4 [0095.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.290] lstrlenW (lpString=".7z") returned 3 [0095.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.290] lstrlenW (lpString=".dbf") returned 4 [0095.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.290] lstrlenW (lpString=".1cd") returned 4 [0095.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 63 [0095.290] lstrlenW (lpString=".jpg") returned 4 [0095.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.290] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") [0095.290] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3946) returned 1 [0095.291] CloseHandle (hObject=0x180) returned 1 [0095.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 0x20 [0095.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.291] GetLastError () returned 0x0 [0095.291] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf6a, lpOverlapped=0x0) returned 1 [0095.380] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0095.409] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.409] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.410] SetEndOfFile (hFile=0x22c) returned 1 [0095.410] CloseHandle (hObject=0x22c) returned 1 [0095.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.410] SetEndOfFile (hFile=0x180) returned 1 [0095.411] CloseHandle (hObject=0x180) returned 1 [0095.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 1 [0095.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.411] lstrlenW (lpString=".doc") returned 4 [0095.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.411] lstrlenW (lpString=".docx") returned 5 [0095.411] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.411] lstrlenW (lpString=".pdf") returned 4 [0095.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.411] lstrlenW (lpString=".xls") returned 4 [0095.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.411] lstrlenW (lpString=".xlsx") returned 5 [0095.411] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.412] lstrlenW (lpString=".ppt") returned 4 [0095.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.412] lstrlenW (lpString=".zip") returned 4 [0095.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.412] lstrlenW (lpString=".rar") returned 4 [0095.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.412] lstrlenW (lpString=".bz2") returned 4 [0095.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.412] lstrlenW (lpString=".7z") returned 3 [0095.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.412] lstrlenW (lpString=".dbf") returned 4 [0095.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.412] lstrlenW (lpString=".1cd") returned 4 [0095.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 63 [0095.412] lstrlenW (lpString=".jpg") returned 4 [0095.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.412] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") [0095.753] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=21054) returned 1 [0095.753] CloseHandle (hObject=0x15c) returned 1 [0095.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 0x20 [0095.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0095.753] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.753] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.754] GetLastError () returned 0x0 [0095.754] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x523e, lpOverlapped=0x0) returned 1 [0095.968] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5240, lpOverlapped=0x0) returned 1 [0095.969] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.969] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.970] SetEndOfFile (hFile=0x1fc) returned 1 [0095.970] CloseHandle (hObject=0x1fc) returned 1 [0095.970] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.970] SetEndOfFile (hFile=0x15c) returned 1 [0095.971] CloseHandle (hObject=0x15c) returned 1 [0095.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 1 [0095.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.971] lstrlenW (lpString=".doc") returned 4 [0095.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.971] lstrlenW (lpString=".docx") returned 5 [0095.971] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.971] lstrlenW (lpString=".pdf") returned 4 [0095.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.971] lstrlenW (lpString=".xls") returned 4 [0095.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.971] lstrlenW (lpString=".xlsx") returned 5 [0095.971] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.971] lstrlenW (lpString=".ppt") returned 4 [0095.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.971] lstrlenW (lpString=".zip") returned 4 [0095.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.972] lstrlenW (lpString=".rar") returned 4 [0095.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.972] lstrlenW (lpString=".bz2") returned 4 [0095.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.972] lstrlenW (lpString=".7z") returned 3 [0095.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.972] lstrlenW (lpString=".dbf") returned 4 [0095.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.972] lstrlenW (lpString=".1cd") returned 4 [0095.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 63 [0095.972] lstrlenW (lpString=".jpg") returned 4 [0095.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.972] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") [0095.973] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=35236) returned 1 [0095.973] CloseHandle (hObject=0x15c) returned 1 [0095.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 0x20 [0095.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0095.973] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.973] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.974] GetLastError () returned 0x0 [0095.974] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x89a4, lpOverlapped=0x0) returned 1 [0095.977] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x89b0, lpOverlapped=0x0) returned 1 [0095.978] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.978] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.978] SetEndOfFile (hFile=0x1fc) returned 1 [0095.978] CloseHandle (hObject=0x1fc) returned 1 [0095.978] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.978] SetEndOfFile (hFile=0x15c) returned 1 [0095.979] CloseHandle (hObject=0x15c) returned 1 [0095.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 1 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.980] lstrlenW (lpString=".doc") returned 4 [0095.980] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0095.980] lstrlenW (lpString=".docx") returned 5 [0095.980] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0095.980] lstrlenW (lpString=".pdf") returned 4 [0095.980] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0095.980] lstrlenW (lpString=".xls") returned 4 [0095.980] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0095.980] lstrlenW (lpString=".xlsx") returned 5 [0095.980] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0095.980] lstrlenW (lpString=".ppt") returned 4 [0095.980] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.980] lstrlenW (lpString=".zip") returned 4 [0095.980] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0095.980] lstrlenW (lpString=".rar") returned 4 [0095.980] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0095.980] lstrlenW (lpString=".bz2") returned 4 [0095.980] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0095.980] lstrlenW (lpString=".7z") returned 3 [0095.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.980] lstrlenW (lpString=".dbf") returned 4 [0095.980] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.980] lstrlenW (lpString=".1cd") returned 4 [0095.980] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0095.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 63 [0095.981] lstrlenW (lpString=".jpg") returned 4 [0095.981] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0095.981] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") [0095.981] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17105) returned 1 [0095.981] CloseHandle (hObject=0x15c) returned 1 [0095.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 0x20 [0095.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0095.981] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.982] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.982] GetLastError () returned 0x0 [0095.982] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x42d1, lpOverlapped=0x0) returned 1 [0095.984] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x42e0, lpOverlapped=0x0) returned 1 [0095.985] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.985] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.985] SetEndOfFile (hFile=0x1fc) returned 1 [0095.985] CloseHandle (hObject=0x1fc) returned 1 [0095.985] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.986] SetEndOfFile (hFile=0x15c) returned 1 [0095.986] CloseHandle (hObject=0x15c) returned 1 [0095.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 1 [0095.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.987] lstrlenW (lpString=".doc") returned 4 [0095.987] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0095.987] lstrlenW (lpString=".docx") returned 5 [0095.987] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0095.987] lstrlenW (lpString=".pdf") returned 4 [0095.987] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0095.987] lstrlenW (lpString=".xls") returned 4 [0095.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0095.987] lstrlenW (lpString=".xlsx") returned 5 [0095.987] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0095.987] lstrlenW (lpString=".ppt") returned 4 [0095.987] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0095.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.987] lstrlenW (lpString=".zip") returned 4 [0095.987] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0095.987] lstrlenW (lpString=".rar") returned 4 [0095.987] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0095.987] lstrlenW (lpString=".bz2") returned 4 [0095.987] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0095.987] lstrlenW (lpString=".7z") returned 3 [0095.987] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0095.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.987] lstrlenW (lpString=".dbf") returned 4 [0095.988] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0095.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.988] lstrlenW (lpString=".1cd") returned 4 [0095.988] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0095.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 63 [0095.988] lstrlenW (lpString=".jpg") returned 4 [0095.988] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0095.988] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") [0095.988] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16017) returned 1 [0095.988] CloseHandle (hObject=0x15c) returned 1 [0095.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 0x20 [0095.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0095.989] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.989] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.989] GetLastError () returned 0x0 [0095.989] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3e91, lpOverlapped=0x0) returned 1 [0095.991] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0095.992] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.992] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.992] SetEndOfFile (hFile=0x1fc) returned 1 [0095.992] CloseHandle (hObject=0x1fc) returned 1 [0095.992] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.992] SetEndOfFile (hFile=0x15c) returned 1 [0095.993] CloseHandle (hObject=0x15c) returned 1 [0095.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 1 [0095.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.994] lstrlenW (lpString=".doc") returned 4 [0095.994] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0095.994] lstrlenW (lpString=".docx") returned 5 [0095.994] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0095.994] lstrlenW (lpString=".pdf") returned 4 [0095.994] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0095.994] lstrlenW (lpString=".xls") returned 4 [0095.994] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0095.994] lstrlenW (lpString=".xlsx") returned 5 [0095.994] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0095.994] lstrlenW (lpString=".ppt") returned 4 [0095.994] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0095.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.994] lstrlenW (lpString=".zip") returned 4 [0095.994] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0095.994] lstrlenW (lpString=".rar") returned 4 [0095.994] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0095.994] lstrlenW (lpString=".bz2") returned 4 [0095.994] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0095.994] lstrlenW (lpString=".7z") returned 3 [0095.994] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0095.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.995] lstrlenW (lpString=".dbf") returned 4 [0095.995] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0095.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.995] lstrlenW (lpString=".1cd") returned 4 [0095.995] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0095.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 63 [0095.995] lstrlenW (lpString=".jpg") returned 4 [0095.995] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0095.995] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") [0095.995] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=17349) returned 1 [0095.995] CloseHandle (hObject=0x15c) returned 1 [0095.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 0x20 [0095.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0095.996] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.996] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.996] GetLastError () returned 0x0 [0095.996] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x43c5, lpOverlapped=0x0) returned 1 [0095.998] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0095.999] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.999] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.999] SetEndOfFile (hFile=0x1fc) returned 1 [0095.999] CloseHandle (hObject=0x1fc) returned 1 [0095.999] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.999] SetEndOfFile (hFile=0x15c) returned 1 [0096.000] CloseHandle (hObject=0x15c) returned 1 [0096.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 1 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString=".doc") returned 4 [0096.001] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0096.001] lstrlenW (lpString=".docx") returned 5 [0096.001] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0096.001] lstrlenW (lpString=".pdf") returned 4 [0096.001] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0096.001] lstrlenW (lpString=".xls") returned 4 [0096.001] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0096.001] lstrlenW (lpString=".xlsx") returned 5 [0096.001] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0096.001] lstrlenW (lpString=".ppt") returned 4 [0096.001] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString=".zip") returned 4 [0096.001] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0096.001] lstrlenW (lpString=".rar") returned 4 [0096.001] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0096.001] lstrlenW (lpString=".bz2") returned 4 [0096.001] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0096.001] lstrlenW (lpString=".7z") returned 3 [0096.001] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString=".dbf") returned 4 [0096.001] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString=".1cd") returned 4 [0096.001] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0096.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 63 [0096.001] lstrlenW (lpString=".jpg") returned 4 [0096.002] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0096.002] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") [0096.257] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=36230) returned 1 [0096.265] CloseHandle (hObject=0x1fc) returned 1 [0096.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 0x20 [0096.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.266] GetLastError () returned 0x0 [0096.266] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8d86, lpOverlapped=0x0) returned 1 [0096.273] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8d90, lpOverlapped=0x0) returned 1 [0096.275] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.275] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.275] SetEndOfFile (hFile=0x22c) returned 1 [0096.275] CloseHandle (hObject=0x22c) returned 1 [0096.275] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.275] SetEndOfFile (hFile=0x1fc) returned 1 [0096.276] CloseHandle (hObject=0x1fc) returned 1 [0096.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 1 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString=".doc") returned 4 [0096.277] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0096.277] lstrlenW (lpString=".docx") returned 5 [0096.277] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0096.277] lstrlenW (lpString=".pdf") returned 4 [0096.277] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0096.277] lstrlenW (lpString=".xls") returned 4 [0096.277] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0096.277] lstrlenW (lpString=".xlsx") returned 5 [0096.277] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0096.277] lstrlenW (lpString=".ppt") returned 4 [0096.277] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString=".zip") returned 4 [0096.277] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0096.277] lstrlenW (lpString=".rar") returned 4 [0096.277] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0096.277] lstrlenW (lpString=".bz2") returned 4 [0096.277] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0096.277] lstrlenW (lpString=".7z") returned 3 [0096.277] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString=".dbf") returned 4 [0096.277] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString=".1cd") returned 4 [0096.277] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0096.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 63 [0096.277] lstrlenW (lpString=".jpg") returned 4 [0096.278] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0096.278] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") [0096.279] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31398) returned 1 [0096.279] CloseHandle (hObject=0x1fc) returned 1 [0096.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 0x20 [0096.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.279] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.279] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.280] GetLastError () returned 0x0 [0096.280] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7aa6, lpOverlapped=0x0) returned 1 [0096.282] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7ab0, lpOverlapped=0x0) returned 1 [0096.283] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.283] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.283] SetEndOfFile (hFile=0x22c) returned 1 [0096.283] CloseHandle (hObject=0x22c) returned 1 [0096.284] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.284] SetEndOfFile (hFile=0x1fc) returned 1 [0096.285] CloseHandle (hObject=0x1fc) returned 1 [0096.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 1 [0096.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.285] lstrlenW (lpString=".doc") returned 4 [0096.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.285] lstrlenW (lpString=".docx") returned 5 [0096.285] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0096.285] lstrlenW (lpString=".pdf") returned 4 [0096.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.285] lstrlenW (lpString=".xls") returned 4 [0096.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.285] lstrlenW (lpString=".xlsx") returned 5 [0096.285] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0096.285] lstrlenW (lpString=".ppt") returned 4 [0096.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.285] lstrlenW (lpString=".zip") returned 4 [0096.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.285] lstrlenW (lpString=".rar") returned 4 [0096.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.285] lstrlenW (lpString=".bz2") returned 4 [0096.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.286] lstrlenW (lpString=".7z") returned 3 [0096.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.286] lstrlenW (lpString=".dbf") returned 4 [0096.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.286] lstrlenW (lpString=".1cd") returned 4 [0096.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 63 [0096.286] lstrlenW (lpString=".jpg") returned 4 [0096.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.286] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") [0096.286] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7012) returned 1 [0096.287] CloseHandle (hObject=0x1fc) returned 1 [0096.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 0x20 [0096.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.287] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.287] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.288] GetLastError () returned 0x0 [0096.288] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1b64, lpOverlapped=0x0) returned 1 [0096.289] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0096.290] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.290] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.290] SetEndOfFile (hFile=0x22c) returned 1 [0096.290] CloseHandle (hObject=0x22c) returned 1 [0096.290] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.290] SetEndOfFile (hFile=0x1fc) returned 1 [0096.291] CloseHandle (hObject=0x1fc) returned 1 [0096.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 1 [0096.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.292] lstrlenW (lpString=".doc") returned 4 [0096.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString=".docx") returned 5 [0096.292] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0096.292] lstrlenW (lpString=".pdf") returned 4 [0096.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString=".xls") returned 4 [0096.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.292] lstrlenW (lpString=".xlsx") returned 5 [0096.292] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0096.292] lstrlenW (lpString=".ppt") returned 4 [0096.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.292] lstrlenW (lpString=".zip") returned 4 [0096.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.292] lstrlenW (lpString=".rar") returned 4 [0096.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString=".bz2") returned 4 [0096.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString=".7z") returned 3 [0096.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.292] lstrlenW (lpString=".dbf") returned 4 [0096.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.292] lstrlenW (lpString=".1cd") returned 4 [0096.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 63 [0096.293] lstrlenW (lpString=".jpg") returned 4 [0096.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.293] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") [0096.294] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13912) returned 1 [0096.294] CloseHandle (hObject=0x1fc) returned 1 [0096.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 0x20 [0096.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.294] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.294] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.295] GetLastError () returned 0x0 [0096.295] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3658, lpOverlapped=0x0) returned 1 [0096.296] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3660, lpOverlapped=0x0) returned 1 [0096.298] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.298] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.298] SetEndOfFile (hFile=0x22c) returned 1 [0096.298] CloseHandle (hObject=0x22c) returned 1 [0096.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.298] SetEndOfFile (hFile=0x1fc) returned 1 [0096.299] CloseHandle (hObject=0x1fc) returned 1 [0096.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 1 [0096.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.299] lstrlenW (lpString=".doc") returned 4 [0096.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.299] lstrlenW (lpString=".docx") returned 5 [0096.299] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0096.299] lstrlenW (lpString=".pdf") returned 4 [0096.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.299] lstrlenW (lpString=".xls") returned 4 [0096.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.299] lstrlenW (lpString=".xlsx") returned 5 [0096.300] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0096.300] lstrlenW (lpString=".ppt") returned 4 [0096.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.300] lstrlenW (lpString=".zip") returned 4 [0096.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.300] lstrlenW (lpString=".rar") returned 4 [0096.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.300] lstrlenW (lpString=".bz2") returned 4 [0096.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.300] lstrlenW (lpString=".7z") returned 3 [0096.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.300] lstrlenW (lpString=".dbf") returned 4 [0096.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.300] lstrlenW (lpString=".1cd") returned 4 [0096.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 63 [0096.300] lstrlenW (lpString=".jpg") returned 4 [0096.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.300] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") [0096.301] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19286) returned 1 [0096.301] CloseHandle (hObject=0x1fc) returned 1 [0096.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 0x20 [0096.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.302] GetLastError () returned 0x0 [0096.302] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4b56, lpOverlapped=0x0) returned 1 [0096.304] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4b60, lpOverlapped=0x0) returned 1 [0096.305] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.305] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.305] SetEndOfFile (hFile=0x22c) returned 1 [0096.305] CloseHandle (hObject=0x22c) returned 1 [0096.305] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.305] SetEndOfFile (hFile=0x1fc) returned 1 [0096.306] CloseHandle (hObject=0x1fc) returned 1 [0096.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 1 [0096.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.306] lstrlenW (lpString=".doc") returned 4 [0096.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.306] lstrlenW (lpString=".docx") returned 5 [0096.307] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0096.307] lstrlenW (lpString=".pdf") returned 4 [0096.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString=".xls") returned 4 [0096.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.307] lstrlenW (lpString=".xlsx") returned 5 [0096.307] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0096.307] lstrlenW (lpString=".ppt") returned 4 [0096.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.307] lstrlenW (lpString=".zip") returned 4 [0096.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.307] lstrlenW (lpString=".rar") returned 4 [0096.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString=".bz2") returned 4 [0096.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString=".7z") returned 3 [0096.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.307] lstrlenW (lpString=".dbf") returned 4 [0096.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.307] lstrlenW (lpString=".1cd") returned 4 [0096.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 63 [0096.307] lstrlenW (lpString=".jpg") returned 4 [0096.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.307] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") [0096.308] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4774) returned 1 [0096.308] CloseHandle (hObject=0x1fc) returned 1 [0096.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 0x20 [0096.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.308] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.308] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.309] GetLastError () returned 0x0 [0096.309] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x12a6, lpOverlapped=0x0) returned 1 [0096.508] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x12b0, lpOverlapped=0x0) returned 1 [0096.509] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.509] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.509] SetEndOfFile (hFile=0x22c) returned 1 [0096.509] CloseHandle (hObject=0x22c) returned 1 [0096.509] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.509] SetEndOfFile (hFile=0x1fc) returned 1 [0096.510] CloseHandle (hObject=0x1fc) returned 1 [0096.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 1 [0096.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.809] lstrlenW (lpString=".doc") returned 4 [0096.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.809] lstrlenW (lpString=".docx") returned 5 [0096.809] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0096.809] lstrlenW (lpString=".pdf") returned 4 [0096.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.809] lstrlenW (lpString=".xls") returned 4 [0096.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.809] lstrlenW (lpString=".xlsx") returned 5 [0096.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0096.809] lstrlenW (lpString=".ppt") returned 4 [0096.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.810] lstrlenW (lpString=".zip") returned 4 [0096.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.810] lstrlenW (lpString=".rar") returned 4 [0096.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.810] lstrlenW (lpString=".bz2") returned 4 [0096.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.810] lstrlenW (lpString=".7z") returned 3 [0096.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.810] lstrlenW (lpString=".dbf") returned 4 [0096.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.810] lstrlenW (lpString=".1cd") returned 4 [0096.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 63 [0096.810] lstrlenW (lpString=".jpg") returned 4 [0096.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.810] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") [0097.108] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=18784) returned 1 [0097.108] CloseHandle (hObject=0x1a0) returned 1 [0097.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 0x20 [0097.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.108] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.108] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.109] GetLastError () returned 0x0 [0097.109] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4960, lpOverlapped=0x0) returned 1 [0097.259] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4970, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4970, lpOverlapped=0x0) returned 1 [0097.261] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.261] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.261] SetEndOfFile (hFile=0x180) returned 1 [0097.261] CloseHandle (hObject=0x180) returned 1 [0097.261] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.261] SetEndOfFile (hFile=0x1a0) returned 1 [0097.262] CloseHandle (hObject=0x1a0) returned 1 [0097.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 1 [0097.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.450] lstrlenW (lpString=".doc") returned 4 [0097.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.450] lstrlenW (lpString=".docx") returned 5 [0097.450] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0097.450] lstrlenW (lpString=".pdf") returned 4 [0097.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.450] lstrlenW (lpString=".xls") returned 4 [0097.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.450] lstrlenW (lpString=".xlsx") returned 5 [0097.450] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0097.450] lstrlenW (lpString=".ppt") returned 4 [0097.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.450] lstrlenW (lpString=".zip") returned 4 [0097.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.450] lstrlenW (lpString=".rar") returned 4 [0097.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.451] lstrlenW (lpString=".bz2") returned 4 [0097.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.451] lstrlenW (lpString=".7z") returned 3 [0097.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.451] lstrlenW (lpString=".dbf") returned 4 [0097.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.451] lstrlenW (lpString=".1cd") returned 4 [0097.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 63 [0097.451] lstrlenW (lpString=".jpg") returned 4 [0097.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.451] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") [0097.451] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3616) returned 1 [0097.452] CloseHandle (hObject=0x158) returned 1 [0097.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 0x20 [0097.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0097.452] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.452] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.222] GetLastError () returned 0x0 [0098.222] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe20, lpOverlapped=0x0) returned 1 [0098.223] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe30, lpOverlapped=0x0) returned 1 [0098.224] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.224] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.225] SetEndOfFile (hFile=0x16c) returned 1 [0098.225] CloseHandle (hObject=0x16c) returned 1 [0098.225] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.225] SetEndOfFile (hFile=0x158) returned 1 [0098.226] CloseHandle (hObject=0x158) returned 1 [0098.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 1 [0098.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.226] lstrlenW (lpString=".doc") returned 4 [0098.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.226] lstrlenW (lpString=".docx") returned 5 [0098.226] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0098.226] lstrlenW (lpString=".pdf") returned 4 [0098.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.226] lstrlenW (lpString=".xls") returned 4 [0098.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.226] lstrlenW (lpString=".xlsx") returned 5 [0098.226] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0098.226] lstrlenW (lpString=".ppt") returned 4 [0098.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.226] lstrlenW (lpString=".zip") returned 4 [0098.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.226] lstrlenW (lpString=".rar") returned 4 [0098.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.227] lstrlenW (lpString=".bz2") returned 4 [0098.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.227] lstrlenW (lpString=".7z") returned 3 [0098.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.227] lstrlenW (lpString=".dbf") returned 4 [0098.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.227] lstrlenW (lpString=".1cd") returned 4 [0098.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 63 [0098.227] lstrlenW (lpString=".jpg") returned 4 [0098.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.227] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") [0098.228] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4158) returned 1 [0098.228] CloseHandle (hObject=0x158) returned 1 [0098.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 0x20 [0098.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.228] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.228] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.229] GetLastError () returned 0x0 [0098.229] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x103e, lpOverlapped=0x0) returned 1 [0098.232] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0098.233] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.233] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.233] SetEndOfFile (hFile=0x16c) returned 1 [0098.233] CloseHandle (hObject=0x16c) returned 1 [0098.233] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.233] SetEndOfFile (hFile=0x158) returned 1 [0098.234] CloseHandle (hObject=0x158) returned 1 [0098.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 1 [0098.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.234] lstrlenW (lpString=".doc") returned 4 [0098.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.234] lstrlenW (lpString=".docx") returned 5 [0098.234] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0098.234] lstrlenW (lpString=".pdf") returned 4 [0098.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.234] lstrlenW (lpString=".xls") returned 4 [0098.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.235] lstrlenW (lpString=".xlsx") returned 5 [0098.235] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0098.235] lstrlenW (lpString=".ppt") returned 4 [0098.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.235] lstrlenW (lpString=".zip") returned 4 [0098.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.235] lstrlenW (lpString=".rar") returned 4 [0098.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.235] lstrlenW (lpString=".bz2") returned 4 [0098.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.235] lstrlenW (lpString=".7z") returned 3 [0098.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.235] lstrlenW (lpString=".dbf") returned 4 [0098.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.235] lstrlenW (lpString=".1cd") returned 4 [0098.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 63 [0098.235] lstrlenW (lpString=".jpg") returned 4 [0098.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.235] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") [0098.236] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=18958) returned 1 [0098.236] CloseHandle (hObject=0x158) returned 1 [0098.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 0x20 [0098.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.236] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.236] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.237] GetLastError () returned 0x0 [0098.237] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4a0e, lpOverlapped=0x0) returned 1 [0098.239] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4a10, lpOverlapped=0x0) returned 1 [0098.240] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.240] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.240] SetEndOfFile (hFile=0x16c) returned 1 [0098.240] CloseHandle (hObject=0x16c) returned 1 [0098.240] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.240] SetEndOfFile (hFile=0x158) returned 1 [0098.241] CloseHandle (hObject=0x158) returned 1 [0098.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 1 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString=".doc") returned 4 [0098.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString=".docx") returned 5 [0098.242] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0098.242] lstrlenW (lpString=".pdf") returned 4 [0098.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString=".xls") returned 4 [0098.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.242] lstrlenW (lpString=".xlsx") returned 5 [0098.242] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0098.242] lstrlenW (lpString=".ppt") returned 4 [0098.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString=".zip") returned 4 [0098.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.242] lstrlenW (lpString=".rar") returned 4 [0098.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString=".bz2") returned 4 [0098.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString=".7z") returned 3 [0098.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString=".dbf") returned 4 [0098.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString=".1cd") returned 4 [0098.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 63 [0098.242] lstrlenW (lpString=".jpg") returned 4 [0098.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.243] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") [0098.244] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11512) returned 1 [0098.244] CloseHandle (hObject=0x16c) returned 1 [0098.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 0x20 [0098.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.244] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.244] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0098.324] GetLastError () returned 0x0 [0098.324] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2cf8, lpOverlapped=0x0) returned 1 [0098.352] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2d00, lpOverlapped=0x0) returned 1 [0098.353] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.353] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.353] SetEndOfFile (hFile=0x168) returned 1 [0098.353] CloseHandle (hObject=0x168) returned 1 [0098.353] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.354] SetEndOfFile (hFile=0x16c) returned 1 [0098.354] CloseHandle (hObject=0x16c) returned 1 [0098.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 1 [0098.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.355] lstrlenW (lpString=".doc") returned 4 [0098.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString=".docx") returned 5 [0098.355] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0098.355] lstrlenW (lpString=".pdf") returned 4 [0098.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString=".xls") returned 4 [0098.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.355] lstrlenW (lpString=".xlsx") returned 5 [0098.355] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0098.355] lstrlenW (lpString=".ppt") returned 4 [0098.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.355] lstrlenW (lpString=".zip") returned 4 [0098.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.355] lstrlenW (lpString=".rar") returned 4 [0098.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString=".bz2") returned 4 [0098.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString=".7z") returned 3 [0098.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.355] lstrlenW (lpString=".dbf") returned 4 [0098.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.355] lstrlenW (lpString=".1cd") returned 4 [0098.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 63 [0098.356] lstrlenW (lpString=".jpg") returned 4 [0098.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.356] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") [0098.705] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16626) returned 1 [0098.705] CloseHandle (hObject=0x1a0) returned 1 [0098.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 0x20 [0098.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.706] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.706] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.706] GetLastError () returned 0x0 [0098.706] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x40f2, lpOverlapped=0x0) returned 1 [0098.709] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4100, lpOverlapped=0x0) returned 1 [0098.710] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.710] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.710] SetEndOfFile (hFile=0x180) returned 1 [0098.710] CloseHandle (hObject=0x180) returned 1 [0098.710] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.710] SetEndOfFile (hFile=0x1a0) returned 1 [0098.711] CloseHandle (hObject=0x1a0) returned 1 [0098.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 1 [0098.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.711] lstrlenW (lpString=".doc") returned 4 [0098.711] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.711] lstrlenW (lpString=".docx") returned 5 [0098.711] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.711] lstrlenW (lpString=".pdf") returned 4 [0098.712] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.712] lstrlenW (lpString=".xls") returned 4 [0098.712] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.712] lstrlenW (lpString=".xlsx") returned 5 [0098.712] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.712] lstrlenW (lpString=".ppt") returned 4 [0098.712] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.712] lstrlenW (lpString=".zip") returned 4 [0098.712] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.712] lstrlenW (lpString=".rar") returned 4 [0098.712] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.712] lstrlenW (lpString=".bz2") returned 4 [0098.712] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.712] lstrlenW (lpString=".7z") returned 3 [0098.712] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.712] lstrlenW (lpString=".dbf") returned 4 [0098.712] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.712] lstrlenW (lpString=".1cd") returned 4 [0098.712] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 63 [0098.712] lstrlenW (lpString=".jpg") returned 4 [0098.712] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.712] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") [0098.713] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26739) returned 1 [0098.713] CloseHandle (hObject=0x1a0) returned 1 [0098.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0098.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.713] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.713] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.714] GetLastError () returned 0x0 [0098.714] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6873, lpOverlapped=0x0) returned 1 [0098.717] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0098.718] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.718] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.718] SetEndOfFile (hFile=0x180) returned 1 [0098.718] CloseHandle (hObject=0x180) returned 1 [0098.718] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.719] SetEndOfFile (hFile=0x1a0) returned 1 [0098.719] CloseHandle (hObject=0x1a0) returned 1 [0098.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 1 [0098.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.720] lstrlenW (lpString=".doc") returned 4 [0098.720] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.720] lstrlenW (lpString=".docx") returned 5 [0098.720] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0098.720] lstrlenW (lpString=".pdf") returned 4 [0098.720] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.720] lstrlenW (lpString=".xls") returned 4 [0098.720] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.720] lstrlenW (lpString=".xlsx") returned 5 [0098.720] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0098.720] lstrlenW (lpString=".ppt") returned 4 [0098.720] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.720] lstrlenW (lpString=".zip") returned 4 [0098.720] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.720] lstrlenW (lpString=".rar") returned 4 [0098.720] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.720] lstrlenW (lpString=".bz2") returned 4 [0098.720] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.720] lstrlenW (lpString=".7z") returned 3 [0098.720] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.720] lstrlenW (lpString=".dbf") returned 4 [0098.721] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.721] lstrlenW (lpString=".1cd") returned 4 [0098.721] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 63 [0098.721] lstrlenW (lpString=".jpg") returned 4 [0098.721] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.721] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") [0098.721] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=42135) returned 1 [0098.721] CloseHandle (hObject=0x1a0) returned 1 [0098.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 0x20 [0098.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.722] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.722] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.722] GetLastError () returned 0x0 [0098.722] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa497, lpOverlapped=0x0) returned 1 [0098.725] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa4a0, lpOverlapped=0x0) returned 1 [0098.726] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.726] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.726] SetEndOfFile (hFile=0x180) returned 1 [0098.727] CloseHandle (hObject=0x180) returned 1 [0098.727] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.727] SetEndOfFile (hFile=0x1a0) returned 1 [0098.728] CloseHandle (hObject=0x1a0) returned 1 [0098.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 1 [0098.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.728] lstrlenW (lpString=".doc") returned 4 [0098.728] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.728] lstrlenW (lpString=".docx") returned 5 [0098.728] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0098.728] lstrlenW (lpString=".pdf") returned 4 [0098.728] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.728] lstrlenW (lpString=".xls") returned 4 [0098.728] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.729] lstrlenW (lpString=".xlsx") returned 5 [0098.729] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0098.729] lstrlenW (lpString=".ppt") returned 4 [0098.729] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.729] lstrlenW (lpString=".zip") returned 4 [0098.729] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.729] lstrlenW (lpString=".rar") returned 4 [0098.729] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.729] lstrlenW (lpString=".bz2") returned 4 [0098.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.729] lstrlenW (lpString=".7z") returned 3 [0098.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.729] lstrlenW (lpString=".dbf") returned 4 [0098.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.729] lstrlenW (lpString=".1cd") returned 4 [0098.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 63 [0098.729] lstrlenW (lpString=".jpg") returned 4 [0098.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.729] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") [0098.730] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7803) returned 1 [0098.730] CloseHandle (hObject=0x1a0) returned 1 [0098.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 0x20 [0098.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.730] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.730] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.731] GetLastError () returned 0x0 [0098.731] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1e7b, lpOverlapped=0x0) returned 1 [0098.732] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0098.733] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.733] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.733] SetEndOfFile (hFile=0x180) returned 1 [0098.733] CloseHandle (hObject=0x180) returned 1 [0098.736] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.736] SetEndOfFile (hFile=0x1a0) returned 1 [0098.736] CloseHandle (hObject=0x1a0) returned 1 [0098.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 1 [0098.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.737] lstrlenW (lpString=".doc") returned 4 [0098.737] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.737] lstrlenW (lpString=".docx") returned 5 [0098.737] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.737] lstrlenW (lpString=".pdf") returned 4 [0098.737] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.737] lstrlenW (lpString=".xls") returned 4 [0098.737] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.737] lstrlenW (lpString=".xlsx") returned 5 [0098.737] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.737] lstrlenW (lpString=".ppt") returned 4 [0098.737] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.737] lstrlenW (lpString=".zip") returned 4 [0098.737] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.737] lstrlenW (lpString=".rar") returned 4 [0098.737] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.737] lstrlenW (lpString=".bz2") returned 4 [0098.737] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.738] lstrlenW (lpString=".7z") returned 3 [0098.738] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.738] lstrlenW (lpString=".dbf") returned 4 [0098.738] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.738] lstrlenW (lpString=".1cd") returned 4 [0098.738] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 63 [0098.738] lstrlenW (lpString=".jpg") returned 4 [0098.738] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.738] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") [0098.739] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13845) returned 1 [0098.739] CloseHandle (hObject=0x1a0) returned 1 [0098.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 0x20 [0098.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.739] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.739] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.740] GetLastError () returned 0x0 [0098.740] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3615, lpOverlapped=0x0) returned 1 [0098.773] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3620, lpOverlapped=0x0) returned 1 [0098.774] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.774] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.774] SetEndOfFile (hFile=0x180) returned 1 [0098.783] CloseHandle (hObject=0x180) returned 1 [0098.783] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.783] SetEndOfFile (hFile=0x1a0) returned 1 [0098.784] CloseHandle (hObject=0x1a0) returned 1 [0098.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 1 [0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.787] lstrlenW (lpString=".doc") returned 4 [0098.787] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.788] lstrlenW (lpString=".docx") returned 5 [0098.788] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0098.788] lstrlenW (lpString=".pdf") returned 4 [0098.788] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.788] lstrlenW (lpString=".xls") returned 4 [0098.788] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.788] lstrlenW (lpString=".xlsx") returned 5 [0098.788] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0098.788] lstrlenW (lpString=".ppt") returned 4 [0098.788] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.788] lstrlenW (lpString=".zip") returned 4 [0098.788] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.788] lstrlenW (lpString=".rar") returned 4 [0098.788] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.788] lstrlenW (lpString=".bz2") returned 4 [0098.788] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.788] lstrlenW (lpString=".7z") returned 3 [0098.788] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.788] lstrlenW (lpString=".dbf") returned 4 [0098.788] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.788] lstrlenW (lpString=".1cd") returned 4 [0098.788] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 63 [0098.788] lstrlenW (lpString=".jpg") returned 4 [0098.788] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.788] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") [0098.947] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20166) returned 1 [0098.947] CloseHandle (hObject=0x16c) returned 1 [0098.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 0x20 [0098.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.948] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.948] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.948] GetLastError () returned 0x0 [0098.948] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4ec6, lpOverlapped=0x0) returned 1 [0098.950] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4ed0, lpOverlapped=0x0) returned 1 [0098.952] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.952] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.952] SetEndOfFile (hFile=0x1fc) returned 1 [0098.952] CloseHandle (hObject=0x1fc) returned 1 [0098.952] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.952] SetEndOfFile (hFile=0x16c) returned 1 [0098.953] CloseHandle (hObject=0x16c) returned 1 [0098.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 1 [0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.953] lstrlenW (lpString=".doc") returned 4 [0098.954] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.954] lstrlenW (lpString=".docx") returned 5 [0098.954] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.954] lstrlenW (lpString=".pdf") returned 4 [0098.954] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.954] lstrlenW (lpString=".xls") returned 4 [0098.954] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.954] lstrlenW (lpString=".xlsx") returned 5 [0098.954] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.954] lstrlenW (lpString=".ppt") returned 4 [0098.954] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.954] lstrlenW (lpString=".zip") returned 4 [0098.954] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.954] lstrlenW (lpString=".rar") returned 4 [0098.954] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.954] lstrlenW (lpString=".bz2") returned 4 [0098.954] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.954] lstrlenW (lpString=".7z") returned 3 [0098.954] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.954] lstrlenW (lpString=".dbf") returned 4 [0098.954] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.954] lstrlenW (lpString=".1cd") returned 4 [0098.954] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 63 [0098.954] lstrlenW (lpString=".jpg") returned 4 [0098.954] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.954] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") [0098.956] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=91450) returned 1 [0098.956] CloseHandle (hObject=0x16c) returned 1 [0098.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 0x20 [0098.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.956] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.956] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.959] GetLastError () returned 0x0 [0098.959] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1653a, lpOverlapped=0x0) returned 1 [0098.963] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x16540, lpOverlapped=0x0) returned 1 [0098.965] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.965] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.965] SetEndOfFile (hFile=0x1fc) returned 1 [0098.965] CloseHandle (hObject=0x1fc) returned 1 [0098.965] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.965] SetEndOfFile (hFile=0x16c) returned 1 [0098.966] CloseHandle (hObject=0x16c) returned 1 [0098.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 1 [0098.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.967] lstrlenW (lpString=".doc") returned 4 [0098.967] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.967] lstrlenW (lpString=".docx") returned 5 [0098.967] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0098.967] lstrlenW (lpString=".pdf") returned 4 [0098.967] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.967] lstrlenW (lpString=".xls") returned 4 [0098.967] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.967] lstrlenW (lpString=".xlsx") returned 5 [0098.967] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0098.967] lstrlenW (lpString=".ppt") returned 4 [0098.967] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.967] lstrlenW (lpString=".zip") returned 4 [0098.967] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.968] lstrlenW (lpString=".rar") returned 4 [0098.968] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.968] lstrlenW (lpString=".bz2") returned 4 [0098.968] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.968] lstrlenW (lpString=".7z") returned 3 [0098.968] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.968] lstrlenW (lpString=".dbf") returned 4 [0098.968] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.968] lstrlenW (lpString=".1cd") returned 4 [0098.968] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 63 [0098.968] lstrlenW (lpString=".jpg") returned 4 [0098.968] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.968] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") [0098.968] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=81437) returned 1 [0098.969] CloseHandle (hObject=0x16c) returned 1 [0098.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 0x20 [0098.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.969] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.969] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.969] GetLastError () returned 0x0 [0098.970] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13e1d, lpOverlapped=0x0) returned 1 [0098.973] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13e20, lpOverlapped=0x0) returned 1 [0098.975] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.975] WriteFile (in: hFile=0x1fc, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.975] SetEndOfFile (hFile=0x1fc) returned 1 [0098.975] CloseHandle (hObject=0x1fc) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.975] SetEndOfFile (hFile=0x16c) returned 1 [0098.976] CloseHandle (hObject=0x16c) returned 1 [0098.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 1 [0098.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0098.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0098.977] lstrlenW (lpString=".doc") returned 4 [0098.977] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.977] lstrlenW (lpString=".docx") returned 5 [0098.977] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.977] lstrlenW (lpString=".pdf") returned 4 [0098.977] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.977] lstrlenW (lpString=".xls") returned 4 [0098.977] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.977] lstrlenW (lpString=".xlsx") returned 5 [0098.977] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.977] lstrlenW (lpString=".ppt") returned 4 [0098.977] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0098.977] lstrlenW (lpString=".zip") returned 4 [0098.977] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.977] lstrlenW (lpString=".rar") returned 4 [0099.015] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.015] lstrlenW (lpString=".bz2") returned 4 [0099.015] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.015] lstrlenW (lpString=".7z") returned 3 [0099.015] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0099.015] lstrlenW (lpString=".dbf") returned 4 [0099.015] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0099.015] lstrlenW (lpString=".1cd") returned 4 [0099.015] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 63 [0099.015] lstrlenW (lpString=".jpg") returned 4 [0099.015] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.016] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") [0099.069] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=96073) returned 1 [0099.069] CloseHandle (hObject=0x210) returned 1 [0099.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 0x20 [0099.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.069] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.069] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.070] GetLastError () returned 0x0 [0099.070] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x17749, lpOverlapped=0x0) returned 1 [0099.077] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x17750, lpOverlapped=0x0) returned 1 [0099.079] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.079] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.079] SetEndOfFile (hFile=0x16c) returned 1 [0099.079] CloseHandle (hObject=0x16c) returned 1 [0099.079] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.079] SetEndOfFile (hFile=0x210) returned 1 [0099.080] CloseHandle (hObject=0x210) returned 1 [0099.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 1 [0099.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.081] lstrlenW (lpString=".doc") returned 4 [0099.081] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.081] lstrlenW (lpString=".docx") returned 5 [0099.081] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0099.081] lstrlenW (lpString=".pdf") returned 4 [0099.081] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.081] lstrlenW (lpString=".xls") returned 4 [0099.081] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.081] lstrlenW (lpString=".xlsx") returned 5 [0099.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0099.081] lstrlenW (lpString=".ppt") returned 4 [0099.081] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.081] lstrlenW (lpString=".zip") returned 4 [0099.081] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.081] lstrlenW (lpString=".rar") returned 4 [0099.081] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.081] lstrlenW (lpString=".bz2") returned 4 [0099.081] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.081] lstrlenW (lpString=".7z") returned 3 [0099.081] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.081] lstrlenW (lpString=".dbf") returned 4 [0099.081] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.081] lstrlenW (lpString=".1cd") returned 4 [0099.081] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 63 [0099.082] lstrlenW (lpString=".jpg") returned 4 [0099.082] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.082] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") [0099.082] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=88703) returned 1 [0099.082] CloseHandle (hObject=0x210) returned 1 [0099.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 0x20 [0099.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.083] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.083] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.083] GetLastError () returned 0x0 [0099.083] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15a7f, lpOverlapped=0x0) returned 1 [0099.089] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15a80, lpOverlapped=0x0) returned 1 [0099.091] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.091] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.091] SetEndOfFile (hFile=0x16c) returned 1 [0099.091] CloseHandle (hObject=0x16c) returned 1 [0099.091] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.091] SetEndOfFile (hFile=0x210) returned 1 [0099.093] CloseHandle (hObject=0x210) returned 1 [0099.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 1 [0099.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.093] lstrlenW (lpString=".doc") returned 4 [0099.093] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.093] lstrlenW (lpString=".docx") returned 5 [0099.093] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0099.093] lstrlenW (lpString=".pdf") returned 4 [0099.093] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.093] lstrlenW (lpString=".xls") returned 4 [0099.093] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.093] lstrlenW (lpString=".xlsx") returned 5 [0099.093] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0099.094] lstrlenW (lpString=".ppt") returned 4 [0099.094] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.094] lstrlenW (lpString=".zip") returned 4 [0099.094] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.094] lstrlenW (lpString=".rar") returned 4 [0099.094] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.094] lstrlenW (lpString=".bz2") returned 4 [0099.094] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.094] lstrlenW (lpString=".7z") returned 3 [0099.094] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.094] lstrlenW (lpString=".dbf") returned 4 [0099.094] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.094] lstrlenW (lpString=".1cd") returned 4 [0099.094] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 63 [0099.094] lstrlenW (lpString=".jpg") returned 4 [0099.094] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.094] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") [0099.095] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=90095) returned 1 [0099.095] CloseHandle (hObject=0x210) returned 1 [0099.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 0x20 [0099.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.095] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.095] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.096] GetLastError () returned 0x0 [0099.096] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15fef, lpOverlapped=0x0) returned 1 [0099.105] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15ff0, lpOverlapped=0x0) returned 1 [0099.107] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.107] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.108] SetEndOfFile (hFile=0x16c) returned 1 [0099.108] CloseHandle (hObject=0x16c) returned 1 [0099.108] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.108] SetEndOfFile (hFile=0x210) returned 1 [0099.109] CloseHandle (hObject=0x210) returned 1 [0099.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 1 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString=".doc") returned 4 [0099.110] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.110] lstrlenW (lpString=".docx") returned 5 [0099.110] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0099.110] lstrlenW (lpString=".pdf") returned 4 [0099.110] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.110] lstrlenW (lpString=".xls") returned 4 [0099.110] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.110] lstrlenW (lpString=".xlsx") returned 5 [0099.110] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0099.110] lstrlenW (lpString=".ppt") returned 4 [0099.110] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString=".zip") returned 4 [0099.110] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.110] lstrlenW (lpString=".rar") returned 4 [0099.110] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.110] lstrlenW (lpString=".bz2") returned 4 [0099.110] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.110] lstrlenW (lpString=".7z") returned 3 [0099.110] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString=".dbf") returned 4 [0099.110] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString=".1cd") returned 4 [0099.110] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 63 [0099.110] lstrlenW (lpString=".jpg") returned 4 [0099.110] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.110] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") [0099.111] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=109037) returned 1 [0099.111] CloseHandle (hObject=0x210) returned 1 [0099.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 0x20 [0099.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.111] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.111] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.112] GetLastError () returned 0x0 [0099.112] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1a9ed, lpOverlapped=0x0) returned 1 [0099.244] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a9f0, lpOverlapped=0x0) returned 1 [0099.246] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.246] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.246] SetEndOfFile (hFile=0x16c) returned 1 [0099.308] CloseHandle (hObject=0x16c) returned 1 [0099.308] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.308] SetEndOfFile (hFile=0x210) returned 1 [0099.332] CloseHandle (hObject=0x210) returned 1 [0099.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 1 [0099.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.345] lstrlenW (lpString=".doc") returned 4 [0099.345] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.345] lstrlenW (lpString=".docx") returned 5 [0099.345] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0099.345] lstrlenW (lpString=".pdf") returned 4 [0099.345] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.345] lstrlenW (lpString=".xls") returned 4 [0099.345] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.345] lstrlenW (lpString=".xlsx") returned 5 [0099.345] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0099.345] lstrlenW (lpString=".ppt") returned 4 [0099.345] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.345] lstrlenW (lpString=".zip") returned 4 [0099.345] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.345] lstrlenW (lpString=".rar") returned 4 [0099.345] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.345] lstrlenW (lpString=".bz2") returned 4 [0099.345] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.346] lstrlenW (lpString=".7z") returned 3 [0099.346] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.346] lstrlenW (lpString=".dbf") returned 4 [0099.346] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.346] lstrlenW (lpString=".1cd") returned 4 [0099.346] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 63 [0099.346] lstrlenW (lpString=".jpg") returned 4 [0099.346] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.346] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") [0099.347] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=114423) returned 1 [0099.347] CloseHandle (hObject=0x210) returned 1 [0099.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 0x20 [0099.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.347] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.347] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.348] GetLastError () returned 0x0 [0099.348] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1bef7, lpOverlapped=0x0) returned 1 [0099.351] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1bf00, lpOverlapped=0x0) returned 1 [0099.354] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.354] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.354] SetEndOfFile (hFile=0x16c) returned 1 [0099.354] CloseHandle (hObject=0x16c) returned 1 [0099.354] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.354] SetEndOfFile (hFile=0x210) returned 1 [0099.356] CloseHandle (hObject=0x210) returned 1 [0099.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 1 [0099.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.356] lstrlenW (lpString=".doc") returned 4 [0099.356] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.356] lstrlenW (lpString=".docx") returned 5 [0099.356] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0099.356] lstrlenW (lpString=".pdf") returned 4 [0099.356] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.356] lstrlenW (lpString=".xls") returned 4 [0099.357] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.357] lstrlenW (lpString=".xlsx") returned 5 [0099.357] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0099.357] lstrlenW (lpString=".ppt") returned 4 [0099.357] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.357] lstrlenW (lpString=".zip") returned 4 [0099.357] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.357] lstrlenW (lpString=".rar") returned 4 [0099.357] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.357] lstrlenW (lpString=".bz2") returned 4 [0099.357] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.357] lstrlenW (lpString=".7z") returned 3 [0099.357] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.357] lstrlenW (lpString=".dbf") returned 4 [0099.357] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.357] lstrlenW (lpString=".1cd") returned 4 [0099.357] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 63 [0099.357] lstrlenW (lpString=".jpg") returned 4 [0099.357] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.357] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") [0099.358] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=97774) returned 1 [0099.358] CloseHandle (hObject=0x210) returned 1 [0099.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 0x20 [0099.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.358] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.358] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.359] GetLastError () returned 0x0 [0099.359] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x17dee, lpOverlapped=0x0) returned 1 [0099.363] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x17df0, lpOverlapped=0x0) returned 1 [0099.365] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.365] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.365] SetEndOfFile (hFile=0x16c) returned 1 [0099.366] CloseHandle (hObject=0x16c) returned 1 [0099.366] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.366] SetEndOfFile (hFile=0x210) returned 1 [0099.367] CloseHandle (hObject=0x210) returned 1 [0099.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 1 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString=".doc") returned 4 [0099.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.368] lstrlenW (lpString=".docx") returned 5 [0099.368] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0099.368] lstrlenW (lpString=".pdf") returned 4 [0099.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.368] lstrlenW (lpString=".xls") returned 4 [0099.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.368] lstrlenW (lpString=".xlsx") returned 5 [0099.368] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0099.368] lstrlenW (lpString=".ppt") returned 4 [0099.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString=".zip") returned 4 [0099.368] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.368] lstrlenW (lpString=".rar") returned 4 [0099.368] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.368] lstrlenW (lpString=".bz2") returned 4 [0099.368] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.368] lstrlenW (lpString=".7z") returned 3 [0099.368] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString=".dbf") returned 4 [0099.368] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString=".1cd") returned 4 [0099.368] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 63 [0099.368] lstrlenW (lpString=".jpg") returned 4 [0099.368] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.369] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") [0099.369] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=113410) returned 1 [0099.369] CloseHandle (hObject=0x210) returned 1 [0099.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 0x20 [0099.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.369] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.370] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.370] GetLastError () returned 0x0 [0099.370] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1bb02, lpOverlapped=0x0) returned 1 [0099.419] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1bb10, lpOverlapped=0x0) returned 1 [0099.422] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.422] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.422] SetEndOfFile (hFile=0x16c) returned 1 [0099.571] CloseHandle (hObject=0x16c) returned 1 [0099.571] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.571] SetEndOfFile (hFile=0x210) returned 1 [0099.573] CloseHandle (hObject=0x210) returned 1 [0099.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 1 [0099.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.709] lstrlenW (lpString=".doc") returned 4 [0099.709] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.709] lstrlenW (lpString=".docx") returned 5 [0099.709] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0099.709] lstrlenW (lpString=".pdf") returned 4 [0099.709] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.709] lstrlenW (lpString=".xls") returned 4 [0099.709] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.709] lstrlenW (lpString=".xlsx") returned 5 [0099.709] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0099.709] lstrlenW (lpString=".ppt") returned 4 [0099.709] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.710] lstrlenW (lpString=".zip") returned 4 [0099.710] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.710] lstrlenW (lpString=".rar") returned 4 [0099.710] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.710] lstrlenW (lpString=".bz2") returned 4 [0099.710] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.710] lstrlenW (lpString=".7z") returned 3 [0099.710] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.710] lstrlenW (lpString=".dbf") returned 4 [0099.710] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.710] lstrlenW (lpString=".1cd") returned 4 [0099.710] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 63 [0099.710] lstrlenW (lpString=".jpg") returned 4 [0099.710] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.710] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") [0099.824] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=102633) returned 1 [0099.824] CloseHandle (hObject=0x1c0) returned 1 [0099.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 0x20 [0099.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.824] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.824] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.825] GetLastError () returned 0x0 [0099.825] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x190e9, lpOverlapped=0x0) returned 1 [0099.856] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x190f0, lpOverlapped=0x0) returned 1 [0099.859] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.859] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.859] SetEndOfFile (hFile=0x1a0) returned 1 [0099.859] CloseHandle (hObject=0x1a0) returned 1 [0099.859] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.859] SetEndOfFile (hFile=0x1c0) returned 1 [0099.860] CloseHandle (hObject=0x1c0) returned 1 [0099.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 1 [0099.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.863] lstrlenW (lpString=".doc") returned 4 [0099.863] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.863] lstrlenW (lpString=".docx") returned 5 [0099.863] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0099.863] lstrlenW (lpString=".pdf") returned 4 [0099.863] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.863] lstrlenW (lpString=".xls") returned 4 [0099.863] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.863] lstrlenW (lpString=".xlsx") returned 5 [0099.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0099.863] lstrlenW (lpString=".ppt") returned 4 [0099.863] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.864] lstrlenW (lpString=".zip") returned 4 [0099.864] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.864] lstrlenW (lpString=".rar") returned 4 [0099.864] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.864] lstrlenW (lpString=".bz2") returned 4 [0099.864] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.864] lstrlenW (lpString=".7z") returned 3 [0099.864] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.864] lstrlenW (lpString=".dbf") returned 4 [0099.864] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.864] lstrlenW (lpString=".1cd") returned 4 [0099.864] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 63 [0099.864] lstrlenW (lpString=".jpg") returned 4 [0099.864] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.864] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") [0099.907] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15171) returned 1 [0099.907] CloseHandle (hObject=0x22c) returned 1 [0099.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0099.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.907] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.907] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.908] GetLastError () returned 0x0 [0099.908] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3b43, lpOverlapped=0x0) returned 1 [0099.910] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3b50, lpOverlapped=0x0) returned 1 [0099.911] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.911] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.911] SetEndOfFile (hFile=0x168) returned 1 [0099.911] CloseHandle (hObject=0x168) returned 1 [0099.911] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.911] SetEndOfFile (hFile=0x22c) returned 1 [0099.912] CloseHandle (hObject=0x22c) returned 1 [0099.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 1 [0099.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.913] lstrlenW (lpString=".doc") returned 4 [0099.913] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.913] lstrlenW (lpString=".docx") returned 5 [0099.913] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.913] lstrlenW (lpString=".pdf") returned 4 [0099.913] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.913] lstrlenW (lpString=".xls") returned 4 [0099.913] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.913] lstrlenW (lpString=".xlsx") returned 5 [0099.913] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.913] lstrlenW (lpString=".ppt") returned 4 [0099.913] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.913] lstrlenW (lpString=".zip") returned 4 [0099.913] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.913] lstrlenW (lpString=".rar") returned 4 [0099.913] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.913] lstrlenW (lpString=".bz2") returned 4 [0099.913] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.913] lstrlenW (lpString=".7z") returned 3 [0099.913] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.913] lstrlenW (lpString=".dbf") returned 4 [0099.913] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.913] lstrlenW (lpString=".1cd") returned 4 [0099.913] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 63 [0099.914] lstrlenW (lpString=".jpg") returned 4 [0099.914] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.914] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") [0099.914] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14698) returned 1 [0099.915] CloseHandle (hObject=0x22c) returned 1 [0099.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0099.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.915] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.915] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.916] GetLastError () returned 0x0 [0099.916] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x396a, lpOverlapped=0x0) returned 1 [0099.918] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0099.919] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.919] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.919] SetEndOfFile (hFile=0x168) returned 1 [0099.919] CloseHandle (hObject=0x168) returned 1 [0099.919] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.919] SetEndOfFile (hFile=0x22c) returned 1 [0099.920] CloseHandle (hObject=0x22c) returned 1 [0099.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 1 [0099.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.921] lstrlenW (lpString=".doc") returned 4 [0099.921] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.921] lstrlenW (lpString=".docx") returned 5 [0099.921] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0099.921] lstrlenW (lpString=".pdf") returned 4 [0099.921] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.921] lstrlenW (lpString=".xls") returned 4 [0099.921] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.921] lstrlenW (lpString=".xlsx") returned 5 [0099.921] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0099.921] lstrlenW (lpString=".ppt") returned 4 [0099.921] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.921] lstrlenW (lpString=".zip") returned 4 [0099.921] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.921] lstrlenW (lpString=".rar") returned 4 [0099.921] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.921] lstrlenW (lpString=".bz2") returned 4 [0099.921] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.921] lstrlenW (lpString=".7z") returned 3 [0099.921] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.921] lstrlenW (lpString=".dbf") returned 4 [0099.921] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.921] lstrlenW (lpString=".1cd") returned 4 [0099.921] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 63 [0099.921] lstrlenW (lpString=".jpg") returned 4 [0099.921] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.921] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") [0099.922] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26942) returned 1 [0099.922] CloseHandle (hObject=0x22c) returned 1 [0099.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 0x20 [0099.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.922] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.922] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.923] GetLastError () returned 0x0 [0099.923] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x693e, lpOverlapped=0x0) returned 1 [0099.925] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0099.927] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.927] WriteFile (in: hFile=0x168, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.927] SetEndOfFile (hFile=0x168) returned 1 [0099.927] CloseHandle (hObject=0x168) returned 1 [0099.927] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.927] SetEndOfFile (hFile=0x22c) returned 1 [0099.928] CloseHandle (hObject=0x22c) returned 1 [0099.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 1 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0099.928] lstrlenW (lpString=".doc") returned 4 [0099.928] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.928] lstrlenW (lpString=".docx") returned 5 [0099.928] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0099.928] lstrlenW (lpString=".pdf") returned 4 [0099.929] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.929] lstrlenW (lpString=".xls") returned 4 [0099.929] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.026] lstrlenW (lpString=".xlsx") returned 5 [0100.026] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0100.026] lstrlenW (lpString=".ppt") returned 4 [0100.026] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0100.026] lstrlenW (lpString=".zip") returned 4 [0100.026] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.026] lstrlenW (lpString=".rar") returned 4 [0100.026] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.026] lstrlenW (lpString=".bz2") returned 4 [0100.026] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.026] lstrlenW (lpString=".7z") returned 3 [0100.026] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0100.027] lstrlenW (lpString=".dbf") returned 4 [0100.027] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0100.027] lstrlenW (lpString=".1cd") returned 4 [0100.027] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 63 [0100.027] lstrlenW (lpString=".jpg") returned 4 [0100.027] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.027] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") [0100.182] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=47551) returned 1 [0100.182] CloseHandle (hObject=0x1fc) returned 1 [0100.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 0x20 [0100.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.184] GetLastError () returned 0x0 [0100.184] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xb9bf, lpOverlapped=0x0) returned 1 [0100.186] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb9c0, lpOverlapped=0x0) returned 1 [0100.187] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.187] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.187] SetEndOfFile (hFile=0x158) returned 1 [0100.188] CloseHandle (hObject=0x158) returned 1 [0100.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.188] SetEndOfFile (hFile=0x1fc) returned 1 [0100.189] CloseHandle (hObject=0x1fc) returned 1 [0100.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 1 [0100.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.189] lstrlenW (lpString=".doc") returned 4 [0100.189] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.189] lstrlenW (lpString=".docx") returned 5 [0100.189] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0100.189] lstrlenW (lpString=".pdf") returned 4 [0100.189] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.189] lstrlenW (lpString=".xls") returned 4 [0100.189] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.190] lstrlenW (lpString=".xlsx") returned 5 [0100.190] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0100.190] lstrlenW (lpString=".ppt") returned 4 [0100.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.190] lstrlenW (lpString=".zip") returned 4 [0100.190] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.190] lstrlenW (lpString=".rar") returned 4 [0100.190] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.190] lstrlenW (lpString=".bz2") returned 4 [0100.190] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.190] lstrlenW (lpString=".7z") returned 3 [0100.190] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.190] lstrlenW (lpString=".dbf") returned 4 [0100.190] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.190] lstrlenW (lpString=".1cd") returned 4 [0100.190] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 63 [0100.190] lstrlenW (lpString=".jpg") returned 4 [0100.190] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.190] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") [0100.191] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=39148) returned 1 [0100.191] CloseHandle (hObject=0x1fc) returned 1 [0100.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 0x20 [0100.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.191] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.191] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.192] GetLastError () returned 0x0 [0100.192] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x98ec, lpOverlapped=0x0) returned 1 [0100.194] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x98f0, lpOverlapped=0x0) returned 1 [0100.196] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.196] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.196] SetEndOfFile (hFile=0x158) returned 1 [0100.196] CloseHandle (hObject=0x158) returned 1 [0100.196] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.196] SetEndOfFile (hFile=0x1fc) returned 1 [0100.197] CloseHandle (hObject=0x1fc) returned 1 [0100.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 1 [0100.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.197] lstrlenW (lpString=".doc") returned 4 [0100.197] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.197] lstrlenW (lpString=".docx") returned 5 [0100.198] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0100.198] lstrlenW (lpString=".pdf") returned 4 [0100.198] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.198] lstrlenW (lpString=".xls") returned 4 [0100.198] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.198] lstrlenW (lpString=".xlsx") returned 5 [0100.198] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0100.198] lstrlenW (lpString=".ppt") returned 4 [0100.198] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.198] lstrlenW (lpString=".zip") returned 4 [0100.198] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.198] lstrlenW (lpString=".rar") returned 4 [0100.198] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.198] lstrlenW (lpString=".bz2") returned 4 [0100.198] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.198] lstrlenW (lpString=".7z") returned 3 [0100.198] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.198] lstrlenW (lpString=".dbf") returned 4 [0100.198] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.198] lstrlenW (lpString=".1cd") returned 4 [0100.198] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 63 [0100.198] lstrlenW (lpString=".jpg") returned 4 [0100.198] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.198] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") [0100.199] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32243) returned 1 [0100.199] CloseHandle (hObject=0x1fc) returned 1 [0100.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 0x20 [0100.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.200] GetLastError () returned 0x0 [0100.200] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7df3, lpOverlapped=0x0) returned 1 [0100.203] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0100.205] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.205] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.205] SetEndOfFile (hFile=0x158) returned 1 [0100.205] CloseHandle (hObject=0x158) returned 1 [0100.205] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.205] SetEndOfFile (hFile=0x1fc) returned 1 [0100.206] CloseHandle (hObject=0x1fc) returned 1 [0100.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 1 [0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.206] lstrlenW (lpString=".doc") returned 4 [0100.206] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.206] lstrlenW (lpString=".docx") returned 5 [0100.206] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0100.206] lstrlenW (lpString=".pdf") returned 4 [0100.206] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.206] lstrlenW (lpString=".xls") returned 4 [0100.207] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.207] lstrlenW (lpString=".xlsx") returned 5 [0100.207] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0100.207] lstrlenW (lpString=".ppt") returned 4 [0100.207] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.207] lstrlenW (lpString=".zip") returned 4 [0100.207] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.207] lstrlenW (lpString=".rar") returned 4 [0100.207] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.207] lstrlenW (lpString=".bz2") returned 4 [0100.207] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.207] lstrlenW (lpString=".7z") returned 3 [0100.207] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.207] lstrlenW (lpString=".dbf") returned 4 [0100.207] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.207] lstrlenW (lpString=".1cd") returned 4 [0100.207] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 63 [0100.207] lstrlenW (lpString=".jpg") returned 4 [0100.207] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.207] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") [0100.208] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13596) returned 1 [0100.208] CloseHandle (hObject=0x1fc) returned 1 [0100.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 0x20 [0100.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.209] GetLastError () returned 0x0 [0100.209] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x351c, lpOverlapped=0x0) returned 1 [0100.211] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3520, lpOverlapped=0x0) returned 1 [0100.212] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.212] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.212] SetEndOfFile (hFile=0x158) returned 1 [0100.212] CloseHandle (hObject=0x158) returned 1 [0100.212] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.212] SetEndOfFile (hFile=0x1fc) returned 1 [0100.213] CloseHandle (hObject=0x1fc) returned 1 [0100.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 1 [0100.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.213] lstrlenW (lpString=".doc") returned 4 [0100.213] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.213] lstrlenW (lpString=".docx") returned 5 [0100.214] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0100.214] lstrlenW (lpString=".pdf") returned 4 [0100.214] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.214] lstrlenW (lpString=".xls") returned 4 [0100.214] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.214] lstrlenW (lpString=".xlsx") returned 5 [0100.214] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0100.214] lstrlenW (lpString=".ppt") returned 4 [0100.214] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.214] lstrlenW (lpString=".zip") returned 4 [0100.214] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.214] lstrlenW (lpString=".rar") returned 4 [0100.214] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.214] lstrlenW (lpString=".bz2") returned 4 [0100.214] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.214] lstrlenW (lpString=".7z") returned 3 [0100.214] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.214] lstrlenW (lpString=".dbf") returned 4 [0100.214] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.214] lstrlenW (lpString=".1cd") returned 4 [0100.214] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 63 [0100.214] lstrlenW (lpString=".jpg") returned 4 [0100.214] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.214] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") [0100.215] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=202883) returned 1 [0100.215] CloseHandle (hObject=0x1fc) returned 1 [0100.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 0x20 [0100.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.216] GetLastError () returned 0x0 [0100.216] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x31883, lpOverlapped=0x0) returned 1 [0100.367] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x31890, lpOverlapped=0x0) returned 1 [0100.371] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.371] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.371] SetEndOfFile (hFile=0x158) returned 1 [0100.371] CloseHandle (hObject=0x158) returned 1 [0100.371] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.371] SetEndOfFile (hFile=0x1fc) returned 1 [0100.373] CloseHandle (hObject=0x1fc) returned 1 [0100.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 1 [0100.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.373] lstrlenW (lpString=".doc") returned 4 [0100.373] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0100.374] lstrlenW (lpString=".docx") returned 5 [0100.374] lstrcmpiW (lpString1=".docx", lpString2="1.PNG") returned -1 [0100.374] lstrlenW (lpString=".pdf") returned 4 [0100.374] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0100.374] lstrlenW (lpString=".xls") returned 4 [0100.374] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0100.374] lstrlenW (lpString=".xlsx") returned 5 [0100.374] lstrcmpiW (lpString1=".xlsx", lpString2="1.PNG") returned -1 [0100.374] lstrlenW (lpString=".ppt") returned 4 [0100.374] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0100.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.374] lstrlenW (lpString=".zip") returned 4 [0100.374] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0100.374] lstrlenW (lpString=".rar") returned 4 [0100.374] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0100.374] lstrlenW (lpString=".bz2") returned 4 [0100.374] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0100.374] lstrlenW (lpString=".7z") returned 3 [0100.374] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0100.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.374] lstrlenW (lpString=".dbf") returned 4 [0100.374] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0100.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.374] lstrlenW (lpString=".1cd") returned 4 [0100.374] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0100.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 63 [0100.374] lstrlenW (lpString=".jpg") returned 4 [0100.374] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0100.374] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") [0100.620] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4900) returned 1 [0100.620] CloseHandle (hObject=0x22c) returned 1 [0100.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 0x20 [0100.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0100.620] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.620] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.623] GetLastError () returned 0x0 [0100.623] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1324, lpOverlapped=0x0) returned 1 [0100.625] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0100.626] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.626] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.626] SetEndOfFile (hFile=0x1c0) returned 1 [0100.626] CloseHandle (hObject=0x1c0) returned 1 [0100.626] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.626] SetEndOfFile (hFile=0x22c) returned 1 [0100.627] CloseHandle (hObject=0x22c) returned 1 [0100.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 1 [0100.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.627] lstrlenW (lpString=".doc") returned 4 [0100.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.627] lstrlenW (lpString=".docx") returned 5 [0100.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.627] lstrlenW (lpString=".pdf") returned 4 [0100.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.627] lstrlenW (lpString=".xls") returned 4 [0100.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.627] lstrlenW (lpString=".xlsx") returned 5 [0100.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.628] lstrlenW (lpString=".ppt") returned 4 [0100.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.628] lstrlenW (lpString=".zip") returned 4 [0100.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.628] lstrlenW (lpString=".rar") returned 4 [0100.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString=".bz2") returned 4 [0100.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString=".7z") returned 3 [0100.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.628] lstrlenW (lpString=".dbf") returned 4 [0100.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.628] lstrlenW (lpString=".1cd") returned 4 [0100.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.628] lstrlenW (lpString=".jpg") returned 4 [0100.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString=".pdf") returned 4 [0100.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString=".xls") returned 4 [0100.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.628] lstrlenW (lpString=".xlsx") returned 5 [0100.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.628] lstrlenW (lpString=".ppt") returned 4 [0100.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.628] lstrlenW (lpString=".zip") returned 4 [0100.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.628] lstrlenW (lpString=".rar") returned 4 [0100.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.629] lstrlenW (lpString=".bz2") returned 4 [0100.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.629] lstrlenW (lpString=".7z") returned 3 [0100.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.629] lstrlenW (lpString=".dbf") returned 4 [0100.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.629] lstrlenW (lpString=".1cd") returned 4 [0100.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 63 [0100.629] lstrlenW (lpString=".jpg") returned 4 [0100.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.629] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") [0100.629] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10148) returned 1 [0100.630] CloseHandle (hObject=0x22c) returned 1 [0100.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 0x20 [0100.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0100.630] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.630] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.630] GetLastError () returned 0x0 [0100.630] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x27a4, lpOverlapped=0x0) returned 1 [0100.633] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0100.634] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.634] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.634] SetEndOfFile (hFile=0x1c0) returned 1 [0100.634] CloseHandle (hObject=0x1c0) returned 1 [0100.634] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.634] SetEndOfFile (hFile=0x22c) returned 1 [0100.635] CloseHandle (hObject=0x22c) returned 1 [0100.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 1 [0100.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.635] lstrlenW (lpString=".doc") returned 4 [0100.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.635] lstrlenW (lpString=".docx") returned 5 [0100.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.635] lstrlenW (lpString=".pdf") returned 4 [0100.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.635] lstrlenW (lpString=".xls") returned 4 [0100.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.635] lstrlenW (lpString=".xlsx") returned 5 [0100.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.635] lstrlenW (lpString=".ppt") returned 4 [0100.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.636] lstrlenW (lpString=".zip") returned 4 [0100.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.636] lstrlenW (lpString=".rar") returned 4 [0100.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString=".bz2") returned 4 [0100.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString=".7z") returned 3 [0100.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.636] lstrlenW (lpString=".dbf") returned 4 [0100.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.636] lstrlenW (lpString=".1cd") returned 4 [0100.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.636] lstrlenW (lpString=".jpg") returned 4 [0100.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString=".pdf") returned 4 [0100.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString=".xls") returned 4 [0100.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.636] lstrlenW (lpString=".xlsx") returned 5 [0100.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.636] lstrlenW (lpString=".ppt") returned 4 [0100.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.636] lstrlenW (lpString=".zip") returned 4 [0100.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.636] lstrlenW (lpString=".rar") returned 4 [0100.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.637] lstrlenW (lpString=".bz2") returned 4 [0100.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.637] lstrlenW (lpString=".7z") returned 3 [0100.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.637] lstrlenW (lpString=".dbf") returned 4 [0100.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.637] lstrlenW (lpString=".1cd") returned 4 [0100.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 63 [0100.637] lstrlenW (lpString=".jpg") returned 4 [0100.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.637] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") [0100.637] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20332) returned 1 [0100.638] CloseHandle (hObject=0x22c) returned 1 [0100.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 0x20 [0100.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0100.638] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.638] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.639] GetLastError () returned 0x0 [0100.639] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4f6c, lpOverlapped=0x0) returned 1 [0100.640] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4f70, lpOverlapped=0x0) returned 1 [0100.642] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.642] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.642] SetEndOfFile (hFile=0x1c0) returned 1 [0100.642] CloseHandle (hObject=0x1c0) returned 1 [0100.642] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.642] SetEndOfFile (hFile=0x22c) returned 1 [0100.643] CloseHandle (hObject=0x22c) returned 1 [0100.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 1 [0100.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.643] lstrlenW (lpString=".doc") returned 4 [0100.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.643] lstrlenW (lpString=".docx") returned 5 [0100.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.643] lstrlenW (lpString=".pdf") returned 4 [0100.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString=".xls") returned 4 [0100.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.644] lstrlenW (lpString=".xlsx") returned 5 [0100.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.644] lstrlenW (lpString=".ppt") returned 4 [0100.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.644] lstrlenW (lpString=".zip") returned 4 [0100.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.644] lstrlenW (lpString=".rar") returned 4 [0100.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString=".bz2") returned 4 [0100.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString=".7z") returned 3 [0100.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.644] lstrlenW (lpString=".dbf") returned 4 [0100.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.644] lstrlenW (lpString=".1cd") returned 4 [0100.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.644] lstrlenW (lpString=".jpg") returned 4 [0100.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString=".pdf") returned 4 [0100.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString=".xls") returned 4 [0100.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.644] lstrlenW (lpString=".xlsx") returned 5 [0100.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.644] lstrlenW (lpString=".ppt") returned 4 [0100.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.645] lstrlenW (lpString=".zip") returned 4 [0100.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.645] lstrlenW (lpString=".rar") returned 4 [0100.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.645] lstrlenW (lpString=".bz2") returned 4 [0100.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.645] lstrlenW (lpString=".7z") returned 3 [0100.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.645] lstrlenW (lpString=".dbf") returned 4 [0100.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.645] lstrlenW (lpString=".1cd") returned 4 [0100.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 63 [0100.645] lstrlenW (lpString=".jpg") returned 4 [0100.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.645] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") [0100.794] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3088) returned 1 [0100.794] CloseHandle (hObject=0x15c) returned 1 [0100.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 0x20 [0100.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.795] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.795] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.797] GetLastError () returned 0x0 [0100.797] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc10, lpOverlapped=0x0) returned 1 [0100.800] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc20, lpOverlapped=0x0) returned 1 [0100.801] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.801] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.801] SetEndOfFile (hFile=0x16c) returned 1 [0100.801] CloseHandle (hObject=0x16c) returned 1 [0100.801] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.801] SetEndOfFile (hFile=0x15c) returned 1 [0100.802] CloseHandle (hObject=0x15c) returned 1 [0100.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 1 [0100.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.802] lstrlenW (lpString=".doc") returned 4 [0100.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.802] lstrlenW (lpString=".docx") returned 5 [0100.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.803] lstrlenW (lpString=".pdf") returned 4 [0100.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString=".xls") returned 4 [0100.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.803] lstrlenW (lpString=".xlsx") returned 5 [0100.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.803] lstrlenW (lpString=".ppt") returned 4 [0100.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.803] lstrlenW (lpString=".zip") returned 4 [0100.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.803] lstrlenW (lpString=".rar") returned 4 [0100.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString=".bz2") returned 4 [0100.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString=".7z") returned 3 [0100.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.803] lstrlenW (lpString=".dbf") returned 4 [0100.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.803] lstrlenW (lpString=".1cd") returned 4 [0100.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.803] lstrlenW (lpString=".jpg") returned 4 [0100.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString=".pdf") returned 4 [0100.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.803] lstrlenW (lpString=".xls") returned 4 [0100.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.803] lstrlenW (lpString=".xlsx") returned 5 [0100.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.804] lstrlenW (lpString=".ppt") returned 4 [0100.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.804] lstrlenW (lpString=".zip") returned 4 [0100.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.804] lstrlenW (lpString=".rar") returned 4 [0100.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.804] lstrlenW (lpString=".bz2") returned 4 [0100.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.804] lstrlenW (lpString=".7z") returned 3 [0100.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.804] lstrlenW (lpString=".dbf") returned 4 [0100.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.804] lstrlenW (lpString=".1cd") returned 4 [0100.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 63 [0100.804] lstrlenW (lpString=".jpg") returned 4 [0100.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.804] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") [0100.808] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=22656) returned 1 [0100.808] CloseHandle (hObject=0x15c) returned 1 [0100.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 0x20 [0100.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.808] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.808] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.809] GetLastError () returned 0x0 [0100.809] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5880, lpOverlapped=0x0) returned 1 [0100.811] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5890, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5890, lpOverlapped=0x0) returned 1 [0100.812] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.812] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.812] SetEndOfFile (hFile=0x16c) returned 1 [0100.812] CloseHandle (hObject=0x16c) returned 1 [0100.812] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.813] SetEndOfFile (hFile=0x15c) returned 1 [0100.813] CloseHandle (hObject=0x15c) returned 1 [0100.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 1 [0100.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.814] lstrlenW (lpString=".doc") returned 4 [0100.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString=".docx") returned 5 [0100.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.814] lstrlenW (lpString=".pdf") returned 4 [0100.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString=".xls") returned 4 [0100.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.814] lstrlenW (lpString=".xlsx") returned 5 [0100.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.814] lstrlenW (lpString=".ppt") returned 4 [0100.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.814] lstrlenW (lpString=".zip") returned 4 [0100.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.814] lstrlenW (lpString=".rar") returned 4 [0100.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString=".bz2") returned 4 [0100.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString=".7z") returned 3 [0100.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.814] lstrlenW (lpString=".dbf") returned 4 [0100.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".1cd") returned 4 [0100.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".jpg") returned 4 [0100.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString=".pdf") returned 4 [0100.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString=".xls") returned 4 [0100.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.815] lstrlenW (lpString=".xlsx") returned 5 [0100.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.815] lstrlenW (lpString=".ppt") returned 4 [0100.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".zip") returned 4 [0100.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.815] lstrlenW (lpString=".rar") returned 4 [0100.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString=".bz2") returned 4 [0100.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString=".7z") returned 3 [0100.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".dbf") returned 4 [0100.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".1cd") returned 4 [0100.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 63 [0100.815] lstrlenW (lpString=".jpg") returned 4 [0100.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.816] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") [0100.816] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=18300) returned 1 [0100.816] CloseHandle (hObject=0x15c) returned 1 [0100.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 0x20 [0100.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.816] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.817] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.817] GetLastError () returned 0x0 [0100.817] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x477c, lpOverlapped=0x0) returned 1 [0100.819] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4780, lpOverlapped=0x0) returned 1 [0100.821] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.821] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.821] SetEndOfFile (hFile=0x16c) returned 1 [0100.821] CloseHandle (hObject=0x16c) returned 1 [0100.821] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.821] SetEndOfFile (hFile=0x15c) returned 1 [0100.822] CloseHandle (hObject=0x15c) returned 1 [0100.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 1 [0100.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.822] lstrlenW (lpString=".doc") returned 4 [0100.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.822] lstrlenW (lpString=".docx") returned 5 [0100.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.822] lstrlenW (lpString=".pdf") returned 4 [0100.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.822] lstrlenW (lpString=".xls") returned 4 [0100.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.823] lstrlenW (lpString=".xlsx") returned 5 [0100.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.823] lstrlenW (lpString=".ppt") returned 4 [0100.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.823] lstrlenW (lpString=".zip") returned 4 [0100.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.823] lstrlenW (lpString=".rar") returned 4 [0100.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString=".bz2") returned 4 [0100.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString=".7z") returned 3 [0100.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.823] lstrlenW (lpString=".dbf") returned 4 [0100.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.823] lstrlenW (lpString=".1cd") returned 4 [0100.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.823] lstrlenW (lpString=".jpg") returned 4 [0100.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString=".pdf") returned 4 [0100.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.823] lstrlenW (lpString=".xls") returned 4 [0100.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.823] lstrlenW (lpString=".xlsx") returned 5 [0100.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.823] lstrlenW (lpString=".ppt") returned 4 [0100.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.824] lstrlenW (lpString=".zip") returned 4 [0100.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.824] lstrlenW (lpString=".rar") returned 4 [0100.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.824] lstrlenW (lpString=".bz2") returned 4 [0100.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.824] lstrlenW (lpString=".7z") returned 3 [0100.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.824] lstrlenW (lpString=".dbf") returned 4 [0100.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.824] lstrlenW (lpString=".1cd") returned 4 [0100.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 63 [0100.824] lstrlenW (lpString=".jpg") returned 4 [0100.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.824] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") [0100.825] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1328) returned 1 [0100.825] CloseHandle (hObject=0x15c) returned 1 [0100.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 0x20 [0100.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.825] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.825] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.826] GetLastError () returned 0x0 [0100.826] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x530, lpOverlapped=0x0) returned 1 [0100.827] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x540, lpOverlapped=0x0) returned 1 [0100.828] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.828] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.828] SetEndOfFile (hFile=0x16c) returned 1 [0100.828] CloseHandle (hObject=0x16c) returned 1 [0100.828] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.828] SetEndOfFile (hFile=0x15c) returned 1 [0100.829] CloseHandle (hObject=0x15c) returned 1 [0100.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 1 [0100.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.829] lstrlenW (lpString=".doc") returned 4 [0100.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.829] lstrlenW (lpString=".docx") returned 5 [0100.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.830] lstrlenW (lpString=".pdf") returned 4 [0100.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString=".xls") returned 4 [0100.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.830] lstrlenW (lpString=".xlsx") returned 5 [0100.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.830] lstrlenW (lpString=".ppt") returned 4 [0100.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.830] lstrlenW (lpString=".zip") returned 4 [0100.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.830] lstrlenW (lpString=".rar") returned 4 [0100.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString=".bz2") returned 4 [0100.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString=".7z") returned 3 [0100.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.830] lstrlenW (lpString=".dbf") returned 4 [0100.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.830] lstrlenW (lpString=".1cd") returned 4 [0100.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.830] lstrlenW (lpString=".jpg") returned 4 [0100.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString=".pdf") returned 4 [0100.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.830] lstrlenW (lpString=".xls") returned 4 [0100.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.830] lstrlenW (lpString=".xlsx") returned 5 [0100.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.831] lstrlenW (lpString=".ppt") returned 4 [0100.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.831] lstrlenW (lpString=".zip") returned 4 [0100.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.831] lstrlenW (lpString=".rar") returned 4 [0100.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.831] lstrlenW (lpString=".bz2") returned 4 [0100.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.831] lstrlenW (lpString=".7z") returned 3 [0100.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.831] lstrlenW (lpString=".dbf") returned 4 [0100.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.831] lstrlenW (lpString=".1cd") returned 4 [0100.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 63 [0100.831] lstrlenW (lpString=".jpg") returned 4 [0100.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.831] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") [0100.832] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32020) returned 1 [0100.832] CloseHandle (hObject=0x15c) returned 1 [0100.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 0x20 [0100.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.832] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.832] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.833] GetLastError () returned 0x0 [0100.833] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7d14, lpOverlapped=0x0) returned 1 [0101.006] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7d20, lpOverlapped=0x0) returned 1 [0101.007] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.007] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.007] SetEndOfFile (hFile=0x16c) returned 1 [0101.007] CloseHandle (hObject=0x16c) returned 1 [0101.007] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.007] SetEndOfFile (hFile=0x15c) returned 1 [0101.008] CloseHandle (hObject=0x15c) returned 1 [0101.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 1 [0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.009] lstrlenW (lpString=".doc") returned 4 [0101.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString=".docx") returned 5 [0101.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.009] lstrlenW (lpString=".pdf") returned 4 [0101.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString=".xls") returned 4 [0101.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.009] lstrlenW (lpString=".xlsx") returned 5 [0101.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.009] lstrlenW (lpString=".ppt") returned 4 [0101.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.009] lstrlenW (lpString=".zip") returned 4 [0101.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.009] lstrlenW (lpString=".rar") returned 4 [0101.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString=".bz2") returned 4 [0101.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString=".7z") returned 3 [0101.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.009] lstrlenW (lpString=".dbf") returned 4 [0101.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".1cd") returned 4 [0101.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".jpg") returned 4 [0101.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString=".pdf") returned 4 [0101.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString=".xls") returned 4 [0101.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.010] lstrlenW (lpString=".xlsx") returned 5 [0101.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.010] lstrlenW (lpString=".ppt") returned 4 [0101.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".zip") returned 4 [0101.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.010] lstrlenW (lpString=".rar") returned 4 [0101.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString=".bz2") returned 4 [0101.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString=".7z") returned 3 [0101.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".dbf") returned 4 [0101.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".1cd") returned 4 [0101.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 63 [0101.010] lstrlenW (lpString=".jpg") returned 4 [0101.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.011] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") [0101.011] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7992) returned 1 [0101.011] CloseHandle (hObject=0x15c) returned 1 [0101.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 0x20 [0101.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.011] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.012] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.012] GetLastError () returned 0x0 [0101.012] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0101.014] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0101.015] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.015] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.015] SetEndOfFile (hFile=0x16c) returned 1 [0101.015] CloseHandle (hObject=0x16c) returned 1 [0101.015] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.015] SetEndOfFile (hFile=0x15c) returned 1 [0101.016] CloseHandle (hObject=0x15c) returned 1 [0101.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 1 [0101.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.017] lstrlenW (lpString=".doc") returned 4 [0101.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString=".docx") returned 5 [0101.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.017] lstrlenW (lpString=".pdf") returned 4 [0101.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString=".xls") returned 4 [0101.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.017] lstrlenW (lpString=".xlsx") returned 5 [0101.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.017] lstrlenW (lpString=".ppt") returned 4 [0101.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.017] lstrlenW (lpString=".zip") returned 4 [0101.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.017] lstrlenW (lpString=".rar") returned 4 [0101.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString=".bz2") returned 4 [0101.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString=".7z") returned 3 [0101.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.017] lstrlenW (lpString=".dbf") returned 4 [0101.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.017] lstrlenW (lpString=".1cd") returned 4 [0101.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.018] lstrlenW (lpString=".jpg") returned 4 [0101.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString=".pdf") returned 4 [0101.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString=".xls") returned 4 [0101.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.018] lstrlenW (lpString=".xlsx") returned 5 [0101.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.018] lstrlenW (lpString=".ppt") returned 4 [0101.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.018] lstrlenW (lpString=".zip") returned 4 [0101.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.018] lstrlenW (lpString=".rar") returned 4 [0101.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString=".bz2") returned 4 [0101.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString=".7z") returned 3 [0101.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.018] lstrlenW (lpString=".dbf") returned 4 [0101.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.018] lstrlenW (lpString=".1cd") returned 4 [0101.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 63 [0101.018] lstrlenW (lpString=".jpg") returned 4 [0101.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.018] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") [0101.020] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4680) returned 1 [0101.020] CloseHandle (hObject=0x15c) returned 1 [0101.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 0x20 [0101.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.020] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.020] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.021] GetLastError () returned 0x0 [0101.021] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1248, lpOverlapped=0x0) returned 1 [0101.023] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1250, lpOverlapped=0x0) returned 1 [0101.024] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.024] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.024] SetEndOfFile (hFile=0x16c) returned 1 [0101.024] CloseHandle (hObject=0x16c) returned 1 [0101.024] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.024] SetEndOfFile (hFile=0x15c) returned 1 [0101.025] CloseHandle (hObject=0x15c) returned 1 [0101.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 1 [0101.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.025] lstrlenW (lpString=".doc") returned 4 [0101.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.025] lstrlenW (lpString=".docx") returned 5 [0101.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.025] lstrlenW (lpString=".pdf") returned 4 [0101.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.025] lstrlenW (lpString=".xls") returned 4 [0101.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.026] lstrlenW (lpString=".xlsx") returned 5 [0101.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.026] lstrlenW (lpString=".ppt") returned 4 [0101.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.026] lstrlenW (lpString=".zip") returned 4 [0101.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.026] lstrlenW (lpString=".rar") returned 4 [0101.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString=".bz2") returned 4 [0101.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString=".7z") returned 3 [0101.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.026] lstrlenW (lpString=".dbf") returned 4 [0101.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.026] lstrlenW (lpString=".1cd") returned 4 [0101.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.026] lstrlenW (lpString=".jpg") returned 4 [0101.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString=".pdf") returned 4 [0101.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString=".xls") returned 4 [0101.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.026] lstrlenW (lpString=".xlsx") returned 5 [0101.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.026] lstrlenW (lpString=".ppt") returned 4 [0101.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.027] lstrlenW (lpString=".zip") returned 4 [0101.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.027] lstrlenW (lpString=".rar") returned 4 [0101.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.027] lstrlenW (lpString=".bz2") returned 4 [0101.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.027] lstrlenW (lpString=".7z") returned 3 [0101.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.027] lstrlenW (lpString=".dbf") returned 4 [0101.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.027] lstrlenW (lpString=".1cd") returned 4 [0101.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 63 [0101.027] lstrlenW (lpString=".jpg") returned 4 [0101.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.027] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") [0101.028] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8752) returned 1 [0101.028] CloseHandle (hObject=0x15c) returned 1 [0101.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 0x20 [0101.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.028] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.028] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.029] GetLastError () returned 0x0 [0101.029] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2230, lpOverlapped=0x0) returned 1 [0101.031] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0101.032] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.032] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.032] SetEndOfFile (hFile=0x16c) returned 1 [0101.032] CloseHandle (hObject=0x16c) returned 1 [0101.032] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.032] SetEndOfFile (hFile=0x15c) returned 1 [0101.033] CloseHandle (hObject=0x15c) returned 1 [0101.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 1 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString=".doc") returned 4 [0101.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString=".docx") returned 5 [0101.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.034] lstrlenW (lpString=".pdf") returned 4 [0101.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString=".xls") returned 4 [0101.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.034] lstrlenW (lpString=".xlsx") returned 5 [0101.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.034] lstrlenW (lpString=".ppt") returned 4 [0101.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString=".zip") returned 4 [0101.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.034] lstrlenW (lpString=".rar") returned 4 [0101.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString=".bz2") returned 4 [0101.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString=".7z") returned 3 [0101.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString=".dbf") returned 4 [0101.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString=".1cd") returned 4 [0101.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.034] lstrlenW (lpString=".jpg") returned 4 [0101.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString=".pdf") returned 4 [0101.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString=".xls") returned 4 [0101.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.035] lstrlenW (lpString=".xlsx") returned 5 [0101.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.035] lstrlenW (lpString=".ppt") returned 4 [0101.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.035] lstrlenW (lpString=".zip") returned 4 [0101.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.035] lstrlenW (lpString=".rar") returned 4 [0101.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString=".bz2") returned 4 [0101.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString=".7z") returned 3 [0101.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.035] lstrlenW (lpString=".dbf") returned 4 [0101.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.035] lstrlenW (lpString=".1cd") returned 4 [0101.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 63 [0101.035] lstrlenW (lpString=".jpg") returned 4 [0101.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.035] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") [0101.036] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5552) returned 1 [0101.036] CloseHandle (hObject=0x15c) returned 1 [0101.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 0x20 [0101.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.036] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.036] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.037] GetLastError () returned 0x0 [0101.037] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15b0, lpOverlapped=0x0) returned 1 [0101.039] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0101.040] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.040] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.040] SetEndOfFile (hFile=0x16c) returned 1 [0101.040] CloseHandle (hObject=0x16c) returned 1 [0101.040] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.040] SetEndOfFile (hFile=0x15c) returned 1 [0101.041] CloseHandle (hObject=0x15c) returned 1 [0101.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.042] lstrlenW (lpString=".doc") returned 4 [0101.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".docx") returned 5 [0101.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.042] lstrlenW (lpString=".pdf") returned 4 [0101.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".xls") returned 4 [0101.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.042] lstrlenW (lpString=".xlsx") returned 5 [0101.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.042] lstrlenW (lpString=".ppt") returned 4 [0101.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.042] lstrlenW (lpString=".zip") returned 4 [0101.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.042] lstrlenW (lpString=".rar") returned 4 [0101.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".bz2") returned 4 [0101.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".7z") returned 3 [0101.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.042] lstrlenW (lpString=".dbf") returned 4 [0101.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.042] lstrlenW (lpString=".1cd") returned 4 [0101.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.043] lstrlenW (lpString=".jpg") returned 4 [0101.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".pdf") returned 4 [0101.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".xls") returned 4 [0101.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.043] lstrlenW (lpString=".xlsx") returned 5 [0101.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.043] lstrlenW (lpString=".ppt") returned 4 [0101.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.043] lstrlenW (lpString=".zip") returned 4 [0101.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.043] lstrlenW (lpString=".rar") returned 4 [0101.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".bz2") returned 4 [0101.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".7z") returned 3 [0101.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.043] lstrlenW (lpString=".dbf") returned 4 [0101.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.043] lstrlenW (lpString=".1cd") returned 4 [0101.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 63 [0101.043] lstrlenW (lpString=".jpg") returned 4 [0101.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.043] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") [0101.044] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6232) returned 1 [0101.044] CloseHandle (hObject=0x15c) returned 1 [0101.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 0x20 [0101.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.045] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.045] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.045] GetLastError () returned 0x0 [0101.045] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1858, lpOverlapped=0x0) returned 1 [0101.057] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1860, lpOverlapped=0x0) returned 1 [0101.057] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.057] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.058] SetEndOfFile (hFile=0x16c) returned 1 [0101.142] CloseHandle (hObject=0x16c) returned 1 [0101.142] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.142] SetEndOfFile (hFile=0x15c) returned 1 [0101.143] CloseHandle (hObject=0x15c) returned 1 [0101.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 1 [0101.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.200] lstrlenW (lpString=".doc") returned 4 [0101.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.200] lstrlenW (lpString=".docx") returned 5 [0101.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.200] lstrlenW (lpString=".pdf") returned 4 [0101.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.200] lstrlenW (lpString=".xls") returned 4 [0101.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.201] lstrlenW (lpString=".xlsx") returned 5 [0101.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.201] lstrlenW (lpString=".ppt") returned 4 [0101.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.201] lstrlenW (lpString=".zip") returned 4 [0101.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.201] lstrlenW (lpString=".rar") returned 4 [0101.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString=".bz2") returned 4 [0101.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString=".7z") returned 3 [0101.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.201] lstrlenW (lpString=".dbf") returned 4 [0101.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.201] lstrlenW (lpString=".1cd") returned 4 [0101.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.201] lstrlenW (lpString=".jpg") returned 4 [0101.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString=".pdf") returned 4 [0101.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString=".xls") returned 4 [0101.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.201] lstrlenW (lpString=".xlsx") returned 5 [0101.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.201] lstrlenW (lpString=".ppt") returned 4 [0101.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.202] lstrlenW (lpString=".zip") returned 4 [0101.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.202] lstrlenW (lpString=".rar") returned 4 [0101.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.202] lstrlenW (lpString=".bz2") returned 4 [0101.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.202] lstrlenW (lpString=".7z") returned 3 [0101.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.202] lstrlenW (lpString=".dbf") returned 4 [0101.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.202] lstrlenW (lpString=".1cd") returned 4 [0101.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 63 [0101.202] lstrlenW (lpString=".jpg") returned 4 [0101.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.202] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") [0101.203] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=28912) returned 1 [0101.203] CloseHandle (hObject=0x1ec) returned 1 [0101.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 0x20 [0101.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0101.203] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.203] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0101.204] GetLastError () returned 0x0 [0101.204] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x70f0, lpOverlapped=0x0) returned 1 [0101.206] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7100, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7100, lpOverlapped=0x0) returned 1 [0101.207] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.207] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.207] SetEndOfFile (hFile=0x1b4) returned 1 [0101.207] CloseHandle (hObject=0x1b4) returned 1 [0101.208] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.208] SetEndOfFile (hFile=0x1ec) returned 1 [0101.209] CloseHandle (hObject=0x1ec) returned 1 [0101.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 1 [0101.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString=".doc") returned 4 [0101.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString=".docx") returned 5 [0101.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.210] lstrlenW (lpString=".pdf") returned 4 [0101.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString=".xls") returned 4 [0101.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.210] lstrlenW (lpString=".xlsx") returned 5 [0101.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.210] lstrlenW (lpString=".ppt") returned 4 [0101.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString=".zip") returned 4 [0101.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.210] lstrlenW (lpString=".rar") returned 4 [0101.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString=".bz2") returned 4 [0101.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString=".7z") returned 3 [0101.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString=".dbf") returned 4 [0101.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString=".1cd") returned 4 [0101.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.210] lstrlenW (lpString=".jpg") returned 4 [0101.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString=".pdf") returned 4 [0101.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString=".xls") returned 4 [0101.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.211] lstrlenW (lpString=".xlsx") returned 5 [0101.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.211] lstrlenW (lpString=".ppt") returned 4 [0101.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.211] lstrlenW (lpString=".zip") returned 4 [0101.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.211] lstrlenW (lpString=".rar") returned 4 [0101.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString=".bz2") returned 4 [0101.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString=".7z") returned 3 [0101.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.211] lstrlenW (lpString=".dbf") returned 4 [0101.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.211] lstrlenW (lpString=".1cd") returned 4 [0101.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 63 [0101.211] lstrlenW (lpString=".jpg") returned 4 [0101.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.211] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") [0101.212] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5806) returned 1 [0101.212] CloseHandle (hObject=0x1ec) returned 1 [0101.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 0x20 [0101.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0101.212] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.212] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0101.213] GetLastError () returned 0x0 [0101.213] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x16ae, lpOverlapped=0x0) returned 1 [0101.298] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0101.299] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.299] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.299] SetEndOfFile (hFile=0x1b4) returned 1 [0101.299] CloseHandle (hObject=0x1b4) returned 1 [0101.299] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.299] SetEndOfFile (hFile=0x1ec) returned 1 [0101.300] CloseHandle (hObject=0x1ec) returned 1 [0101.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 1 [0101.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.301] lstrlenW (lpString=".doc") returned 4 [0101.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString=".docx") returned 5 [0101.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.301] lstrlenW (lpString=".pdf") returned 4 [0101.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString=".xls") returned 4 [0101.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.301] lstrlenW (lpString=".xlsx") returned 5 [0101.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.301] lstrlenW (lpString=".ppt") returned 4 [0101.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.301] lstrlenW (lpString=".zip") returned 4 [0101.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.301] lstrlenW (lpString=".rar") returned 4 [0101.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString=".bz2") returned 4 [0101.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString=".7z") returned 3 [0101.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.301] lstrlenW (lpString=".dbf") returned 4 [0101.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.301] lstrlenW (lpString=".1cd") returned 4 [0101.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.302] lstrlenW (lpString=".jpg") returned 4 [0101.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString=".pdf") returned 4 [0101.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString=".xls") returned 4 [0101.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.302] lstrlenW (lpString=".xlsx") returned 5 [0101.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.302] lstrlenW (lpString=".ppt") returned 4 [0101.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.302] lstrlenW (lpString=".zip") returned 4 [0101.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.302] lstrlenW (lpString=".rar") returned 4 [0101.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString=".bz2") returned 4 [0101.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString=".7z") returned 3 [0101.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.302] lstrlenW (lpString=".dbf") returned 4 [0101.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.302] lstrlenW (lpString=".1cd") returned 4 [0101.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 63 [0101.303] lstrlenW (lpString=".jpg") returned 4 [0101.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.303] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") [0101.737] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3438) returned 1 [0101.737] CloseHandle (hObject=0x158) returned 1 [0101.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 0x20 [0101.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.738] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.738] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.739] GetLastError () returned 0x0 [0101.739] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd6e, lpOverlapped=0x0) returned 1 [0101.770] WriteFile (in: hFile=0x19c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd70, lpOverlapped=0x0) returned 1 [0101.833] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.833] WriteFile (in: hFile=0x19c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.834] SetEndOfFile (hFile=0x19c) returned 1 [0102.065] CloseHandle (hObject=0x19c) returned 1 [0102.120] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.120] SetEndOfFile (hFile=0x158) returned 1 [0102.162] CloseHandle (hObject=0x158) returned 1 [0102.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 1 [0102.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.255] lstrlenW (lpString=".doc") returned 4 [0102.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.255] lstrlenW (lpString=".docx") returned 5 [0102.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.255] lstrlenW (lpString=".pdf") returned 4 [0102.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.255] lstrlenW (lpString=".xls") returned 4 [0102.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.271] lstrlenW (lpString=".xlsx") returned 5 [0102.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.271] lstrlenW (lpString=".ppt") returned 4 [0102.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.271] lstrlenW (lpString=".zip") returned 4 [0102.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.271] lstrlenW (lpString=".rar") returned 4 [0102.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.272] lstrlenW (lpString=".bz2") returned 4 [0102.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.280] lstrlenW (lpString=".7z") returned 3 [0102.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.280] lstrlenW (lpString=".dbf") returned 4 [0102.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.280] lstrlenW (lpString=".1cd") returned 4 [0102.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.280] lstrlenW (lpString=".jpg") returned 4 [0102.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.280] lstrlenW (lpString=".pdf") returned 4 [0102.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString=".xls") returned 4 [0102.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.284] lstrlenW (lpString=".xlsx") returned 5 [0102.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.285] lstrlenW (lpString=".ppt") returned 4 [0102.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.285] lstrlenW (lpString=".zip") returned 4 [0102.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.285] lstrlenW (lpString=".rar") returned 4 [0102.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.285] lstrlenW (lpString=".bz2") returned 4 [0102.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.285] lstrlenW (lpString=".7z") returned 3 [0102.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.285] lstrlenW (lpString=".dbf") returned 4 [0102.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.285] lstrlenW (lpString=".1cd") returned 4 [0102.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 63 [0102.285] lstrlenW (lpString=".jpg") returned 4 [0102.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.285] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") [0102.587] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5316) returned 1 [0102.587] CloseHandle (hObject=0x1ec) returned 1 [0102.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 0x20 [0102.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0102.587] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.587] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0102.588] GetLastError () returned 0x0 [0102.588] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x14c4, lpOverlapped=0x0) returned 1 [0102.641] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0102.642] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.642] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.642] SetEndOfFile (hFile=0x1b4) returned 1 [0102.642] CloseHandle (hObject=0x1b4) returned 1 [0102.643] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.643] SetEndOfFile (hFile=0x1ec) returned 1 [0102.644] CloseHandle (hObject=0x1ec) returned 1 [0102.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 1 [0102.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.644] lstrlenW (lpString=".doc") returned 4 [0102.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.644] lstrlenW (lpString=".docx") returned 5 [0102.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.644] lstrlenW (lpString=".pdf") returned 4 [0102.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.644] lstrlenW (lpString=".xls") returned 4 [0102.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.644] lstrlenW (lpString=".xlsx") returned 5 [0102.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.644] lstrlenW (lpString=".ppt") returned 4 [0102.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.644] lstrlenW (lpString=".zip") returned 4 [0102.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.645] lstrlenW (lpString=".rar") returned 4 [0102.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".bz2") returned 4 [0102.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".7z") returned 3 [0102.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.645] lstrlenW (lpString=".dbf") returned 4 [0102.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.645] lstrlenW (lpString=".1cd") returned 4 [0102.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.645] lstrlenW (lpString=".jpg") returned 4 [0102.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".pdf") returned 4 [0102.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".xls") returned 4 [0102.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.645] lstrlenW (lpString=".xlsx") returned 5 [0102.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.645] lstrlenW (lpString=".ppt") returned 4 [0102.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.645] lstrlenW (lpString=".zip") returned 4 [0102.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.645] lstrlenW (lpString=".rar") returned 4 [0102.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".bz2") returned 4 [0102.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.645] lstrlenW (lpString=".7z") returned 3 [0102.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.646] lstrlenW (lpString=".dbf") returned 4 [0102.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.646] lstrlenW (lpString=".1cd") returned 4 [0102.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 63 [0102.646] lstrlenW (lpString=".jpg") returned 4 [0102.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.646] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") [0102.647] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2272) returned 1 [0102.647] CloseHandle (hObject=0x1ec) returned 1 [0102.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 0x20 [0102.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0102.647] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.647] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0102.648] GetLastError () returned 0x0 [0102.648] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8e0, lpOverlapped=0x0) returned 1 [0102.706] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0102.707] ReadFile (in: hFile=0x1ec, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.707] WriteFile (in: hFile=0x1b4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.707] SetEndOfFile (hFile=0x1b4) returned 1 [0102.707] CloseHandle (hObject=0x1b4) returned 1 [0102.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.707] SetEndOfFile (hFile=0x1ec) returned 1 [0102.708] CloseHandle (hObject=0x1ec) returned 1 [0102.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 1 [0102.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.708] lstrlenW (lpString=".doc") returned 4 [0102.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.708] lstrlenW (lpString=".docx") returned 5 [0102.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.708] lstrlenW (lpString=".pdf") returned 4 [0102.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.708] lstrlenW (lpString=".xls") returned 4 [0102.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.709] lstrlenW (lpString=".xlsx") returned 5 [0102.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.709] lstrlenW (lpString=".ppt") returned 4 [0102.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.709] lstrlenW (lpString=".zip") returned 4 [0102.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.709] lstrlenW (lpString=".rar") returned 4 [0102.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString=".bz2") returned 4 [0102.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString=".7z") returned 3 [0102.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.709] lstrlenW (lpString=".dbf") returned 4 [0102.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.709] lstrlenW (lpString=".1cd") returned 4 [0102.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.709] lstrlenW (lpString=".jpg") returned 4 [0102.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString=".pdf") returned 4 [0102.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString=".xls") returned 4 [0102.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.709] lstrlenW (lpString=".xlsx") returned 5 [0102.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.709] lstrlenW (lpString=".ppt") returned 4 [0102.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.709] lstrlenW (lpString=".zip") returned 4 [0102.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.710] lstrlenW (lpString=".rar") returned 4 [0102.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.710] lstrlenW (lpString=".bz2") returned 4 [0102.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.710] lstrlenW (lpString=".7z") returned 3 [0102.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.710] lstrlenW (lpString=".dbf") returned 4 [0102.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.710] lstrlenW (lpString=".1cd") returned 4 [0102.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 63 [0102.710] lstrlenW (lpString=".jpg") returned 4 [0102.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.710] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") [0102.754] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3368) returned 1 [0102.754] CloseHandle (hObject=0x15c) returned 1 [0102.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 0x20 [0102.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.755] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.755] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.757] GetLastError () returned 0x0 [0102.757] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd28, lpOverlapped=0x0) returned 1 [0102.762] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0102.762] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.762] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.763] SetEndOfFile (hFile=0x180) returned 1 [0102.763] CloseHandle (hObject=0x180) returned 1 [0102.763] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.763] SetEndOfFile (hFile=0x15c) returned 1 [0102.764] CloseHandle (hObject=0x15c) returned 1 [0102.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 1 [0102.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.764] lstrlenW (lpString=".doc") returned 4 [0102.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.764] lstrlenW (lpString=".docx") returned 5 [0102.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.764] lstrlenW (lpString=".pdf") returned 4 [0102.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.764] lstrlenW (lpString=".xls") returned 4 [0102.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.764] lstrlenW (lpString=".xlsx") returned 5 [0102.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.764] lstrlenW (lpString=".ppt") returned 4 [0102.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.764] lstrlenW (lpString=".zip") returned 4 [0102.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.764] lstrlenW (lpString=".rar") returned 4 [0102.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".bz2") returned 4 [0102.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".7z") returned 3 [0102.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.765] lstrlenW (lpString=".dbf") returned 4 [0102.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.765] lstrlenW (lpString=".1cd") returned 4 [0102.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.765] lstrlenW (lpString=".jpg") returned 4 [0102.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".pdf") returned 4 [0102.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".xls") returned 4 [0102.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.765] lstrlenW (lpString=".xlsx") returned 5 [0102.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.765] lstrlenW (lpString=".ppt") returned 4 [0102.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.765] lstrlenW (lpString=".zip") returned 4 [0102.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.765] lstrlenW (lpString=".rar") returned 4 [0102.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".bz2") returned 4 [0102.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.765] lstrlenW (lpString=".7z") returned 3 [0102.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.766] lstrlenW (lpString=".dbf") returned 4 [0102.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.766] lstrlenW (lpString=".1cd") returned 4 [0102.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 63 [0102.766] lstrlenW (lpString=".jpg") returned 4 [0102.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.766] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") [0102.767] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3188) returned 1 [0102.767] CloseHandle (hObject=0x15c) returned 1 [0102.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 0x20 [0102.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.767] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.767] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.768] GetLastError () returned 0x0 [0102.768] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc74, lpOverlapped=0x0) returned 1 [0102.770] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0102.771] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.771] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.771] SetEndOfFile (hFile=0x180) returned 1 [0102.771] CloseHandle (hObject=0x180) returned 1 [0102.771] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.771] SetEndOfFile (hFile=0x15c) returned 1 [0102.772] CloseHandle (hObject=0x15c) returned 1 [0102.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 1 [0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.773] lstrlenW (lpString=".doc") returned 4 [0102.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString=".docx") returned 5 [0102.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.773] lstrlenW (lpString=".pdf") returned 4 [0102.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString=".xls") returned 4 [0102.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.773] lstrlenW (lpString=".xlsx") returned 5 [0102.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.773] lstrlenW (lpString=".ppt") returned 4 [0102.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.773] lstrlenW (lpString=".zip") returned 4 [0102.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.773] lstrlenW (lpString=".rar") returned 4 [0102.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString=".bz2") returned 4 [0102.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString=".7z") returned 3 [0102.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.773] lstrlenW (lpString=".dbf") returned 4 [0102.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.773] lstrlenW (lpString=".1cd") returned 4 [0102.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.774] lstrlenW (lpString=".jpg") returned 4 [0102.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString=".pdf") returned 4 [0102.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString=".xls") returned 4 [0102.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.774] lstrlenW (lpString=".xlsx") returned 5 [0102.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.774] lstrlenW (lpString=".ppt") returned 4 [0102.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.774] lstrlenW (lpString=".zip") returned 4 [0102.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.774] lstrlenW (lpString=".rar") returned 4 [0102.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString=".bz2") returned 4 [0102.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString=".7z") returned 3 [0102.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.774] lstrlenW (lpString=".dbf") returned 4 [0102.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.774] lstrlenW (lpString=".1cd") returned 4 [0102.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 63 [0102.774] lstrlenW (lpString=".jpg") returned 4 [0102.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.774] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") [0102.775] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3308) returned 1 [0102.775] CloseHandle (hObject=0x15c) returned 1 [0102.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 0x20 [0102.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.775] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.775] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.776] GetLastError () returned 0x0 [0102.776] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xcec, lpOverlapped=0x0) returned 1 [0102.778] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0102.779] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.779] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.779] SetEndOfFile (hFile=0x180) returned 1 [0102.779] CloseHandle (hObject=0x180) returned 1 [0102.779] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.779] SetEndOfFile (hFile=0x15c) returned 1 [0102.780] CloseHandle (hObject=0x15c) returned 1 [0102.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 1 [0102.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.780] lstrlenW (lpString=".doc") returned 4 [0102.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.780] lstrlenW (lpString=".docx") returned 5 [0102.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.780] lstrlenW (lpString=".pdf") returned 4 [0102.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.780] lstrlenW (lpString=".xls") returned 4 [0102.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.781] lstrlenW (lpString=".xlsx") returned 5 [0102.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.781] lstrlenW (lpString=".ppt") returned 4 [0102.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.781] lstrlenW (lpString=".zip") returned 4 [0102.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.781] lstrlenW (lpString=".rar") returned 4 [0102.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString=".bz2") returned 4 [0102.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString=".7z") returned 3 [0102.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.781] lstrlenW (lpString=".dbf") returned 4 [0102.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.781] lstrlenW (lpString=".1cd") returned 4 [0102.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.781] lstrlenW (lpString=".jpg") returned 4 [0102.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString=".pdf") returned 4 [0102.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.781] lstrlenW (lpString=".xls") returned 4 [0102.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.781] lstrlenW (lpString=".xlsx") returned 5 [0102.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.782] lstrlenW (lpString=".ppt") returned 4 [0102.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.782] lstrlenW (lpString=".zip") returned 4 [0102.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.782] lstrlenW (lpString=".rar") returned 4 [0102.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.782] lstrlenW (lpString=".bz2") returned 4 [0102.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.782] lstrlenW (lpString=".7z") returned 3 [0102.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.782] lstrlenW (lpString=".dbf") returned 4 [0102.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.782] lstrlenW (lpString=".1cd") returned 4 [0102.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 63 [0102.782] lstrlenW (lpString=".jpg") returned 4 [0102.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.782] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") [0102.785] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3032) returned 1 [0102.785] CloseHandle (hObject=0x1a0) returned 1 [0102.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 0x20 [0102.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.786] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.787] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.789] GetLastError () returned 0x0 [0102.789] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbd8, lpOverlapped=0x0) returned 1 [0102.791] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0102.792] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.792] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.792] SetEndOfFile (hFile=0x15c) returned 1 [0102.792] CloseHandle (hObject=0x15c) returned 1 [0102.792] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.792] SetEndOfFile (hFile=0x1a0) returned 1 [0102.793] CloseHandle (hObject=0x1a0) returned 1 [0102.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 1 [0102.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.793] lstrlenW (lpString=".doc") returned 4 [0102.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.793] lstrlenW (lpString=".docx") returned 5 [0102.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.793] lstrlenW (lpString=".pdf") returned 4 [0102.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.793] lstrlenW (lpString=".xls") returned 4 [0102.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.793] lstrlenW (lpString=".xlsx") returned 5 [0102.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.794] lstrlenW (lpString=".ppt") returned 4 [0102.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.794] lstrlenW (lpString=".zip") returned 4 [0102.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.794] lstrlenW (lpString=".rar") returned 4 [0102.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString=".bz2") returned 4 [0102.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString=".7z") returned 3 [0102.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.794] lstrlenW (lpString=".dbf") returned 4 [0102.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.794] lstrlenW (lpString=".1cd") returned 4 [0102.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.794] lstrlenW (lpString=".jpg") returned 4 [0102.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString=".pdf") returned 4 [0102.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString=".xls") returned 4 [0102.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.794] lstrlenW (lpString=".xlsx") returned 5 [0102.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.794] lstrlenW (lpString=".ppt") returned 4 [0102.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.794] lstrlenW (lpString=".zip") returned 4 [0102.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.794] lstrlenW (lpString=".rar") returned 4 [0102.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.795] lstrlenW (lpString=".bz2") returned 4 [0102.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.795] lstrlenW (lpString=".7z") returned 3 [0102.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.795] lstrlenW (lpString=".dbf") returned 4 [0102.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.795] lstrlenW (lpString=".1cd") returned 4 [0102.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 63 [0102.795] lstrlenW (lpString=".jpg") returned 4 [0102.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.795] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") [0102.796] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2376) returned 1 [0102.796] CloseHandle (hObject=0x1a0) returned 1 [0102.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 0x20 [0102.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.796] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.796] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.797] GetLastError () returned 0x0 [0102.797] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x948, lpOverlapped=0x0) returned 1 [0102.912] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x950, lpOverlapped=0x0) returned 1 [0102.913] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.913] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.913] SetEndOfFile (hFile=0x15c) returned 1 [0102.960] CloseHandle (hObject=0x15c) returned 1 [0102.960] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.960] SetEndOfFile (hFile=0x1a0) returned 1 [0102.960] CloseHandle (hObject=0x1a0) returned 1 [0102.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 1 [0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.961] lstrlenW (lpString=".doc") returned 4 [0102.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.961] lstrlenW (lpString=".docx") returned 5 [0102.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.961] lstrlenW (lpString=".pdf") returned 4 [0102.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.961] lstrlenW (lpString=".xls") returned 4 [0102.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.961] lstrlenW (lpString=".xlsx") returned 5 [0102.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.961] lstrlenW (lpString=".ppt") returned 4 [0102.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.961] lstrlenW (lpString=".zip") returned 4 [0102.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.961] lstrlenW (lpString=".rar") returned 4 [0102.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.961] lstrlenW (lpString=".bz2") returned 4 [0102.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString=".7z") returned 3 [0102.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.962] lstrlenW (lpString=".dbf") returned 4 [0102.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.962] lstrlenW (lpString=".1cd") returned 4 [0102.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.962] lstrlenW (lpString=".jpg") returned 4 [0102.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString=".pdf") returned 4 [0102.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString=".xls") returned 4 [0102.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.962] lstrlenW (lpString=".xlsx") returned 5 [0102.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.962] lstrlenW (lpString=".ppt") returned 4 [0102.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.962] lstrlenW (lpString=".zip") returned 4 [0102.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.962] lstrlenW (lpString=".rar") returned 4 [0102.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString=".bz2") returned 4 [0102.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString=".7z") returned 3 [0102.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.962] lstrlenW (lpString=".dbf") returned 4 [0102.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.963] lstrlenW (lpString=".1cd") returned 4 [0102.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 63 [0102.963] lstrlenW (lpString=".jpg") returned 4 [0102.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.963] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") [0102.974] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8480) returned 1 [0102.974] CloseHandle (hObject=0x22c) returned 1 [0102.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 0x20 [0102.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.975] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.975] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0102.976] GetLastError () returned 0x0 [0102.976] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2120, lpOverlapped=0x0) returned 1 [0103.015] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0103.016] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.016] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.016] SetEndOfFile (hFile=0x1c8) returned 1 [0103.017] CloseHandle (hObject=0x1c8) returned 1 [0103.017] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.017] SetEndOfFile (hFile=0x22c) returned 1 [0103.018] CloseHandle (hObject=0x22c) returned 1 [0103.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 1 [0103.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.018] lstrlenW (lpString=".doc") returned 4 [0103.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.018] lstrlenW (lpString=".docx") returned 5 [0103.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.018] lstrlenW (lpString=".pdf") returned 4 [0103.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.018] lstrlenW (lpString=".xls") returned 4 [0103.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.018] lstrlenW (lpString=".xlsx") returned 5 [0103.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.018] lstrlenW (lpString=".ppt") returned 4 [0103.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.019] lstrlenW (lpString=".zip") returned 4 [0103.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.019] lstrlenW (lpString=".rar") returned 4 [0103.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".bz2") returned 4 [0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".7z") returned 3 [0103.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.019] lstrlenW (lpString=".dbf") returned 4 [0103.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.019] lstrlenW (lpString=".1cd") returned 4 [0103.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.019] lstrlenW (lpString=".jpg") returned 4 [0103.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".pdf") returned 4 [0103.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".xls") returned 4 [0103.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.019] lstrlenW (lpString=".xlsx") returned 5 [0103.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.019] lstrlenW (lpString=".ppt") returned 4 [0103.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.019] lstrlenW (lpString=".zip") returned 4 [0103.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.019] lstrlenW (lpString=".rar") returned 4 [0103.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".bz2") returned 4 [0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.019] lstrlenW (lpString=".7z") returned 3 [0103.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.020] lstrlenW (lpString=".dbf") returned 4 [0103.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.020] lstrlenW (lpString=".1cd") returned 4 [0103.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 63 [0103.020] lstrlenW (lpString=".jpg") returned 4 [0103.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.020] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") [0103.020] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12216) returned 1 [0103.020] CloseHandle (hObject=0x22c) returned 1 [0103.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 0x20 [0103.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0103.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.021] GetLastError () returned 0x0 [0103.021] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2fb8, lpOverlapped=0x0) returned 1 [0103.050] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2fc0, lpOverlapped=0x0) returned 1 [0103.051] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.051] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.052] SetEndOfFile (hFile=0x1c8) returned 1 [0103.086] CloseHandle (hObject=0x1c8) returned 1 [0103.086] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.086] SetEndOfFile (hFile=0x22c) returned 1 [0103.087] CloseHandle (hObject=0x22c) returned 1 [0103.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 1 [0103.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.087] lstrlenW (lpString=".doc") returned 4 [0103.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".docx") returned 5 [0103.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.088] lstrlenW (lpString=".pdf") returned 4 [0103.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".xls") returned 4 [0103.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.088] lstrlenW (lpString=".xlsx") returned 5 [0103.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.088] lstrlenW (lpString=".ppt") returned 4 [0103.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.088] lstrlenW (lpString=".zip") returned 4 [0103.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.088] lstrlenW (lpString=".rar") returned 4 [0103.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".bz2") returned 4 [0103.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".7z") returned 3 [0103.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.088] lstrlenW (lpString=".dbf") returned 4 [0103.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.088] lstrlenW (lpString=".1cd") returned 4 [0103.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.088] lstrlenW (lpString=".jpg") returned 4 [0103.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".pdf") returned 4 [0103.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.088] lstrlenW (lpString=".xls") returned 4 [0103.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.089] lstrlenW (lpString=".xlsx") returned 5 [0103.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.089] lstrlenW (lpString=".ppt") returned 4 [0103.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.089] lstrlenW (lpString=".zip") returned 4 [0103.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.089] lstrlenW (lpString=".rar") returned 4 [0103.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.089] lstrlenW (lpString=".bz2") returned 4 [0103.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.089] lstrlenW (lpString=".7z") returned 3 [0103.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.089] lstrlenW (lpString=".dbf") returned 4 [0103.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.089] lstrlenW (lpString=".1cd") returned 4 [0103.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 63 [0103.089] lstrlenW (lpString=".jpg") returned 4 [0103.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.089] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") [0103.090] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4088) returned 1 [0103.090] CloseHandle (hObject=0x22c) returned 1 [0103.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 0x20 [0103.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0103.091] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.091] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.092] GetLastError () returned 0x0 [0103.092] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xff8, lpOverlapped=0x0) returned 1 [0103.304] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1000, lpOverlapped=0x0) returned 1 [0103.306] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.306] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.306] SetEndOfFile (hFile=0x1c8) returned 1 [0103.306] CloseHandle (hObject=0x1c8) returned 1 [0103.307] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.307] SetEndOfFile (hFile=0x22c) returned 1 [0103.307] CloseHandle (hObject=0x22c) returned 1 [0103.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 1 [0103.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.308] lstrlenW (lpString=".doc") returned 4 [0103.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString=".docx") returned 5 [0103.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.308] lstrlenW (lpString=".pdf") returned 4 [0103.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString=".xls") returned 4 [0103.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.308] lstrlenW (lpString=".xlsx") returned 5 [0103.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.308] lstrlenW (lpString=".ppt") returned 4 [0103.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.308] lstrlenW (lpString=".zip") returned 4 [0103.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.308] lstrlenW (lpString=".rar") returned 4 [0103.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString=".bz2") returned 4 [0103.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString=".7z") returned 3 [0103.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.308] lstrlenW (lpString=".dbf") returned 4 [0103.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.308] lstrlenW (lpString=".1cd") returned 4 [0103.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.309] lstrlenW (lpString=".jpg") returned 4 [0103.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString=".pdf") returned 4 [0103.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString=".xls") returned 4 [0103.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.309] lstrlenW (lpString=".xlsx") returned 5 [0103.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.309] lstrlenW (lpString=".ppt") returned 4 [0103.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.309] lstrlenW (lpString=".zip") returned 4 [0103.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.309] lstrlenW (lpString=".rar") returned 4 [0103.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString=".bz2") returned 4 [0103.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString=".7z") returned 3 [0103.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.309] lstrlenW (lpString=".dbf") returned 4 [0103.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.309] lstrlenW (lpString=".1cd") returned 4 [0103.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 63 [0103.309] lstrlenW (lpString=".jpg") returned 4 [0103.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.310] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") [0103.310] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2188) returned 1 [0103.310] CloseHandle (hObject=0x22c) returned 1 [0103.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 0x20 [0103.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0103.310] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.310] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.311] GetLastError () returned 0x0 [0103.311] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x88c, lpOverlapped=0x0) returned 1 [0103.379] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x890, lpOverlapped=0x0) returned 1 [0103.380] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.380] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.380] SetEndOfFile (hFile=0x1c8) returned 1 [0103.550] CloseHandle (hObject=0x1c8) returned 1 [0103.550] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.550] SetEndOfFile (hFile=0x22c) returned 1 [0103.551] CloseHandle (hObject=0x22c) returned 1 [0103.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.724] lstrlenW (lpString=".doc") returned 4 [0103.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.724] lstrlenW (lpString=".docx") returned 5 [0103.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.724] lstrlenW (lpString=".pdf") returned 4 [0103.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.724] lstrlenW (lpString=".xls") returned 4 [0103.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.724] lstrlenW (lpString=".xlsx") returned 5 [0103.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.724] lstrlenW (lpString=".ppt") returned 4 [0103.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.724] lstrlenW (lpString=".zip") returned 4 [0103.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.724] lstrlenW (lpString=".rar") returned 4 [0103.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.724] lstrlenW (lpString=".bz2") returned 4 [0103.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.724] lstrlenW (lpString=".7z") returned 3 [0103.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.724] lstrlenW (lpString=".dbf") returned 4 [0103.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".1cd") returned 4 [0103.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".jpg") returned 4 [0103.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString=".pdf") returned 4 [0103.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString=".xls") returned 4 [0103.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.725] lstrlenW (lpString=".xlsx") returned 5 [0103.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.725] lstrlenW (lpString=".ppt") returned 4 [0103.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".zip") returned 4 [0103.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.725] lstrlenW (lpString=".rar") returned 4 [0103.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString=".bz2") returned 4 [0103.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString=".7z") returned 3 [0103.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".dbf") returned 4 [0103.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".1cd") returned 4 [0103.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 63 [0103.725] lstrlenW (lpString=".jpg") returned 4 [0103.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.726] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") [0104.127] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3440) returned 1 [0104.127] CloseHandle (hObject=0x210) returned 1 [0104.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 0x20 [0104.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.128] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.128] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.129] GetLastError () returned 0x0 [0104.129] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd70, lpOverlapped=0x0) returned 1 [0104.132] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd80, lpOverlapped=0x0) returned 1 [0104.133] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.134] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.134] SetEndOfFile (hFile=0x15c) returned 1 [0104.134] CloseHandle (hObject=0x15c) returned 1 [0104.134] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.134] SetEndOfFile (hFile=0x210) returned 1 [0104.135] CloseHandle (hObject=0x210) returned 1 [0104.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 1 [0104.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.136] lstrlenW (lpString=".doc") returned 4 [0104.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString=".docx") returned 5 [0104.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.136] lstrlenW (lpString=".pdf") returned 4 [0104.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString=".xls") returned 4 [0104.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.136] lstrlenW (lpString=".xlsx") returned 5 [0104.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.136] lstrlenW (lpString=".ppt") returned 4 [0104.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.136] lstrlenW (lpString=".zip") returned 4 [0104.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.136] lstrlenW (lpString=".rar") returned 4 [0104.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString=".bz2") returned 4 [0104.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString=".7z") returned 3 [0104.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.136] lstrlenW (lpString=".dbf") returned 4 [0104.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.136] lstrlenW (lpString=".1cd") returned 4 [0104.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.137] lstrlenW (lpString=".jpg") returned 4 [0104.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString=".pdf") returned 4 [0104.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString=".xls") returned 4 [0104.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.137] lstrlenW (lpString=".xlsx") returned 5 [0104.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.137] lstrlenW (lpString=".ppt") returned 4 [0104.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.137] lstrlenW (lpString=".zip") returned 4 [0104.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.137] lstrlenW (lpString=".rar") returned 4 [0104.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString=".bz2") returned 4 [0104.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString=".7z") returned 3 [0104.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.137] lstrlenW (lpString=".dbf") returned 4 [0104.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.138] lstrlenW (lpString=".1cd") returned 4 [0104.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 63 [0104.138] lstrlenW (lpString=".jpg") returned 4 [0104.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.138] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") [0104.139] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=23204) returned 1 [0104.139] CloseHandle (hObject=0x210) returned 1 [0104.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x20 [0104.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.139] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.139] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.140] GetLastError () returned 0x0 [0104.140] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5aa4, lpOverlapped=0x0) returned 1 [0104.157] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5ab0, lpOverlapped=0x0) returned 1 [0104.159] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.159] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.159] SetEndOfFile (hFile=0x15c) returned 1 [0104.159] CloseHandle (hObject=0x15c) returned 1 [0104.159] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.159] SetEndOfFile (hFile=0x210) returned 1 [0104.160] CloseHandle (hObject=0x210) returned 1 [0104.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 1 [0104.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.161] lstrlenW (lpString=".doc") returned 4 [0104.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.161] lstrlenW (lpString=".docx") returned 5 [0104.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.161] lstrlenW (lpString=".pdf") returned 4 [0104.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.161] lstrlenW (lpString=".xls") returned 4 [0104.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.161] lstrlenW (lpString=".xlsx") returned 5 [0104.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.161] lstrlenW (lpString=".ppt") returned 4 [0104.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.161] lstrlenW (lpString=".zip") returned 4 [0104.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.162] lstrlenW (lpString=".rar") returned 4 [0104.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString=".bz2") returned 4 [0104.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString=".7z") returned 3 [0104.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.162] lstrlenW (lpString=".dbf") returned 4 [0104.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.162] lstrlenW (lpString=".1cd") returned 4 [0104.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.162] lstrlenW (lpString=".jpg") returned 4 [0104.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString=".pdf") returned 4 [0104.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString=".xls") returned 4 [0104.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.162] lstrlenW (lpString=".xlsx") returned 5 [0104.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.162] lstrlenW (lpString=".ppt") returned 4 [0104.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.162] lstrlenW (lpString=".zip") returned 4 [0104.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.163] lstrlenW (lpString=".rar") returned 4 [0104.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.163] lstrlenW (lpString=".bz2") returned 4 [0104.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.163] lstrlenW (lpString=".7z") returned 3 [0104.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.163] lstrlenW (lpString=".dbf") returned 4 [0104.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.163] lstrlenW (lpString=".1cd") returned 4 [0104.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 63 [0104.163] lstrlenW (lpString=".jpg") returned 4 [0104.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.163] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") [0104.164] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7416) returned 1 [0104.164] CloseHandle (hObject=0x210) returned 1 [0104.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 0x20 [0104.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.165] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.165] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.166] GetLastError () returned 0x0 [0104.166] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1cf8, lpOverlapped=0x0) returned 1 [0104.168] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1d00, lpOverlapped=0x0) returned 1 [0104.169] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.170] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.170] SetEndOfFile (hFile=0x15c) returned 1 [0104.170] CloseHandle (hObject=0x15c) returned 1 [0104.170] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.170] SetEndOfFile (hFile=0x210) returned 1 [0104.171] CloseHandle (hObject=0x210) returned 1 [0104.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 1 [0104.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.172] lstrlenW (lpString=".doc") returned 4 [0104.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.172] lstrlenW (lpString=".docx") returned 5 [0104.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.172] lstrlenW (lpString=".pdf") returned 4 [0104.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.172] lstrlenW (lpString=".xls") returned 4 [0104.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.172] lstrlenW (lpString=".xlsx") returned 5 [0104.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.172] lstrlenW (lpString=".ppt") returned 4 [0104.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.172] lstrlenW (lpString=".zip") returned 4 [0104.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.173] lstrlenW (lpString=".rar") returned 4 [0104.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString=".bz2") returned 4 [0104.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString=".7z") returned 3 [0104.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.173] lstrlenW (lpString=".dbf") returned 4 [0104.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.173] lstrlenW (lpString=".1cd") returned 4 [0104.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.173] lstrlenW (lpString=".jpg") returned 4 [0104.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString=".pdf") returned 4 [0104.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString=".xls") returned 4 [0104.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.173] lstrlenW (lpString=".xlsx") returned 5 [0104.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.173] lstrlenW (lpString=".ppt") returned 4 [0104.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.173] lstrlenW (lpString=".zip") returned 4 [0104.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.174] lstrlenW (lpString=".rar") returned 4 [0104.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.174] lstrlenW (lpString=".bz2") returned 4 [0104.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.174] lstrlenW (lpString=".7z") returned 3 [0104.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.174] lstrlenW (lpString=".dbf") returned 4 [0104.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.174] lstrlenW (lpString=".1cd") returned 4 [0104.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 63 [0104.174] lstrlenW (lpString=".jpg") returned 4 [0104.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.174] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") [0104.175] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16676) returned 1 [0104.175] CloseHandle (hObject=0x210) returned 1 [0104.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x20 [0104.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.176] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.176] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.177] GetLastError () returned 0x0 [0104.177] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4124, lpOverlapped=0x0) returned 1 [0104.205] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0104.206] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.206] WriteFile (in: hFile=0x15c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.207] SetEndOfFile (hFile=0x15c) returned 1 [0104.222] CloseHandle (hObject=0x15c) returned 1 [0104.243] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.243] SetEndOfFile (hFile=0x210) returned 1 [0104.251] CloseHandle (hObject=0x210) returned 1 [0104.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 1 [0104.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.251] lstrlenW (lpString=".doc") returned 4 [0104.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.251] lstrlenW (lpString=".docx") returned 5 [0104.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.251] lstrlenW (lpString=".pdf") returned 4 [0104.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.251] lstrlenW (lpString=".xls") returned 4 [0104.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.251] lstrlenW (lpString=".xlsx") returned 5 [0104.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.251] lstrlenW (lpString=".ppt") returned 4 [0104.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.252] lstrlenW (lpString=".zip") returned 4 [0104.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.252] lstrlenW (lpString=".rar") returned 4 [0104.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString=".bz2") returned 4 [0104.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString=".7z") returned 3 [0104.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.252] lstrlenW (lpString=".dbf") returned 4 [0104.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.252] lstrlenW (lpString=".1cd") returned 4 [0104.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.252] lstrlenW (lpString=".jpg") returned 4 [0104.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString=".pdf") returned 4 [0104.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString=".xls") returned 4 [0104.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.252] lstrlenW (lpString=".xlsx") returned 5 [0104.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.252] lstrlenW (lpString=".ppt") returned 4 [0104.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.252] lstrlenW (lpString=".zip") returned 4 [0104.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.252] lstrlenW (lpString=".rar") returned 4 [0104.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.252] lstrlenW (lpString=".bz2") returned 4 [0104.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.253] lstrlenW (lpString=".7z") returned 3 [0104.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.253] lstrlenW (lpString=".dbf") returned 4 [0104.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.253] lstrlenW (lpString=".1cd") returned 4 [0104.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 63 [0104.253] lstrlenW (lpString=".jpg") returned 4 [0104.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.253] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") [0104.254] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9904) returned 1 [0104.254] CloseHandle (hObject=0x210) returned 1 [0104.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x20 [0104.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.254] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.254] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.255] GetLastError () returned 0x0 [0104.255] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x26b0, lpOverlapped=0x0) returned 1 [0104.259] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x26c0, lpOverlapped=0x0) returned 1 [0104.260] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.260] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.260] SetEndOfFile (hFile=0x158) returned 1 [0104.260] CloseHandle (hObject=0x158) returned 1 [0104.261] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.261] SetEndOfFile (hFile=0x210) returned 1 [0104.261] CloseHandle (hObject=0x210) returned 1 [0104.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 1 [0104.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.262] lstrlenW (lpString=".doc") returned 4 [0104.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.262] lstrlenW (lpString=".docx") returned 5 [0104.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.262] lstrlenW (lpString=".pdf") returned 4 [0104.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.262] lstrlenW (lpString=".xls") returned 4 [0104.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.262] lstrlenW (lpString=".xlsx") returned 5 [0104.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.262] lstrlenW (lpString=".ppt") returned 4 [0104.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.262] lstrlenW (lpString=".zip") returned 4 [0104.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.262] lstrlenW (lpString=".rar") returned 4 [0104.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.262] lstrlenW (lpString=".bz2") returned 4 [0104.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.262] lstrlenW (lpString=".7z") returned 3 [0104.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".dbf") returned 4 [0104.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".1cd") returned 4 [0104.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".jpg") returned 4 [0104.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString=".pdf") returned 4 [0104.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString=".xls") returned 4 [0104.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.263] lstrlenW (lpString=".xlsx") returned 5 [0104.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.263] lstrlenW (lpString=".ppt") returned 4 [0104.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".zip") returned 4 [0104.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.263] lstrlenW (lpString=".rar") returned 4 [0104.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString=".bz2") returned 4 [0104.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString=".7z") returned 3 [0104.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".dbf") returned 4 [0104.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.263] lstrlenW (lpString=".1cd") returned 4 [0104.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 63 [0104.264] lstrlenW (lpString=".jpg") returned 4 [0104.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.264] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") [0104.264] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=22128) returned 1 [0104.264] CloseHandle (hObject=0x210) returned 1 [0104.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x20 [0104.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.265] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.265] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.265] GetLastError () returned 0x0 [0104.265] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5670, lpOverlapped=0x0) returned 1 [0104.276] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5680, lpOverlapped=0x0) returned 1 [0104.277] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.277] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.277] SetEndOfFile (hFile=0x158) returned 1 [0104.278] CloseHandle (hObject=0x158) returned 1 [0104.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.278] SetEndOfFile (hFile=0x210) returned 1 [0104.279] CloseHandle (hObject=0x210) returned 1 [0104.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 1 [0104.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.279] lstrlenW (lpString=".doc") returned 4 [0104.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.279] lstrlenW (lpString=".docx") returned 5 [0104.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.279] lstrlenW (lpString=".pdf") returned 4 [0104.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.279] lstrlenW (lpString=".xls") returned 4 [0104.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.279] lstrlenW (lpString=".xlsx") returned 5 [0104.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.279] lstrlenW (lpString=".ppt") returned 4 [0104.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.279] lstrlenW (lpString=".zip") returned 4 [0104.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.279] lstrlenW (lpString=".rar") returned 4 [0104.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.279] lstrlenW (lpString=".bz2") returned 4 [0104.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString=".7z") returned 3 [0104.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.280] lstrlenW (lpString=".dbf") returned 4 [0104.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.280] lstrlenW (lpString=".1cd") returned 4 [0104.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.280] lstrlenW (lpString=".jpg") returned 4 [0104.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString=".pdf") returned 4 [0104.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString=".xls") returned 4 [0104.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.280] lstrlenW (lpString=".xlsx") returned 5 [0104.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.280] lstrlenW (lpString=".ppt") returned 4 [0104.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.280] lstrlenW (lpString=".zip") returned 4 [0104.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.280] lstrlenW (lpString=".rar") returned 4 [0104.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString=".bz2") returned 4 [0104.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString=".7z") returned 3 [0104.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.280] lstrlenW (lpString=".dbf") returned 4 [0104.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.281] lstrlenW (lpString=".1cd") returned 4 [0104.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 63 [0104.281] lstrlenW (lpString=".jpg") returned 4 [0104.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.281] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") [0104.289] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6886) returned 1 [0104.289] CloseHandle (hObject=0x210) returned 1 [0104.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 0x20 [0104.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.294] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.294] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.308] GetLastError () returned 0x0 [0104.308] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1ae6, lpOverlapped=0x0) returned 1 [0104.310] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0104.311] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.311] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.311] SetEndOfFile (hFile=0x210) returned 1 [0104.311] CloseHandle (hObject=0x210) returned 1 [0104.311] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.311] SetEndOfFile (hFile=0x16c) returned 1 [0104.312] CloseHandle (hObject=0x16c) returned 1 [0104.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 1 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString=".doc") returned 4 [0104.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString=".docx") returned 5 [0104.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.313] lstrlenW (lpString=".pdf") returned 4 [0104.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString=".xls") returned 4 [0104.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.313] lstrlenW (lpString=".xlsx") returned 5 [0104.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.313] lstrlenW (lpString=".ppt") returned 4 [0104.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString=".zip") returned 4 [0104.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.313] lstrlenW (lpString=".rar") returned 4 [0104.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString=".bz2") returned 4 [0104.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString=".7z") returned 3 [0104.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString=".dbf") returned 4 [0104.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString=".1cd") returned 4 [0104.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.313] lstrlenW (lpString=".jpg") returned 4 [0104.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString=".pdf") returned 4 [0104.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString=".xls") returned 4 [0104.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.314] lstrlenW (lpString=".xlsx") returned 5 [0104.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.314] lstrlenW (lpString=".ppt") returned 4 [0104.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.314] lstrlenW (lpString=".zip") returned 4 [0104.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.314] lstrlenW (lpString=".rar") returned 4 [0104.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString=".bz2") returned 4 [0104.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString=".7z") returned 3 [0104.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.314] lstrlenW (lpString=".dbf") returned 4 [0104.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.314] lstrlenW (lpString=".1cd") returned 4 [0104.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 63 [0104.314] lstrlenW (lpString=".jpg") returned 4 [0104.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.314] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") [0104.315] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24616) returned 1 [0104.315] CloseHandle (hObject=0x16c) returned 1 [0104.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 0x20 [0104.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.315] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.315] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.316] GetLastError () returned 0x0 [0104.316] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6028, lpOverlapped=0x0) returned 1 [0104.318] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0104.319] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.319] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.319] SetEndOfFile (hFile=0x210) returned 1 [0104.320] CloseHandle (hObject=0x210) returned 1 [0104.320] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.320] SetEndOfFile (hFile=0x16c) returned 1 [0104.324] CloseHandle (hObject=0x16c) returned 1 [0104.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 1 [0104.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.324] lstrlenW (lpString=".doc") returned 4 [0104.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.324] lstrlenW (lpString=".docx") returned 5 [0104.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.324] lstrlenW (lpString=".pdf") returned 4 [0104.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.324] lstrlenW (lpString=".xls") returned 4 [0104.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.325] lstrlenW (lpString=".xlsx") returned 5 [0104.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.325] lstrlenW (lpString=".ppt") returned 4 [0104.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.325] lstrlenW (lpString=".zip") returned 4 [0104.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.325] lstrlenW (lpString=".rar") returned 4 [0104.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString=".bz2") returned 4 [0104.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString=".7z") returned 3 [0104.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.325] lstrlenW (lpString=".dbf") returned 4 [0104.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.325] lstrlenW (lpString=".1cd") returned 4 [0104.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.325] lstrlenW (lpString=".jpg") returned 4 [0104.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString=".pdf") returned 4 [0104.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString=".xls") returned 4 [0104.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.325] lstrlenW (lpString=".xlsx") returned 5 [0104.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.325] lstrlenW (lpString=".ppt") returned 4 [0104.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.325] lstrlenW (lpString=".zip") returned 4 [0104.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.326] lstrlenW (lpString=".rar") returned 4 [0104.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.326] lstrlenW (lpString=".bz2") returned 4 [0104.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.326] lstrlenW (lpString=".7z") returned 3 [0104.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.326] lstrlenW (lpString=".dbf") returned 4 [0104.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.326] lstrlenW (lpString=".1cd") returned 4 [0104.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 63 [0104.326] lstrlenW (lpString=".jpg") returned 4 [0104.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.326] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") [0104.327] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4234) returned 1 [0104.327] CloseHandle (hObject=0x16c) returned 1 [0104.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x20 [0104.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.327] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.327] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.328] GetLastError () returned 0x0 [0104.328] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x108a, lpOverlapped=0x0) returned 1 [0104.330] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0104.330] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.331] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.331] SetEndOfFile (hFile=0x210) returned 1 [0104.331] CloseHandle (hObject=0x210) returned 1 [0104.331] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.331] SetEndOfFile (hFile=0x16c) returned 1 [0104.332] CloseHandle (hObject=0x16c) returned 1 [0104.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 1 [0104.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.332] lstrlenW (lpString=".doc") returned 4 [0104.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.332] lstrlenW (lpString=".docx") returned 5 [0104.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.332] lstrlenW (lpString=".pdf") returned 4 [0104.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.332] lstrlenW (lpString=".xls") returned 4 [0104.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.332] lstrlenW (lpString=".xlsx") returned 5 [0104.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.332] lstrlenW (lpString=".ppt") returned 4 [0104.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.332] lstrlenW (lpString=".zip") returned 4 [0104.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.333] lstrlenW (lpString=".rar") returned 4 [0104.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".bz2") returned 4 [0104.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".7z") returned 3 [0104.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.333] lstrlenW (lpString=".dbf") returned 4 [0104.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.333] lstrlenW (lpString=".1cd") returned 4 [0104.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.333] lstrlenW (lpString=".jpg") returned 4 [0104.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".pdf") returned 4 [0104.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".xls") returned 4 [0104.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.333] lstrlenW (lpString=".xlsx") returned 5 [0104.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.333] lstrlenW (lpString=".ppt") returned 4 [0104.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.333] lstrlenW (lpString=".zip") returned 4 [0104.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.333] lstrlenW (lpString=".rar") returned 4 [0104.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".bz2") returned 4 [0104.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.333] lstrlenW (lpString=".7z") returned 3 [0104.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.334] lstrlenW (lpString=".dbf") returned 4 [0104.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.334] lstrlenW (lpString=".1cd") returned 4 [0104.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 63 [0104.334] lstrlenW (lpString=".jpg") returned 4 [0104.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.334] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") [0104.334] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4398) returned 1 [0104.334] CloseHandle (hObject=0x16c) returned 1 [0104.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x20 [0104.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.335] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.335] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.335] GetLastError () returned 0x0 [0104.335] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x112e, lpOverlapped=0x0) returned 1 [0104.337] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0104.338] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.338] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.338] SetEndOfFile (hFile=0x210) returned 1 [0104.338] CloseHandle (hObject=0x210) returned 1 [0104.338] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.338] SetEndOfFile (hFile=0x16c) returned 1 [0104.339] CloseHandle (hObject=0x16c) returned 1 [0104.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 1 [0104.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString=".doc") returned 4 [0104.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString=".docx") returned 5 [0104.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.340] lstrlenW (lpString=".pdf") returned 4 [0104.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString=".xls") returned 4 [0104.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.340] lstrlenW (lpString=".xlsx") returned 5 [0104.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.340] lstrlenW (lpString=".ppt") returned 4 [0104.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString=".zip") returned 4 [0104.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.340] lstrlenW (lpString=".rar") returned 4 [0104.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString=".bz2") returned 4 [0104.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString=".7z") returned 3 [0104.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString=".dbf") returned 4 [0104.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString=".1cd") returned 4 [0104.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.340] lstrlenW (lpString=".jpg") returned 4 [0104.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.340] lstrlenW (lpString=".pdf") returned 4 [0104.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString=".xls") returned 4 [0104.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.341] lstrlenW (lpString=".xlsx") returned 5 [0104.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.341] lstrlenW (lpString=".ppt") returned 4 [0104.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.341] lstrlenW (lpString=".zip") returned 4 [0104.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.341] lstrlenW (lpString=".rar") returned 4 [0104.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString=".bz2") returned 4 [0104.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString=".7z") returned 3 [0104.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.341] lstrlenW (lpString=".dbf") returned 4 [0104.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.341] lstrlenW (lpString=".1cd") returned 4 [0104.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 63 [0104.341] lstrlenW (lpString=".jpg") returned 4 [0104.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.341] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") [0104.342] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4408) returned 1 [0104.342] CloseHandle (hObject=0x16c) returned 1 [0104.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x20 [0104.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.342] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.342] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.343] GetLastError () returned 0x0 [0104.343] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1138, lpOverlapped=0x0) returned 1 [0104.345] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0104.346] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.346] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.346] SetEndOfFile (hFile=0x210) returned 1 [0104.346] CloseHandle (hObject=0x210) returned 1 [0104.346] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.346] SetEndOfFile (hFile=0x16c) returned 1 [0104.347] CloseHandle (hObject=0x16c) returned 1 [0104.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 1 [0104.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.347] lstrlenW (lpString=".doc") returned 4 [0104.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.347] lstrlenW (lpString=".docx") returned 5 [0104.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.347] lstrlenW (lpString=".pdf") returned 4 [0104.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString=".xls") returned 4 [0104.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.348] lstrlenW (lpString=".xlsx") returned 5 [0104.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.348] lstrlenW (lpString=".ppt") returned 4 [0104.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.348] lstrlenW (lpString=".zip") returned 4 [0104.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.348] lstrlenW (lpString=".rar") returned 4 [0104.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString=".bz2") returned 4 [0104.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString=".7z") returned 3 [0104.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.348] lstrlenW (lpString=".dbf") returned 4 [0104.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.348] lstrlenW (lpString=".1cd") returned 4 [0104.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.348] lstrlenW (lpString=".jpg") returned 4 [0104.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString=".pdf") returned 4 [0104.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.348] lstrlenW (lpString=".xls") returned 4 [0104.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.348] lstrlenW (lpString=".xlsx") returned 5 [0104.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.348] lstrlenW (lpString=".ppt") returned 4 [0104.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.349] lstrlenW (lpString=".zip") returned 4 [0104.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.349] lstrlenW (lpString=".rar") returned 4 [0104.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.349] lstrlenW (lpString=".bz2") returned 4 [0104.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.349] lstrlenW (lpString=".7z") returned 3 [0104.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.349] lstrlenW (lpString=".dbf") returned 4 [0104.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.349] lstrlenW (lpString=".1cd") returned 4 [0104.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 63 [0104.349] lstrlenW (lpString=".jpg") returned 4 [0104.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.349] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") [0104.350] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14630) returned 1 [0104.350] CloseHandle (hObject=0x16c) returned 1 [0104.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 0x20 [0104.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.350] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.350] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.351] GetLastError () returned 0x0 [0104.351] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3926, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3930, lpOverlapped=0x0) returned 1 [0104.501] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.501] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.502] SetEndOfFile (hFile=0x210) returned 1 [0104.699] CloseHandle (hObject=0x210) returned 1 [0104.699] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.699] SetEndOfFile (hFile=0x16c) returned 1 [0104.722] CloseHandle (hObject=0x16c) returned 1 [0104.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 1 [0104.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString=".doc") returned 4 [0104.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString=".docx") returned 5 [0104.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.731] lstrlenW (lpString=".pdf") returned 4 [0104.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString=".xls") returned 4 [0104.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.731] lstrlenW (lpString=".xlsx") returned 5 [0104.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.731] lstrlenW (lpString=".ppt") returned 4 [0104.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString=".zip") returned 4 [0104.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.731] lstrlenW (lpString=".rar") returned 4 [0104.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString=".bz2") returned 4 [0104.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString=".7z") returned 3 [0104.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString=".dbf") returned 4 [0104.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString=".1cd") returned 4 [0104.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.731] lstrlenW (lpString=".jpg") returned 4 [0104.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString=".pdf") returned 4 [0104.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString=".xls") returned 4 [0104.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.732] lstrlenW (lpString=".xlsx") returned 5 [0104.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.732] lstrlenW (lpString=".ppt") returned 4 [0104.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.732] lstrlenW (lpString=".zip") returned 4 [0104.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.732] lstrlenW (lpString=".rar") returned 4 [0104.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString=".bz2") returned 4 [0104.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString=".7z") returned 3 [0104.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.732] lstrlenW (lpString=".dbf") returned 4 [0104.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.732] lstrlenW (lpString=".1cd") returned 4 [0104.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 63 [0104.732] lstrlenW (lpString=".jpg") returned 4 [0104.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.732] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") [0104.733] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2436) returned 1 [0104.733] CloseHandle (hObject=0x16c) returned 1 [0104.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 0x20 [0104.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.733] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.734] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.734] GetLastError () returned 0x0 [0104.734] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x984, lpOverlapped=0x0) returned 1 [0104.736] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x990, lpOverlapped=0x0) returned 1 [0104.736] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.737] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.737] SetEndOfFile (hFile=0x210) returned 1 [0104.737] CloseHandle (hObject=0x210) returned 1 [0104.737] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.737] SetEndOfFile (hFile=0x16c) returned 1 [0104.738] CloseHandle (hObject=0x16c) returned 1 [0104.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 1 [0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.738] lstrlenW (lpString=".doc") returned 4 [0104.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.738] lstrlenW (lpString=".docx") returned 5 [0104.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.738] lstrlenW (lpString=".pdf") returned 4 [0104.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.738] lstrlenW (lpString=".xls") returned 4 [0104.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.738] lstrlenW (lpString=".xlsx") returned 5 [0104.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.738] lstrlenW (lpString=".ppt") returned 4 [0104.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.738] lstrlenW (lpString=".zip") returned 4 [0104.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.738] lstrlenW (lpString=".rar") returned 4 [0104.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".bz2") returned 4 [0104.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".7z") returned 3 [0104.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.739] lstrlenW (lpString=".dbf") returned 4 [0104.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.739] lstrlenW (lpString=".1cd") returned 4 [0104.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.739] lstrlenW (lpString=".jpg") returned 4 [0104.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".pdf") returned 4 [0104.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".xls") returned 4 [0104.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.739] lstrlenW (lpString=".xlsx") returned 5 [0104.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.739] lstrlenW (lpString=".ppt") returned 4 [0104.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.739] lstrlenW (lpString=".zip") returned 4 [0104.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.739] lstrlenW (lpString=".rar") returned 4 [0104.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".bz2") returned 4 [0104.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.739] lstrlenW (lpString=".7z") returned 3 [0104.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.739] lstrlenW (lpString=".dbf") returned 4 [0104.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.740] lstrlenW (lpString=".1cd") returned 4 [0104.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 63 [0104.740] lstrlenW (lpString=".jpg") returned 4 [0104.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.740] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") [0104.740] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1436) returned 1 [0104.740] CloseHandle (hObject=0x16c) returned 1 [0104.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x20 [0104.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.741] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.741] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.741] GetLastError () returned 0x0 [0104.741] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x59c, lpOverlapped=0x0) returned 1 [0104.743] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0104.744] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.744] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.744] SetEndOfFile (hFile=0x210) returned 1 [0104.744] CloseHandle (hObject=0x210) returned 1 [0104.744] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.745] SetEndOfFile (hFile=0x16c) returned 1 [0104.745] CloseHandle (hObject=0x16c) returned 1 [0104.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 1 [0104.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.746] lstrlenW (lpString=".doc") returned 4 [0104.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString=".docx") returned 5 [0104.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.746] lstrlenW (lpString=".pdf") returned 4 [0104.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString=".xls") returned 4 [0104.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.746] lstrlenW (lpString=".xlsx") returned 5 [0104.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.746] lstrlenW (lpString=".ppt") returned 4 [0104.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.746] lstrlenW (lpString=".zip") returned 4 [0104.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.746] lstrlenW (lpString=".rar") returned 4 [0104.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString=".bz2") returned 4 [0104.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString=".7z") returned 3 [0104.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.746] lstrlenW (lpString=".dbf") returned 4 [0104.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.746] lstrlenW (lpString=".1cd") returned 4 [0104.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.747] lstrlenW (lpString=".jpg") returned 4 [0104.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString=".pdf") returned 4 [0104.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString=".xls") returned 4 [0104.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.747] lstrlenW (lpString=".xlsx") returned 5 [0104.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.747] lstrlenW (lpString=".ppt") returned 4 [0104.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.747] lstrlenW (lpString=".zip") returned 4 [0104.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.747] lstrlenW (lpString=".rar") returned 4 [0104.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString=".bz2") returned 4 [0104.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString=".7z") returned 3 [0104.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.747] lstrlenW (lpString=".dbf") returned 4 [0104.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.747] lstrlenW (lpString=".1cd") returned 4 [0104.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 63 [0104.747] lstrlenW (lpString=".jpg") returned 4 [0104.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.747] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") [0104.749] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16284) returned 1 [0104.749] CloseHandle (hObject=0x16c) returned 1 [0104.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x20 [0104.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.749] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.749] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.750] GetLastError () returned 0x0 [0104.750] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3f9c, lpOverlapped=0x0) returned 1 [0104.751] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3fa0, lpOverlapped=0x0) returned 1 [0104.753] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.753] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.753] SetEndOfFile (hFile=0x210) returned 1 [0104.753] CloseHandle (hObject=0x210) returned 1 [0104.753] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.753] SetEndOfFile (hFile=0x16c) returned 1 [0104.754] CloseHandle (hObject=0x16c) returned 1 [0104.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 1 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.754] lstrlenW (lpString=".doc") returned 4 [0104.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.754] lstrlenW (lpString=".docx") returned 5 [0104.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.754] lstrlenW (lpString=".pdf") returned 4 [0104.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString=".xls") returned 4 [0104.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.755] lstrlenW (lpString=".xlsx") returned 5 [0104.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.755] lstrlenW (lpString=".ppt") returned 4 [0104.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.755] lstrlenW (lpString=".zip") returned 4 [0104.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.755] lstrlenW (lpString=".rar") returned 4 [0104.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString=".bz2") returned 4 [0104.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString=".7z") returned 3 [0104.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.755] lstrlenW (lpString=".dbf") returned 4 [0104.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.755] lstrlenW (lpString=".1cd") returned 4 [0104.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.755] lstrlenW (lpString=".jpg") returned 4 [0104.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString=".pdf") returned 4 [0104.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString=".xls") returned 4 [0104.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.755] lstrlenW (lpString=".xlsx") returned 5 [0104.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.755] lstrlenW (lpString=".ppt") returned 4 [0104.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.755] lstrlenW (lpString=".zip") returned 4 [0104.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.756] lstrlenW (lpString=".rar") returned 4 [0104.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.756] lstrlenW (lpString=".bz2") returned 4 [0104.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.756] lstrlenW (lpString=".7z") returned 3 [0104.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.756] lstrlenW (lpString=".dbf") returned 4 [0104.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.756] lstrlenW (lpString=".1cd") returned 4 [0104.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 63 [0104.756] lstrlenW (lpString=".jpg") returned 4 [0104.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.756] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") [0104.757] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5144) returned 1 [0104.757] CloseHandle (hObject=0x16c) returned 1 [0104.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x20 [0104.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.758] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.758] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.759] GetLastError () returned 0x0 [0104.759] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1418, lpOverlapped=0x0) returned 1 [0104.760] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1420, lpOverlapped=0x0) returned 1 [0104.761] ReadFile (in: hFile=0x16c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.761] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.761] SetEndOfFile (hFile=0x210) returned 1 [0104.762] CloseHandle (hObject=0x210) returned 1 [0104.762] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.762] SetEndOfFile (hFile=0x16c) returned 1 [0104.762] CloseHandle (hObject=0x16c) returned 1 [0104.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.763] lstrlenW (lpString=".doc") returned 4 [0104.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.763] lstrlenW (lpString=".docx") returned 5 [0104.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.763] lstrlenW (lpString=".pdf") returned 4 [0104.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.763] lstrlenW (lpString=".xls") returned 4 [0104.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.763] lstrlenW (lpString=".xlsx") returned 5 [0104.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.763] lstrlenW (lpString=".ppt") returned 4 [0104.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.763] lstrlenW (lpString=".zip") returned 4 [0104.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.763] lstrlenW (lpString=".rar") returned 4 [0104.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.763] lstrlenW (lpString=".bz2") returned 4 [0104.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.763] lstrlenW (lpString=".7z") returned 3 [0104.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.763] lstrlenW (lpString=".dbf") returned 4 [0104.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".1cd") returned 4 [0104.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".jpg") returned 4 [0104.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString=".pdf") returned 4 [0104.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString=".xls") returned 4 [0104.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.764] lstrlenW (lpString=".xlsx") returned 5 [0104.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.764] lstrlenW (lpString=".ppt") returned 4 [0104.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".zip") returned 4 [0104.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.764] lstrlenW (lpString=".rar") returned 4 [0104.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString=".bz2") returned 4 [0104.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString=".7z") returned 3 [0104.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".dbf") returned 4 [0104.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".1cd") returned 4 [0104.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 63 [0104.764] lstrlenW (lpString=".jpg") returned 4 [0104.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.765] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") [0105.074] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3546) returned 1 [0105.074] CloseHandle (hObject=0x1fc) returned 1 [0105.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 0x20 [0105.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.083] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.083] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.099] GetLastError () returned 0x0 [0105.099] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xdda, lpOverlapped=0x0) returned 1 [0105.101] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xde0, lpOverlapped=0x0) returned 1 [0105.102] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.102] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.102] SetEndOfFile (hFile=0x158) returned 1 [0105.102] CloseHandle (hObject=0x158) returned 1 [0105.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.102] SetEndOfFile (hFile=0x1fc) returned 1 [0105.103] CloseHandle (hObject=0x1fc) returned 1 [0105.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 1 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString=".doc") returned 4 [0105.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString=".docx") returned 5 [0105.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.104] lstrlenW (lpString=".pdf") returned 4 [0105.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString=".xls") returned 4 [0105.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.104] lstrlenW (lpString=".xlsx") returned 5 [0105.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.104] lstrlenW (lpString=".ppt") returned 4 [0105.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString=".zip") returned 4 [0105.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.104] lstrlenW (lpString=".rar") returned 4 [0105.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString=".bz2") returned 4 [0105.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString=".7z") returned 3 [0105.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString=".dbf") returned 4 [0105.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString=".1cd") returned 4 [0105.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.104] lstrlenW (lpString=".jpg") returned 4 [0105.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString=".pdf") returned 4 [0105.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString=".xls") returned 4 [0105.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.105] lstrlenW (lpString=".xlsx") returned 5 [0105.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.105] lstrlenW (lpString=".ppt") returned 4 [0105.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.105] lstrlenW (lpString=".zip") returned 4 [0105.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.105] lstrlenW (lpString=".rar") returned 4 [0105.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString=".bz2") returned 4 [0105.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString=".7z") returned 3 [0105.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.105] lstrlenW (lpString=".dbf") returned 4 [0105.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.105] lstrlenW (lpString=".1cd") returned 4 [0105.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 63 [0105.105] lstrlenW (lpString=".jpg") returned 4 [0105.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.105] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") [0105.106] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3184) returned 1 [0105.106] CloseHandle (hObject=0x1fc) returned 1 [0105.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 0x20 [0105.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.106] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.106] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.107] GetLastError () returned 0x0 [0105.107] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc70, lpOverlapped=0x0) returned 1 [0105.109] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0105.110] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.110] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.110] SetEndOfFile (hFile=0x158) returned 1 [0105.110] CloseHandle (hObject=0x158) returned 1 [0105.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.110] SetEndOfFile (hFile=0x1fc) returned 1 [0105.111] CloseHandle (hObject=0x1fc) returned 1 [0105.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 1 [0105.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.111] lstrlenW (lpString=".doc") returned 4 [0105.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.111] lstrlenW (lpString=".docx") returned 5 [0105.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.112] lstrlenW (lpString=".pdf") returned 4 [0105.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString=".xls") returned 4 [0105.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.112] lstrlenW (lpString=".xlsx") returned 5 [0105.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.112] lstrlenW (lpString=".ppt") returned 4 [0105.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.112] lstrlenW (lpString=".zip") returned 4 [0105.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.112] lstrlenW (lpString=".rar") returned 4 [0105.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString=".bz2") returned 4 [0105.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString=".7z") returned 3 [0105.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.112] lstrlenW (lpString=".dbf") returned 4 [0105.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.112] lstrlenW (lpString=".1cd") returned 4 [0105.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.112] lstrlenW (lpString=".jpg") returned 4 [0105.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.112] lstrlenW (lpString=".pdf") returned 4 [0105.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString=".xls") returned 4 [0105.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.113] lstrlenW (lpString=".xlsx") returned 5 [0105.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.113] lstrlenW (lpString=".ppt") returned 4 [0105.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.113] lstrlenW (lpString=".zip") returned 4 [0105.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.113] lstrlenW (lpString=".rar") returned 4 [0105.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString=".bz2") returned 4 [0105.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString=".7z") returned 3 [0105.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.113] lstrlenW (lpString=".dbf") returned 4 [0105.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.113] lstrlenW (lpString=".1cd") returned 4 [0105.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 63 [0105.113] lstrlenW (lpString=".jpg") returned 4 [0105.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.113] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") [0105.114] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1556) returned 1 [0105.114] CloseHandle (hObject=0x1fc) returned 1 [0105.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x20 [0105.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.115] GetLastError () returned 0x0 [0105.115] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x614, lpOverlapped=0x0) returned 1 [0105.117] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x620, lpOverlapped=0x0) returned 1 [0105.118] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.118] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.118] SetEndOfFile (hFile=0x158) returned 1 [0105.118] CloseHandle (hObject=0x158) returned 1 [0105.118] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.118] SetEndOfFile (hFile=0x1fc) returned 1 [0105.119] CloseHandle (hObject=0x1fc) returned 1 [0105.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 1 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString=".doc") returned 4 [0105.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString=".docx") returned 5 [0105.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.120] lstrlenW (lpString=".pdf") returned 4 [0105.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString=".xls") returned 4 [0105.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.120] lstrlenW (lpString=".xlsx") returned 5 [0105.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.120] lstrlenW (lpString=".ppt") returned 4 [0105.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString=".zip") returned 4 [0105.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.120] lstrlenW (lpString=".rar") returned 4 [0105.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString=".bz2") returned 4 [0105.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString=".7z") returned 3 [0105.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString=".dbf") returned 4 [0105.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString=".1cd") returned 4 [0105.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.120] lstrlenW (lpString=".jpg") returned 4 [0105.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString=".pdf") returned 4 [0105.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString=".xls") returned 4 [0105.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.121] lstrlenW (lpString=".xlsx") returned 5 [0105.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.121] lstrlenW (lpString=".ppt") returned 4 [0105.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.121] lstrlenW (lpString=".zip") returned 4 [0105.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.121] lstrlenW (lpString=".rar") returned 4 [0105.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString=".bz2") returned 4 [0105.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString=".7z") returned 3 [0105.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.121] lstrlenW (lpString=".dbf") returned 4 [0105.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.121] lstrlenW (lpString=".1cd") returned 4 [0105.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 63 [0105.121] lstrlenW (lpString=".jpg") returned 4 [0105.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.121] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") [0105.123] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2228) returned 1 [0105.123] CloseHandle (hObject=0x1fc) returned 1 [0105.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x20 [0105.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.124] GetLastError () returned 0x0 [0105.124] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0105.125] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0105.126] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.126] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.127] SetEndOfFile (hFile=0x158) returned 1 [0105.127] CloseHandle (hObject=0x158) returned 1 [0105.127] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.127] SetEndOfFile (hFile=0x1fc) returned 1 [0105.127] CloseHandle (hObject=0x1fc) returned 1 [0105.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 1 [0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.128] lstrlenW (lpString=".doc") returned 4 [0105.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.128] lstrlenW (lpString=".docx") returned 5 [0105.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.128] lstrlenW (lpString=".pdf") returned 4 [0105.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.128] lstrlenW (lpString=".xls") returned 4 [0105.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.128] lstrlenW (lpString=".xlsx") returned 5 [0105.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.128] lstrlenW (lpString=".ppt") returned 4 [0105.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.128] lstrlenW (lpString=".zip") returned 4 [0105.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.128] lstrlenW (lpString=".rar") returned 4 [0105.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.128] lstrlenW (lpString=".bz2") returned 4 [0105.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.128] lstrlenW (lpString=".7z") returned 3 [0105.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".dbf") returned 4 [0105.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".1cd") returned 4 [0105.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".jpg") returned 4 [0105.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString=".pdf") returned 4 [0105.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString=".xls") returned 4 [0105.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.129] lstrlenW (lpString=".xlsx") returned 5 [0105.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.129] lstrlenW (lpString=".ppt") returned 4 [0105.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".zip") returned 4 [0105.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.129] lstrlenW (lpString=".rar") returned 4 [0105.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString=".bz2") returned 4 [0105.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString=".7z") returned 3 [0105.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".dbf") returned 4 [0105.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.129] lstrlenW (lpString=".1cd") returned 4 [0105.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 63 [0105.130] lstrlenW (lpString=".jpg") returned 4 [0105.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.130] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") [0105.130] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13184) returned 1 [0105.130] CloseHandle (hObject=0x1fc) returned 1 [0105.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x20 [0105.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.131] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.131] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.131] GetLastError () returned 0x0 [0105.131] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3380, lpOverlapped=0x0) returned 1 [0105.148] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3390, lpOverlapped=0x0) returned 1 [0105.178] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.178] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.178] SetEndOfFile (hFile=0x158) returned 1 [0105.179] CloseHandle (hObject=0x158) returned 1 [0105.179] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.179] SetEndOfFile (hFile=0x1fc) returned 1 [0105.179] CloseHandle (hObject=0x1fc) returned 1 [0105.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 1 [0105.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.180] lstrlenW (lpString=".doc") returned 4 [0105.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.180] lstrlenW (lpString=".docx") returned 5 [0105.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.180] lstrlenW (lpString=".pdf") returned 4 [0105.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.180] lstrlenW (lpString=".xls") returned 4 [0105.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.180] lstrlenW (lpString=".xlsx") returned 5 [0105.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.180] lstrlenW (lpString=".ppt") returned 4 [0105.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.180] lstrlenW (lpString=".zip") returned 4 [0105.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.180] lstrlenW (lpString=".rar") returned 4 [0105.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.180] lstrlenW (lpString=".bz2") returned 4 [0105.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString=".7z") returned 3 [0105.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.181] lstrlenW (lpString=".dbf") returned 4 [0105.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.181] lstrlenW (lpString=".1cd") returned 4 [0105.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.181] lstrlenW (lpString=".jpg") returned 4 [0105.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString=".pdf") returned 4 [0105.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString=".xls") returned 4 [0105.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.181] lstrlenW (lpString=".xlsx") returned 5 [0105.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.181] lstrlenW (lpString=".ppt") returned 4 [0105.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.181] lstrlenW (lpString=".zip") returned 4 [0105.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.181] lstrlenW (lpString=".rar") returned 4 [0105.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString=".bz2") returned 4 [0105.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString=".7z") returned 3 [0105.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.181] lstrlenW (lpString=".dbf") returned 4 [0105.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.182] lstrlenW (lpString=".1cd") returned 4 [0105.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 63 [0105.182] lstrlenW (lpString=".jpg") returned 4 [0105.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.182] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") [0105.182] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7972) returned 1 [0105.182] CloseHandle (hObject=0x1fc) returned 1 [0105.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x20 [0105.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.183] GetLastError () returned 0x0 [0105.183] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1f24, lpOverlapped=0x0) returned 1 [0105.193] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0105.193] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.194] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.194] SetEndOfFile (hFile=0x158) returned 1 [0105.197] CloseHandle (hObject=0x158) returned 1 [0105.197] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.197] SetEndOfFile (hFile=0x1fc) returned 1 [0105.227] CloseHandle (hObject=0x1fc) returned 1 [0105.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 1 [0105.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.231] lstrlenW (lpString=".doc") returned 4 [0105.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.231] lstrlenW (lpString=".docx") returned 5 [0105.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.231] lstrlenW (lpString=".pdf") returned 4 [0105.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.231] lstrlenW (lpString=".xls") returned 4 [0105.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.231] lstrlenW (lpString=".xlsx") returned 5 [0105.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.231] lstrlenW (lpString=".ppt") returned 4 [0105.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.232] lstrlenW (lpString=".zip") returned 4 [0105.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.232] lstrlenW (lpString=".rar") returned 4 [0105.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".bz2") returned 4 [0105.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".7z") returned 3 [0105.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.232] lstrlenW (lpString=".dbf") returned 4 [0105.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.232] lstrlenW (lpString=".1cd") returned 4 [0105.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.232] lstrlenW (lpString=".jpg") returned 4 [0105.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".pdf") returned 4 [0105.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".xls") returned 4 [0105.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.232] lstrlenW (lpString=".xlsx") returned 5 [0105.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.232] lstrlenW (lpString=".ppt") returned 4 [0105.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.232] lstrlenW (lpString=".zip") returned 4 [0105.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.232] lstrlenW (lpString=".rar") returned 4 [0105.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".bz2") returned 4 [0105.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.232] lstrlenW (lpString=".7z") returned 3 [0105.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.233] lstrlenW (lpString=".dbf") returned 4 [0105.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.233] lstrlenW (lpString=".1cd") returned 4 [0105.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 63 [0105.233] lstrlenW (lpString=".jpg") returned 4 [0105.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.233] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") [0105.933] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2556) returned 1 [0105.933] CloseHandle (hObject=0x1fc) returned 1 [0105.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x20 [0105.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.934] GetLastError () returned 0x0 [0105.934] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0105.936] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0105.937] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.937] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.937] SetEndOfFile (hFile=0x1f4) returned 1 [0105.937] CloseHandle (hObject=0x1f4) returned 1 [0105.937] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.937] SetEndOfFile (hFile=0x1fc) returned 1 [0105.938] CloseHandle (hObject=0x1fc) returned 1 [0105.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.939] lstrlenW (lpString=".doc") returned 4 [0105.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString=".docx") returned 5 [0105.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.939] lstrlenW (lpString=".pdf") returned 4 [0105.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString=".xls") returned 4 [0105.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.939] lstrlenW (lpString=".xlsx") returned 5 [0105.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.939] lstrlenW (lpString=".ppt") returned 4 [0105.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.939] lstrlenW (lpString=".zip") returned 4 [0105.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.939] lstrlenW (lpString=".rar") returned 4 [0105.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString=".bz2") returned 4 [0105.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString=".7z") returned 3 [0105.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.939] lstrlenW (lpString=".dbf") returned 4 [0105.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.939] lstrlenW (lpString=".1cd") returned 4 [0105.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.940] lstrlenW (lpString=".jpg") returned 4 [0105.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString=".pdf") returned 4 [0105.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString=".xls") returned 4 [0105.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.940] lstrlenW (lpString=".xlsx") returned 5 [0105.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.940] lstrlenW (lpString=".ppt") returned 4 [0105.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.940] lstrlenW (lpString=".zip") returned 4 [0105.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.940] lstrlenW (lpString=".rar") returned 4 [0105.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString=".bz2") returned 4 [0105.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString=".7z") returned 3 [0105.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.940] lstrlenW (lpString=".dbf") returned 4 [0105.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.940] lstrlenW (lpString=".1cd") returned 4 [0105.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 63 [0105.940] lstrlenW (lpString=".jpg") returned 4 [0105.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.940] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") [0105.941] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1588) returned 1 [0105.941] CloseHandle (hObject=0x1fc) returned 1 [0105.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 0x20 [0105.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.941] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.942] GetLastError () returned 0x0 [0105.942] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x634, lpOverlapped=0x0) returned 1 [0105.944] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x640, lpOverlapped=0x0) returned 1 [0105.944] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.944] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.945] SetEndOfFile (hFile=0x1f4) returned 1 [0105.945] CloseHandle (hObject=0x1f4) returned 1 [0105.945] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.945] SetEndOfFile (hFile=0x1fc) returned 1 [0105.946] CloseHandle (hObject=0x1fc) returned 1 [0105.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.946] lstrlenW (lpString=".doc") returned 4 [0105.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.946] lstrlenW (lpString=".docx") returned 5 [0105.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.946] lstrlenW (lpString=".pdf") returned 4 [0105.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.946] lstrlenW (lpString=".xls") returned 4 [0105.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.946] lstrlenW (lpString=".xlsx") returned 5 [0105.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.946] lstrlenW (lpString=".ppt") returned 4 [0105.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.946] lstrlenW (lpString=".zip") returned 4 [0105.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.946] lstrlenW (lpString=".rar") returned 4 [0105.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.946] lstrlenW (lpString=".bz2") returned 4 [0105.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString=".7z") returned 3 [0105.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.947] lstrlenW (lpString=".dbf") returned 4 [0105.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.947] lstrlenW (lpString=".1cd") returned 4 [0105.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.947] lstrlenW (lpString=".jpg") returned 4 [0105.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString=".pdf") returned 4 [0105.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString=".xls") returned 4 [0105.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.947] lstrlenW (lpString=".xlsx") returned 5 [0105.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.947] lstrlenW (lpString=".ppt") returned 4 [0105.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.947] lstrlenW (lpString=".zip") returned 4 [0105.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.947] lstrlenW (lpString=".rar") returned 4 [0105.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString=".bz2") returned 4 [0105.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.947] lstrlenW (lpString=".7z") returned 3 [0105.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.947] lstrlenW (lpString=".dbf") returned 4 [0105.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.948] lstrlenW (lpString=".1cd") returned 4 [0105.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 63 [0105.948] lstrlenW (lpString=".jpg") returned 4 [0105.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.948] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") [0105.948] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32718) returned 1 [0105.948] CloseHandle (hObject=0x1fc) returned 1 [0105.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x20 [0105.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.949] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.949] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.949] GetLastError () returned 0x0 [0105.949] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7fce, lpOverlapped=0x0) returned 1 [0105.952] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7fd0, lpOverlapped=0x0) returned 1 [0105.953] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.953] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.953] SetEndOfFile (hFile=0x1f4) returned 1 [0105.953] CloseHandle (hObject=0x1f4) returned 1 [0105.953] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.953] SetEndOfFile (hFile=0x1fc) returned 1 [0105.954] CloseHandle (hObject=0x1fc) returned 1 [0105.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 1 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString=".doc") returned 4 [0105.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString=".docx") returned 5 [0105.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.955] lstrlenW (lpString=".pdf") returned 4 [0105.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString=".xls") returned 4 [0105.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.955] lstrlenW (lpString=".xlsx") returned 5 [0105.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.955] lstrlenW (lpString=".ppt") returned 4 [0105.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString=".zip") returned 4 [0105.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.955] lstrlenW (lpString=".rar") returned 4 [0105.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString=".bz2") returned 4 [0105.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString=".7z") returned 3 [0105.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString=".dbf") returned 4 [0105.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString=".1cd") returned 4 [0105.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.955] lstrlenW (lpString=".jpg") returned 4 [0105.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString=".pdf") returned 4 [0105.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString=".xls") returned 4 [0105.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.956] lstrlenW (lpString=".xlsx") returned 5 [0105.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.956] lstrlenW (lpString=".ppt") returned 4 [0105.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.956] lstrlenW (lpString=".zip") returned 4 [0105.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.956] lstrlenW (lpString=".rar") returned 4 [0105.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString=".bz2") returned 4 [0105.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString=".7z") returned 3 [0105.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.956] lstrlenW (lpString=".dbf") returned 4 [0105.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.956] lstrlenW (lpString=".1cd") returned 4 [0105.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 63 [0105.956] lstrlenW (lpString=".jpg") returned 4 [0105.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.956] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") [0105.957] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4636) returned 1 [0105.957] CloseHandle (hObject=0x1fc) returned 1 [0105.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x20 [0105.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.957] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.957] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.958] GetLastError () returned 0x0 [0105.958] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x121c, lpOverlapped=0x0) returned 1 [0105.959] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0105.960] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.960] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.960] SetEndOfFile (hFile=0x1f4) returned 1 [0105.961] CloseHandle (hObject=0x1f4) returned 1 [0105.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.961] SetEndOfFile (hFile=0x1fc) returned 1 [0105.962] CloseHandle (hObject=0x1fc) returned 1 [0105.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 1 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.962] lstrlenW (lpString=".doc") returned 4 [0105.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.962] lstrlenW (lpString=".docx") returned 5 [0105.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.962] lstrlenW (lpString=".pdf") returned 4 [0105.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.962] lstrlenW (lpString=".xls") returned 4 [0105.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.962] lstrlenW (lpString=".xlsx") returned 5 [0105.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.962] lstrlenW (lpString=".ppt") returned 4 [0105.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.962] lstrlenW (lpString=".zip") returned 4 [0105.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.963] lstrlenW (lpString=".rar") returned 4 [0105.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".bz2") returned 4 [0105.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".7z") returned 3 [0105.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.963] lstrlenW (lpString=".dbf") returned 4 [0105.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.963] lstrlenW (lpString=".1cd") returned 4 [0105.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.963] lstrlenW (lpString=".jpg") returned 4 [0105.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".pdf") returned 4 [0105.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".xls") returned 4 [0105.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.963] lstrlenW (lpString=".xlsx") returned 5 [0105.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.963] lstrlenW (lpString=".ppt") returned 4 [0105.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.963] lstrlenW (lpString=".zip") returned 4 [0105.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.963] lstrlenW (lpString=".rar") returned 4 [0105.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".bz2") returned 4 [0105.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.963] lstrlenW (lpString=".7z") returned 3 [0105.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.964] lstrlenW (lpString=".dbf") returned 4 [0105.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.964] lstrlenW (lpString=".1cd") returned 4 [0105.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 63 [0105.964] lstrlenW (lpString=".jpg") returned 4 [0105.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.964] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") [0105.964] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16456) returned 1 [0105.964] CloseHandle (hObject=0x1fc) returned 1 [0105.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x20 [0105.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.965] GetLastError () returned 0x0 [0105.965] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4048, lpOverlapped=0x0) returned 1 [0106.046] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4050, lpOverlapped=0x0) returned 1 [0106.047] ReadFile (in: hFile=0x1fc, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.047] WriteFile (in: hFile=0x1f4, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.047] SetEndOfFile (hFile=0x1f4) returned 1 [0106.271] CloseHandle (hObject=0x1f4) returned 1 [0106.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.272] SetEndOfFile (hFile=0x1fc) returned 1 [0106.272] CloseHandle (hObject=0x1fc) returned 1 [0106.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.336] lstrlenW (lpString=".doc") returned 4 [0106.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString=".docx") returned 5 [0106.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.336] lstrlenW (lpString=".pdf") returned 4 [0106.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString=".xls") returned 4 [0106.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.336] lstrlenW (lpString=".xlsx") returned 5 [0106.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.336] lstrlenW (lpString=".ppt") returned 4 [0106.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.336] lstrlenW (lpString=".zip") returned 4 [0106.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.336] lstrlenW (lpString=".rar") returned 4 [0106.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString=".bz2") returned 4 [0106.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString=".7z") returned 3 [0106.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.336] lstrlenW (lpString=".dbf") returned 4 [0106.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".1cd") returned 4 [0106.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".jpg") returned 4 [0106.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString=".pdf") returned 4 [0106.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString=".xls") returned 4 [0106.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.337] lstrlenW (lpString=".xlsx") returned 5 [0106.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.337] lstrlenW (lpString=".ppt") returned 4 [0106.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".zip") returned 4 [0106.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.337] lstrlenW (lpString=".rar") returned 4 [0106.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString=".bz2") returned 4 [0106.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString=".7z") returned 3 [0106.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".dbf") returned 4 [0106.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".1cd") returned 4 [0106.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 63 [0106.337] lstrlenW (lpString=".jpg") returned 4 [0106.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.338] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") [0106.487] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31968) returned 1 [0106.487] CloseHandle (hObject=0x15c) returned 1 [0106.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x20 [0106.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.488] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.488] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.488] GetLastError () returned 0x0 [0106.488] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.498] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.499] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.499] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.499] SetEndOfFile (hFile=0x1b8) returned 1 [0106.499] CloseHandle (hObject=0x1b8) returned 1 [0106.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.499] SetEndOfFile (hFile=0x15c) returned 1 [0106.500] CloseHandle (hObject=0x15c) returned 1 [0106.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString=".doc") returned 4 [0106.501] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".docx") returned 5 [0106.501] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.501] lstrlenW (lpString=".pdf") returned 4 [0106.501] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".xls") returned 4 [0106.501] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".xlsx") returned 5 [0106.501] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.501] lstrlenW (lpString=".ppt") returned 4 [0106.501] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString=".zip") returned 4 [0106.501] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".rar") returned 4 [0106.501] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".bz2") returned 4 [0106.501] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString=".7z") returned 3 [0106.501] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString=".dbf") returned 4 [0106.501] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString=".1cd") returned 4 [0106.501] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 63 [0106.501] lstrlenW (lpString=".jpg") returned 4 [0106.501] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.502] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") [0106.502] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31968) returned 1 [0106.502] CloseHandle (hObject=0x15c) returned 1 [0106.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x20 [0106.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.503] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.503] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.503] GetLastError () returned 0x0 [0106.503] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.524] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.526] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.526] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.526] SetEndOfFile (hFile=0x1b8) returned 1 [0106.526] CloseHandle (hObject=0x1b8) returned 1 [0106.526] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.526] SetEndOfFile (hFile=0x15c) returned 1 [0106.527] CloseHandle (hObject=0x15c) returned 1 [0106.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 1 [0106.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.528] lstrlenW (lpString=".doc") returned 4 [0106.528] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".docx") returned 5 [0106.528] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.528] lstrlenW (lpString=".pdf") returned 4 [0106.528] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".xls") returned 4 [0106.528] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".xlsx") returned 5 [0106.528] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.528] lstrlenW (lpString=".ppt") returned 4 [0106.528] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.528] lstrlenW (lpString=".zip") returned 4 [0106.528] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".rar") returned 4 [0106.528] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".bz2") returned 4 [0106.528] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString=".7z") returned 3 [0106.528] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.528] lstrlenW (lpString=".dbf") returned 4 [0106.528] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.528] lstrlenW (lpString=".1cd") returned 4 [0106.529] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 63 [0106.529] lstrlenW (lpString=".jpg") returned 4 [0106.529] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.529] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") [0106.529] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29335) returned 1 [0106.529] CloseHandle (hObject=0x15c) returned 1 [0106.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x20 [0106.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.530] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.530] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.530] GetLastError () returned 0x0 [0106.530] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7297, lpOverlapped=0x0) returned 1 [0106.538] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x72a0, lpOverlapped=0x0) returned 1 [0106.539] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.539] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.539] SetEndOfFile (hFile=0x1b8) returned 1 [0106.539] CloseHandle (hObject=0x1b8) returned 1 [0106.539] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.540] SetEndOfFile (hFile=0x15c) returned 1 [0106.540] CloseHandle (hObject=0x15c) returned 1 [0106.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 1 [0106.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.541] lstrlenW (lpString=".doc") returned 4 [0106.541] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.541] lstrlenW (lpString=".docx") returned 5 [0106.541] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0106.541] lstrlenW (lpString=".pdf") returned 4 [0106.541] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.541] lstrlenW (lpString=".xls") returned 4 [0106.541] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.541] lstrlenW (lpString=".xlsx") returned 5 [0106.541] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0106.541] lstrlenW (lpString=".ppt") returned 4 [0106.541] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.541] lstrlenW (lpString=".zip") returned 4 [0106.541] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.541] lstrlenW (lpString=".rar") returned 4 [0106.541] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.541] lstrlenW (lpString=".bz2") returned 4 [0106.541] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.541] lstrlenW (lpString=".7z") returned 3 [0106.542] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.542] lstrlenW (lpString=".dbf") returned 4 [0106.542] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.542] lstrlenW (lpString=".1cd") returned 4 [0106.542] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 63 [0106.542] lstrlenW (lpString=".jpg") returned 4 [0106.542] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.542] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") [0106.543] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32184) returned 1 [0106.543] CloseHandle (hObject=0x15c) returned 1 [0106.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 0x20 [0106.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.544] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.544] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.547] GetLastError () returned 0x0 [0106.547] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.839] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.848] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.848] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.848] SetEndOfFile (hFile=0x1b8) returned 1 [0106.848] CloseHandle (hObject=0x1b8) returned 1 [0106.849] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.849] SetEndOfFile (hFile=0x15c) returned 1 [0106.849] CloseHandle (hObject=0x15c) returned 1 [0106.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 1 [0106.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.850] lstrlenW (lpString=".doc") returned 4 [0106.850] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.850] lstrlenW (lpString=".docx") returned 5 [0106.850] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.850] lstrlenW (lpString=".pdf") returned 4 [0106.850] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.850] lstrlenW (lpString=".xls") returned 4 [0106.850] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.850] lstrlenW (lpString=".xlsx") returned 5 [0106.850] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.850] lstrlenW (lpString=".ppt") returned 4 [0106.850] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.850] lstrlenW (lpString=".zip") returned 4 [0106.850] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.851] lstrlenW (lpString=".rar") returned 4 [0106.851] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.851] lstrlenW (lpString=".bz2") returned 4 [0106.851] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.851] lstrlenW (lpString=".7z") returned 3 [0106.851] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.851] lstrlenW (lpString=".dbf") returned 4 [0106.851] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.851] lstrlenW (lpString=".1cd") returned 4 [0106.851] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 63 [0106.851] lstrlenW (lpString=".jpg") returned 4 [0106.851] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.851] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") [0106.852] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=25499) returned 1 [0106.852] CloseHandle (hObject=0x15c) returned 1 [0106.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 0x20 [0106.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.852] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.852] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.853] GetLastError () returned 0x0 [0106.853] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x639b, lpOverlapped=0x0) returned 1 [0106.855] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x63a0, lpOverlapped=0x0) returned 1 [0106.856] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.856] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.856] SetEndOfFile (hFile=0x1b8) returned 1 [0106.857] CloseHandle (hObject=0x1b8) returned 1 [0106.857] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.857] SetEndOfFile (hFile=0x15c) returned 1 [0106.858] CloseHandle (hObject=0x15c) returned 1 [0106.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 1 [0106.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.858] lstrlenW (lpString=".doc") returned 4 [0106.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.858] lstrlenW (lpString=".docx") returned 5 [0106.858] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0106.858] lstrlenW (lpString=".pdf") returned 4 [0106.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.858] lstrlenW (lpString=".xls") returned 4 [0106.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.858] lstrlenW (lpString=".xlsx") returned 5 [0106.858] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0106.858] lstrlenW (lpString=".ppt") returned 4 [0106.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.858] lstrlenW (lpString=".zip") returned 4 [0106.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.858] lstrlenW (lpString=".rar") returned 4 [0106.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.859] lstrlenW (lpString=".bz2") returned 4 [0106.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.859] lstrlenW (lpString=".7z") returned 3 [0106.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.859] lstrlenW (lpString=".dbf") returned 4 [0106.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.859] lstrlenW (lpString=".1cd") returned 4 [0106.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 63 [0106.859] lstrlenW (lpString=".jpg") returned 4 [0106.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.859] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") [0106.859] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=32400) returned 1 [0106.860] CloseHandle (hObject=0x15c) returned 1 [0106.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x20 [0106.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.860] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.860] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.861] GetLastError () returned 0x0 [0106.861] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7e90, lpOverlapped=0x0) returned 1 [0106.865] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0106.866] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.866] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.866] SetEndOfFile (hFile=0x1b8) returned 1 [0106.866] CloseHandle (hObject=0x1b8) returned 1 [0106.866] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.866] SetEndOfFile (hFile=0x15c) returned 1 [0106.867] CloseHandle (hObject=0x15c) returned 1 [0106.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 1 [0106.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.868] lstrlenW (lpString=".doc") returned 4 [0106.868] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".docx") returned 5 [0106.868] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.868] lstrlenW (lpString=".pdf") returned 4 [0106.868] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".xls") returned 4 [0106.868] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".xlsx") returned 5 [0106.868] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.868] lstrlenW (lpString=".ppt") returned 4 [0106.868] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.868] lstrlenW (lpString=".zip") returned 4 [0106.868] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".rar") returned 4 [0106.868] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".bz2") returned 4 [0106.868] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString=".7z") returned 3 [0106.868] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.868] lstrlenW (lpString=".dbf") returned 4 [0106.868] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.868] lstrlenW (lpString=".1cd") returned 4 [0106.869] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 63 [0106.869] lstrlenW (lpString=".jpg") returned 4 [0106.869] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.869] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") [0106.869] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33048) returned 1 [0106.869] CloseHandle (hObject=0x15c) returned 1 [0106.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x20 [0106.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.870] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.870] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.870] GetLastError () returned 0x0 [0106.870] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8118, lpOverlapped=0x0) returned 1 [0106.872] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8120, lpOverlapped=0x0) returned 1 [0106.874] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.874] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.874] SetEndOfFile (hFile=0x1b8) returned 1 [0106.874] CloseHandle (hObject=0x1b8) returned 1 [0106.874] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.874] SetEndOfFile (hFile=0x15c) returned 1 [0106.875] CloseHandle (hObject=0x15c) returned 1 [0106.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 1 [0106.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.875] lstrlenW (lpString=".doc") returned 4 [0106.875] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.875] lstrlenW (lpString=".docx") returned 5 [0106.876] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.876] lstrlenW (lpString=".pdf") returned 4 [0106.876] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString=".xls") returned 4 [0106.876] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString=".xlsx") returned 5 [0106.876] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.876] lstrlenW (lpString=".ppt") returned 4 [0106.876] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.876] lstrlenW (lpString=".zip") returned 4 [0106.876] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString=".rar") returned 4 [0106.876] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString=".bz2") returned 4 [0106.876] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString=".7z") returned 3 [0106.876] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.876] lstrlenW (lpString=".dbf") returned 4 [0106.876] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.876] lstrlenW (lpString=".1cd") returned 4 [0106.876] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 63 [0106.876] lstrlenW (lpString=".jpg") returned 4 [0106.876] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.876] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") [0106.877] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=24363) returned 1 [0106.877] CloseHandle (hObject=0x15c) returned 1 [0106.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 0x20 [0106.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.878] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.878] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.878] GetLastError () returned 0x0 [0106.878] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5f2b, lpOverlapped=0x0) returned 1 [0107.142] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5f30, lpOverlapped=0x0) returned 1 [0107.143] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.143] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.144] SetEndOfFile (hFile=0x1b8) returned 1 [0107.144] CloseHandle (hObject=0x1b8) returned 1 [0107.144] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.144] SetEndOfFile (hFile=0x15c) returned 1 [0107.145] CloseHandle (hObject=0x15c) returned 1 [0107.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 1 [0107.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.145] lstrlenW (lpString=".doc") returned 4 [0107.145] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.145] lstrlenW (lpString=".docx") returned 5 [0107.145] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.145] lstrlenW (lpString=".pdf") returned 4 [0107.145] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.145] lstrlenW (lpString=".xls") returned 4 [0107.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.145] lstrlenW (lpString=".xlsx") returned 5 [0107.145] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.146] lstrlenW (lpString=".ppt") returned 4 [0107.146] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.146] lstrlenW (lpString=".zip") returned 4 [0107.146] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.146] lstrlenW (lpString=".rar") returned 4 [0107.146] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.146] lstrlenW (lpString=".bz2") returned 4 [0107.146] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.146] lstrlenW (lpString=".7z") returned 3 [0107.146] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.146] lstrlenW (lpString=".dbf") returned 4 [0107.146] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.146] lstrlenW (lpString=".1cd") returned 4 [0107.146] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 63 [0107.146] lstrlenW (lpString=".jpg") returned 4 [0107.146] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.146] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") [0107.147] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=50050) returned 1 [0107.147] CloseHandle (hObject=0x15c) returned 1 [0107.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 0x20 [0107.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.147] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.147] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0107.148] GetLastError () returned 0x0 [0107.148] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc382, lpOverlapped=0x0) returned 1 [0107.150] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc390, lpOverlapped=0x0) returned 1 [0107.152] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.152] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.152] SetEndOfFile (hFile=0x1b8) returned 1 [0107.152] CloseHandle (hObject=0x1b8) returned 1 [0107.152] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.152] SetEndOfFile (hFile=0x15c) returned 1 [0107.153] CloseHandle (hObject=0x15c) returned 1 [0107.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 1 [0107.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString=".doc") returned 4 [0107.154] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.154] lstrlenW (lpString=".docx") returned 5 [0107.154] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.154] lstrlenW (lpString=".pdf") returned 4 [0107.154] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.154] lstrlenW (lpString=".xls") returned 4 [0107.154] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.154] lstrlenW (lpString=".xlsx") returned 5 [0107.154] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.154] lstrlenW (lpString=".ppt") returned 4 [0107.154] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString=".zip") returned 4 [0107.154] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.154] lstrlenW (lpString=".rar") returned 4 [0107.154] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.154] lstrlenW (lpString=".bz2") returned 4 [0107.154] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.154] lstrlenW (lpString=".7z") returned 3 [0107.154] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString=".dbf") returned 4 [0107.154] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString=".1cd") returned 4 [0107.154] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 63 [0107.154] lstrlenW (lpString=".jpg") returned 4 [0107.154] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.154] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") [0107.155] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31752) returned 1 [0107.155] CloseHandle (hObject=0x15c) returned 1 [0107.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x20 [0107.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.155] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.155] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0107.156] GetLastError () returned 0x0 [0107.156] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7c08, lpOverlapped=0x0) returned 1 [0107.158] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7c10, lpOverlapped=0x0) returned 1 [0107.159] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.159] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.159] SetEndOfFile (hFile=0x1b8) returned 1 [0107.160] CloseHandle (hObject=0x1b8) returned 1 [0107.160] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.160] SetEndOfFile (hFile=0x15c) returned 1 [0107.161] CloseHandle (hObject=0x15c) returned 1 [0107.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 1 [0107.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.161] lstrlenW (lpString=".doc") returned 4 [0107.161] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.161] lstrlenW (lpString=".docx") returned 5 [0107.161] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.161] lstrlenW (lpString=".pdf") returned 4 [0107.161] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.161] lstrlenW (lpString=".xls") returned 4 [0107.161] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.161] lstrlenW (lpString=".xlsx") returned 5 [0107.161] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.161] lstrlenW (lpString=".ppt") returned 4 [0107.161] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.161] lstrlenW (lpString=".zip") returned 4 [0107.161] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.161] lstrlenW (lpString=".rar") returned 4 [0107.161] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.162] lstrlenW (lpString=".bz2") returned 4 [0107.162] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.162] lstrlenW (lpString=".7z") returned 3 [0107.162] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.162] lstrlenW (lpString=".dbf") returned 4 [0107.162] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.162] lstrlenW (lpString=".1cd") returned 4 [0107.162] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 63 [0107.162] lstrlenW (lpString=".jpg") returned 4 [0107.162] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.162] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") [0107.163] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=108216) returned 1 [0107.163] CloseHandle (hObject=0x15c) returned 1 [0107.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x20 [0107.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.163] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.163] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0107.164] GetLastError () returned 0x0 [0107.164] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1a6b8, lpOverlapped=0x0) returned 1 [0107.168] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a6c0, lpOverlapped=0x0) returned 1 [0107.170] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.170] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.170] SetEndOfFile (hFile=0x1b8) returned 1 [0107.170] CloseHandle (hObject=0x1b8) returned 1 [0107.170] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.170] SetEndOfFile (hFile=0x15c) returned 1 [0107.172] CloseHandle (hObject=0x15c) returned 1 [0107.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 1 [0107.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.172] lstrlenW (lpString=".doc") returned 4 [0107.172] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString=".docx") returned 5 [0107.172] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.172] lstrlenW (lpString=".pdf") returned 4 [0107.172] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString=".xls") returned 4 [0107.172] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString=".xlsx") returned 5 [0107.172] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.172] lstrlenW (lpString=".ppt") returned 4 [0107.172] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.172] lstrlenW (lpString=".zip") returned 4 [0107.172] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString=".rar") returned 4 [0107.172] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.172] lstrlenW (lpString=".bz2") returned 4 [0107.172] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.173] lstrlenW (lpString=".7z") returned 3 [0107.173] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.173] lstrlenW (lpString=".dbf") returned 4 [0107.173] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.173] lstrlenW (lpString=".1cd") returned 4 [0107.173] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 63 [0107.173] lstrlenW (lpString=".jpg") returned 4 [0107.173] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.173] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") [0107.173] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=108504) returned 1 [0107.174] CloseHandle (hObject=0x15c) returned 1 [0107.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x20 [0107.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.174] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.174] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0107.175] GetLastError () returned 0x0 [0107.175] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a7e0, lpOverlapped=0x0) returned 1 [0107.331] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.331] SetEndOfFile (hFile=0x1b8) returned 1 [0107.331] CloseHandle (hObject=0x1b8) returned 1 [0107.331] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.331] SetEndOfFile (hFile=0x15c) returned 1 [0107.332] CloseHandle (hObject=0x15c) returned 1 [0107.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 1 [0107.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.339] lstrlenW (lpString=".doc") returned 4 [0107.339] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.339] lstrlenW (lpString=".docx") returned 5 [0107.339] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.339] lstrlenW (lpString=".pdf") returned 4 [0107.339] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.339] lstrlenW (lpString=".xls") returned 4 [0107.340] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString=".xlsx") returned 5 [0107.340] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.340] lstrlenW (lpString=".ppt") returned 4 [0107.340] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.340] lstrlenW (lpString=".zip") returned 4 [0107.340] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString=".rar") returned 4 [0107.340] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString=".bz2") returned 4 [0107.340] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString=".7z") returned 3 [0107.340] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.340] lstrlenW (lpString=".dbf") returned 4 [0107.340] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.340] lstrlenW (lpString=".1cd") returned 4 [0107.340] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 63 [0107.340] lstrlenW (lpString=".jpg") returned 4 [0107.340] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.340] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") [0107.558] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=42053) returned 1 [0107.558] CloseHandle (hObject=0x15c) returned 1 [0107.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0107.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0107.559] GetLastError () returned 0x0 [0107.559] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa445, lpOverlapped=0x0) returned 1 [0107.901] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa450, lpOverlapped=0x0) returned 1 [0107.903] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.905] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.905] SetEndOfFile (hFile=0x158) returned 1 [0107.906] CloseHandle (hObject=0x158) returned 1 [0107.906] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.906] SetEndOfFile (hFile=0x15c) returned 1 [0107.907] CloseHandle (hObject=0x15c) returned 1 [0107.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 1 [0107.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.908] lstrlenW (lpString=".doc") returned 4 [0107.908] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.908] lstrlenW (lpString=".docx") returned 5 [0107.908] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0107.908] lstrlenW (lpString=".pdf") returned 4 [0107.908] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.908] lstrlenW (lpString=".xls") returned 4 [0107.908] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.908] lstrlenW (lpString=".xlsx") returned 5 [0107.908] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0107.908] lstrlenW (lpString=".ppt") returned 4 [0107.908] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.908] lstrlenW (lpString=".zip") returned 4 [0107.908] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.908] lstrlenW (lpString=".rar") returned 4 [0107.908] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.908] lstrlenW (lpString=".bz2") returned 4 [0107.908] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.908] lstrlenW (lpString=".7z") returned 3 [0107.908] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.909] lstrlenW (lpString=".dbf") returned 4 [0107.909] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.909] lstrlenW (lpString=".1cd") returned 4 [0107.909] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 63 [0107.909] lstrlenW (lpString=".jpg") returned 4 [0107.909] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.909] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") [0107.910] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=48558) returned 1 [0107.910] CloseHandle (hObject=0x15c) returned 1 [0107.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0107.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.910] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.910] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0107.911] GetLastError () returned 0x0 [0107.911] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xbdae, lpOverlapped=0x0) returned 1 [0107.943] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xbdb0, lpOverlapped=0x0) returned 1 [0107.945] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.945] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.945] SetEndOfFile (hFile=0x158) returned 1 [0108.327] CloseHandle (hObject=0x158) returned 1 [0108.334] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.341] SetEndOfFile (hFile=0x15c) returned 1 [0108.342] CloseHandle (hObject=0x15c) returned 1 [0108.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString=".doc") returned 4 [0108.343] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0108.343] lstrlenW (lpString=".docx") returned 5 [0108.343] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0108.343] lstrlenW (lpString=".pdf") returned 4 [0108.343] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0108.343] lstrlenW (lpString=".xls") returned 4 [0108.343] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0108.343] lstrlenW (lpString=".xlsx") returned 5 [0108.343] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0108.343] lstrlenW (lpString=".ppt") returned 4 [0108.343] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0108.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString=".zip") returned 4 [0108.343] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0108.343] lstrlenW (lpString=".rar") returned 4 [0108.343] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0108.343] lstrlenW (lpString=".bz2") returned 4 [0108.343] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0108.343] lstrlenW (lpString=".7z") returned 3 [0108.343] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0108.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString=".dbf") returned 4 [0108.343] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0108.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString=".1cd") returned 4 [0108.343] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0108.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 63 [0108.343] lstrlenW (lpString=".jpg") returned 4 [0108.343] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0108.343] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") [0108.344] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3350) returned 1 [0108.344] CloseHandle (hObject=0x15c) returned 1 [0108.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 0x20 [0108.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.344] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.345] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.345] GetLastError () returned 0x0 [0108.345] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd16, lpOverlapped=0x0) returned 1 [0108.386] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0108.387] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.387] WriteFile (in: hFile=0x158, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0108.387] SetEndOfFile (hFile=0x158) returned 1 [0108.389] CloseHandle (hObject=0x158) returned 1 [0108.389] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.389] SetEndOfFile (hFile=0x15c) returned 1 [0108.390] CloseHandle (hObject=0x15c) returned 1 [0108.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 1 [0108.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.390] lstrlenW (lpString=".doc") returned 4 [0108.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.390] lstrlenW (lpString=".docx") returned 5 [0108.390] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0108.390] lstrlenW (lpString=".pdf") returned 4 [0108.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.390] lstrlenW (lpString=".xls") returned 4 [0108.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.390] lstrlenW (lpString=".xlsx") returned 5 [0108.390] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0108.390] lstrlenW (lpString=".ppt") returned 4 [0108.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.391] lstrlenW (lpString=".zip") returned 4 [0108.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.391] lstrlenW (lpString=".rar") returned 4 [0108.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.391] lstrlenW (lpString=".bz2") returned 4 [0108.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.391] lstrlenW (lpString=".7z") returned 3 [0108.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.391] lstrlenW (lpString=".dbf") returned 4 [0108.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.391] lstrlenW (lpString=".1cd") returned 4 [0108.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 62 [0108.391] lstrlenW (lpString=".jpg") returned 4 [0108.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.391] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") [0108.393] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4712) returned 1 [0108.393] CloseHandle (hObject=0x15c) returned 1 [0108.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x20 [0108.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.393] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.393] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.413] GetLastError () returned 0x0 [0108.413] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1268, lpOverlapped=0x0) returned 1 [0108.435] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0108.436] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.436] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.436] SetEndOfFile (hFile=0x1c8) returned 1 [0108.436] CloseHandle (hObject=0x1c8) returned 1 [0108.436] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.436] SetEndOfFile (hFile=0x15c) returned 1 [0108.437] CloseHandle (hObject=0x15c) returned 1 [0108.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 1 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString=".doc") returned 4 [0108.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString=".docx") returned 5 [0108.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.438] lstrlenW (lpString=".pdf") returned 4 [0108.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString=".xls") returned 4 [0108.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.438] lstrlenW (lpString=".xlsx") returned 5 [0108.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.438] lstrlenW (lpString=".ppt") returned 4 [0108.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString=".zip") returned 4 [0108.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.438] lstrlenW (lpString=".rar") returned 4 [0108.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString=".bz2") returned 4 [0108.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString=".7z") returned 3 [0108.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString=".dbf") returned 4 [0108.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString=".1cd") returned 4 [0108.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.438] lstrlenW (lpString=".jpg") returned 4 [0108.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString=".pdf") returned 4 [0108.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString=".xls") returned 4 [0108.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.439] lstrlenW (lpString=".xlsx") returned 5 [0108.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.439] lstrlenW (lpString=".ppt") returned 4 [0108.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.439] lstrlenW (lpString=".zip") returned 4 [0108.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.439] lstrlenW (lpString=".rar") returned 4 [0108.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString=".bz2") returned 4 [0108.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString=".7z") returned 3 [0108.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.439] lstrlenW (lpString=".dbf") returned 4 [0108.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.439] lstrlenW (lpString=".1cd") returned 4 [0108.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 63 [0108.439] lstrlenW (lpString=".jpg") returned 4 [0108.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.439] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") [0108.440] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3292) returned 1 [0108.440] CloseHandle (hObject=0x15c) returned 1 [0108.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 0x20 [0108.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.440] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.440] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.441] GetLastError () returned 0x0 [0108.441] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xcdc, lpOverlapped=0x0) returned 1 [0108.470] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0108.471] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.471] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.471] SetEndOfFile (hFile=0x1c8) returned 1 [0108.471] CloseHandle (hObject=0x1c8) returned 1 [0108.471] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.471] SetEndOfFile (hFile=0x15c) returned 1 [0108.472] CloseHandle (hObject=0x15c) returned 1 [0108.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 1 [0108.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.472] lstrlenW (lpString=".doc") returned 4 [0108.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.472] lstrlenW (lpString=".docx") returned 5 [0108.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.473] lstrlenW (lpString=".pdf") returned 4 [0108.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString=".xls") returned 4 [0108.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.473] lstrlenW (lpString=".xlsx") returned 5 [0108.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.473] lstrlenW (lpString=".ppt") returned 4 [0108.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.473] lstrlenW (lpString=".zip") returned 4 [0108.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.473] lstrlenW (lpString=".rar") returned 4 [0108.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString=".bz2") returned 4 [0108.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString=".7z") returned 3 [0108.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.473] lstrlenW (lpString=".dbf") returned 4 [0108.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.473] lstrlenW (lpString=".1cd") returned 4 [0108.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.473] lstrlenW (lpString=".jpg") returned 4 [0108.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString=".pdf") returned 4 [0108.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.473] lstrlenW (lpString=".xls") returned 4 [0108.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.473] lstrlenW (lpString=".xlsx") returned 5 [0108.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.474] lstrlenW (lpString=".ppt") returned 4 [0108.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.474] lstrlenW (lpString=".zip") returned 4 [0108.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.474] lstrlenW (lpString=".rar") returned 4 [0108.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.474] lstrlenW (lpString=".bz2") returned 4 [0108.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.474] lstrlenW (lpString=".7z") returned 3 [0108.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.474] lstrlenW (lpString=".dbf") returned 4 [0108.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.474] lstrlenW (lpString=".1cd") returned 4 [0108.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 63 [0108.474] lstrlenW (lpString=".jpg") returned 4 [0108.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.474] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") [0108.475] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5004) returned 1 [0108.475] CloseHandle (hObject=0x15c) returned 1 [0108.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x20 [0108.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.476] GetLastError () returned 0x0 [0108.476] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x138c, lpOverlapped=0x0) returned 1 [0108.478] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0108.479] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.479] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.479] SetEndOfFile (hFile=0x1c8) returned 1 [0108.479] CloseHandle (hObject=0x1c8) returned 1 [0108.479] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.479] SetEndOfFile (hFile=0x15c) returned 1 [0108.480] CloseHandle (hObject=0x15c) returned 1 [0108.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 1 [0108.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString=".doc") returned 4 [0108.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString=".docx") returned 5 [0108.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.481] lstrlenW (lpString=".pdf") returned 4 [0108.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString=".xls") returned 4 [0108.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.481] lstrlenW (lpString=".xlsx") returned 5 [0108.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.481] lstrlenW (lpString=".ppt") returned 4 [0108.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString=".zip") returned 4 [0108.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.481] lstrlenW (lpString=".rar") returned 4 [0108.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString=".bz2") returned 4 [0108.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString=".7z") returned 3 [0108.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString=".dbf") returned 4 [0108.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString=".1cd") returned 4 [0108.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.481] lstrlenW (lpString=".jpg") returned 4 [0108.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.481] lstrlenW (lpString=".pdf") returned 4 [0108.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString=".xls") returned 4 [0108.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.482] lstrlenW (lpString=".xlsx") returned 5 [0108.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.482] lstrlenW (lpString=".ppt") returned 4 [0108.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.482] lstrlenW (lpString=".zip") returned 4 [0108.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.482] lstrlenW (lpString=".rar") returned 4 [0108.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString=".bz2") returned 4 [0108.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString=".7z") returned 3 [0108.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.482] lstrlenW (lpString=".dbf") returned 4 [0108.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.482] lstrlenW (lpString=".1cd") returned 4 [0108.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 63 [0108.482] lstrlenW (lpString=".jpg") returned 4 [0108.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.482] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") [0108.483] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27844) returned 1 [0108.483] CloseHandle (hObject=0x15c) returned 1 [0108.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 0x20 [0108.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.483] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.484] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.484] GetLastError () returned 0x0 [0108.484] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x6cc4, lpOverlapped=0x0) returned 1 [0108.486] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x6cd0, lpOverlapped=0x0) returned 1 [0108.487] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.487] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.488] SetEndOfFile (hFile=0x1c8) returned 1 [0108.488] CloseHandle (hObject=0x1c8) returned 1 [0108.488] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.488] SetEndOfFile (hFile=0x15c) returned 1 [0108.489] CloseHandle (hObject=0x15c) returned 1 [0108.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 1 [0108.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.489] lstrlenW (lpString=".doc") returned 4 [0108.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.489] lstrlenW (lpString=".docx") returned 5 [0108.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.489] lstrlenW (lpString=".pdf") returned 4 [0108.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.489] lstrlenW (lpString=".xls") returned 4 [0108.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.489] lstrlenW (lpString=".xlsx") returned 5 [0108.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.490] lstrlenW (lpString=".ppt") returned 4 [0108.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.490] lstrlenW (lpString=".zip") returned 4 [0108.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.490] lstrlenW (lpString=".rar") returned 4 [0108.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString=".bz2") returned 4 [0108.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString=".7z") returned 3 [0108.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.490] lstrlenW (lpString=".dbf") returned 4 [0108.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.490] lstrlenW (lpString=".1cd") returned 4 [0108.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.490] lstrlenW (lpString=".jpg") returned 4 [0108.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString=".pdf") returned 4 [0108.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString=".xls") returned 4 [0108.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.490] lstrlenW (lpString=".xlsx") returned 5 [0108.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.490] lstrlenW (lpString=".ppt") returned 4 [0108.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.490] lstrlenW (lpString=".zip") returned 4 [0108.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.490] lstrlenW (lpString=".rar") returned 4 [0108.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.491] lstrlenW (lpString=".bz2") returned 4 [0108.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.491] lstrlenW (lpString=".7z") returned 3 [0108.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.491] lstrlenW (lpString=".dbf") returned 4 [0108.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.491] lstrlenW (lpString=".1cd") returned 4 [0108.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 63 [0108.491] lstrlenW (lpString=".jpg") returned 4 [0108.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.491] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") [0108.492] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13994) returned 1 [0108.492] CloseHandle (hObject=0x15c) returned 1 [0108.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 0x20 [0108.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.493] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.493] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.494] GetLastError () returned 0x0 [0108.494] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x36aa, lpOverlapped=0x0) returned 1 [0108.495] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x36b0, lpOverlapped=0x0) returned 1 [0108.496] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.496] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.496] SetEndOfFile (hFile=0x1c8) returned 1 [0108.497] CloseHandle (hObject=0x1c8) returned 1 [0108.497] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.497] SetEndOfFile (hFile=0x15c) returned 1 [0108.498] CloseHandle (hObject=0x15c) returned 1 [0108.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 1 [0108.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.498] lstrlenW (lpString=".doc") returned 4 [0108.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.498] lstrlenW (lpString=".docx") returned 5 [0108.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.498] lstrlenW (lpString=".pdf") returned 4 [0108.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.498] lstrlenW (lpString=".xls") returned 4 [0108.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.498] lstrlenW (lpString=".xlsx") returned 5 [0108.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.498] lstrlenW (lpString=".ppt") returned 4 [0108.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.498] lstrlenW (lpString=".zip") returned 4 [0108.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.498] lstrlenW (lpString=".rar") returned 4 [0108.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".bz2") returned 4 [0108.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".7z") returned 3 [0108.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.499] lstrlenW (lpString=".dbf") returned 4 [0108.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.499] lstrlenW (lpString=".1cd") returned 4 [0108.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.499] lstrlenW (lpString=".jpg") returned 4 [0108.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".pdf") returned 4 [0108.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".xls") returned 4 [0108.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.499] lstrlenW (lpString=".xlsx") returned 5 [0108.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.499] lstrlenW (lpString=".ppt") returned 4 [0108.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.499] lstrlenW (lpString=".zip") returned 4 [0108.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.499] lstrlenW (lpString=".rar") returned 4 [0108.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".bz2") returned 4 [0108.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.499] lstrlenW (lpString=".7z") returned 3 [0108.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.499] lstrlenW (lpString=".dbf") returned 4 [0108.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.500] lstrlenW (lpString=".1cd") returned 4 [0108.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 63 [0108.500] lstrlenW (lpString=".jpg") returned 4 [0108.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.500] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") [0108.501] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13046) returned 1 [0108.501] CloseHandle (hObject=0x15c) returned 1 [0108.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 0x20 [0108.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.501] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.501] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.502] GetLastError () returned 0x0 [0108.502] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x32f6, lpOverlapped=0x0) returned 1 [0108.529] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0108.530] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.530] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.530] SetEndOfFile (hFile=0x1c8) returned 1 [0108.530] CloseHandle (hObject=0x1c8) returned 1 [0108.530] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.531] SetEndOfFile (hFile=0x15c) returned 1 [0108.531] CloseHandle (hObject=0x15c) returned 1 [0108.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 1 [0108.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.532] lstrlenW (lpString=".doc") returned 4 [0108.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.532] lstrlenW (lpString=".docx") returned 5 [0108.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.532] lstrlenW (lpString=".pdf") returned 4 [0108.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.532] lstrlenW (lpString=".xls") returned 4 [0108.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.532] lstrlenW (lpString=".xlsx") returned 5 [0108.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.532] lstrlenW (lpString=".ppt") returned 4 [0108.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.532] lstrlenW (lpString=".zip") returned 4 [0108.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.532] lstrlenW (lpString=".rar") returned 4 [0108.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.532] lstrlenW (lpString=".bz2") returned 4 [0108.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString=".7z") returned 3 [0108.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".dbf") returned 4 [0108.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".1cd") returned 4 [0108.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".jpg") returned 4 [0108.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString=".pdf") returned 4 [0108.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString=".xls") returned 4 [0108.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.533] lstrlenW (lpString=".xlsx") returned 5 [0108.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.533] lstrlenW (lpString=".ppt") returned 4 [0108.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".zip") returned 4 [0108.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.533] lstrlenW (lpString=".rar") returned 4 [0108.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString=".bz2") returned 4 [0108.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString=".7z") returned 3 [0108.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".dbf") returned 4 [0108.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.533] lstrlenW (lpString=".1cd") returned 4 [0108.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 63 [0108.534] lstrlenW (lpString=".jpg") returned 4 [0108.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.534] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") [0108.536] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8230) returned 1 [0108.536] CloseHandle (hObject=0x15c) returned 1 [0108.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 0x20 [0108.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.536] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.536] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.537] GetLastError () returned 0x0 [0108.537] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2026, lpOverlapped=0x0) returned 1 [0108.541] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2030, lpOverlapped=0x0) returned 1 [0108.542] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.542] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.542] SetEndOfFile (hFile=0x1c8) returned 1 [0108.542] CloseHandle (hObject=0x1c8) returned 1 [0108.542] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.542] SetEndOfFile (hFile=0x15c) returned 1 [0108.543] CloseHandle (hObject=0x15c) returned 1 [0108.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 1 [0108.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.543] lstrlenW (lpString=".doc") returned 4 [0108.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.543] lstrlenW (lpString=".docx") returned 5 [0108.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.544] lstrlenW (lpString=".pdf") returned 4 [0108.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString=".xls") returned 4 [0108.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.544] lstrlenW (lpString=".xlsx") returned 5 [0108.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.544] lstrlenW (lpString=".ppt") returned 4 [0108.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.544] lstrlenW (lpString=".zip") returned 4 [0108.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.544] lstrlenW (lpString=".rar") returned 4 [0108.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString=".bz2") returned 4 [0108.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString=".7z") returned 3 [0108.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.544] lstrlenW (lpString=".dbf") returned 4 [0108.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.544] lstrlenW (lpString=".1cd") returned 4 [0108.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.544] lstrlenW (lpString=".jpg") returned 4 [0108.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString=".pdf") returned 4 [0108.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.544] lstrlenW (lpString=".xls") returned 4 [0108.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.544] lstrlenW (lpString=".xlsx") returned 5 [0108.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.545] lstrlenW (lpString=".ppt") returned 4 [0108.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.545] lstrlenW (lpString=".zip") returned 4 [0108.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.545] lstrlenW (lpString=".rar") returned 4 [0108.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.545] lstrlenW (lpString=".bz2") returned 4 [0108.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.545] lstrlenW (lpString=".7z") returned 3 [0108.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.545] lstrlenW (lpString=".dbf") returned 4 [0108.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.545] lstrlenW (lpString=".1cd") returned 4 [0108.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 63 [0108.545] lstrlenW (lpString=".jpg") returned 4 [0108.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.545] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") [0108.546] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13746) returned 1 [0108.546] CloseHandle (hObject=0x15c) returned 1 [0108.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 0x20 [0108.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.546] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.546] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.547] GetLastError () returned 0x0 [0108.547] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x35b2, lpOverlapped=0x0) returned 1 [0108.549] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0108.550] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.550] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.550] SetEndOfFile (hFile=0x1c8) returned 1 [0108.550] CloseHandle (hObject=0x1c8) returned 1 [0108.550] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.550] SetEndOfFile (hFile=0x15c) returned 1 [0108.551] CloseHandle (hObject=0x15c) returned 1 [0108.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 1 [0108.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString=".doc") returned 4 [0108.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString=".docx") returned 5 [0108.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.552] lstrlenW (lpString=".pdf") returned 4 [0108.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString=".xls") returned 4 [0108.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.552] lstrlenW (lpString=".xlsx") returned 5 [0108.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.552] lstrlenW (lpString=".ppt") returned 4 [0108.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString=".zip") returned 4 [0108.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.552] lstrlenW (lpString=".rar") returned 4 [0108.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString=".bz2") returned 4 [0108.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString=".7z") returned 3 [0108.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString=".dbf") returned 4 [0108.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString=".1cd") returned 4 [0108.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.552] lstrlenW (lpString=".jpg") returned 4 [0108.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.552] lstrlenW (lpString=".pdf") returned 4 [0108.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString=".xls") returned 4 [0108.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.553] lstrlenW (lpString=".xlsx") returned 5 [0108.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.553] lstrlenW (lpString=".ppt") returned 4 [0108.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.553] lstrlenW (lpString=".zip") returned 4 [0108.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.553] lstrlenW (lpString=".rar") returned 4 [0108.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString=".bz2") returned 4 [0108.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString=".7z") returned 3 [0108.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.553] lstrlenW (lpString=".dbf") returned 4 [0108.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.553] lstrlenW (lpString=".1cd") returned 4 [0108.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 63 [0108.553] lstrlenW (lpString=".jpg") returned 4 [0108.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.553] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") [0108.554] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15150) returned 1 [0108.555] CloseHandle (hObject=0x15c) returned 1 [0108.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 0x20 [0108.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.555] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.555] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.556] GetLastError () returned 0x0 [0108.556] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0108.557] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0108.558] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.558] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.558] SetEndOfFile (hFile=0x1c8) returned 1 [0108.559] CloseHandle (hObject=0x1c8) returned 1 [0108.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.559] SetEndOfFile (hFile=0x15c) returned 1 [0108.559] CloseHandle (hObject=0x15c) returned 1 [0108.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 1 [0108.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.560] lstrlenW (lpString=".doc") returned 4 [0108.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.560] lstrlenW (lpString=".docx") returned 5 [0108.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.560] lstrlenW (lpString=".pdf") returned 4 [0108.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.560] lstrlenW (lpString=".xls") returned 4 [0108.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.560] lstrlenW (lpString=".xlsx") returned 5 [0108.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.560] lstrlenW (lpString=".ppt") returned 4 [0108.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.560] lstrlenW (lpString=".zip") returned 4 [0108.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.560] lstrlenW (lpString=".rar") returned 4 [0108.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.560] lstrlenW (lpString=".bz2") returned 4 [0108.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString=".7z") returned 3 [0108.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".dbf") returned 4 [0108.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".1cd") returned 4 [0108.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".jpg") returned 4 [0108.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString=".pdf") returned 4 [0108.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString=".xls") returned 4 [0108.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.561] lstrlenW (lpString=".xlsx") returned 5 [0108.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.561] lstrlenW (lpString=".ppt") returned 4 [0108.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".zip") returned 4 [0108.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.561] lstrlenW (lpString=".rar") returned 4 [0108.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString=".bz2") returned 4 [0108.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString=".7z") returned 3 [0108.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".dbf") returned 4 [0108.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.561] lstrlenW (lpString=".1cd") returned 4 [0108.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 63 [0108.562] lstrlenW (lpString=".jpg") returned 4 [0108.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.562] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") [0108.564] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8770) returned 1 [0108.564] CloseHandle (hObject=0x15c) returned 1 [0108.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 0x20 [0108.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.565] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.565] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.565] GetLastError () returned 0x0 [0108.565] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2242, lpOverlapped=0x0) returned 1 [0108.668] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0108.772] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.772] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.772] SetEndOfFile (hFile=0x1c8) returned 1 [0108.772] CloseHandle (hObject=0x1c8) returned 1 [0108.772] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.772] SetEndOfFile (hFile=0x15c) returned 1 [0108.773] CloseHandle (hObject=0x15c) returned 1 [0108.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 1 [0108.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.773] lstrlenW (lpString=".doc") returned 4 [0108.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.773] lstrlenW (lpString=".docx") returned 5 [0108.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.773] lstrlenW (lpString=".pdf") returned 4 [0108.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.773] lstrlenW (lpString=".xls") returned 4 [0108.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.774] lstrlenW (lpString=".xlsx") returned 5 [0108.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.774] lstrlenW (lpString=".ppt") returned 4 [0108.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.774] lstrlenW (lpString=".zip") returned 4 [0108.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.774] lstrlenW (lpString=".rar") returned 4 [0108.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString=".bz2") returned 4 [0108.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString=".7z") returned 3 [0108.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.774] lstrlenW (lpString=".dbf") returned 4 [0108.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.774] lstrlenW (lpString=".1cd") returned 4 [0108.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.774] lstrlenW (lpString=".jpg") returned 4 [0108.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString=".pdf") returned 4 [0108.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString=".xls") returned 4 [0108.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.774] lstrlenW (lpString=".xlsx") returned 5 [0108.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.774] lstrlenW (lpString=".ppt") returned 4 [0108.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.775] lstrlenW (lpString=".zip") returned 4 [0108.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.775] lstrlenW (lpString=".rar") returned 4 [0108.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.775] lstrlenW (lpString=".bz2") returned 4 [0108.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.775] lstrlenW (lpString=".7z") returned 3 [0108.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.775] lstrlenW (lpString=".dbf") returned 4 [0108.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.775] lstrlenW (lpString=".1cd") returned 4 [0108.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 63 [0108.775] lstrlenW (lpString=".jpg") returned 4 [0108.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.775] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") [0108.776] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6472) returned 1 [0108.776] CloseHandle (hObject=0x15c) returned 1 [0108.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 0x20 [0108.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.776] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.776] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.777] GetLastError () returned 0x0 [0108.777] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1948, lpOverlapped=0x0) returned 1 [0108.778] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1950, lpOverlapped=0x0) returned 1 [0108.779] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.779] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.779] SetEndOfFile (hFile=0x1c8) returned 1 [0108.779] CloseHandle (hObject=0x1c8) returned 1 [0108.780] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.780] SetEndOfFile (hFile=0x15c) returned 1 [0108.780] CloseHandle (hObject=0x15c) returned 1 [0108.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 1 [0108.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.781] lstrlenW (lpString=".doc") returned 4 [0108.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString=".docx") returned 5 [0108.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.781] lstrlenW (lpString=".pdf") returned 4 [0108.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString=".xls") returned 4 [0108.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.781] lstrlenW (lpString=".xlsx") returned 5 [0108.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.781] lstrlenW (lpString=".ppt") returned 4 [0108.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.781] lstrlenW (lpString=".zip") returned 4 [0108.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.781] lstrlenW (lpString=".rar") returned 4 [0108.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString=".bz2") returned 4 [0108.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString=".7z") returned 3 [0108.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.781] lstrlenW (lpString=".dbf") returned 4 [0108.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".1cd") returned 4 [0108.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".jpg") returned 4 [0108.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString=".pdf") returned 4 [0108.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString=".xls") returned 4 [0108.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.782] lstrlenW (lpString=".xlsx") returned 5 [0108.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.782] lstrlenW (lpString=".ppt") returned 4 [0108.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".zip") returned 4 [0108.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.782] lstrlenW (lpString=".rar") returned 4 [0108.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString=".bz2") returned 4 [0108.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString=".7z") returned 3 [0108.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".dbf") returned 4 [0108.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".1cd") returned 4 [0108.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 63 [0108.782] lstrlenW (lpString=".jpg") returned 4 [0108.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.782] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") [0108.783] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20970) returned 1 [0108.783] CloseHandle (hObject=0x15c) returned 1 [0108.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 0x20 [0108.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.783] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.783] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.784] GetLastError () returned 0x0 [0108.784] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x51ea, lpOverlapped=0x0) returned 1 [0108.787] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x51f0, lpOverlapped=0x0) returned 1 [0108.788] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.788] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.788] SetEndOfFile (hFile=0x1c8) returned 1 [0108.788] CloseHandle (hObject=0x1c8) returned 1 [0108.789] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.789] SetEndOfFile (hFile=0x15c) returned 1 [0108.790] CloseHandle (hObject=0x15c) returned 1 [0108.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 1 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.790] lstrlenW (lpString=".doc") returned 4 [0108.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.790] lstrlenW (lpString=".docx") returned 5 [0108.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.790] lstrlenW (lpString=".pdf") returned 4 [0108.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.790] lstrlenW (lpString=".xls") returned 4 [0108.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.790] lstrlenW (lpString=".xlsx") returned 5 [0108.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.791] lstrlenW (lpString=".ppt") returned 4 [0108.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.791] lstrlenW (lpString=".zip") returned 4 [0108.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.791] lstrlenW (lpString=".rar") returned 4 [0108.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString=".bz2") returned 4 [0108.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString=".7z") returned 3 [0108.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.791] lstrlenW (lpString=".dbf") returned 4 [0108.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.791] lstrlenW (lpString=".1cd") returned 4 [0108.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.791] lstrlenW (lpString=".jpg") returned 4 [0108.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString=".pdf") returned 4 [0108.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString=".xls") returned 4 [0108.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.791] lstrlenW (lpString=".xlsx") returned 5 [0108.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.791] lstrlenW (lpString=".ppt") returned 4 [0108.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.791] lstrlenW (lpString=".zip") returned 4 [0108.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.791] lstrlenW (lpString=".rar") returned 4 [0108.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.792] lstrlenW (lpString=".bz2") returned 4 [0108.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.792] lstrlenW (lpString=".7z") returned 3 [0108.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.792] lstrlenW (lpString=".dbf") returned 4 [0108.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.792] lstrlenW (lpString=".1cd") returned 4 [0108.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 63 [0108.792] lstrlenW (lpString=".jpg") returned 4 [0108.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.792] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") [0108.793] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13064) returned 1 [0108.793] CloseHandle (hObject=0x15c) returned 1 [0108.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 0x20 [0108.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.793] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.793] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.794] GetLastError () returned 0x0 [0108.794] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3308, lpOverlapped=0x0) returned 1 [0108.795] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3310, lpOverlapped=0x0) returned 1 [0108.796] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.796] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.796] SetEndOfFile (hFile=0x1c8) returned 1 [0108.796] CloseHandle (hObject=0x1c8) returned 1 [0108.797] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.797] SetEndOfFile (hFile=0x15c) returned 1 [0108.797] CloseHandle (hObject=0x15c) returned 1 [0108.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.798] lstrlenW (lpString=".doc") returned 4 [0108.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".docx") returned 5 [0108.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.798] lstrlenW (lpString=".pdf") returned 4 [0108.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".xls") returned 4 [0108.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".xlsx") returned 5 [0108.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.798] lstrlenW (lpString=".ppt") returned 4 [0108.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.798] lstrlenW (lpString=".zip") returned 4 [0108.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".rar") returned 4 [0108.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".bz2") returned 4 [0108.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".7z") returned 3 [0108.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.798] lstrlenW (lpString=".dbf") returned 4 [0108.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".1cd") returned 4 [0108.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".jpg") returned 4 [0108.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString=".pdf") returned 4 [0108.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString=".xls") returned 4 [0108.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.799] lstrlenW (lpString=".xlsx") returned 5 [0108.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.799] lstrlenW (lpString=".ppt") returned 4 [0108.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".zip") returned 4 [0108.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.799] lstrlenW (lpString=".rar") returned 4 [0108.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString=".bz2") returned 4 [0108.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString=".7z") returned 3 [0108.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".dbf") returned 4 [0108.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".1cd") returned 4 [0108.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 63 [0108.799] lstrlenW (lpString=".jpg") returned 4 [0108.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.800] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") [0108.800] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10228) returned 1 [0108.800] CloseHandle (hObject=0x15c) returned 1 [0108.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf")) returned 0x20 [0108.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.800] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.801] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.801] GetLastError () returned 0x0 [0108.801] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x27f4, lpOverlapped=0x0) returned 1 [0108.803] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2800, lpOverlapped=0x0) returned 1 [0108.804] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.804] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.804] SetEndOfFile (hFile=0x1c8) returned 1 [0108.804] CloseHandle (hObject=0x1c8) returned 1 [0108.804] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.804] SetEndOfFile (hFile=0x15c) returned 1 [0108.805] CloseHandle (hObject=0x15c) returned 1 [0108.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf")) returned 1 [0109.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.306] lstrlenW (lpString=".doc") returned 4 [0109.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.306] lstrlenW (lpString=".docx") returned 5 [0109.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.307] lstrlenW (lpString=".pdf") returned 4 [0109.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString=".xls") returned 4 [0109.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.307] lstrlenW (lpString=".xlsx") returned 5 [0109.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.307] lstrlenW (lpString=".ppt") returned 4 [0109.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.307] lstrlenW (lpString=".zip") returned 4 [0109.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.307] lstrlenW (lpString=".rar") returned 4 [0109.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString=".bz2") returned 4 [0109.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString=".7z") returned 3 [0109.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.307] lstrlenW (lpString=".dbf") returned 4 [0109.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.307] lstrlenW (lpString=".1cd") returned 4 [0109.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.307] lstrlenW (lpString=".jpg") returned 4 [0109.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString=".pdf") returned 4 [0109.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.307] lstrlenW (lpString=".xls") returned 4 [0109.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.307] lstrlenW (lpString=".xlsx") returned 5 [0109.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.307] lstrlenW (lpString=".ppt") returned 4 [0109.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.308] lstrlenW (lpString=".zip") returned 4 [0109.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.308] lstrlenW (lpString=".rar") returned 4 [0109.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.308] lstrlenW (lpString=".bz2") returned 4 [0109.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.308] lstrlenW (lpString=".7z") returned 3 [0109.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.308] lstrlenW (lpString=".dbf") returned 4 [0109.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.308] lstrlenW (lpString=".1cd") returned 4 [0109.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 63 [0109.308] lstrlenW (lpString=".jpg") returned 4 [0109.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.308] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") [0109.309] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1412) returned 1 [0109.309] CloseHandle (hObject=0x15c) returned 1 [0109.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf")) returned 0x20 [0109.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.309] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.309] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.310] GetLastError () returned 0x0 [0109.310] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x584, lpOverlapped=0x0) returned 1 [0109.313] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x590, lpOverlapped=0x0) returned 1 [0109.314] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.314] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.314] SetEndOfFile (hFile=0x210) returned 1 [0109.314] CloseHandle (hObject=0x210) returned 1 [0109.314] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.314] SetEndOfFile (hFile=0x15c) returned 1 [0109.315] CloseHandle (hObject=0x15c) returned 1 [0109.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf")) returned 1 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString=".doc") returned 4 [0109.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString=".docx") returned 5 [0109.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.316] lstrlenW (lpString=".pdf") returned 4 [0109.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString=".xls") returned 4 [0109.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.316] lstrlenW (lpString=".xlsx") returned 5 [0109.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.316] lstrlenW (lpString=".ppt") returned 4 [0109.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString=".zip") returned 4 [0109.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.316] lstrlenW (lpString=".rar") returned 4 [0109.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString=".bz2") returned 4 [0109.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString=".7z") returned 3 [0109.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString=".dbf") returned 4 [0109.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString=".1cd") returned 4 [0109.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.316] lstrlenW (lpString=".jpg") returned 4 [0109.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString=".pdf") returned 4 [0109.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString=".xls") returned 4 [0109.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.317] lstrlenW (lpString=".xlsx") returned 5 [0109.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.317] lstrlenW (lpString=".ppt") returned 4 [0109.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.317] lstrlenW (lpString=".zip") returned 4 [0109.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.317] lstrlenW (lpString=".rar") returned 4 [0109.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString=".bz2") returned 4 [0109.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString=".7z") returned 3 [0109.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.317] lstrlenW (lpString=".dbf") returned 4 [0109.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.317] lstrlenW (lpString=".1cd") returned 4 [0109.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 63 [0109.317] lstrlenW (lpString=".jpg") returned 4 [0109.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.317] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") [0109.318] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5714) returned 1 [0109.318] CloseHandle (hObject=0x15c) returned 1 [0109.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf")) returned 0x20 [0109.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.318] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.318] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.319] GetLastError () returned 0x0 [0109.319] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1652, lpOverlapped=0x0) returned 1 [0109.321] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0109.322] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.322] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.322] SetEndOfFile (hFile=0x210) returned 1 [0109.322] CloseHandle (hObject=0x210) returned 1 [0109.322] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.322] SetEndOfFile (hFile=0x15c) returned 1 [0109.323] CloseHandle (hObject=0x15c) returned 1 [0109.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf")) returned 1 [0109.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.323] lstrlenW (lpString=".doc") returned 4 [0109.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.323] lstrlenW (lpString=".docx") returned 5 [0109.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.323] lstrlenW (lpString=".pdf") returned 4 [0109.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString=".xls") returned 4 [0109.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.324] lstrlenW (lpString=".xlsx") returned 5 [0109.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.324] lstrlenW (lpString=".ppt") returned 4 [0109.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.324] lstrlenW (lpString=".zip") returned 4 [0109.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.324] lstrlenW (lpString=".rar") returned 4 [0109.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString=".bz2") returned 4 [0109.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString=".7z") returned 3 [0109.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.324] lstrlenW (lpString=".dbf") returned 4 [0109.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.324] lstrlenW (lpString=".1cd") returned 4 [0109.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.324] lstrlenW (lpString=".jpg") returned 4 [0109.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString=".pdf") returned 4 [0109.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString=".xls") returned 4 [0109.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.324] lstrlenW (lpString=".xlsx") returned 5 [0109.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.324] lstrlenW (lpString=".ppt") returned 4 [0109.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.325] lstrlenW (lpString=".zip") returned 4 [0109.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.325] lstrlenW (lpString=".rar") returned 4 [0109.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.325] lstrlenW (lpString=".bz2") returned 4 [0109.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.325] lstrlenW (lpString=".7z") returned 3 [0109.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.325] lstrlenW (lpString=".dbf") returned 4 [0109.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.325] lstrlenW (lpString=".1cd") returned 4 [0109.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 63 [0109.325] lstrlenW (lpString=".jpg") returned 4 [0109.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.325] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") [0109.326] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5824) returned 1 [0109.326] CloseHandle (hObject=0x15c) returned 1 [0109.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf")) returned 0x20 [0109.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.326] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.326] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.327] GetLastError () returned 0x0 [0109.327] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x16c0, lpOverlapped=0x0) returned 1 [0109.328] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0109.329] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.329] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.329] SetEndOfFile (hFile=0x210) returned 1 [0109.329] CloseHandle (hObject=0x210) returned 1 [0109.329] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.329] SetEndOfFile (hFile=0x15c) returned 1 [0109.330] CloseHandle (hObject=0x15c) returned 1 [0109.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf")) returned 1 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString=".doc") returned 4 [0109.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString=".docx") returned 5 [0109.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.331] lstrlenW (lpString=".pdf") returned 4 [0109.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString=".xls") returned 4 [0109.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.331] lstrlenW (lpString=".xlsx") returned 5 [0109.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.331] lstrlenW (lpString=".ppt") returned 4 [0109.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString=".zip") returned 4 [0109.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.331] lstrlenW (lpString=".rar") returned 4 [0109.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString=".bz2") returned 4 [0109.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString=".7z") returned 3 [0109.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString=".dbf") returned 4 [0109.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString=".1cd") returned 4 [0109.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.331] lstrlenW (lpString=".jpg") returned 4 [0109.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString=".pdf") returned 4 [0109.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString=".xls") returned 4 [0109.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.332] lstrlenW (lpString=".xlsx") returned 5 [0109.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.332] lstrlenW (lpString=".ppt") returned 4 [0109.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.332] lstrlenW (lpString=".zip") returned 4 [0109.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.332] lstrlenW (lpString=".rar") returned 4 [0109.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString=".bz2") returned 4 [0109.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString=".7z") returned 3 [0109.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.332] lstrlenW (lpString=".dbf") returned 4 [0109.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.332] lstrlenW (lpString=".1cd") returned 4 [0109.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 63 [0109.332] lstrlenW (lpString=".jpg") returned 4 [0109.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.332] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") [0109.333] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1488) returned 1 [0109.333] CloseHandle (hObject=0x15c) returned 1 [0109.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf")) returned 0x20 [0109.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.333] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.333] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.334] GetLastError () returned 0x0 [0109.334] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5d0, lpOverlapped=0x0) returned 1 [0109.336] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5e0, lpOverlapped=0x0) returned 1 [0109.337] ReadFile (in: hFile=0x15c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.337] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.337] SetEndOfFile (hFile=0x210) returned 1 [0109.337] CloseHandle (hObject=0x210) returned 1 [0109.337] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.337] SetEndOfFile (hFile=0x15c) returned 1 [0109.340] CloseHandle (hObject=0x15c) returned 1 [0109.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf")) returned 1 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString=".doc") returned 4 [0109.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString=".docx") returned 5 [0109.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.341] lstrlenW (lpString=".pdf") returned 4 [0109.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString=".xls") returned 4 [0109.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.341] lstrlenW (lpString=".xlsx") returned 5 [0109.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.341] lstrlenW (lpString=".ppt") returned 4 [0109.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString=".zip") returned 4 [0109.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.341] lstrlenW (lpString=".rar") returned 4 [0109.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString=".bz2") returned 4 [0109.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString=".7z") returned 3 [0109.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString=".dbf") returned 4 [0109.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString=".1cd") returned 4 [0109.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.341] lstrlenW (lpString=".jpg") returned 4 [0109.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString=".pdf") returned 4 [0109.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString=".xls") returned 4 [0109.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.342] lstrlenW (lpString=".xlsx") returned 5 [0109.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.342] lstrlenW (lpString=".ppt") returned 4 [0109.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.342] lstrlenW (lpString=".zip") returned 4 [0109.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.342] lstrlenW (lpString=".rar") returned 4 [0109.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString=".bz2") returned 4 [0109.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString=".7z") returned 3 [0109.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.342] lstrlenW (lpString=".dbf") returned 4 [0109.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.342] lstrlenW (lpString=".1cd") returned 4 [0109.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 63 [0109.342] lstrlenW (lpString=".jpg") returned 4 [0109.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.342] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") [0109.516] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=25270) returned 1 [0109.516] CloseHandle (hObject=0x22c) returned 1 [0109.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 0x20 [0109.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.517] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.517] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.518] GetLastError () returned 0x0 [0109.518] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x62b6, lpOverlapped=0x0) returned 1 [0109.520] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0109.521] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.521] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.521] SetEndOfFile (hFile=0x180) returned 1 [0109.521] CloseHandle (hObject=0x180) returned 1 [0109.521] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.521] SetEndOfFile (hFile=0x22c) returned 1 [0109.522] CloseHandle (hObject=0x22c) returned 1 [0109.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 1 [0109.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString=".doc") returned 4 [0109.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString=".docx") returned 5 [0109.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.523] lstrlenW (lpString=".pdf") returned 4 [0109.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString=".xls") returned 4 [0109.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.523] lstrlenW (lpString=".xlsx") returned 5 [0109.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.523] lstrlenW (lpString=".ppt") returned 4 [0109.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString=".zip") returned 4 [0109.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.523] lstrlenW (lpString=".rar") returned 4 [0109.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString=".bz2") returned 4 [0109.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString=".7z") returned 3 [0109.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString=".dbf") returned 4 [0109.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString=".1cd") returned 4 [0109.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.523] lstrlenW (lpString=".jpg") returned 4 [0109.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString=".pdf") returned 4 [0109.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString=".xls") returned 4 [0109.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.524] lstrlenW (lpString=".xlsx") returned 5 [0109.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.524] lstrlenW (lpString=".ppt") returned 4 [0109.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.524] lstrlenW (lpString=".zip") returned 4 [0109.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.524] lstrlenW (lpString=".rar") returned 4 [0109.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString=".bz2") returned 4 [0109.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString=".7z") returned 3 [0109.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.524] lstrlenW (lpString=".dbf") returned 4 [0109.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.524] lstrlenW (lpString=".1cd") returned 4 [0109.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 63 [0109.524] lstrlenW (lpString=".jpg") returned 4 [0109.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.524] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") [0109.525] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1632) returned 1 [0109.525] CloseHandle (hObject=0x22c) returned 1 [0109.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf")) returned 0x20 [0109.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.525] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.525] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.526] GetLastError () returned 0x0 [0109.526] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x660, lpOverlapped=0x0) returned 1 [0109.527] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x670, lpOverlapped=0x0) returned 1 [0109.528] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.528] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.528] SetEndOfFile (hFile=0x180) returned 1 [0109.529] CloseHandle (hObject=0x180) returned 1 [0109.529] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.529] SetEndOfFile (hFile=0x22c) returned 1 [0109.529] CloseHandle (hObject=0x22c) returned 1 [0109.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf")) returned 1 [0109.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.530] lstrlenW (lpString=".doc") returned 4 [0109.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.530] lstrlenW (lpString=".docx") returned 5 [0109.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.530] lstrlenW (lpString=".pdf") returned 4 [0109.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.530] lstrlenW (lpString=".xls") returned 4 [0109.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.530] lstrlenW (lpString=".xlsx") returned 5 [0109.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.530] lstrlenW (lpString=".ppt") returned 4 [0109.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.531] lstrlenW (lpString=".zip") returned 4 [0109.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.531] lstrlenW (lpString=".rar") returned 4 [0109.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString=".bz2") returned 4 [0109.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString=".7z") returned 3 [0109.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.531] lstrlenW (lpString=".dbf") returned 4 [0109.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.531] lstrlenW (lpString=".1cd") returned 4 [0109.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.531] lstrlenW (lpString=".jpg") returned 4 [0109.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString=".pdf") returned 4 [0109.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString=".xls") returned 4 [0109.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.531] lstrlenW (lpString=".xlsx") returned 5 [0109.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.531] lstrlenW (lpString=".ppt") returned 4 [0109.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.531] lstrlenW (lpString=".zip") returned 4 [0109.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.531] lstrlenW (lpString=".rar") returned 4 [0109.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.531] lstrlenW (lpString=".bz2") returned 4 [0109.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.532] lstrlenW (lpString=".7z") returned 3 [0109.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.532] lstrlenW (lpString=".dbf") returned 4 [0109.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.532] lstrlenW (lpString=".1cd") returned 4 [0109.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 63 [0109.532] lstrlenW (lpString=".jpg") returned 4 [0109.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.532] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") [0109.532] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1484) returned 1 [0109.533] CloseHandle (hObject=0x22c) returned 1 [0109.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf")) returned 0x20 [0109.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.533] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.533] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.534] GetLastError () returned 0x0 [0109.534] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5cc, lpOverlapped=0x0) returned 1 [0109.615] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0109.616] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.616] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.616] SetEndOfFile (hFile=0x180) returned 1 [0109.758] CloseHandle (hObject=0x180) returned 1 [0109.758] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.758] SetEndOfFile (hFile=0x22c) returned 1 [0109.938] CloseHandle (hObject=0x22c) returned 1 [0109.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf")) returned 1 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.943] lstrlenW (lpString=".doc") returned 4 [0109.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString=".docx") returned 5 [0109.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.943] lstrlenW (lpString=".pdf") returned 4 [0109.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString=".xls") returned 4 [0109.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.943] lstrlenW (lpString=".xlsx") returned 5 [0109.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.943] lstrlenW (lpString=".ppt") returned 4 [0109.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.943] lstrlenW (lpString=".zip") returned 4 [0109.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.943] lstrlenW (lpString=".rar") returned 4 [0109.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString=".bz2") returned 4 [0109.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString=".7z") returned 3 [0109.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.943] lstrlenW (lpString=".dbf") returned 4 [0109.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.943] lstrlenW (lpString=".1cd") returned 4 [0109.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.944] lstrlenW (lpString=".jpg") returned 4 [0109.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString=".pdf") returned 4 [0109.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString=".xls") returned 4 [0109.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.944] lstrlenW (lpString=".xlsx") returned 5 [0109.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.944] lstrlenW (lpString=".ppt") returned 4 [0109.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.944] lstrlenW (lpString=".zip") returned 4 [0109.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.944] lstrlenW (lpString=".rar") returned 4 [0109.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString=".bz2") returned 4 [0109.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString=".7z") returned 3 [0109.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.944] lstrlenW (lpString=".dbf") returned 4 [0109.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.944] lstrlenW (lpString=".1cd") returned 4 [0109.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 63 [0109.945] lstrlenW (lpString=".jpg") returned 4 [0109.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.945] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") [0109.956] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5870) returned 1 [0109.972] CloseHandle (hObject=0x1c0) returned 1 [0109.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf")) returned 0x20 [0109.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0109.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.973] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.337] GetLastError () returned 0x0 [0110.337] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x16ee, lpOverlapped=0x0) returned 1 [0110.339] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0110.340] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.340] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.340] SetEndOfFile (hFile=0x1b8) returned 1 [0110.340] CloseHandle (hObject=0x1b8) returned 1 [0110.340] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.340] SetEndOfFile (hFile=0x1c0) returned 1 [0110.341] CloseHandle (hObject=0x1c0) returned 1 [0110.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf")) returned 1 [0110.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString=".doc") returned 4 [0110.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString=".docx") returned 5 [0110.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.342] lstrlenW (lpString=".pdf") returned 4 [0110.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString=".xls") returned 4 [0110.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.342] lstrlenW (lpString=".xlsx") returned 5 [0110.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.342] lstrlenW (lpString=".ppt") returned 4 [0110.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString=".zip") returned 4 [0110.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.342] lstrlenW (lpString=".rar") returned 4 [0110.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString=".bz2") returned 4 [0110.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString=".7z") returned 3 [0110.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString=".dbf") returned 4 [0110.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString=".1cd") returned 4 [0110.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.342] lstrlenW (lpString=".jpg") returned 4 [0110.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.342] lstrlenW (lpString=".pdf") returned 4 [0110.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString=".xls") returned 4 [0110.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.343] lstrlenW (lpString=".xlsx") returned 5 [0110.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.343] lstrlenW (lpString=".ppt") returned 4 [0110.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.343] lstrlenW (lpString=".zip") returned 4 [0110.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.343] lstrlenW (lpString=".rar") returned 4 [0110.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString=".bz2") returned 4 [0110.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString=".7z") returned 3 [0110.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.343] lstrlenW (lpString=".dbf") returned 4 [0110.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.343] lstrlenW (lpString=".1cd") returned 4 [0110.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 63 [0110.343] lstrlenW (lpString=".jpg") returned 4 [0110.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.343] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") [0110.344] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10414) returned 1 [0110.344] CloseHandle (hObject=0x1c0) returned 1 [0110.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf")) returned 0x20 [0110.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.344] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.344] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.345] GetLastError () returned 0x0 [0110.345] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x28ae, lpOverlapped=0x0) returned 1 [0110.346] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x28b0, lpOverlapped=0x0) returned 1 [0110.347] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.347] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.347] SetEndOfFile (hFile=0x1b8) returned 1 [0110.348] CloseHandle (hObject=0x1b8) returned 1 [0110.348] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.348] SetEndOfFile (hFile=0x1c0) returned 1 [0110.348] CloseHandle (hObject=0x1c0) returned 1 [0110.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf")) returned 1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.349] lstrlenW (lpString=".doc") returned 4 [0110.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.349] lstrlenW (lpString=".docx") returned 5 [0110.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.349] lstrlenW (lpString=".pdf") returned 4 [0110.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.349] lstrlenW (lpString=".xls") returned 4 [0110.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.349] lstrlenW (lpString=".xlsx") returned 5 [0110.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.349] lstrlenW (lpString=".ppt") returned 4 [0110.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.349] lstrlenW (lpString=".zip") returned 4 [0110.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.350] lstrlenW (lpString=".rar") returned 4 [0110.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".bz2") returned 4 [0110.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".7z") returned 3 [0110.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.350] lstrlenW (lpString=".dbf") returned 4 [0110.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.350] lstrlenW (lpString=".1cd") returned 4 [0110.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.350] lstrlenW (lpString=".jpg") returned 4 [0110.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".pdf") returned 4 [0110.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".xls") returned 4 [0110.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.350] lstrlenW (lpString=".xlsx") returned 5 [0110.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.350] lstrlenW (lpString=".ppt") returned 4 [0110.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.350] lstrlenW (lpString=".zip") returned 4 [0110.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.350] lstrlenW (lpString=".rar") returned 4 [0110.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".bz2") returned 4 [0110.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.350] lstrlenW (lpString=".7z") returned 3 [0110.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.351] lstrlenW (lpString=".dbf") returned 4 [0110.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.351] lstrlenW (lpString=".1cd") returned 4 [0110.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 63 [0110.351] lstrlenW (lpString=".jpg") returned 4 [0110.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.351] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") [0110.351] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=14042) returned 1 [0110.351] CloseHandle (hObject=0x1c0) returned 1 [0110.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf")) returned 0x20 [0110.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.352] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.352] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.353] GetLastError () returned 0x0 [0110.353] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x36da, lpOverlapped=0x0) returned 1 [0110.354] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0110.355] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.355] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.355] SetEndOfFile (hFile=0x1b8) returned 1 [0110.355] CloseHandle (hObject=0x1b8) returned 1 [0110.355] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.356] SetEndOfFile (hFile=0x1c0) returned 1 [0110.356] CloseHandle (hObject=0x1c0) returned 1 [0110.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf")) returned 1 [0110.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.357] lstrlenW (lpString=".doc") returned 4 [0110.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString=".docx") returned 5 [0110.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.357] lstrlenW (lpString=".pdf") returned 4 [0110.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString=".xls") returned 4 [0110.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.357] lstrlenW (lpString=".xlsx") returned 5 [0110.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.357] lstrlenW (lpString=".ppt") returned 4 [0110.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.357] lstrlenW (lpString=".zip") returned 4 [0110.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.357] lstrlenW (lpString=".rar") returned 4 [0110.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString=".bz2") returned 4 [0110.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString=".7z") returned 3 [0110.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.357] lstrlenW (lpString=".dbf") returned 4 [0110.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".1cd") returned 4 [0110.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".jpg") returned 4 [0110.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString=".pdf") returned 4 [0110.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString=".xls") returned 4 [0110.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.358] lstrlenW (lpString=".xlsx") returned 5 [0110.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.358] lstrlenW (lpString=".ppt") returned 4 [0110.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".zip") returned 4 [0110.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.358] lstrlenW (lpString=".rar") returned 4 [0110.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString=".bz2") returned 4 [0110.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString=".7z") returned 3 [0110.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".dbf") returned 4 [0110.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".1cd") returned 4 [0110.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 63 [0110.358] lstrlenW (lpString=".jpg") returned 4 [0110.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.359] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") [0110.360] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16360) returned 1 [0110.360] CloseHandle (hObject=0x1c0) returned 1 [0110.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf")) returned 0x20 [0110.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.360] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.360] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.361] GetLastError () returned 0x0 [0110.361] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3fe8, lpOverlapped=0x0) returned 1 [0110.365] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3ff0, lpOverlapped=0x0) returned 1 [0110.366] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.366] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.366] SetEndOfFile (hFile=0x1b8) returned 1 [0110.366] CloseHandle (hObject=0x1b8) returned 1 [0110.367] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.367] SetEndOfFile (hFile=0x1c0) returned 1 [0110.367] CloseHandle (hObject=0x1c0) returned 1 [0110.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf")) returned 1 [0110.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.368] lstrlenW (lpString=".doc") returned 4 [0110.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.368] lstrlenW (lpString=".docx") returned 5 [0110.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.368] lstrlenW (lpString=".pdf") returned 4 [0110.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.368] lstrlenW (lpString=".xls") returned 4 [0110.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.368] lstrlenW (lpString=".xlsx") returned 5 [0110.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.368] lstrlenW (lpString=".ppt") returned 4 [0110.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.368] lstrlenW (lpString=".zip") returned 4 [0110.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.368] lstrlenW (lpString=".rar") returned 4 [0110.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.368] lstrlenW (lpString=".bz2") returned 4 [0110.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.368] lstrlenW (lpString=".7z") returned 3 [0110.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".dbf") returned 4 [0110.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".1cd") returned 4 [0110.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".jpg") returned 4 [0110.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString=".pdf") returned 4 [0110.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString=".xls") returned 4 [0110.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.369] lstrlenW (lpString=".xlsx") returned 5 [0110.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.369] lstrlenW (lpString=".ppt") returned 4 [0110.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".zip") returned 4 [0110.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.369] lstrlenW (lpString=".rar") returned 4 [0110.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString=".bz2") returned 4 [0110.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString=".7z") returned 3 [0110.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".dbf") returned 4 [0110.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.369] lstrlenW (lpString=".1cd") returned 4 [0110.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 63 [0110.370] lstrlenW (lpString=".jpg") returned 4 [0110.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.370] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") [0110.370] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6296) returned 1 [0110.370] CloseHandle (hObject=0x1c0) returned 1 [0110.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf")) returned 0x20 [0110.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.371] GetLastError () returned 0x0 [0110.372] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1898, lpOverlapped=0x0) returned 1 [0110.375] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x18a0, lpOverlapped=0x0) returned 1 [0110.376] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.376] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.376] SetEndOfFile (hFile=0x1b8) returned 1 [0110.376] CloseHandle (hObject=0x1b8) returned 1 [0110.376] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.376] SetEndOfFile (hFile=0x1c0) returned 1 [0110.377] CloseHandle (hObject=0x1c0) returned 1 [0110.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf")) returned 1 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.378] lstrlenW (lpString=".doc") returned 4 [0110.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString=".docx") returned 5 [0110.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.378] lstrlenW (lpString=".pdf") returned 4 [0110.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString=".xls") returned 4 [0110.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.378] lstrlenW (lpString=".xlsx") returned 5 [0110.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.378] lstrlenW (lpString=".ppt") returned 4 [0110.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.378] lstrlenW (lpString=".zip") returned 4 [0110.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.378] lstrlenW (lpString=".rar") returned 4 [0110.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString=".bz2") returned 4 [0110.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString=".7z") returned 3 [0110.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.378] lstrlenW (lpString=".dbf") returned 4 [0110.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.378] lstrlenW (lpString=".1cd") returned 4 [0110.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.379] lstrlenW (lpString=".jpg") returned 4 [0110.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString=".pdf") returned 4 [0110.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString=".xls") returned 4 [0110.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.379] lstrlenW (lpString=".xlsx") returned 5 [0110.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.379] lstrlenW (lpString=".ppt") returned 4 [0110.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.379] lstrlenW (lpString=".zip") returned 4 [0110.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.379] lstrlenW (lpString=".rar") returned 4 [0110.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString=".bz2") returned 4 [0110.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString=".7z") returned 3 [0110.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.379] lstrlenW (lpString=".dbf") returned 4 [0110.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.379] lstrlenW (lpString=".1cd") returned 4 [0110.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 63 [0110.379] lstrlenW (lpString=".jpg") returned 4 [0110.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.379] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") [0110.382] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10744) returned 1 [0110.382] CloseHandle (hObject=0x1c0) returned 1 [0110.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf")) returned 0x20 [0110.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.382] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.383] GetLastError () returned 0x0 [0110.383] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x29f8, lpOverlapped=0x0) returned 1 [0110.385] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2a00, lpOverlapped=0x0) returned 1 [0110.386] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.386] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.386] SetEndOfFile (hFile=0x1b8) returned 1 [0110.386] CloseHandle (hObject=0x1b8) returned 1 [0110.386] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.386] SetEndOfFile (hFile=0x1c0) returned 1 [0110.387] CloseHandle (hObject=0x1c0) returned 1 [0110.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf")) returned 1 [0110.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.387] lstrlenW (lpString=".doc") returned 4 [0110.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.387] lstrlenW (lpString=".docx") returned 5 [0110.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.387] lstrlenW (lpString=".pdf") returned 4 [0110.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString=".xls") returned 4 [0110.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.388] lstrlenW (lpString=".xlsx") returned 5 [0110.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.388] lstrlenW (lpString=".ppt") returned 4 [0110.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.388] lstrlenW (lpString=".zip") returned 4 [0110.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.388] lstrlenW (lpString=".rar") returned 4 [0110.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString=".bz2") returned 4 [0110.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString=".7z") returned 3 [0110.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.388] lstrlenW (lpString=".dbf") returned 4 [0110.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.388] lstrlenW (lpString=".1cd") returned 4 [0110.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.388] lstrlenW (lpString=".jpg") returned 4 [0110.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString=".pdf") returned 4 [0110.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.388] lstrlenW (lpString=".xls") returned 4 [0110.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.388] lstrlenW (lpString=".xlsx") returned 5 [0110.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.388] lstrlenW (lpString=".ppt") returned 4 [0110.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.389] lstrlenW (lpString=".zip") returned 4 [0110.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.389] lstrlenW (lpString=".rar") returned 4 [0110.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.389] lstrlenW (lpString=".bz2") returned 4 [0110.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.389] lstrlenW (lpString=".7z") returned 3 [0110.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.389] lstrlenW (lpString=".dbf") returned 4 [0110.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.389] lstrlenW (lpString=".1cd") returned 4 [0110.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 63 [0110.389] lstrlenW (lpString=".jpg") returned 4 [0110.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.389] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") [0110.390] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10420) returned 1 [0110.390] CloseHandle (hObject=0x1c0) returned 1 [0110.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf")) returned 0x20 [0110.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.391] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.391] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.391] GetLastError () returned 0x0 [0110.391] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x28b4, lpOverlapped=0x0) returned 1 [0110.393] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x28c0, lpOverlapped=0x0) returned 1 [0110.394] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.394] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.394] SetEndOfFile (hFile=0x1b8) returned 1 [0110.394] CloseHandle (hObject=0x1b8) returned 1 [0110.394] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.394] SetEndOfFile (hFile=0x1c0) returned 1 [0110.395] CloseHandle (hObject=0x1c0) returned 1 [0110.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf")) returned 1 [0110.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.396] lstrlenW (lpString=".doc") returned 4 [0110.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.396] lstrlenW (lpString=".docx") returned 5 [0110.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.396] lstrlenW (lpString=".pdf") returned 4 [0110.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.396] lstrlenW (lpString=".xls") returned 4 [0110.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.396] lstrlenW (lpString=".xlsx") returned 5 [0110.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.396] lstrlenW (lpString=".ppt") returned 4 [0110.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.396] lstrlenW (lpString=".zip") returned 4 [0110.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.396] lstrlenW (lpString=".rar") returned 4 [0110.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.396] lstrlenW (lpString=".bz2") returned 4 [0110.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.396] lstrlenW (lpString=".7z") returned 3 [0110.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.397] lstrlenW (lpString=".dbf") returned 4 [0110.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.397] lstrlenW (lpString=".1cd") returned 4 [0110.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.397] lstrlenW (lpString=".jpg") returned 4 [0110.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString=".pdf") returned 4 [0110.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString=".xls") returned 4 [0110.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.397] lstrlenW (lpString=".xlsx") returned 5 [0110.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.397] lstrlenW (lpString=".ppt") returned 4 [0110.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.397] lstrlenW (lpString=".zip") returned 4 [0110.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.397] lstrlenW (lpString=".rar") returned 4 [0110.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString=".bz2") returned 4 [0110.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.397] lstrlenW (lpString=".7z") returned 3 [0110.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.398] lstrlenW (lpString=".dbf") returned 4 [0110.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.398] lstrlenW (lpString=".1cd") returned 4 [0110.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 63 [0110.398] lstrlenW (lpString=".jpg") returned 4 [0110.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.398] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") [0110.399] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6924) returned 1 [0110.399] CloseHandle (hObject=0x1c0) returned 1 [0110.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf")) returned 0x20 [0110.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.399] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.399] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.400] GetLastError () returned 0x0 [0110.400] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1b0c, lpOverlapped=0x0) returned 1 [0110.401] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0110.402] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.402] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.403] SetEndOfFile (hFile=0x1b8) returned 1 [0110.403] CloseHandle (hObject=0x1b8) returned 1 [0110.403] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.403] SetEndOfFile (hFile=0x1c0) returned 1 [0110.404] CloseHandle (hObject=0x1c0) returned 1 [0110.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf")) returned 1 [0110.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.404] lstrlenW (lpString=".doc") returned 4 [0110.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.404] lstrlenW (lpString=".docx") returned 5 [0110.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.404] lstrlenW (lpString=".pdf") returned 4 [0110.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.404] lstrlenW (lpString=".xls") returned 4 [0110.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.404] lstrlenW (lpString=".xlsx") returned 5 [0110.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.404] lstrlenW (lpString=".ppt") returned 4 [0110.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.404] lstrlenW (lpString=".zip") returned 4 [0110.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.405] lstrlenW (lpString=".rar") returned 4 [0110.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".bz2") returned 4 [0110.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".7z") returned 3 [0110.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.405] lstrlenW (lpString=".dbf") returned 4 [0110.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.405] lstrlenW (lpString=".1cd") returned 4 [0110.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.405] lstrlenW (lpString=".jpg") returned 4 [0110.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".pdf") returned 4 [0110.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".xls") returned 4 [0110.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.405] lstrlenW (lpString=".xlsx") returned 5 [0110.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.405] lstrlenW (lpString=".ppt") returned 4 [0110.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.405] lstrlenW (lpString=".zip") returned 4 [0110.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.405] lstrlenW (lpString=".rar") returned 4 [0110.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".bz2") returned 4 [0110.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.405] lstrlenW (lpString=".7z") returned 3 [0110.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.406] lstrlenW (lpString=".dbf") returned 4 [0110.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.406] lstrlenW (lpString=".1cd") returned 4 [0110.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 63 [0110.406] lstrlenW (lpString=".jpg") returned 4 [0110.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.406] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") [0110.406] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7160) returned 1 [0110.407] CloseHandle (hObject=0x1c0) returned 1 [0110.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf")) returned 0x20 [0110.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.408] GetLastError () returned 0x0 [0110.408] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1bf8, lpOverlapped=0x0) returned 1 [0110.409] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0110.410] ReadFile (in: hFile=0x1c0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.410] WriteFile (in: hFile=0x1b8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.410] SetEndOfFile (hFile=0x1b8) returned 1 [0110.410] CloseHandle (hObject=0x1b8) returned 1 [0110.410] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.410] SetEndOfFile (hFile=0x1c0) returned 1 [0110.411] CloseHandle (hObject=0x1c0) returned 1 [0110.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf")) returned 1 [0110.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.433] lstrlenW (lpString=".doc") returned 4 [0110.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.433] lstrlenW (lpString=".docx") returned 5 [0110.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.433] lstrlenW (lpString=".pdf") returned 4 [0110.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString=".xls") returned 4 [0110.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.434] lstrlenW (lpString=".xlsx") returned 5 [0110.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.434] lstrlenW (lpString=".ppt") returned 4 [0110.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.434] lstrlenW (lpString=".zip") returned 4 [0110.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.434] lstrlenW (lpString=".rar") returned 4 [0110.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString=".bz2") returned 4 [0110.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString=".7z") returned 3 [0110.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.434] lstrlenW (lpString=".dbf") returned 4 [0110.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.434] lstrlenW (lpString=".1cd") returned 4 [0110.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.434] lstrlenW (lpString=".jpg") returned 4 [0110.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString=".pdf") returned 4 [0110.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.434] lstrlenW (lpString=".xls") returned 4 [0110.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.434] lstrlenW (lpString=".xlsx") returned 5 [0110.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.434] lstrlenW (lpString=".ppt") returned 4 [0110.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.435] lstrlenW (lpString=".zip") returned 4 [0110.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.435] lstrlenW (lpString=".rar") returned 4 [0110.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.435] lstrlenW (lpString=".bz2") returned 4 [0110.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.435] lstrlenW (lpString=".7z") returned 3 [0110.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.435] lstrlenW (lpString=".dbf") returned 4 [0110.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.435] lstrlenW (lpString=".1cd") returned 4 [0110.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 63 [0110.435] lstrlenW (lpString=".jpg") returned 4 [0110.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.435] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") [0110.750] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10564) returned 1 [0110.750] CloseHandle (hObject=0x210) returned 1 [0110.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf")) returned 0x20 [0110.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.751] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.751] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.752] GetLastError () returned 0x0 [0110.752] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2944, lpOverlapped=0x0) returned 1 [0110.753] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0110.754] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.754] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.755] SetEndOfFile (hFile=0x1a0) returned 1 [0110.755] CloseHandle (hObject=0x1a0) returned 1 [0110.755] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.755] SetEndOfFile (hFile=0x210) returned 1 [0110.756] CloseHandle (hObject=0x210) returned 1 [0110.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf")) returned 1 [0110.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.756] lstrlenW (lpString=".doc") returned 4 [0110.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.756] lstrlenW (lpString=".docx") returned 5 [0110.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.756] lstrlenW (lpString=".pdf") returned 4 [0110.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.756] lstrlenW (lpString=".xls") returned 4 [0110.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.756] lstrlenW (lpString=".xlsx") returned 5 [0110.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.756] lstrlenW (lpString=".ppt") returned 4 [0110.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.757] lstrlenW (lpString=".zip") returned 4 [0110.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.757] lstrlenW (lpString=".rar") returned 4 [0110.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString=".bz2") returned 4 [0110.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString=".7z") returned 3 [0110.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.757] lstrlenW (lpString=".dbf") returned 4 [0110.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.757] lstrlenW (lpString=".1cd") returned 4 [0110.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.757] lstrlenW (lpString=".jpg") returned 4 [0110.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString=".pdf") returned 4 [0110.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString=".xls") returned 4 [0110.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.757] lstrlenW (lpString=".xlsx") returned 5 [0110.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.757] lstrlenW (lpString=".ppt") returned 4 [0110.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.757] lstrlenW (lpString=".zip") returned 4 [0110.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.757] lstrlenW (lpString=".rar") returned 4 [0110.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.758] lstrlenW (lpString=".bz2") returned 4 [0110.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.758] lstrlenW (lpString=".7z") returned 3 [0110.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.758] lstrlenW (lpString=".dbf") returned 4 [0110.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.758] lstrlenW (lpString=".1cd") returned 4 [0110.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 63 [0110.758] lstrlenW (lpString=".jpg") returned 4 [0110.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.758] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") [0110.759] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=44570) returned 1 [0110.759] CloseHandle (hObject=0x210) returned 1 [0110.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf")) returned 0x20 [0110.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.759] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.759] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.760] GetLastError () returned 0x0 [0110.760] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xae1a, lpOverlapped=0x0) returned 1 [0110.762] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xae20, lpOverlapped=0x0) returned 1 [0110.763] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.763] SetEndOfFile (hFile=0x1a0) returned 1 [0110.763] CloseHandle (hObject=0x1a0) returned 1 [0110.764] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.764] SetEndOfFile (hFile=0x210) returned 1 [0110.766] CloseHandle (hObject=0x210) returned 1 [0110.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf")) returned 1 [0110.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.767] lstrlenW (lpString=".doc") returned 4 [0110.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.767] lstrlenW (lpString=".docx") returned 5 [0110.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.767] lstrlenW (lpString=".pdf") returned 4 [0110.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.767] lstrlenW (lpString=".xls") returned 4 [0110.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.767] lstrlenW (lpString=".xlsx") returned 5 [0110.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.767] lstrlenW (lpString=".ppt") returned 4 [0110.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.767] lstrlenW (lpString=".zip") returned 4 [0110.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.767] lstrlenW (lpString=".rar") returned 4 [0110.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.767] lstrlenW (lpString=".bz2") returned 4 [0110.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.767] lstrlenW (lpString=".7z") returned 3 [0110.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".dbf") returned 4 [0110.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".1cd") returned 4 [0110.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".jpg") returned 4 [0110.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".pdf") returned 4 [0110.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".xls") returned 4 [0110.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.768] lstrlenW (lpString=".xlsx") returned 5 [0110.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.768] lstrlenW (lpString=".ppt") returned 4 [0110.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".zip") returned 4 [0110.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.768] lstrlenW (lpString=".rar") returned 4 [0110.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".bz2") returned 4 [0110.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".7z") returned 3 [0110.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".dbf") returned 4 [0110.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.768] lstrlenW (lpString=".1cd") returned 4 [0110.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 63 [0110.769] lstrlenW (lpString=".jpg") returned 4 [0110.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.769] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") [0110.769] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=23352) returned 1 [0110.769] CloseHandle (hObject=0x210) returned 1 [0110.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf")) returned 0x20 [0110.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.770] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.770] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.770] GetLastError () returned 0x0 [0110.770] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x5b38, lpOverlapped=0x0) returned 1 [0110.778] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5b40, lpOverlapped=0x0) returned 1 [0110.779] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.779] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.780] SetEndOfFile (hFile=0x1a0) returned 1 [0110.780] CloseHandle (hObject=0x1a0) returned 1 [0110.780] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.780] SetEndOfFile (hFile=0x210) returned 1 [0110.781] CloseHandle (hObject=0x210) returned 1 [0110.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf")) returned 1 [0110.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.781] lstrlenW (lpString=".doc") returned 4 [0110.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.781] lstrlenW (lpString=".docx") returned 5 [0110.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.781] lstrlenW (lpString=".pdf") returned 4 [0110.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.781] lstrlenW (lpString=".xls") returned 4 [0110.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.781] lstrlenW (lpString=".xlsx") returned 5 [0110.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.781] lstrlenW (lpString=".ppt") returned 4 [0110.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.782] lstrlenW (lpString=".zip") returned 4 [0110.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.782] lstrlenW (lpString=".rar") returned 4 [0110.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString=".bz2") returned 4 [0110.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString=".7z") returned 3 [0110.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.782] lstrlenW (lpString=".dbf") returned 4 [0110.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.782] lstrlenW (lpString=".1cd") returned 4 [0110.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.782] lstrlenW (lpString=".jpg") returned 4 [0110.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString=".pdf") returned 4 [0110.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString=".xls") returned 4 [0110.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.782] lstrlenW (lpString=".xlsx") returned 5 [0110.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.782] lstrlenW (lpString=".ppt") returned 4 [0110.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.782] lstrlenW (lpString=".zip") returned 4 [0110.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.782] lstrlenW (lpString=".rar") returned 4 [0110.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.782] lstrlenW (lpString=".bz2") returned 4 [0110.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.783] lstrlenW (lpString=".7z") returned 3 [0110.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.783] lstrlenW (lpString=".dbf") returned 4 [0110.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.783] lstrlenW (lpString=".1cd") returned 4 [0110.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 63 [0110.783] lstrlenW (lpString=".jpg") returned 4 [0110.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.783] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") [0110.784] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=67422) returned 1 [0110.784] CloseHandle (hObject=0x210) returned 1 [0110.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf")) returned 0x20 [0110.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.785] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.785] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.786] GetLastError () returned 0x0 [0110.786] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1075e, lpOverlapped=0x0) returned 1 [0110.808] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x10760, lpOverlapped=0x0) returned 1 [0110.810] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.810] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.810] SetEndOfFile (hFile=0x1a0) returned 1 [0110.810] CloseHandle (hObject=0x1a0) returned 1 [0110.810] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.810] SetEndOfFile (hFile=0x210) returned 1 [0110.812] CloseHandle (hObject=0x210) returned 1 [0110.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf")) returned 1 [0110.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.812] lstrlenW (lpString=".doc") returned 4 [0110.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.812] lstrlenW (lpString=".docx") returned 5 [0110.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.812] lstrlenW (lpString=".pdf") returned 4 [0110.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.812] lstrlenW (lpString=".xls") returned 4 [0110.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.812] lstrlenW (lpString=".xlsx") returned 5 [0110.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.812] lstrlenW (lpString=".ppt") returned 4 [0110.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.812] lstrlenW (lpString=".zip") returned 4 [0110.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.813] lstrlenW (lpString=".rar") returned 4 [0110.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".bz2") returned 4 [0110.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".7z") returned 3 [0110.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.813] lstrlenW (lpString=".dbf") returned 4 [0110.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.813] lstrlenW (lpString=".1cd") returned 4 [0110.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.813] lstrlenW (lpString=".jpg") returned 4 [0110.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".pdf") returned 4 [0110.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".xls") returned 4 [0110.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.813] lstrlenW (lpString=".xlsx") returned 5 [0110.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.813] lstrlenW (lpString=".ppt") returned 4 [0110.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.813] lstrlenW (lpString=".zip") returned 4 [0110.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.813] lstrlenW (lpString=".rar") returned 4 [0110.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".bz2") returned 4 [0110.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.813] lstrlenW (lpString=".7z") returned 3 [0110.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.814] lstrlenW (lpString=".dbf") returned 4 [0110.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.814] lstrlenW (lpString=".1cd") returned 4 [0110.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 63 [0110.814] lstrlenW (lpString=".jpg") returned 4 [0110.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.814] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") [0110.814] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=30154) returned 1 [0110.815] CloseHandle (hObject=0x210) returned 1 [0110.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf")) returned 0x20 [0110.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.817] GetLastError () returned 0x0 [0110.817] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x75ca, lpOverlapped=0x0) returned 1 [0110.827] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x75d0, lpOverlapped=0x0) returned 1 [0110.829] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.829] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.829] SetEndOfFile (hFile=0x1a0) returned 1 [0110.829] CloseHandle (hObject=0x1a0) returned 1 [0110.829] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.829] SetEndOfFile (hFile=0x210) returned 1 [0110.830] CloseHandle (hObject=0x210) returned 1 [0110.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf")) returned 1 [0110.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.830] lstrlenW (lpString=".doc") returned 4 [0110.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.830] lstrlenW (lpString=".docx") returned 5 [0110.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.830] lstrlenW (lpString=".pdf") returned 4 [0110.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString=".xls") returned 4 [0110.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.831] lstrlenW (lpString=".xlsx") returned 5 [0110.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.831] lstrlenW (lpString=".ppt") returned 4 [0110.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.831] lstrlenW (lpString=".zip") returned 4 [0110.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.831] lstrlenW (lpString=".rar") returned 4 [0110.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString=".bz2") returned 4 [0110.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString=".7z") returned 3 [0110.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.831] lstrlenW (lpString=".dbf") returned 4 [0110.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.831] lstrlenW (lpString=".1cd") returned 4 [0110.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.831] lstrlenW (lpString=".jpg") returned 4 [0110.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString=".pdf") returned 4 [0110.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString=".xls") returned 4 [0110.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.831] lstrlenW (lpString=".xlsx") returned 5 [0110.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.831] lstrlenW (lpString=".ppt") returned 4 [0110.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.832] lstrlenW (lpString=".zip") returned 4 [0110.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.832] lstrlenW (lpString=".rar") returned 4 [0110.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.832] lstrlenW (lpString=".bz2") returned 4 [0110.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.832] lstrlenW (lpString=".7z") returned 3 [0110.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.832] lstrlenW (lpString=".dbf") returned 4 [0110.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.832] lstrlenW (lpString=".1cd") returned 4 [0110.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 63 [0110.832] lstrlenW (lpString=".jpg") returned 4 [0110.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.832] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") [0110.833] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=21680) returned 1 [0110.833] CloseHandle (hObject=0x210) returned 1 [0110.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf")) returned 0x20 [0110.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.833] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.833] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.834] GetLastError () returned 0x0 [0110.834] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x54b0, lpOverlapped=0x0) returned 1 [0110.903] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x54c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x54c0, lpOverlapped=0x0) returned 1 [0110.904] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.904] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.904] SetEndOfFile (hFile=0x1a0) returned 1 [0110.964] CloseHandle (hObject=0x1a0) returned 1 [0110.964] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.964] SetEndOfFile (hFile=0x210) returned 1 [0110.965] CloseHandle (hObject=0x210) returned 1 [0110.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf")) returned 1 [0110.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.965] lstrlenW (lpString=".doc") returned 4 [0110.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.966] lstrlenW (lpString=".docx") returned 5 [0110.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.966] lstrlenW (lpString=".pdf") returned 4 [0110.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.966] lstrlenW (lpString=".xls") returned 4 [0110.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.966] lstrlenW (lpString=".xlsx") returned 5 [0110.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.966] lstrlenW (lpString=".ppt") returned 4 [0110.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.966] lstrlenW (lpString=".zip") returned 4 [0110.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.966] lstrlenW (lpString=".rar") returned 4 [0110.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.966] lstrlenW (lpString=".bz2") returned 4 [0110.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.966] lstrlenW (lpString=".7z") returned 3 [0110.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.966] lstrlenW (lpString=".dbf") returned 4 [0110.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.989] lstrlenW (lpString=".1cd") returned 4 [0110.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.989] lstrlenW (lpString=".jpg") returned 4 [0110.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString=".pdf") returned 4 [0110.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString=".xls") returned 4 [0110.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.990] lstrlenW (lpString=".xlsx") returned 5 [0110.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.990] lstrlenW (lpString=".ppt") returned 4 [0110.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.990] lstrlenW (lpString=".zip") returned 4 [0110.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.990] lstrlenW (lpString=".rar") returned 4 [0110.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString=".bz2") returned 4 [0110.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString=".7z") returned 3 [0110.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.990] lstrlenW (lpString=".dbf") returned 4 [0110.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.990] lstrlenW (lpString=".1cd") returned 4 [0110.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 63 [0110.990] lstrlenW (lpString=".jpg") returned 4 [0110.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.990] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") [0110.991] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4232) returned 1 [0110.991] CloseHandle (hObject=0x180) returned 1 [0110.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf")) returned 0x20 [0110.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.991] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.991] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.992] GetLastError () returned 0x0 [0110.992] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1088, lpOverlapped=0x0) returned 1 [0110.993] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0110.994] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.994] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.994] SetEndOfFile (hFile=0x1c8) returned 1 [0110.995] CloseHandle (hObject=0x1c8) returned 1 [0110.995] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.995] SetEndOfFile (hFile=0x180) returned 1 [0110.998] CloseHandle (hObject=0x180) returned 1 [0110.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf")) returned 1 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0110.999] lstrlenW (lpString=".doc") returned 4 [0110.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString=".docx") returned 5 [0110.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.999] lstrlenW (lpString=".pdf") returned 4 [0110.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString=".xls") returned 4 [0110.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.999] lstrlenW (lpString=".xlsx") returned 5 [0110.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.999] lstrlenW (lpString=".ppt") returned 4 [0110.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0110.999] lstrlenW (lpString=".zip") returned 4 [0110.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.999] lstrlenW (lpString=".rar") returned 4 [0110.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString=".bz2") returned 4 [0110.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString=".7z") returned 3 [0110.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0110.999] lstrlenW (lpString=".dbf") returned 4 [0110.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0110.999] lstrlenW (lpString=".1cd") returned 4 [0110.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0111.000] lstrlenW (lpString=".jpg") returned 4 [0111.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString=".pdf") returned 4 [0111.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString=".xls") returned 4 [0111.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.000] lstrlenW (lpString=".xlsx") returned 5 [0111.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.000] lstrlenW (lpString=".ppt") returned 4 [0111.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0111.000] lstrlenW (lpString=".zip") returned 4 [0111.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.000] lstrlenW (lpString=".rar") returned 4 [0111.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString=".bz2") returned 4 [0111.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString=".7z") returned 3 [0111.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0111.000] lstrlenW (lpString=".dbf") returned 4 [0111.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0111.000] lstrlenW (lpString=".1cd") returned 4 [0111.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 63 [0111.000] lstrlenW (lpString=".jpg") returned 4 [0111.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.000] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") [0111.001] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1400) returned 1 [0111.001] CloseHandle (hObject=0x180) returned 1 [0111.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf")) returned 0x20 [0111.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.001] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.001] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.002] GetLastError () returned 0x0 [0111.002] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x578, lpOverlapped=0x0) returned 1 [0111.003] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x580, lpOverlapped=0x0) returned 1 [0111.005] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.005] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.005] SetEndOfFile (hFile=0x1c8) returned 1 [0111.005] CloseHandle (hObject=0x1c8) returned 1 [0111.005] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.005] SetEndOfFile (hFile=0x180) returned 1 [0111.006] CloseHandle (hObject=0x180) returned 1 [0111.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf")) returned 1 [0111.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.006] lstrlenW (lpString=".doc") returned 4 [0111.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".docx") returned 5 [0111.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.007] lstrlenW (lpString=".pdf") returned 4 [0111.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".xls") returned 4 [0111.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.007] lstrlenW (lpString=".xlsx") returned 5 [0111.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.007] lstrlenW (lpString=".ppt") returned 4 [0111.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.007] lstrlenW (lpString=".zip") returned 4 [0111.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.007] lstrlenW (lpString=".rar") returned 4 [0111.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".bz2") returned 4 [0111.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".7z") returned 3 [0111.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.007] lstrlenW (lpString=".dbf") returned 4 [0111.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.007] lstrlenW (lpString=".1cd") returned 4 [0111.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.007] lstrlenW (lpString=".jpg") returned 4 [0111.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".pdf") returned 4 [0111.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.007] lstrlenW (lpString=".xls") returned 4 [0111.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.008] lstrlenW (lpString=".xlsx") returned 5 [0111.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.008] lstrlenW (lpString=".ppt") returned 4 [0111.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.008] lstrlenW (lpString=".zip") returned 4 [0111.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.008] lstrlenW (lpString=".rar") returned 4 [0111.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.008] lstrlenW (lpString=".bz2") returned 4 [0111.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.008] lstrlenW (lpString=".7z") returned 3 [0111.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.008] lstrlenW (lpString=".dbf") returned 4 [0111.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.008] lstrlenW (lpString=".1cd") returned 4 [0111.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 63 [0111.008] lstrlenW (lpString=".jpg") returned 4 [0111.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.008] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") [0111.009] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12422) returned 1 [0111.009] CloseHandle (hObject=0x180) returned 1 [0111.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf")) returned 0x20 [0111.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.010] GetLastError () returned 0x0 [0111.011] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3086, lpOverlapped=0x0) returned 1 [0111.013] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3090, lpOverlapped=0x0) returned 1 [0111.018] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.018] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.018] SetEndOfFile (hFile=0x1c8) returned 1 [0111.018] CloseHandle (hObject=0x1c8) returned 1 [0111.018] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.018] SetEndOfFile (hFile=0x180) returned 1 [0111.019] CloseHandle (hObject=0x180) returned 1 [0111.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf")) returned 1 [0111.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.020] lstrlenW (lpString=".doc") returned 4 [0111.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.020] lstrlenW (lpString=".docx") returned 5 [0111.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.020] lstrlenW (lpString=".pdf") returned 4 [0111.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.020] lstrlenW (lpString=".xls") returned 4 [0111.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.020] lstrlenW (lpString=".xlsx") returned 5 [0111.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.020] lstrlenW (lpString=".ppt") returned 4 [0111.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.020] lstrlenW (lpString=".zip") returned 4 [0111.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.020] lstrlenW (lpString=".rar") returned 4 [0111.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.125] lstrlenW (lpString=".bz2") returned 4 [0111.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString=".7z") returned 3 [0111.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.139] lstrlenW (lpString=".dbf") returned 4 [0111.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.139] lstrlenW (lpString=".1cd") returned 4 [0111.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.139] lstrlenW (lpString=".jpg") returned 4 [0111.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString=".pdf") returned 4 [0111.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString=".xls") returned 4 [0111.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.139] lstrlenW (lpString=".xlsx") returned 5 [0111.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.139] lstrlenW (lpString=".ppt") returned 4 [0111.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.139] lstrlenW (lpString=".zip") returned 4 [0111.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.139] lstrlenW (lpString=".rar") returned 4 [0111.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.140] lstrlenW (lpString=".bz2") returned 4 [0111.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.140] lstrlenW (lpString=".7z") returned 3 [0111.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.140] lstrlenW (lpString=".dbf") returned 4 [0111.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.140] lstrlenW (lpString=".1cd") returned 4 [0111.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 63 [0111.140] lstrlenW (lpString=".jpg") returned 4 [0111.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.140] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") [0111.154] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3720) returned 1 [0111.154] CloseHandle (hObject=0x210) returned 1 [0111.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf")) returned 0x20 [0111.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.154] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.155] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.155] GetLastError () returned 0x0 [0111.155] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xe88, lpOverlapped=0x0) returned 1 [0111.160] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0111.161] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.161] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.161] SetEndOfFile (hFile=0x1a0) returned 1 [0111.161] CloseHandle (hObject=0x1a0) returned 1 [0111.161] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.161] SetEndOfFile (hFile=0x210) returned 1 [0111.162] CloseHandle (hObject=0x210) returned 1 [0111.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf")) returned 1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.163] lstrlenW (lpString=".doc") returned 4 [0111.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString=".docx") returned 5 [0111.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.163] lstrlenW (lpString=".pdf") returned 4 [0111.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString=".xls") returned 4 [0111.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.163] lstrlenW (lpString=".xlsx") returned 5 [0111.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.163] lstrlenW (lpString=".ppt") returned 4 [0111.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.163] lstrlenW (lpString=".zip") returned 4 [0111.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.163] lstrlenW (lpString=".rar") returned 4 [0111.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString=".bz2") returned 4 [0111.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString=".7z") returned 3 [0111.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.163] lstrlenW (lpString=".dbf") returned 4 [0111.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.163] lstrlenW (lpString=".1cd") returned 4 [0111.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.164] lstrlenW (lpString=".jpg") returned 4 [0111.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString=".pdf") returned 4 [0111.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString=".xls") returned 4 [0111.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.164] lstrlenW (lpString=".xlsx") returned 5 [0111.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.164] lstrlenW (lpString=".ppt") returned 4 [0111.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.164] lstrlenW (lpString=".zip") returned 4 [0111.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.164] lstrlenW (lpString=".rar") returned 4 [0111.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString=".bz2") returned 4 [0111.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString=".7z") returned 3 [0111.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.164] lstrlenW (lpString=".dbf") returned 4 [0111.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.164] lstrlenW (lpString=".1cd") returned 4 [0111.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 63 [0111.164] lstrlenW (lpString=".jpg") returned 4 [0111.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.164] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") [0111.193] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2072) returned 1 [0111.193] CloseHandle (hObject=0x180) returned 1 [0111.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf")) returned 0x20 [0111.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.193] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.193] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.194] GetLastError () returned 0x0 [0111.194] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x818, lpOverlapped=0x0) returned 1 [0111.195] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x820, lpOverlapped=0x0) returned 1 [0111.196] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.196] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.196] SetEndOfFile (hFile=0x1c8) returned 1 [0111.196] CloseHandle (hObject=0x1c8) returned 1 [0111.199] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.199] SetEndOfFile (hFile=0x180) returned 1 [0111.200] CloseHandle (hObject=0x180) returned 1 [0111.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf")) returned 1 [0111.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString=".doc") returned 4 [0111.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString=".docx") returned 5 [0111.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.201] lstrlenW (lpString=".pdf") returned 4 [0111.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString=".xls") returned 4 [0111.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.201] lstrlenW (lpString=".xlsx") returned 5 [0111.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.201] lstrlenW (lpString=".ppt") returned 4 [0111.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString=".zip") returned 4 [0111.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.201] lstrlenW (lpString=".rar") returned 4 [0111.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString=".bz2") returned 4 [0111.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString=".7z") returned 3 [0111.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString=".dbf") returned 4 [0111.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString=".1cd") returned 4 [0111.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.201] lstrlenW (lpString=".jpg") returned 4 [0111.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString=".pdf") returned 4 [0111.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString=".xls") returned 4 [0111.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.202] lstrlenW (lpString=".xlsx") returned 5 [0111.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.202] lstrlenW (lpString=".ppt") returned 4 [0111.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.202] lstrlenW (lpString=".zip") returned 4 [0111.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.202] lstrlenW (lpString=".rar") returned 4 [0111.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString=".bz2") returned 4 [0111.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString=".7z") returned 3 [0111.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.202] lstrlenW (lpString=".dbf") returned 4 [0111.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.202] lstrlenW (lpString=".1cd") returned 4 [0111.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 63 [0111.202] lstrlenW (lpString=".jpg") returned 4 [0111.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.202] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") [0111.203] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2800) returned 1 [0111.203] CloseHandle (hObject=0x180) returned 1 [0111.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf")) returned 0x20 [0111.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.203] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.204] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.204] GetLastError () returned 0x0 [0111.204] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xaf0, lpOverlapped=0x0) returned 1 [0111.251] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xb00, lpOverlapped=0x0) returned 1 [0111.252] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.252] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.252] SetEndOfFile (hFile=0x1c8) returned 1 [0111.253] CloseHandle (hObject=0x1c8) returned 1 [0111.253] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.253] SetEndOfFile (hFile=0x180) returned 1 [0111.253] CloseHandle (hObject=0x180) returned 1 [0111.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf")) returned 1 [0111.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.254] lstrlenW (lpString=".doc") returned 4 [0111.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.254] lstrlenW (lpString=".docx") returned 5 [0111.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.254] lstrlenW (lpString=".pdf") returned 4 [0111.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.254] lstrlenW (lpString=".xls") returned 4 [0111.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.254] lstrlenW (lpString=".xlsx") returned 5 [0111.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.255] lstrlenW (lpString=".ppt") returned 4 [0111.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.255] lstrlenW (lpString=".zip") returned 4 [0111.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.255] lstrlenW (lpString=".rar") returned 4 [0111.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString=".bz2") returned 4 [0111.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString=".7z") returned 3 [0111.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.255] lstrlenW (lpString=".dbf") returned 4 [0111.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.255] lstrlenW (lpString=".1cd") returned 4 [0111.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.255] lstrlenW (lpString=".jpg") returned 4 [0111.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString=".pdf") returned 4 [0111.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.255] lstrlenW (lpString=".xls") returned 4 [0111.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.255] lstrlenW (lpString=".xlsx") returned 5 [0111.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.256] lstrlenW (lpString=".ppt") returned 4 [0111.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.256] lstrlenW (lpString=".zip") returned 4 [0111.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.256] lstrlenW (lpString=".rar") returned 4 [0111.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.256] lstrlenW (lpString=".bz2") returned 4 [0111.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.256] lstrlenW (lpString=".7z") returned 3 [0111.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.256] lstrlenW (lpString=".dbf") returned 4 [0111.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.256] lstrlenW (lpString=".1cd") returned 4 [0111.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 63 [0111.256] lstrlenW (lpString=".jpg") returned 4 [0111.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.256] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") [0111.306] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=96796) returned 1 [0111.306] CloseHandle (hObject=0x180) returned 1 [0111.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf")) returned 0x20 [0111.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.307] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.307] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.308] GetLastError () returned 0x0 [0111.308] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x17a1c, lpOverlapped=0x0) returned 1 [0111.374] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x17a20, lpOverlapped=0x0) returned 1 [0111.377] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.377] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.377] SetEndOfFile (hFile=0x1c8) returned 1 [0111.377] CloseHandle (hObject=0x1c8) returned 1 [0111.378] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.378] SetEndOfFile (hFile=0x180) returned 1 [0111.379] CloseHandle (hObject=0x180) returned 1 [0111.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf")) returned 1 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString=".doc") returned 4 [0111.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString=".docx") returned 5 [0111.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.380] lstrlenW (lpString=".pdf") returned 4 [0111.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString=".xls") returned 4 [0111.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.380] lstrlenW (lpString=".xlsx") returned 5 [0111.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.380] lstrlenW (lpString=".ppt") returned 4 [0111.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString=".zip") returned 4 [0111.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.380] lstrlenW (lpString=".rar") returned 4 [0111.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString=".bz2") returned 4 [0111.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString=".7z") returned 3 [0111.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString=".dbf") returned 4 [0111.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString=".1cd") returned 4 [0111.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.380] lstrlenW (lpString=".jpg") returned 4 [0111.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString=".pdf") returned 4 [0111.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString=".xls") returned 4 [0111.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.381] lstrlenW (lpString=".xlsx") returned 5 [0111.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.381] lstrlenW (lpString=".ppt") returned 4 [0111.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.381] lstrlenW (lpString=".zip") returned 4 [0111.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.381] lstrlenW (lpString=".rar") returned 4 [0111.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString=".bz2") returned 4 [0111.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString=".7z") returned 3 [0111.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.381] lstrlenW (lpString=".dbf") returned 4 [0111.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.381] lstrlenW (lpString=".1cd") returned 4 [0111.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 63 [0111.381] lstrlenW (lpString=".jpg") returned 4 [0111.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.381] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") [0111.382] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6740) returned 1 [0111.382] CloseHandle (hObject=0x180) returned 1 [0111.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf")) returned 0x20 [0111.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.382] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.383] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.383] GetLastError () returned 0x0 [0111.383] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1a54, lpOverlapped=0x0) returned 1 [0111.399] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0111.405] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.405] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.405] SetEndOfFile (hFile=0x1c8) returned 1 [0111.406] CloseHandle (hObject=0x1c8) returned 1 [0111.406] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.406] SetEndOfFile (hFile=0x180) returned 1 [0111.406] CloseHandle (hObject=0x180) returned 1 [0111.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf")) returned 1 [0111.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.407] lstrlenW (lpString=".doc") returned 4 [0111.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.407] lstrlenW (lpString=".docx") returned 5 [0111.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.407] lstrlenW (lpString=".pdf") returned 4 [0111.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.407] lstrlenW (lpString=".xls") returned 4 [0111.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.407] lstrlenW (lpString=".xlsx") returned 5 [0111.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.407] lstrlenW (lpString=".ppt") returned 4 [0111.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.407] lstrlenW (lpString=".zip") returned 4 [0111.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.407] lstrlenW (lpString=".rar") returned 4 [0111.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.407] lstrlenW (lpString=".bz2") returned 4 [0111.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString=".7z") returned 3 [0111.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.408] lstrlenW (lpString=".dbf") returned 4 [0111.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.408] lstrlenW (lpString=".1cd") returned 4 [0111.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.408] lstrlenW (lpString=".jpg") returned 4 [0111.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString=".pdf") returned 4 [0111.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString=".xls") returned 4 [0111.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.408] lstrlenW (lpString=".xlsx") returned 5 [0111.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.408] lstrlenW (lpString=".ppt") returned 4 [0111.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.408] lstrlenW (lpString=".zip") returned 4 [0111.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.408] lstrlenW (lpString=".rar") returned 4 [0111.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString=".bz2") returned 4 [0111.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.408] lstrlenW (lpString=".7z") returned 3 [0111.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.408] lstrlenW (lpString=".dbf") returned 4 [0111.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.409] lstrlenW (lpString=".1cd") returned 4 [0111.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 63 [0111.409] lstrlenW (lpString=".jpg") returned 4 [0111.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.409] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") [0111.410] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1396) returned 1 [0111.410] CloseHandle (hObject=0x180) returned 1 [0111.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf")) returned 0x20 [0111.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.411] GetLastError () returned 0x0 [0111.411] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x574, lpOverlapped=0x0) returned 1 [0111.612] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x580, lpOverlapped=0x0) returned 1 [0111.613] ReadFile (in: hFile=0x180, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.613] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.613] SetEndOfFile (hFile=0x1c8) returned 1 [0112.195] CloseHandle (hObject=0x1c8) returned 1 [0112.195] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.195] SetEndOfFile (hFile=0x180) returned 1 [0112.202] CloseHandle (hObject=0x180) returned 1 [0112.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf")) returned 1 [0112.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.443] lstrlenW (lpString=".doc") returned 4 [0112.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".docx") returned 5 [0112.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.444] lstrlenW (lpString=".pdf") returned 4 [0112.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".xls") returned 4 [0112.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.444] lstrlenW (lpString=".xlsx") returned 5 [0112.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.444] lstrlenW (lpString=".ppt") returned 4 [0112.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.444] lstrlenW (lpString=".zip") returned 4 [0112.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.444] lstrlenW (lpString=".rar") returned 4 [0112.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".bz2") returned 4 [0112.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".7z") returned 3 [0112.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.444] lstrlenW (lpString=".dbf") returned 4 [0112.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.444] lstrlenW (lpString=".1cd") returned 4 [0112.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.444] lstrlenW (lpString=".jpg") returned 4 [0112.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".pdf") returned 4 [0112.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.444] lstrlenW (lpString=".xls") returned 4 [0112.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.445] lstrlenW (lpString=".xlsx") returned 5 [0112.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.445] lstrlenW (lpString=".ppt") returned 4 [0112.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.445] lstrlenW (lpString=".zip") returned 4 [0112.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.445] lstrlenW (lpString=".rar") returned 4 [0112.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.445] lstrlenW (lpString=".bz2") returned 4 [0112.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.445] lstrlenW (lpString=".7z") returned 3 [0112.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.445] lstrlenW (lpString=".dbf") returned 4 [0112.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.445] lstrlenW (lpString=".1cd") returned 4 [0112.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 63 [0112.445] lstrlenW (lpString=".jpg") returned 4 [0112.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.445] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") [0112.714] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=75310) returned 1 [0112.714] CloseHandle (hObject=0x158) returned 1 [0112.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf")) returned 0x20 [0112.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.714] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.714] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.715] GetLastError () returned 0x0 [0112.715] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1262e, lpOverlapped=0x0) returned 1 [0112.719] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x12630, lpOverlapped=0x0) returned 1 [0112.721] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.721] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.721] SetEndOfFile (hFile=0x210) returned 1 [0112.721] CloseHandle (hObject=0x210) returned 1 [0112.721] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.721] SetEndOfFile (hFile=0x158) returned 1 [0112.731] CloseHandle (hObject=0x158) returned 1 [0112.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf")) returned 1 [0112.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.731] lstrlenW (lpString=".doc") returned 4 [0112.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.731] lstrlenW (lpString=".docx") returned 5 [0112.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.731] lstrlenW (lpString=".pdf") returned 4 [0112.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.731] lstrlenW (lpString=".xls") returned 4 [0112.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.731] lstrlenW (lpString=".xlsx") returned 5 [0112.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.732] lstrlenW (lpString=".ppt") returned 4 [0112.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.732] lstrlenW (lpString=".zip") returned 4 [0112.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.732] lstrlenW (lpString=".rar") returned 4 [0112.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString=".bz2") returned 4 [0112.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString=".7z") returned 3 [0112.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.732] lstrlenW (lpString=".dbf") returned 4 [0112.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.732] lstrlenW (lpString=".1cd") returned 4 [0112.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.732] lstrlenW (lpString=".jpg") returned 4 [0112.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString=".pdf") returned 4 [0112.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString=".xls") returned 4 [0112.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.732] lstrlenW (lpString=".xlsx") returned 5 [0112.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.732] lstrlenW (lpString=".ppt") returned 4 [0112.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.732] lstrlenW (lpString=".zip") returned 4 [0112.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.732] lstrlenW (lpString=".rar") returned 4 [0112.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.733] lstrlenW (lpString=".bz2") returned 4 [0112.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.733] lstrlenW (lpString=".7z") returned 3 [0112.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.733] lstrlenW (lpString=".dbf") returned 4 [0112.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.733] lstrlenW (lpString=".1cd") returned 4 [0112.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 63 [0112.733] lstrlenW (lpString=".jpg") returned 4 [0112.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.733] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") [0112.736] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=38522) returned 1 [0112.736] CloseHandle (hObject=0x158) returned 1 [0112.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf")) returned 0x20 [0112.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.736] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.736] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.738] GetLastError () returned 0x0 [0112.738] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x967a, lpOverlapped=0x0) returned 1 [0112.740] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9680, lpOverlapped=0x0) returned 1 [0112.741] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.741] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.741] SetEndOfFile (hFile=0x210) returned 1 [0112.742] CloseHandle (hObject=0x210) returned 1 [0112.742] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.742] SetEndOfFile (hFile=0x158) returned 1 [0112.743] CloseHandle (hObject=0x158) returned 1 [0112.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf")) returned 1 [0112.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.743] lstrlenW (lpString=".doc") returned 4 [0112.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.743] lstrlenW (lpString=".docx") returned 5 [0112.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.743] lstrlenW (lpString=".pdf") returned 4 [0112.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.743] lstrlenW (lpString=".xls") returned 4 [0112.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.743] lstrlenW (lpString=".xlsx") returned 5 [0112.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.744] lstrlenW (lpString=".ppt") returned 4 [0112.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.744] lstrlenW (lpString=".zip") returned 4 [0112.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.744] lstrlenW (lpString=".rar") returned 4 [0112.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString=".bz2") returned 4 [0112.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString=".7z") returned 3 [0112.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.744] lstrlenW (lpString=".dbf") returned 4 [0112.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.744] lstrlenW (lpString=".1cd") returned 4 [0112.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.744] lstrlenW (lpString=".jpg") returned 4 [0112.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString=".pdf") returned 4 [0112.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString=".xls") returned 4 [0112.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.744] lstrlenW (lpString=".xlsx") returned 5 [0112.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.744] lstrlenW (lpString=".ppt") returned 4 [0112.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.744] lstrlenW (lpString=".zip") returned 4 [0112.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.745] lstrlenW (lpString=".rar") returned 4 [0112.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.745] lstrlenW (lpString=".bz2") returned 4 [0112.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.745] lstrlenW (lpString=".7z") returned 3 [0112.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.745] lstrlenW (lpString=".dbf") returned 4 [0112.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.745] lstrlenW (lpString=".1cd") returned 4 [0112.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 63 [0112.745] lstrlenW (lpString=".jpg") returned 4 [0112.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.745] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") [0112.746] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8948) returned 1 [0112.746] CloseHandle (hObject=0x158) returned 1 [0112.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf")) returned 0x20 [0112.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.747] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.747] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.748] GetLastError () returned 0x0 [0112.748] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x22f4, lpOverlapped=0x0) returned 1 [0112.811] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2300, lpOverlapped=0x0) returned 1 [0112.812] ReadFile (in: hFile=0x158, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.812] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.812] SetEndOfFile (hFile=0x210) returned 1 [0112.849] CloseHandle (hObject=0x210) returned 1 [0112.849] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.849] SetEndOfFile (hFile=0x158) returned 1 [0112.850] CloseHandle (hObject=0x158) returned 1 [0112.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf")) returned 1 [0112.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.938] lstrlenW (lpString=".doc") returned 4 [0112.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.938] lstrlenW (lpString=".docx") returned 5 [0112.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.943] lstrlenW (lpString=".pdf") returned 4 [0112.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.946] lstrlenW (lpString=".xls") returned 4 [0112.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.946] lstrlenW (lpString=".xlsx") returned 5 [0112.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.946] lstrlenW (lpString=".ppt") returned 4 [0112.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.946] lstrlenW (lpString=".zip") returned 4 [0112.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.953] lstrlenW (lpString=".rar") returned 4 [0112.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString=".bz2") returned 4 [0112.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString=".7z") returned 3 [0112.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.961] lstrlenW (lpString=".dbf") returned 4 [0112.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.961] lstrlenW (lpString=".1cd") returned 4 [0112.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.961] lstrlenW (lpString=".jpg") returned 4 [0112.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString=".pdf") returned 4 [0112.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.961] lstrlenW (lpString=".xls") returned 4 [0112.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.961] lstrlenW (lpString=".xlsx") returned 5 [0112.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.961] lstrlenW (lpString=".ppt") returned 4 [0112.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.962] lstrlenW (lpString=".zip") returned 4 [0112.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.962] lstrlenW (lpString=".rar") returned 4 [0112.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.962] lstrlenW (lpString=".bz2") returned 4 [0112.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.962] lstrlenW (lpString=".7z") returned 3 [0112.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.962] lstrlenW (lpString=".dbf") returned 4 [0112.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.962] lstrlenW (lpString=".1cd") returned 4 [0112.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 63 [0112.962] lstrlenW (lpString=".jpg") returned 4 [0112.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.962] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") [0112.963] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1930) returned 1 [0112.963] CloseHandle (hObject=0x1c8) returned 1 [0112.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf")) returned 0x20 [0112.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0112.963] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.964] GetLastError () returned 0x0 [0112.964] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x78a, lpOverlapped=0x0) returned 1 [0112.965] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x790, lpOverlapped=0x0) returned 1 [0112.966] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.966] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.966] SetEndOfFile (hFile=0x1c0) returned 1 [0112.966] CloseHandle (hObject=0x1c0) returned 1 [0112.966] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.966] SetEndOfFile (hFile=0x1c8) returned 1 [0112.967] CloseHandle (hObject=0x1c8) returned 1 [0112.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf")) returned 1 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString=".doc") returned 4 [0112.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString=".docx") returned 5 [0112.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.968] lstrlenW (lpString=".pdf") returned 4 [0112.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString=".xls") returned 4 [0112.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.968] lstrlenW (lpString=".xlsx") returned 5 [0112.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.968] lstrlenW (lpString=".ppt") returned 4 [0112.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString=".zip") returned 4 [0112.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.968] lstrlenW (lpString=".rar") returned 4 [0112.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString=".bz2") returned 4 [0112.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString=".7z") returned 3 [0112.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString=".dbf") returned 4 [0112.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString=".1cd") returned 4 [0112.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.968] lstrlenW (lpString=".jpg") returned 4 [0112.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.968] lstrlenW (lpString=".pdf") returned 4 [0112.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString=".xls") returned 4 [0112.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.969] lstrlenW (lpString=".xlsx") returned 5 [0112.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.969] lstrlenW (lpString=".ppt") returned 4 [0112.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.969] lstrlenW (lpString=".zip") returned 4 [0112.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.969] lstrlenW (lpString=".rar") returned 4 [0112.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString=".bz2") returned 4 [0112.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString=".7z") returned 3 [0112.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.969] lstrlenW (lpString=".dbf") returned 4 [0112.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.969] lstrlenW (lpString=".1cd") returned 4 [0112.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 63 [0112.969] lstrlenW (lpString=".jpg") returned 4 [0112.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.969] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") [0112.971] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=806) returned 1 [0112.971] CloseHandle (hObject=0x1c8) returned 1 [0112.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf")) returned 0x20 [0112.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0112.971] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.971] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.972] GetLastError () returned 0x0 [0112.972] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x326, lpOverlapped=0x0) returned 1 [0112.973] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x330, lpOverlapped=0x0) returned 1 [0112.974] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.974] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.974] SetEndOfFile (hFile=0x1c0) returned 1 [0112.974] CloseHandle (hObject=0x1c0) returned 1 [0112.974] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.974] SetEndOfFile (hFile=0x1c8) returned 1 [0112.977] CloseHandle (hObject=0x1c8) returned 1 [0112.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf")) returned 1 [0112.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.977] lstrlenW (lpString=".doc") returned 4 [0112.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.977] lstrlenW (lpString=".docx") returned 5 [0112.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.977] lstrlenW (lpString=".pdf") returned 4 [0112.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.977] lstrlenW (lpString=".xls") returned 4 [0112.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.978] lstrlenW (lpString=".xlsx") returned 5 [0112.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.978] lstrlenW (lpString=".ppt") returned 4 [0112.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.978] lstrlenW (lpString=".zip") returned 4 [0112.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.978] lstrlenW (lpString=".rar") returned 4 [0112.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString=".bz2") returned 4 [0112.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString=".7z") returned 3 [0112.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.978] lstrlenW (lpString=".dbf") returned 4 [0112.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.978] lstrlenW (lpString=".1cd") returned 4 [0112.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.978] lstrlenW (lpString=".jpg") returned 4 [0112.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString=".pdf") returned 4 [0112.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString=".xls") returned 4 [0112.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.978] lstrlenW (lpString=".xlsx") returned 5 [0112.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.978] lstrlenW (lpString=".ppt") returned 4 [0112.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.979] lstrlenW (lpString=".zip") returned 4 [0112.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.979] lstrlenW (lpString=".rar") returned 4 [0112.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.979] lstrlenW (lpString=".bz2") returned 4 [0112.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.979] lstrlenW (lpString=".7z") returned 3 [0112.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.979] lstrlenW (lpString=".dbf") returned 4 [0112.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.979] lstrlenW (lpString=".1cd") returned 4 [0112.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 63 [0112.979] lstrlenW (lpString=".jpg") returned 4 [0112.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.979] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") [0112.980] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1136) returned 1 [0112.980] CloseHandle (hObject=0x1c8) returned 1 [0112.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf")) returned 0x20 [0112.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0112.980] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.980] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.981] GetLastError () returned 0x0 [0112.981] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x470, lpOverlapped=0x0) returned 1 [0112.982] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x480, lpOverlapped=0x0) returned 1 [0112.983] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.983] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.983] SetEndOfFile (hFile=0x1c0) returned 1 [0112.983] CloseHandle (hObject=0x1c0) returned 1 [0112.983] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.983] SetEndOfFile (hFile=0x1c8) returned 1 [0112.984] CloseHandle (hObject=0x1c8) returned 1 [0112.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf")) returned 1 [0112.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.985] lstrlenW (lpString=".doc") returned 4 [0112.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString=".docx") returned 5 [0112.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.985] lstrlenW (lpString=".pdf") returned 4 [0112.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString=".xls") returned 4 [0112.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.985] lstrlenW (lpString=".xlsx") returned 5 [0112.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.985] lstrlenW (lpString=".ppt") returned 4 [0112.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.985] lstrlenW (lpString=".zip") returned 4 [0112.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.985] lstrlenW (lpString=".rar") returned 4 [0112.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString=".bz2") returned 4 [0112.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString=".7z") returned 3 [0112.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.985] lstrlenW (lpString=".dbf") returned 4 [0112.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.985] lstrlenW (lpString=".1cd") returned 4 [0112.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.986] lstrlenW (lpString=".jpg") returned 4 [0112.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString=".pdf") returned 4 [0112.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString=".xls") returned 4 [0112.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.986] lstrlenW (lpString=".xlsx") returned 5 [0112.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.986] lstrlenW (lpString=".ppt") returned 4 [0112.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.986] lstrlenW (lpString=".zip") returned 4 [0112.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.986] lstrlenW (lpString=".rar") returned 4 [0112.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString=".bz2") returned 4 [0112.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString=".7z") returned 3 [0112.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.986] lstrlenW (lpString=".dbf") returned 4 [0112.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.987] lstrlenW (lpString=".1cd") returned 4 [0112.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 63 [0112.987] lstrlenW (lpString=".jpg") returned 4 [0112.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.987] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") [0112.987] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5060) returned 1 [0112.987] CloseHandle (hObject=0x1c8) returned 1 [0112.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf")) returned 0x20 [0112.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0112.988] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.988] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.988] GetLastError () returned 0x0 [0112.988] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13c4, lpOverlapped=0x0) returned 1 [0112.990] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0112.991] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.991] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.991] SetEndOfFile (hFile=0x1c0) returned 1 [0112.991] CloseHandle (hObject=0x1c0) returned 1 [0112.991] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.991] SetEndOfFile (hFile=0x1c8) returned 1 [0112.992] CloseHandle (hObject=0x1c8) returned 1 [0112.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf")) returned 1 [0112.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.992] lstrlenW (lpString=".doc") returned 4 [0112.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.992] lstrlenW (lpString=".docx") returned 5 [0112.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.992] lstrlenW (lpString=".pdf") returned 4 [0112.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.992] lstrlenW (lpString=".xls") returned 4 [0112.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.992] lstrlenW (lpString=".xlsx") returned 5 [0112.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.992] lstrlenW (lpString=".ppt") returned 4 [0112.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.993] lstrlenW (lpString=".zip") returned 4 [0112.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.993] lstrlenW (lpString=".rar") returned 4 [0112.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString=".bz2") returned 4 [0112.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString=".7z") returned 3 [0112.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.993] lstrlenW (lpString=".dbf") returned 4 [0112.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.993] lstrlenW (lpString=".1cd") returned 4 [0112.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.993] lstrlenW (lpString=".jpg") returned 4 [0112.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString=".pdf") returned 4 [0112.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString=".xls") returned 4 [0112.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.993] lstrlenW (lpString=".xlsx") returned 5 [0112.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.993] lstrlenW (lpString=".ppt") returned 4 [0112.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.993] lstrlenW (lpString=".zip") returned 4 [0112.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.993] lstrlenW (lpString=".rar") returned 4 [0112.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.994] lstrlenW (lpString=".bz2") returned 4 [0112.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.994] lstrlenW (lpString=".7z") returned 3 [0112.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.994] lstrlenW (lpString=".dbf") returned 4 [0112.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.994] lstrlenW (lpString=".1cd") returned 4 [0112.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 63 [0112.994] lstrlenW (lpString=".jpg") returned 4 [0112.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.994] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") [0113.373] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3304) returned 1 [0113.373] CloseHandle (hObject=0x1a0) returned 1 [0113.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf")) returned 0x20 [0113.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.374] GetLastError () returned 0x0 [0113.374] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xce8, lpOverlapped=0x0) returned 1 [0113.376] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0113.377] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.377] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.377] SetEndOfFile (hFile=0x180) returned 1 [0113.377] CloseHandle (hObject=0x180) returned 1 [0113.377] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.377] SetEndOfFile (hFile=0x1a0) returned 1 [0113.378] CloseHandle (hObject=0x1a0) returned 1 [0113.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf")) returned 1 [0113.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.378] lstrlenW (lpString=".doc") returned 4 [0113.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.378] lstrlenW (lpString=".docx") returned 5 [0113.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.378] lstrlenW (lpString=".pdf") returned 4 [0113.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString=".xls") returned 4 [0113.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.379] lstrlenW (lpString=".xlsx") returned 5 [0113.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.379] lstrlenW (lpString=".ppt") returned 4 [0113.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.379] lstrlenW (lpString=".zip") returned 4 [0113.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.379] lstrlenW (lpString=".rar") returned 4 [0113.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString=".bz2") returned 4 [0113.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString=".7z") returned 3 [0113.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.379] lstrlenW (lpString=".dbf") returned 4 [0113.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.379] lstrlenW (lpString=".1cd") returned 4 [0113.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.379] lstrlenW (lpString=".jpg") returned 4 [0113.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString=".pdf") returned 4 [0113.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.379] lstrlenW (lpString=".xls") returned 4 [0113.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.379] lstrlenW (lpString=".xlsx") returned 5 [0113.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.379] lstrlenW (lpString=".ppt") returned 4 [0113.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.380] lstrlenW (lpString=".zip") returned 4 [0113.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.380] lstrlenW (lpString=".rar") returned 4 [0113.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.380] lstrlenW (lpString=".bz2") returned 4 [0113.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.380] lstrlenW (lpString=".7z") returned 3 [0113.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.380] lstrlenW (lpString=".dbf") returned 4 [0113.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.380] lstrlenW (lpString=".1cd") returned 4 [0113.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 63 [0113.380] lstrlenW (lpString=".jpg") returned 4 [0113.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.380] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") [0113.381] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4644) returned 1 [0113.381] CloseHandle (hObject=0x1a0) returned 1 [0113.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf")) returned 0x20 [0113.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.381] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.381] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.382] GetLastError () returned 0x0 [0113.382] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1224, lpOverlapped=0x0) returned 1 [0113.383] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1230, lpOverlapped=0x0) returned 1 [0113.384] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.384] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.385] SetEndOfFile (hFile=0x180) returned 1 [0113.385] CloseHandle (hObject=0x180) returned 1 [0113.385] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.385] SetEndOfFile (hFile=0x1a0) returned 1 [0113.386] CloseHandle (hObject=0x1a0) returned 1 [0113.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf")) returned 1 [0113.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.386] lstrlenW (lpString=".doc") returned 4 [0113.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.386] lstrlenW (lpString=".docx") returned 5 [0113.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.386] lstrlenW (lpString=".pdf") returned 4 [0113.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.386] lstrlenW (lpString=".xls") returned 4 [0113.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.386] lstrlenW (lpString=".xlsx") returned 5 [0113.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.386] lstrlenW (lpString=".ppt") returned 4 [0113.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.386] lstrlenW (lpString=".zip") returned 4 [0113.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.386] lstrlenW (lpString=".rar") returned 4 [0113.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".bz2") returned 4 [0113.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".7z") returned 3 [0113.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.387] lstrlenW (lpString=".dbf") returned 4 [0113.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.387] lstrlenW (lpString=".1cd") returned 4 [0113.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.387] lstrlenW (lpString=".jpg") returned 4 [0113.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".pdf") returned 4 [0113.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".xls") returned 4 [0113.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.387] lstrlenW (lpString=".xlsx") returned 5 [0113.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.387] lstrlenW (lpString=".ppt") returned 4 [0113.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.387] lstrlenW (lpString=".zip") returned 4 [0113.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.387] lstrlenW (lpString=".rar") returned 4 [0113.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".bz2") returned 4 [0113.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.387] lstrlenW (lpString=".7z") returned 3 [0113.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.387] lstrlenW (lpString=".dbf") returned 4 [0113.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.388] lstrlenW (lpString=".1cd") returned 4 [0113.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 63 [0113.388] lstrlenW (lpString=".jpg") returned 4 [0113.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.388] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") [0113.388] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7104) returned 1 [0113.388] CloseHandle (hObject=0x1a0) returned 1 [0113.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf")) returned 0x20 [0113.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.389] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.389] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.389] GetLastError () returned 0x0 [0113.389] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1bc0, lpOverlapped=0x0) returned 1 [0113.391] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0113.392] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.392] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.392] SetEndOfFile (hFile=0x180) returned 1 [0113.392] CloseHandle (hObject=0x180) returned 1 [0113.392] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.392] SetEndOfFile (hFile=0x1a0) returned 1 [0113.393] CloseHandle (hObject=0x1a0) returned 1 [0113.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf")) returned 1 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString=".doc") returned 4 [0113.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString=".docx") returned 5 [0113.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.394] lstrlenW (lpString=".pdf") returned 4 [0113.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString=".xls") returned 4 [0113.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.394] lstrlenW (lpString=".xlsx") returned 5 [0113.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.394] lstrlenW (lpString=".ppt") returned 4 [0113.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString=".zip") returned 4 [0113.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.394] lstrlenW (lpString=".rar") returned 4 [0113.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString=".bz2") returned 4 [0113.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString=".7z") returned 3 [0113.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString=".dbf") returned 4 [0113.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString=".1cd") returned 4 [0113.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.394] lstrlenW (lpString=".jpg") returned 4 [0113.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString=".pdf") returned 4 [0113.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString=".xls") returned 4 [0113.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.395] lstrlenW (lpString=".xlsx") returned 5 [0113.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.395] lstrlenW (lpString=".ppt") returned 4 [0113.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.395] lstrlenW (lpString=".zip") returned 4 [0113.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.395] lstrlenW (lpString=".rar") returned 4 [0113.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString=".bz2") returned 4 [0113.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString=".7z") returned 3 [0113.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.395] lstrlenW (lpString=".dbf") returned 4 [0113.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.395] lstrlenW (lpString=".1cd") returned 4 [0113.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 63 [0113.395] lstrlenW (lpString=".jpg") returned 4 [0113.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.395] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") [0113.396] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1848) returned 1 [0113.396] CloseHandle (hObject=0x1a0) returned 1 [0113.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf")) returned 0x20 [0113.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.396] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.396] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.397] GetLastError () returned 0x0 [0113.397] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x738, lpOverlapped=0x0) returned 1 [0113.398] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x740, lpOverlapped=0x0) returned 1 [0113.399] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.399] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.399] SetEndOfFile (hFile=0x180) returned 1 [0113.400] CloseHandle (hObject=0x180) returned 1 [0113.400] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.400] SetEndOfFile (hFile=0x1a0) returned 1 [0113.400] CloseHandle (hObject=0x1a0) returned 1 [0113.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf")) returned 1 [0113.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.401] lstrlenW (lpString=".doc") returned 4 [0113.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.401] lstrlenW (lpString=".docx") returned 5 [0113.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.401] lstrlenW (lpString=".pdf") returned 4 [0113.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.401] lstrlenW (lpString=".xls") returned 4 [0113.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.401] lstrlenW (lpString=".xlsx") returned 5 [0113.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.401] lstrlenW (lpString=".ppt") returned 4 [0113.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.401] lstrlenW (lpString=".zip") returned 4 [0113.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.401] lstrlenW (lpString=".rar") returned 4 [0113.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.401] lstrlenW (lpString=".bz2") returned 4 [0113.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.401] lstrlenW (lpString=".7z") returned 3 [0113.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".dbf") returned 4 [0113.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".1cd") returned 4 [0113.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".jpg") returned 4 [0113.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString=".pdf") returned 4 [0113.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString=".xls") returned 4 [0113.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.402] lstrlenW (lpString=".xlsx") returned 5 [0113.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.402] lstrlenW (lpString=".ppt") returned 4 [0113.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".zip") returned 4 [0113.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.402] lstrlenW (lpString=".rar") returned 4 [0113.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString=".bz2") returned 4 [0113.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString=".7z") returned 3 [0113.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".dbf") returned 4 [0113.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.402] lstrlenW (lpString=".1cd") returned 4 [0113.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 63 [0113.403] lstrlenW (lpString=".jpg") returned 4 [0113.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.403] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") [0113.404] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3176) returned 1 [0113.404] CloseHandle (hObject=0x1a0) returned 1 [0113.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf")) returned 0x20 [0113.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.404] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.404] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.405] GetLastError () returned 0x0 [0113.405] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xc68, lpOverlapped=0x0) returned 1 [0113.406] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xc70, lpOverlapped=0x0) returned 1 [0113.407] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.407] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.407] SetEndOfFile (hFile=0x180) returned 1 [0113.408] CloseHandle (hObject=0x180) returned 1 [0113.408] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.408] SetEndOfFile (hFile=0x1a0) returned 1 [0113.408] CloseHandle (hObject=0x1a0) returned 1 [0113.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf")) returned 1 [0113.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.409] lstrlenW (lpString=".doc") returned 4 [0113.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.409] lstrlenW (lpString=".docx") returned 5 [0113.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.409] lstrlenW (lpString=".pdf") returned 4 [0113.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.409] lstrlenW (lpString=".xls") returned 4 [0113.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.409] lstrlenW (lpString=".xlsx") returned 5 [0113.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.409] lstrlenW (lpString=".ppt") returned 4 [0113.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.409] lstrlenW (lpString=".zip") returned 4 [0113.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.409] lstrlenW (lpString=".rar") returned 4 [0113.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.409] lstrlenW (lpString=".bz2") returned 4 [0113.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.409] lstrlenW (lpString=".7z") returned 3 [0113.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.410] lstrlenW (lpString=".dbf") returned 4 [0113.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.410] lstrlenW (lpString=".1cd") returned 4 [0113.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.410] lstrlenW (lpString=".jpg") returned 4 [0113.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString=".pdf") returned 4 [0113.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString=".xls") returned 4 [0113.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.410] lstrlenW (lpString=".xlsx") returned 5 [0113.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.410] lstrlenW (lpString=".ppt") returned 4 [0113.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.410] lstrlenW (lpString=".zip") returned 4 [0113.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.410] lstrlenW (lpString=".rar") returned 4 [0113.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString=".bz2") returned 4 [0113.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.410] lstrlenW (lpString=".7z") returned 3 [0113.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.410] lstrlenW (lpString=".dbf") returned 4 [0113.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.411] lstrlenW (lpString=".1cd") returned 4 [0113.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 63 [0113.411] lstrlenW (lpString=".jpg") returned 4 [0113.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.411] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") [0113.411] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3980) returned 1 [0113.411] CloseHandle (hObject=0x1a0) returned 1 [0113.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf")) returned 0x20 [0113.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.412] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.412] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.412] GetLastError () returned 0x0 [0113.412] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf8c, lpOverlapped=0x0) returned 1 [0113.414] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0113.415] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.415] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.415] SetEndOfFile (hFile=0x180) returned 1 [0113.415] CloseHandle (hObject=0x180) returned 1 [0113.415] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.415] SetEndOfFile (hFile=0x1a0) returned 1 [0113.416] CloseHandle (hObject=0x1a0) returned 1 [0113.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf")) returned 1 [0113.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.416] lstrlenW (lpString=".doc") returned 4 [0113.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.416] lstrlenW (lpString=".docx") returned 5 [0113.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.416] lstrlenW (lpString=".pdf") returned 4 [0113.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString=".xls") returned 4 [0113.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.417] lstrlenW (lpString=".xlsx") returned 5 [0113.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.417] lstrlenW (lpString=".ppt") returned 4 [0113.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.417] lstrlenW (lpString=".zip") returned 4 [0113.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.417] lstrlenW (lpString=".rar") returned 4 [0113.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString=".bz2") returned 4 [0113.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString=".7z") returned 3 [0113.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.417] lstrlenW (lpString=".dbf") returned 4 [0113.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.417] lstrlenW (lpString=".1cd") returned 4 [0113.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.417] lstrlenW (lpString=".jpg") returned 4 [0113.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString=".pdf") returned 4 [0113.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.417] lstrlenW (lpString=".xls") returned 4 [0113.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.417] lstrlenW (lpString=".xlsx") returned 5 [0113.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.417] lstrlenW (lpString=".ppt") returned 4 [0113.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.418] lstrlenW (lpString=".zip") returned 4 [0113.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.418] lstrlenW (lpString=".rar") returned 4 [0113.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.418] lstrlenW (lpString=".bz2") returned 4 [0113.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.418] lstrlenW (lpString=".7z") returned 3 [0113.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.418] lstrlenW (lpString=".dbf") returned 4 [0113.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.418] lstrlenW (lpString=".1cd") returned 4 [0113.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 63 [0113.418] lstrlenW (lpString=".jpg") returned 4 [0113.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.418] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") [0113.419] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3956) returned 1 [0113.419] CloseHandle (hObject=0x1a0) returned 1 [0113.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf")) returned 0x20 [0113.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.419] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.419] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.420] GetLastError () returned 0x0 [0113.420] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf74, lpOverlapped=0x0) returned 1 [0113.421] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0113.422] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.422] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.422] SetEndOfFile (hFile=0x180) returned 1 [0113.423] CloseHandle (hObject=0x180) returned 1 [0113.423] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.423] SetEndOfFile (hFile=0x1a0) returned 1 [0113.424] CloseHandle (hObject=0x1a0) returned 1 [0113.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf")) returned 1 [0113.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.424] lstrlenW (lpString=".doc") returned 4 [0113.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.424] lstrlenW (lpString=".docx") returned 5 [0113.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.424] lstrlenW (lpString=".pdf") returned 4 [0113.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.424] lstrlenW (lpString=".xls") returned 4 [0113.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.424] lstrlenW (lpString=".xlsx") returned 5 [0113.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.424] lstrlenW (lpString=".ppt") returned 4 [0113.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.424] lstrlenW (lpString=".zip") returned 4 [0113.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.425] lstrlenW (lpString=".rar") returned 4 [0113.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".bz2") returned 4 [0113.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".7z") returned 3 [0113.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.425] lstrlenW (lpString=".dbf") returned 4 [0113.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.425] lstrlenW (lpString=".1cd") returned 4 [0113.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.425] lstrlenW (lpString=".jpg") returned 4 [0113.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".pdf") returned 4 [0113.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".xls") returned 4 [0113.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.425] lstrlenW (lpString=".xlsx") returned 5 [0113.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.425] lstrlenW (lpString=".ppt") returned 4 [0113.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.425] lstrlenW (lpString=".zip") returned 4 [0113.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.425] lstrlenW (lpString=".rar") returned 4 [0113.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".bz2") returned 4 [0113.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.425] lstrlenW (lpString=".7z") returned 3 [0113.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.426] lstrlenW (lpString=".dbf") returned 4 [0113.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.426] lstrlenW (lpString=".1cd") returned 4 [0113.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 63 [0113.426] lstrlenW (lpString=".jpg") returned 4 [0113.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.426] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") [0113.426] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5564) returned 1 [0113.426] CloseHandle (hObject=0x1a0) returned 1 [0113.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf")) returned 0x20 [0113.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.427] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.427] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.427] GetLastError () returned 0x0 [0113.427] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x15bc, lpOverlapped=0x0) returned 1 [0113.429] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0113.430] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.430] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.430] SetEndOfFile (hFile=0x180) returned 1 [0113.430] CloseHandle (hObject=0x180) returned 1 [0113.430] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.430] SetEndOfFile (hFile=0x1a0) returned 1 [0113.431] CloseHandle (hObject=0x1a0) returned 1 [0113.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf")) returned 1 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString=".doc") returned 4 [0113.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString=".docx") returned 5 [0113.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.432] lstrlenW (lpString=".pdf") returned 4 [0113.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString=".xls") returned 4 [0113.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.432] lstrlenW (lpString=".xlsx") returned 5 [0113.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.432] lstrlenW (lpString=".ppt") returned 4 [0113.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString=".zip") returned 4 [0113.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.432] lstrlenW (lpString=".rar") returned 4 [0113.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString=".bz2") returned 4 [0113.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString=".7z") returned 3 [0113.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString=".dbf") returned 4 [0113.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString=".1cd") returned 4 [0113.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.432] lstrlenW (lpString=".jpg") returned 4 [0113.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString=".pdf") returned 4 [0113.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString=".xls") returned 4 [0113.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.433] lstrlenW (lpString=".xlsx") returned 5 [0113.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.433] lstrlenW (lpString=".ppt") returned 4 [0113.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.433] lstrlenW (lpString=".zip") returned 4 [0113.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.433] lstrlenW (lpString=".rar") returned 4 [0113.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString=".bz2") returned 4 [0113.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString=".7z") returned 3 [0113.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.433] lstrlenW (lpString=".dbf") returned 4 [0113.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.433] lstrlenW (lpString=".1cd") returned 4 [0113.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 63 [0113.433] lstrlenW (lpString=".jpg") returned 4 [0113.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.433] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") [0113.434] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7592) returned 1 [0113.434] CloseHandle (hObject=0x1a0) returned 1 [0113.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf")) returned 0x20 [0113.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.434] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.434] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.435] GetLastError () returned 0x0 [0113.435] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1da8, lpOverlapped=0x0) returned 1 [0113.437] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1db0, lpOverlapped=0x0) returned 1 [0113.438] ReadFile (in: hFile=0x1a0, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.438] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.438] SetEndOfFile (hFile=0x180) returned 1 [0113.438] CloseHandle (hObject=0x180) returned 1 [0113.438] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.438] SetEndOfFile (hFile=0x1a0) returned 1 [0113.439] CloseHandle (hObject=0x1a0) returned 1 [0113.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf")) returned 1 [0113.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.439] lstrlenW (lpString=".doc") returned 4 [0113.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.439] lstrlenW (lpString=".docx") returned 5 [0113.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.439] lstrlenW (lpString=".pdf") returned 4 [0113.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString=".xls") returned 4 [0113.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.440] lstrlenW (lpString=".xlsx") returned 5 [0113.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.440] lstrlenW (lpString=".ppt") returned 4 [0113.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.440] lstrlenW (lpString=".zip") returned 4 [0113.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.440] lstrlenW (lpString=".rar") returned 4 [0113.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString=".bz2") returned 4 [0113.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString=".7z") returned 3 [0113.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.440] lstrlenW (lpString=".dbf") returned 4 [0113.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.440] lstrlenW (lpString=".1cd") returned 4 [0113.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.440] lstrlenW (lpString=".jpg") returned 4 [0113.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString=".pdf") returned 4 [0113.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.440] lstrlenW (lpString=".xls") returned 4 [0113.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.440] lstrlenW (lpString=".xlsx") returned 5 [0113.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.440] lstrlenW (lpString=".ppt") returned 4 [0113.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.441] lstrlenW (lpString=".zip") returned 4 [0113.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.441] lstrlenW (lpString=".rar") returned 4 [0113.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.441] lstrlenW (lpString=".bz2") returned 4 [0113.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.441] lstrlenW (lpString=".7z") returned 3 [0113.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.441] lstrlenW (lpString=".dbf") returned 4 [0113.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.441] lstrlenW (lpString=".1cd") returned 4 [0113.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 63 [0113.441] lstrlenW (lpString=".jpg") returned 4 [0113.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.441] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") [0113.799] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2012) returned 1 [0113.799] CloseHandle (hObject=0x1c8) returned 1 [0113.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf")) returned 0x20 [0113.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.799] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.800] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.801] GetLastError () returned 0x0 [0113.801] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x7dc, lpOverlapped=0x0) returned 1 [0113.803] WriteFile (in: hFile=0x19c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0113.804] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.804] WriteFile (in: hFile=0x19c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.804] SetEndOfFile (hFile=0x19c) returned 1 [0113.804] CloseHandle (hObject=0x19c) returned 1 [0113.804] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.804] SetEndOfFile (hFile=0x1c8) returned 1 [0113.805] CloseHandle (hObject=0x1c8) returned 1 [0113.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf")) returned 1 [0113.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.805] lstrlenW (lpString=".doc") returned 4 [0113.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.805] lstrlenW (lpString=".docx") returned 5 [0113.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.805] lstrlenW (lpString=".pdf") returned 4 [0113.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString=".xls") returned 4 [0113.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.806] lstrlenW (lpString=".xlsx") returned 5 [0113.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.806] lstrlenW (lpString=".ppt") returned 4 [0113.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.806] lstrlenW (lpString=".zip") returned 4 [0113.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.806] lstrlenW (lpString=".rar") returned 4 [0113.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString=".bz2") returned 4 [0113.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString=".7z") returned 3 [0113.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.806] lstrlenW (lpString=".dbf") returned 4 [0113.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.806] lstrlenW (lpString=".1cd") returned 4 [0113.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.806] lstrlenW (lpString=".jpg") returned 4 [0113.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString=".pdf") returned 4 [0113.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.806] lstrlenW (lpString=".xls") returned 4 [0113.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.806] lstrlenW (lpString=".xlsx") returned 5 [0113.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.807] lstrlenW (lpString=".ppt") returned 4 [0113.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.807] lstrlenW (lpString=".zip") returned 4 [0113.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.807] lstrlenW (lpString=".rar") returned 4 [0113.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.807] lstrlenW (lpString=".bz2") returned 4 [0113.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.807] lstrlenW (lpString=".7z") returned 3 [0113.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.807] lstrlenW (lpString=".dbf") returned 4 [0113.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.807] lstrlenW (lpString=".1cd") returned 4 [0113.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 63 [0113.807] lstrlenW (lpString=".jpg") returned 4 [0113.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.807] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") [0113.808] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2514) returned 1 [0113.808] CloseHandle (hObject=0x210) returned 1 [0113.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf")) returned 0x20 [0113.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.809] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.809] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.809] GetLastError () returned 0x0 [0113.809] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x9d2, lpOverlapped=0x0) returned 1 [0113.811] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0113.812] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.812] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.812] SetEndOfFile (hFile=0x1c8) returned 1 [0113.812] CloseHandle (hObject=0x1c8) returned 1 [0113.812] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.812] SetEndOfFile (hFile=0x210) returned 1 [0113.813] CloseHandle (hObject=0x210) returned 1 [0113.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf")) returned 1 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString=".doc") returned 4 [0113.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString=".docx") returned 5 [0113.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.814] lstrlenW (lpString=".pdf") returned 4 [0113.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString=".xls") returned 4 [0113.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.814] lstrlenW (lpString=".xlsx") returned 5 [0113.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.814] lstrlenW (lpString=".ppt") returned 4 [0113.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString=".zip") returned 4 [0113.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.814] lstrlenW (lpString=".rar") returned 4 [0113.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString=".bz2") returned 4 [0113.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString=".7z") returned 3 [0113.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString=".dbf") returned 4 [0113.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString=".1cd") returned 4 [0113.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.814] lstrlenW (lpString=".jpg") returned 4 [0113.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString=".pdf") returned 4 [0113.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString=".xls") returned 4 [0113.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.815] lstrlenW (lpString=".xlsx") returned 5 [0113.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.815] lstrlenW (lpString=".ppt") returned 4 [0113.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.815] lstrlenW (lpString=".zip") returned 4 [0113.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.815] lstrlenW (lpString=".rar") returned 4 [0113.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString=".bz2") returned 4 [0113.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString=".7z") returned 3 [0113.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.815] lstrlenW (lpString=".dbf") returned 4 [0113.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.815] lstrlenW (lpString=".1cd") returned 4 [0113.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 63 [0113.815] lstrlenW (lpString=".jpg") returned 4 [0113.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.815] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") [0113.816] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=566) returned 1 [0113.816] CloseHandle (hObject=0x210) returned 1 [0113.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf")) returned 0x20 [0113.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.817] GetLastError () returned 0x0 [0113.817] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x236, lpOverlapped=0x0) returned 1 [0113.818] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x240, lpOverlapped=0x0) returned 1 [0113.819] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.819] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.819] SetEndOfFile (hFile=0x1c8) returned 1 [0113.819] CloseHandle (hObject=0x1c8) returned 1 [0113.819] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.819] SetEndOfFile (hFile=0x210) returned 1 [0113.820] CloseHandle (hObject=0x210) returned 1 [0113.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf")) returned 1 [0113.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.820] lstrlenW (lpString=".doc") returned 4 [0113.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.820] lstrlenW (lpString=".docx") returned 5 [0113.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.820] lstrlenW (lpString=".pdf") returned 4 [0113.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString=".xls") returned 4 [0113.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.821] lstrlenW (lpString=".xlsx") returned 5 [0113.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.821] lstrlenW (lpString=".ppt") returned 4 [0113.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.821] lstrlenW (lpString=".zip") returned 4 [0113.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.821] lstrlenW (lpString=".rar") returned 4 [0113.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString=".bz2") returned 4 [0113.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString=".7z") returned 3 [0113.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.821] lstrlenW (lpString=".dbf") returned 4 [0113.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.821] lstrlenW (lpString=".1cd") returned 4 [0113.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.821] lstrlenW (lpString=".jpg") returned 4 [0113.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString=".pdf") returned 4 [0113.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.821] lstrlenW (lpString=".xls") returned 4 [0113.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.821] lstrlenW (lpString=".xlsx") returned 5 [0113.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.821] lstrlenW (lpString=".ppt") returned 4 [0113.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.822] lstrlenW (lpString=".zip") returned 4 [0113.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.822] lstrlenW (lpString=".rar") returned 4 [0113.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.822] lstrlenW (lpString=".bz2") returned 4 [0113.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.822] lstrlenW (lpString=".7z") returned 3 [0113.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.822] lstrlenW (lpString=".dbf") returned 4 [0113.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.822] lstrlenW (lpString=".1cd") returned 4 [0113.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 63 [0113.822] lstrlenW (lpString=".jpg") returned 4 [0113.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.822] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") [0113.823] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1642) returned 1 [0113.823] CloseHandle (hObject=0x210) returned 1 [0113.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf")) returned 0x20 [0113.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.823] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.823] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.824] GetLastError () returned 0x0 [0113.824] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x66a, lpOverlapped=0x0) returned 1 [0113.826] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x670, lpOverlapped=0x0) returned 1 [0113.827] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.827] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.827] SetEndOfFile (hFile=0x1c8) returned 1 [0113.827] CloseHandle (hObject=0x1c8) returned 1 [0113.827] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.827] SetEndOfFile (hFile=0x210) returned 1 [0113.828] CloseHandle (hObject=0x210) returned 1 [0113.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf")) returned 1 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.829] lstrlenW (lpString=".doc") returned 4 [0113.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString=".docx") returned 5 [0113.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.829] lstrlenW (lpString=".pdf") returned 4 [0113.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString=".xls") returned 4 [0113.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.829] lstrlenW (lpString=".xlsx") returned 5 [0113.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.829] lstrlenW (lpString=".ppt") returned 4 [0113.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.829] lstrlenW (lpString=".zip") returned 4 [0113.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.829] lstrlenW (lpString=".rar") returned 4 [0113.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString=".bz2") returned 4 [0113.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString=".7z") returned 3 [0113.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.829] lstrlenW (lpString=".dbf") returned 4 [0113.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.829] lstrlenW (lpString=".1cd") returned 4 [0113.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.830] lstrlenW (lpString=".jpg") returned 4 [0113.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString=".pdf") returned 4 [0113.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString=".xls") returned 4 [0113.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.830] lstrlenW (lpString=".xlsx") returned 5 [0113.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.830] lstrlenW (lpString=".ppt") returned 4 [0113.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.830] lstrlenW (lpString=".zip") returned 4 [0113.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.830] lstrlenW (lpString=".rar") returned 4 [0113.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString=".bz2") returned 4 [0113.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString=".7z") returned 3 [0113.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.830] lstrlenW (lpString=".dbf") returned 4 [0113.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.830] lstrlenW (lpString=".1cd") returned 4 [0113.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 63 [0113.830] lstrlenW (lpString=".jpg") returned 4 [0113.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.830] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") [0113.832] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19970) returned 1 [0113.832] CloseHandle (hObject=0x210) returned 1 [0113.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf")) returned 0x20 [0113.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.832] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.832] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.833] GetLastError () returned 0x0 [0113.833] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4e02, lpOverlapped=0x0) returned 1 [0113.932] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4e10, lpOverlapped=0x0) returned 1 [0113.934] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.934] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.934] SetEndOfFile (hFile=0x1c8) returned 1 [0113.934] CloseHandle (hObject=0x1c8) returned 1 [0113.934] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.934] SetEndOfFile (hFile=0x210) returned 1 [0113.935] CloseHandle (hObject=0x210) returned 1 [0113.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf")) returned 1 [0113.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.935] lstrlenW (lpString=".doc") returned 4 [0113.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.935] lstrlenW (lpString=".docx") returned 5 [0113.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.935] lstrlenW (lpString=".pdf") returned 4 [0113.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString=".xls") returned 4 [0113.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.936] lstrlenW (lpString=".xlsx") returned 5 [0113.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.936] lstrlenW (lpString=".ppt") returned 4 [0113.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.936] lstrlenW (lpString=".zip") returned 4 [0113.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.936] lstrlenW (lpString=".rar") returned 4 [0113.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString=".bz2") returned 4 [0113.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString=".7z") returned 3 [0113.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.936] lstrlenW (lpString=".dbf") returned 4 [0113.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.936] lstrlenW (lpString=".1cd") returned 4 [0113.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.936] lstrlenW (lpString=".jpg") returned 4 [0113.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString=".pdf") returned 4 [0113.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.936] lstrlenW (lpString=".xls") returned 4 [0113.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.936] lstrlenW (lpString=".xlsx") returned 5 [0113.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.936] lstrlenW (lpString=".ppt") returned 4 [0113.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.937] lstrlenW (lpString=".zip") returned 4 [0113.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.937] lstrlenW (lpString=".rar") returned 4 [0113.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.937] lstrlenW (lpString=".bz2") returned 4 [0113.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.937] lstrlenW (lpString=".7z") returned 3 [0113.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.937] lstrlenW (lpString=".dbf") returned 4 [0113.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.937] lstrlenW (lpString=".1cd") returned 4 [0113.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 63 [0113.937] lstrlenW (lpString=".jpg") returned 4 [0113.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.937] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") [0113.938] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6144) returned 1 [0113.938] CloseHandle (hObject=0x210) returned 1 [0113.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf")) returned 0x20 [0113.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.938] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.938] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.939] GetLastError () returned 0x0 [0113.939] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1800, lpOverlapped=0x0) returned 1 [0114.004] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1810, lpOverlapped=0x0) returned 1 [0114.005] ReadFile (in: hFile=0x210, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.005] WriteFile (in: hFile=0x1c8, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.005] SetEndOfFile (hFile=0x1c8) returned 1 [0114.005] CloseHandle (hObject=0x1c8) returned 1 [0114.005] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.006] SetEndOfFile (hFile=0x210) returned 1 [0114.006] CloseHandle (hObject=0x210) returned 1 [0114.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf")) returned 1 [0114.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.008] lstrlenW (lpString=".doc") returned 4 [0114.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.008] lstrlenW (lpString=".docx") returned 5 [0114.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0114.008] lstrlenW (lpString=".pdf") returned 4 [0114.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString=".xls") returned 4 [0114.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.009] lstrlenW (lpString=".xlsx") returned 5 [0114.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0114.009] lstrlenW (lpString=".ppt") returned 4 [0114.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.009] lstrlenW (lpString=".zip") returned 4 [0114.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.009] lstrlenW (lpString=".rar") returned 4 [0114.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString=".bz2") returned 4 [0114.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString=".7z") returned 3 [0114.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.009] lstrlenW (lpString=".dbf") returned 4 [0114.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.009] lstrlenW (lpString=".1cd") returned 4 [0114.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.009] lstrlenW (lpString=".jpg") returned 4 [0114.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.009] lstrlenW (lpString=".pdf") returned 4 [0114.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString=".xls") returned 4 [0114.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.010] lstrlenW (lpString=".xlsx") returned 5 [0114.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0114.010] lstrlenW (lpString=".ppt") returned 4 [0114.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.010] lstrlenW (lpString=".zip") returned 4 [0114.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.010] lstrlenW (lpString=".rar") returned 4 [0114.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString=".bz2") returned 4 [0114.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString=".7z") returned 3 [0114.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.010] lstrlenW (lpString=".dbf") returned 4 [0114.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.010] lstrlenW (lpString=".1cd") returned 4 [0114.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 63 [0114.010] lstrlenW (lpString=".jpg") returned 4 [0114.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.010] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") [0114.097] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=467) returned 1 [0114.098] CloseHandle (hObject=0x1c8) returned 1 [0114.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif")) returned 0x20 [0114.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.098] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.098] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.099] GetLastError () returned 0x0 [0114.099] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1d3, lpOverlapped=0x0) returned 1 [0114.100] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0114.100] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.100] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.101] SetEndOfFile (hFile=0x22c) returned 1 [0114.101] CloseHandle (hObject=0x22c) returned 1 [0114.101] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.101] SetEndOfFile (hFile=0x1c8) returned 1 [0114.102] CloseHandle (hObject=0x1c8) returned 1 [0114.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif")) returned 1 [0114.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.102] lstrlenW (lpString=".doc") returned 4 [0114.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.102] lstrlenW (lpString=".docx") returned 5 [0114.102] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.102] lstrlenW (lpString=".pdf") returned 4 [0114.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.102] lstrlenW (lpString=".xls") returned 4 [0114.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.102] lstrlenW (lpString=".xlsx") returned 5 [0114.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.102] lstrlenW (lpString=".ppt") returned 4 [0114.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.102] lstrlenW (lpString=".zip") returned 4 [0114.103] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".rar") returned 4 [0114.103] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".bz2") returned 4 [0114.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.103] lstrlenW (lpString=".7z") returned 3 [0114.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.103] lstrlenW (lpString=".dbf") returned 4 [0114.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.103] lstrlenW (lpString=".1cd") returned 4 [0114.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.103] lstrlenW (lpString=".jpg") returned 4 [0114.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".pdf") returned 4 [0114.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".xls") returned 4 [0114.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".xlsx") returned 5 [0114.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.103] lstrlenW (lpString=".ppt") returned 4 [0114.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.103] lstrlenW (lpString=".zip") returned 4 [0114.103] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".rar") returned 4 [0114.103] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.103] lstrlenW (lpString=".bz2") returned 4 [0114.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.103] lstrlenW (lpString=".7z") returned 3 [0114.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.104] lstrlenW (lpString=".dbf") returned 4 [0114.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.104] lstrlenW (lpString=".1cd") returned 4 [0114.104] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 63 [0114.104] lstrlenW (lpString=".jpg") returned 4 [0114.104] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.104] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") [0114.104] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=318) returned 1 [0114.104] CloseHandle (hObject=0x1c8) returned 1 [0114.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif")) returned 0x20 [0114.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.105] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.105] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.105] GetLastError () returned 0x0 [0114.106] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13e, lpOverlapped=0x0) returned 1 [0114.106] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x140, lpOverlapped=0x0) returned 1 [0114.107] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.107] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.108] SetEndOfFile (hFile=0x22c) returned 1 [0114.108] CloseHandle (hObject=0x22c) returned 1 [0114.108] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.108] SetEndOfFile (hFile=0x1c8) returned 1 [0114.109] CloseHandle (hObject=0x1c8) returned 1 [0114.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif")) returned 1 [0114.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.109] lstrlenW (lpString=".doc") returned 4 [0114.109] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.109] lstrlenW (lpString=".docx") returned 5 [0114.109] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.109] lstrlenW (lpString=".pdf") returned 4 [0114.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.109] lstrlenW (lpString=".xls") returned 4 [0114.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.109] lstrlenW (lpString=".xlsx") returned 5 [0114.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.109] lstrlenW (lpString=".ppt") returned 4 [0114.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.110] lstrlenW (lpString=".zip") returned 4 [0114.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".rar") returned 4 [0114.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".bz2") returned 4 [0114.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.110] lstrlenW (lpString=".7z") returned 3 [0114.110] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.110] lstrlenW (lpString=".dbf") returned 4 [0114.110] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.110] lstrlenW (lpString=".1cd") returned 4 [0114.110] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.110] lstrlenW (lpString=".jpg") returned 4 [0114.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".pdf") returned 4 [0114.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".xls") returned 4 [0114.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".xlsx") returned 5 [0114.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.110] lstrlenW (lpString=".ppt") returned 4 [0114.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.110] lstrlenW (lpString=".zip") returned 4 [0114.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".rar") returned 4 [0114.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.110] lstrlenW (lpString=".bz2") returned 4 [0114.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.110] lstrlenW (lpString=".7z") returned 3 [0114.111] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.111] lstrlenW (lpString=".dbf") returned 4 [0114.111] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.111] lstrlenW (lpString=".1cd") returned 4 [0114.111] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 63 [0114.111] lstrlenW (lpString=".jpg") returned 4 [0114.111] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.111] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") [0114.111] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=592) returned 1 [0114.111] CloseHandle (hObject=0x1c8) returned 1 [0114.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif")) returned 0x20 [0114.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.113] GetLastError () returned 0x0 [0114.113] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x250, lpOverlapped=0x0) returned 1 [0114.114] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x260, lpOverlapped=0x0) returned 1 [0114.114] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.114] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.115] SetEndOfFile (hFile=0x22c) returned 1 [0114.115] CloseHandle (hObject=0x22c) returned 1 [0114.115] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.115] SetEndOfFile (hFile=0x1c8) returned 1 [0114.116] CloseHandle (hObject=0x1c8) returned 1 [0114.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif")) returned 1 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.116] lstrlenW (lpString=".doc") returned 4 [0114.116] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.116] lstrlenW (lpString=".docx") returned 5 [0114.116] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.116] lstrlenW (lpString=".pdf") returned 4 [0114.116] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.116] lstrlenW (lpString=".xls") returned 4 [0114.116] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.116] lstrlenW (lpString=".xlsx") returned 5 [0114.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.116] lstrlenW (lpString=".ppt") returned 4 [0114.116] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.116] lstrlenW (lpString=".zip") returned 4 [0114.116] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.116] lstrlenW (lpString=".rar") returned 4 [0114.116] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.116] lstrlenW (lpString=".bz2") returned 4 [0114.116] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.117] lstrlenW (lpString=".7z") returned 3 [0114.117] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.117] lstrlenW (lpString=".dbf") returned 4 [0114.117] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.117] lstrlenW (lpString=".1cd") returned 4 [0114.117] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.117] lstrlenW (lpString=".jpg") returned 4 [0114.117] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString=".pdf") returned 4 [0114.117] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString=".xls") returned 4 [0114.117] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString=".xlsx") returned 5 [0114.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.117] lstrlenW (lpString=".ppt") returned 4 [0114.117] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.117] lstrlenW (lpString=".zip") returned 4 [0114.117] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString=".rar") returned 4 [0114.117] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.117] lstrlenW (lpString=".bz2") returned 4 [0114.117] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.117] lstrlenW (lpString=".7z") returned 3 [0114.117] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.117] lstrlenW (lpString=".dbf") returned 4 [0114.117] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.118] lstrlenW (lpString=".1cd") returned 4 [0114.118] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 63 [0114.118] lstrlenW (lpString=".jpg") returned 4 [0114.118] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.118] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") [0114.118] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=681) returned 1 [0114.118] CloseHandle (hObject=0x1c8) returned 1 [0114.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif")) returned 0x20 [0114.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.119] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.119] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.120] GetLastError () returned 0x0 [0114.120] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2a9, lpOverlapped=0x0) returned 1 [0114.121] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0114.121] ReadFile (in: hFile=0x1c8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.122] WriteFile (in: hFile=0x22c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.122] SetEndOfFile (hFile=0x22c) returned 1 [0114.122] CloseHandle (hObject=0x22c) returned 1 [0114.122] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.122] SetEndOfFile (hFile=0x1c8) returned 1 [0114.123] CloseHandle (hObject=0x1c8) returned 1 [0114.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif")) returned 1 [0114.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.123] lstrlenW (lpString=".doc") returned 4 [0114.123] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.123] lstrlenW (lpString=".docx") returned 5 [0114.123] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.123] lstrlenW (lpString=".pdf") returned 4 [0114.123] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.123] lstrlenW (lpString=".xls") returned 4 [0114.123] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.123] lstrlenW (lpString=".xlsx") returned 5 [0114.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.123] lstrlenW (lpString=".ppt") returned 4 [0114.124] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.124] lstrlenW (lpString=".zip") returned 4 [0114.124] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".rar") returned 4 [0114.124] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".bz2") returned 4 [0114.124] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.124] lstrlenW (lpString=".7z") returned 3 [0114.124] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.124] lstrlenW (lpString=".dbf") returned 4 [0114.124] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.124] lstrlenW (lpString=".1cd") returned 4 [0114.124] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.124] lstrlenW (lpString=".jpg") returned 4 [0114.124] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".pdf") returned 4 [0114.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".xls") returned 4 [0114.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".xlsx") returned 5 [0114.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.124] lstrlenW (lpString=".ppt") returned 4 [0114.124] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.124] lstrlenW (lpString=".zip") returned 4 [0114.124] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.124] lstrlenW (lpString=".rar") returned 4 [0114.124] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.125] lstrlenW (lpString=".bz2") returned 4 [0114.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.125] lstrlenW (lpString=".7z") returned 3 [0114.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.242] lstrlenW (lpString=".dbf") returned 4 [0114.242] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.242] lstrlenW (lpString=".1cd") returned 4 [0114.242] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 63 [0114.242] lstrlenW (lpString=".jpg") returned 4 [0114.242] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.242] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") [0115.097] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2201) returned 1 [0115.097] CloseHandle (hObject=0x1b8) returned 1 [0115.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif")) returned 0x20 [0115.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.097] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.098] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.098] GetLastError () returned 0x0 [0115.098] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x899, lpOverlapped=0x0) returned 1 [0115.100] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8a0, lpOverlapped=0x0) returned 1 [0115.101] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.101] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.101] SetEndOfFile (hFile=0x210) returned 1 [0115.103] CloseHandle (hObject=0x210) returned 1 [0115.103] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.103] SetEndOfFile (hFile=0x1b8) returned 1 [0115.104] CloseHandle (hObject=0x1b8) returned 1 [0115.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif")) returned 1 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.105] lstrlenW (lpString=".doc") returned 4 [0115.105] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.105] lstrlenW (lpString=".docx") returned 5 [0115.105] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.105] lstrlenW (lpString=".pdf") returned 4 [0115.105] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.105] lstrlenW (lpString=".xls") returned 4 [0115.105] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.105] lstrlenW (lpString=".xlsx") returned 5 [0115.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.105] lstrlenW (lpString=".ppt") returned 4 [0115.105] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.105] lstrlenW (lpString=".zip") returned 4 [0115.105] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.105] lstrlenW (lpString=".rar") returned 4 [0115.105] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.105] lstrlenW (lpString=".bz2") returned 4 [0115.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.105] lstrlenW (lpString=".7z") returned 3 [0115.105] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.105] lstrlenW (lpString=".dbf") returned 4 [0115.105] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.105] lstrlenW (lpString=".1cd") returned 4 [0115.105] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.106] lstrlenW (lpString=".jpg") returned 4 [0115.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString=".pdf") returned 4 [0115.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString=".xls") returned 4 [0115.106] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString=".xlsx") returned 5 [0115.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.106] lstrlenW (lpString=".ppt") returned 4 [0115.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.106] lstrlenW (lpString=".zip") returned 4 [0115.106] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString=".rar") returned 4 [0115.106] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.106] lstrlenW (lpString=".bz2") returned 4 [0115.106] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.106] lstrlenW (lpString=".7z") returned 3 [0115.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.106] lstrlenW (lpString=".dbf") returned 4 [0115.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.106] lstrlenW (lpString=".1cd") returned 4 [0115.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 63 [0115.106] lstrlenW (lpString=".jpg") returned 4 [0115.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.106] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") [0115.107] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2582) returned 1 [0115.107] CloseHandle (hObject=0x1b8) returned 1 [0115.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf")) returned 0x20 [0115.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.107] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.108] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.108] GetLastError () returned 0x0 [0115.108] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xa16, lpOverlapped=0x0) returned 1 [0115.110] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xa20, lpOverlapped=0x0) returned 1 [0115.111] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.111] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.111] SetEndOfFile (hFile=0x210) returned 1 [0115.111] CloseHandle (hObject=0x210) returned 1 [0115.111] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.111] SetEndOfFile (hFile=0x1b8) returned 1 [0115.112] CloseHandle (hObject=0x1b8) returned 1 [0115.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf")) returned 1 [0115.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.112] lstrlenW (lpString=".doc") returned 4 [0115.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.112] lstrlenW (lpString=".docx") returned 5 [0115.112] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.112] lstrlenW (lpString=".pdf") returned 4 [0115.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.112] lstrlenW (lpString=".xls") returned 4 [0115.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.113] lstrlenW (lpString=".xlsx") returned 5 [0115.113] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.113] lstrlenW (lpString=".ppt") returned 4 [0115.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.113] lstrlenW (lpString=".zip") returned 4 [0115.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.113] lstrlenW (lpString=".rar") returned 4 [0115.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.113] lstrlenW (lpString=".bz2") returned 4 [0115.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.113] lstrlenW (lpString=".7z") returned 3 [0115.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.113] lstrlenW (lpString=".dbf") returned 4 [0115.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.113] lstrlenW (lpString=".1cd") returned 4 [0115.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 60 [0115.113] lstrlenW (lpString=".jpg") returned 4 [0115.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.113] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") [0115.114] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2422) returned 1 [0115.114] CloseHandle (hObject=0x1b8) returned 1 [0115.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf")) returned 0x20 [0115.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.114] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.114] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.115] GetLastError () returned 0x0 [0115.115] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x976, lpOverlapped=0x0) returned 1 [0115.116] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x980, lpOverlapped=0x0) returned 1 [0115.117] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.117] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.117] SetEndOfFile (hFile=0x210) returned 1 [0115.117] CloseHandle (hObject=0x210) returned 1 [0115.118] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.118] SetEndOfFile (hFile=0x1b8) returned 1 [0115.118] CloseHandle (hObject=0x1b8) returned 1 [0115.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf")) returned 1 [0115.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.119] lstrlenW (lpString=".doc") returned 4 [0115.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString=".docx") returned 5 [0115.119] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.119] lstrlenW (lpString=".pdf") returned 4 [0115.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString=".xls") returned 4 [0115.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.119] lstrlenW (lpString=".xlsx") returned 5 [0115.119] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.119] lstrlenW (lpString=".ppt") returned 4 [0115.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.119] lstrlenW (lpString=".zip") returned 4 [0115.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.119] lstrlenW (lpString=".rar") returned 4 [0115.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString=".bz2") returned 4 [0115.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString=".7z") returned 3 [0115.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.119] lstrlenW (lpString=".dbf") returned 4 [0115.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.120] lstrlenW (lpString=".1cd") returned 4 [0115.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 60 [0115.120] lstrlenW (lpString=".jpg") returned 4 [0115.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.120] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") [0115.121] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3959) returned 1 [0115.121] CloseHandle (hObject=0x1b8) returned 1 [0115.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 0x20 [0115.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.121] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.121] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.123] GetLastError () returned 0x0 [0115.123] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xf77, lpOverlapped=0x0) returned 1 [0115.126] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0115.127] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.127] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.127] SetEndOfFile (hFile=0x210) returned 1 [0115.128] CloseHandle (hObject=0x210) returned 1 [0115.128] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.128] SetEndOfFile (hFile=0x1b8) returned 1 [0115.128] CloseHandle (hObject=0x1b8) returned 1 [0115.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 1 [0115.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.129] lstrlenW (lpString=".doc") returned 4 [0115.129] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.129] lstrlenW (lpString=".docx") returned 5 [0115.129] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0115.129] lstrlenW (lpString=".pdf") returned 4 [0115.129] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.129] lstrlenW (lpString=".xls") returned 4 [0115.129] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.129] lstrlenW (lpString=".xlsx") returned 5 [0115.129] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0115.129] lstrlenW (lpString=".ppt") returned 4 [0115.129] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.129] lstrlenW (lpString=".zip") returned 4 [0115.129] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.129] lstrlenW (lpString=".rar") returned 4 [0115.129] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.129] lstrlenW (lpString=".bz2") returned 4 [0115.129] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.129] lstrlenW (lpString=".7z") returned 3 [0115.129] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.130] lstrlenW (lpString=".dbf") returned 4 [0115.130] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.130] lstrlenW (lpString=".1cd") returned 4 [0115.130] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0115.130] lstrlenW (lpString=".jpg") returned 4 [0115.130] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.130] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") [0115.130] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=47) returned 1 [0115.130] CloseHandle (hObject=0x1b8) returned 1 [0115.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 0x20 [0115.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.131] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.131] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.131] GetLastError () returned 0x0 [0115.131] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2f, lpOverlapped=0x0) returned 1 [0115.132] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x30, lpOverlapped=0x0) returned 1 [0115.133] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.133] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.133] SetEndOfFile (hFile=0x210) returned 1 [0115.133] CloseHandle (hObject=0x210) returned 1 [0115.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.134] SetEndOfFile (hFile=0x1b8) returned 1 [0115.134] CloseHandle (hObject=0x1b8) returned 1 [0115.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 1 [0115.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.135] lstrlenW (lpString=".doc") returned 4 [0115.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.135] lstrlenW (lpString=".docx") returned 5 [0115.135] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0115.135] lstrlenW (lpString=".pdf") returned 4 [0115.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.135] lstrlenW (lpString=".xls") returned 4 [0115.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.135] lstrlenW (lpString=".xlsx") returned 5 [0115.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0115.135] lstrlenW (lpString=".ppt") returned 4 [0115.135] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.135] lstrlenW (lpString=".zip") returned 4 [0115.135] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.135] lstrlenW (lpString=".rar") returned 4 [0115.135] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.135] lstrlenW (lpString=".bz2") returned 4 [0115.135] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.135] lstrlenW (lpString=".7z") returned 3 [0115.135] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.135] lstrlenW (lpString=".dbf") returned 4 [0115.135] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.135] lstrlenW (lpString=".1cd") returned 4 [0115.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0115.136] lstrlenW (lpString=".jpg") returned 4 [0115.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.136] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") [0115.137] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=733) returned 1 [0115.137] CloseHandle (hObject=0x1b8) returned 1 [0115.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 0x20 [0115.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.137] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.137] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.138] GetLastError () returned 0x0 [0115.138] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x2dd, lpOverlapped=0x0) returned 1 [0115.146] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0115.147] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.147] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.147] SetEndOfFile (hFile=0x210) returned 1 [0115.147] CloseHandle (hObject=0x210) returned 1 [0115.147] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.147] SetEndOfFile (hFile=0x1b8) returned 1 [0115.148] CloseHandle (hObject=0x1b8) returned 1 [0115.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 1 [0115.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.149] lstrlenW (lpString=".doc") returned 4 [0115.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.149] lstrlenW (lpString=".docx") returned 5 [0115.149] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0115.149] lstrlenW (lpString=".pdf") returned 4 [0115.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.149] lstrlenW (lpString=".xls") returned 4 [0115.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.149] lstrlenW (lpString=".xlsx") returned 5 [0115.149] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0115.149] lstrlenW (lpString=".ppt") returned 4 [0115.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.149] lstrlenW (lpString=".zip") returned 4 [0115.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.149] lstrlenW (lpString=".rar") returned 4 [0115.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.149] lstrlenW (lpString=".bz2") returned 4 [0115.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.149] lstrlenW (lpString=".7z") returned 3 [0115.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.149] lstrlenW (lpString=".dbf") returned 4 [0115.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.150] lstrlenW (lpString=".1cd") returned 4 [0115.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 76 [0115.150] lstrlenW (lpString=".jpg") returned 4 [0115.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.150] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") [0115.150] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1429) returned 1 [0115.150] CloseHandle (hObject=0x1b8) returned 1 [0115.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 0x20 [0115.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.151] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.151] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.151] GetLastError () returned 0x0 [0115.151] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x595, lpOverlapped=0x0) returned 1 [0115.153] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0115.154] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.154] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.154] SetEndOfFile (hFile=0x210) returned 1 [0115.154] CloseHandle (hObject=0x210) returned 1 [0115.154] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.154] SetEndOfFile (hFile=0x1b8) returned 1 [0115.155] CloseHandle (hObject=0x1b8) returned 1 [0115.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 1 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString=".doc") returned 4 [0115.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.156] lstrlenW (lpString=".docx") returned 5 [0115.156] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0115.156] lstrlenW (lpString=".pdf") returned 4 [0115.156] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.156] lstrlenW (lpString=".xls") returned 4 [0115.156] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.156] lstrlenW (lpString=".xlsx") returned 5 [0115.156] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0115.156] lstrlenW (lpString=".ppt") returned 4 [0115.156] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString=".zip") returned 4 [0115.156] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.156] lstrlenW (lpString=".rar") returned 4 [0115.156] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.156] lstrlenW (lpString=".bz2") returned 4 [0115.156] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.156] lstrlenW (lpString=".7z") returned 3 [0115.156] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString=".dbf") returned 4 [0115.156] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString=".1cd") returned 4 [0115.156] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 76 [0115.156] lstrlenW (lpString=".jpg") returned 4 [0115.156] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.157] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") [0115.158] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4561) returned 1 [0115.158] CloseHandle (hObject=0x1b8) returned 1 [0115.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 0x20 [0115.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.158] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.158] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.159] GetLastError () returned 0x0 [0115.159] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x11d1, lpOverlapped=0x0) returned 1 [0115.161] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x11e0, lpOverlapped=0x0) returned 1 [0115.162] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.162] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.162] SetEndOfFile (hFile=0x210) returned 1 [0115.162] CloseHandle (hObject=0x210) returned 1 [0115.162] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.162] SetEndOfFile (hFile=0x1b8) returned 1 [0115.163] CloseHandle (hObject=0x1b8) returned 1 [0115.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString=".doc") returned 4 [0115.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.164] lstrlenW (lpString=".docx") returned 5 [0115.164] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0115.164] lstrlenW (lpString=".pdf") returned 4 [0115.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.164] lstrlenW (lpString=".xls") returned 4 [0115.164] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.164] lstrlenW (lpString=".xlsx") returned 5 [0115.164] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0115.164] lstrlenW (lpString=".ppt") returned 4 [0115.164] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString=".zip") returned 4 [0115.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.164] lstrlenW (lpString=".rar") returned 4 [0115.164] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.164] lstrlenW (lpString=".bz2") returned 4 [0115.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.164] lstrlenW (lpString=".7z") returned 3 [0115.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString=".dbf") returned 4 [0115.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString=".1cd") returned 4 [0115.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 76 [0115.164] lstrlenW (lpString=".jpg") returned 4 [0115.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.164] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") [0115.165] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4899) returned 1 [0115.165] CloseHandle (hObject=0x1b8) returned 1 [0115.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 0x20 [0115.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.165] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.165] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.166] GetLastError () returned 0x0 [0115.166] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1323, lpOverlapped=0x0) returned 1 [0115.168] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0115.169] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.169] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.169] SetEndOfFile (hFile=0x210) returned 1 [0115.169] CloseHandle (hObject=0x210) returned 1 [0115.169] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.169] SetEndOfFile (hFile=0x1b8) returned 1 [0115.170] CloseHandle (hObject=0x1b8) returned 1 [0115.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.170] lstrlenW (lpString=".doc") returned 4 [0115.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.170] lstrlenW (lpString=".docx") returned 5 [0115.170] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0115.170] lstrlenW (lpString=".pdf") returned 4 [0115.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.171] lstrlenW (lpString=".xls") returned 4 [0115.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.171] lstrlenW (lpString=".xlsx") returned 5 [0115.171] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0115.171] lstrlenW (lpString=".ppt") returned 4 [0115.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.171] lstrlenW (lpString=".zip") returned 4 [0115.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.171] lstrlenW (lpString=".rar") returned 4 [0115.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.171] lstrlenW (lpString=".bz2") returned 4 [0115.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.171] lstrlenW (lpString=".7z") returned 3 [0115.171] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.171] lstrlenW (lpString=".dbf") returned 4 [0115.171] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.171] lstrlenW (lpString=".1cd") returned 4 [0115.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 76 [0115.171] lstrlenW (lpString=".jpg") returned 4 [0115.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.171] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") [0115.172] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1086) returned 1 [0115.172] CloseHandle (hObject=0x1b8) returned 1 [0115.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 0x20 [0115.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.172] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.172] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.173] GetLastError () returned 0x0 [0115.173] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x43e, lpOverlapped=0x0) returned 1 [0115.174] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.175] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.175] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.175] SetEndOfFile (hFile=0x210) returned 1 [0115.175] CloseHandle (hObject=0x210) returned 1 [0115.176] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.176] SetEndOfFile (hFile=0x1b8) returned 1 [0115.176] CloseHandle (hObject=0x1b8) returned 1 [0115.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 1 [0115.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.177] lstrlenW (lpString=".doc") returned 4 [0115.177] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.177] lstrlenW (lpString=".docx") returned 5 [0115.177] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0115.177] lstrlenW (lpString=".pdf") returned 4 [0115.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.177] lstrlenW (lpString=".xls") returned 4 [0115.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.177] lstrlenW (lpString=".xlsx") returned 5 [0115.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0115.177] lstrlenW (lpString=".ppt") returned 4 [0115.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.177] lstrlenW (lpString=".zip") returned 4 [0115.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.177] lstrlenW (lpString=".rar") returned 4 [0115.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.177] lstrlenW (lpString=".bz2") returned 4 [0115.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.177] lstrlenW (lpString=".7z") returned 3 [0115.177] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.177] lstrlenW (lpString=".dbf") returned 4 [0115.177] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.178] lstrlenW (lpString=".1cd") returned 4 [0115.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 76 [0115.178] lstrlenW (lpString=".jpg") returned 4 [0115.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.178] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") [0115.178] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1042) returned 1 [0115.178] CloseHandle (hObject=0x1b8) returned 1 [0115.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 0x20 [0115.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.179] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.179] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.179] GetLastError () returned 0x0 [0115.179] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x412, lpOverlapped=0x0) returned 1 [0115.357] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x420, lpOverlapped=0x0) returned 1 [0115.358] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.358] WriteFile (in: hFile=0x210, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.358] SetEndOfFile (hFile=0x210) returned 1 [0115.358] CloseHandle (hObject=0x210) returned 1 [0115.358] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.358] SetEndOfFile (hFile=0x1b8) returned 1 [0115.359] CloseHandle (hObject=0x1b8) returned 1 [0115.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 1 [0115.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.416] lstrlenW (lpString=".doc") returned 4 [0115.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.416] lstrlenW (lpString=".docx") returned 5 [0115.416] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0115.416] lstrlenW (lpString=".pdf") returned 4 [0115.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.416] lstrlenW (lpString=".xls") returned 4 [0115.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.416] lstrlenW (lpString=".xlsx") returned 5 [0115.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0115.416] lstrlenW (lpString=".ppt") returned 4 [0115.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.416] lstrlenW (lpString=".zip") returned 4 [0115.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".rar") returned 4 [0115.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".bz2") returned 4 [0115.418] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.418] lstrlenW (lpString=".7z") returned 3 [0115.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.427] lstrlenW (lpString=".dbf") returned 4 [0115.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.427] lstrlenW (lpString=".1cd") returned 4 [0115.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 76 [0115.434] lstrlenW (lpString=".jpg") returned 4 [0115.434] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.440] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") [0115.444] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2431) returned 1 [0115.444] CloseHandle (hObject=0x22c) returned 1 [0115.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 0x20 [0115.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.445] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.445] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.446] GetLastError () returned 0x0 [0115.446] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x97f, lpOverlapped=0x0) returned 1 [0115.447] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x980, lpOverlapped=0x0) returned 1 [0115.448] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.448] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.448] SetEndOfFile (hFile=0x1c0) returned 1 [0115.448] CloseHandle (hObject=0x1c0) returned 1 [0115.448] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.448] SetEndOfFile (hFile=0x22c) returned 1 [0115.449] CloseHandle (hObject=0x22c) returned 1 [0115.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 1 [0115.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.450] lstrlenW (lpString=".doc") returned 4 [0115.450] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.450] lstrlenW (lpString=".docx") returned 5 [0115.450] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.450] lstrlenW (lpString=".pdf") returned 4 [0115.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".xls") returned 4 [0115.450] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".xlsx") returned 5 [0115.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.450] lstrlenW (lpString=".ppt") returned 4 [0115.450] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.450] lstrlenW (lpString=".zip") returned 4 [0115.450] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".rar") returned 4 [0115.450] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".bz2") returned 4 [0115.450] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.450] lstrlenW (lpString=".7z") returned 3 [0115.450] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.450] lstrlenW (lpString=".dbf") returned 4 [0115.450] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.450] lstrlenW (lpString=".1cd") returned 4 [0115.450] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.450] lstrlenW (lpString=".jpg") returned 4 [0115.450] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".pdf") returned 4 [0115.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.450] lstrlenW (lpString=".xls") returned 4 [0115.451] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.451] lstrlenW (lpString=".xlsx") returned 5 [0115.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.451] lstrlenW (lpString=".ppt") returned 4 [0115.451] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.451] lstrlenW (lpString=".zip") returned 4 [0115.451] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.451] lstrlenW (lpString=".rar") returned 4 [0115.451] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.451] lstrlenW (lpString=".bz2") returned 4 [0115.451] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.451] lstrlenW (lpString=".7z") returned 3 [0115.451] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.451] lstrlenW (lpString=".dbf") returned 4 [0115.451] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.451] lstrlenW (lpString=".1cd") returned 4 [0115.451] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 76 [0115.451] lstrlenW (lpString=".jpg") returned 4 [0115.451] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.451] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") [0115.452] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1401) returned 1 [0115.452] CloseHandle (hObject=0x22c) returned 1 [0115.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 0x20 [0115.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.453] GetLastError () returned 0x0 [0115.453] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x579, lpOverlapped=0x0) returned 1 [0115.454] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x580, lpOverlapped=0x0) returned 1 [0115.455] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.455] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.455] SetEndOfFile (hFile=0x1c0) returned 1 [0115.456] CloseHandle (hObject=0x1c0) returned 1 [0115.456] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.456] SetEndOfFile (hFile=0x22c) returned 1 [0115.456] CloseHandle (hObject=0x22c) returned 1 [0115.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 1 [0115.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.457] lstrlenW (lpString=".doc") returned 4 [0115.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.457] lstrlenW (lpString=".docx") returned 5 [0115.457] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.457] lstrlenW (lpString=".pdf") returned 4 [0115.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.457] lstrlenW (lpString=".xls") returned 4 [0115.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.457] lstrlenW (lpString=".xlsx") returned 5 [0115.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.457] lstrlenW (lpString=".ppt") returned 4 [0115.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.457] lstrlenW (lpString=".zip") returned 4 [0115.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.457] lstrlenW (lpString=".rar") returned 4 [0115.457] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.457] lstrlenW (lpString=".bz2") returned 4 [0115.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.457] lstrlenW (lpString=".7z") returned 3 [0115.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".dbf") returned 4 [0115.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".1cd") returned 4 [0115.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".jpg") returned 4 [0115.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString=".pdf") returned 4 [0115.458] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString=".xls") returned 4 [0115.458] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString=".xlsx") returned 5 [0115.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.458] lstrlenW (lpString=".ppt") returned 4 [0115.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".zip") returned 4 [0115.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString=".rar") returned 4 [0115.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.458] lstrlenW (lpString=".bz2") returned 4 [0115.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.458] lstrlenW (lpString=".7z") returned 3 [0115.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".dbf") returned 4 [0115.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".1cd") returned 4 [0115.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 76 [0115.458] lstrlenW (lpString=".jpg") returned 4 [0115.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.459] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") [0115.459] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19132) returned 1 [0115.459] CloseHandle (hObject=0x22c) returned 1 [0115.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 0x20 [0115.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.459] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.460] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.460] GetLastError () returned 0x0 [0115.460] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x4abc, lpOverlapped=0x0) returned 1 [0115.462] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x4ac0, lpOverlapped=0x0) returned 1 [0115.464] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.464] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.464] SetEndOfFile (hFile=0x1c0) returned 1 [0115.464] CloseHandle (hObject=0x1c0) returned 1 [0115.464] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.464] SetEndOfFile (hFile=0x22c) returned 1 [0115.465] CloseHandle (hObject=0x22c) returned 1 [0115.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 1 [0115.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.465] lstrlenW (lpString=".doc") returned 4 [0115.465] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.465] lstrlenW (lpString=".docx") returned 5 [0115.465] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.465] lstrlenW (lpString=".pdf") returned 4 [0115.465] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.465] lstrlenW (lpString=".xls") returned 4 [0115.466] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString=".xlsx") returned 5 [0115.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.466] lstrlenW (lpString=".ppt") returned 4 [0115.466] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.466] lstrlenW (lpString=".zip") returned 4 [0115.466] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString=".rar") returned 4 [0115.466] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString=".bz2") returned 4 [0115.466] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.466] lstrlenW (lpString=".7z") returned 3 [0115.466] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.466] lstrlenW (lpString=".dbf") returned 4 [0115.466] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.466] lstrlenW (lpString=".1cd") returned 4 [0115.466] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.466] lstrlenW (lpString=".jpg") returned 4 [0115.466] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString=".pdf") returned 4 [0115.466] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.466] lstrlenW (lpString=".xls") returned 4 [0115.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.467] lstrlenW (lpString=".xlsx") returned 5 [0115.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.467] lstrlenW (lpString=".ppt") returned 4 [0115.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.467] lstrlenW (lpString=".zip") returned 4 [0115.467] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.467] lstrlenW (lpString=".rar") returned 4 [0115.467] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.467] lstrlenW (lpString=".bz2") returned 4 [0115.467] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.467] lstrlenW (lpString=".7z") returned 3 [0115.467] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.467] lstrlenW (lpString=".dbf") returned 4 [0115.467] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.467] lstrlenW (lpString=".1cd") returned 4 [0115.467] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 76 [0115.467] lstrlenW (lpString=".jpg") returned 4 [0115.467] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.467] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") [0115.468] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5715) returned 1 [0115.468] CloseHandle (hObject=0x22c) returned 1 [0115.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 0x20 [0115.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.468] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.468] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.469] GetLastError () returned 0x0 [0115.469] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1653, lpOverlapped=0x0) returned 1 [0115.470] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0115.471] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.471] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.472] SetEndOfFile (hFile=0x1c0) returned 1 [0115.472] CloseHandle (hObject=0x1c0) returned 1 [0115.472] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.472] SetEndOfFile (hFile=0x22c) returned 1 [0115.472] CloseHandle (hObject=0x22c) returned 1 [0115.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 1 [0115.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.475] lstrlenW (lpString=".doc") returned 4 [0115.475] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.475] lstrlenW (lpString=".docx") returned 5 [0115.475] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.475] lstrlenW (lpString=".pdf") returned 4 [0115.475] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.475] lstrlenW (lpString=".xls") returned 4 [0115.476] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".xlsx") returned 5 [0115.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.476] lstrlenW (lpString=".ppt") returned 4 [0115.476] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.476] lstrlenW (lpString=".zip") returned 4 [0115.476] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".rar") returned 4 [0115.476] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".bz2") returned 4 [0115.476] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.476] lstrlenW (lpString=".7z") returned 3 [0115.476] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.476] lstrlenW (lpString=".dbf") returned 4 [0115.476] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.476] lstrlenW (lpString=".1cd") returned 4 [0115.476] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.476] lstrlenW (lpString=".jpg") returned 4 [0115.476] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".pdf") returned 4 [0115.476] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".xls") returned 4 [0115.476] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString=".xlsx") returned 5 [0115.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.476] lstrlenW (lpString=".ppt") returned 4 [0115.476] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.476] lstrlenW (lpString=".zip") returned 4 [0115.477] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.477] lstrlenW (lpString=".rar") returned 4 [0115.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.477] lstrlenW (lpString=".bz2") returned 4 [0115.477] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.477] lstrlenW (lpString=".7z") returned 3 [0115.477] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.477] lstrlenW (lpString=".dbf") returned 4 [0115.477] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.477] lstrlenW (lpString=".1cd") returned 4 [0115.477] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 76 [0115.477] lstrlenW (lpString=".jpg") returned 4 [0115.477] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.477] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") [0115.478] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4971) returned 1 [0115.478] CloseHandle (hObject=0x22c) returned 1 [0115.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 0x20 [0115.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.479] GetLastError () returned 0x0 [0115.479] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x136b, lpOverlapped=0x0) returned 1 [0115.506] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0115.507] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.507] WriteFile (in: hFile=0x1c0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.507] SetEndOfFile (hFile=0x1c0) returned 1 [0115.889] CloseHandle (hObject=0x1c0) returned 1 [0115.889] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.889] SetEndOfFile (hFile=0x22c) returned 1 [0115.900] CloseHandle (hObject=0x22c) returned 1 [0115.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 1 [0115.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.900] lstrlenW (lpString=".doc") returned 4 [0115.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.900] lstrlenW (lpString=".docx") returned 5 [0115.900] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.900] lstrlenW (lpString=".pdf") returned 4 [0115.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.900] lstrlenW (lpString=".xls") returned 4 [0115.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".xlsx") returned 5 [0115.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.901] lstrlenW (lpString=".ppt") returned 4 [0115.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.901] lstrlenW (lpString=".zip") returned 4 [0115.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".rar") returned 4 [0115.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".bz2") returned 4 [0115.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.901] lstrlenW (lpString=".7z") returned 3 [0115.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.901] lstrlenW (lpString=".dbf") returned 4 [0115.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.901] lstrlenW (lpString=".1cd") returned 4 [0115.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.901] lstrlenW (lpString=".jpg") returned 4 [0115.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".pdf") returned 4 [0115.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".xls") returned 4 [0115.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.901] lstrlenW (lpString=".xlsx") returned 5 [0115.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.901] lstrlenW (lpString=".ppt") returned 4 [0115.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.902] lstrlenW (lpString=".zip") returned 4 [0115.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.902] lstrlenW (lpString=".rar") returned 4 [0115.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.902] lstrlenW (lpString=".bz2") returned 4 [0115.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.902] lstrlenW (lpString=".7z") returned 3 [0115.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.902] lstrlenW (lpString=".dbf") returned 4 [0115.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.902] lstrlenW (lpString=".1cd") returned 4 [0115.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 76 [0115.902] lstrlenW (lpString=".jpg") returned 4 [0115.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.902] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") [0115.903] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=53418) returned 1 [0115.903] CloseHandle (hObject=0x22c) returned 1 [0115.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) returned 0x20 [0115.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.918] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.918] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.920] GetLastError () returned 0x0 [0115.920] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0xd0aa, lpOverlapped=0x0) returned 1 [0115.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xd0b0, lpOverlapped=0x0) returned 1 [0115.937] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0115.938] SetEndOfFile (hFile=0x1a0) returned 1 [0115.938] CloseHandle (hObject=0x1a0) returned 1 [0115.938] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.938] SetEndOfFile (hFile=0x22c) returned 1 [0115.939] CloseHandle (hObject=0x22c) returned 1 [0115.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) returned 1 [0115.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.939] lstrlenW (lpString=".doc") returned 4 [0115.939] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0115.939] lstrlenW (lpString=".docx") returned 5 [0115.940] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0115.940] lstrlenW (lpString=".pdf") returned 4 [0115.940] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString=".xls") returned 4 [0115.940] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString=".xlsx") returned 5 [0115.940] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0115.940] lstrlenW (lpString=".ppt") returned 4 [0115.940] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.940] lstrlenW (lpString=".zip") returned 4 [0115.940] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString=".rar") returned 4 [0115.940] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString=".bz2") returned 4 [0115.940] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString=".7z") returned 3 [0115.940] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0115.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.940] lstrlenW (lpString=".dbf") returned 4 [0115.940] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.940] lstrlenW (lpString=".1cd") returned 4 [0115.940] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0115.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 67 [0115.940] lstrlenW (lpString=".jpg") returned 4 [0115.940] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0115.940] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") [0115.941] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=259111) returned 1 [0115.941] CloseHandle (hObject=0x22c) returned 1 [0115.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) returned 0x20 [0115.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.941] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.941] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.942] GetLastError () returned 0x0 [0115.942] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3f427, lpOverlapped=0x0) returned 1 [0116.008] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3f430, lpOverlapped=0x0) returned 1 [0116.014] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.014] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.014] SetEndOfFile (hFile=0x1a0) returned 1 [0116.014] CloseHandle (hObject=0x1a0) returned 1 [0116.014] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.014] SetEndOfFile (hFile=0x22c) returned 1 [0116.017] CloseHandle (hObject=0x22c) returned 1 [0116.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) returned 1 [0116.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.017] lstrlenW (lpString=".doc") returned 4 [0116.017] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.017] lstrlenW (lpString=".docx") returned 5 [0116.017] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.017] lstrlenW (lpString=".pdf") returned 4 [0116.017] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.017] lstrlenW (lpString=".xls") returned 4 [0116.017] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.017] lstrlenW (lpString=".xlsx") returned 5 [0116.017] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.017] lstrlenW (lpString=".ppt") returned 4 [0116.017] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.017] lstrlenW (lpString=".zip") returned 4 [0116.018] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.018] lstrlenW (lpString=".rar") returned 4 [0116.018] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.018] lstrlenW (lpString=".bz2") returned 4 [0116.018] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.018] lstrlenW (lpString=".7z") returned 3 [0116.018] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.018] lstrlenW (lpString=".dbf") returned 4 [0116.018] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.018] lstrlenW (lpString=".1cd") returned 4 [0116.018] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 62 [0116.018] lstrlenW (lpString=".jpg") returned 4 [0116.018] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.018] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") [0116.019] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=95803) returned 1 [0116.019] CloseHandle (hObject=0x22c) returned 1 [0116.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) returned 0x20 [0116.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0116.019] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.019] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0116.020] GetLastError () returned 0x0 [0116.020] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1763b, lpOverlapped=0x0) returned 1 [0116.299] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x17640, lpOverlapped=0x0) returned 1 [0116.301] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.301] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.302] SetEndOfFile (hFile=0x1a0) returned 1 [0116.302] CloseHandle (hObject=0x1a0) returned 1 [0116.302] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.302] SetEndOfFile (hFile=0x22c) returned 1 [0116.303] CloseHandle (hObject=0x22c) returned 1 [0116.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) returned 1 [0116.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.304] lstrlenW (lpString=".doc") returned 4 [0116.304] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".docx") returned 5 [0116.304] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.304] lstrlenW (lpString=".pdf") returned 4 [0116.304] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".xls") returned 4 [0116.304] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".xlsx") returned 5 [0116.304] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.304] lstrlenW (lpString=".ppt") returned 4 [0116.304] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.304] lstrlenW (lpString=".zip") returned 4 [0116.304] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".rar") returned 4 [0116.304] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".bz2") returned 4 [0116.304] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString=".7z") returned 3 [0116.304] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.304] lstrlenW (lpString=".dbf") returned 4 [0116.304] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.304] lstrlenW (lpString=".1cd") returned 4 [0116.304] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 64 [0116.304] lstrlenW (lpString=".jpg") returned 4 [0116.304] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.304] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") [0116.305] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=568653) returned 1 [0116.305] CloseHandle (hObject=0x22c) returned 1 [0116.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) returned 0x20 [0116.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0116.306] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.306] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0116.770] GetLastError () returned 0x0 [0116.770] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x8ad4d, lpOverlapped=0x0) returned 1 [0117.149] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x8ad50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x8ad50, lpOverlapped=0x0) returned 1 [0117.158] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.158] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.159] SetEndOfFile (hFile=0x1ec) returned 1 [0117.159] CloseHandle (hObject=0x1ec) returned 1 [0117.159] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.159] SetEndOfFile (hFile=0x22c) returned 1 [0117.164] CloseHandle (hObject=0x22c) returned 1 [0117.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) returned 1 [0117.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.164] lstrlenW (lpString=".doc") returned 4 [0117.164] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.164] lstrlenW (lpString=".docx") returned 5 [0117.164] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.164] lstrlenW (lpString=".pdf") returned 4 [0117.164] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.164] lstrlenW (lpString=".xls") returned 4 [0117.165] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString=".xlsx") returned 5 [0117.165] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.165] lstrlenW (lpString=".ppt") returned 4 [0117.165] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.165] lstrlenW (lpString=".zip") returned 4 [0117.165] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString=".rar") returned 4 [0117.165] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString=".bz2") returned 4 [0117.165] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString=".7z") returned 3 [0117.165] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.165] lstrlenW (lpString=".dbf") returned 4 [0117.165] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.165] lstrlenW (lpString=".1cd") returned 4 [0117.165] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 67 [0117.165] lstrlenW (lpString=".jpg") returned 4 [0117.165] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.165] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") [0117.167] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=69473) returned 1 [0117.168] CloseHandle (hObject=0x22c) returned 1 [0117.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) returned 0x20 [0117.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0117.172] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.172] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.174] GetLastError () returned 0x0 [0117.174] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x10f61, lpOverlapped=0x0) returned 1 [0117.211] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x10f70, lpOverlapped=0x0) returned 1 [0117.212] ReadFile (in: hFile=0x22c, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.212] WriteFile (in: hFile=0x1ec, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.213] SetEndOfFile (hFile=0x1ec) returned 1 [0117.213] CloseHandle (hObject=0x1ec) returned 1 [0117.213] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.213] SetEndOfFile (hFile=0x22c) returned 1 [0117.392] CloseHandle (hObject=0x22c) returned 1 [0117.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) returned 1 [0117.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.399] lstrlenW (lpString=".doc") returned 4 [0117.399] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.399] lstrlenW (lpString=".docx") returned 5 [0117.399] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.399] lstrlenW (lpString=".pdf") returned 4 [0117.400] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString=".xls") returned 4 [0117.400] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString=".xlsx") returned 5 [0117.400] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.400] lstrlenW (lpString=".ppt") returned 4 [0117.400] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.400] lstrlenW (lpString=".zip") returned 4 [0117.400] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString=".rar") returned 4 [0117.400] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString=".bz2") returned 4 [0117.400] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString=".7z") returned 3 [0117.400] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.400] lstrlenW (lpString=".dbf") returned 4 [0117.400] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.400] lstrlenW (lpString=".1cd") returned 4 [0117.400] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 64 [0117.400] lstrlenW (lpString=".jpg") returned 4 [0117.400] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.400] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") [0117.401] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=80625) returned 1 [0117.401] CloseHandle (hObject=0x1b8) returned 1 [0117.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx")) returned 0x20 [0117.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.401] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.401] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.402] GetLastError () returned 0x0 [0117.402] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x13af1, lpOverlapped=0x0) returned 1 [0117.406] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x13b00, lpOverlapped=0x0) returned 1 [0117.408] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.408] WriteFile (in: hFile=0x180, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0117.408] SetEndOfFile (hFile=0x180) returned 1 [0117.408] CloseHandle (hObject=0x180) returned 1 [0117.408] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.408] SetEndOfFile (hFile=0x1b8) returned 1 [0117.409] CloseHandle (hObject=0x1b8) returned 1 [0117.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx")) returned 1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.410] lstrlenW (lpString=".doc") returned 4 [0117.410] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".docx") returned 5 [0117.410] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.410] lstrlenW (lpString=".pdf") returned 4 [0117.410] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".xls") returned 4 [0117.410] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".xlsx") returned 5 [0117.410] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.410] lstrlenW (lpString=".ppt") returned 4 [0117.410] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.410] lstrlenW (lpString=".zip") returned 4 [0117.410] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".rar") returned 4 [0117.410] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".bz2") returned 4 [0117.410] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.410] lstrlenW (lpString=".7z") returned 3 [0117.410] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.411] lstrlenW (lpString=".dbf") returned 4 [0117.411] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.411] lstrlenW (lpString=".1cd") returned 4 [0117.411] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 63 [0117.411] lstrlenW (lpString=".jpg") returned 4 [0117.411] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.411] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") [0117.411] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=88122) returned 1 [0117.411] CloseHandle (hObject=0x1b8) returned 1 [0117.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx")) returned 0x20 [0117.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.412] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.412] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0117.413] GetLastError () returned 0x0 [0117.413] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x1583a, lpOverlapped=0x0) returned 1 [0117.417] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x15840, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x15840, lpOverlapped=0x0) returned 1 [0117.419] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.419] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.419] SetEndOfFile (hFile=0x1a0) returned 1 [0117.419] CloseHandle (hObject=0x1a0) returned 1 [0117.419] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.419] SetEndOfFile (hFile=0x1b8) returned 1 [0117.420] CloseHandle (hObject=0x1b8) returned 1 [0117.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx")) returned 1 [0117.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.421] lstrlenW (lpString=".doc") returned 4 [0117.421] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".docx") returned 5 [0117.421] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.421] lstrlenW (lpString=".pdf") returned 4 [0117.421] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".xls") returned 4 [0117.421] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".xlsx") returned 5 [0117.421] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.421] lstrlenW (lpString=".ppt") returned 4 [0117.421] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.421] lstrlenW (lpString=".zip") returned 4 [0117.421] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".rar") returned 4 [0117.421] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".bz2") returned 4 [0117.421] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString=".7z") returned 3 [0117.421] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.421] lstrlenW (lpString=".dbf") returned 4 [0117.421] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.421] lstrlenW (lpString=".1cd") returned 4 [0117.422] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 64 [0117.422] lstrlenW (lpString=".jpg") returned 4 [0117.422] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.422] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") [0117.422] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=617159) returned 1 [0117.422] CloseHandle (hObject=0x1b8) returned 1 [0117.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx")) returned 0x20 [0117.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.423] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.423] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0117.423] GetLastError () returned 0x0 [0117.423] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x96ac7, lpOverlapped=0x0) returned 1 [0117.437] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x96ad0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x96ad0, lpOverlapped=0x0) returned 1 [0117.602] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.602] SetEndOfFile (hFile=0x1a0) returned 1 [0117.602] CloseHandle (hObject=0x1a0) returned 1 [0117.602] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.602] SetEndOfFile (hFile=0x1b8) returned 1 [0117.608] CloseHandle (hObject=0x1b8) returned 1 [0117.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx")) returned 1 [0117.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.608] lstrlenW (lpString=".doc") returned 4 [0117.608] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.608] lstrlenW (lpString=".docx") returned 5 [0117.608] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.608] lstrlenW (lpString=".pdf") returned 4 [0117.608] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.608] lstrlenW (lpString=".xls") returned 4 [0117.608] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.608] lstrlenW (lpString=".xlsx") returned 5 [0117.608] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.608] lstrlenW (lpString=".ppt") returned 4 [0117.608] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.608] lstrlenW (lpString=".zip") returned 4 [0117.608] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.608] lstrlenW (lpString=".rar") returned 4 [0117.609] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.609] lstrlenW (lpString=".bz2") returned 4 [0117.609] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.609] lstrlenW (lpString=".7z") returned 3 [0117.609] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.609] lstrlenW (lpString=".dbf") returned 4 [0117.609] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.609] lstrlenW (lpString=".1cd") returned 4 [0117.609] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 67 [0117.609] lstrlenW (lpString=".jpg") returned 4 [0117.609] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.609] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") [0117.610] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=67304) returned 1 [0117.610] CloseHandle (hObject=0x1b8) returned 1 [0117.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx")) returned 0x20 [0117.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.611] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.611] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0117.612] GetLastError () returned 0x0 [0117.612] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x106e8, lpOverlapped=0x0) returned 1 [0117.615] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x106f0, lpOverlapped=0x0) returned 1 [0117.616] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.616] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0117.617] SetEndOfFile (hFile=0x1a0) returned 1 [0117.617] CloseHandle (hObject=0x1a0) returned 1 [0117.617] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.617] SetEndOfFile (hFile=0x1b8) returned 1 [0117.618] CloseHandle (hObject=0x1b8) returned 1 [0117.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx")) returned 1 [0117.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.618] lstrlenW (lpString=".doc") returned 4 [0117.618] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.618] lstrlenW (lpString=".docx") returned 5 [0117.618] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.618] lstrlenW (lpString=".pdf") returned 4 [0117.618] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString=".xls") returned 4 [0117.619] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString=".xlsx") returned 5 [0117.619] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.619] lstrlenW (lpString=".ppt") returned 4 [0117.619] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.619] lstrlenW (lpString=".zip") returned 4 [0117.619] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString=".rar") returned 4 [0117.619] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString=".bz2") returned 4 [0117.619] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString=".7z") returned 3 [0117.619] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.619] lstrlenW (lpString=".dbf") returned 4 [0117.619] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.619] lstrlenW (lpString=".1cd") returned 4 [0117.619] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 68 [0117.619] lstrlenW (lpString=".jpg") returned 4 [0117.619] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.619] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") [0117.620] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=74912) returned 1 [0117.620] CloseHandle (hObject=0x1b8) returned 1 [0117.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx")) returned 0x20 [0117.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.620] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.621] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0117.621] GetLastError () returned 0x0 [0117.621] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x124a0, lpOverlapped=0x0) returned 1 [0117.624] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x124b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x124b0, lpOverlapped=0x0) returned 1 [0117.626] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0117.626] SetEndOfFile (hFile=0x1a0) returned 1 [0117.626] CloseHandle (hObject=0x1a0) returned 1 [0117.626] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.626] SetEndOfFile (hFile=0x1b8) returned 1 [0117.627] CloseHandle (hObject=0x1b8) returned 1 [0117.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx")) returned 1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.628] lstrlenW (lpString=".doc") returned 4 [0117.628] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".docx") returned 5 [0117.628] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.628] lstrlenW (lpString=".pdf") returned 4 [0117.628] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".xls") returned 4 [0117.628] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".xlsx") returned 5 [0117.628] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.628] lstrlenW (lpString=".ppt") returned 4 [0117.628] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.628] lstrlenW (lpString=".zip") returned 4 [0117.628] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".rar") returned 4 [0117.628] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".bz2") returned 4 [0117.628] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString=".7z") returned 3 [0117.628] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.628] lstrlenW (lpString=".dbf") returned 4 [0117.628] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.628] lstrlenW (lpString=".1cd") returned 4 [0117.629] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 66 [0117.629] lstrlenW (lpString=".jpg") returned 4 [0117.629] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.629] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") [0117.629] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=68995) returned 1 [0117.629] CloseHandle (hObject=0x1b8) returned 1 [0117.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx")) returned 0x20 [0117.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.630] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.630] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0117.631] GetLastError () returned 0x0 [0117.631] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x10d83, lpOverlapped=0x0) returned 1 [0117.887] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x10d90, lpOverlapped=0x0) returned 1 [0117.888] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.888] WriteFile (in: hFile=0x1a0, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.889] SetEndOfFile (hFile=0x1a0) returned 1 [0117.889] CloseHandle (hObject=0x1a0) returned 1 [0117.889] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.889] SetEndOfFile (hFile=0x1b8) returned 1 [0117.890] CloseHandle (hObject=0x1b8) returned 1 [0117.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx")) returned 1 [0117.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.890] lstrlenW (lpString=".doc") returned 4 [0117.890] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.890] lstrlenW (lpString=".docx") returned 5 [0117.890] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.891] lstrlenW (lpString=".pdf") returned 4 [0117.891] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString=".xls") returned 4 [0117.891] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString=".xlsx") returned 5 [0117.891] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.891] lstrlenW (lpString=".ppt") returned 4 [0117.891] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.891] lstrlenW (lpString=".zip") returned 4 [0117.891] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString=".rar") returned 4 [0117.891] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString=".bz2") returned 4 [0117.891] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString=".7z") returned 3 [0117.891] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.891] lstrlenW (lpString=".dbf") returned 4 [0117.891] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.891] lstrlenW (lpString=".1cd") returned 4 [0117.891] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 65 [0117.891] lstrlenW (lpString=".jpg") returned 4 [0117.891] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.891] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") [0118.221] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=961) returned 1 [0118.221] CloseHandle (hObject=0x1b8) returned 1 [0118.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml")) returned 0x20 [0118.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.237] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.244] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.256] GetLastError () returned 0x0 [0118.256] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c1, lpOverlapped=0x0) returned 1 [0118.257] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.258] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.258] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0118.258] SetEndOfFile (hFile=0x16c) returned 1 [0118.258] CloseHandle (hObject=0x16c) returned 1 [0118.259] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.259] SetEndOfFile (hFile=0x1b8) returned 1 [0118.260] CloseHandle (hObject=0x1b8) returned 1 [0118.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml")) returned 1 [0118.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.260] lstrlenW (lpString=".doc") returned 4 [0118.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.260] lstrlenW (lpString=".docx") returned 5 [0118.260] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0118.260] lstrlenW (lpString=".pdf") returned 4 [0118.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.260] lstrlenW (lpString=".xls") returned 4 [0118.260] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.260] lstrlenW (lpString=".xlsx") returned 5 [0118.260] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0118.260] lstrlenW (lpString=".ppt") returned 4 [0118.260] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.260] lstrlenW (lpString=".zip") returned 4 [0118.260] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.260] lstrlenW (lpString=".rar") returned 4 [0118.260] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.261] lstrlenW (lpString=".bz2") returned 4 [0118.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.261] lstrlenW (lpString=".7z") returned 3 [0118.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.261] lstrlenW (lpString=".dbf") returned 4 [0118.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.261] lstrlenW (lpString=".1cd") returned 4 [0118.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 76 [0118.261] lstrlenW (lpString=".jpg") returned 4 [0118.261] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.261] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") [0118.262] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=964) returned 1 [0118.262] CloseHandle (hObject=0x1b8) returned 1 [0118.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml")) returned 0x20 [0118.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.262] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.262] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.263] GetLastError () returned 0x0 [0118.263] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.264] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.265] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.265] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.265] SetEndOfFile (hFile=0x16c) returned 1 [0118.265] CloseHandle (hObject=0x16c) returned 1 [0118.265] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.265] SetEndOfFile (hFile=0x1b8) returned 1 [0118.266] CloseHandle (hObject=0x1b8) returned 1 [0118.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml")) returned 1 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.266] lstrlenW (lpString=".doc") returned 4 [0118.266] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString=".docx") returned 5 [0118.267] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0118.267] lstrlenW (lpString=".pdf") returned 4 [0118.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString=".xls") returned 4 [0118.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString=".xlsx") returned 5 [0118.267] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0118.267] lstrlenW (lpString=".ppt") returned 4 [0118.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.267] lstrlenW (lpString=".zip") returned 4 [0118.267] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.267] lstrlenW (lpString=".rar") returned 4 [0118.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString=".bz2") returned 4 [0118.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString=".7z") returned 3 [0118.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.267] lstrlenW (lpString=".dbf") returned 4 [0118.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.267] lstrlenW (lpString=".1cd") returned 4 [0118.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 79 [0118.267] lstrlenW (lpString=".jpg") returned 4 [0118.267] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.267] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") [0118.268] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=961) returned 1 [0118.268] CloseHandle (hObject=0x1b8) returned 1 [0118.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml")) returned 0x20 [0118.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.268] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.268] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.270] GetLastError () returned 0x0 [0118.270] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c1, lpOverlapped=0x0) returned 1 [0118.272] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.273] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.273] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0118.273] SetEndOfFile (hFile=0x16c) returned 1 [0118.273] CloseHandle (hObject=0x16c) returned 1 [0118.273] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.273] SetEndOfFile (hFile=0x1b8) returned 1 [0118.274] CloseHandle (hObject=0x1b8) returned 1 [0118.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml")) returned 1 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString=".doc") returned 4 [0118.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString=".docx") returned 5 [0118.275] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0118.275] lstrlenW (lpString=".pdf") returned 4 [0118.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString=".xls") returned 4 [0118.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString=".xlsx") returned 5 [0118.275] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0118.275] lstrlenW (lpString=".ppt") returned 4 [0118.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString=".zip") returned 4 [0118.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.275] lstrlenW (lpString=".rar") returned 4 [0118.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString=".bz2") returned 4 [0118.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString=".7z") returned 3 [0118.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString=".dbf") returned 4 [0118.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString=".1cd") returned 4 [0118.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 76 [0118.275] lstrlenW (lpString=".jpg") returned 4 [0118.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.276] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") [0118.276] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=928) returned 1 [0118.276] CloseHandle (hObject=0x1b8) returned 1 [0118.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml")) returned 0x20 [0118.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.277] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.277] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.277] GetLastError () returned 0x0 [0118.277] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3a0, lpOverlapped=0x0) returned 1 [0118.279] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0118.280] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.280] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.280] SetEndOfFile (hFile=0x16c) returned 1 [0118.280] CloseHandle (hObject=0x16c) returned 1 [0118.280] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.280] SetEndOfFile (hFile=0x1b8) returned 1 [0118.281] CloseHandle (hObject=0x1b8) returned 1 [0118.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml")) returned 1 [0118.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.281] lstrlenW (lpString=".doc") returned 4 [0118.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.281] lstrlenW (lpString=".docx") returned 5 [0118.281] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0118.281] lstrlenW (lpString=".pdf") returned 4 [0118.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.281] lstrlenW (lpString=".xls") returned 4 [0118.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString=".xlsx") returned 5 [0118.282] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0118.282] lstrlenW (lpString=".ppt") returned 4 [0118.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.282] lstrlenW (lpString=".zip") returned 4 [0118.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.282] lstrlenW (lpString=".rar") returned 4 [0118.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString=".bz2") returned 4 [0118.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString=".7z") returned 3 [0118.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.282] lstrlenW (lpString=".dbf") returned 4 [0118.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.282] lstrlenW (lpString=".1cd") returned 4 [0118.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 79 [0118.282] lstrlenW (lpString=".jpg") returned 4 [0118.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.282] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") [0118.283] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=964) returned 1 [0118.283] CloseHandle (hObject=0x1b8) returned 1 [0118.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml")) returned 0x20 [0118.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.283] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.283] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.284] GetLastError () returned 0x0 [0118.284] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.453] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.454] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.454] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.454] SetEndOfFile (hFile=0x16c) returned 1 [0118.455] CloseHandle (hObject=0x16c) returned 1 [0118.455] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.455] SetEndOfFile (hFile=0x1b8) returned 1 [0118.458] CloseHandle (hObject=0x1b8) returned 1 [0118.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml")) returned 1 [0118.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.458] lstrlenW (lpString=".doc") returned 4 [0118.458] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.458] lstrlenW (lpString=".docx") returned 5 [0118.458] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.458] lstrlenW (lpString=".pdf") returned 4 [0118.458] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.458] lstrlenW (lpString=".xls") returned 4 [0118.459] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString=".xlsx") returned 5 [0118.459] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.459] lstrlenW (lpString=".ppt") returned 4 [0118.459] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.459] lstrlenW (lpString=".zip") returned 4 [0118.459] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.459] lstrlenW (lpString=".rar") returned 4 [0118.459] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString=".bz2") returned 4 [0118.459] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString=".7z") returned 3 [0118.459] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.459] lstrlenW (lpString=".dbf") returned 4 [0118.459] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.459] lstrlenW (lpString=".1cd") returned 4 [0118.459] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 79 [0118.459] lstrlenW (lpString=".jpg") returned 4 [0118.459] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.459] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") [0118.460] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=962) returned 1 [0118.460] CloseHandle (hObject=0x1b8) returned 1 [0118.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml")) returned 0x20 [0118.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.460] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.460] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.461] GetLastError () returned 0x0 [0118.461] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c2, lpOverlapped=0x0) returned 1 [0118.463] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.464] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.464] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.464] SetEndOfFile (hFile=0x16c) returned 1 [0118.464] CloseHandle (hObject=0x16c) returned 1 [0118.464] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.464] SetEndOfFile (hFile=0x1b8) returned 1 [0118.465] CloseHandle (hObject=0x1b8) returned 1 [0118.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml")) returned 1 [0118.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.465] lstrlenW (lpString=".doc") returned 4 [0118.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.465] lstrlenW (lpString=".docx") returned 5 [0118.465] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0118.465] lstrlenW (lpString=".pdf") returned 4 [0118.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.465] lstrlenW (lpString=".xls") returned 4 [0118.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.465] lstrlenW (lpString=".xlsx") returned 5 [0118.465] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0118.466] lstrlenW (lpString=".ppt") returned 4 [0118.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.466] lstrlenW (lpString=".zip") returned 4 [0118.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.466] lstrlenW (lpString=".rar") returned 4 [0118.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.466] lstrlenW (lpString=".bz2") returned 4 [0118.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.466] lstrlenW (lpString=".7z") returned 3 [0118.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.466] lstrlenW (lpString=".dbf") returned 4 [0118.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.466] lstrlenW (lpString=".1cd") returned 4 [0118.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 77 [0118.466] lstrlenW (lpString=".jpg") returned 4 [0118.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.466] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") [0118.467] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=965) returned 1 [0118.467] CloseHandle (hObject=0x1b8) returned 1 [0118.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml")) returned 0x20 [0118.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.467] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.467] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.468] GetLastError () returned 0x0 [0118.468] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x3c5, lpOverlapped=0x0) returned 1 [0118.469] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.470] ReadFile (in: hFile=0x1b8, lpBuffer=0x35f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.470] WriteFile (in: hFile=0x16c, lpBuffer=0x35f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x35f0020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0118.471] SetEndOfFile (hFile=0x16c) returned 1 [0118.471] CloseHandle (hObject=0x16c) returned 1 [0118.471] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.471] SetEndOfFile (hFile=0x1b8) returned 1 [0118.471] CloseHandle (hObject=0x1b8) returned 1 [0118.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml")) returned 1 [0118.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.472] lstrlenW (lpString=".doc") returned 4 [0118.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.472] lstrlenW (lpString=".docx") returned 5 [0118.472] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0118.472] lstrlenW (lpString=".pdf") returned 4 [0118.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.472] lstrlenW (lpString=".xls") returned 4 [0118.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.472] lstrlenW (lpString=".xlsx") returned 5 [0118.472] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0118.472] lstrlenW (lpString=".ppt") returned 4 [0118.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.472] lstrlenW (lpString=".zip") returned 4 [0118.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.472] lstrlenW (lpString=".rar") returned 4 [0118.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.472] lstrlenW (lpString=".bz2") returned 4 [0118.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.473] lstrlenW (lpString=".7z") returned 3 [0118.473] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.473] lstrlenW (lpString=".dbf") returned 4 [0118.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.473] lstrlenW (lpString=".1cd") returned 4 [0118.473] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 80 [0118.473] lstrlenW (lpString=".jpg") returned 4 [0118.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.473] RtlInitUnicodeStringEx (DestinationString=0x236fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") [0118.474] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=963) returned 1 [0118.474] CloseHandle (hObject=0x1b8) returned 1 [0118.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml")) returned 0x20 [0118.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0118.474] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.474] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x9c8 [0033.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x6a3c98 [0033.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3700048 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641150 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x641690 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641168 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3800020 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641180 [0033.715] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641180, Size=0x20) returned 0x629f70 [0033.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641180 [0033.715] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641180, Size=0x20) returned 0x629f48 [0033.716] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.716] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.716] Wow64DisableWow64FsRedirection (in: OldValue=0x2beff58 | out: OldValue=0x2beff58*=0x0) returned 1 [0033.716] lstrlenW (lpString="kernel32.dll") returned 12 [0033.716] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.716] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.716] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.716] Sleep (dwMilliseconds=0x64) [0033.882] lstrlenW (lpString="BCD") returned 3 [0033.882] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.882] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.882] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.882] lstrlenW (lpString=".doc") returned 4 [0033.882] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.882] lstrlenW (lpString=".docx") returned 5 [0033.882] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.882] lstrlenW (lpString=".pdf") returned 4 [0033.882] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.882] lstrlenW (lpString=".xls") returned 4 [0033.882] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.882] lstrlenW (lpString=".xlsx") returned 5 [0033.882] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.882] lstrlenW (lpString=".ppt") returned 4 [0033.882] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.882] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.882] lstrlenW (lpString=".zip") returned 4 [0033.882] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.882] lstrlenW (lpString=".rar") returned 4 [0033.882] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".bz2") returned 4 [0033.883] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".7z") returned 3 [0033.883] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString=".dbf") returned 4 [0033.883] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString=".1cd") returned 4 [0033.883] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString=".jpg") returned 4 [0033.883] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString=".doc") returned 4 [0033.883] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".docx") returned 5 [0033.883] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.883] lstrlenW (lpString=".pdf") returned 4 [0033.883] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".xls") returned 4 [0033.883] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".xlsx") returned 5 [0033.883] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.883] lstrlenW (lpString=".ppt") returned 4 [0033.883] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.883] lstrlenW (lpString=".zip") returned 4 [0033.883] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".rar") returned 4 [0033.883] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.883] lstrlenW (lpString=".bz2") returned 4 [0033.884] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.884] lstrlenW (lpString=".7z") returned 3 [0033.884] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.884] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.884] lstrlenW (lpString=".dbf") returned 4 [0033.884] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.884] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.884] lstrlenW (lpString=".1cd") returned 4 [0033.884] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.884] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.884] lstrlenW (lpString=".jpg") returned 4 [0033.884] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.884] lstrcmpiW (lpString1=".LOG1", lpString2=".zoh") returned -1 [0033.884] lstrlenW (lpString="BCD.LOG1") returned 8 [0033.884] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.884] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=0) returned 1 [0033.884] CloseHandle (hObject=0x174) returned 1 [0033.884] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.884] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.884] lstrlenW (lpString=".doc") returned 4 [0033.885] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".docx") returned 5 [0033.885] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.885] lstrlenW (lpString=".pdf") returned 4 [0033.885] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".xls") returned 4 [0033.885] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".xlsx") returned 5 [0033.885] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.885] lstrlenW (lpString=".ppt") returned 4 [0033.885] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.885] lstrlenW (lpString=".zip") returned 4 [0033.885] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".rar") returned 4 [0033.885] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".bz2") returned 4 [0033.885] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString=".7z") returned 3 [0033.885] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.885] lstrlenW (lpString=".dbf") returned 4 [0033.885] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.885] lstrlenW (lpString=".1cd") returned 4 [0033.885] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.885] lstrlenW (lpString=".jpg") returned 4 [0033.885] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.886] lstrlenW (lpString=".doc") returned 4 [0033.886] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".docx") returned 5 [0033.886] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.886] lstrlenW (lpString=".pdf") returned 4 [0033.886] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".xls") returned 4 [0033.886] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".xlsx") returned 5 [0033.886] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.886] lstrlenW (lpString=".ppt") returned 4 [0033.886] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.886] lstrlenW (lpString=".zip") returned 4 [0033.886] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".rar") returned 4 [0033.886] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".bz2") returned 4 [0033.886] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString=".7z") returned 3 [0033.886] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.886] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.886] lstrlenW (lpString=".dbf") returned 4 [0033.886] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.886] lstrlenW (lpString=".1cd") returned 4 [0033.886] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.886] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.886] lstrlenW (lpString=".jpg") returned 4 [0033.887] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.887] lstrcmpiW (lpString1=".LOG2", lpString2=".zoh") returned -1 [0033.887] lstrlenW (lpString="BCD.LOG2") returned 8 [0033.887] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.887] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=0) returned 1 [0033.887] CloseHandle (hObject=0x174) returned 1 [0033.887] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.887] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.887] lstrlenW (lpString=".doc") returned 4 [0033.887] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.887] lstrlenW (lpString=".docx") returned 5 [0033.887] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.887] lstrlenW (lpString=".pdf") returned 4 [0033.887] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.887] lstrlenW (lpString=".xls") returned 4 [0033.887] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.887] lstrlenW (lpString=".xlsx") returned 5 [0033.887] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.887] lstrlenW (lpString=".ppt") returned 4 [0033.887] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString=".zip") returned 4 [0033.888] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".rar") returned 4 [0033.888] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".bz2") returned 4 [0033.888] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".7z") returned 3 [0033.888] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString=".dbf") returned 4 [0033.888] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString=".1cd") returned 4 [0033.888] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString=".jpg") returned 4 [0033.888] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.888] lstrlenW (lpString=".doc") returned 4 [0033.888] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".docx") returned 5 [0033.888] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.888] lstrlenW (lpString=".pdf") returned 4 [0033.888] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".xls") returned 4 [0033.888] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.888] lstrlenW (lpString=".xlsx") returned 5 [0033.888] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.888] lstrlenW (lpString=".ppt") returned 4 [0033.888] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.889] lstrlenW (lpString=".zip") returned 4 [0033.889] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString=".rar") returned 4 [0033.889] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString=".bz2") returned 4 [0033.889] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString=".7z") returned 3 [0033.889] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.889] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.889] lstrlenW (lpString=".dbf") returned 4 [0033.889] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.889] lstrlenW (lpString=".1cd") returned 4 [0033.889] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.889] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.889] lstrlenW (lpString=".jpg") returned 4 [0033.889] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.889] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0033.889] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.889] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.889] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=89168) returned 1 [0033.889] CloseHandle (hObject=0x174) returned 1 [0033.890] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0033.890] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.890] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.890] lstrlenW (lpString=".doc") returned 4 [0033.890] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.890] lstrlenW (lpString=".docx") returned 5 [0033.890] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.890] lstrlenW (lpString=".pdf") returned 4 [0033.890] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.890] lstrlenW (lpString=".xls") returned 4 [0033.890] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.890] lstrlenW (lpString=".xlsx") returned 5 [0033.890] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.890] lstrlenW (lpString=".ppt") returned 4 [0033.890] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.890] lstrlenW (lpString=".zip") returned 4 [0033.890] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.890] lstrlenW (lpString=".rar") returned 4 [0033.890] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.890] lstrlenW (lpString=".bz2") returned 4 [0033.890] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.890] lstrlenW (lpString=".7z") returned 3 [0033.890] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.890] lstrlenW (lpString=".dbf") returned 4 [0033.890] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString=".1cd") returned 4 [0033.891] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString=".jpg") returned 4 [0033.891] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString=".doc") returned 4 [0033.891] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString=".docx") returned 5 [0033.891] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.891] lstrlenW (lpString=".pdf") returned 4 [0033.891] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.891] lstrlenW (lpString=".xls") returned 4 [0033.891] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.891] lstrlenW (lpString=".xlsx") returned 5 [0033.891] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.891] lstrlenW (lpString=".ppt") returned 4 [0033.891] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString=".zip") returned 4 [0033.891] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.891] lstrlenW (lpString=".rar") returned 4 [0033.891] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.891] lstrlenW (lpString=".bz2") returned 4 [0033.891] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString=".7z") returned 3 [0033.891] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.891] lstrlenW (lpString=".dbf") returned 4 [0033.891] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.892] lstrlenW (lpString=".1cd") returned 4 [0033.892] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.892] lstrlenW (lpString=".jpg") returned 4 [0033.892] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.892] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0033.892] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.892] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.892] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=87616) returned 1 [0033.892] CloseHandle (hObject=0x174) returned 1 [0033.892] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0033.892] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.892] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.892] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.892] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.892] lstrlenW (lpString=".doc") returned 4 [0033.893] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.893] lstrlenW (lpString=".docx") returned 5 [0033.893] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.893] lstrlenW (lpString=".pdf") returned 4 [0033.893] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.893] lstrlenW (lpString=".xls") returned 4 [0033.893] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.893] lstrlenW (lpString=".xlsx") returned 5 [0033.893] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.893] lstrlenW (lpString=".ppt") returned 4 [0033.893] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString=".zip") returned 4 [0033.893] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.893] lstrlenW (lpString=".rar") returned 4 [0033.893] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.893] lstrlenW (lpString=".bz2") returned 4 [0033.893] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.893] lstrlenW (lpString=".7z") returned 3 [0033.893] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString=".dbf") returned 4 [0033.893] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString=".1cd") returned 4 [0033.893] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString=".jpg") returned 4 [0033.893] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.893] lstrlenW (lpString=".doc") returned 4 [0033.894] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.894] lstrlenW (lpString=".docx") returned 5 [0033.894] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.894] lstrlenW (lpString=".pdf") returned 4 [0033.894] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.894] lstrlenW (lpString=".xls") returned 4 [0033.894] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.894] lstrlenW (lpString=".xlsx") returned 5 [0033.894] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.894] lstrlenW (lpString=".ppt") returned 4 [0033.894] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.894] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.894] lstrlenW (lpString=".zip") returned 4 [0033.894] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.894] lstrlenW (lpString=".rar") returned 4 [0033.894] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.894] lstrlenW (lpString=".bz2") returned 4 [0033.894] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.894] lstrlenW (lpString=".7z") returned 3 [0033.894] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.894] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.894] lstrlenW (lpString=".dbf") returned 4 [0033.894] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.894] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.894] lstrlenW (lpString=".1cd") returned 4 [0033.894] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.894] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.895] lstrlenW (lpString=".jpg") returned 4 [0033.895] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.895] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0033.895] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.895] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.895] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=91712) returned 1 [0033.895] CloseHandle (hObject=0x174) returned 1 [0033.895] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0033.895] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.895] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.895] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.895] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.895] lstrlenW (lpString=".doc") returned 4 [0033.895] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.895] lstrlenW (lpString=".docx") returned 5 [0033.895] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.896] lstrlenW (lpString=".pdf") returned 4 [0033.896] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.896] lstrlenW (lpString=".xls") returned 4 [0033.896] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.896] lstrlenW (lpString=".xlsx") returned 5 [0033.896] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.896] lstrlenW (lpString=".ppt") returned 4 [0033.896] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString=".zip") returned 4 [0033.896] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.896] lstrlenW (lpString=".rar") returned 4 [0033.896] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.896] lstrlenW (lpString=".bz2") returned 4 [0033.896] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.896] lstrlenW (lpString=".7z") returned 3 [0033.896] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString=".dbf") returned 4 [0033.896] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString=".1cd") returned 4 [0033.896] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString=".jpg") returned 4 [0033.896] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.896] lstrlenW (lpString=".doc") returned 4 [0033.896] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.896] lstrlenW (lpString=".docx") returned 5 [0033.896] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.897] lstrlenW (lpString=".pdf") returned 4 [0033.897] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.897] lstrlenW (lpString=".xls") returned 4 [0033.897] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.897] lstrlenW (lpString=".xlsx") returned 5 [0033.897] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.897] lstrlenW (lpString=".ppt") returned 4 [0033.897] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.897] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.897] lstrlenW (lpString=".zip") returned 4 [0033.897] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.897] lstrlenW (lpString=".rar") returned 4 [0033.897] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.897] lstrlenW (lpString=".bz2") returned 4 [0033.897] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.897] lstrlenW (lpString=".7z") returned 3 [0033.897] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.897] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.897] lstrlenW (lpString=".dbf") returned 4 [0033.897] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.897] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.897] lstrlenW (lpString=".1cd") returned 4 [0033.897] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.897] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.897] lstrlenW (lpString=".jpg") returned 4 [0033.897] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.897] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0033.897] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.897] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.898] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=94800) returned 1 [0033.898] CloseHandle (hObject=0x174) returned 1 [0033.898] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0033.898] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.898] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.898] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.898] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.898] lstrlenW (lpString=".doc") returned 4 [0033.898] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.898] lstrlenW (lpString=".docx") returned 5 [0033.898] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.898] lstrlenW (lpString=".pdf") returned 4 [0033.898] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.898] lstrlenW (lpString=".xls") returned 4 [0033.898] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.898] lstrlenW (lpString=".xlsx") returned 5 [0033.898] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.898] lstrlenW (lpString=".ppt") returned 4 [0033.898] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.898] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.898] lstrlenW (lpString=".zip") returned 4 [0033.898] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.898] lstrlenW (lpString=".rar") returned 4 [0033.898] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.899] lstrlenW (lpString=".bz2") returned 4 [0033.899] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.899] lstrlenW (lpString=".7z") returned 3 [0033.899] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.899] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\en-US\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0033.899] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=85056) returned 1 [0033.899] CloseHandle (hObject=0x174) returned 1 [0033.899] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0033.899] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.899] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.899] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\en-US\\memtest.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0033.899] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=43600) returned 1 [0033.899] CloseHandle (hObject=0x174) returned 1 [0033.900] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0033.900] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.900] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.900] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\es-ES\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0033.900] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90192) returned 1 [0033.900] CloseHandle (hObject=0x174) returned 1 [0033.900] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0033.900] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.900] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.900] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0033.900] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=89152) returned 1 [0033.901] CloseHandle (hObject=0x174) returned 1 [0033.910] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0033.910] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.910] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.911] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\Fonts\\chs_boot.ttf", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0033.911] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3694080) returned 1 [0033.911] CloseHandle (hObject=0x174) returned 1 [0033.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0033.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.911] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0034.032] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\Fonts\\wgl4_boot.ttf", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.379] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=47452) returned 1 [0034.379] CloseHandle (hObject=0x190) returned 1 [0034.379] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0034.379] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.379] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.379] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.379] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=93248) returned 1 [0034.379] CloseHandle (hObject=0x190) returned 1 [0034.379] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0034.379] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.379] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.380] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.380] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90688) returned 1 [0034.380] CloseHandle (hObject=0x190) returned 1 [0034.380] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0034.380] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.380] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.380] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\it-IT\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.380] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90704) returned 1 [0034.380] CloseHandle (hObject=0x190) returned 1 [0034.380] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0034.381] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.381] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.381] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.381] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=76352) returned 1 [0034.381] CloseHandle (hObject=0x190) returned 1 [0034.381] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0034.381] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.381] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.381] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.381] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=75344) returned 1 [0034.381] CloseHandle (hObject=0x190) returned 1 [0034.381] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0034.382] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.382] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.382] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\memtest.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.382] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=485760) returned 1 [0034.382] CloseHandle (hObject=0x190) returned 1 [0034.382] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0034.382] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.382] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.382] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.383] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=88144) returned 1 [0034.383] CloseHandle (hObject=0x190) returned 1 [0034.383] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0034.383] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.383] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.383] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.383] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90704) returned 1 [0034.383] CloseHandle (hObject=0x190) returned 1 [0034.383] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0034.383] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.383] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.383] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.384] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90704) returned 1 [0034.384] CloseHandle (hObject=0x190) returned 1 [0034.384] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0034.384] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.384] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.384] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.384] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90176) returned 1 [0034.384] CloseHandle (hObject=0x190) returned 1 [0034.384] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0034.384] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.384] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.384] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.385] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=89664) returned 1 [0034.385] CloseHandle (hObject=0x190) returned 1 [0034.386] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0034.386] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.386] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.386] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.387] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=90192) returned 1 [0034.387] CloseHandle (hObject=0x190) returned 1 [0034.387] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0034.387] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.387] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.387] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.387] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=87616) returned 1 [0034.387] CloseHandle (hObject=0x190) returned 1 [0034.387] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0034.387] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.387] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.387] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.388] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=87104) returned 1 [0034.388] CloseHandle (hObject=0x190) returned 1 [0034.388] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0034.388] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.388] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.388] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.388] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=70720) returned 1 [0034.388] CloseHandle (hObject=0x190) returned 1 [0034.388] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0034.388] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.388] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.388] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.391] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=70224) returned 1 [0034.391] CloseHandle (hObject=0x190) returned 1 [0034.391] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0034.391] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.391] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.391] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.391] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=70208) returned 1 [0034.391] CloseHandle (hObject=0x190) returned 1 [0034.391] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0034.391] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.391] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.391] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\bootmgr", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.392] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=383786) returned 1 [0034.392] CloseHandle (hObject=0x190) returned 1 [0034.392] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0034.392] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\bootmgr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.392] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0034.392] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.392] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\hiberfil.sys", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.392] NtCreateFile (FileHandle=0x2befebc, DesiredAccess=0x80100080, ObjectAttributes=0x2befe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2befe88), IoStatusBlock=0x2befea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0034.392] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16972987) returned 1 [0034.392] CloseHandle (hObject=0x190) returned 1 [0034.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0034.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.393] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0034.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0034.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0034.394] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.400] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0034.400] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.410] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.410] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0034.410] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.806] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0034.806] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0034.820] SetEndOfFile (hFile=0x190) returned 1 [0034.820] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4008600 [0034.824] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0034.824] WriteFile (in: hFile=0x190, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.825] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0034.825] WriteFile (in: hFile=0x190, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.825] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0034.825] WriteFile (in: hFile=0x190, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.827] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0034.827] CloseHandle (hObject=0x190) returned 1 [0038.356] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0038.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString=".doc") returned 4 [0038.357] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString=".docx") returned 5 [0038.357] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.357] lstrlenW (lpString=".pdf") returned 4 [0038.357] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString=".xls") returned 4 [0038.357] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString=".xlsx") returned 5 [0038.357] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.357] lstrlenW (lpString=".ppt") returned 4 [0038.357] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString=".zip") returned 4 [0038.357] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString=".rar") returned 4 [0038.357] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString=".bz2") returned 4 [0038.357] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.357] lstrlenW (lpString=".7z") returned 3 [0038.357] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString=".dbf") returned 4 [0038.357] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString=".1cd") returned 4 [0038.357] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString=".jpg") returned 4 [0038.357] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.358] lstrlenW (lpString=".doc") returned 4 [0038.358] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString=".docx") returned 5 [0038.358] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.358] lstrlenW (lpString=".pdf") returned 4 [0038.358] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString=".xls") returned 4 [0038.358] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString=".xlsx") returned 5 [0038.358] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.358] lstrlenW (lpString=".ppt") returned 4 [0038.358] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.358] lstrlenW (lpString=".zip") returned 4 [0038.358] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString=".rar") returned 4 [0038.358] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString=".bz2") returned 4 [0038.358] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.358] lstrlenW (lpString=".7z") returned 3 [0038.358] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.358] lstrlenW (lpString=".dbf") returned 4 [0038.358] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.358] lstrlenW (lpString=".1cd") returned 4 [0038.358] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0038.358] lstrlenW (lpString=".jpg") returned 4 [0038.358] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.359] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0038.359] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0038.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0038.359] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2865664) returned 1 [0038.359] CloseHandle (hObject=0x190) returned 1 [0038.359] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0038.359] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.359] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0038.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0038.360] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0038.360] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0038.360] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.365] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0038.365] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0038.394] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.411] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0038.411] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0038.666] SetEndOfFile (hFile=0x190) returned 1 [0038.666] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4098628 [0038.670] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0038.670] WriteFile (in: hFile=0x190, lpBuffer=0x4098628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4098628*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.672] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0038.672] WriteFile (in: hFile=0x190, lpBuffer=0x4098628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4098628*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.677] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0038.677] WriteFile (in: hFile=0x190, lpBuffer=0x4098628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4098628*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.680] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4098628 | out: hHeap=0x5c0000) returned 1 [0038.680] CloseHandle (hObject=0x190) returned 1 [0039.265] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0039.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.265] lstrlenW (lpString=".doc") returned 4 [0039.265] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.265] lstrlenW (lpString=".docx") returned 5 [0039.265] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.266] lstrlenW (lpString=".pdf") returned 4 [0039.266] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.266] lstrlenW (lpString=".xls") returned 4 [0039.266] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.266] lstrlenW (lpString=".xlsx") returned 5 [0039.266] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.266] lstrlenW (lpString=".ppt") returned 4 [0039.266] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString=".zip") returned 4 [0039.266] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.266] lstrlenW (lpString=".rar") returned 4 [0039.266] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.266] lstrlenW (lpString=".bz2") returned 4 [0039.266] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.266] lstrlenW (lpString=".7z") returned 3 [0039.266] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString=".dbf") returned 4 [0039.266] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString=".1cd") returned 4 [0039.266] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString=".jpg") returned 4 [0039.266] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.266] lstrlenW (lpString=".doc") returned 4 [0039.266] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.266] lstrlenW (lpString=".docx") returned 5 [0039.266] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.266] lstrlenW (lpString=".pdf") returned 4 [0039.267] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.267] lstrlenW (lpString=".xls") returned 4 [0039.267] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.267] lstrlenW (lpString=".xlsx") returned 5 [0039.267] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.267] lstrlenW (lpString=".ppt") returned 4 [0039.267] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.267] lstrlenW (lpString=".zip") returned 4 [0039.267] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.267] lstrlenW (lpString=".rar") returned 4 [0039.267] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.267] lstrlenW (lpString=".bz2") returned 4 [0039.267] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.267] lstrlenW (lpString=".7z") returned 3 [0039.267] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.267] lstrlenW (lpString=".dbf") returned 4 [0039.267] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.267] lstrlenW (lpString=".1cd") returned 4 [0039.267] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.267] lstrlenW (lpString=".jpg") returned 4 [0039.267] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.267] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0039.267] lstrlenW (lpString="WordMUI.msi") returned 11 [0039.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.268] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2522624) returned 1 [0039.268] CloseHandle (hObject=0x190) returned 1 [0039.268] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0039.268] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.268] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0039.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.283] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0039.283] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0039.283] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.418] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0039.418] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.432] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.432] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0039.432] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.530] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0039.530] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0039.618] SetEndOfFile (hFile=0x190) returned 1 [0039.618] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x40f8630 [0039.903] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0039.903] WriteFile (in: hFile=0x190, lpBuffer=0x40f8630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x40f8630*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.905] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0039.905] WriteFile (in: hFile=0x190, lpBuffer=0x40f8630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x40f8630*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.910] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0039.910] WriteFile (in: hFile=0x190, lpBuffer=0x40f8630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x40f8630*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.913] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40f8630 | out: hHeap=0x5c0000) returned 1 [0039.916] CloseHandle (hObject=0x190) returned 1 [0040.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0040.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.272] lstrlenW (lpString=".doc") returned 4 [0040.272] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.272] lstrlenW (lpString=".docx") returned 5 [0040.272] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.272] lstrlenW (lpString=".pdf") returned 4 [0040.272] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.272] lstrlenW (lpString=".xls") returned 4 [0040.272] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.273] lstrlenW (lpString=".xlsx") returned 5 [0040.273] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.273] lstrlenW (lpString=".ppt") returned 4 [0040.273] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString=".zip") returned 4 [0040.273] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.273] lstrlenW (lpString=".rar") returned 4 [0040.273] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.273] lstrlenW (lpString=".bz2") returned 4 [0040.273] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.273] lstrlenW (lpString=".7z") returned 3 [0040.273] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString=".dbf") returned 4 [0040.273] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString=".1cd") returned 4 [0040.273] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString=".jpg") returned 4 [0040.273] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.273] lstrlenW (lpString=".doc") returned 4 [0040.273] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.273] lstrlenW (lpString=".docx") returned 5 [0040.273] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.273] lstrlenW (lpString=".pdf") returned 4 [0040.273] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.273] lstrlenW (lpString=".xls") returned 4 [0040.273] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.274] lstrlenW (lpString=".xlsx") returned 5 [0040.274] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.274] lstrlenW (lpString=".ppt") returned 4 [0040.274] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.274] lstrlenW (lpString=".zip") returned 4 [0040.274] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.274] lstrlenW (lpString=".rar") returned 4 [0040.274] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.274] lstrlenW (lpString=".bz2") returned 4 [0040.274] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.274] lstrlenW (lpString=".7z") returned 3 [0040.274] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.274] lstrlenW (lpString=".dbf") returned 4 [0040.274] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.274] lstrlenW (lpString=".1cd") returned 4 [0040.274] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.274] lstrlenW (lpString=".jpg") returned 4 [0040.274] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.275] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0040.275] lstrlenW (lpString="Proof.msi") returned 9 [0040.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0040.275] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=875520) returned 1 [0040.275] CloseHandle (hObject=0x190) returned 1 [0040.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0040.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0040.275] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0040.275] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0040.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.276] GetLastError () returned 0x0 [0040.276] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0040.526] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0040.543] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0040.543] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.543] SetEndOfFile (hFile=0x1c0) returned 1 [0040.543] CloseHandle (hObject=0x1c0) returned 1 [0040.551] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0040.551] SetEndOfFile (hFile=0x190) returned 1 [0040.750] CloseHandle (hObject=0x190) returned 1 [0040.750] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0040.750] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0040.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.750] lstrlenW (lpString=".doc") returned 4 [0040.751] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.751] lstrlenW (lpString=".docx") returned 5 [0040.751] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.751] lstrlenW (lpString=".pdf") returned 4 [0040.751] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.751] lstrlenW (lpString=".xls") returned 4 [0040.751] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.751] lstrlenW (lpString=".xlsx") returned 5 [0040.751] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.751] lstrlenW (lpString=".ppt") returned 4 [0040.751] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString=".zip") returned 4 [0040.751] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.751] lstrlenW (lpString=".rar") returned 4 [0040.751] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.751] lstrlenW (lpString=".bz2") returned 4 [0040.751] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.751] lstrlenW (lpString=".7z") returned 3 [0040.751] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString=".dbf") returned 4 [0040.751] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString=".1cd") returned 4 [0040.751] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString=".jpg") returned 4 [0040.751] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.751] lstrlenW (lpString=".doc") returned 4 [0040.752] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.752] lstrlenW (lpString=".docx") returned 5 [0040.752] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.752] lstrlenW (lpString=".pdf") returned 4 [0040.752] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.752] lstrlenW (lpString=".xls") returned 4 [0040.752] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.752] lstrlenW (lpString=".xlsx") returned 5 [0040.752] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.752] lstrlenW (lpString=".ppt") returned 4 [0040.752] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.752] lstrlenW (lpString=".zip") returned 4 [0040.752] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.752] lstrlenW (lpString=".rar") returned 4 [0040.752] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.752] lstrlenW (lpString=".bz2") returned 4 [0040.752] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.752] lstrlenW (lpString=".7z") returned 3 [0040.752] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.752] lstrlenW (lpString=".dbf") returned 4 [0040.752] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.752] lstrlenW (lpString=".1cd") returned 4 [0040.752] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.752] lstrlenW (lpString=".jpg") returned 4 [0040.752] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.753] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0040.753] lstrlenW (lpString="Proof.msi") returned 9 [0040.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0040.753] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=881152) returned 1 [0040.753] CloseHandle (hObject=0x190) returned 1 [0040.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0040.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0040.753] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0040.753] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0040.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0040.754] GetLastError () returned 0x0 [0040.754] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd7200, lpOverlapped=0x0) returned 1 [0041.055] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0041.400] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0041.400] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.400] SetEndOfFile (hFile=0x1f8) returned 1 [0041.400] CloseHandle (hObject=0x1f8) returned 1 [0041.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0041.407] SetEndOfFile (hFile=0x190) returned 1 [0041.415] CloseHandle (hObject=0x190) returned 1 [0041.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0041.415] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0041.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.415] lstrlenW (lpString=".doc") returned 4 [0041.416] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.416] lstrlenW (lpString=".docx") returned 5 [0041.416] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0041.416] lstrlenW (lpString=".pdf") returned 4 [0041.416] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.416] lstrlenW (lpString=".xls") returned 4 [0041.416] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.416] lstrlenW (lpString=".xlsx") returned 5 [0041.416] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0041.416] lstrlenW (lpString=".ppt") returned 4 [0041.416] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString=".zip") returned 4 [0041.416] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.416] lstrlenW (lpString=".rar") returned 4 [0041.416] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.416] lstrlenW (lpString=".bz2") returned 4 [0041.416] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.416] lstrlenW (lpString=".7z") returned 3 [0041.416] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString=".dbf") returned 4 [0041.416] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString=".1cd") returned 4 [0041.416] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString=".jpg") returned 4 [0041.416] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.416] lstrlenW (lpString=".doc") returned 4 [0041.417] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.417] lstrlenW (lpString=".docx") returned 5 [0041.417] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0041.417] lstrlenW (lpString=".pdf") returned 4 [0041.417] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.417] lstrlenW (lpString=".xls") returned 4 [0041.417] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.417] lstrlenW (lpString=".xlsx") returned 5 [0041.417] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0041.417] lstrlenW (lpString=".ppt") returned 4 [0041.417] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.417] lstrlenW (lpString=".zip") returned 4 [0041.417] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.417] lstrlenW (lpString=".rar") returned 4 [0041.417] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.417] lstrlenW (lpString=".bz2") returned 4 [0041.417] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.417] lstrlenW (lpString=".7z") returned 3 [0041.417] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.417] lstrlenW (lpString=".dbf") returned 4 [0041.417] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.417] lstrlenW (lpString=".1cd") returned 4 [0041.417] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0041.417] lstrlenW (lpString=".jpg") returned 4 [0041.417] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.417] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0041.418] lstrlenW (lpString="Proof.cab") returned 9 [0041.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0041.418] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=21064532) returned 1 [0041.418] CloseHandle (hObject=0x190) returned 1 [0041.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0041.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.418] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0041.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0041.852] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0041.852] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0041.852] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.045] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0042.046] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0042.178] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.326] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0042.326] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.342] SetEndOfFile (hFile=0x190) returned 1 [0042.342] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4078620 [0042.346] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0042.346] WriteFile (in: hFile=0x190, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.347] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0042.347] WriteFile (in: hFile=0x190, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.347] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0042.348] WriteFile (in: hFile=0x190, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.349] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4078620 | out: hHeap=0x5c0000) returned 1 [0042.588] CloseHandle (hObject=0x190) returned 1 [0045.072] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.072] lstrlenW (lpString=".doc") returned 4 [0045.072] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.072] lstrlenW (lpString=".docx") returned 5 [0045.072] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.072] lstrlenW (lpString=".pdf") returned 4 [0045.072] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.072] lstrlenW (lpString=".xls") returned 4 [0045.073] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString=".xlsx") returned 5 [0045.073] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.073] lstrlenW (lpString=".ppt") returned 4 [0045.073] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString=".zip") returned 4 [0045.073] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString=".rar") returned 4 [0045.073] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString=".bz2") returned 4 [0045.073] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.073] lstrlenW (lpString=".7z") returned 3 [0045.073] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString=".dbf") returned 4 [0045.073] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString=".1cd") returned 4 [0045.073] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString=".jpg") returned 4 [0045.073] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.073] lstrlenW (lpString=".doc") returned 4 [0045.073] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString=".docx") returned 5 [0045.073] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.073] lstrlenW (lpString=".pdf") returned 4 [0045.073] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.073] lstrlenW (lpString=".xls") returned 4 [0045.074] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.074] lstrlenW (lpString=".xlsx") returned 5 [0045.074] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.074] lstrlenW (lpString=".ppt") returned 4 [0045.074] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.074] lstrlenW (lpString=".zip") returned 4 [0045.074] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.074] lstrlenW (lpString=".rar") returned 4 [0045.074] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.074] lstrlenW (lpString=".bz2") returned 4 [0045.074] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.074] lstrlenW (lpString=".7z") returned 3 [0045.074] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.074] lstrlenW (lpString=".dbf") returned 4 [0045.074] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.074] lstrlenW (lpString=".1cd") returned 4 [0045.074] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0045.074] lstrlenW (lpString=".jpg") returned 4 [0045.074] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.074] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0045.074] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0045.074] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.075] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2507776) returned 1 [0045.075] CloseHandle (hObject=0x190) returned 1 [0045.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0045.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.075] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0045.075] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.076] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0045.076] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0045.076] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.079] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0045.079] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.090] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.090] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0045.090] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.108] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0045.108] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0045.421] SetEndOfFile (hFile=0x190) returned 1 [0045.421] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0045.537] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0045.537] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.538] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0045.538] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.544] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0045.544] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.547] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0045.547] CloseHandle (hObject=0x190) returned 1 [0045.547] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.548] lstrlenW (lpString=".doc") returned 4 [0045.548] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.548] lstrlenW (lpString=".docx") returned 5 [0045.548] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.548] lstrlenW (lpString=".pdf") returned 4 [0045.548] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.548] lstrlenW (lpString=".xls") returned 4 [0045.548] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.548] lstrlenW (lpString=".xlsx") returned 5 [0045.548] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.548] lstrlenW (lpString=".ppt") returned 4 [0045.548] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.548] lstrlenW (lpString=".zip") returned 4 [0045.548] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.548] lstrlenW (lpString=".rar") returned 4 [0045.548] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.548] lstrlenW (lpString=".bz2") returned 4 [0045.548] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.548] lstrlenW (lpString=".7z") returned 3 [0045.548] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.548] lstrlenW (lpString=".dbf") returned 4 [0045.548] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.549] lstrlenW (lpString=".1cd") returned 4 [0045.549] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.549] lstrlenW (lpString=".jpg") returned 4 [0045.549] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.549] lstrlenW (lpString=".doc") returned 4 [0045.549] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.549] lstrlenW (lpString=".docx") returned 5 [0045.549] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.549] lstrlenW (lpString=".pdf") returned 4 [0045.549] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.549] lstrlenW (lpString=".xls") returned 4 [0045.549] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.549] lstrlenW (lpString=".xlsx") returned 5 [0045.549] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.549] lstrlenW (lpString=".ppt") returned 4 [0045.549] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.549] lstrlenW (lpString=".zip") returned 4 [0045.549] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.549] lstrlenW (lpString=".rar") returned 4 [0045.549] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.549] lstrlenW (lpString=".bz2") returned 4 [0045.549] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.549] lstrlenW (lpString=".7z") returned 3 [0045.549] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.550] lstrlenW (lpString=".dbf") returned 4 [0045.550] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.550] lstrlenW (lpString=".1cd") returned 4 [0045.550] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0045.550] lstrlenW (lpString=".jpg") returned 4 [0045.550] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.550] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0045.550] lstrlenW (lpString="dwdcw20.dll") returned 11 [0045.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.550] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=526176) returned 1 [0045.550] CloseHandle (hObject=0x190) returned 1 [0045.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0045.551] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.551] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0045.551] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0045.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.551] GetLastError () returned 0x0 [0045.551] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x80760, lpOverlapped=0x0) returned 1 [0045.582] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80770, lpOverlapped=0x0) returned 1 [0045.591] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0045.591] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.591] SetEndOfFile (hFile=0x1c0) returned 1 [0046.420] CloseHandle (hObject=0x1c0) returned 1 [0046.494] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0046.494] SetEndOfFile (hFile=0x190) returned 1 [0046.499] CloseHandle (hObject=0x190) returned 1 [0046.499] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.499] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0046.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.499] lstrlenW (lpString=".doc") returned 4 [0046.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString=".docx") returned 5 [0046.500] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.500] lstrlenW (lpString=".pdf") returned 4 [0046.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString=".xls") returned 4 [0046.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString=".xlsx") returned 5 [0046.500] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.500] lstrlenW (lpString=".ppt") returned 4 [0046.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.500] lstrlenW (lpString=".zip") returned 4 [0046.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString=".rar") returned 4 [0046.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.500] lstrlenW (lpString=".bz2") returned 4 [0046.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.500] lstrlenW (lpString=".7z") returned 3 [0046.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.500] lstrlenW (lpString=".dbf") returned 4 [0046.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.500] lstrlenW (lpString=".1cd") returned 4 [0046.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.500] lstrlenW (lpString=".jpg") returned 4 [0046.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString=".doc") returned 4 [0046.501] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString=".docx") returned 5 [0046.501] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.501] lstrlenW (lpString=".pdf") returned 4 [0046.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString=".xls") returned 4 [0046.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString=".xlsx") returned 5 [0046.501] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.501] lstrlenW (lpString=".ppt") returned 4 [0046.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString=".zip") returned 4 [0046.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString=".rar") returned 4 [0046.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.501] lstrlenW (lpString=".bz2") returned 4 [0046.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.501] lstrlenW (lpString=".7z") returned 3 [0046.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString=".dbf") returned 4 [0046.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString=".1cd") returned 4 [0046.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.501] lstrlenW (lpString=".jpg") returned 4 [0046.502] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.502] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0046.502] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0046.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.502] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3702272) returned 1 [0046.502] CloseHandle (hObject=0x190) returned 1 [0046.502] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0046.502] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.502] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0046.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.503] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0046.503] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0046.503] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.537] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0046.537] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.699] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.699] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0046.699] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.731] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0046.731] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.002] SetEndOfFile (hFile=0x190) returned 1 [0047.002] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0047.002] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0047.002] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.004] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0047.004] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.014] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0047.014] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.016] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0047.016] CloseHandle (hObject=0x190) returned 1 [0047.017] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0047.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.017] lstrlenW (lpString=".doc") returned 4 [0047.017] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.017] lstrlenW (lpString=".docx") returned 5 [0047.017] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.017] lstrlenW (lpString=".pdf") returned 4 [0047.017] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.017] lstrlenW (lpString=".xls") returned 4 [0047.017] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.017] lstrlenW (lpString=".xlsx") returned 5 [0047.017] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.017] lstrlenW (lpString=".ppt") returned 4 [0047.017] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.017] lstrlenW (lpString=".zip") returned 4 [0047.018] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.018] lstrlenW (lpString=".rar") returned 4 [0047.018] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.018] lstrlenW (lpString=".bz2") returned 4 [0047.018] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.018] lstrlenW (lpString=".7z") returned 3 [0047.018] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.018] lstrlenW (lpString=".dbf") returned 4 [0047.018] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.018] lstrlenW (lpString=".1cd") returned 4 [0047.018] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.018] lstrlenW (lpString=".jpg") returned 4 [0047.018] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.018] lstrlenW (lpString=".doc") returned 4 [0047.018] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.018] lstrlenW (lpString=".docx") returned 5 [0047.018] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.018] lstrlenW (lpString=".pdf") returned 4 [0047.018] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.018] lstrlenW (lpString=".xls") returned 4 [0047.018] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.018] lstrlenW (lpString=".xlsx") returned 5 [0047.018] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.018] lstrlenW (lpString=".ppt") returned 4 [0047.018] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.019] lstrlenW (lpString=".zip") returned 4 [0047.019] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.019] lstrlenW (lpString=".rar") returned 4 [0047.019] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.019] lstrlenW (lpString=".bz2") returned 4 [0047.019] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.019] lstrlenW (lpString=".7z") returned 3 [0047.019] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.019] lstrlenW (lpString=".dbf") returned 4 [0047.019] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.019] lstrlenW (lpString=".1cd") returned 4 [0047.019] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.019] lstrlenW (lpString=".jpg") returned 4 [0047.019] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.019] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0047.019] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0047.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.020] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=868864) returned 1 [0047.020] CloseHandle (hObject=0x190) returned 1 [0047.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0047.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.020] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0047.020] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0047.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.020] GetLastError () returned 0x0 [0047.020] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd4200, lpOverlapped=0x0) returned 1 [0047.072] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0047.090] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0047.090] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.090] SetEndOfFile (hFile=0x1ec) returned 1 [0047.090] CloseHandle (hObject=0x1ec) returned 1 [0047.091] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0047.091] SetEndOfFile (hFile=0x190) returned 1 [0047.665] CloseHandle (hObject=0x190) returned 1 [0047.665] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0047.665] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0047.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.665] lstrlenW (lpString=".doc") returned 4 [0047.665] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.665] lstrlenW (lpString=".docx") returned 5 [0047.665] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.665] lstrlenW (lpString=".pdf") returned 4 [0047.665] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.665] lstrlenW (lpString=".xls") returned 4 [0047.665] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.665] lstrlenW (lpString=".xlsx") returned 5 [0047.666] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.666] lstrlenW (lpString=".ppt") returned 4 [0047.666] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString=".zip") returned 4 [0047.666] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.666] lstrlenW (lpString=".rar") returned 4 [0047.666] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.666] lstrlenW (lpString=".bz2") returned 4 [0047.666] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.666] lstrlenW (lpString=".7z") returned 3 [0047.666] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString=".dbf") returned 4 [0047.666] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString=".1cd") returned 4 [0047.666] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString=".jpg") returned 4 [0047.666] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.666] lstrlenW (lpString=".doc") returned 4 [0047.666] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.666] lstrlenW (lpString=".docx") returned 5 [0047.666] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.666] lstrlenW (lpString=".pdf") returned 4 [0047.667] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.667] lstrlenW (lpString=".xls") returned 4 [0047.667] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.667] lstrlenW (lpString=".xlsx") returned 5 [0047.667] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.667] lstrlenW (lpString=".ppt") returned 4 [0047.667] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.667] lstrlenW (lpString=".zip") returned 4 [0047.667] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.667] lstrlenW (lpString=".rar") returned 4 [0047.667] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.667] lstrlenW (lpString=".bz2") returned 4 [0047.667] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.667] lstrlenW (lpString=".7z") returned 3 [0047.667] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.667] lstrlenW (lpString=".dbf") returned 4 [0047.667] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.667] lstrlenW (lpString=".1cd") returned 4 [0047.667] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.667] lstrlenW (lpString=".jpg") returned 4 [0047.667] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.667] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0047.668] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0047.668] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.668] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=36233052) returned 1 [0047.668] CloseHandle (hObject=0x190) returned 1 [0047.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0047.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.668] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0047.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.669] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0047.669] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0047.669] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0047.775] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.057] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.057] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0048.057] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.145] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0048.145] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.164] SetEndOfFile (hFile=0x190) returned 1 [0048.164] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0048.261] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0048.261] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.262] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0048.262] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.263] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0048.263] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.265] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0048.267] CloseHandle (hObject=0x190) returned 1 [0048.267] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.268] lstrlenW (lpString=".doc") returned 4 [0048.268] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString=".docx") returned 5 [0048.268] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.268] lstrlenW (lpString=".pdf") returned 4 [0048.268] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString=".xls") returned 4 [0048.268] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString=".xlsx") returned 5 [0048.268] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.268] lstrlenW (lpString=".ppt") returned 4 [0048.268] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.268] lstrlenW (lpString=".zip") returned 4 [0048.268] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString=".rar") returned 4 [0048.268] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString=".bz2") returned 4 [0048.268] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.268] lstrlenW (lpString=".7z") returned 3 [0048.268] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.268] lstrlenW (lpString=".dbf") returned 4 [0048.268] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString=".1cd") returned 4 [0048.269] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString=".jpg") returned 4 [0048.269] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString=".doc") returned 4 [0048.269] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString=".docx") returned 5 [0048.269] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.269] lstrlenW (lpString=".pdf") returned 4 [0048.269] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString=".xls") returned 4 [0048.269] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString=".xlsx") returned 5 [0048.269] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.269] lstrlenW (lpString=".ppt") returned 4 [0048.269] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString=".zip") returned 4 [0048.269] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString=".rar") returned 4 [0048.269] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString=".bz2") returned 4 [0048.269] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.269] lstrlenW (lpString=".7z") returned 3 [0048.269] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.269] lstrlenW (lpString=".dbf") returned 4 [0048.269] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.270] lstrlenW (lpString=".1cd") returned 4 [0048.270] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.270] lstrlenW (lpString=".jpg") returned 4 [0048.270] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.270] lstrcmpiW (lpString1=".xrm-ms", lpString2=".zoh") returned -1 [0048.270] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0048.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.270] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=715834) returned 1 [0048.270] CloseHandle (hObject=0x190) returned 1 [0048.270] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0048.270] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.271] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0048.271] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0048.271] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.271] GetLastError () returned 0x0 [0048.271] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0048.461] WriteFile (in: hFile=0x204, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0048.474] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0048.474] WriteFile (in: hFile=0x204, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x104, lpOverlapped=0x0) returned 1 [0048.475] SetEndOfFile (hFile=0x204) returned 1 [0048.475] CloseHandle (hObject=0x204) returned 1 [0048.475] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0048.475] SetEndOfFile (hFile=0x190) returned 1 [0048.736] CloseHandle (hObject=0x190) returned 1 [0048.736] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.736] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0048.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.737] lstrlenW (lpString=".doc") returned 4 [0048.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.737] lstrlenW (lpString=".docx") returned 5 [0048.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.737] lstrlenW (lpString=".pdf") returned 4 [0048.737] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.737] lstrlenW (lpString=".xls") returned 4 [0048.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.737] lstrlenW (lpString=".xlsx") returned 5 [0048.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.737] lstrlenW (lpString=".ppt") returned 4 [0048.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.737] lstrlenW (lpString=".zip") returned 4 [0048.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.737] lstrlenW (lpString=".rar") returned 4 [0048.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".bz2") returned 4 [0048.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".7z") returned 3 [0048.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString=".dbf") returned 4 [0048.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString=".1cd") returned 4 [0048.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString=".jpg") returned 4 [0048.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString=".doc") returned 4 [0048.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".docx") returned 5 [0048.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.738] lstrlenW (lpString=".pdf") returned 4 [0048.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".xls") returned 4 [0048.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".xlsx") returned 5 [0048.738] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.738] lstrlenW (lpString=".ppt") returned 4 [0048.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.738] lstrlenW (lpString=".zip") returned 4 [0048.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.738] lstrlenW (lpString=".rar") returned 4 [0048.739] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.739] lstrlenW (lpString=".bz2") returned 4 [0048.739] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.739] lstrlenW (lpString=".7z") returned 3 [0048.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.739] lstrlenW (lpString=".dbf") returned 4 [0048.739] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.739] lstrlenW (lpString=".1cd") returned 4 [0048.739] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.739] lstrlenW (lpString=".jpg") returned 4 [0048.739] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.739] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0048.739] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0048.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.739] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=222948913) returned 1 [0048.739] CloseHandle (hObject=0x190) returned 1 [0048.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0048.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.740] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0048.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.740] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0048.740] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0048.740] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.747] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0048.747] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.754] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.754] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0048.754] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.770] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.021] SetEndOfFile (hFile=0x190) returned 1 [0049.327] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0049.357] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0049.838] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.841] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0049.841] WriteFile (in: hFile=0x190, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.843] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0049.843] CloseHandle (hObject=0x190) returned 1 [0049.843] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0049.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.843] lstrlenW (lpString=".doc") returned 4 [0049.843] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.843] lstrlenW (lpString=".docx") returned 5 [0049.843] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.843] lstrlenW (lpString=".pdf") returned 4 [0049.843] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.843] lstrlenW (lpString=".xls") returned 4 [0049.844] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString=".xlsx") returned 5 [0049.844] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.844] lstrlenW (lpString=".ppt") returned 4 [0049.844] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString=".zip") returned 4 [0049.844] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString=".rar") returned 4 [0049.844] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString=".bz2") returned 4 [0049.844] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.844] lstrlenW (lpString=".7z") returned 3 [0049.844] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString=".dbf") returned 4 [0049.844] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString=".1cd") returned 4 [0049.844] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString=".jpg") returned 4 [0049.844] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.844] lstrlenW (lpString=".doc") returned 4 [0049.844] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString=".docx") returned 5 [0049.844] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.844] lstrlenW (lpString=".pdf") returned 4 [0049.844] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.844] lstrlenW (lpString=".xls") returned 4 [0049.845] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.845] lstrlenW (lpString=".xlsx") returned 5 [0049.845] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.845] lstrlenW (lpString=".ppt") returned 4 [0049.845] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.845] lstrlenW (lpString=".zip") returned 4 [0049.845] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.845] lstrlenW (lpString=".rar") returned 4 [0049.845] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.845] lstrlenW (lpString=".bz2") returned 4 [0049.845] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.845] lstrlenW (lpString=".7z") returned 3 [0049.845] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.845] lstrlenW (lpString=".dbf") returned 4 [0049.845] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.845] lstrlenW (lpString=".1cd") returned 4 [0049.845] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.845] lstrlenW (lpString=".jpg") returned 4 [0049.845] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.845] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0049.845] lstrlenW (lpString="ose.exe") returned 7 [0049.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.192] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=174440) returned 1 [0050.192] CloseHandle (hObject=0x210) returned 1 [0050.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0050.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.192] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.192] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.193] GetLastError () returned 0x0 [0050.193] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2a968, lpOverlapped=0x0) returned 1 [0050.198] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0050.201] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0050.201] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0050.202] SetEndOfFile (hFile=0x16c) returned 1 [0050.202] CloseHandle (hObject=0x16c) returned 1 [0050.202] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.202] SetEndOfFile (hFile=0x210) returned 1 [0050.204] CloseHandle (hObject=0x210) returned 1 [0050.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.204] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0050.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.204] lstrlenW (lpString=".doc") returned 4 [0050.204] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.204] lstrlenW (lpString=".docx") returned 5 [0050.204] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.204] lstrlenW (lpString=".pdf") returned 4 [0050.204] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.204] lstrlenW (lpString=".xls") returned 4 [0050.204] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.204] lstrlenW (lpString=".xlsx") returned 5 [0050.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.204] lstrlenW (lpString=".ppt") returned 4 [0050.204] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString=".zip") returned 4 [0050.205] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString=".rar") returned 4 [0050.205] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString=".bz2") returned 4 [0050.205] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.205] lstrlenW (lpString=".7z") returned 3 [0050.205] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString=".dbf") returned 4 [0050.205] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString=".1cd") returned 4 [0050.205] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString=".jpg") returned 4 [0050.205] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.205] lstrlenW (lpString=".doc") returned 4 [0050.205] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.205] lstrlenW (lpString=".docx") returned 5 [0050.205] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.205] lstrlenW (lpString=".pdf") returned 4 [0050.205] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString=".xls") returned 4 [0050.205] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.205] lstrlenW (lpString=".xlsx") returned 5 [0050.205] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.205] lstrlenW (lpString=".ppt") returned 4 [0050.205] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.206] lstrlenW (lpString=".zip") returned 4 [0050.206] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.206] lstrlenW (lpString=".rar") returned 4 [0050.206] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.206] lstrlenW (lpString=".bz2") returned 4 [0050.206] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.206] lstrlenW (lpString=".7z") returned 3 [0050.206] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.206] lstrlenW (lpString=".dbf") returned 4 [0050.206] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.206] lstrlenW (lpString=".1cd") returned 4 [0050.206] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.206] lstrlenW (lpString=".jpg") returned 4 [0050.206] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.206] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0050.206] lstrlenW (lpString="PidGenX.dll") returned 11 [0050.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.206] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1463568) returned 1 [0050.207] CloseHandle (hObject=0x210) returned 1 [0050.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0050.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.207] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.207] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.207] GetLastError () returned 0x0 [0050.207] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.233] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.564] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x65520, lpOverlapped=0x0) returned 1 [0050.578] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x65530, lpOverlapped=0x0) returned 1 [0050.707] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0050.707] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.707] SetEndOfFile (hFile=0x16c) returned 1 [0050.707] CloseHandle (hObject=0x16c) returned 1 [0050.707] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.707] SetEndOfFile (hFile=0x210) returned 1 [0050.711] CloseHandle (hObject=0x210) returned 1 [0050.711] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0050.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.963] lstrlenW (lpString=".doc") returned 4 [0050.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.963] lstrlenW (lpString=".docx") returned 5 [0050.963] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0050.963] lstrlenW (lpString=".pdf") returned 4 [0050.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.963] lstrlenW (lpString=".xls") returned 4 [0050.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.963] lstrlenW (lpString=".xlsx") returned 5 [0050.964] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0050.964] lstrlenW (lpString=".ppt") returned 4 [0050.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString=".zip") returned 4 [0050.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString=".rar") returned 4 [0050.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString=".bz2") returned 4 [0050.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.964] lstrlenW (lpString=".7z") returned 3 [0050.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString=".dbf") returned 4 [0050.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString=".1cd") returned 4 [0050.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString=".jpg") returned 4 [0050.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.964] lstrlenW (lpString=".doc") returned 4 [0050.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString=".docx") returned 5 [0050.964] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0050.964] lstrlenW (lpString=".pdf") returned 4 [0050.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString=".xls") returned 4 [0050.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.964] lstrlenW (lpString=".xlsx") returned 5 [0050.964] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0050.965] lstrlenW (lpString=".ppt") returned 4 [0050.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.965] lstrlenW (lpString=".zip") returned 4 [0050.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.965] lstrlenW (lpString=".rar") returned 4 [0050.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.965] lstrlenW (lpString=".bz2") returned 4 [0050.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.965] lstrlenW (lpString=".7z") returned 3 [0050.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.965] lstrlenW (lpString=".dbf") returned 4 [0050.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.965] lstrlenW (lpString=".1cd") returned 4 [0050.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0050.965] lstrlenW (lpString=".jpg") returned 4 [0050.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.965] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0050.965] lstrlenW (lpString="setup.exe") returned 9 [0050.965] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.966] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1377656) returned 1 [0050.966] CloseHandle (hObject=0x180) returned 1 [0050.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0050.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.966] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.966] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0050.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0050.966] GetLastError () returned 0x0 [0050.966] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.161] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.182] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x50588, lpOverlapped=0x0) returned 1 [0051.195] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x50590, lpOverlapped=0x0) returned 1 [0051.204] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0051.204] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.204] SetEndOfFile (hFile=0x1a8) returned 1 [0051.204] CloseHandle (hObject=0x1a8) returned 1 [0051.205] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.205] SetEndOfFile (hFile=0x180) returned 1 [0051.208] CloseHandle (hObject=0x180) returned 1 [0051.208] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.208] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString=".doc") returned 4 [0051.209] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.209] lstrlenW (lpString=".docx") returned 5 [0051.209] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.209] lstrlenW (lpString=".pdf") returned 4 [0051.209] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.209] lstrlenW (lpString=".xls") returned 4 [0051.209] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.209] lstrlenW (lpString=".xlsx") returned 5 [0051.209] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.209] lstrlenW (lpString=".ppt") returned 4 [0051.209] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString=".zip") returned 4 [0051.209] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.209] lstrlenW (lpString=".rar") returned 4 [0051.209] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.209] lstrlenW (lpString=".bz2") returned 4 [0051.209] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.209] lstrlenW (lpString=".7z") returned 3 [0051.209] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString=".dbf") returned 4 [0051.209] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString=".1cd") returned 4 [0051.209] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.209] lstrlenW (lpString=".jpg") returned 4 [0051.209] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString=".doc") returned 4 [0051.210] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.210] lstrlenW (lpString=".docx") returned 5 [0051.210] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.210] lstrlenW (lpString=".pdf") returned 4 [0051.210] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString=".xls") returned 4 [0051.210] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString=".xlsx") returned 5 [0051.210] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.210] lstrlenW (lpString=".ppt") returned 4 [0051.210] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString=".zip") returned 4 [0051.210] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString=".rar") returned 4 [0051.210] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.210] lstrlenW (lpString=".bz2") returned 4 [0051.210] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.210] lstrlenW (lpString=".7z") returned 3 [0051.210] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString=".dbf") returned 4 [0051.210] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString=".1cd") returned 4 [0051.210] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.210] lstrlenW (lpString=".jpg") returned 4 [0051.210] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.211] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0051.211] lstrlenW (lpString="ose.exe") returned 7 [0051.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.876] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=174440) returned 1 [0051.876] CloseHandle (hObject=0x188) returned 1 [0051.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0051.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.877] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.877] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.878] GetLastError () returned 0x0 [0051.878] ReadFile (in: hFile=0x188, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2a968, lpOverlapped=0x0) returned 1 [0051.883] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0051.887] ReadFile (in: hFile=0x188, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0051.887] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0051.887] SetEndOfFile (hFile=0x1a8) returned 1 [0051.887] CloseHandle (hObject=0x1a8) returned 1 [0051.887] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.887] SetEndOfFile (hFile=0x188) returned 1 [0051.889] CloseHandle (hObject=0x188) returned 1 [0051.889] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.889] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0051.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.889] lstrlenW (lpString=".doc") returned 4 [0051.889] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.889] lstrlenW (lpString=".docx") returned 5 [0051.889] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0051.889] lstrlenW (lpString=".pdf") returned 4 [0051.889] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.889] lstrlenW (lpString=".xls") returned 4 [0051.890] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString=".xlsx") returned 5 [0051.890] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0051.890] lstrlenW (lpString=".ppt") returned 4 [0051.890] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString=".zip") returned 4 [0051.890] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString=".rar") returned 4 [0051.890] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString=".bz2") returned 4 [0051.890] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.890] lstrlenW (lpString=".7z") returned 3 [0051.890] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString=".dbf") returned 4 [0051.890] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString=".1cd") returned 4 [0051.890] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString=".jpg") returned 4 [0051.890] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.890] lstrlenW (lpString=".doc") returned 4 [0051.890] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.890] lstrlenW (lpString=".docx") returned 5 [0051.890] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0051.890] lstrlenW (lpString=".pdf") returned 4 [0051.890] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.890] lstrlenW (lpString=".xls") returned 4 [0051.890] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.891] lstrlenW (lpString=".xlsx") returned 5 [0051.891] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0051.891] lstrlenW (lpString=".ppt") returned 4 [0051.891] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.891] lstrlenW (lpString=".zip") returned 4 [0051.891] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.891] lstrlenW (lpString=".rar") returned 4 [0051.891] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.891] lstrlenW (lpString=".bz2") returned 4 [0051.891] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.891] lstrlenW (lpString=".7z") returned 3 [0051.891] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.891] lstrlenW (lpString=".dbf") returned 4 [0051.891] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.891] lstrlenW (lpString=".1cd") returned 4 [0051.891] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.891] lstrlenW (lpString=".jpg") returned 4 [0051.891] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.891] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0051.891] lstrlenW (lpString="setup.exe") returned 9 [0051.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.893] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1377656) returned 1 [0051.893] CloseHandle (hObject=0x188) returned 1 [0051.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0051.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.894] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.894] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0051.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.894] GetLastError () returned 0x0 [0051.894] ReadFile (in: hFile=0x188, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.914] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.150] ReadFile (in: hFile=0x188, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x50588, lpOverlapped=0x0) returned 1 [0052.165] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x50590, lpOverlapped=0x0) returned 1 [0052.173] ReadFile (in: hFile=0x188, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0052.173] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.173] SetEndOfFile (hFile=0x1a8) returned 1 [0052.173] CloseHandle (hObject=0x1a8) returned 1 [0052.174] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0052.174] SetEndOfFile (hFile=0x188) returned 1 [0052.177] CloseHandle (hObject=0x188) returned 1 [0052.177] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0052.177] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0052.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.177] lstrlenW (lpString=".doc") returned 4 [0052.178] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.178] lstrlenW (lpString=".docx") returned 5 [0052.178] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.178] lstrlenW (lpString=".pdf") returned 4 [0052.178] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString=".xls") returned 4 [0052.178] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString=".xlsx") returned 5 [0052.178] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.178] lstrlenW (lpString=".ppt") returned 4 [0052.178] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString=".zip") returned 4 [0052.178] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString=".rar") returned 4 [0052.178] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.178] lstrlenW (lpString=".7z") returned 3 [0052.178] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString=".dbf") returned 4 [0052.178] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString=".1cd") returned 4 [0052.178] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString=".jpg") returned 4 [0052.178] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.178] lstrlenW (lpString=".doc") returned 4 [0052.179] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.179] lstrlenW (lpString=".docx") returned 5 [0052.179] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.179] lstrlenW (lpString=".pdf") returned 4 [0052.179] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.179] lstrlenW (lpString=".xls") returned 4 [0052.179] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.179] lstrlenW (lpString=".xlsx") returned 5 [0052.179] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.179] lstrlenW (lpString=".ppt") returned 4 [0052.179] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.179] lstrlenW (lpString=".zip") returned 4 [0052.179] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.179] lstrlenW (lpString=".rar") returned 4 [0052.179] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.179] lstrlenW (lpString=".bz2") returned 4 [0052.179] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.179] lstrlenW (lpString=".7z") returned 3 [0052.179] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.179] lstrlenW (lpString=".dbf") returned 4 [0052.179] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.179] lstrlenW (lpString=".1cd") returned 4 [0052.179] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.179] lstrlenW (lpString=".jpg") returned 4 [0052.179] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.179] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0052.180] lstrlenW (lpString="first-nc-parking.exe") returned 20 [0052.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\first-nc-parking.exe" (normalized: "c:\\program files\\common files\\first-nc-parking.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.180] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=75776) returned 1 [0052.180] CloseHandle (hObject=0x188) returned 1 [0052.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\first-nc-parking.exe" (normalized: "c:\\program files\\common files\\first-nc-parking.exe")) returned 0x20 [0052.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\first-nc-parking.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\first-nc-parking.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\first-nc-parking.exe" (normalized: "c:\\program files\\common files\\first-nc-parking.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.180] lstrlenW (lpString=".doc") returned 4 [0052.180] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.180] lstrlenW (lpString=".docx") returned 5 [0052.180] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0052.180] lstrlenW (lpString=".pdf") returned 4 [0052.181] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString=".xls") returned 4 [0052.181] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString=".xlsx") returned 5 [0052.181] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0052.181] lstrlenW (lpString=".ppt") returned 4 [0052.181] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString=".zip") returned 4 [0052.181] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString=".rar") returned 4 [0052.181] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString=".bz2") returned 4 [0052.181] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.181] lstrlenW (lpString=".7z") returned 3 [0052.181] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString=".dbf") returned 4 [0052.181] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString=".1cd") returned 4 [0052.181] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString=".jpg") returned 4 [0052.181] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.181] lstrlenW (lpString=".doc") returned 4 [0052.181] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.181] lstrlenW (lpString=".docx") returned 5 [0052.181] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0052.181] lstrlenW (lpString=".pdf") returned 4 [0052.182] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.182] lstrlenW (lpString=".xls") returned 4 [0052.182] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.182] lstrlenW (lpString=".xlsx") returned 5 [0052.182] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0052.182] lstrlenW (lpString=".ppt") returned 4 [0052.182] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.182] lstrlenW (lpString=".zip") returned 4 [0052.182] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.182] lstrlenW (lpString=".rar") returned 4 [0052.182] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.182] lstrlenW (lpString=".bz2") returned 4 [0052.182] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.182] lstrlenW (lpString=".7z") returned 3 [0052.182] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.182] lstrlenW (lpString=".dbf") returned 4 [0052.182] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.182] lstrlenW (lpString=".1cd") returned 4 [0052.182] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\first-nc-parking.exe") returned 50 [0052.182] lstrlenW (lpString=".jpg") returned 4 [0052.182] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.182] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0052.182] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0052.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.926] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1369952) returned 1 [0052.926] CloseHandle (hObject=0x1f8) returned 1 [0052.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0052.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.927] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0052.927] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0052.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.927] GetLastError () returned 0x0 [0052.927] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.997] WriteFile (in: hFile=0x204, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0053.014] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4e770, lpOverlapped=0x0) returned 1 [0053.110] WriteFile (in: hFile=0x204, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0053.119] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0053.119] WriteFile (in: hFile=0x204, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.120] SetEndOfFile (hFile=0x204) returned 1 [0053.120] CloseHandle (hObject=0x204) returned 1 [0053.120] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0053.120] SetEndOfFile (hFile=0x1f8) returned 1 [0053.127] CloseHandle (hObject=0x1f8) returned 1 [0053.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0053.127] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0053.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.127] lstrlenW (lpString=".doc") returned 4 [0053.127] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.127] lstrlenW (lpString=".docx") returned 5 [0053.127] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0053.127] lstrlenW (lpString=".pdf") returned 4 [0053.127] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.127] lstrlenW (lpString=".xls") returned 4 [0053.127] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.127] lstrlenW (lpString=".xlsx") returned 5 [0053.127] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0053.127] lstrlenW (lpString=".ppt") returned 4 [0053.128] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString=".zip") returned 4 [0053.128] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString=".rar") returned 4 [0053.128] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString=".bz2") returned 4 [0053.128] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.128] lstrlenW (lpString=".7z") returned 3 [0053.128] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString=".dbf") returned 4 [0053.128] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString=".1cd") returned 4 [0053.128] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString=".jpg") returned 4 [0053.128] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.128] lstrlenW (lpString=".doc") returned 4 [0053.128] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString=".docx") returned 5 [0053.128] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0053.128] lstrlenW (lpString=".pdf") returned 4 [0053.128] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString=".xls") returned 4 [0053.128] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.128] lstrlenW (lpString=".xlsx") returned 5 [0053.128] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0053.128] lstrlenW (lpString=".ppt") returned 4 [0053.129] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.129] lstrlenW (lpString=".zip") returned 4 [0053.129] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.176] lstrlenW (lpString=".rar") returned 4 [0053.176] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.176] lstrlenW (lpString=".bz2") returned 4 [0053.176] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.176] lstrlenW (lpString=".7z") returned 3 [0053.176] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.176] lstrlenW (lpString=".dbf") returned 4 [0053.176] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.176] lstrlenW (lpString=".1cd") returned 4 [0053.176] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0053.176] lstrlenW (lpString=".jpg") returned 4 [0053.176] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.176] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0053.176] lstrlenW (lpString="offfiltx.dll") returned 12 [0053.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.426] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1486736) returned 1 [0054.426] CloseHandle (hObject=0x160) returned 1 [0054.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0054.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.426] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0054.426] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0054.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.429] GetLastError () returned 0x0 [0054.429] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.454] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.564] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0054.939] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0054.948] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0054.948] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.948] SetEndOfFile (hFile=0x220) returned 1 [0054.948] CloseHandle (hObject=0x220) returned 1 [0054.948] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0054.949] SetEndOfFile (hFile=0x160) returned 1 [0054.952] CloseHandle (hObject=0x160) returned 1 [0054.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.953] lstrlenW (lpString=".doc") returned 4 [0054.953] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString=".docx") returned 5 [0054.953] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.953] lstrlenW (lpString=".pdf") returned 4 [0054.953] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString=".xls") returned 4 [0054.953] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString=".xlsx") returned 5 [0054.953] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.953] lstrlenW (lpString=".ppt") returned 4 [0054.953] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.953] lstrlenW (lpString=".zip") returned 4 [0054.953] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString=".rar") returned 4 [0054.953] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.953] lstrlenW (lpString=".bz2") returned 4 [0054.953] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.953] lstrlenW (lpString=".7z") returned 3 [0054.953] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString=".dbf") returned 4 [0054.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString=".1cd") returned 4 [0054.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString=".jpg") returned 4 [0054.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString=".doc") returned 4 [0054.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString=".docx") returned 5 [0054.954] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.954] lstrlenW (lpString=".pdf") returned 4 [0054.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString=".xls") returned 4 [0054.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString=".xlsx") returned 5 [0054.954] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.954] lstrlenW (lpString=".ppt") returned 4 [0054.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.954] lstrlenW (lpString=".zip") returned 4 [0054.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString=".rar") returned 4 [0054.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.954] lstrlenW (lpString=".bz2") returned 4 [0054.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.954] lstrlenW (lpString=".7z") returned 3 [0054.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.955] lstrlenW (lpString=".dbf") returned 4 [0054.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.955] lstrlenW (lpString=".1cd") returned 4 [0054.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.955] lstrlenW (lpString=".jpg") returned 4 [0054.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.955] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0054.955] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0054.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.043] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=241024) returned 1 [0055.043] CloseHandle (hObject=0x220) returned 1 [0055.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0055.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.043] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.043] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.044] GetLastError () returned 0x0 [0055.044] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0055.049] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0055.053] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0055.053] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.053] SetEndOfFile (hFile=0x17c) returned 1 [0055.053] CloseHandle (hObject=0x17c) returned 1 [0055.053] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.053] SetEndOfFile (hFile=0x220) returned 1 [0055.055] CloseHandle (hObject=0x220) returned 1 [0055.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.055] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0055.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".doc") returned 4 [0055.056] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.056] lstrlenW (lpString=".docx") returned 5 [0055.056] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.056] lstrlenW (lpString=".pdf") returned 4 [0055.056] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString=".xls") returned 4 [0055.056] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString=".xlsx") returned 5 [0055.056] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.056] lstrlenW (lpString=".ppt") returned 4 [0055.056] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".zip") returned 4 [0055.056] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString=".rar") returned 4 [0055.056] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString=".bz2") returned 4 [0055.056] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.056] lstrlenW (lpString=".7z") returned 3 [0055.056] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".dbf") returned 4 [0055.056] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".1cd") returned 4 [0055.056] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".jpg") returned 4 [0055.056] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.056] lstrlenW (lpString=".doc") returned 4 [0055.057] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.057] lstrlenW (lpString=".docx") returned 5 [0055.057] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.057] lstrlenW (lpString=".pdf") returned 4 [0055.057] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.057] lstrlenW (lpString=".xls") returned 4 [0055.057] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.057] lstrlenW (lpString=".xlsx") returned 5 [0055.057] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.057] lstrlenW (lpString=".ppt") returned 4 [0055.057] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.057] lstrlenW (lpString=".zip") returned 4 [0055.057] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.057] lstrlenW (lpString=".rar") returned 4 [0055.057] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.057] lstrlenW (lpString=".bz2") returned 4 [0055.057] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.057] lstrlenW (lpString=".7z") returned 3 [0055.057] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.057] lstrlenW (lpString=".dbf") returned 4 [0055.057] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.057] lstrlenW (lpString=".1cd") returned 4 [0055.057] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.057] lstrlenW (lpString=".jpg") returned 4 [0055.057] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.057] lstrcmpiW (lpString1=".CGM", lpString2=".zoh") returned -1 [0055.058] lstrlenW (lpString="MS.CGM") returned 6 [0055.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.058] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1908) returned 1 [0055.058] CloseHandle (hObject=0x220) returned 1 [0055.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0055.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.058] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.058] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.059] GetLastError () returned 0x0 [0055.059] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x774, lpOverlapped=0x0) returned 1 [0055.060] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x780, lpOverlapped=0x0) returned 1 [0055.061] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0055.061] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0055.061] SetEndOfFile (hFile=0x17c) returned 1 [0055.061] CloseHandle (hObject=0x17c) returned 1 [0055.061] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.061] SetEndOfFile (hFile=0x220) returned 1 [0055.062] CloseHandle (hObject=0x220) returned 1 [0055.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.062] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0055.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.063] lstrlenW (lpString=".doc") returned 4 [0055.063] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString=".docx") returned 5 [0055.063] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0055.063] lstrlenW (lpString=".pdf") returned 4 [0055.063] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString=".xls") returned 4 [0055.063] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString=".xlsx") returned 5 [0055.063] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0055.063] lstrlenW (lpString=".ppt") returned 4 [0055.063] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.063] lstrlenW (lpString=".zip") returned 4 [0055.063] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString=".rar") returned 4 [0055.063] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0055.063] lstrlenW (lpString=".bz2") returned 4 [0055.063] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0055.063] lstrlenW (lpString=".7z") returned 3 [0055.064] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString=".dbf") returned 4 [0055.064] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString=".1cd") returned 4 [0055.064] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString=".jpg") returned 4 [0055.064] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString=".doc") returned 4 [0055.064] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString=".docx") returned 5 [0055.064] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0055.064] lstrlenW (lpString=".pdf") returned 4 [0055.064] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString=".xls") returned 4 [0055.064] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString=".xlsx") returned 5 [0055.064] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0055.064] lstrlenW (lpString=".ppt") returned 4 [0055.064] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.064] lstrlenW (lpString=".zip") returned 4 [0055.064] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString=".rar") returned 4 [0055.064] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0055.064] lstrlenW (lpString=".bz2") returned 4 [0055.064] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0055.064] lstrlenW (lpString=".7z") returned 3 [0055.065] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0055.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.065] lstrlenW (lpString=".dbf") returned 4 [0055.065] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0055.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.065] lstrlenW (lpString=".1cd") returned 4 [0055.065] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0055.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0055.065] lstrlenW (lpString=".jpg") returned 4 [0055.065] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0055.065] lstrcmpiW (lpString1=".WPG", lpString2=".zoh") returned -1 [0055.065] lstrlenW (lpString="MS.WPG") returned 6 [0055.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.065] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1382) returned 1 [0055.065] CloseHandle (hObject=0x220) returned 1 [0055.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0055.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.066] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.066] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.066] GetLastError () returned 0x0 [0055.066] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x566, lpOverlapped=0x0) returned 1 [0055.068] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x570, lpOverlapped=0x0) returned 1 [0055.068] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0055.069] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0055.069] SetEndOfFile (hFile=0x17c) returned 1 [0055.069] CloseHandle (hObject=0x17c) returned 1 [0055.069] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.069] SetEndOfFile (hFile=0x220) returned 1 [0055.070] CloseHandle (hObject=0x220) returned 1 [0055.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0055.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.070] lstrlenW (lpString=".doc") returned 4 [0055.070] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0055.070] lstrlenW (lpString=".docx") returned 5 [0055.070] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0055.070] lstrlenW (lpString=".pdf") returned 4 [0055.070] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0055.070] lstrlenW (lpString=".xls") returned 4 [0055.070] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0055.070] lstrlenW (lpString=".xlsx") returned 5 [0055.070] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0055.070] lstrlenW (lpString=".ppt") returned 4 [0055.070] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".zip") returned 4 [0055.071] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0055.071] lstrlenW (lpString=".rar") returned 4 [0055.071] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString=".bz2") returned 4 [0055.071] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString=".7z") returned 3 [0055.071] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".dbf") returned 4 [0055.071] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".1cd") returned 4 [0055.071] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".jpg") returned 4 [0055.071] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".doc") returned 4 [0055.071] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString=".docx") returned 5 [0055.071] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0055.071] lstrlenW (lpString=".pdf") returned 4 [0055.071] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString=".xls") returned 4 [0055.071] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0055.071] lstrlenW (lpString=".xlsx") returned 5 [0055.071] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0055.071] lstrlenW (lpString=".ppt") returned 4 [0055.071] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0055.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.071] lstrlenW (lpString=".zip") returned 4 [0055.072] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0055.072] lstrlenW (lpString=".rar") returned 4 [0055.072] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0055.072] lstrlenW (lpString=".bz2") returned 4 [0055.072] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0055.072] lstrlenW (lpString=".7z") returned 3 [0055.072] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.072] lstrlenW (lpString=".dbf") returned 4 [0055.072] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.072] lstrlenW (lpString=".1cd") returned 4 [0055.072] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0055.072] lstrlenW (lpString=".jpg") returned 4 [0055.072] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0055.072] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0055.072] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0055.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.072] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=73080) returned 1 [0055.072] CloseHandle (hObject=0x220) returned 1 [0055.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0055.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.073] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.073] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0055.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.073] GetLastError () returned 0x0 [0055.073] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x11d78, lpOverlapped=0x0) returned 1 [0055.077] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0055.097] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0055.097] WriteFile (in: hFile=0x17c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.097] SetEndOfFile (hFile=0x17c) returned 1 [0056.593] CloseHandle (hObject=0x17c) returned 1 [0056.593] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0056.593] SetEndOfFile (hFile=0x220) returned 1 [0056.670] CloseHandle (hObject=0x220) returned 1 [0056.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0056.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.721] lstrlenW (lpString=".doc") returned 4 [0056.721] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.721] lstrlenW (lpString=".docx") returned 5 [0056.721] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.721] lstrlenW (lpString=".pdf") returned 4 [0056.721] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.721] lstrlenW (lpString=".xls") returned 4 [0056.721] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString=".xlsx") returned 5 [0056.722] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.722] lstrlenW (lpString=".ppt") returned 4 [0056.722] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString=".zip") returned 4 [0056.722] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString=".rar") returned 4 [0056.722] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString=".bz2") returned 4 [0056.722] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.722] lstrlenW (lpString=".7z") returned 3 [0056.722] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString=".dbf") returned 4 [0056.722] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString=".1cd") returned 4 [0056.722] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString=".jpg") returned 4 [0056.722] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.722] lstrlenW (lpString=".doc") returned 4 [0056.722] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.722] lstrlenW (lpString=".docx") returned 5 [0056.722] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.722] lstrlenW (lpString=".pdf") returned 4 [0056.722] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString=".xls") returned 4 [0056.722] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.722] lstrlenW (lpString=".xlsx") returned 5 [0056.722] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.723] lstrlenW (lpString=".ppt") returned 4 [0056.723] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.723] lstrlenW (lpString=".zip") returned 4 [0056.723] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.723] lstrlenW (lpString=".rar") returned 4 [0056.723] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.723] lstrlenW (lpString=".bz2") returned 4 [0056.723] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.723] lstrlenW (lpString=".7z") returned 3 [0056.723] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.723] lstrlenW (lpString=".dbf") returned 4 [0056.723] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.723] lstrlenW (lpString=".1cd") returned 4 [0056.723] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0056.723] lstrlenW (lpString=".jpg") returned 4 [0056.723] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.723] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0056.723] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0056.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.724] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1831424) returned 1 [0056.724] CloseHandle (hObject=0x22c) returned 1 [0056.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0056.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0056.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.936] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0056.937] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0056.937] ReadFile (in: hFile=0x22c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.946] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0056.946] ReadFile (in: hFile=0x22c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.030] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.030] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0057.030] ReadFile (in: hFile=0x22c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.087] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.087] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0057.118] SetEndOfFile (hFile=0x22c) returned 1 [0057.118] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0057.122] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0057.123] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.124] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.127] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.129] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0057.129] CloseHandle (hObject=0x22c) returned 1 [0057.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.129] lstrlenW (lpString=".doc") returned 4 [0057.129] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.129] lstrlenW (lpString=".docx") returned 5 [0057.129] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0057.129] lstrlenW (lpString=".pdf") returned 4 [0057.129] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.129] lstrlenW (lpString=".xls") returned 4 [0057.129] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.129] lstrlenW (lpString=".xlsx") returned 5 [0057.129] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0057.129] lstrlenW (lpString=".ppt") returned 4 [0057.130] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString=".zip") returned 4 [0057.130] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString=".rar") returned 4 [0057.130] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString=".bz2") returned 4 [0057.130] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.130] lstrlenW (lpString=".7z") returned 3 [0057.130] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString=".dbf") returned 4 [0057.130] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString=".1cd") returned 4 [0057.130] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString=".jpg") returned 4 [0057.130] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.130] lstrlenW (lpString=".doc") returned 4 [0057.130] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString=".docx") returned 5 [0057.130] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0057.130] lstrlenW (lpString=".pdf") returned 4 [0057.130] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString=".xls") returned 4 [0057.130] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.130] lstrlenW (lpString=".xlsx") returned 5 [0057.130] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0057.130] lstrlenW (lpString=".ppt") returned 4 [0057.130] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.131] lstrlenW (lpString=".zip") returned 4 [0057.131] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.131] lstrlenW (lpString=".rar") returned 4 [0057.131] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.131] lstrlenW (lpString=".bz2") returned 4 [0057.131] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.131] lstrlenW (lpString=".7z") returned 3 [0057.131] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.131] lstrlenW (lpString=".dbf") returned 4 [0057.131] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.131] lstrlenW (lpString=".1cd") returned 4 [0057.131] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0057.131] lstrlenW (lpString=".jpg") returned 4 [0057.131] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.131] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0057.131] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.377] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3584) returned 1 [0057.378] CloseHandle (hObject=0x22c) returned 1 [0057.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0057.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.378] lstrlenW (lpString=".doc") returned 4 [0057.378] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.378] lstrlenW (lpString=".docx") returned 5 [0057.378] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.378] lstrlenW (lpString=".pdf") returned 4 [0057.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.378] lstrlenW (lpString=".xls") returned 4 [0057.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.378] lstrlenW (lpString=".xlsx") returned 5 [0057.378] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.378] lstrlenW (lpString=".ppt") returned 4 [0057.378] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString=".zip") returned 4 [0057.379] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.379] lstrlenW (lpString=".rar") returned 4 [0057.379] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.379] lstrlenW (lpString=".bz2") returned 4 [0057.379] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.379] lstrlenW (lpString=".7z") returned 3 [0057.379] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString=".dbf") returned 4 [0057.379] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString=".1cd") returned 4 [0057.379] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString=".jpg") returned 4 [0057.379] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.379] lstrlenW (lpString=".doc") returned 4 [0057.379] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.379] lstrlenW (lpString=".docx") returned 5 [0057.379] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.380] lstrlenW (lpString=".pdf") returned 4 [0057.380] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.380] lstrlenW (lpString=".xls") returned 4 [0057.380] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.380] lstrlenW (lpString=".xlsx") returned 5 [0057.380] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.380] lstrlenW (lpString=".ppt") returned 4 [0057.380] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.380] lstrlenW (lpString=".zip") returned 4 [0057.380] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.380] lstrlenW (lpString=".rar") returned 4 [0057.380] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.380] lstrlenW (lpString=".bz2") returned 4 [0057.380] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.380] lstrlenW (lpString=".7z") returned 3 [0057.380] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.380] lstrlenW (lpString=".dbf") returned 4 [0057.380] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.380] lstrlenW (lpString=".1cd") returned 4 [0057.380] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0057.380] lstrlenW (lpString=".jpg") returned 4 [0057.380] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.381] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".zoh") returned -1 [0057.381] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0057.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.381] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=55680) returned 1 [0057.381] CloseHandle (hObject=0x22c) returned 1 [0057.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0057.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.382] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.382] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.382] GetLastError () returned 0x0 [0057.382] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd980, lpOverlapped=0x0) returned 1 [0057.385] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd990, lpOverlapped=0x0) returned 1 [0057.387] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0057.387] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0057.387] SetEndOfFile (hFile=0x160) returned 1 [0057.387] CloseHandle (hObject=0x160) returned 1 [0057.388] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.388] SetEndOfFile (hFile=0x22c) returned 1 [0057.389] CloseHandle (hObject=0x22c) returned 1 [0057.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0057.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.389] lstrlenW (lpString=".doc") returned 4 [0057.389] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".docx") returned 5 [0057.390] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.390] lstrlenW (lpString=".pdf") returned 4 [0057.390] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".xls") returned 4 [0057.390] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".xlsx") returned 5 [0057.390] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.390] lstrlenW (lpString=".ppt") returned 4 [0057.390] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.390] lstrlenW (lpString=".zip") returned 4 [0057.390] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".rar") returned 4 [0057.390] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".bz2") returned 4 [0057.390] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString=".7z") returned 3 [0057.390] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.390] lstrlenW (lpString=".dbf") returned 4 [0057.390] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.390] lstrlenW (lpString=".1cd") returned 4 [0057.390] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.390] lstrlenW (lpString=".jpg") returned 4 [0057.390] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString=".doc") returned 4 [0057.391] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".docx") returned 5 [0057.391] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.391] lstrlenW (lpString=".pdf") returned 4 [0057.391] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".xls") returned 4 [0057.391] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".xlsx") returned 5 [0057.391] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.391] lstrlenW (lpString=".ppt") returned 4 [0057.391] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString=".zip") returned 4 [0057.391] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".rar") returned 4 [0057.391] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".bz2") returned 4 [0057.391] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString=".7z") returned 3 [0057.391] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString=".dbf") returned 4 [0057.391] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString=".1cd") returned 4 [0057.391] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.391] lstrlenW (lpString=".jpg") returned 4 [0057.391] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.392] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".zoh") returned -1 [0057.392] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0057.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.392] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1388416) returned 1 [0057.392] CloseHandle (hObject=0x22c) returned 1 [0057.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0057.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.392] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.393] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0057.393] GetLastError () returned 0x0 [0057.393] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0057.847] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0057.865] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x52f90, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0057.888] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0057.888] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfc, lpOverlapped=0x0) returned 1 [0057.888] SetEndOfFile (hFile=0x160) returned 1 [0057.888] CloseHandle (hObject=0x160) returned 1 [0057.889] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0057.889] SetEndOfFile (hFile=0x22c) returned 1 [0057.892] CloseHandle (hObject=0x22c) returned 1 [0057.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0057.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.903] lstrlenW (lpString=".doc") returned 4 [0057.903] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.903] lstrlenW (lpString=".docx") returned 5 [0057.903] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.903] lstrlenW (lpString=".pdf") returned 4 [0057.903] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.903] lstrlenW (lpString=".xls") returned 4 [0057.903] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".xlsx") returned 5 [0057.904] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.904] lstrlenW (lpString=".ppt") returned 4 [0057.904] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString=".zip") returned 4 [0057.904] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".rar") returned 4 [0057.904] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".bz2") returned 4 [0057.904] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".7z") returned 3 [0057.904] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString=".dbf") returned 4 [0057.904] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString=".1cd") returned 4 [0057.904] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString=".jpg") returned 4 [0057.904] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.904] lstrlenW (lpString=".doc") returned 4 [0057.904] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".docx") returned 5 [0057.904] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.904] lstrlenW (lpString=".pdf") returned 4 [0057.904] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".xls") returned 4 [0057.904] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.904] lstrlenW (lpString=".xlsx") returned 5 [0057.905] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.905] lstrlenW (lpString=".ppt") returned 4 [0057.905] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.905] lstrlenW (lpString=".zip") returned 4 [0057.905] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString=".rar") returned 4 [0057.905] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString=".bz2") returned 4 [0057.905] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString=".7z") returned 3 [0057.905] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.905] lstrlenW (lpString=".dbf") returned 4 [0057.905] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.905] lstrlenW (lpString=".1cd") returned 4 [0057.905] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0057.905] lstrlenW (lpString=".jpg") returned 4 [0057.905] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.905] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.905] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0057.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.516] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11656) returned 1 [0058.516] CloseHandle (hObject=0x160) returned 1 [0058.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0058.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.542] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.542] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.543] GetLastError () returned 0x0 [0058.543] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2d88, lpOverlapped=0x0) returned 1 [0058.545] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0058.546] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.546] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.546] SetEndOfFile (hFile=0x214) returned 1 [0058.547] CloseHandle (hObject=0x214) returned 1 [0058.547] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.547] SetEndOfFile (hFile=0x160) returned 1 [0058.548] CloseHandle (hObject=0x160) returned 1 [0058.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.549] lstrlenW (lpString=".doc") returned 4 [0058.549] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString=".docx") returned 5 [0058.549] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.549] lstrlenW (lpString=".pdf") returned 4 [0058.549] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString=".xls") returned 4 [0058.549] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString=".xlsx") returned 5 [0058.549] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.549] lstrlenW (lpString=".ppt") returned 4 [0058.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.549] lstrlenW (lpString=".zip") returned 4 [0058.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString=".rar") returned 4 [0058.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.549] lstrlenW (lpString=".bz2") returned 4 [0058.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.549] lstrlenW (lpString=".7z") returned 3 [0058.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.549] lstrlenW (lpString=".dbf") returned 4 [0058.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.549] lstrlenW (lpString=".1cd") returned 4 [0058.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString=".jpg") returned 4 [0058.550] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString=".doc") returned 4 [0058.550] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString=".docx") returned 5 [0058.550] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.550] lstrlenW (lpString=".pdf") returned 4 [0058.550] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString=".xls") returned 4 [0058.550] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString=".xlsx") returned 5 [0058.550] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.550] lstrlenW (lpString=".ppt") returned 4 [0058.550] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString=".zip") returned 4 [0058.550] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString=".rar") returned 4 [0058.550] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.550] lstrlenW (lpString=".bz2") returned 4 [0058.550] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.550] lstrlenW (lpString=".7z") returned 3 [0058.550] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString=".dbf") returned 4 [0058.550] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.550] lstrlenW (lpString=".1cd") returned 4 [0058.551] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.551] lstrlenW (lpString=".jpg") returned 4 [0058.551] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.551] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.551] lstrlenW (lpString="ACEERR.DLL") returned 10 [0058.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.552] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=43408) returned 1 [0058.552] CloseHandle (hObject=0x160) returned 1 [0058.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0058.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.552] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.552] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.553] GetLastError () returned 0x0 [0058.553] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa990, lpOverlapped=0x0) returned 1 [0058.556] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0058.557] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.557] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.557] SetEndOfFile (hFile=0x214) returned 1 [0058.558] CloseHandle (hObject=0x214) returned 1 [0058.558] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.558] SetEndOfFile (hFile=0x160) returned 1 [0058.559] CloseHandle (hObject=0x160) returned 1 [0058.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.559] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString=".doc") returned 4 [0058.560] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString=".docx") returned 5 [0058.560] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.560] lstrlenW (lpString=".pdf") returned 4 [0058.560] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString=".xls") returned 4 [0058.560] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString=".xlsx") returned 5 [0058.560] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.560] lstrlenW (lpString=".ppt") returned 4 [0058.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString=".zip") returned 4 [0058.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString=".rar") returned 4 [0058.560] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.560] lstrlenW (lpString=".bz2") returned 4 [0058.560] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.560] lstrlenW (lpString=".7z") returned 3 [0058.560] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString=".dbf") returned 4 [0058.560] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString=".1cd") returned 4 [0058.560] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.560] lstrlenW (lpString=".jpg") returned 4 [0058.560] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.561] lstrlenW (lpString=".doc") returned 4 [0058.561] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString=".docx") returned 5 [0058.561] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.561] lstrlenW (lpString=".pdf") returned 4 [0058.561] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString=".xls") returned 4 [0058.561] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString=".xlsx") returned 5 [0058.561] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.561] lstrlenW (lpString=".ppt") returned 4 [0058.561] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.561] lstrlenW (lpString=".zip") returned 4 [0058.561] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString=".rar") returned 4 [0058.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.561] lstrlenW (lpString=".bz2") returned 4 [0058.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.561] lstrlenW (lpString=".7z") returned 3 [0058.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.561] lstrlenW (lpString=".dbf") returned 4 [0058.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.561] lstrlenW (lpString=".1cd") returned 4 [0058.561] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.562] lstrlenW (lpString=".jpg") returned 4 [0058.562] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.562] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.562] lstrlenW (lpString="ACEES.DLL") returned 9 [0058.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.563] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1012648) returned 1 [0058.563] CloseHandle (hObject=0x160) returned 1 [0058.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0058.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.563] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.563] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.564] GetLastError () returned 0x0 [0058.564] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0058.584] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0058.768] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.768] SetEndOfFile (hFile=0x214) returned 1 [0058.768] CloseHandle (hObject=0x214) returned 1 [0058.768] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.768] SetEndOfFile (hFile=0x160) returned 1 [0058.777] CloseHandle (hObject=0x160) returned 1 [0058.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0058.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.777] lstrlenW (lpString=".doc") returned 4 [0058.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.777] lstrlenW (lpString=".docx") returned 5 [0058.777] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.777] lstrlenW (lpString=".pdf") returned 4 [0058.777] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.777] lstrlenW (lpString=".xls") returned 4 [0058.777] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.777] lstrlenW (lpString=".xlsx") returned 5 [0058.777] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.777] lstrlenW (lpString=".ppt") returned 4 [0058.777] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString=".zip") returned 4 [0058.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString=".rar") returned 4 [0058.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString=".bz2") returned 4 [0058.778] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.778] lstrlenW (lpString=".7z") returned 3 [0058.778] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString=".dbf") returned 4 [0058.778] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString=".1cd") returned 4 [0058.778] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString=".jpg") returned 4 [0058.778] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.778] lstrlenW (lpString=".doc") returned 4 [0058.778] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString=".docx") returned 5 [0058.778] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.778] lstrlenW (lpString=".pdf") returned 4 [0058.778] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString=".xls") returned 4 [0058.778] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString=".xlsx") returned 5 [0058.778] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.778] lstrlenW (lpString=".ppt") returned 4 [0058.778] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.779] lstrlenW (lpString=".zip") returned 4 [0058.779] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.779] lstrlenW (lpString=".rar") returned 4 [0058.779] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.779] lstrlenW (lpString=".bz2") returned 4 [0058.779] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.779] lstrlenW (lpString=".7z") returned 3 [0058.779] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.779] lstrlenW (lpString=".dbf") returned 4 [0058.779] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.779] lstrlenW (lpString=".1cd") returned 4 [0058.779] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.779] lstrlenW (lpString=".jpg") returned 4 [0058.779] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.779] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.779] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0058.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.780] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=342960) returned 1 [0058.780] CloseHandle (hObject=0x160) returned 1 [0058.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0058.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.780] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.780] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.781] GetLastError () returned 0x0 [0058.781] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0058.789] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0058.796] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.796] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.796] SetEndOfFile (hFile=0x214) returned 1 [0058.796] CloseHandle (hObject=0x214) returned 1 [0058.796] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.796] SetEndOfFile (hFile=0x160) returned 1 [0058.799] CloseHandle (hObject=0x160) returned 1 [0058.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0058.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.800] lstrlenW (lpString=".doc") returned 4 [0058.800] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString=".docx") returned 5 [0058.800] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0058.800] lstrlenW (lpString=".pdf") returned 4 [0058.800] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString=".xls") returned 4 [0058.800] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString=".xlsx") returned 5 [0058.800] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0058.800] lstrlenW (lpString=".ppt") returned 4 [0058.800] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.800] lstrlenW (lpString=".zip") returned 4 [0058.800] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString=".rar") returned 4 [0058.800] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.800] lstrlenW (lpString=".bz2") returned 4 [0058.800] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.800] lstrlenW (lpString=".7z") returned 3 [0058.801] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString=".dbf") returned 4 [0058.801] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString=".1cd") returned 4 [0058.801] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString=".jpg") returned 4 [0058.801] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString=".doc") returned 4 [0058.801] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString=".docx") returned 5 [0058.801] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0058.801] lstrlenW (lpString=".pdf") returned 4 [0058.801] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString=".xls") returned 4 [0058.801] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString=".xlsx") returned 5 [0058.801] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0058.801] lstrlenW (lpString=".ppt") returned 4 [0058.801] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.801] lstrlenW (lpString=".zip") returned 4 [0058.801] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString=".rar") returned 4 [0058.801] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.801] lstrlenW (lpString=".bz2") returned 4 [0058.801] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.802] lstrlenW (lpString=".7z") returned 3 [0058.802] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.802] lstrlenW (lpString=".dbf") returned 4 [0058.802] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.802] lstrlenW (lpString=".1cd") returned 4 [0058.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.802] lstrlenW (lpString=".jpg") returned 4 [0058.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.802] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.802] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0058.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.803] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=15800) returned 1 [0058.803] CloseHandle (hObject=0x160) returned 1 [0058.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0058.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.803] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.803] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.803] GetLastError () returned 0x0 [0058.803] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3db8, lpOverlapped=0x0) returned 1 [0058.805] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0058.807] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.807] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.807] SetEndOfFile (hFile=0x214) returned 1 [0058.807] CloseHandle (hObject=0x214) returned 1 [0058.808] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.808] SetEndOfFile (hFile=0x160) returned 1 [0058.808] CloseHandle (hObject=0x160) returned 1 [0058.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0058.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.809] lstrlenW (lpString=".doc") returned 4 [0058.809] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString=".docx") returned 5 [0058.809] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.809] lstrlenW (lpString=".pdf") returned 4 [0058.809] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString=".xls") returned 4 [0058.809] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString=".xlsx") returned 5 [0058.809] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.809] lstrlenW (lpString=".ppt") returned 4 [0058.809] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.809] lstrlenW (lpString=".zip") returned 4 [0058.809] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString=".rar") returned 4 [0058.809] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.809] lstrlenW (lpString=".bz2") returned 4 [0058.809] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.809] lstrlenW (lpString=".7z") returned 3 [0058.809] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString=".dbf") returned 4 [0058.810] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString=".1cd") returned 4 [0058.810] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString=".jpg") returned 4 [0058.810] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString=".doc") returned 4 [0058.810] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString=".docx") returned 5 [0058.810] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.810] lstrlenW (lpString=".pdf") returned 4 [0058.810] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString=".xls") returned 4 [0058.810] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString=".xlsx") returned 5 [0058.810] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.810] lstrlenW (lpString=".ppt") returned 4 [0058.810] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.810] lstrlenW (lpString=".zip") returned 4 [0058.810] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString=".rar") returned 4 [0058.810] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.810] lstrlenW (lpString=".bz2") returned 4 [0058.810] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.810] lstrlenW (lpString=".7z") returned 3 [0058.810] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.811] lstrlenW (lpString=".dbf") returned 4 [0058.811] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.811] lstrlenW (lpString=".1cd") returned 4 [0058.811] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0058.811] lstrlenW (lpString=".jpg") returned 4 [0058.811] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.811] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.811] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0058.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.812] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=15800) returned 1 [0058.812] CloseHandle (hObject=0x160) returned 1 [0058.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0058.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.812] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.812] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.813] GetLastError () returned 0x0 [0058.813] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3db8, lpOverlapped=0x0) returned 1 [0058.816] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0058.819] ReadFile (in: hFile=0x160, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0058.819] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.820] SetEndOfFile (hFile=0x214) returned 1 [0058.820] CloseHandle (hObject=0x214) returned 1 [0058.820] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0058.820] SetEndOfFile (hFile=0x160) returned 1 [0058.821] CloseHandle (hObject=0x160) returned 1 [0058.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0058.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.821] lstrlenW (lpString=".doc") returned 4 [0058.821] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.821] lstrlenW (lpString=".docx") returned 5 [0058.821] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.821] lstrlenW (lpString=".pdf") returned 4 [0058.821] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.821] lstrlenW (lpString=".xls") returned 4 [0058.821] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.821] lstrlenW (lpString=".xlsx") returned 5 [0058.821] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.822] lstrlenW (lpString=".ppt") returned 4 [0058.822] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString=".zip") returned 4 [0058.822] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString=".rar") returned 4 [0058.822] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString=".bz2") returned 4 [0058.822] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.822] lstrlenW (lpString=".7z") returned 3 [0058.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString=".dbf") returned 4 [0058.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString=".1cd") returned 4 [0058.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString=".jpg") returned 4 [0058.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.822] lstrlenW (lpString=".doc") returned 4 [0058.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString=".docx") returned 5 [0058.822] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.822] lstrlenW (lpString=".pdf") returned 4 [0058.822] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString=".xls") returned 4 [0058.822] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.822] lstrlenW (lpString=".xlsx") returned 5 [0058.822] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.822] lstrlenW (lpString=".ppt") returned 4 [0058.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0058.823] lstrlenW (lpString=".zip") returned 4 [0058.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.107] lstrlenW (lpString=".rar") returned 4 [0059.107] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.107] lstrlenW (lpString=".bz2") returned 4 [0059.107] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.107] lstrlenW (lpString=".7z") returned 3 [0059.107] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.107] lstrlenW (lpString=".dbf") returned 4 [0059.107] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.107] lstrlenW (lpString=".1cd") returned 4 [0059.107] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.107] lstrlenW (lpString=".jpg") returned 4 [0059.107] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.108] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.108] lstrlenW (lpString="ACER3X.DLL") returned 10 [0059.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0059.113] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=451480) returned 1 [0059.113] CloseHandle (hObject=0x1c8) returned 1 [0059.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0059.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0059.113] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0059.113] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0059.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0059.114] GetLastError () returned 0x0 [0059.114] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6e398, lpOverlapped=0x0) returned 1 [0059.125] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0059.133] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0059.134] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.134] SetEndOfFile (hFile=0x22c) returned 1 [0059.134] CloseHandle (hObject=0x22c) returned 1 [0059.134] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0059.134] SetEndOfFile (hFile=0x1c8) returned 1 [0059.469] CloseHandle (hObject=0x1c8) returned 1 [0059.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0060.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.355] lstrlenW (lpString=".doc") returned 4 [0060.355] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString=".docx") returned 5 [0060.356] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0060.356] lstrlenW (lpString=".pdf") returned 4 [0060.356] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString=".xls") returned 4 [0060.356] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString=".xlsx") returned 5 [0060.356] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0060.356] lstrlenW (lpString=".ppt") returned 4 [0060.356] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.356] lstrlenW (lpString=".zip") returned 4 [0060.356] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString=".rar") returned 4 [0060.356] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.356] lstrlenW (lpString=".bz2") returned 4 [0060.356] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.356] lstrlenW (lpString=".7z") returned 3 [0060.356] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.356] lstrlenW (lpString=".dbf") returned 4 [0060.356] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.356] lstrlenW (lpString=".1cd") returned 4 [0060.357] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString=".jpg") returned 4 [0060.357] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString=".doc") returned 4 [0060.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString=".docx") returned 5 [0060.357] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0060.357] lstrlenW (lpString=".pdf") returned 4 [0060.357] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString=".xls") returned 4 [0060.357] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString=".xlsx") returned 5 [0060.357] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0060.357] lstrlenW (lpString=".ppt") returned 4 [0060.357] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString=".zip") returned 4 [0060.357] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString=".rar") returned 4 [0060.357] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.357] lstrlenW (lpString=".bz2") returned 4 [0060.357] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.357] lstrlenW (lpString=".7z") returned 3 [0060.357] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString=".dbf") returned 4 [0060.357] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.357] lstrlenW (lpString=".1cd") returned 4 [0060.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0060.358] lstrlenW (lpString=".jpg") returned 4 [0060.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.358] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.358] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0060.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0060.365] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=385368) returned 1 [0060.365] CloseHandle (hObject=0x190) returned 1 [0060.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0060.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0060.366] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0060.366] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0060.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0060.366] GetLastError () returned 0x0 [0060.366] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5e158, lpOverlapped=0x0) returned 1 [0060.382] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0060.389] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0060.389] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.389] SetEndOfFile (hFile=0x1bc) returned 1 [0060.389] CloseHandle (hObject=0x1bc) returned 1 [0060.390] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0060.390] SetEndOfFile (hFile=0x190) returned 1 [0060.393] CloseHandle (hObject=0x190) returned 1 [0060.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0060.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString=".doc") returned 4 [0060.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString=".docx") returned 5 [0060.394] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.394] lstrlenW (lpString=".pdf") returned 4 [0060.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString=".xls") returned 4 [0060.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString=".xlsx") returned 5 [0060.394] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.394] lstrlenW (lpString=".ppt") returned 4 [0060.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString=".zip") returned 4 [0060.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString=".rar") returned 4 [0060.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString=".bz2") returned 4 [0060.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.394] lstrlenW (lpString=".7z") returned 3 [0060.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString=".dbf") returned 4 [0060.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString=".1cd") returned 4 [0060.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString=".jpg") returned 4 [0060.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.395] lstrlenW (lpString=".doc") returned 4 [0060.395] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString=".docx") returned 5 [0060.395] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.395] lstrlenW (lpString=".pdf") returned 4 [0060.395] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString=".xls") returned 4 [0060.395] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString=".xlsx") returned 5 [0060.395] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.395] lstrlenW (lpString=".ppt") returned 4 [0060.395] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.395] lstrlenW (lpString=".zip") returned 4 [0060.395] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString=".rar") returned 4 [0060.395] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.395] lstrlenW (lpString=".bz2") returned 4 [0060.395] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.395] lstrlenW (lpString=".7z") returned 3 [0060.395] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.395] lstrlenW (lpString=".dbf") returned 4 [0060.395] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.395] lstrlenW (lpString=".1cd") returned 4 [0060.395] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.395] lstrlenW (lpString=".jpg") returned 4 [0060.395] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.395] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0060.396] lstrlenW (lpString="Csi.dll") returned 7 [0060.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0060.403] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5072816) returned 1 [0060.403] CloseHandle (hObject=0x190) returned 1 [0060.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0060.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0060.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0060.404] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0060.404] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0060.404] ReadFile (in: hFile=0x190, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.413] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0060.413] ReadFile (in: hFile=0x190, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.664] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.664] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0060.664] ReadFile (in: hFile=0x190, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.680] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0060.680] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0060.838] SetEndOfFile (hFile=0x190) returned 1 [0060.891] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0060.891] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0060.891] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.892] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0060.892] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.894] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0060.894] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.896] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0060.896] CloseHandle (hObject=0x190) returned 1 [0060.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.897] lstrlenW (lpString=".doc") returned 4 [0060.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString=".docx") returned 5 [0060.897] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0060.897] lstrlenW (lpString=".pdf") returned 4 [0060.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString=".xls") returned 4 [0060.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString=".xlsx") returned 5 [0060.897] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0060.897] lstrlenW (lpString=".ppt") returned 4 [0060.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.897] lstrlenW (lpString=".zip") returned 4 [0060.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString=".rar") returned 4 [0060.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.897] lstrlenW (lpString=".bz2") returned 4 [0060.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.898] lstrlenW (lpString=".7z") returned 3 [0060.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString=".dbf") returned 4 [0060.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString=".1cd") returned 4 [0060.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString=".jpg") returned 4 [0060.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString=".doc") returned 4 [0060.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.898] lstrlenW (lpString=".docx") returned 5 [0060.898] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0060.898] lstrlenW (lpString=".pdf") returned 4 [0060.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.898] lstrlenW (lpString=".xls") returned 4 [0060.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.898] lstrlenW (lpString=".xlsx") returned 5 [0060.898] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0060.898] lstrlenW (lpString=".ppt") returned 4 [0060.898] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.898] lstrlenW (lpString=".zip") returned 4 [0060.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.899] lstrlenW (lpString=".rar") returned 4 [0060.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.899] lstrlenW (lpString=".bz2") returned 4 [0060.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.899] lstrlenW (lpString=".7z") returned 3 [0060.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.899] lstrlenW (lpString=".dbf") returned 4 [0060.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.899] lstrlenW (lpString=".1cd") returned 4 [0060.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.899] lstrlenW (lpString=".jpg") returned 4 [0060.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.899] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.899] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0060.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.408] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=71032) returned 1 [0061.408] CloseHandle (hObject=0x150) returned 1 [0061.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0061.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.408] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.416] GetLastError () returned 0x0 [0061.416] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x11578, lpOverlapped=0x0) returned 1 [0061.726] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x11580, lpOverlapped=0x0) returned 1 [0061.728] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0061.728] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.728] SetEndOfFile (hFile=0x1c8) returned 1 [0061.728] CloseHandle (hObject=0x1c8) returned 1 [0061.729] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.729] SetEndOfFile (hFile=0x150) returned 1 [0061.730] CloseHandle (hObject=0x150) returned 1 [0061.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0061.730] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0061.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.730] lstrlenW (lpString=".doc") returned 4 [0061.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.730] lstrlenW (lpString=".docx") returned 5 [0061.730] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0061.730] lstrlenW (lpString=".pdf") returned 4 [0061.730] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.730] lstrlenW (lpString=".xls") returned 4 [0061.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString=".xlsx") returned 5 [0061.731] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0061.731] lstrlenW (lpString=".ppt") returned 4 [0061.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString=".zip") returned 4 [0061.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString=".rar") returned 4 [0061.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString=".bz2") returned 4 [0061.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.731] lstrlenW (lpString=".7z") returned 3 [0061.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString=".dbf") returned 4 [0061.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString=".1cd") returned 4 [0061.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString=".jpg") returned 4 [0061.731] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.731] lstrlenW (lpString=".doc") returned 4 [0061.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString=".docx") returned 5 [0061.731] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0061.731] lstrlenW (lpString=".pdf") returned 4 [0061.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.731] lstrlenW (lpString=".xls") returned 4 [0061.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.732] lstrlenW (lpString=".xlsx") returned 5 [0061.732] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0061.732] lstrlenW (lpString=".ppt") returned 4 [0061.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.732] lstrlenW (lpString=".zip") returned 4 [0061.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.732] lstrlenW (lpString=".rar") returned 4 [0061.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.732] lstrlenW (lpString=".bz2") returned 4 [0061.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.732] lstrlenW (lpString=".7z") returned 3 [0061.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.732] lstrlenW (lpString=".dbf") returned 4 [0061.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.732] lstrlenW (lpString=".1cd") returned 4 [0061.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0061.732] lstrlenW (lpString=".jpg") returned 4 [0061.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.732] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0061.732] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0061.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.734] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=473952) returned 1 [0061.734] CloseHandle (hObject=0x150) returned 1 [0061.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0061.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.735] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.735] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.736] GetLastError () returned 0x0 [0061.736] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x73b60, lpOverlapped=0x0) returned 1 [0061.920] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x73b70, lpOverlapped=0x0) returned 1 [0061.930] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0061.930] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.930] SetEndOfFile (hFile=0x1c8) returned 1 [0061.931] CloseHandle (hObject=0x1c8) returned 1 [0061.931] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.931] SetEndOfFile (hFile=0x150) returned 1 [0061.935] CloseHandle (hObject=0x150) returned 1 [0061.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0061.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0061.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.935] lstrlenW (lpString=".doc") returned 4 [0061.935] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.935] lstrlenW (lpString=".docx") returned 5 [0061.935] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0061.935] lstrlenW (lpString=".pdf") returned 4 [0061.935] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.935] lstrlenW (lpString=".xls") returned 4 [0061.935] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.935] lstrlenW (lpString=".xlsx") returned 5 [0061.935] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0061.936] lstrlenW (lpString=".ppt") returned 4 [0061.936] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString=".zip") returned 4 [0061.936] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.936] lstrlenW (lpString=".rar") returned 4 [0061.936] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.936] lstrlenW (lpString=".bz2") returned 4 [0061.936] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.936] lstrlenW (lpString=".7z") returned 3 [0061.936] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString=".dbf") returned 4 [0061.936] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString=".1cd") returned 4 [0061.936] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString=".jpg") returned 4 [0061.936] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.936] lstrlenW (lpString=".doc") returned 4 [0061.936] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.936] lstrlenW (lpString=".docx") returned 5 [0061.936] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0061.936] lstrlenW (lpString=".pdf") returned 4 [0061.936] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.936] lstrlenW (lpString=".xls") returned 4 [0061.936] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.937] lstrlenW (lpString=".xlsx") returned 5 [0061.937] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0061.937] lstrlenW (lpString=".ppt") returned 4 [0061.937] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.937] lstrlenW (lpString=".zip") returned 4 [0061.937] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.937] lstrlenW (lpString=".rar") returned 4 [0061.937] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.937] lstrlenW (lpString=".bz2") returned 4 [0061.937] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.937] lstrlenW (lpString=".7z") returned 3 [0061.937] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.937] lstrlenW (lpString=".dbf") returned 4 [0061.937] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.937] lstrlenW (lpString=".1cd") returned 4 [0061.937] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.937] lstrlenW (lpString=".jpg") returned 4 [0061.937] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.937] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0061.937] lstrlenW (lpString="msoshext.dll") returned 12 [0061.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0061.938] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1269648) returned 1 [0061.938] CloseHandle (hObject=0x150) returned 1 [0061.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0061.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.938] lstrlenW (lpString=".doc") returned 4 [0061.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.938] lstrlenW (lpString=".docx") returned 5 [0061.938] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.938] lstrlenW (lpString=".pdf") returned 4 [0061.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.938] lstrlenW (lpString=".xls") returned 4 [0061.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.938] lstrlenW (lpString=".xlsx") returned 5 [0061.938] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.938] lstrlenW (lpString=".ppt") returned 4 [0061.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.938] lstrlenW (lpString=".zip") returned 4 [0061.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString=".rar") returned 4 [0061.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString=".bz2") returned 4 [0061.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.939] lstrlenW (lpString=".7z") returned 3 [0061.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.939] lstrlenW (lpString=".dbf") returned 4 [0061.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.939] lstrlenW (lpString=".1cd") returned 4 [0061.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.939] lstrlenW (lpString=".jpg") returned 4 [0061.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.939] lstrlenW (lpString=".doc") returned 4 [0061.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString=".docx") returned 5 [0061.939] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.939] lstrlenW (lpString=".pdf") returned 4 [0061.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString=".xls") returned 4 [0061.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString=".xlsx") returned 5 [0061.939] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.939] lstrlenW (lpString=".ppt") returned 4 [0061.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.940] lstrlenW (lpString=".zip") returned 4 [0061.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.940] lstrlenW (lpString=".rar") returned 4 [0061.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.940] lstrlenW (lpString=".bz2") returned 4 [0061.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.940] lstrlenW (lpString=".7z") returned 3 [0061.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.940] lstrlenW (lpString=".dbf") returned 4 [0061.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.940] lstrlenW (lpString=".1cd") returned 4 [0061.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.940] lstrlenW (lpString=".jpg") returned 4 [0061.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.940] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0061.940] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0061.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.978] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=56144) returned 1 [0061.978] CloseHandle (hObject=0x1c8) returned 1 [0061.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0061.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.978] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.978] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0061.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0061.979] GetLastError () returned 0x0 [0061.979] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdb50, lpOverlapped=0x0) returned 1 [0062.007] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdb60, lpOverlapped=0x0) returned 1 [0062.009] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0062.009] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.009] SetEndOfFile (hFile=0x1bc) returned 1 [0062.010] CloseHandle (hObject=0x1bc) returned 1 [0062.010] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0062.010] SetEndOfFile (hFile=0x1c8) returned 1 [0062.011] CloseHandle (hObject=0x1c8) returned 1 [0062.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0062.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.011] lstrlenW (lpString=".doc") returned 4 [0062.011] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.011] lstrlenW (lpString=".docx") returned 5 [0062.012] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0062.012] lstrlenW (lpString=".pdf") returned 4 [0062.012] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString=".xls") returned 4 [0062.012] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString=".xlsx") returned 5 [0062.012] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0062.012] lstrlenW (lpString=".ppt") returned 4 [0062.012] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.012] lstrlenW (lpString=".zip") returned 4 [0062.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString=".rar") returned 4 [0062.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString=".bz2") returned 4 [0062.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.012] lstrlenW (lpString=".7z") returned 3 [0062.012] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.012] lstrlenW (lpString=".dbf") returned 4 [0062.012] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.012] lstrlenW (lpString=".1cd") returned 4 [0062.012] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.012] lstrlenW (lpString=".jpg") returned 4 [0062.012] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.013] lstrlenW (lpString=".doc") returned 4 [0062.013] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString=".docx") returned 5 [0062.013] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0062.013] lstrlenW (lpString=".pdf") returned 4 [0062.013] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString=".xls") returned 4 [0062.013] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString=".xlsx") returned 5 [0062.013] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0062.013] lstrlenW (lpString=".ppt") returned 4 [0062.013] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.013] lstrlenW (lpString=".zip") returned 4 [0062.013] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString=".rar") returned 4 [0062.013] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.013] lstrlenW (lpString=".bz2") returned 4 [0062.013] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.013] lstrlenW (lpString=".7z") returned 3 [0062.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.013] lstrlenW (lpString=".dbf") returned 4 [0062.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.013] lstrlenW (lpString=".1cd") returned 4 [0062.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0062.013] lstrlenW (lpString=".jpg") returned 4 [0062.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.014] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0062.014] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0062.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.015] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=121168) returned 1 [0062.015] CloseHandle (hObject=0x1c8) returned 1 [0062.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0062.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.015] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0062.015] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0062.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.016] GetLastError () returned 0x0 [0062.016] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1d950, lpOverlapped=0x0) returned 1 [0062.173] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1d960, lpOverlapped=0x0) returned 1 [0062.175] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0062.175] WriteFile (in: hFile=0x1bc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.175] SetEndOfFile (hFile=0x1bc) returned 1 [0062.176] CloseHandle (hObject=0x1bc) returned 1 [0062.176] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0062.176] SetEndOfFile (hFile=0x1c8) returned 1 [0062.177] CloseHandle (hObject=0x1c8) returned 1 [0062.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0062.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.248] lstrlenW (lpString=".doc") returned 4 [0062.248] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0062.248] lstrlenW (lpString=".docx") returned 5 [0062.248] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0062.248] lstrlenW (lpString=".pdf") returned 4 [0062.248] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0062.248] lstrlenW (lpString=".xls") returned 4 [0062.248] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0062.248] lstrlenW (lpString=".xlsx") returned 5 [0062.248] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0062.248] lstrlenW (lpString=".ppt") returned 4 [0062.248] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString=".zip") returned 4 [0062.249] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString=".rar") returned 4 [0062.249] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString=".bz2") returned 4 [0062.249] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0062.249] lstrlenW (lpString=".7z") returned 3 [0062.249] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString=".dbf") returned 4 [0062.249] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString=".1cd") returned 4 [0062.249] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString=".jpg") returned 4 [0062.249] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.249] lstrlenW (lpString=".doc") returned 4 [0062.249] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0062.249] lstrlenW (lpString=".docx") returned 5 [0062.249] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0062.249] lstrlenW (lpString=".pdf") returned 4 [0062.249] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString=".xls") returned 4 [0062.249] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0062.249] lstrlenW (lpString=".xlsx") returned 5 [0062.249] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0062.250] lstrlenW (lpString=".ppt") returned 4 [0062.250] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0062.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.250] lstrlenW (lpString=".zip") returned 4 [0062.250] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0062.250] lstrlenW (lpString=".rar") returned 4 [0062.250] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0062.250] lstrlenW (lpString=".bz2") returned 4 [0062.250] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0062.250] lstrlenW (lpString=".7z") returned 3 [0062.250] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.250] lstrlenW (lpString=".dbf") returned 4 [0062.250] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.250] lstrlenW (lpString=".1cd") returned 4 [0062.250] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0062.250] lstrlenW (lpString=".jpg") returned 4 [0062.250] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0062.250] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.250] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0062.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.995] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=24976) returned 1 [0062.995] CloseHandle (hObject=0x158) returned 1 [0062.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0062.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.005] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.005] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.012] GetLastError () returned 0x0 [0063.012] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6190, lpOverlapped=0x0) returned 1 [0063.030] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0063.031] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0063.031] WriteFile (in: hFile=0x190, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.031] SetEndOfFile (hFile=0x190) returned 1 [0063.031] CloseHandle (hObject=0x190) returned 1 [0063.032] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.032] SetEndOfFile (hFile=0x150) returned 1 [0063.033] CloseHandle (hObject=0x150) returned 1 [0063.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0063.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.033] lstrlenW (lpString=".doc") returned 4 [0063.033] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.033] lstrlenW (lpString=".docx") returned 5 [0063.033] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0063.033] lstrlenW (lpString=".pdf") returned 4 [0063.033] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.033] lstrlenW (lpString=".xls") returned 4 [0063.033] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.033] lstrlenW (lpString=".xlsx") returned 5 [0063.033] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0063.033] lstrlenW (lpString=".ppt") returned 4 [0063.033] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.033] lstrlenW (lpString=".zip") returned 4 [0063.033] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".rar") returned 4 [0063.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".bz2") returned 4 [0063.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.034] lstrlenW (lpString=".7z") returned 3 [0063.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString=".dbf") returned 4 [0063.034] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString=".1cd") returned 4 [0063.034] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString=".jpg") returned 4 [0063.034] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString=".doc") returned 4 [0063.034] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".docx") returned 5 [0063.034] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0063.034] lstrlenW (lpString=".pdf") returned 4 [0063.034] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".xls") returned 4 [0063.034] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".xlsx") returned 5 [0063.034] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0063.034] lstrlenW (lpString=".ppt") returned 4 [0063.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.034] lstrlenW (lpString=".zip") returned 4 [0063.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.034] lstrlenW (lpString=".rar") returned 4 [0063.035] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.035] lstrlenW (lpString=".bz2") returned 4 [0063.035] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.035] lstrlenW (lpString=".7z") returned 3 [0063.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.035] lstrlenW (lpString=".dbf") returned 4 [0063.035] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.035] lstrlenW (lpString=".1cd") returned 4 [0063.035] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0063.035] lstrlenW (lpString=".jpg") returned 4 [0063.035] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.035] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.035] lstrlenW (lpString="OSETUP.DLL") returned 10 [0063.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.036] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7379816) returned 1 [0063.036] CloseHandle (hObject=0x150) returned 1 [0063.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0063.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0063.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.037] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0063.037] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0063.037] ReadFile (in: hFile=0x150, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.049] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0063.049] ReadFile (in: hFile=0x150, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.054] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.054] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0063.054] ReadFile (in: hFile=0x150, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.598] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.598] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0063.613] SetEndOfFile (hFile=0x150) returned 1 [0063.613] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0063.613] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0063.613] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.615] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0063.615] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.617] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0063.617] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.618] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0063.618] CloseHandle (hObject=0x150) returned 1 [0063.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString=".doc") returned 4 [0063.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString=".docx") returned 5 [0063.619] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.619] lstrlenW (lpString=".pdf") returned 4 [0063.619] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString=".xls") returned 4 [0063.619] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString=".xlsx") returned 5 [0063.619] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.619] lstrlenW (lpString=".ppt") returned 4 [0063.619] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString=".zip") returned 4 [0063.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString=".rar") returned 4 [0063.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString=".bz2") returned 4 [0063.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.619] lstrlenW (lpString=".7z") returned 3 [0063.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString=".dbf") returned 4 [0063.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString=".1cd") returned 4 [0063.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.619] lstrlenW (lpString=".jpg") returned 4 [0063.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString=".doc") returned 4 [0063.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString=".docx") returned 5 [0063.620] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.620] lstrlenW (lpString=".pdf") returned 4 [0063.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString=".xls") returned 4 [0063.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString=".xlsx") returned 5 [0063.620] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.620] lstrlenW (lpString=".ppt") returned 4 [0063.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString=".zip") returned 4 [0063.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString=".rar") returned 4 [0063.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.620] lstrlenW (lpString=".bz2") returned 4 [0063.620] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.620] lstrlenW (lpString=".7z") returned 3 [0063.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString=".dbf") returned 4 [0063.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString=".1cd") returned 4 [0063.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.620] lstrlenW (lpString=".jpg") returned 4 [0063.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.621] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.621] lstrlenW (lpString="OFFREL.DLL") returned 10 [0063.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.621] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9568) returned 1 [0063.621] CloseHandle (hObject=0x150) returned 1 [0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.622] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.622] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.622] GetLastError () returned 0x0 [0063.622] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2560, lpOverlapped=0x0) returned 1 [0063.833] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2570, lpOverlapped=0x0) returned 1 [0063.834] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0063.834] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0063.834] SetEndOfFile (hFile=0x214) returned 1 [0063.834] CloseHandle (hObject=0x214) returned 1 [0063.834] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.834] SetEndOfFile (hFile=0x150) returned 1 [0063.835] CloseHandle (hObject=0x150) returned 1 [0063.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.835] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1 [0063.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.836] lstrlenW (lpString=".doc") returned 4 [0063.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString=".docx") returned 5 [0063.836] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0063.836] lstrlenW (lpString=".pdf") returned 4 [0063.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString=".xls") returned 4 [0063.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString=".xlsx") returned 5 [0063.836] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0063.836] lstrlenW (lpString=".ppt") returned 4 [0063.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.836] lstrlenW (lpString=".zip") returned 4 [0063.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString=".rar") returned 4 [0063.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.836] lstrlenW (lpString=".bz2") returned 4 [0063.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.836] lstrlenW (lpString=".7z") returned 3 [0063.836] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.836] lstrlenW (lpString=".dbf") returned 4 [0063.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.836] lstrlenW (lpString=".1cd") returned 4 [0063.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.837] lstrlenW (lpString=".jpg") returned 4 [0063.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.837] lstrlenW (lpString=".doc") returned 4 [0063.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString=".docx") returned 5 [0063.837] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0063.837] lstrlenW (lpString=".pdf") returned 4 [0063.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString=".xls") returned 4 [0063.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString=".xlsx") returned 5 [0063.837] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0063.837] lstrlenW (lpString=".ppt") returned 4 [0063.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.837] lstrlenW (lpString=".zip") returned 4 [0063.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString=".rar") returned 4 [0063.837] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.837] lstrlenW (lpString=".bz2") returned 4 [0063.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.837] lstrlenW (lpString=".7z") returned 3 [0063.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.837] lstrlenW (lpString=".dbf") returned 4 [0063.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.838] lstrlenW (lpString=".1cd") returned 4 [0063.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0063.838] lstrlenW (lpString=".jpg") returned 4 [0063.838] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.838] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.838] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0063.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.840] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=18336) returned 1 [0063.840] CloseHandle (hObject=0x150) returned 1 [0063.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0063.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.841] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.841] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.841] GetLastError () returned 0x0 [0063.841] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x47a0, lpOverlapped=0x0) returned 1 [0063.843] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x47b0, lpOverlapped=0x0) returned 1 [0063.844] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0063.844] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.845] SetEndOfFile (hFile=0x214) returned 1 [0063.845] CloseHandle (hObject=0x214) returned 1 [0063.845] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.845] SetEndOfFile (hFile=0x150) returned 1 [0063.846] CloseHandle (hObject=0x150) returned 1 [0063.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1 [0063.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.846] lstrlenW (lpString=".doc") returned 4 [0063.846] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.846] lstrlenW (lpString=".docx") returned 5 [0063.846] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0063.846] lstrlenW (lpString=".pdf") returned 4 [0063.846] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.846] lstrlenW (lpString=".xls") returned 4 [0063.846] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.846] lstrlenW (lpString=".xlsx") returned 5 [0063.846] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0063.846] lstrlenW (lpString=".ppt") returned 4 [0063.847] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString=".zip") returned 4 [0063.847] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString=".rar") returned 4 [0063.847] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString=".bz2") returned 4 [0063.847] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.847] lstrlenW (lpString=".7z") returned 3 [0063.847] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString=".dbf") returned 4 [0063.847] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString=".1cd") returned 4 [0063.847] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString=".jpg") returned 4 [0063.847] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.847] lstrlenW (lpString=".doc") returned 4 [0063.847] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString=".docx") returned 5 [0063.847] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0063.847] lstrlenW (lpString=".pdf") returned 4 [0063.847] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString=".xls") returned 4 [0063.847] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.847] lstrlenW (lpString=".xlsx") returned 5 [0063.847] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0063.848] lstrlenW (lpString=".ppt") returned 4 [0063.848] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.848] lstrlenW (lpString=".zip") returned 4 [0063.848] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.848] lstrlenW (lpString=".rar") returned 4 [0063.848] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.848] lstrlenW (lpString=".bz2") returned 4 [0063.848] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.848] lstrlenW (lpString=".7z") returned 3 [0063.848] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.848] lstrlenW (lpString=".dbf") returned 4 [0063.848] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.848] lstrlenW (lpString=".1cd") returned 4 [0063.848] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0063.848] lstrlenW (lpString=".jpg") returned 4 [0063.848] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.848] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.848] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0063.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.849] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=752552) returned 1 [0063.850] CloseHandle (hObject=0x150) returned 1 [0063.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0063.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0063.850] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.850] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0063.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.850] GetLastError () returned 0x0 [0063.850] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0063.865] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb7bb0, lpOverlapped=0x0) returned 1 [0063.902] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0063.902] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.902] SetEndOfFile (hFile=0x214) returned 1 [0064.787] CloseHandle (hObject=0x214) returned 1 [0064.952] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0064.985] SetEndOfFile (hFile=0x150) returned 1 [0064.991] CloseHandle (hObject=0x150) returned 1 [0064.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0064.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.991] lstrlenW (lpString=".doc") returned 4 [0064.991] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.991] lstrlenW (lpString=".docx") returned 5 [0064.991] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0064.992] lstrlenW (lpString=".pdf") returned 4 [0064.992] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString=".xls") returned 4 [0064.992] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString=".xlsx") returned 5 [0064.992] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0064.992] lstrlenW (lpString=".ppt") returned 4 [0064.992] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString=".zip") returned 4 [0064.992] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString=".rar") returned 4 [0064.992] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString=".bz2") returned 4 [0064.992] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.992] lstrlenW (lpString=".7z") returned 3 [0064.992] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString=".dbf") returned 4 [0064.992] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString=".1cd") returned 4 [0064.992] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString=".jpg") returned 4 [0064.992] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.992] lstrlenW (lpString=".doc") returned 4 [0064.992] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.992] lstrlenW (lpString=".docx") returned 5 [0064.993] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0064.993] lstrlenW (lpString=".pdf") returned 4 [0064.993] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.993] lstrlenW (lpString=".xls") returned 4 [0064.993] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.993] lstrlenW (lpString=".xlsx") returned 5 [0064.993] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0064.993] lstrlenW (lpString=".ppt") returned 4 [0064.993] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.993] lstrlenW (lpString=".zip") returned 4 [0064.993] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.993] lstrlenW (lpString=".rar") returned 4 [0064.993] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.993] lstrlenW (lpString=".bz2") returned 4 [0064.993] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.993] lstrlenW (lpString=".7z") returned 3 [0064.993] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.993] lstrlenW (lpString=".dbf") returned 4 [0064.993] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.993] lstrlenW (lpString=".1cd") returned 4 [0064.993] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0064.993] lstrlenW (lpString=".jpg") returned 4 [0064.993] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.993] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0064.994] lstrlenW (lpString="SERCONV.DLL") returned 11 [0064.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0064.994] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=591736) returned 1 [0064.994] CloseHandle (hObject=0x150) returned 1 [0064.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0064.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0064.994] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0064.994] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0064.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0064.995] GetLastError () returned 0x0 [0064.995] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x90778, lpOverlapped=0x0) returned 1 [0065.008] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x90780, lpOverlapped=0x0) returned 1 [0065.018] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0065.018] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.019] SetEndOfFile (hFile=0x15c) returned 1 [0065.019] CloseHandle (hObject=0x15c) returned 1 [0065.019] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0065.019] SetEndOfFile (hFile=0x150) returned 1 [0065.024] CloseHandle (hObject=0x150) returned 1 [0065.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.024] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1 [0065.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.024] lstrlenW (lpString=".doc") returned 4 [0065.024] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.024] lstrlenW (lpString=".docx") returned 5 [0065.024] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0065.025] lstrlenW (lpString=".pdf") returned 4 [0065.025] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString=".xls") returned 4 [0065.025] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString=".xlsx") returned 5 [0065.025] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0065.025] lstrlenW (lpString=".ppt") returned 4 [0065.025] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString=".zip") returned 4 [0065.025] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString=".rar") returned 4 [0065.025] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString=".bz2") returned 4 [0065.025] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.025] lstrlenW (lpString=".7z") returned 3 [0065.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString=".dbf") returned 4 [0065.025] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString=".1cd") returned 4 [0065.025] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString=".jpg") returned 4 [0065.025] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.025] lstrlenW (lpString=".doc") returned 4 [0065.025] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.025] lstrlenW (lpString=".docx") returned 5 [0065.025] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0065.026] lstrlenW (lpString=".pdf") returned 4 [0065.026] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.026] lstrlenW (lpString=".xls") returned 4 [0065.026] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.026] lstrlenW (lpString=".xlsx") returned 5 [0065.026] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0065.026] lstrlenW (lpString=".ppt") returned 4 [0065.026] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.026] lstrlenW (lpString=".zip") returned 4 [0065.026] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.026] lstrlenW (lpString=".rar") returned 4 [0065.026] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.026] lstrlenW (lpString=".bz2") returned 4 [0065.026] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.026] lstrlenW (lpString=".7z") returned 3 [0065.026] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.026] lstrlenW (lpString=".dbf") returned 4 [0065.026] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.026] lstrlenW (lpString=".1cd") returned 4 [0065.026] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0065.026] lstrlenW (lpString=".jpg") returned 4 [0065.026] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.026] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0065.026] lstrlenW (lpString="USP10.DLL") returned 9 [0065.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.243] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=813824) returned 1 [0066.243] CloseHandle (hObject=0x1c8) returned 1 [0066.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0066.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.243] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.243] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.244] GetLastError () returned 0x0 [0066.244] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc6b00, lpOverlapped=0x0) returned 1 [0066.261] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc6b10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc6b10, lpOverlapped=0x0) returned 1 [0066.276] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0066.276] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.276] SetEndOfFile (hFile=0x1f4) returned 1 [0066.276] CloseHandle (hObject=0x1f4) returned 1 [0066.276] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.277] SetEndOfFile (hFile=0x1c8) returned 1 [0066.306] CloseHandle (hObject=0x1c8) returned 1 [0066.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1 [0066.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.307] lstrlenW (lpString=".doc") returned 4 [0066.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString=".docx") returned 5 [0066.307] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0066.307] lstrlenW (lpString=".pdf") returned 4 [0066.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString=".xls") returned 4 [0066.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString=".xlsx") returned 5 [0066.307] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0066.307] lstrlenW (lpString=".ppt") returned 4 [0066.307] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.307] lstrlenW (lpString=".zip") returned 4 [0066.307] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString=".rar") returned 4 [0066.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.307] lstrlenW (lpString=".bz2") returned 4 [0066.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.307] lstrlenW (lpString=".7z") returned 3 [0066.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.307] lstrlenW (lpString=".dbf") returned 4 [0066.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.307] lstrlenW (lpString=".1cd") returned 4 [0066.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString=".jpg") returned 4 [0066.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString=".doc") returned 4 [0066.308] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString=".docx") returned 5 [0066.308] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0066.308] lstrlenW (lpString=".pdf") returned 4 [0066.308] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString=".xls") returned 4 [0066.308] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString=".xlsx") returned 5 [0066.308] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0066.308] lstrlenW (lpString=".ppt") returned 4 [0066.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString=".zip") returned 4 [0066.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString=".rar") returned 4 [0066.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.308] lstrlenW (lpString=".bz2") returned 4 [0066.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.308] lstrlenW (lpString=".7z") returned 3 [0066.308] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString=".dbf") returned 4 [0066.308] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.308] lstrlenW (lpString=".1cd") returned 4 [0066.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0066.309] lstrlenW (lpString=".jpg") returned 4 [0066.309] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.309] lstrcmpiW (lpString1=".LEX", lpString2=".zoh") returned -1 [0066.309] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0066.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.555] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=295663) returned 1 [0066.556] CloseHandle (hObject=0x22c) returned 1 [0066.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0066.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.587] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.587] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.588] GetLastError () returned 0x0 [0066.588] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x482ef, lpOverlapped=0x0) returned 1 [0066.595] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x482f0, lpOverlapped=0x0) returned 1 [0066.600] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0066.600] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.601] SetEndOfFile (hFile=0x1fc) returned 1 [0066.601] CloseHandle (hObject=0x1fc) returned 1 [0066.601] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.601] SetEndOfFile (hFile=0x22c) returned 1 [0066.604] CloseHandle (hObject=0x22c) returned 1 [0066.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1 [0066.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.604] lstrlenW (lpString=".doc") returned 4 [0066.604] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0066.604] lstrlenW (lpString=".docx") returned 5 [0066.604] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0066.604] lstrlenW (lpString=".pdf") returned 4 [0066.604] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0066.604] lstrlenW (lpString=".xls") returned 4 [0066.604] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0066.604] lstrlenW (lpString=".xlsx") returned 5 [0066.604] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0066.604] lstrlenW (lpString=".ppt") returned 4 [0066.604] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString=".zip") returned 4 [0066.605] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0066.605] lstrlenW (lpString=".rar") returned 4 [0066.605] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0066.605] lstrlenW (lpString=".bz2") returned 4 [0066.605] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0066.605] lstrlenW (lpString=".7z") returned 3 [0066.605] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString=".dbf") returned 4 [0066.605] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString=".1cd") returned 4 [0066.605] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString=".jpg") returned 4 [0066.605] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.605] lstrlenW (lpString=".doc") returned 4 [0066.605] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0066.605] lstrlenW (lpString=".docx") returned 5 [0066.605] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0066.605] lstrlenW (lpString=".pdf") returned 4 [0066.605] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0066.605] lstrlenW (lpString=".xls") returned 4 [0066.605] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0066.605] lstrlenW (lpString=".xlsx") returned 5 [0066.605] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0066.606] lstrlenW (lpString=".ppt") returned 4 [0066.606] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0066.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.606] lstrlenW (lpString=".zip") returned 4 [0066.606] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0066.606] lstrlenW (lpString=".rar") returned 4 [0066.606] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0066.606] lstrlenW (lpString=".bz2") returned 4 [0066.606] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0066.606] lstrlenW (lpString=".7z") returned 3 [0066.606] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0066.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.606] lstrlenW (lpString=".dbf") returned 4 [0066.606] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0066.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.606] lstrlenW (lpString=".1cd") returned 4 [0066.606] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0066.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0066.606] lstrlenW (lpString=".jpg") returned 4 [0066.606] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0066.606] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".zoh") returned -1 [0066.606] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0066.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.740] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=13696) returned 1 [0066.742] CloseHandle (hObject=0x22c) returned 1 [0066.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0066.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.757] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.760] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.777] GetLastError () returned 0x0 [0066.778] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3580, lpOverlapped=0x0) returned 1 [0066.855] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3590, lpOverlapped=0x0) returned 1 [0066.856] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0066.856] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0066.856] SetEndOfFile (hFile=0x1fc) returned 1 [0066.856] CloseHandle (hObject=0x1fc) returned 1 [0066.856] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.856] SetEndOfFile (hFile=0x22c) returned 1 [0066.868] CloseHandle (hObject=0x22c) returned 1 [0066.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1 [0066.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.891] lstrlenW (lpString=".doc") returned 4 [0066.892] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0066.894] lstrlenW (lpString=".docx") returned 5 [0066.896] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0066.896] lstrlenW (lpString=".pdf") returned 4 [0066.897] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0066.898] lstrlenW (lpString=".xls") returned 4 [0066.899] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0066.899] lstrlenW (lpString=".xlsx") returned 5 [0066.900] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0066.901] lstrlenW (lpString=".ppt") returned 4 [0066.905] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0066.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.910] lstrlenW (lpString=".zip") returned 4 [0066.912] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0066.913] lstrlenW (lpString=".rar") returned 4 [0066.914] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0066.915] lstrlenW (lpString=".bz2") returned 4 [0066.916] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0066.918] lstrlenW (lpString=".7z") returned 3 [0066.920] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.922] lstrlenW (lpString=".dbf") returned 4 [0066.922] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0066.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.927] lstrlenW (lpString=".1cd") returned 4 [0066.927] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0066.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.934] lstrlenW (lpString=".jpg") returned 4 [0066.942] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.955] lstrlenW (lpString=".doc") returned 4 [0066.955] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".docx") returned 5 [0066.955] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0066.955] lstrlenW (lpString=".pdf") returned 4 [0066.955] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".xls") returned 4 [0066.955] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".xlsx") returned 5 [0066.955] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0066.955] lstrlenW (lpString=".ppt") returned 4 [0066.955] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.955] lstrlenW (lpString=".zip") returned 4 [0066.955] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".rar") returned 4 [0066.955] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".bz2") returned 4 [0066.955] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString=".7z") returned 3 [0066.955] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.955] lstrlenW (lpString=".dbf") returned 4 [0066.955] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0066.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.955] lstrlenW (lpString=".1cd") returned 4 [0066.956] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0066.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0066.956] lstrlenW (lpString=".jpg") returned 4 [0066.956] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0066.956] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0066.956] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0066.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.972] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=123776) returned 1 [0066.972] CloseHandle (hObject=0x22c) returned 1 [0066.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0066.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.972] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.972] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.973] GetLastError () returned 0x0 [0066.973] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1e380, lpOverlapped=0x0) returned 1 [0066.977] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1e390, lpOverlapped=0x0) returned 1 [0066.979] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0066.979] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.980] SetEndOfFile (hFile=0x1fc) returned 1 [0066.980] CloseHandle (hObject=0x1fc) returned 1 [0066.980] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0066.980] SetEndOfFile (hFile=0x22c) returned 1 [0066.981] CloseHandle (hObject=0x22c) returned 1 [0066.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.981] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1 [0067.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.569] lstrlenW (lpString=".doc") returned 4 [0067.569] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString=".docx") returned 5 [0067.569] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0067.569] lstrlenW (lpString=".pdf") returned 4 [0067.569] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString=".xls") returned 4 [0067.569] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString=".xlsx") returned 5 [0067.569] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0067.569] lstrlenW (lpString=".ppt") returned 4 [0067.569] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.569] lstrlenW (lpString=".zip") returned 4 [0067.569] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString=".rar") returned 4 [0067.569] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.569] lstrlenW (lpString=".bz2") returned 4 [0067.569] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.569] lstrlenW (lpString=".7z") returned 3 [0067.569] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.569] lstrlenW (lpString=".dbf") returned 4 [0067.569] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.569] lstrlenW (lpString=".1cd") returned 4 [0067.569] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".jpg") returned 4 [0067.570] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".doc") returned 4 [0067.570] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString=".docx") returned 5 [0067.570] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0067.570] lstrlenW (lpString=".pdf") returned 4 [0067.570] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString=".xls") returned 4 [0067.570] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString=".xlsx") returned 5 [0067.570] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0067.570] lstrlenW (lpString=".ppt") returned 4 [0067.570] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".zip") returned 4 [0067.570] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString=".rar") returned 4 [0067.570] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.570] lstrlenW (lpString=".bz2") returned 4 [0067.570] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.570] lstrlenW (lpString=".7z") returned 3 [0067.570] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".dbf") returned 4 [0067.570] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".1cd") returned 4 [0067.570] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0067.570] lstrlenW (lpString=".jpg") returned 4 [0067.571] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.571] lstrcmpiW (lpString1=".TLB", lpString2=".zoh") returned -1 [0067.571] lstrlenW (lpString="MSTAG.TLB") returned 9 [0067.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.681] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=13684) returned 1 [0067.681] CloseHandle (hObject=0x22c) returned 1 [0067.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0067.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.681] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.681] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.683] GetLastError () returned 0x0 [0067.683] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3574, lpOverlapped=0x0) returned 1 [0067.685] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3580, lpOverlapped=0x0) returned 1 [0067.686] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0067.686] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.686] SetEndOfFile (hFile=0x1f4) returned 1 [0067.687] CloseHandle (hObject=0x1f4) returned 1 [0067.687] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.687] SetEndOfFile (hFile=0x22c) returned 1 [0067.688] CloseHandle (hObject=0x22c) returned 1 [0067.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.688] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1 [0067.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.688] lstrlenW (lpString=".doc") returned 4 [0067.688] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0067.688] lstrlenW (lpString=".docx") returned 5 [0067.688] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0067.688] lstrlenW (lpString=".pdf") returned 4 [0067.688] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0067.688] lstrlenW (lpString=".xls") returned 4 [0067.688] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0067.688] lstrlenW (lpString=".xlsx") returned 5 [0067.688] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0067.688] lstrlenW (lpString=".ppt") returned 4 [0067.688] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0067.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.688] lstrlenW (lpString=".zip") returned 4 [0067.688] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0067.689] lstrlenW (lpString=".rar") returned 4 [0067.689] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString=".bz2") returned 4 [0067.689] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString=".7z") returned 3 [0067.689] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString=".dbf") returned 4 [0067.689] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString=".1cd") returned 4 [0067.689] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString=".jpg") returned 4 [0067.689] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString=".doc") returned 4 [0067.689] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString=".docx") returned 5 [0067.689] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0067.689] lstrlenW (lpString=".pdf") returned 4 [0067.689] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString=".xls") returned 4 [0067.689] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0067.689] lstrlenW (lpString=".xlsx") returned 5 [0067.689] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0067.689] lstrlenW (lpString=".ppt") returned 4 [0067.689] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0067.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.689] lstrlenW (lpString=".zip") returned 4 [0067.690] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0067.690] lstrlenW (lpString=".rar") returned 4 [0067.690] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0067.690] lstrlenW (lpString=".bz2") returned 4 [0067.690] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0067.690] lstrlenW (lpString=".7z") returned 3 [0067.690] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0067.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.690] lstrlenW (lpString=".dbf") returned 4 [0067.690] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0067.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.690] lstrlenW (lpString=".1cd") returned 4 [0067.690] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0067.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0067.690] lstrlenW (lpString=".jpg") returned 4 [0067.690] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0067.690] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0067.690] lstrlenW (lpString="OSE.EXE") returned 7 [0067.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.691] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=174440) returned 1 [0067.691] CloseHandle (hObject=0x22c) returned 1 [0067.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0067.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.691] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.691] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.692] GetLastError () returned 0x0 [0067.692] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2a968, lpOverlapped=0x0) returned 1 [0067.696] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0067.700] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0067.700] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0067.700] SetEndOfFile (hFile=0x1f4) returned 1 [0067.700] CloseHandle (hObject=0x1f4) returned 1 [0067.700] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.700] SetEndOfFile (hFile=0x22c) returned 1 [0067.702] CloseHandle (hObject=0x22c) returned 1 [0067.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0067.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.702] lstrlenW (lpString=".doc") returned 4 [0067.702] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0067.702] lstrlenW (lpString=".docx") returned 5 [0067.702] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0067.702] lstrlenW (lpString=".pdf") returned 4 [0067.702] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0067.702] lstrlenW (lpString=".xls") returned 4 [0067.702] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0067.702] lstrlenW (lpString=".xlsx") returned 5 [0067.702] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0067.702] lstrlenW (lpString=".ppt") returned 4 [0067.702] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0067.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".zip") returned 4 [0067.703] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString=".rar") returned 4 [0067.703] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString=".bz2") returned 4 [0067.703] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0067.703] lstrlenW (lpString=".7z") returned 3 [0067.703] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".dbf") returned 4 [0067.703] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".1cd") returned 4 [0067.703] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".jpg") returned 4 [0067.703] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".doc") returned 4 [0067.703] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0067.703] lstrlenW (lpString=".docx") returned 5 [0067.703] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0067.703] lstrlenW (lpString=".pdf") returned 4 [0067.703] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString=".xls") returned 4 [0067.703] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString=".xlsx") returned 5 [0067.703] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0067.703] lstrlenW (lpString=".ppt") returned 4 [0067.703] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0067.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.703] lstrlenW (lpString=".zip") returned 4 [0067.703] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0067.704] lstrlenW (lpString=".rar") returned 4 [0067.704] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0067.704] lstrlenW (lpString=".bz2") returned 4 [0067.704] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0067.704] lstrlenW (lpString=".7z") returned 3 [0067.704] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0067.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.704] lstrlenW (lpString=".dbf") returned 4 [0067.704] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0067.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.704] lstrlenW (lpString=".1cd") returned 4 [0067.704] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0067.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0067.704] lstrlenW (lpString=".jpg") returned 4 [0067.704] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0067.704] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.704] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0067.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.705] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=146808) returned 1 [0067.705] CloseHandle (hObject=0x22c) returned 1 [0067.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0067.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.705] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.705] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.707] GetLastError () returned 0x0 [0067.707] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x23d78, lpOverlapped=0x0) returned 1 [0067.711] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x23d80, lpOverlapped=0x0) returned 1 [0067.714] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.714] SetEndOfFile (hFile=0x1f4) returned 1 [0067.714] CloseHandle (hObject=0x1f4) returned 1 [0067.714] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.714] SetEndOfFile (hFile=0x22c) returned 1 [0067.800] CloseHandle (hObject=0x22c) returned 1 [0067.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1 [0067.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.801] lstrlenW (lpString=".doc") returned 4 [0067.801] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.801] lstrlenW (lpString=".docx") returned 5 [0067.802] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0067.802] lstrlenW (lpString=".pdf") returned 4 [0067.802] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString=".xls") returned 4 [0067.802] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString=".xlsx") returned 5 [0067.802] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0067.802] lstrlenW (lpString=".ppt") returned 4 [0067.802] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString=".zip") returned 4 [0067.802] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString=".rar") returned 4 [0067.802] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString=".bz2") returned 4 [0067.802] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.802] lstrlenW (lpString=".7z") returned 3 [0067.802] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString=".dbf") returned 4 [0067.802] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString=".1cd") returned 4 [0067.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString=".jpg") returned 4 [0067.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.802] lstrlenW (lpString=".doc") returned 4 [0067.802] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.802] lstrlenW (lpString=".docx") returned 5 [0067.803] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0067.803] lstrlenW (lpString=".pdf") returned 4 [0067.803] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.803] lstrlenW (lpString=".xls") returned 4 [0067.803] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.803] lstrlenW (lpString=".xlsx") returned 5 [0067.803] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0067.803] lstrlenW (lpString=".ppt") returned 4 [0067.803] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.803] lstrlenW (lpString=".zip") returned 4 [0067.803] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.803] lstrlenW (lpString=".rar") returned 4 [0067.803] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.803] lstrlenW (lpString=".bz2") returned 4 [0067.803] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.803] lstrlenW (lpString=".7z") returned 3 [0067.803] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.803] lstrlenW (lpString=".dbf") returned 4 [0067.803] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.803] lstrlenW (lpString=".1cd") returned 4 [0067.803] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0067.803] lstrlenW (lpString=".jpg") returned 4 [0067.803] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.804] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=555) returned 1 [0067.804] CloseHandle (hObject=0x22c) returned 1 [0067.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0067.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.804] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.804] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.805] GetLastError () returned 0x0 [0067.805] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x22b, lpOverlapped=0x0) returned 1 [0067.805] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x230, lpOverlapped=0x0) returned 1 [0067.806] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0067.806] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.806] SetEndOfFile (hFile=0x1ec) returned 1 [0067.807] CloseHandle (hObject=0x1ec) returned 1 [0067.807] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.807] SetEndOfFile (hFile=0x22c) returned 1 [0067.807] CloseHandle (hObject=0x22c) returned 1 [0067.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1 [0067.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.808] lstrlenW (lpString=".doc") returned 4 [0067.808] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0067.808] lstrlenW (lpString=".docx") returned 5 [0067.808] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0067.808] lstrlenW (lpString=".pdf") returned 4 [0067.808] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0067.808] lstrlenW (lpString=".xls") returned 4 [0067.808] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0067.808] lstrlenW (lpString=".xlsx") returned 5 [0067.808] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0067.808] lstrlenW (lpString=".ppt") returned 4 [0067.808] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0067.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.808] lstrlenW (lpString=".zip") returned 4 [0067.808] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0067.808] lstrlenW (lpString=".rar") returned 4 [0067.808] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0067.808] lstrlenW (lpString=".bz2") returned 4 [0067.808] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0067.809] lstrlenW (lpString=".7z") returned 3 [0067.809] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0067.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.809] lstrlenW (lpString=".dbf") returned 4 [0067.809] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0067.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.809] lstrlenW (lpString=".1cd") returned 4 [0067.809] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0067.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0067.809] lstrlenW (lpString=".jpg") returned 4 [0067.809] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0067.809] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=69575) returned 1 [0067.809] CloseHandle (hObject=0x22c) returned 1 [0067.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0067.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.810] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.810] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0067.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.810] GetLastError () returned 0x0 [0067.810] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x10fc7, lpOverlapped=0x0) returned 1 [0068.198] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x10fd0, lpOverlapped=0x0) returned 1 [0068.200] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.200] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.200] SetEndOfFile (hFile=0x1ec) returned 1 [0068.200] CloseHandle (hObject=0x1ec) returned 1 [0068.200] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.201] SetEndOfFile (hFile=0x22c) returned 1 [0068.202] CloseHandle (hObject=0x22c) returned 1 [0068.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1 [0068.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.202] lstrlenW (lpString=".doc") returned 4 [0068.202] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.202] lstrlenW (lpString=".docx") returned 5 [0068.202] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0068.202] lstrlenW (lpString=".pdf") returned 4 [0068.202] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.202] lstrlenW (lpString=".xls") returned 4 [0068.202] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.202] lstrlenW (lpString=".xlsx") returned 5 [0068.202] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0068.202] lstrlenW (lpString=".ppt") returned 4 [0068.202] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.203] lstrlenW (lpString=".zip") returned 4 [0068.203] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.203] lstrlenW (lpString=".rar") returned 4 [0068.203] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.203] lstrlenW (lpString=".bz2") returned 4 [0068.203] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.203] lstrlenW (lpString=".7z") returned 3 [0068.203] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.203] lstrlenW (lpString=".dbf") returned 4 [0068.203] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.203] lstrlenW (lpString=".1cd") returned 4 [0068.203] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0068.203] lstrlenW (lpString=".jpg") returned 4 [0068.203] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.203] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=100798) returned 1 [0068.203] CloseHandle (hObject=0x22c) returned 1 [0068.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0068.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.204] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.204] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.205] GetLastError () returned 0x0 [0068.205] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x189be, lpOverlapped=0x0) returned 1 [0068.269] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x189c0, lpOverlapped=0x0) returned 1 [0068.271] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.271] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0068.271] SetEndOfFile (hFile=0x1ec) returned 1 [0068.271] CloseHandle (hObject=0x1ec) returned 1 [0068.271] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.271] SetEndOfFile (hFile=0x22c) returned 1 [0068.273] CloseHandle (hObject=0x22c) returned 1 [0068.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 1 [0068.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.277] lstrlenW (lpString=".doc") returned 4 [0068.277] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.277] lstrlenW (lpString=".docx") returned 5 [0068.277] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.277] lstrlenW (lpString=".pdf") returned 4 [0068.277] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.277] lstrlenW (lpString=".xls") returned 4 [0068.277] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.277] lstrlenW (lpString=".xlsx") returned 5 [0068.277] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.277] lstrlenW (lpString=".ppt") returned 4 [0068.277] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.277] lstrlenW (lpString=".zip") returned 4 [0068.277] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.277] lstrlenW (lpString=".rar") returned 4 [0068.277] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.277] lstrlenW (lpString=".bz2") returned 4 [0068.277] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.277] lstrlenW (lpString=".7z") returned 3 [0068.277] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.277] lstrlenW (lpString=".dbf") returned 4 [0068.277] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.277] lstrlenW (lpString=".1cd") returned 4 [0068.277] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.277] lstrlenW (lpString=".jpg") returned 4 [0068.277] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString=".doc") returned 4 [0068.278] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.278] lstrlenW (lpString=".docx") returned 5 [0068.278] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.278] lstrlenW (lpString=".pdf") returned 4 [0068.278] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString=".xls") returned 4 [0068.278] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString=".xlsx") returned 5 [0068.278] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.278] lstrlenW (lpString=".ppt") returned 4 [0068.278] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString=".zip") returned 4 [0068.278] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString=".rar") returned 4 [0068.278] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.278] lstrlenW (lpString=".bz2") returned 4 [0068.278] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.278] lstrlenW (lpString=".7z") returned 3 [0068.278] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString=".dbf") returned 4 [0068.278] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString=".1cd") returned 4 [0068.278] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0068.278] lstrlenW (lpString=".jpg") returned 4 [0068.278] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.279] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.279] lstrlenW (lpString="BLENDS.INF") returned 10 [0068.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.279] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=534) returned 1 [0068.279] CloseHandle (hObject=0x150) returned 1 [0068.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0068.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.280] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.280] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.280] GetLastError () returned 0x0 [0068.280] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x216, lpOverlapped=0x0) returned 1 [0068.281] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x220, lpOverlapped=0x0) returned 1 [0068.282] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.282] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.282] SetEndOfFile (hFile=0x15c) returned 1 [0068.282] CloseHandle (hObject=0x15c) returned 1 [0068.282] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.282] SetEndOfFile (hFile=0x150) returned 1 [0068.283] CloseHandle (hObject=0x150) returned 1 [0068.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString=".doc") returned 4 [0068.284] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.284] lstrlenW (lpString=".docx") returned 5 [0068.284] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.284] lstrlenW (lpString=".pdf") returned 4 [0068.284] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.284] lstrlenW (lpString=".xls") returned 4 [0068.284] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.284] lstrlenW (lpString=".xlsx") returned 5 [0068.284] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.284] lstrlenW (lpString=".ppt") returned 4 [0068.284] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString=".zip") returned 4 [0068.284] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.284] lstrlenW (lpString=".rar") returned 4 [0068.284] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.284] lstrlenW (lpString=".bz2") returned 4 [0068.284] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.284] lstrlenW (lpString=".7z") returned 3 [0068.284] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString=".dbf") returned 4 [0068.284] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString=".1cd") returned 4 [0068.284] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.284] lstrlenW (lpString=".jpg") returned 4 [0068.284] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString=".doc") returned 4 [0068.285] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.285] lstrlenW (lpString=".docx") returned 5 [0068.285] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.285] lstrlenW (lpString=".pdf") returned 4 [0068.285] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString=".xls") returned 4 [0068.285] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString=".xlsx") returned 5 [0068.285] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.285] lstrlenW (lpString=".ppt") returned 4 [0068.285] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString=".zip") returned 4 [0068.285] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString=".rar") returned 4 [0068.285] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.285] lstrlenW (lpString=".bz2") returned 4 [0068.285] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.285] lstrlenW (lpString=".7z") returned 3 [0068.285] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString=".dbf") returned 4 [0068.285] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString=".1cd") returned 4 [0068.285] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0068.285] lstrlenW (lpString=".jpg") returned 4 [0068.285] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.285] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.286] lstrlenW (lpString="BLUECALM.ELM") returned 12 [0068.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.286] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=49850) returned 1 [0068.286] CloseHandle (hObject=0x150) returned 1 [0068.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0068.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.286] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.286] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.287] GetLastError () returned 0x0 [0068.287] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc2ba, lpOverlapped=0x0) returned 1 [0068.290] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc2c0, lpOverlapped=0x0) returned 1 [0068.291] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.291] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.291] SetEndOfFile (hFile=0x15c) returned 1 [0068.291] CloseHandle (hObject=0x15c) returned 1 [0068.291] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.291] SetEndOfFile (hFile=0x150) returned 1 [0068.293] CloseHandle (hObject=0x150) returned 1 [0068.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1 [0068.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.293] lstrlenW (lpString=".doc") returned 4 [0068.293] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.293] lstrlenW (lpString=".docx") returned 5 [0068.293] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0068.293] lstrlenW (lpString=".pdf") returned 4 [0068.293] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.293] lstrlenW (lpString=".xls") returned 4 [0068.293] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.293] lstrlenW (lpString=".xlsx") returned 5 [0068.293] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0068.293] lstrlenW (lpString=".ppt") returned 4 [0068.293] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.293] lstrlenW (lpString=".zip") returned 4 [0068.293] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.293] lstrlenW (lpString=".rar") returned 4 [0068.294] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString=".bz2") returned 4 [0068.294] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.294] lstrlenW (lpString=".7z") returned 3 [0068.294] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString=".dbf") returned 4 [0068.294] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString=".1cd") returned 4 [0068.294] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString=".jpg") returned 4 [0068.294] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString=".doc") returned 4 [0068.294] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.294] lstrlenW (lpString=".docx") returned 5 [0068.294] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0068.294] lstrlenW (lpString=".pdf") returned 4 [0068.294] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString=".xls") returned 4 [0068.294] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString=".xlsx") returned 5 [0068.294] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0068.294] lstrlenW (lpString=".ppt") returned 4 [0068.294] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.294] lstrlenW (lpString=".zip") returned 4 [0068.294] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.294] lstrlenW (lpString=".rar") returned 4 [0068.294] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.295] lstrlenW (lpString=".bz2") returned 4 [0068.295] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.295] lstrlenW (lpString=".7z") returned 3 [0068.295] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.295] lstrlenW (lpString=".dbf") returned 4 [0068.295] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.295] lstrlenW (lpString=".1cd") returned 4 [0068.295] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0068.295] lstrlenW (lpString=".jpg") returned 4 [0068.295] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.295] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.295] lstrlenW (lpString="BLUECALM.INF") returned 12 [0068.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.295] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=551) returned 1 [0068.295] CloseHandle (hObject=0x150) returned 1 [0068.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0068.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.296] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.296] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.296] GetLastError () returned 0x0 [0068.296] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x227, lpOverlapped=0x0) returned 1 [0068.297] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x230, lpOverlapped=0x0) returned 1 [0068.298] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.298] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.298] SetEndOfFile (hFile=0x15c) returned 1 [0068.298] CloseHandle (hObject=0x15c) returned 1 [0068.298] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.298] SetEndOfFile (hFile=0x150) returned 1 [0068.299] CloseHandle (hObject=0x150) returned 1 [0068.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString=".doc") returned 4 [0068.300] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.300] lstrlenW (lpString=".docx") returned 5 [0068.300] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0068.300] lstrlenW (lpString=".pdf") returned 4 [0068.300] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.300] lstrlenW (lpString=".xls") returned 4 [0068.300] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.300] lstrlenW (lpString=".xlsx") returned 5 [0068.300] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0068.300] lstrlenW (lpString=".ppt") returned 4 [0068.300] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString=".zip") returned 4 [0068.300] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.300] lstrlenW (lpString=".rar") returned 4 [0068.300] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.300] lstrlenW (lpString=".bz2") returned 4 [0068.300] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.300] lstrlenW (lpString=".7z") returned 3 [0068.300] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString=".dbf") returned 4 [0068.300] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString=".1cd") returned 4 [0068.300] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.300] lstrlenW (lpString=".jpg") returned 4 [0068.300] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString=".doc") returned 4 [0068.301] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.301] lstrlenW (lpString=".docx") returned 5 [0068.301] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0068.301] lstrlenW (lpString=".pdf") returned 4 [0068.301] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString=".xls") returned 4 [0068.301] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString=".xlsx") returned 5 [0068.301] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0068.301] lstrlenW (lpString=".ppt") returned 4 [0068.301] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString=".zip") returned 4 [0068.301] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString=".rar") returned 4 [0068.301] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.301] lstrlenW (lpString=".bz2") returned 4 [0068.301] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.301] lstrlenW (lpString=".7z") returned 3 [0068.301] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString=".dbf") returned 4 [0068.301] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString=".1cd") returned 4 [0068.301] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0068.301] lstrlenW (lpString=".jpg") returned 4 [0068.301] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.301] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.302] lstrlenW (lpString="BLUEPRNT.ELM") returned 12 [0068.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.302] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=55942) returned 1 [0068.302] CloseHandle (hObject=0x150) returned 1 [0068.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0068.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.302] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.302] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.303] GetLastError () returned 0x0 [0068.303] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xda86, lpOverlapped=0x0) returned 1 [0068.307] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xda90, lpOverlapped=0x0) returned 1 [0068.309] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.309] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.309] SetEndOfFile (hFile=0x15c) returned 1 [0068.309] CloseHandle (hObject=0x15c) returned 1 [0068.309] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.309] SetEndOfFile (hFile=0x150) returned 1 [0068.310] CloseHandle (hObject=0x150) returned 1 [0068.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1 [0068.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.311] lstrlenW (lpString=".doc") returned 4 [0068.311] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.311] lstrlenW (lpString=".docx") returned 5 [0068.311] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0068.311] lstrlenW (lpString=".pdf") returned 4 [0068.311] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.311] lstrlenW (lpString=".xls") returned 4 [0068.311] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.311] lstrlenW (lpString=".xlsx") returned 5 [0068.311] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0068.311] lstrlenW (lpString=".ppt") returned 4 [0068.311] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.311] lstrlenW (lpString=".zip") returned 4 [0068.311] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.311] lstrlenW (lpString=".rar") returned 4 [0068.311] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.311] lstrlenW (lpString=".bz2") returned 4 [0068.311] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.311] lstrlenW (lpString=".7z") returned 3 [0068.311] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.311] lstrlenW (lpString=".dbf") returned 4 [0068.311] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.311] lstrlenW (lpString=".1cd") returned 4 [0068.311] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".jpg") returned 4 [0068.312] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".doc") returned 4 [0068.312] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.312] lstrlenW (lpString=".docx") returned 5 [0068.312] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0068.312] lstrlenW (lpString=".pdf") returned 4 [0068.312] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString=".xls") returned 4 [0068.312] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString=".xlsx") returned 5 [0068.312] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0068.312] lstrlenW (lpString=".ppt") returned 4 [0068.312] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".zip") returned 4 [0068.312] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString=".rar") returned 4 [0068.312] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.312] lstrlenW (lpString=".bz2") returned 4 [0068.312] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.312] lstrlenW (lpString=".7z") returned 3 [0068.312] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".dbf") returned 4 [0068.312] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".1cd") returned 4 [0068.312] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0068.312] lstrlenW (lpString=".jpg") returned 4 [0068.313] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.313] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.313] lstrlenW (lpString="BLUEPRNT.INF") returned 12 [0068.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.313] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=549) returned 1 [0068.314] CloseHandle (hObject=0x150) returned 1 [0068.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0068.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.314] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.314] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.314] GetLastError () returned 0x0 [0068.314] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x225, lpOverlapped=0x0) returned 1 [0068.315] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x230, lpOverlapped=0x0) returned 1 [0068.316] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.316] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.316] SetEndOfFile (hFile=0x15c) returned 1 [0068.316] CloseHandle (hObject=0x15c) returned 1 [0068.316] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.316] SetEndOfFile (hFile=0x150) returned 1 [0068.317] CloseHandle (hObject=0x150) returned 1 [0068.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.318] lstrlenW (lpString=".doc") returned 4 [0068.318] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.318] lstrlenW (lpString=".docx") returned 5 [0068.318] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0068.318] lstrlenW (lpString=".pdf") returned 4 [0068.318] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.318] lstrlenW (lpString=".xls") returned 4 [0068.318] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.318] lstrlenW (lpString=".xlsx") returned 5 [0068.318] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0068.318] lstrlenW (lpString=".ppt") returned 4 [0068.318] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.318] lstrlenW (lpString=".zip") returned 4 [0068.318] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.318] lstrlenW (lpString=".rar") returned 4 [0068.318] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.318] lstrlenW (lpString=".bz2") returned 4 [0068.318] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.318] lstrlenW (lpString=".7z") returned 3 [0068.318] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.318] lstrlenW (lpString=".dbf") returned 4 [0068.318] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.318] lstrlenW (lpString=".1cd") returned 4 [0068.318] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString=".jpg") returned 4 [0068.319] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString=".doc") returned 4 [0068.319] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.319] lstrlenW (lpString=".docx") returned 5 [0068.319] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0068.319] lstrlenW (lpString=".pdf") returned 4 [0068.319] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString=".xls") returned 4 [0068.319] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString=".xlsx") returned 5 [0068.319] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0068.319] lstrlenW (lpString=".ppt") returned 4 [0068.319] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString=".zip") returned 4 [0068.319] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString=".rar") returned 4 [0068.319] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.319] lstrlenW (lpString=".bz2") returned 4 [0068.319] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.319] lstrlenW (lpString=".7z") returned 3 [0068.319] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString=".dbf") returned 4 [0068.319] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.319] lstrlenW (lpString=".1cd") returned 4 [0068.319] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0068.320] lstrlenW (lpString=".jpg") returned 4 [0068.320] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.320] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.320] lstrlenW (lpString="BOLDSTRI.ELM") returned 12 [0068.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.320] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=60154) returned 1 [0068.320] CloseHandle (hObject=0x150) returned 1 [0068.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0068.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.320] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.321] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.321] GetLastError () returned 0x0 [0068.321] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xeafa, lpOverlapped=0x0) returned 1 [0068.324] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xeb00, lpOverlapped=0x0) returned 1 [0068.325] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.325] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.326] SetEndOfFile (hFile=0x15c) returned 1 [0068.326] CloseHandle (hObject=0x15c) returned 1 [0068.326] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.326] SetEndOfFile (hFile=0x150) returned 1 [0068.327] CloseHandle (hObject=0x150) returned 1 [0068.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1 [0068.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.327] lstrlenW (lpString=".doc") returned 4 [0068.327] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.327] lstrlenW (lpString=".docx") returned 5 [0068.327] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0068.327] lstrlenW (lpString=".pdf") returned 4 [0068.327] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.327] lstrlenW (lpString=".xls") returned 4 [0068.327] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.327] lstrlenW (lpString=".xlsx") returned 5 [0068.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0068.328] lstrlenW (lpString=".ppt") returned 4 [0068.328] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString=".zip") returned 4 [0068.328] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString=".rar") returned 4 [0068.328] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString=".bz2") returned 4 [0068.328] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.328] lstrlenW (lpString=".7z") returned 3 [0068.328] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString=".dbf") returned 4 [0068.328] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString=".1cd") returned 4 [0068.328] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString=".jpg") returned 4 [0068.328] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.328] lstrlenW (lpString=".doc") returned 4 [0068.328] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.328] lstrlenW (lpString=".docx") returned 5 [0068.328] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0068.328] lstrlenW (lpString=".pdf") returned 4 [0068.328] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString=".xls") returned 4 [0068.328] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.328] lstrlenW (lpString=".xlsx") returned 5 [0068.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0068.329] lstrlenW (lpString=".ppt") returned 4 [0068.329] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.329] lstrlenW (lpString=".zip") returned 4 [0068.329] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.329] lstrlenW (lpString=".rar") returned 4 [0068.329] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.329] lstrlenW (lpString=".bz2") returned 4 [0068.329] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.329] lstrlenW (lpString=".7z") returned 3 [0068.329] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.329] lstrlenW (lpString=".dbf") returned 4 [0068.329] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.329] lstrlenW (lpString=".1cd") returned 4 [0068.329] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0068.329] lstrlenW (lpString=".jpg") returned 4 [0068.329] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.329] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.329] lstrlenW (lpString="BOLDSTRI.INF") returned 12 [0068.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.330] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=596) returned 1 [0068.330] CloseHandle (hObject=0x150) returned 1 [0068.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0068.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.330] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.330] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.330] GetLastError () returned 0x0 [0068.330] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x254, lpOverlapped=0x0) returned 1 [0068.331] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x260, lpOverlapped=0x0) returned 1 [0068.332] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.332] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.332] SetEndOfFile (hFile=0x15c) returned 1 [0068.332] CloseHandle (hObject=0x15c) returned 1 [0068.333] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.333] SetEndOfFile (hFile=0x150) returned 1 [0068.333] CloseHandle (hObject=0x150) returned 1 [0068.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1 [0068.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.334] lstrlenW (lpString=".doc") returned 4 [0068.334] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.334] lstrlenW (lpString=".docx") returned 5 [0068.334] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0068.334] lstrlenW (lpString=".pdf") returned 4 [0068.334] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.334] lstrlenW (lpString=".xls") returned 4 [0068.334] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.334] lstrlenW (lpString=".xlsx") returned 5 [0068.334] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0068.334] lstrlenW (lpString=".ppt") returned 4 [0068.334] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.334] lstrlenW (lpString=".zip") returned 4 [0068.334] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.334] lstrlenW (lpString=".rar") returned 4 [0068.334] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.334] lstrlenW (lpString=".bz2") returned 4 [0068.334] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.334] lstrlenW (lpString=".7z") returned 3 [0068.334] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.334] lstrlenW (lpString=".dbf") returned 4 [0068.334] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString=".1cd") returned 4 [0068.335] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString=".jpg") returned 4 [0068.335] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString=".doc") returned 4 [0068.335] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.335] lstrlenW (lpString=".docx") returned 5 [0068.335] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0068.335] lstrlenW (lpString=".pdf") returned 4 [0068.335] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString=".xls") returned 4 [0068.335] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString=".xlsx") returned 5 [0068.335] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0068.335] lstrlenW (lpString=".ppt") returned 4 [0068.335] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString=".zip") returned 4 [0068.335] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString=".rar") returned 4 [0068.335] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.335] lstrlenW (lpString=".bz2") returned 4 [0068.335] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.335] lstrlenW (lpString=".7z") returned 3 [0068.335] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.335] lstrlenW (lpString=".dbf") returned 4 [0068.336] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.336] lstrlenW (lpString=".1cd") returned 4 [0068.336] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0068.336] lstrlenW (lpString=".jpg") returned 4 [0068.336] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.336] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.336] lstrlenW (lpString="BREEZE.ELM") returned 10 [0068.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.336] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=107831) returned 1 [0068.336] CloseHandle (hObject=0x150) returned 1 [0068.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0068.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0068.337] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.337] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0068.337] GetLastError () returned 0x0 [0068.337] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1a537, lpOverlapped=0x0) returned 1 [0068.711] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1a540, lpOverlapped=0x0) returned 1 [0068.713] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.713] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.713] SetEndOfFile (hFile=0x15c) returned 1 [0068.713] CloseHandle (hObject=0x15c) returned 1 [0068.715] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.716] SetEndOfFile (hFile=0x150) returned 1 [0068.727] CloseHandle (hObject=0x150) returned 1 [0068.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 1 [0068.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.728] lstrlenW (lpString=".doc") returned 4 [0068.728] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.728] lstrlenW (lpString=".docx") returned 5 [0068.728] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0068.728] lstrlenW (lpString=".pdf") returned 4 [0068.728] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.728] lstrlenW (lpString=".xls") returned 4 [0068.728] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.728] lstrlenW (lpString=".xlsx") returned 5 [0068.730] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0068.730] lstrlenW (lpString=".ppt") returned 4 [0068.735] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.735] lstrlenW (lpString=".zip") returned 4 [0068.743] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.743] lstrlenW (lpString=".rar") returned 4 [0068.743] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.744] lstrlenW (lpString=".bz2") returned 4 [0068.744] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.744] lstrlenW (lpString=".7z") returned 3 [0068.744] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.744] lstrlenW (lpString=".dbf") returned 4 [0068.744] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.745] lstrlenW (lpString=".1cd") returned 4 [0068.745] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0068.745] lstrlenW (lpString=".jpg") returned 4 [0068.745] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.745] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") [0068.792] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=480) returned 1 [0068.792] CloseHandle (hObject=0x1c8) returned 1 [0068.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0068.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.792] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.792] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.793] GetLastError () returned 0x0 [0068.793] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1e0, lpOverlapped=0x0) returned 1 [0068.794] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1f0, lpOverlapped=0x0) returned 1 [0068.795] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0068.795] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.795] SetEndOfFile (hFile=0x1fc) returned 1 [0068.795] CloseHandle (hObject=0x1fc) returned 1 [0068.795] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0068.795] SetEndOfFile (hFile=0x1c8) returned 1 [0068.796] CloseHandle (hObject=0x1c8) returned 1 [0068.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.796] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 1 [0068.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.796] lstrlenW (lpString=".doc") returned 4 [0068.796] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.796] lstrlenW (lpString=".docx") returned 5 [0068.796] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0068.796] lstrlenW (lpString=".pdf") returned 4 [0068.796] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.796] lstrlenW (lpString=".xls") returned 4 [0068.796] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.796] lstrlenW (lpString=".xlsx") returned 5 [0068.796] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0068.797] lstrlenW (lpString=".ppt") returned 4 [0068.797] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.797] lstrlenW (lpString=".zip") returned 4 [0068.797] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.797] lstrlenW (lpString=".rar") returned 4 [0068.797] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.797] lstrlenW (lpString=".bz2") returned 4 [0068.797] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.797] lstrlenW (lpString=".7z") returned 3 [0068.797] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.797] lstrlenW (lpString=".dbf") returned 4 [0068.797] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.797] lstrlenW (lpString=".1cd") returned 4 [0068.797] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0068.797] lstrlenW (lpString=".jpg") returned 4 [0068.797] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.797] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") [0069.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=503) returned 1 [0069.126] CloseHandle (hObject=0x180) returned 1 [0069.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0069.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.127] GetLastError () returned 0x0 [0069.127] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1f7, lpOverlapped=0x0) returned 1 [0069.128] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x200, lpOverlapped=0x0) returned 1 [0069.129] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.129] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.129] SetEndOfFile (hFile=0x210) returned 1 [0069.129] CloseHandle (hObject=0x210) returned 1 [0069.129] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.129] SetEndOfFile (hFile=0x180) returned 1 [0069.130] CloseHandle (hObject=0x180) returned 1 [0069.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.130] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 1 [0069.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.130] lstrlenW (lpString=".doc") returned 4 [0069.130] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.130] lstrlenW (lpString=".docx") returned 5 [0069.130] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0069.130] lstrlenW (lpString=".pdf") returned 4 [0069.130] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.130] lstrlenW (lpString=".xls") returned 4 [0069.131] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.131] lstrlenW (lpString=".xlsx") returned 5 [0069.131] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0069.131] lstrlenW (lpString=".ppt") returned 4 [0069.131] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.131] lstrlenW (lpString=".zip") returned 4 [0069.131] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.131] lstrlenW (lpString=".rar") returned 4 [0069.131] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.131] lstrlenW (lpString=".bz2") returned 4 [0069.131] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.131] lstrlenW (lpString=".7z") returned 3 [0069.131] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.131] lstrlenW (lpString=".dbf") returned 4 [0069.131] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.131] lstrlenW (lpString=".1cd") returned 4 [0069.131] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0069.131] lstrlenW (lpString=".jpg") returned 4 [0069.131] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.131] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") [0069.132] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=529) returned 1 [0069.132] CloseHandle (hObject=0x180) returned 1 [0069.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20 [0069.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.132] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.132] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.132] GetLastError () returned 0x0 [0069.133] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x211, lpOverlapped=0x0) returned 1 [0069.133] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x220, lpOverlapped=0x0) returned 1 [0069.149] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.149] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.156] SetEndOfFile (hFile=0x210) returned 1 [0069.156] CloseHandle (hObject=0x210) returned 1 [0069.165] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.165] SetEndOfFile (hFile=0x180) returned 1 [0069.214] CloseHandle (hObject=0x180) returned 1 [0069.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.215] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.215] lstrlenW (lpString=".doc") returned 4 [0069.215] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.215] lstrlenW (lpString=".docx") returned 5 [0069.215] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.215] lstrlenW (lpString=".pdf") returned 4 [0069.215] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.215] lstrlenW (lpString=".xls") returned 4 [0069.215] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.215] lstrlenW (lpString=".xlsx") returned 5 [0069.215] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.215] lstrlenW (lpString=".ppt") returned 4 [0069.215] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.215] lstrlenW (lpString=".zip") returned 4 [0069.215] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.215] lstrlenW (lpString=".rar") returned 4 [0069.215] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.215] lstrlenW (lpString=".bz2") returned 4 [0069.215] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.215] lstrlenW (lpString=".7z") returned 3 [0069.215] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.215] lstrlenW (lpString=".dbf") returned 4 [0069.216] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.216] lstrlenW (lpString=".1cd") returned 4 [0069.216] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0069.216] lstrlenW (lpString=".jpg") returned 4 [0069.216] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.216] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") [0069.322] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=429) returned 1 [0069.323] CloseHandle (hObject=0x154) returned 1 [0069.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0069.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0069.323] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.323] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0069.323] GetLastError () returned 0x0 [0069.323] ReadFile (in: hFile=0x154, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1ad, lpOverlapped=0x0) returned 1 [0069.324] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1b0, lpOverlapped=0x0) returned 1 [0069.325] ReadFile (in: hFile=0x154, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.325] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0069.325] SetEndOfFile (hFile=0x22c) returned 1 [0069.325] CloseHandle (hObject=0x22c) returned 1 [0069.326] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.326] SetEndOfFile (hFile=0x154) returned 1 [0069.326] CloseHandle (hObject=0x154) returned 1 [0069.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 1 [0069.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.327] lstrlenW (lpString=".doc") returned 4 [0069.327] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.327] lstrlenW (lpString=".docx") returned 5 [0069.327] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.327] lstrlenW (lpString=".pdf") returned 4 [0069.327] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.327] lstrlenW (lpString=".xls") returned 4 [0069.327] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.327] lstrlenW (lpString=".xlsx") returned 5 [0069.327] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.327] lstrlenW (lpString=".ppt") returned 4 [0069.327] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.327] lstrlenW (lpString=".zip") returned 4 [0069.327] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.327] lstrlenW (lpString=".rar") returned 4 [0069.327] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.327] lstrlenW (lpString=".bz2") returned 4 [0069.327] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.327] lstrlenW (lpString=".7z") returned 3 [0069.327] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.327] lstrlenW (lpString=".dbf") returned 4 [0069.327] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.328] lstrlenW (lpString=".1cd") returned 4 [0069.328] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0069.328] lstrlenW (lpString=".jpg") returned 4 [0069.328] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.328] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") [0069.458] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=500) returned 1 [0069.471] CloseHandle (hObject=0x158) returned 1 [0069.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20 [0069.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.474] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.474] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.478] GetLastError () returned 0x0 [0069.478] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1f4, lpOverlapped=0x0) returned 1 [0069.479] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x200, lpOverlapped=0x0) returned 1 [0069.480] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.480] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.480] SetEndOfFile (hFile=0x1ec) returned 1 [0069.480] CloseHandle (hObject=0x1ec) returned 1 [0069.480] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.480] SetEndOfFile (hFile=0x158) returned 1 [0069.481] CloseHandle (hObject=0x158) returned 1 [0069.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.481] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 1 [0069.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.481] lstrlenW (lpString=".doc") returned 4 [0069.481] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.481] lstrlenW (lpString=".docx") returned 5 [0069.481] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0069.482] lstrlenW (lpString=".pdf") returned 4 [0069.482] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.482] lstrlenW (lpString=".xls") returned 4 [0069.482] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.482] lstrlenW (lpString=".xlsx") returned 5 [0069.482] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0069.482] lstrlenW (lpString=".ppt") returned 4 [0069.482] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.482] lstrlenW (lpString=".zip") returned 4 [0069.482] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.482] lstrlenW (lpString=".rar") returned 4 [0069.482] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.482] lstrlenW (lpString=".bz2") returned 4 [0069.482] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.482] lstrlenW (lpString=".7z") returned 3 [0069.482] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.482] lstrlenW (lpString=".dbf") returned 4 [0069.482] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.482] lstrlenW (lpString=".1cd") returned 4 [0069.482] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0069.482] lstrlenW (lpString=".jpg") returned 4 [0069.482] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.482] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") [0069.483] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=444) returned 1 [0069.483] CloseHandle (hObject=0x158) returned 1 [0069.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20 [0069.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.483] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.483] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.484] GetLastError () returned 0x0 [0069.484] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1bc, lpOverlapped=0x0) returned 1 [0069.485] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1c0, lpOverlapped=0x0) returned 1 [0069.485] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.485] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0069.486] SetEndOfFile (hFile=0x1ec) returned 1 [0069.486] CloseHandle (hObject=0x1ec) returned 1 [0069.486] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.486] SetEndOfFile (hFile=0x158) returned 1 [0069.487] CloseHandle (hObject=0x158) returned 1 [0069.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.487] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 1 [0069.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.487] lstrlenW (lpString=".doc") returned 4 [0069.487] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.487] lstrlenW (lpString=".docx") returned 5 [0069.487] lstrcmpiW (lpString1=".docx", lpString2="Y.INF") returned -1 [0069.487] lstrlenW (lpString=".pdf") returned 4 [0069.487] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.487] lstrlenW (lpString=".xls") returned 4 [0069.487] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.487] lstrlenW (lpString=".xlsx") returned 5 [0069.487] lstrcmpiW (lpString1=".xlsx", lpString2="Y.INF") returned -1 [0069.487] lstrlenW (lpString=".ppt") returned 4 [0069.487] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.487] lstrlenW (lpString=".zip") returned 4 [0069.487] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.487] lstrlenW (lpString=".rar") returned 4 [0069.487] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.487] lstrlenW (lpString=".bz2") returned 4 [0069.488] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.488] lstrlenW (lpString=".7z") returned 3 [0069.488] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.488] lstrlenW (lpString=".dbf") returned 4 [0069.488] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.488] lstrlenW (lpString=".1cd") returned 4 [0069.488] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0069.488] lstrlenW (lpString=".jpg") returned 4 [0069.488] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.488] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") [0069.488] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=85056) returned 1 [0069.488] CloseHandle (hObject=0x158) returned 1 [0069.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20 [0069.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.489] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.489] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.489] GetLastError () returned 0x0 [0069.489] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x14c40, lpOverlapped=0x0) returned 1 [0069.492] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x14c50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x14c50, lpOverlapped=0x0) returned 1 [0069.494] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.494] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.494] SetEndOfFile (hFile=0x1ec) returned 1 [0069.495] CloseHandle (hObject=0x1ec) returned 1 [0069.495] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.495] SetEndOfFile (hFile=0x158) returned 1 [0069.496] CloseHandle (hObject=0x158) returned 1 [0069.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 1 [0069.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.496] lstrlenW (lpString=".doc") returned 4 [0069.496] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.496] lstrlenW (lpString=".docx") returned 5 [0069.496] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.496] lstrlenW (lpString=".pdf") returned 4 [0069.496] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.496] lstrlenW (lpString=".xls") returned 4 [0069.497] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.497] lstrlenW (lpString=".xlsx") returned 5 [0069.497] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.497] lstrlenW (lpString=".ppt") returned 4 [0069.497] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.497] lstrlenW (lpString=".zip") returned 4 [0069.497] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.497] lstrlenW (lpString=".rar") returned 4 [0069.497] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.497] lstrlenW (lpString=".bz2") returned 4 [0069.497] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.497] lstrlenW (lpString=".7z") returned 3 [0069.497] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.497] lstrlenW (lpString=".dbf") returned 4 [0069.497] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.497] lstrlenW (lpString=".1cd") returned 4 [0069.497] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0069.497] lstrlenW (lpString=".jpg") returned 4 [0069.497] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.497] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") [0069.498] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=500) returned 1 [0069.498] CloseHandle (hObject=0x158) returned 1 [0069.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20 [0069.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.498] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.498] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.498] GetLastError () returned 0x0 [0069.499] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1f4, lpOverlapped=0x0) returned 1 [0069.499] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x200, lpOverlapped=0x0) returned 1 [0069.501] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.501] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.501] SetEndOfFile (hFile=0x1ec) returned 1 [0069.501] CloseHandle (hObject=0x1ec) returned 1 [0069.501] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.501] SetEndOfFile (hFile=0x158) returned 1 [0069.502] CloseHandle (hObject=0x158) returned 1 [0069.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.502] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 1 [0069.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.502] lstrlenW (lpString=".doc") returned 4 [0069.502] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.502] lstrlenW (lpString=".docx") returned 5 [0069.502] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.502] lstrlenW (lpString=".pdf") returned 4 [0069.502] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.502] lstrlenW (lpString=".xls") returned 4 [0069.502] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.502] lstrlenW (lpString=".xlsx") returned 5 [0069.502] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.502] lstrlenW (lpString=".ppt") returned 4 [0069.502] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.503] lstrlenW (lpString=".zip") returned 4 [0069.503] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.503] lstrlenW (lpString=".rar") returned 4 [0069.503] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.503] lstrlenW (lpString=".bz2") returned 4 [0069.503] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.503] lstrlenW (lpString=".7z") returned 3 [0069.503] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.503] lstrlenW (lpString=".dbf") returned 4 [0069.503] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.503] lstrlenW (lpString=".1cd") returned 4 [0069.503] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0069.503] lstrlenW (lpString=".jpg") returned 4 [0069.503] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.503] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") [0069.683] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=54687) returned 1 [0069.683] CloseHandle (hObject=0x1c0) returned 1 [0069.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20 [0069.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.683] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.683] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.684] GetLastError () returned 0x0 [0069.684] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd59f, lpOverlapped=0x0) returned 1 [0069.723] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd5a0, lpOverlapped=0x0) returned 1 [0069.769] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.770] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.772] SetEndOfFile (hFile=0x1f0) returned 1 [0069.780] CloseHandle (hObject=0x1f0) returned 1 [0069.783] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.785] SetEndOfFile (hFile=0x1c0) returned 1 [0069.812] CloseHandle (hObject=0x1c0) returned 1 [0069.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 1 [0069.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.835] lstrlenW (lpString=".doc") returned 4 [0069.836] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.837] lstrlenW (lpString=".docx") returned 5 [0069.838] lstrcmpiW (lpString1=".docx", lpString2="A.ELM") returned -1 [0069.840] lstrlenW (lpString=".pdf") returned 4 [0069.841] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.843] lstrlenW (lpString=".xls") returned 4 [0069.844] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.846] lstrlenW (lpString=".xlsx") returned 5 [0069.847] lstrcmpiW (lpString1=".xlsx", lpString2="A.ELM") returned -1 [0069.848] lstrlenW (lpString=".ppt") returned 4 [0069.849] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.854] lstrlenW (lpString=".zip") returned 4 [0069.856] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.863] lstrlenW (lpString=".rar") returned 4 [0069.866] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.867] lstrlenW (lpString=".bz2") returned 4 [0069.870] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.872] lstrlenW (lpString=".7z") returned 3 [0069.872] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.892] lstrlenW (lpString=".dbf") returned 4 [0069.892] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.892] lstrlenW (lpString=".1cd") returned 4 [0069.892] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0069.892] lstrlenW (lpString=".jpg") returned 4 [0069.892] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.892] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") [0069.893] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=57906) returned 1 [0069.893] CloseHandle (hObject=0x1c0) returned 1 [0069.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0069.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.893] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.893] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.894] GetLastError () returned 0x0 [0069.894] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xe232, lpOverlapped=0x0) returned 1 [0069.897] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe240, lpOverlapped=0x0) returned 1 [0069.898] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.898] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.898] SetEndOfFile (hFile=0x1f0) returned 1 [0069.901] CloseHandle (hObject=0x1f0) returned 1 [0069.901] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.901] SetEndOfFile (hFile=0x1c0) returned 1 [0069.902] CloseHandle (hObject=0x1c0) returned 1 [0069.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.902] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 1 [0069.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.902] lstrlenW (lpString=".doc") returned 4 [0069.903] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.903] lstrlenW (lpString=".docx") returned 5 [0069.903] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.903] lstrlenW (lpString=".pdf") returned 4 [0069.903] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.903] lstrlenW (lpString=".xls") returned 4 [0069.903] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.903] lstrlenW (lpString=".xlsx") returned 5 [0069.903] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.903] lstrlenW (lpString=".ppt") returned 4 [0069.903] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.903] lstrlenW (lpString=".zip") returned 4 [0069.903] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.903] lstrlenW (lpString=".rar") returned 4 [0069.903] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.903] lstrlenW (lpString=".bz2") returned 4 [0069.903] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.903] lstrlenW (lpString=".7z") returned 3 [0069.903] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.903] lstrlenW (lpString=".dbf") returned 4 [0069.903] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.903] lstrlenW (lpString=".1cd") returned 4 [0069.903] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0069.903] lstrlenW (lpString=".jpg") returned 4 [0069.903] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.903] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") [0069.904] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=625) returned 1 [0069.905] CloseHandle (hObject=0x1c0) returned 1 [0069.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0069.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.905] GetLastError () returned 0x0 [0069.905] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x271, lpOverlapped=0x0) returned 1 [0069.906] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x280, lpOverlapped=0x0) returned 1 [0069.907] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.907] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.907] SetEndOfFile (hFile=0x1f0) returned 1 [0069.907] CloseHandle (hObject=0x1f0) returned 1 [0069.907] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.907] SetEndOfFile (hFile=0x1c0) returned 1 [0069.908] CloseHandle (hObject=0x1c0) returned 1 [0069.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 1 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.909] lstrlenW (lpString=".doc") returned 4 [0069.909] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.909] lstrlenW (lpString=".docx") returned 5 [0069.909] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.909] lstrlenW (lpString=".pdf") returned 4 [0069.909] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.909] lstrlenW (lpString=".xls") returned 4 [0069.909] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.909] lstrlenW (lpString=".xlsx") returned 5 [0069.909] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.909] lstrlenW (lpString=".ppt") returned 4 [0069.909] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.909] lstrlenW (lpString=".zip") returned 4 [0069.909] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.909] lstrlenW (lpString=".rar") returned 4 [0069.909] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.909] lstrlenW (lpString=".bz2") returned 4 [0069.909] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.909] lstrlenW (lpString=".7z") returned 3 [0069.909] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.909] lstrlenW (lpString=".dbf") returned 4 [0069.909] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.909] lstrlenW (lpString=".1cd") returned 4 [0069.909] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0069.910] lstrlenW (lpString=".jpg") returned 4 [0069.910] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.910] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") [0069.911] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=49133) returned 1 [0069.911] CloseHandle (hObject=0x1c0) returned 1 [0069.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 0x20 [0069.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.911] GetLastError () returned 0x0 [0069.912] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbfed, lpOverlapped=0x0) returned 1 [0069.915] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbff0, lpOverlapped=0x0) returned 1 [0069.917] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.917] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.917] SetEndOfFile (hFile=0x1f0) returned 1 [0069.917] CloseHandle (hObject=0x1f0) returned 1 [0069.917] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.917] SetEndOfFile (hFile=0x1c0) returned 1 [0069.918] CloseHandle (hObject=0x1c0) returned 1 [0069.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 1 [0069.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString=".doc") returned 4 [0069.919] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.919] lstrlenW (lpString=".docx") returned 5 [0069.919] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0069.919] lstrlenW (lpString=".pdf") returned 4 [0069.919] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.919] lstrlenW (lpString=".xls") returned 4 [0069.919] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.919] lstrlenW (lpString=".xlsx") returned 5 [0069.919] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0069.919] lstrlenW (lpString=".ppt") returned 4 [0069.919] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString=".zip") returned 4 [0069.919] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.919] lstrlenW (lpString=".rar") returned 4 [0069.919] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.919] lstrlenW (lpString=".bz2") returned 4 [0069.919] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.919] lstrlenW (lpString=".7z") returned 3 [0069.919] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString=".dbf") returned 4 [0069.919] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString=".1cd") returned 4 [0069.919] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0069.919] lstrlenW (lpString=".jpg") returned 4 [0069.919] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.919] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") [0069.920] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=578) returned 1 [0069.920] CloseHandle (hObject=0x1c0) returned 1 [0069.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0069.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.921] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.921] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.921] GetLastError () returned 0x0 [0069.921] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x242, lpOverlapped=0x0) returned 1 [0069.922] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x250, lpOverlapped=0x0) returned 1 [0069.923] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0069.923] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.923] SetEndOfFile (hFile=0x1f0) returned 1 [0069.923] CloseHandle (hObject=0x1f0) returned 1 [0069.923] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0069.923] SetEndOfFile (hFile=0x1c0) returned 1 [0069.924] CloseHandle (hObject=0x1c0) returned 1 [0069.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 1 [0069.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString=".doc") returned 4 [0069.925] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.925] lstrlenW (lpString=".docx") returned 5 [0069.925] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0069.925] lstrlenW (lpString=".pdf") returned 4 [0069.925] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.925] lstrlenW (lpString=".xls") returned 4 [0069.925] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.925] lstrlenW (lpString=".xlsx") returned 5 [0069.925] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0069.925] lstrlenW (lpString=".ppt") returned 4 [0069.925] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString=".zip") returned 4 [0069.925] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.925] lstrlenW (lpString=".rar") returned 4 [0069.925] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.925] lstrlenW (lpString=".bz2") returned 4 [0069.925] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.925] lstrlenW (lpString=".7z") returned 3 [0069.925] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString=".dbf") returned 4 [0069.925] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString=".1cd") returned 4 [0069.925] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0069.925] lstrlenW (lpString=".jpg") returned 4 [0069.925] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.926] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") [0070.057] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=106004) returned 1 [0070.057] CloseHandle (hObject=0x180) returned 1 [0070.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20 [0070.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0070.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0070.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0070.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0070.065] GetLastError () returned 0x0 [0070.066] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x19e14, lpOverlapped=0x0) returned 1 [0070.082] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x19e20, lpOverlapped=0x0) returned 1 [0070.618] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0070.618] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.618] SetEndOfFile (hFile=0x16c) returned 1 [0070.624] CloseHandle (hObject=0x16c) returned 1 [0070.624] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0070.625] SetEndOfFile (hFile=0x180) returned 1 [0070.626] CloseHandle (hObject=0x180) returned 1 [0070.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.626] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 1 [0070.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.626] lstrlenW (lpString=".doc") returned 4 [0070.626] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0070.626] lstrlenW (lpString=".docx") returned 5 [0070.626] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1 [0070.626] lstrlenW (lpString=".pdf") returned 4 [0070.626] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0070.627] lstrlenW (lpString=".xls") returned 4 [0070.627] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0070.627] lstrlenW (lpString=".xlsx") returned 5 [0070.627] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1 [0070.627] lstrlenW (lpString=".ppt") returned 4 [0070.627] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.627] lstrlenW (lpString=".zip") returned 4 [0070.627] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0070.627] lstrlenW (lpString=".rar") returned 4 [0070.627] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0070.627] lstrlenW (lpString=".bz2") returned 4 [0070.627] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0070.627] lstrlenW (lpString=".7z") returned 3 [0070.627] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.627] lstrlenW (lpString=".dbf") returned 4 [0070.627] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.627] lstrlenW (lpString=".1cd") returned 4 [0070.627] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0070.627] lstrlenW (lpString=".jpg") returned 4 [0070.627] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0070.627] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") [0070.628] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=943322) returned 1 [0070.628] CloseHandle (hObject=0x180) returned 1 [0070.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0070.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0070.628] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0070.628] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0070.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0070.629] GetLastError () returned 0x0 [0070.629] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xe64da, lpOverlapped=0x0) returned 1 [0071.001] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe64e0, lpOverlapped=0x0) returned 1 [0071.038] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0071.038] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.038] SetEndOfFile (hFile=0x16c) returned 1 [0071.038] CloseHandle (hObject=0x16c) returned 1 [0071.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.039] SetEndOfFile (hFile=0x180) returned 1 [0071.046] CloseHandle (hObject=0x180) returned 1 [0071.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 1 [0071.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.046] lstrlenW (lpString=".doc") returned 4 [0071.047] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0071.047] lstrlenW (lpString=".docx") returned 5 [0071.047] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0071.047] lstrlenW (lpString=".pdf") returned 4 [0071.047] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0071.047] lstrlenW (lpString=".xls") returned 4 [0071.047] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0071.047] lstrlenW (lpString=".xlsx") returned 5 [0071.047] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0071.047] lstrlenW (lpString=".ppt") returned 4 [0071.047] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0071.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.047] lstrlenW (lpString=".zip") returned 4 [0071.047] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0071.047] lstrlenW (lpString=".rar") returned 4 [0071.047] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0071.047] lstrlenW (lpString=".bz2") returned 4 [0071.047] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0071.047] lstrlenW (lpString=".7z") returned 3 [0071.047] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0071.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.047] lstrlenW (lpString=".dbf") returned 4 [0071.047] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0071.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.047] lstrlenW (lpString=".1cd") returned 4 [0071.047] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0071.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0071.047] lstrlenW (lpString=".jpg") returned 4 [0071.047] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0071.047] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") [0071.048] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=229888) returned 1 [0071.048] CloseHandle (hObject=0x180) returned 1 [0071.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 0x20 [0071.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.049] GetLastError () returned 0x0 [0071.049] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x38200, lpOverlapped=0x0) returned 1 [0071.197] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x38210, lpOverlapped=0x0) returned 1 [0071.202] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0071.202] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.202] SetEndOfFile (hFile=0x16c) returned 1 [0071.570] CloseHandle (hObject=0x16c) returned 1 [0071.570] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.570] SetEndOfFile (hFile=0x180) returned 1 [0071.592] CloseHandle (hObject=0x180) returned 1 [0071.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.592] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 1 [0071.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.593] lstrlenW (lpString=".doc") returned 4 [0071.593] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString=".docx") returned 5 [0071.593] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0071.593] lstrlenW (lpString=".pdf") returned 4 [0071.593] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString=".xls") returned 4 [0071.593] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString=".xlsx") returned 5 [0071.593] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0071.593] lstrlenW (lpString=".ppt") returned 4 [0071.593] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.593] lstrlenW (lpString=".zip") returned 4 [0071.593] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString=".rar") returned 4 [0071.593] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.593] lstrlenW (lpString=".bz2") returned 4 [0071.593] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.593] lstrlenW (lpString=".7z") returned 3 [0071.593] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.593] lstrlenW (lpString=".dbf") returned 4 [0071.593] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.593] lstrlenW (lpString=".1cd") returned 4 [0071.594] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0071.594] lstrlenW (lpString=".jpg") returned 4 [0071.594] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.594] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") [0071.681] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3675976) returned 1 [0071.681] CloseHandle (hObject=0x1ec) returned 1 [0071.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0x20 [0071.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0071.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0071.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0071.692] ReadFile (in: hFile=0x180, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.726] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0071.726] ReadFile (in: hFile=0x180, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x341748, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0071.735] ReadFile (in: hFile=0x180, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.819] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.819] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fc, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fc, lpOverlapped=0x0) returned 1 [0071.949] SetEndOfFile (hFile=0x180) returned 1 [0071.949] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0071.949] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0071.949] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.950] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x12b26d, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0071.951] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x341748, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0071.954] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.956] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0071.956] CloseHandle (hObject=0x180) returned 1 [0071.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString=".doc") returned 4 [0071.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString=".docx") returned 5 [0071.957] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0071.957] lstrlenW (lpString=".pdf") returned 4 [0071.957] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString=".xls") returned 4 [0071.957] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString=".xlsx") returned 5 [0071.957] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0071.957] lstrlenW (lpString=".ppt") returned 4 [0071.957] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString=".zip") returned 4 [0071.957] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString=".rar") returned 4 [0071.957] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.957] lstrlenW (lpString=".bz2") returned 4 [0071.957] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.957] lstrlenW (lpString=".7z") returned 3 [0071.957] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString=".dbf") returned 4 [0071.957] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString=".1cd") returned 4 [0071.957] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0071.957] lstrlenW (lpString=".jpg") returned 4 [0071.958] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.958] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") [0071.958] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11009) returned 1 [0071.958] CloseHandle (hObject=0x180) returned 1 [0071.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20 [0071.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.959] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.959] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0071.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0071.959] GetLastError () returned 0x0 [0071.959] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2b01, lpOverlapped=0x0) returned 1 [0072.005] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0072.006] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0072.006] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.006] SetEndOfFile (hFile=0x1fc) returned 1 [0072.006] CloseHandle (hObject=0x1fc) returned 1 [0072.007] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.007] SetEndOfFile (hFile=0x180) returned 1 [0072.007] CloseHandle (hObject=0x180) returned 1 [0072.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 1 [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.008] lstrlenW (lpString=".doc") returned 4 [0072.008] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.008] lstrlenW (lpString=".docx") returned 5 [0072.008] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.008] lstrlenW (lpString=".pdf") returned 4 [0072.008] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.008] lstrlenW (lpString=".xls") returned 4 [0072.008] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.008] lstrlenW (lpString=".xlsx") returned 5 [0072.008] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.008] lstrlenW (lpString=".ppt") returned 4 [0072.008] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.008] lstrlenW (lpString=".zip") returned 4 [0072.008] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.008] lstrlenW (lpString=".rar") returned 4 [0072.008] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.008] lstrlenW (lpString=".bz2") returned 4 [0072.008] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.008] lstrlenW (lpString=".7z") returned 3 [0072.008] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.008] lstrlenW (lpString=".dbf") returned 4 [0072.009] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.009] lstrlenW (lpString=".1cd") returned 4 [0072.009] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 76 [0072.009] lstrlenW (lpString=".jpg") returned 4 [0072.009] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.009] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") [0072.024] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=196069) returned 1 [0072.024] CloseHandle (hObject=0x180) returned 1 [0072.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20 [0072.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.052] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.052] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.052] GetLastError () returned 0x0 [0072.052] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2fde5, lpOverlapped=0x0) returned 1 [0072.057] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2fdf0, lpOverlapped=0x0) returned 1 [0072.060] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0072.060] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.060] SetEndOfFile (hFile=0x1fc) returned 1 [0072.061] CloseHandle (hObject=0x1fc) returned 1 [0072.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.061] SetEndOfFile (hFile=0x180) returned 1 [0072.063] CloseHandle (hObject=0x180) returned 1 [0072.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 1 [0072.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.063] lstrlenW (lpString=".doc") returned 4 [0072.063] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.063] lstrlenW (lpString=".docx") returned 5 [0072.063] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.063] lstrlenW (lpString=".pdf") returned 4 [0072.063] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.063] lstrlenW (lpString=".xls") returned 4 [0072.063] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.063] lstrlenW (lpString=".xlsx") returned 5 [0072.063] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.063] lstrlenW (lpString=".ppt") returned 4 [0072.063] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.063] lstrlenW (lpString=".zip") returned 4 [0072.063] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.063] lstrlenW (lpString=".rar") returned 4 [0072.063] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.063] lstrlenW (lpString=".bz2") returned 4 [0072.064] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.064] lstrlenW (lpString=".7z") returned 3 [0072.064] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.064] lstrlenW (lpString=".dbf") returned 4 [0072.064] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.064] lstrlenW (lpString=".1cd") returned 4 [0072.064] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 76 [0072.064] lstrlenW (lpString=".jpg") returned 4 [0072.064] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.064] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") [0072.064] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=916632) returned 1 [0072.064] CloseHandle (hObject=0x180) returned 1 [0072.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20 [0072.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.065] GetLastError () returned 0x0 [0072.065] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdfc98, lpOverlapped=0x0) returned 1 [0072.242] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdfca0, lpOverlapped=0x0) returned 1 [0072.258] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0072.258] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.258] SetEndOfFile (hFile=0x1fc) returned 1 [0072.258] CloseHandle (hObject=0x1fc) returned 1 [0072.258] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.258] SetEndOfFile (hFile=0x180) returned 1 [0072.265] CloseHandle (hObject=0x180) returned 1 [0072.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 1 [0072.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.266] lstrlenW (lpString=".doc") returned 4 [0072.266] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.266] lstrlenW (lpString=".docx") returned 5 [0072.266] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.266] lstrlenW (lpString=".pdf") returned 4 [0072.266] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.266] lstrlenW (lpString=".xls") returned 4 [0072.266] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.266] lstrlenW (lpString=".xlsx") returned 5 [0072.266] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.266] lstrlenW (lpString=".ppt") returned 4 [0072.266] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.266] lstrlenW (lpString=".zip") returned 4 [0072.266] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.266] lstrlenW (lpString=".rar") returned 4 [0072.266] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.266] lstrlenW (lpString=".bz2") returned 4 [0072.266] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.267] lstrlenW (lpString=".7z") returned 3 [0072.267] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.267] lstrlenW (lpString=".dbf") returned 4 [0072.267] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.267] lstrlenW (lpString=".1cd") returned 4 [0072.267] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 77 [0072.267] lstrlenW (lpString=".jpg") returned 4 [0072.267] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.267] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") [0072.337] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=387408) returned 1 [0072.337] CloseHandle (hObject=0x150) returned 1 [0072.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0072.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.337] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.347] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.348] GetLastError () returned 0x0 [0072.348] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5e950, lpOverlapped=0x0) returned 1 [0072.364] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5e960, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5e960, lpOverlapped=0x0) returned 1 [0072.372] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0072.372] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0072.372] SetEndOfFile (hFile=0x1ec) returned 1 [0072.372] CloseHandle (hObject=0x1ec) returned 1 [0072.372] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.372] SetEndOfFile (hFile=0x150) returned 1 [0072.375] CloseHandle (hObject=0x150) returned 1 [0072.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.376] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0072.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.376] lstrlenW (lpString=".doc") returned 4 [0072.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString=".docx") returned 5 [0072.376] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0072.376] lstrlenW (lpString=".pdf") returned 4 [0072.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString=".xls") returned 4 [0072.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString=".xlsx") returned 5 [0072.376] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0072.376] lstrlenW (lpString=".ppt") returned 4 [0072.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.376] lstrlenW (lpString=".zip") returned 4 [0072.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString=".rar") returned 4 [0072.376] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.376] lstrlenW (lpString=".bz2") returned 4 [0072.376] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.376] lstrlenW (lpString=".7z") returned 3 [0072.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.376] lstrlenW (lpString=".dbf") returned 4 [0072.376] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.376] lstrlenW (lpString=".1cd") returned 4 [0072.377] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0072.377] lstrlenW (lpString=".jpg") returned 4 [0072.377] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.377] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") [0072.457] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16208) returned 1 [0072.457] CloseHandle (hObject=0x22c) returned 1 [0072.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0072.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0072.457] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.457] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.633] GetLastError () returned 0x0 [0072.633] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3f50, lpOverlapped=0x0) returned 1 [0072.635] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3f60, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3f60, lpOverlapped=0x0) returned 1 [0072.637] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0072.637] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xee, lpOverlapped=0x0) returned 1 [0072.637] SetEndOfFile (hFile=0x1fc) returned 1 [0072.637] CloseHandle (hObject=0x1fc) returned 1 [0072.637] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0072.637] SetEndOfFile (hFile=0x22c) returned 1 [0072.639] CloseHandle (hObject=0x22c) returned 1 [0072.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0072.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.639] lstrlenW (lpString=".doc") returned 4 [0072.639] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0072.639] lstrlenW (lpString=".docx") returned 5 [0072.639] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0072.639] lstrlenW (lpString=".pdf") returned 4 [0072.639] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString=".xls") returned 4 [0072.640] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0072.640] lstrlenW (lpString=".xlsx") returned 5 [0072.640] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0072.640] lstrlenW (lpString=".ppt") returned 4 [0072.640] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.640] lstrlenW (lpString=".zip") returned 4 [0072.640] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0072.640] lstrlenW (lpString=".rar") returned 4 [0072.640] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString=".bz2") returned 4 [0072.640] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString=".7z") returned 3 [0072.640] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.640] lstrlenW (lpString=".dbf") returned 4 [0072.640] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.640] lstrlenW (lpString=".1cd") returned 4 [0072.640] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 65 [0072.640] lstrlenW (lpString=".jpg") returned 4 [0072.640] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0072.641] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") [0073.799] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=98304) returned 1 [0073.799] CloseHandle (hObject=0x150) returned 1 [0073.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0073.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.799] lstrlenW (lpString=".doc") returned 4 [0073.799] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0073.799] lstrlenW (lpString=".docx") returned 5 [0073.799] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1 [0073.799] lstrlenW (lpString=".pdf") returned 4 [0073.800] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString=".xls") returned 4 [0073.800] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0073.800] lstrlenW (lpString=".xlsx") returned 5 [0073.800] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1 [0073.800] lstrlenW (lpString=".ppt") returned 4 [0073.800] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.800] lstrlenW (lpString=".zip") returned 4 [0073.800] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0073.800] lstrlenW (lpString=".rar") returned 4 [0073.800] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString=".bz2") returned 4 [0073.800] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString=".7z") returned 3 [0073.800] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.800] lstrlenW (lpString=".dbf") returned 4 [0073.800] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.800] lstrlenW (lpString=".1cd") returned 4 [0073.800] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0073.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0073.800] lstrlenW (lpString=".jpg") returned 4 [0073.800] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0073.800] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") [0074.027] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=20480) returned 1 [0074.027] CloseHandle (hObject=0x22c) returned 1 [0074.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0074.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.045] lstrlenW (lpString=".doc") returned 4 [0074.045] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0074.045] lstrlenW (lpString=".docx") returned 5 [0074.045] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0074.045] lstrlenW (lpString=".pdf") returned 4 [0074.045] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0074.045] lstrlenW (lpString=".xls") returned 4 [0074.045] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0074.045] lstrlenW (lpString=".xlsx") returned 5 [0074.045] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0074.045] lstrlenW (lpString=".ppt") returned 4 [0074.045] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0074.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.045] lstrlenW (lpString=".zip") returned 4 [0074.045] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0074.046] lstrlenW (lpString=".rar") returned 4 [0074.046] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString=".bz2") returned 4 [0074.046] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString=".7z") returned 3 [0074.046] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString=".dbf") returned 4 [0074.046] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString=".1cd") returned 4 [0074.046] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString=".jpg") returned 4 [0074.046] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString=".doc") returned 4 [0074.046] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString=".docx") returned 5 [0074.046] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0074.046] lstrlenW (lpString=".pdf") returned 4 [0074.046] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString=".xls") returned 4 [0074.046] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0074.046] lstrlenW (lpString=".xlsx") returned 5 [0074.046] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0074.046] lstrlenW (lpString=".ppt") returned 4 [0074.046] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0074.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.046] lstrlenW (lpString=".zip") returned 4 [0074.046] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0074.046] lstrlenW (lpString=".rar") returned 4 [0074.046] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0074.047] lstrlenW (lpString=".bz2") returned 4 [0074.047] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0074.047] lstrlenW (lpString=".7z") returned 3 [0074.047] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0074.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.047] lstrlenW (lpString=".dbf") returned 4 [0074.047] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0074.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.047] lstrlenW (lpString=".1cd") returned 4 [0074.047] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0074.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0074.047] lstrlenW (lpString=".jpg") returned 4 [0074.047] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0074.047] lstrlenW (lpString="sqloledb.rll.mui") returned 16 [0074.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.084] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=44032) returned 1 [0074.084] CloseHandle (hObject=0x1c0) returned 1 [0074.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0074.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.085] lstrlenW (lpString=".doc") returned 4 [0074.085] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.085] lstrlenW (lpString=".docx") returned 5 [0074.085] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.086] lstrlenW (lpString=".pdf") returned 4 [0074.086] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.086] lstrlenW (lpString=".xls") returned 4 [0074.086] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.086] lstrlenW (lpString=".xlsx") returned 5 [0074.086] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.086] lstrlenW (lpString=".ppt") returned 4 [0074.087] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString=".zip") returned 4 [0074.087] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.087] lstrlenW (lpString=".rar") returned 4 [0074.087] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.087] lstrlenW (lpString=".bz2") returned 4 [0074.087] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.087] lstrlenW (lpString=".7z") returned 3 [0074.087] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString=".dbf") returned 4 [0074.087] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString=".1cd") returned 4 [0074.087] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString=".jpg") returned 4 [0074.087] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.087] lstrlenW (lpString=".doc") returned 4 [0074.087] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.087] lstrlenW (lpString=".docx") returned 5 [0074.087] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.087] lstrlenW (lpString=".pdf") returned 4 [0074.087] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.087] lstrlenW (lpString=".xls") returned 4 [0074.087] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.087] lstrlenW (lpString=".xlsx") returned 5 [0074.088] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.088] lstrlenW (lpString=".ppt") returned 4 [0074.088] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.088] lstrlenW (lpString=".zip") returned 4 [0074.088] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.088] lstrlenW (lpString=".rar") returned 4 [0074.088] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.088] lstrlenW (lpString=".bz2") returned 4 [0074.088] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.088] lstrlenW (lpString=".7z") returned 3 [0074.088] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.088] lstrlenW (lpString=".dbf") returned 4 [0074.088] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.088] lstrlenW (lpString=".1cd") returned 4 [0074.088] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0074.088] lstrlenW (lpString=".jpg") returned 4 [0074.088] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.088] lstrlenW (lpString="oledb32.dll") returned 11 [0074.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.089] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1101824) returned 1 [0074.089] CloseHandle (hObject=0x1c0) returned 1 [0074.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0074.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.089] lstrlenW (lpString=".doc") returned 4 [0074.089] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.089] lstrlenW (lpString=".docx") returned 5 [0074.089] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0074.089] lstrlenW (lpString=".pdf") returned 4 [0074.089] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.089] lstrlenW (lpString=".xls") returned 4 [0074.089] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.089] lstrlenW (lpString=".xlsx") returned 5 [0074.089] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0074.089] lstrlenW (lpString=".ppt") returned 4 [0074.089] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.089] lstrlenW (lpString=".zip") returned 4 [0074.089] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".rar") returned 4 [0074.090] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".bz2") returned 4 [0074.090] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.090] lstrlenW (lpString=".7z") returned 3 [0074.090] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString=".dbf") returned 4 [0074.090] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString=".1cd") returned 4 [0074.090] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString=".jpg") returned 4 [0074.090] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString=".doc") returned 4 [0074.090] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".docx") returned 5 [0074.090] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0074.090] lstrlenW (lpString=".pdf") returned 4 [0074.090] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".xls") returned 4 [0074.090] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".xlsx") returned 5 [0074.090] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0074.090] lstrlenW (lpString=".ppt") returned 4 [0074.090] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.090] lstrlenW (lpString=".zip") returned 4 [0074.090] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.090] lstrlenW (lpString=".rar") returned 4 [0074.091] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.091] lstrlenW (lpString=".bz2") returned 4 [0074.091] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.091] lstrlenW (lpString=".7z") returned 3 [0074.091] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.091] lstrlenW (lpString=".dbf") returned 4 [0074.091] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.091] lstrlenW (lpString=".1cd") returned 4 [0074.091] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0074.091] lstrlenW (lpString=".jpg") returned 4 [0074.091] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.091] lstrlenW (lpString="oledb32r.dll") returned 12 [0074.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.091] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=81920) returned 1 [0074.091] CloseHandle (hObject=0x1c0) returned 1 [0074.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0074.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.092] lstrlenW (lpString=".doc") returned 4 [0074.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString=".docx") returned 5 [0074.092] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.092] lstrlenW (lpString=".pdf") returned 4 [0074.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString=".xls") returned 4 [0074.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString=".xlsx") returned 5 [0074.092] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.092] lstrlenW (lpString=".ppt") returned 4 [0074.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.092] lstrlenW (lpString=".zip") returned 4 [0074.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString=".rar") returned 4 [0074.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.092] lstrlenW (lpString=".bz2") returned 4 [0074.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.092] lstrlenW (lpString=".7z") returned 3 [0074.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.092] lstrlenW (lpString=".dbf") returned 4 [0074.092] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.092] lstrlenW (lpString=".1cd") returned 4 [0074.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString=".jpg") returned 4 [0074.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString=".doc") returned 4 [0074.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString=".docx") returned 5 [0074.093] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.093] lstrlenW (lpString=".pdf") returned 4 [0074.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString=".xls") returned 4 [0074.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString=".xlsx") returned 5 [0074.093] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.093] lstrlenW (lpString=".ppt") returned 4 [0074.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString=".zip") returned 4 [0074.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString=".rar") returned 4 [0074.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.093] lstrlenW (lpString=".bz2") returned 4 [0074.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.093] lstrlenW (lpString=".7z") returned 3 [0074.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString=".dbf") returned 4 [0074.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.093] lstrlenW (lpString=".1cd") returned 4 [0074.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0074.094] lstrlenW (lpString=".jpg") returned 4 [0074.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.094] lstrlenW (lpString="sqloledb.dll") returned 12 [0074.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.094] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1212416) returned 1 [0074.094] CloseHandle (hObject=0x1c0) returned 1 [0074.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0074.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.094] lstrlenW (lpString=".doc") returned 4 [0074.095] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString=".docx") returned 5 [0074.095] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0074.095] lstrlenW (lpString=".pdf") returned 4 [0074.095] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString=".xls") returned 4 [0074.095] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString=".xlsx") returned 5 [0074.095] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0074.095] lstrlenW (lpString=".ppt") returned 4 [0074.095] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.095] lstrlenW (lpString=".zip") returned 4 [0074.095] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString=".rar") returned 4 [0074.095] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.095] lstrlenW (lpString=".bz2") returned 4 [0074.095] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.095] lstrlenW (lpString=".7z") returned 3 [0074.095] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.095] lstrlenW (lpString=".dbf") returned 4 [0074.095] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.095] lstrlenW (lpString=".1cd") returned 4 [0074.095] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.095] lstrlenW (lpString=".jpg") returned 4 [0074.096] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString=".doc") returned 4 [0074.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString=".docx") returned 5 [0074.096] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0074.096] lstrlenW (lpString=".pdf") returned 4 [0074.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString=".xls") returned 4 [0074.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString=".xlsx") returned 5 [0074.096] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0074.096] lstrlenW (lpString=".ppt") returned 4 [0074.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString=".zip") returned 4 [0074.096] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString=".rar") returned 4 [0074.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.096] lstrlenW (lpString=".bz2") returned 4 [0074.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.096] lstrlenW (lpString=".7z") returned 3 [0074.096] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString=".dbf") returned 4 [0074.096] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString=".1cd") returned 4 [0074.096] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0074.096] lstrlenW (lpString=".jpg") returned 4 [0074.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.097] lstrlenW (lpString="sqloledb.rll") returned 12 [0074.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.097] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16384) returned 1 [0074.097] CloseHandle (hObject=0x1c0) returned 1 [0074.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0074.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.097] lstrlenW (lpString=".doc") returned 4 [0074.097] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0074.097] lstrlenW (lpString=".docx") returned 5 [0074.097] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0074.098] lstrlenW (lpString=".pdf") returned 4 [0074.098] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString=".xls") returned 4 [0074.098] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0074.098] lstrlenW (lpString=".xlsx") returned 5 [0074.098] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0074.098] lstrlenW (lpString=".ppt") returned 4 [0074.098] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString=".zip") returned 4 [0074.098] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0074.098] lstrlenW (lpString=".rar") returned 4 [0074.098] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString=".bz2") returned 4 [0074.098] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString=".7z") returned 3 [0074.098] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString=".dbf") returned 4 [0074.098] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString=".1cd") returned 4 [0074.098] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString=".jpg") returned 4 [0074.098] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.098] lstrlenW (lpString=".doc") returned 4 [0074.098] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0074.098] lstrlenW (lpString=".docx") returned 5 [0074.098] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0074.099] lstrlenW (lpString=".pdf") returned 4 [0074.099] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0074.099] lstrlenW (lpString=".xls") returned 4 [0074.099] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0074.099] lstrlenW (lpString=".xlsx") returned 5 [0074.099] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0074.099] lstrlenW (lpString=".ppt") returned 4 [0074.099] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0074.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.099] lstrlenW (lpString=".zip") returned 4 [0074.099] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0074.099] lstrlenW (lpString=".rar") returned 4 [0074.099] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0074.099] lstrlenW (lpString=".bz2") returned 4 [0074.099] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0074.099] lstrlenW (lpString=".7z") returned 3 [0074.099] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0074.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.099] lstrlenW (lpString=".dbf") returned 4 [0074.099] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0074.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0074.099] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") [0074.099] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=364544) returned 1 [0074.099] CloseHandle (hObject=0x1c0) returned 1 [0074.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0074.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.100] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") [0074.100] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8192) returned 1 [0074.100] CloseHandle (hObject=0x1c0) returned 1 [0074.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0074.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.101] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") [0074.101] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=282136) returned 1 [0074.101] CloseHandle (hObject=0x1c0) returned 1 [0074.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 0x20 [0074.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.101] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0074.101] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0074.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.102] GetLastError () returned 0x0 [0074.102] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x44e18, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x44e20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x44e20, lpOverlapped=0x0) returned 1 [0074.220] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0074.220] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.220] SetEndOfFile (hFile=0x180) returned 1 [0074.220] CloseHandle (hObject=0x180) returned 1 [0074.220] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0074.220] SetEndOfFile (hFile=0x1c0) returned 1 [0074.223] CloseHandle (hObject=0x1c0) returned 1 [0074.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 1 [0074.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.224] lstrlenW (lpString=".doc") returned 4 [0074.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString=".docx") returned 5 [0074.224] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0074.224] lstrlenW (lpString=".pdf") returned 4 [0074.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString=".xls") returned 4 [0074.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString=".xlsx") returned 5 [0074.224] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0074.224] lstrlenW (lpString=".ppt") returned 4 [0074.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.224] lstrlenW (lpString=".zip") returned 4 [0074.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString=".rar") returned 4 [0074.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.224] lstrlenW (lpString=".bz2") returned 4 [0074.224] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.224] lstrlenW (lpString=".7z") returned 3 [0074.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.224] lstrlenW (lpString=".dbf") returned 4 [0074.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.224] lstrlenW (lpString=".1cd") returned 4 [0074.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 53 [0074.225] lstrlenW (lpString=".jpg") returned 4 [0074.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.225] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") [0074.733] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=28672) returned 1 [0074.733] CloseHandle (hObject=0x1fc) returned 1 [0074.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui")) returned 0x20 [0074.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.733] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString=".doc") returned 4 [0074.734] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.734] lstrlenW (lpString=".docx") returned 5 [0074.734] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.734] lstrlenW (lpString=".pdf") returned 4 [0074.734] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.734] lstrlenW (lpString=".xls") returned 4 [0074.734] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.734] lstrlenW (lpString=".xlsx") returned 5 [0074.734] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.734] lstrlenW (lpString=".ppt") returned 4 [0074.734] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString=".zip") returned 4 [0074.734] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.734] lstrlenW (lpString=".rar") returned 4 [0074.734] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.734] lstrlenW (lpString=".bz2") returned 4 [0074.734] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.734] lstrlenW (lpString=".7z") returned 3 [0074.734] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString=".dbf") returned 4 [0074.734] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString=".1cd") returned 4 [0074.734] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString=".jpg") returned 4 [0074.734] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.734] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.735] lstrlenW (lpString=".doc") returned 4 [0074.735] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.735] lstrlenW (lpString=".docx") returned 5 [0074.735] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.735] lstrlenW (lpString=".pdf") returned 4 [0074.735] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.735] lstrlenW (lpString=".xls") returned 4 [0074.735] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.735] lstrlenW (lpString=".xlsx") returned 5 [0074.735] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.735] lstrlenW (lpString=".ppt") returned 4 [0074.735] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.735] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.735] lstrlenW (lpString=".zip") returned 4 [0074.735] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.735] lstrlenW (lpString=".rar") returned 4 [0074.735] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.735] lstrlenW (lpString=".bz2") returned 4 [0074.735] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.735] lstrlenW (lpString=".7z") returned 3 [0074.735] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.735] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.735] lstrlenW (lpString=".dbf") returned 4 [0074.735] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.735] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.735] lstrlenW (lpString=".1cd") returned 4 [0074.735] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.735] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 57 [0074.735] lstrlenW (lpString=".jpg") returned 4 [0074.735] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.735] lstrlenW (lpString="msolui100.rll") returned 13 [0074.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.139] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=14872) returned 1 [0075.139] CloseHandle (hObject=0x154) returned 1 [0075.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0075.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.140] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.140] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.151] GetLastError () returned 0x0 [0075.151] ReadFile (in: hFile=0x154, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3a18, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0075.204] ReadFile (in: hFile=0x154, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xee, lpOverlapped=0x0) returned 1 [0075.204] SetEndOfFile (hFile=0x1ec) returned 1 [0075.204] CloseHandle (hObject=0x1ec) returned 1 [0075.205] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.205] SetEndOfFile (hFile=0x154) returned 1 [0075.205] CloseHandle (hObject=0x154) returned 1 [0075.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0075.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.206] lstrlenW (lpString=".doc") returned 4 [0075.206] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0075.206] lstrlenW (lpString=".docx") returned 5 [0075.206] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0075.206] lstrlenW (lpString=".pdf") returned 4 [0075.206] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0075.206] lstrlenW (lpString=".xls") returned 4 [0075.206] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0075.206] lstrlenW (lpString=".xlsx") returned 5 [0075.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0075.206] lstrlenW (lpString=".ppt") returned 4 [0075.206] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0075.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.206] lstrlenW (lpString=".zip") returned 4 [0075.206] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0075.206] lstrlenW (lpString=".rar") returned 4 [0075.206] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0075.206] lstrlenW (lpString=".bz2") returned 4 [0075.206] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0075.206] lstrlenW (lpString=".7z") returned 3 [0075.206] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString=".dbf") returned 4 [0075.207] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString=".1cd") returned 4 [0075.207] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString=".jpg") returned 4 [0075.207] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString=".doc") returned 4 [0075.207] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString=".docx") returned 5 [0075.207] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0075.207] lstrlenW (lpString=".pdf") returned 4 [0075.207] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString=".xls") returned 4 [0075.207] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0075.207] lstrlenW (lpString=".xlsx") returned 5 [0075.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0075.207] lstrlenW (lpString=".ppt") returned 4 [0075.207] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.207] lstrlenW (lpString=".zip") returned 4 [0075.207] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0075.207] lstrlenW (lpString=".rar") returned 4 [0075.207] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString=".bz2") returned 4 [0075.207] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0075.207] lstrlenW (lpString=".7z") returned 3 [0075.207] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0075.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.208] lstrlenW (lpString=".dbf") returned 4 [0075.208] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0075.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.208] lstrlenW (lpString=".1cd") returned 4 [0075.208] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0075.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0075.208] lstrlenW (lpString=".jpg") returned 4 [0075.208] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0075.208] lstrlenW (lpString="CARBN_01.MID") returned 12 [0075.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.335] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9322) returned 1 [0075.335] CloseHandle (hObject=0x190) returned 1 [0075.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0075.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.336] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.336] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0075.710] GetLastError () returned 0x0 [0075.710] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x246a, lpOverlapped=0x0) returned 1 [0075.714] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2470, lpOverlapped=0x0) returned 1 [0075.716] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.716] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.716] SetEndOfFile (hFile=0x160) returned 1 [0075.716] CloseHandle (hObject=0x160) returned 1 [0075.716] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.716] SetEndOfFile (hFile=0x158) returned 1 [0075.717] CloseHandle (hObject=0x158) returned 1 [0075.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0075.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.717] lstrlenW (lpString=".doc") returned 4 [0075.717] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.718] lstrlenW (lpString=".docx") returned 5 [0075.718] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.718] lstrlenW (lpString=".pdf") returned 4 [0075.718] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.718] lstrlenW (lpString=".xls") returned 4 [0075.718] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.718] lstrlenW (lpString=".xlsx") returned 5 [0075.718] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.718] lstrlenW (lpString=".ppt") returned 4 [0075.718] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.718] lstrlenW (lpString=".zip") returned 4 [0075.718] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.718] lstrlenW (lpString=".rar") returned 4 [0075.718] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.718] lstrlenW (lpString=".bz2") returned 4 [0075.718] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.718] lstrlenW (lpString=".7z") returned 3 [0075.718] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.718] lstrlenW (lpString=".dbf") returned 4 [0075.718] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.718] lstrlenW (lpString=".1cd") returned 4 [0075.718] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0075.718] lstrlenW (lpString=".jpg") returned 4 [0075.718] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.718] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") [0075.719] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9318) returned 1 [0075.719] CloseHandle (hObject=0x158) returned 1 [0075.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0075.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.719] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.719] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0075.720] GetLastError () returned 0x0 [0075.720] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2466, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2470, lpOverlapped=0x0) returned 1 [0075.732] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x160, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.733] SetEndOfFile (hFile=0x160) returned 1 [0075.734] CloseHandle (hObject=0x160) returned 1 [0075.734] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.734] SetEndOfFile (hFile=0x158) returned 1 [0075.735] CloseHandle (hObject=0x158) returned 1 [0075.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString=".doc") returned 4 [0075.741] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.741] lstrlenW (lpString=".docx") returned 5 [0075.741] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0075.741] lstrlenW (lpString=".pdf") returned 4 [0075.741] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.741] lstrlenW (lpString=".xls") returned 4 [0075.741] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.741] lstrlenW (lpString=".xlsx") returned 5 [0075.741] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0075.741] lstrlenW (lpString=".ppt") returned 4 [0075.741] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString=".zip") returned 4 [0075.741] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.741] lstrlenW (lpString=".rar") returned 4 [0075.741] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.741] lstrlenW (lpString=".bz2") returned 4 [0075.741] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.741] lstrlenW (lpString=".7z") returned 3 [0075.741] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString=".dbf") returned 4 [0075.741] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString=".1cd") returned 4 [0075.741] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0075.741] lstrlenW (lpString=".jpg") returned 4 [0075.741] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.742] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") [0075.749] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6331) returned 1 [0075.749] CloseHandle (hObject=0x190) returned 1 [0075.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0075.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.749] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.750] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.774] GetLastError () returned 0x0 [0075.774] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x18bb, lpOverlapped=0x0) returned 1 [0075.781] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0075.782] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.782] SetEndOfFile (hFile=0x1f0) returned 1 [0075.782] CloseHandle (hObject=0x1f0) returned 1 [0075.782] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.782] SetEndOfFile (hFile=0x190) returned 1 [0075.783] CloseHandle (hObject=0x190) returned 1 [0075.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0075.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.783] lstrlenW (lpString=".doc") returned 4 [0075.783] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.783] lstrlenW (lpString=".docx") returned 5 [0075.783] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.784] lstrlenW (lpString=".pdf") returned 4 [0075.784] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.784] lstrlenW (lpString=".xls") returned 4 [0075.784] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.784] lstrlenW (lpString=".xlsx") returned 5 [0075.784] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.784] lstrlenW (lpString=".ppt") returned 4 [0075.784] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.784] lstrlenW (lpString=".zip") returned 4 [0075.784] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.784] lstrlenW (lpString=".rar") returned 4 [0075.784] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.784] lstrlenW (lpString=".bz2") returned 4 [0075.784] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.784] lstrlenW (lpString=".7z") returned 3 [0075.784] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.784] lstrlenW (lpString=".dbf") returned 4 [0075.784] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.784] lstrlenW (lpString=".1cd") returned 4 [0075.784] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0075.784] lstrlenW (lpString=".jpg") returned 4 [0075.784] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.784] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") [0075.785] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8568) returned 1 [0075.785] CloseHandle (hObject=0x190) returned 1 [0075.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0075.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.785] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.785] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.785] GetLastError () returned 0x0 [0075.785] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2178, lpOverlapped=0x0) returned 1 [0075.793] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2180, lpOverlapped=0x0) returned 1 [0075.794] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.795] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.795] SetEndOfFile (hFile=0x1f0) returned 1 [0075.795] CloseHandle (hObject=0x1f0) returned 1 [0075.795] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.795] SetEndOfFile (hFile=0x190) returned 1 [0075.796] CloseHandle (hObject=0x190) returned 1 [0075.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0075.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.796] lstrlenW (lpString=".doc") returned 4 [0075.796] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.796] lstrlenW (lpString=".docx") returned 5 [0075.796] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.796] lstrlenW (lpString=".pdf") returned 4 [0075.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.797] lstrlenW (lpString=".xls") returned 4 [0075.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.797] lstrlenW (lpString=".xlsx") returned 5 [0075.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.797] lstrlenW (lpString=".ppt") returned 4 [0075.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.797] lstrlenW (lpString=".zip") returned 4 [0075.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.797] lstrlenW (lpString=".rar") returned 4 [0075.797] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.797] lstrlenW (lpString=".bz2") returned 4 [0075.797] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.797] lstrlenW (lpString=".7z") returned 3 [0075.797] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.797] lstrlenW (lpString=".dbf") returned 4 [0075.797] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.797] lstrlenW (lpString=".1cd") returned 4 [0075.797] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0075.797] lstrlenW (lpString=".jpg") returned 4 [0075.797] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.797] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") [0075.798] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5843) returned 1 [0075.798] CloseHandle (hObject=0x190) returned 1 [0075.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0075.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.798] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.798] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.798] GetLastError () returned 0x0 [0075.798] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x16d3, lpOverlapped=0x0) returned 1 [0075.804] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0075.805] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.805] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.805] SetEndOfFile (hFile=0x1f0) returned 1 [0075.805] CloseHandle (hObject=0x1f0) returned 1 [0075.805] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.805] SetEndOfFile (hFile=0x190) returned 1 [0075.806] CloseHandle (hObject=0x190) returned 1 [0075.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0075.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.807] lstrlenW (lpString=".doc") returned 4 [0075.808] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.808] lstrlenW (lpString=".docx") returned 5 [0075.808] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.808] lstrlenW (lpString=".pdf") returned 4 [0075.808] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.808] lstrlenW (lpString=".xls") returned 4 [0075.808] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.808] lstrlenW (lpString=".xlsx") returned 5 [0075.808] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.808] lstrlenW (lpString=".ppt") returned 4 [0075.808] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.808] lstrlenW (lpString=".zip") returned 4 [0075.808] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.808] lstrlenW (lpString=".rar") returned 4 [0075.808] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.808] lstrlenW (lpString=".bz2") returned 4 [0075.808] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.808] lstrlenW (lpString=".7z") returned 3 [0075.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.808] lstrlenW (lpString=".dbf") returned 4 [0075.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.808] lstrlenW (lpString=".1cd") returned 4 [0075.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0075.808] lstrlenW (lpString=".jpg") returned 4 [0075.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.809] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") [0075.809] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5968) returned 1 [0075.810] CloseHandle (hObject=0x190) returned 1 [0075.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0075.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.810] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.810] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.810] GetLastError () returned 0x0 [0075.810] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1750, lpOverlapped=0x0) returned 1 [0075.812] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1760, lpOverlapped=0x0) returned 1 [0075.813] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.813] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.813] SetEndOfFile (hFile=0x1f0) returned 1 [0075.814] CloseHandle (hObject=0x1f0) returned 1 [0075.814] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.814] SetEndOfFile (hFile=0x190) returned 1 [0075.814] CloseHandle (hObject=0x190) returned 1 [0075.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0075.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.815] lstrlenW (lpString=".doc") returned 4 [0075.815] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.815] lstrlenW (lpString=".docx") returned 5 [0075.815] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.815] lstrlenW (lpString=".pdf") returned 4 [0075.815] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.815] lstrlenW (lpString=".xls") returned 4 [0075.815] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.815] lstrlenW (lpString=".xlsx") returned 5 [0075.815] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.815] lstrlenW (lpString=".ppt") returned 4 [0075.815] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.815] lstrlenW (lpString=".zip") returned 4 [0075.815] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.815] lstrlenW (lpString=".rar") returned 4 [0075.815] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.815] lstrlenW (lpString=".bz2") returned 4 [0075.815] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.815] lstrlenW (lpString=".7z") returned 3 [0075.815] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.816] lstrlenW (lpString=".dbf") returned 4 [0075.816] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.816] lstrlenW (lpString=".1cd") returned 4 [0075.816] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0075.816] lstrlenW (lpString=".jpg") returned 4 [0075.816] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.816] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") [0075.816] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5440) returned 1 [0075.816] CloseHandle (hObject=0x190) returned 1 [0075.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0075.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.817] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.817] GetLastError () returned 0x0 [0075.817] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1540, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1550, lpOverlapped=0x0) returned 1 [0075.833] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.833] SetEndOfFile (hFile=0x1f0) returned 1 [0075.833] CloseHandle (hObject=0x1f0) returned 1 [0075.833] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.833] SetEndOfFile (hFile=0x190) returned 1 [0075.834] CloseHandle (hObject=0x190) returned 1 [0075.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0075.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.834] lstrlenW (lpString=".doc") returned 4 [0075.834] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.834] lstrlenW (lpString=".docx") returned 5 [0075.834] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.834] lstrlenW (lpString=".pdf") returned 4 [0075.835] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.835] lstrlenW (lpString=".xls") returned 4 [0075.835] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.835] lstrlenW (lpString=".xlsx") returned 5 [0075.835] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.835] lstrlenW (lpString=".ppt") returned 4 [0075.835] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.835] lstrlenW (lpString=".zip") returned 4 [0075.835] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.835] lstrlenW (lpString=".rar") returned 4 [0075.835] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.835] lstrlenW (lpString=".bz2") returned 4 [0075.835] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.835] lstrlenW (lpString=".7z") returned 3 [0075.835] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.835] lstrlenW (lpString=".dbf") returned 4 [0075.835] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.835] lstrlenW (lpString=".1cd") returned 4 [0075.835] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0075.835] lstrlenW (lpString=".jpg") returned 4 [0075.835] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.835] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") [0075.836] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6491) returned 1 [0075.836] CloseHandle (hObject=0x190) returned 1 [0075.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0075.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.836] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.836] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.836] GetLastError () returned 0x0 [0075.836] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x195b, lpOverlapped=0x0) returned 1 [0075.846] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1960, lpOverlapped=0x0) returned 1 [0075.847] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.847] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.847] SetEndOfFile (hFile=0x1f0) returned 1 [0075.848] CloseHandle (hObject=0x1f0) returned 1 [0075.848] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.848] SetEndOfFile (hFile=0x190) returned 1 [0075.848] CloseHandle (hObject=0x190) returned 1 [0075.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.849] lstrlenW (lpString=".doc") returned 4 [0075.849] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.849] lstrlenW (lpString=".docx") returned 5 [0075.849] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.849] lstrlenW (lpString=".pdf") returned 4 [0075.849] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.849] lstrlenW (lpString=".xls") returned 4 [0075.849] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.849] lstrlenW (lpString=".xlsx") returned 5 [0075.849] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.849] lstrlenW (lpString=".ppt") returned 4 [0075.849] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.849] lstrlenW (lpString=".zip") returned 4 [0075.849] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.849] lstrlenW (lpString=".rar") returned 4 [0075.849] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.849] lstrlenW (lpString=".bz2") returned 4 [0075.850] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.850] lstrlenW (lpString=".7z") returned 3 [0075.850] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.850] lstrlenW (lpString=".dbf") returned 4 [0075.850] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.850] lstrlenW (lpString=".1cd") returned 4 [0075.850] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0075.850] lstrlenW (lpString=".jpg") returned 4 [0075.850] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.850] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") [0075.850] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8538) returned 1 [0075.850] CloseHandle (hObject=0x190) returned 1 [0075.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0075.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.851] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.851] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.851] GetLastError () returned 0x0 [0075.851] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x215a, lpOverlapped=0x0) returned 1 [0075.874] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2160, lpOverlapped=0x0) returned 1 [0075.875] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0075.875] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.875] SetEndOfFile (hFile=0x1f0) returned 1 [0075.875] CloseHandle (hObject=0x1f0) returned 1 [0075.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0075.875] SetEndOfFile (hFile=0x190) returned 1 [0075.876] CloseHandle (hObject=0x190) returned 1 [0075.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0075.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.924] lstrlenW (lpString=".doc") returned 4 [0075.924] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.924] lstrlenW (lpString=".docx") returned 5 [0075.924] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0075.924] lstrlenW (lpString=".pdf") returned 4 [0075.924] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.924] lstrlenW (lpString=".xls") returned 4 [0075.924] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.924] lstrlenW (lpString=".xlsx") returned 5 [0075.924] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0075.924] lstrlenW (lpString=".ppt") returned 4 [0075.924] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.924] lstrlenW (lpString=".zip") returned 4 [0075.924] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.924] lstrlenW (lpString=".rar") returned 4 [0075.924] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.925] lstrlenW (lpString=".bz2") returned 4 [0075.925] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.925] lstrlenW (lpString=".7z") returned 3 [0075.925] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.925] lstrlenW (lpString=".dbf") returned 4 [0075.925] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.925] lstrlenW (lpString=".1cd") returned 4 [0075.925] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0075.925] lstrlenW (lpString=".jpg") returned 4 [0075.925] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.925] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") [0076.081] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7768) returned 1 [0076.081] CloseHandle (hObject=0x1f4) returned 1 [0076.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0076.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.191] GetLastError () returned 0x0 [0076.191] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1e58, lpOverlapped=0x0) returned 1 [0076.239] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0076.240] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.240] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.240] SetEndOfFile (hFile=0x154) returned 1 [0076.240] CloseHandle (hObject=0x154) returned 1 [0076.240] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.240] SetEndOfFile (hFile=0x1f4) returned 1 [0076.241] CloseHandle (hObject=0x1f4) returned 1 [0076.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.241] lstrlenW (lpString=".doc") returned 4 [0076.241] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.241] lstrlenW (lpString=".docx") returned 5 [0076.241] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0076.241] lstrlenW (lpString=".pdf") returned 4 [0076.241] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.241] lstrlenW (lpString=".xls") returned 4 [0076.241] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.241] lstrlenW (lpString=".xlsx") returned 5 [0076.241] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0076.241] lstrlenW (lpString=".ppt") returned 4 [0076.241] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.242] lstrlenW (lpString=".zip") returned 4 [0076.242] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.242] lstrlenW (lpString=".rar") returned 4 [0076.242] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.242] lstrlenW (lpString=".bz2") returned 4 [0076.242] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.242] lstrlenW (lpString=".7z") returned 3 [0076.242] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.242] lstrlenW (lpString=".dbf") returned 4 [0076.242] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.242] lstrlenW (lpString=".1cd") returned 4 [0076.242] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0076.242] lstrlenW (lpString=".jpg") returned 4 [0076.242] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.242] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") [0076.275] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=49025) returned 1 [0076.275] CloseHandle (hObject=0x1f4) returned 1 [0076.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0076.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.275] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.276] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.276] GetLastError () returned 0x0 [0076.276] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbf81, lpOverlapped=0x0) returned 1 [0076.597] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0076.599] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.599] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf2, lpOverlapped=0x0) returned 1 [0076.599] SetEndOfFile (hFile=0x154) returned 1 [0076.599] CloseHandle (hObject=0x154) returned 1 [0076.599] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.599] SetEndOfFile (hFile=0x1f4) returned 1 [0076.600] CloseHandle (hObject=0x1f4) returned 1 [0076.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.601] lstrlenW (lpString=".doc") returned 4 [0076.601] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".docx") returned 5 [0076.601] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.601] lstrlenW (lpString=".pdf") returned 4 [0076.601] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".xls") returned 4 [0076.601] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".xlsx") returned 5 [0076.601] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.601] lstrlenW (lpString=".ppt") returned 4 [0076.601] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.601] lstrlenW (lpString=".zip") returned 4 [0076.601] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".rar") returned 4 [0076.601] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".bz2") returned 4 [0076.601] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.601] lstrlenW (lpString=".7z") returned 3 [0076.601] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.602] lstrlenW (lpString=".dbf") returned 4 [0076.602] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.602] lstrlenW (lpString=".1cd") returned 4 [0076.602] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0076.602] lstrlenW (lpString=".jpg") returned 4 [0076.602] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.602] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") [0076.608] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=22554) returned 1 [0076.608] CloseHandle (hObject=0x1f4) returned 1 [0076.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0076.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.608] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.609] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.609] GetLastError () returned 0x0 [0076.609] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x581a, lpOverlapped=0x0) returned 1 [0076.624] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5820, lpOverlapped=0x0) returned 1 [0076.625] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.625] WriteFile (in: hFile=0x154, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.625] SetEndOfFile (hFile=0x154) returned 1 [0076.626] CloseHandle (hObject=0x154) returned 1 [0076.626] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.626] SetEndOfFile (hFile=0x1f4) returned 1 [0076.627] CloseHandle (hObject=0x1f4) returned 1 [0076.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0076.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.627] lstrlenW (lpString=".doc") returned 4 [0076.627] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.627] lstrlenW (lpString=".docx") returned 5 [0076.627] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.627] lstrlenW (lpString=".pdf") returned 4 [0076.627] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.627] lstrlenW (lpString=".xls") returned 4 [0076.627] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.627] lstrlenW (lpString=".xlsx") returned 5 [0076.627] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.627] lstrlenW (lpString=".ppt") returned 4 [0076.627] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.627] lstrlenW (lpString=".zip") returned 4 [0076.627] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.627] lstrlenW (lpString=".rar") returned 4 [0076.627] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.628] lstrlenW (lpString=".bz2") returned 4 [0076.628] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.628] lstrlenW (lpString=".7z") returned 3 [0076.628] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.628] lstrlenW (lpString=".dbf") returned 4 [0076.628] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.628] lstrlenW (lpString=".1cd") returned 4 [0076.628] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0076.628] lstrlenW (lpString=".jpg") returned 4 [0076.628] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.628] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") [0076.632] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=26989) returned 1 [0076.632] CloseHandle (hObject=0x190) returned 1 [0076.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0076.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.632] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.632] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.633] GetLastError () returned 0x0 [0076.633] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x696d, lpOverlapped=0x0) returned 1 [0076.636] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6970, lpOverlapped=0x0) returned 1 [0076.637] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.637] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.637] SetEndOfFile (hFile=0x1f0) returned 1 [0076.638] CloseHandle (hObject=0x1f0) returned 1 [0076.638] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.638] SetEndOfFile (hFile=0x190) returned 1 [0076.776] CloseHandle (hObject=0x190) returned 1 [0076.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0076.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.784] lstrlenW (lpString=".doc") returned 4 [0076.784] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString=".docx") returned 5 [0076.784] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.784] lstrlenW (lpString=".pdf") returned 4 [0076.784] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString=".xls") returned 4 [0076.784] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString=".xlsx") returned 5 [0076.784] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.784] lstrlenW (lpString=".ppt") returned 4 [0076.784] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.784] lstrlenW (lpString=".zip") returned 4 [0076.784] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString=".rar") returned 4 [0076.784] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.785] lstrlenW (lpString=".bz2") returned 4 [0076.785] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.785] lstrlenW (lpString=".7z") returned 3 [0076.785] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.785] lstrlenW (lpString=".dbf") returned 4 [0076.785] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.785] lstrlenW (lpString=".1cd") returned 4 [0076.785] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0076.785] lstrlenW (lpString=".jpg") returned 4 [0076.785] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.785] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") [0076.805] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=42917) returned 1 [0076.805] CloseHandle (hObject=0x210) returned 1 [0076.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0076.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.805] GetLastError () returned 0x0 [0076.805] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0076.814] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0076.816] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.816] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0076.816] SetEndOfFile (hFile=0x1c0) returned 1 [0076.816] CloseHandle (hObject=0x1c0) returned 1 [0076.816] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.816] SetEndOfFile (hFile=0x210) returned 1 [0076.817] CloseHandle (hObject=0x210) returned 1 [0076.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0076.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.818] lstrlenW (lpString=".doc") returned 4 [0076.818] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".docx") returned 5 [0076.818] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.818] lstrlenW (lpString=".pdf") returned 4 [0076.818] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".xls") returned 4 [0076.818] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".xlsx") returned 5 [0076.818] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.818] lstrlenW (lpString=".ppt") returned 4 [0076.818] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.818] lstrlenW (lpString=".zip") returned 4 [0076.818] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".rar") returned 4 [0076.818] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".bz2") returned 4 [0076.818] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString=".7z") returned 3 [0076.818] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.818] lstrlenW (lpString=".dbf") returned 4 [0076.818] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.818] lstrlenW (lpString=".1cd") returned 4 [0076.818] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0076.819] lstrlenW (lpString=".jpg") returned 4 [0076.819] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.819] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") [0076.819] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=22417) returned 1 [0076.819] CloseHandle (hObject=0x210) returned 1 [0076.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0076.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.820] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.820] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.820] GetLastError () returned 0x0 [0076.820] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5791, lpOverlapped=0x0) returned 1 [0076.823] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0076.824] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0076.824] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.824] SetEndOfFile (hFile=0x1c0) returned 1 [0076.824] CloseHandle (hObject=0x1c0) returned 1 [0076.824] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.824] SetEndOfFile (hFile=0x210) returned 1 [0076.825] CloseHandle (hObject=0x210) returned 1 [0076.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.826] lstrlenW (lpString=".doc") returned 4 [0076.826] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".docx") returned 5 [0076.826] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.826] lstrlenW (lpString=".pdf") returned 4 [0076.826] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".xls") returned 4 [0076.826] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".xlsx") returned 5 [0076.826] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.826] lstrlenW (lpString=".ppt") returned 4 [0076.826] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.826] lstrlenW (lpString=".zip") returned 4 [0076.826] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".rar") returned 4 [0076.826] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".bz2") returned 4 [0076.826] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString=".7z") returned 3 [0076.826] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.826] lstrlenW (lpString=".dbf") returned 4 [0076.826] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.826] lstrlenW (lpString=".1cd") returned 4 [0076.826] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0076.827] lstrlenW (lpString=".jpg") returned 4 [0076.827] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.827] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") [0076.827] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1967905) returned 1 [0076.827] CloseHandle (hObject=0x210) returned 1 [0076.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0076.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0076.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.828] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0076.828] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0076.828] ReadFile (in: hFile=0x210, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.851] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0076.851] ReadFile (in: hFile=0x210, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.871] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0076.871] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a0721, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0076.871] ReadFile (in: hFile=0x210, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.915] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0076.915] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0076.957] SetEndOfFile (hFile=0x210) returned 1 [0076.957] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0076.957] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.959] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa0260, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0076.959] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.961] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a0721, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0076.961] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.963] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0076.963] CloseHandle (hObject=0x210) returned 1 [0076.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString=".doc") returned 4 [0076.964] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".docx") returned 5 [0076.964] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.964] lstrlenW (lpString=".pdf") returned 4 [0076.964] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".xls") returned 4 [0076.964] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".xlsx") returned 5 [0076.964] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.964] lstrlenW (lpString=".ppt") returned 4 [0076.964] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString=".zip") returned 4 [0076.964] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".rar") returned 4 [0076.964] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".bz2") returned 4 [0076.964] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString=".7z") returned 3 [0076.964] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString=".dbf") returned 4 [0076.964] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString=".1cd") returned 4 [0076.964] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0076.964] lstrlenW (lpString=".jpg") returned 4 [0076.965] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.965] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") [0076.970] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=21156) returned 1 [0076.970] CloseHandle (hObject=0x190) returned 1 [0077.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0077.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0077.235] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.235] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.235] GetLastError () returned 0x0 [0077.235] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x52a4, lpOverlapped=0x0) returned 1 [0077.247] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0077.248] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0077.248] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0077.248] SetEndOfFile (hFile=0x210) returned 1 [0077.248] CloseHandle (hObject=0x210) returned 1 [0077.427] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.430] SetEndOfFile (hFile=0x22c) returned 1 [0077.431] CloseHandle (hObject=0x22c) returned 1 [0077.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0077.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.432] lstrlenW (lpString=".doc") returned 4 [0077.432] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.432] lstrlenW (lpString=".docx") returned 5 [0077.432] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.433] lstrlenW (lpString=".pdf") returned 4 [0077.433] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString=".xls") returned 4 [0077.433] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString=".xlsx") returned 5 [0077.433] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.433] lstrlenW (lpString=".ppt") returned 4 [0077.433] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.433] lstrlenW (lpString=".zip") returned 4 [0077.433] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString=".rar") returned 4 [0077.433] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString=".bz2") returned 4 [0077.433] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString=".7z") returned 3 [0077.433] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.433] lstrlenW (lpString=".dbf") returned 4 [0077.433] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.433] lstrlenW (lpString=".1cd") returned 4 [0077.433] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0077.433] lstrlenW (lpString=".jpg") returned 4 [0077.433] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.433] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") [0077.587] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=24117) returned 1 [0077.587] CloseHandle (hObject=0x1fc) returned 1 [0077.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0077.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.593] GetLastError () returned 0x0 [0077.593] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5e35, lpOverlapped=0x0) returned 1 [0077.607] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0077.608] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0077.608] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0077.608] SetEndOfFile (hFile=0x1c0) returned 1 [0077.608] CloseHandle (hObject=0x1c0) returned 1 [0077.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.609] SetEndOfFile (hFile=0x1fc) returned 1 [0077.609] CloseHandle (hObject=0x1fc) returned 1 [0077.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.612] lstrlenW (lpString=".doc") returned 4 [0077.612] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.612] lstrlenW (lpString=".docx") returned 5 [0077.612] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.612] lstrlenW (lpString=".pdf") returned 4 [0077.612] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.612] lstrlenW (lpString=".xls") returned 4 [0077.612] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.612] lstrlenW (lpString=".xlsx") returned 5 [0077.612] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.612] lstrlenW (lpString=".ppt") returned 4 [0077.612] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.612] lstrlenW (lpString=".zip") returned 4 [0077.612] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.612] lstrlenW (lpString=".rar") returned 4 [0077.612] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.613] lstrlenW (lpString=".bz2") returned 4 [0077.613] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.613] lstrlenW (lpString=".7z") returned 3 [0077.613] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.613] lstrlenW (lpString=".dbf") returned 4 [0077.613] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.613] lstrlenW (lpString=".1cd") returned 4 [0077.613] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0077.613] lstrlenW (lpString=".jpg") returned 4 [0077.613] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.613] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") [0077.614] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=582401) returned 1 [0077.614] CloseHandle (hObject=0x1fc) returned 1 [0077.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0077.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.614] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.614] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.615] GetLastError () returned 0x0 [0077.615] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x8e301, lpOverlapped=0x0) returned 1 [0077.842] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0077.851] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0077.851] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0077.852] SetEndOfFile (hFile=0x1c0) returned 1 [0077.852] CloseHandle (hObject=0x1c0) returned 1 [0077.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0077.852] SetEndOfFile (hFile=0x1fc) returned 1 [0078.127] CloseHandle (hObject=0x1fc) returned 1 [0078.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0078.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.317] lstrlenW (lpString=".doc") returned 4 [0078.317] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0078.317] lstrlenW (lpString=".docx") returned 5 [0078.317] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0078.317] lstrlenW (lpString=".pdf") returned 4 [0078.317] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0078.424] lstrlenW (lpString=".xls") returned 4 [0078.430] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0078.430] lstrlenW (lpString=".xlsx") returned 5 [0078.430] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0078.430] lstrlenW (lpString=".ppt") returned 4 [0078.430] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.431] lstrlenW (lpString=".zip") returned 4 [0078.431] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString=".rar") returned 4 [0078.431] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString=".bz2") returned 4 [0078.431] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString=".7z") returned 3 [0078.431] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0078.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.431] lstrlenW (lpString=".dbf") returned 4 [0078.431] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.431] lstrlenW (lpString=".1cd") returned 4 [0078.431] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0078.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0078.431] lstrlenW (lpString=".jpg") returned 4 [0078.431] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0078.431] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") [0078.588] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=27781) returned 1 [0078.589] CloseHandle (hObject=0x15c) returned 1 [0078.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0078.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.601] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0078.602] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0078.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.602] GetLastError () returned 0x0 [0078.602] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6c85, lpOverlapped=0x0) returned 1 [0078.737] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0078.751] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0078.751] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xee, lpOverlapped=0x0) returned 1 [0078.751] SetEndOfFile (hFile=0x180) returned 1 [0078.752] CloseHandle (hObject=0x180) returned 1 [0078.752] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0078.752] SetEndOfFile (hFile=0x15c) returned 1 [0078.753] CloseHandle (hObject=0x15c) returned 1 [0078.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0078.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.753] lstrlenW (lpString=".doc") returned 4 [0078.753] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0078.753] lstrlenW (lpString=".docx") returned 5 [0078.753] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0078.753] lstrlenW (lpString=".pdf") returned 4 [0078.753] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0078.753] lstrlenW (lpString=".xls") returned 4 [0078.753] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0078.753] lstrlenW (lpString=".xlsx") returned 5 [0078.753] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0078.753] lstrlenW (lpString=".ppt") returned 4 [0078.753] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.754] lstrlenW (lpString=".zip") returned 4 [0078.754] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString=".rar") returned 4 [0078.754] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString=".bz2") returned 4 [0078.754] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString=".7z") returned 3 [0078.754] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.754] lstrlenW (lpString=".dbf") returned 4 [0078.754] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.754] lstrlenW (lpString=".1cd") returned 4 [0078.754] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0078.754] lstrlenW (lpString=".jpg") returned 4 [0078.754] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0078.754] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") [0079.167] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=23692) returned 1 [0079.167] CloseHandle (hObject=0x1c8) returned 1 [0079.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0079.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.167] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.167] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.168] GetLastError () returned 0x0 [0079.168] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0079.186] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0079.187] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.187] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.187] SetEndOfFile (hFile=0x22c) returned 1 [0079.187] CloseHandle (hObject=0x22c) returned 1 [0079.187] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.187] SetEndOfFile (hFile=0x1c8) returned 1 [0079.188] CloseHandle (hObject=0x1c8) returned 1 [0079.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0079.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.227] lstrlenW (lpString=".doc") returned 4 [0079.227] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".docx") returned 5 [0079.227] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.227] lstrlenW (lpString=".pdf") returned 4 [0079.227] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".xls") returned 4 [0079.227] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".xlsx") returned 5 [0079.227] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.227] lstrlenW (lpString=".ppt") returned 4 [0079.227] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.227] lstrlenW (lpString=".zip") returned 4 [0079.227] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".rar") returned 4 [0079.227] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".bz2") returned 4 [0079.227] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString=".7z") returned 3 [0079.227] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.227] lstrlenW (lpString=".dbf") returned 4 [0079.227] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.227] lstrlenW (lpString=".1cd") returned 4 [0079.228] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0079.228] lstrlenW (lpString=".jpg") returned 4 [0079.228] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.228] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") [0079.231] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=112504) returned 1 [0079.231] CloseHandle (hObject=0x150) returned 1 [0079.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0079.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.231] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.231] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.233] GetLastError () returned 0x0 [0079.233] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1b778, lpOverlapped=0x0) returned 1 [0079.293] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0079.295] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.295] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xee, lpOverlapped=0x0) returned 1 [0079.295] SetEndOfFile (hFile=0x1c0) returned 1 [0079.295] CloseHandle (hObject=0x1c0) returned 1 [0079.295] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.296] SetEndOfFile (hFile=0x150) returned 1 [0079.297] CloseHandle (hObject=0x150) returned 1 [0079.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0079.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.297] lstrlenW (lpString=".doc") returned 4 [0079.298] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".docx") returned 5 [0079.298] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.298] lstrlenW (lpString=".pdf") returned 4 [0079.298] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".xls") returned 4 [0079.298] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".xlsx") returned 5 [0079.298] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.298] lstrlenW (lpString=".ppt") returned 4 [0079.298] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.298] lstrlenW (lpString=".zip") returned 4 [0079.298] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".rar") returned 4 [0079.298] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".bz2") returned 4 [0079.298] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString=".7z") returned 3 [0079.298] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.298] lstrlenW (lpString=".dbf") returned 4 [0079.298] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.298] lstrlenW (lpString=".1cd") returned 4 [0079.298] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0079.298] lstrlenW (lpString=".jpg") returned 4 [0079.298] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.298] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") [0079.299] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=312376) returned 1 [0079.299] CloseHandle (hObject=0x150) returned 1 [0079.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0079.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.299] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.299] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.300] GetLastError () returned 0x0 [0079.300] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4c438, lpOverlapped=0x0) returned 1 [0079.357] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0079.364] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.364] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.364] SetEndOfFile (hFile=0x1c0) returned 1 [0079.364] CloseHandle (hObject=0x1c0) returned 1 [0079.364] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.364] SetEndOfFile (hFile=0x150) returned 1 [0079.367] CloseHandle (hObject=0x150) returned 1 [0079.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0079.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.368] lstrlenW (lpString=".doc") returned 4 [0079.368] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0079.368] lstrlenW (lpString=".docx") returned 5 [0079.368] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0079.474] lstrlenW (lpString=".pdf") returned 4 [0079.474] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0079.474] lstrlenW (lpString=".xls") returned 4 [0079.474] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0079.474] lstrlenW (lpString=".xlsx") returned 5 [0079.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0079.474] lstrlenW (lpString=".ppt") returned 4 [0079.475] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0079.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.475] lstrlenW (lpString=".zip") returned 4 [0079.475] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0079.475] lstrlenW (lpString=".rar") returned 4 [0079.475] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0079.475] lstrlenW (lpString=".bz2") returned 4 [0079.475] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0079.475] lstrlenW (lpString=".7z") returned 3 [0079.475] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0079.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.475] lstrlenW (lpString=".dbf") returned 4 [0079.475] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0079.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.475] lstrlenW (lpString=".1cd") returned 4 [0079.475] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0079.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0079.475] lstrlenW (lpString=".jpg") returned 4 [0079.475] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0079.475] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") [0079.476] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=21424) returned 1 [0079.476] CloseHandle (hObject=0x1c8) returned 1 [0079.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0079.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.477] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.477] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.478] GetLastError () returned 0x0 [0079.478] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x53b0, lpOverlapped=0x0) returned 1 [0079.480] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x53c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x53c0, lpOverlapped=0x0) returned 1 [0079.481] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.481] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.481] SetEndOfFile (hFile=0x22c) returned 1 [0079.481] CloseHandle (hObject=0x22c) returned 1 [0079.482] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.482] SetEndOfFile (hFile=0x1c8) returned 1 [0079.482] CloseHandle (hObject=0x1c8) returned 1 [0079.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 1 [0079.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.483] lstrlenW (lpString=".doc") returned 4 [0079.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.483] lstrlenW (lpString=".docx") returned 5 [0079.483] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0079.483] lstrlenW (lpString=".pdf") returned 4 [0079.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.483] lstrlenW (lpString=".xls") returned 4 [0079.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.483] lstrlenW (lpString=".xlsx") returned 5 [0079.483] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0079.483] lstrlenW (lpString=".ppt") returned 4 [0079.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.483] lstrlenW (lpString=".zip") returned 4 [0079.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.483] lstrlenW (lpString=".rar") returned 4 [0079.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.484] lstrlenW (lpString=".bz2") returned 4 [0079.484] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.484] lstrlenW (lpString=".7z") returned 3 [0079.484] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.484] lstrlenW (lpString=".dbf") returned 4 [0079.484] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.484] lstrlenW (lpString=".1cd") returned 4 [0079.484] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0079.484] lstrlenW (lpString=".jpg") returned 4 [0079.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.484] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") [0079.485] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=495616) returned 1 [0079.485] CloseHandle (hObject=0x1c8) returned 1 [0079.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0079.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.485] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.485] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.486] GetLastError () returned 0x0 [0079.486] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x79000, lpOverlapped=0x0) returned 1 [0079.496] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x79010, lpOverlapped=0x0) returned 1 [0079.504] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.504] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.504] SetEndOfFile (hFile=0x22c) returned 1 [0079.505] CloseHandle (hObject=0x22c) returned 1 [0079.505] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.505] SetEndOfFile (hFile=0x1c8) returned 1 [0079.556] CloseHandle (hObject=0x1c8) returned 1 [0079.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0079.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.557] lstrlenW (lpString=".doc") returned 4 [0079.557] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".docx") returned 5 [0079.557] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0079.557] lstrlenW (lpString=".pdf") returned 4 [0079.557] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".xls") returned 4 [0079.557] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".xlsx") returned 5 [0079.557] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0079.557] lstrlenW (lpString=".ppt") returned 4 [0079.557] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.557] lstrlenW (lpString=".zip") returned 4 [0079.557] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".rar") returned 4 [0079.557] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".bz2") returned 4 [0079.557] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0079.557] lstrlenW (lpString=".7z") returned 3 [0079.557] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0079.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.557] lstrlenW (lpString=".dbf") returned 4 [0079.638] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0079.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.638] lstrlenW (lpString=".1cd") returned 4 [0079.638] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0079.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0079.638] lstrlenW (lpString=".jpg") returned 4 [0079.645] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0079.645] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") [0079.914] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=13240) returned 1 [0079.914] CloseHandle (hObject=0x150) returned 1 [0079.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0079.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.914] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.914] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.930] GetLastError () returned 0x0 [0079.930] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x33b8, lpOverlapped=0x0) returned 1 [0079.932] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x33c0, lpOverlapped=0x0) returned 1 [0079.933] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.933] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.933] SetEndOfFile (hFile=0x1c0) returned 1 [0079.933] CloseHandle (hObject=0x1c0) returned 1 [0079.933] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.933] SetEndOfFile (hFile=0x150) returned 1 [0079.934] CloseHandle (hObject=0x150) returned 1 [0079.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 1 [0079.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.934] lstrlenW (lpString=".doc") returned 4 [0079.934] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString=".docx") returned 5 [0079.935] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0079.935] lstrlenW (lpString=".pdf") returned 4 [0079.935] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString=".xls") returned 4 [0079.935] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString=".xlsx") returned 5 [0079.935] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0079.935] lstrlenW (lpString=".ppt") returned 4 [0079.935] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.935] lstrlenW (lpString=".zip") returned 4 [0079.935] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString=".rar") returned 4 [0079.935] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.935] lstrlenW (lpString=".bz2") returned 4 [0079.935] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.935] lstrlenW (lpString=".7z") returned 3 [0079.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.935] lstrlenW (lpString=".dbf") returned 4 [0079.935] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.935] lstrlenW (lpString=".1cd") returned 4 [0079.935] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0079.935] lstrlenW (lpString=".jpg") returned 4 [0079.935] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.935] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") [0079.936] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=53144) returned 1 [0079.936] CloseHandle (hObject=0x150) returned 1 [0079.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0079.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.937] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.937] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.937] GetLastError () returned 0x0 [0079.937] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xcf98, lpOverlapped=0x0) returned 1 [0079.940] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0079.942] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.942] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0079.942] SetEndOfFile (hFile=0x1c0) returned 1 [0079.942] CloseHandle (hObject=0x1c0) returned 1 [0079.942] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.942] SetEndOfFile (hFile=0x150) returned 1 [0079.943] CloseHandle (hObject=0x150) returned 1 [0079.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0079.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.944] lstrlenW (lpString=".doc") returned 4 [0079.944] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString=".docx") returned 5 [0079.944] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0079.944] lstrlenW (lpString=".pdf") returned 4 [0079.944] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString=".xls") returned 4 [0079.944] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0079.944] lstrlenW (lpString=".xlsx") returned 5 [0079.944] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0079.944] lstrlenW (lpString=".ppt") returned 4 [0079.944] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.944] lstrlenW (lpString=".zip") returned 4 [0079.944] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0079.944] lstrlenW (lpString=".rar") returned 4 [0079.944] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString=".bz2") returned 4 [0079.944] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString=".7z") returned 3 [0079.944] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0079.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.944] lstrlenW (lpString=".dbf") returned 4 [0079.944] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.944] lstrlenW (lpString=".1cd") returned 4 [0079.944] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0079.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0079.944] lstrlenW (lpString=".jpg") returned 4 [0079.944] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0079.945] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") [0079.946] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=164216) returned 1 [0079.946] CloseHandle (hObject=0x150) returned 1 [0079.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0079.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.946] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.946] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.947] GetLastError () returned 0x0 [0079.947] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x28178, lpOverlapped=0x0) returned 1 [0079.951] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x28180, lpOverlapped=0x0) returned 1 [0079.954] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.954] SetEndOfFile (hFile=0x1c0) returned 1 [0079.955] CloseHandle (hObject=0x1c0) returned 1 [0079.955] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.955] SetEndOfFile (hFile=0x150) returned 1 [0079.956] CloseHandle (hObject=0x150) returned 1 [0079.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1 [0079.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.957] lstrlenW (lpString=".doc") returned 4 [0079.957] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0079.957] lstrlenW (lpString=".docx") returned 5 [0079.957] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0079.957] lstrlenW (lpString=".pdf") returned 4 [0079.957] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0079.957] lstrlenW (lpString=".xls") returned 4 [0079.957] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0079.957] lstrlenW (lpString=".xlsx") returned 5 [0079.957] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0079.957] lstrlenW (lpString=".ppt") returned 4 [0079.957] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0079.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.957] lstrlenW (lpString=".zip") returned 4 [0079.957] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0079.957] lstrlenW (lpString=".rar") returned 4 [0079.957] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0079.957] lstrlenW (lpString=".bz2") returned 4 [0079.957] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0079.957] lstrlenW (lpString=".7z") returned 3 [0079.958] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0079.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.958] lstrlenW (lpString=".dbf") returned 4 [0079.958] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0079.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.958] lstrlenW (lpString=".1cd") returned 4 [0079.958] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0079.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0079.958] lstrlenW (lpString=".jpg") returned 4 [0079.958] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0079.958] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") [0079.959] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=104836) returned 1 [0079.959] CloseHandle (hObject=0x150) returned 1 [0079.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0079.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.959] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.959] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.960] GetLastError () returned 0x0 [0079.960] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x19984, lpOverlapped=0x0) returned 1 [0079.963] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x19990, lpOverlapped=0x0) returned 1 [0079.966] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.966] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0079.966] SetEndOfFile (hFile=0x1c0) returned 1 [0079.966] CloseHandle (hObject=0x1c0) returned 1 [0079.966] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.966] SetEndOfFile (hFile=0x150) returned 1 [0079.967] CloseHandle (hObject=0x150) returned 1 [0079.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1 [0079.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.968] lstrlenW (lpString=".doc") returned 4 [0079.968] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0079.968] lstrlenW (lpString=".docx") returned 5 [0079.968] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0079.968] lstrlenW (lpString=".pdf") returned 4 [0079.968] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0079.968] lstrlenW (lpString=".xls") returned 4 [0079.968] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0079.968] lstrlenW (lpString=".xlsx") returned 5 [0079.968] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0079.968] lstrlenW (lpString=".ppt") returned 4 [0079.968] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0079.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.968] lstrlenW (lpString=".zip") returned 4 [0079.968] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0079.968] lstrlenW (lpString=".rar") returned 4 [0079.968] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0079.968] lstrlenW (lpString=".bz2") returned 4 [0079.968] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0079.968] lstrlenW (lpString=".7z") returned 3 [0079.968] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0079.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.968] lstrlenW (lpString=".dbf") returned 4 [0079.969] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0079.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.969] lstrlenW (lpString=".1cd") returned 4 [0079.969] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0079.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0079.969] lstrlenW (lpString=".jpg") returned 4 [0079.969] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0079.969] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") [0079.970] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=362441) returned 1 [0079.970] CloseHandle (hObject=0x150) returned 1 [0079.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0079.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.970] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.970] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0079.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.971] GetLastError () returned 0x0 [0079.971] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x587c9, lpOverlapped=0x0) returned 1 [0079.991] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x587d0, lpOverlapped=0x0) returned 1 [0079.998] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0079.998] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0079.998] SetEndOfFile (hFile=0x1c0) returned 1 [0080.044] CloseHandle (hObject=0x1c0) returned 1 [0080.044] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0080.044] SetEndOfFile (hFile=0x150) returned 1 [0080.048] CloseHandle (hObject=0x150) returned 1 [0080.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1 [0080.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.100] lstrlenW (lpString=".doc") returned 4 [0080.100] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0080.100] lstrlenW (lpString=".docx") returned 5 [0080.100] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0080.100] lstrlenW (lpString=".pdf") returned 4 [0080.100] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0080.100] lstrlenW (lpString=".xls") returned 4 [0080.100] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0080.100] lstrlenW (lpString=".xlsx") returned 5 [0080.100] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0080.100] lstrlenW (lpString=".ppt") returned 4 [0080.100] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0080.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.100] lstrlenW (lpString=".zip") returned 4 [0080.100] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0080.100] lstrlenW (lpString=".rar") returned 4 [0080.100] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0080.100] lstrlenW (lpString=".bz2") returned 4 [0080.100] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0080.100] lstrlenW (lpString=".7z") returned 3 [0080.100] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0080.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.100] lstrlenW (lpString=".dbf") returned 4 [0080.100] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0080.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.101] lstrlenW (lpString=".1cd") returned 4 [0080.101] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0080.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0080.101] lstrlenW (lpString=".jpg") returned 4 [0080.101] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0080.101] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") [0080.905] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=51600) returned 1 [0080.921] CloseHandle (hObject=0x15c) returned 1 [0080.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20 [0080.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.922] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0080.930] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0080.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.937] GetLastError () returned 0x0 [0080.937] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc990, lpOverlapped=0x0) returned 1 [0080.939] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc9a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc9a0, lpOverlapped=0x0) returned 1 [0080.941] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0080.941] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.941] SetEndOfFile (hFile=0x150) returned 1 [0080.941] CloseHandle (hObject=0x150) returned 1 [0080.941] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0080.941] SetEndOfFile (hFile=0x15c) returned 1 [0080.942] CloseHandle (hObject=0x15c) returned 1 [0080.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 1 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString=".doc") returned 4 [0080.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString=".docx") returned 5 [0080.943] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0080.943] lstrlenW (lpString=".pdf") returned 4 [0080.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString=".xls") returned 4 [0080.943] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString=".xlsx") returned 5 [0080.943] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0080.943] lstrlenW (lpString=".ppt") returned 4 [0080.943] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString=".zip") returned 4 [0080.943] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString=".rar") returned 4 [0080.943] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0080.943] lstrlenW (lpString=".bz2") returned 4 [0080.943] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0080.943] lstrlenW (lpString=".7z") returned 3 [0080.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString=".dbf") returned 4 [0080.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString=".1cd") returned 4 [0080.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0080.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0080.943] lstrlenW (lpString=".jpg") returned 4 [0080.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0080.944] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") [0080.945] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7024126) returned 1 [0080.945] CloseHandle (hObject=0x15c) returned 1 [0080.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0080.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0080.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.946] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0080.946] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0080.946] ReadFile (in: hFile=0x15c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.950] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x23b9ff, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0080.950] ReadFile (in: hFile=0x15c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.960] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0080.960] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x672dfe, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0080.960] ReadFile (in: hFile=0x15c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.024] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0081.024] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0081.080] SetEndOfFile (hFile=0x15c) returned 1 [0081.986] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0081.986] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0081.986] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x23b9ff, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0081.987] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.992] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x672dfe, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0081.992] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.994] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0081.994] CloseHandle (hObject=0x15c) returned 1 [0081.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.994] lstrlenW (lpString=".doc") returned 4 [0081.994] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0081.994] lstrlenW (lpString=".docx") returned 5 [0081.995] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0081.995] lstrlenW (lpString=".pdf") returned 4 [0081.995] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0081.995] lstrlenW (lpString=".xls") returned 4 [0081.995] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0081.995] lstrlenW (lpString=".xlsx") returned 5 [0081.995] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0081.995] lstrlenW (lpString=".ppt") returned 4 [0081.995] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0081.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.995] lstrlenW (lpString=".zip") returned 4 [0081.995] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0081.995] lstrlenW (lpString=".rar") returned 4 [0081.995] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0081.995] lstrlenW (lpString=".bz2") returned 4 [0081.995] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0081.995] lstrlenW (lpString=".7z") returned 3 [0081.995] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0081.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.995] lstrlenW (lpString=".dbf") returned 4 [0081.995] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0081.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.995] lstrlenW (lpString=".1cd") returned 4 [0081.995] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0081.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0081.995] lstrlenW (lpString=".jpg") returned 4 [0081.995] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0081.995] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") [0082.222] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2028) returned 1 [0082.222] CloseHandle (hObject=0x190) returned 1 [0082.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0082.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.223] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.223] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.224] GetLastError () returned 0x0 [0082.224] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x7ec, lpOverlapped=0x0) returned 1 [0082.225] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0082.226] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0082.226] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.226] SetEndOfFile (hFile=0x210) returned 1 [0082.227] CloseHandle (hObject=0x210) returned 1 [0082.227] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.227] SetEndOfFile (hFile=0x190) returned 1 [0082.227] CloseHandle (hObject=0x190) returned 1 [0082.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1 [0082.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.228] lstrlenW (lpString=".doc") returned 4 [0082.228] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0082.228] lstrlenW (lpString=".docx") returned 5 [0082.228] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0082.228] lstrlenW (lpString=".pdf") returned 4 [0082.228] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0082.228] lstrlenW (lpString=".xls") returned 4 [0082.228] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0082.228] lstrlenW (lpString=".xlsx") returned 5 [0082.228] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0082.228] lstrlenW (lpString=".ppt") returned 4 [0082.228] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0082.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.228] lstrlenW (lpString=".zip") returned 4 [0082.228] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0082.228] lstrlenW (lpString=".rar") returned 4 [0082.228] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0082.228] lstrlenW (lpString=".bz2") returned 4 [0082.228] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0082.228] lstrlenW (lpString=".7z") returned 3 [0082.229] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0082.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.229] lstrlenW (lpString=".dbf") returned 4 [0082.229] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0082.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.229] lstrlenW (lpString=".1cd") returned 4 [0082.229] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0082.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0082.229] lstrlenW (lpString=".jpg") returned 4 [0082.229] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0082.229] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") [0082.230] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2043) returned 1 [0082.230] CloseHandle (hObject=0x190) returned 1 [0082.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0082.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.230] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.230] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.231] GetLastError () returned 0x0 [0082.231] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x7fb, lpOverlapped=0x0) returned 1 [0082.233] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x800, lpOverlapped=0x0) returned 1 [0082.233] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0082.233] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.234] SetEndOfFile (hFile=0x210) returned 1 [0082.234] CloseHandle (hObject=0x210) returned 1 [0082.234] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.234] SetEndOfFile (hFile=0x190) returned 1 [0082.235] CloseHandle (hObject=0x190) returned 1 [0082.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1 [0082.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.235] lstrlenW (lpString=".doc") returned 4 [0082.235] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0082.235] lstrlenW (lpString=".docx") returned 5 [0082.235] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0082.235] lstrlenW (lpString=".pdf") returned 4 [0082.235] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0082.235] lstrlenW (lpString=".xls") returned 4 [0082.235] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0082.235] lstrlenW (lpString=".xlsx") returned 5 [0082.235] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0082.235] lstrlenW (lpString=".ppt") returned 4 [0082.235] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0082.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.235] lstrlenW (lpString=".zip") returned 4 [0082.235] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0082.235] lstrlenW (lpString=".rar") returned 4 [0082.236] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0082.236] lstrlenW (lpString=".bz2") returned 4 [0082.236] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0082.236] lstrlenW (lpString=".7z") returned 3 [0082.236] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0082.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.236] lstrlenW (lpString=".dbf") returned 4 [0082.236] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0082.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.236] lstrlenW (lpString=".1cd") returned 4 [0082.236] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0082.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0082.236] lstrlenW (lpString=".jpg") returned 4 [0082.236] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0082.236] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") [0082.237] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=320880) returned 1 [0082.237] CloseHandle (hObject=0x190) returned 1 [0082.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0082.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.238] GetLastError () returned 0x0 [0082.238] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4e570, lpOverlapped=0x0) returned 1 [0082.246] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4e580, lpOverlapped=0x0) returned 1 [0082.252] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0082.252] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.252] SetEndOfFile (hFile=0x210) returned 1 [0082.252] CloseHandle (hObject=0x210) returned 1 [0082.252] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0082.252] SetEndOfFile (hFile=0x190) returned 1 [0082.429] CloseHandle (hObject=0x190) returned 1 [0082.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1 [0082.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.818] lstrlenW (lpString=".doc") returned 4 [0082.818] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0082.818] lstrlenW (lpString=".docx") returned 5 [0082.818] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0082.818] lstrlenW (lpString=".pdf") returned 4 [0082.818] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0082.818] lstrlenW (lpString=".xls") returned 4 [0082.818] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0082.818] lstrlenW (lpString=".xlsx") returned 5 [0082.818] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0082.818] lstrlenW (lpString=".ppt") returned 4 [0082.818] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0082.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.818] lstrlenW (lpString=".zip") returned 4 [0082.818] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0082.818] lstrlenW (lpString=".rar") returned 4 [0082.818] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0082.818] lstrlenW (lpString=".bz2") returned 4 [0082.818] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0082.818] lstrlenW (lpString=".7z") returned 3 [0082.818] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0082.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.818] lstrlenW (lpString=".dbf") returned 4 [0082.818] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0082.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.819] lstrlenW (lpString=".1cd") returned 4 [0082.819] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0082.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0082.819] lstrlenW (lpString=".jpg") returned 4 [0082.819] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0082.819] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") [0083.238] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=481168) returned 1 [0083.238] CloseHandle (hObject=0x1fc) returned 1 [0083.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20 [0083.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0083.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0083.239] GetLastError () returned 0x0 [0083.239] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x75790, lpOverlapped=0x0) returned 1 [0083.251] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x757a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x757a0, lpOverlapped=0x0) returned 1 [0083.260] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0083.260] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0083.260] SetEndOfFile (hFile=0x1c0) returned 1 [0083.261] CloseHandle (hObject=0x1c0) returned 1 [0083.261] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.261] SetEndOfFile (hFile=0x1fc) returned 1 [0083.265] CloseHandle (hObject=0x1fc) returned 1 [0083.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 1 [0083.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.265] lstrlenW (lpString=".doc") returned 4 [0083.265] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0083.265] lstrlenW (lpString=".docx") returned 5 [0083.265] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0083.265] lstrlenW (lpString=".pdf") returned 4 [0083.265] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0083.266] lstrlenW (lpString=".xls") returned 4 [0083.266] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0083.266] lstrlenW (lpString=".xlsx") returned 5 [0083.266] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0083.266] lstrlenW (lpString=".ppt") returned 4 [0083.266] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.266] lstrlenW (lpString=".zip") returned 4 [0083.266] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0083.266] lstrlenW (lpString=".rar") returned 4 [0083.266] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0083.266] lstrlenW (lpString=".bz2") returned 4 [0083.266] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0083.266] lstrlenW (lpString=".7z") returned 3 [0083.266] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.266] lstrlenW (lpString=".dbf") returned 4 [0083.266] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.266] lstrlenW (lpString=".1cd") returned 4 [0083.266] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0083.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0083.266] lstrlenW (lpString=".jpg") returned 4 [0083.266] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0083.266] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") [0083.267] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=432098) returned 1 [0083.267] CloseHandle (hObject=0x1fc) returned 1 [0083.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0083.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0083.267] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.268] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0083.269] GetLastError () returned 0x0 [0083.269] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x697e2, lpOverlapped=0x0) returned 1 [0083.529] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x697f0, lpOverlapped=0x0) returned 1 [0083.536] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0083.536] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0083.536] SetEndOfFile (hFile=0x1c0) returned 1 [0083.536] CloseHandle (hObject=0x1c0) returned 1 [0083.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.536] SetEndOfFile (hFile=0x1fc) returned 1 [0083.540] CloseHandle (hObject=0x1fc) returned 1 [0083.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1 [0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.540] lstrlenW (lpString=".doc") returned 4 [0083.540] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0083.540] lstrlenW (lpString=".docx") returned 5 [0083.540] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0083.540] lstrlenW (lpString=".pdf") returned 4 [0083.540] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0083.541] lstrlenW (lpString=".xls") returned 4 [0083.541] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0083.541] lstrlenW (lpString=".xlsx") returned 5 [0083.541] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0083.541] lstrlenW (lpString=".ppt") returned 4 [0083.541] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0083.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.541] lstrlenW (lpString=".zip") returned 4 [0083.541] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0083.541] lstrlenW (lpString=".rar") returned 4 [0083.541] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0083.541] lstrlenW (lpString=".bz2") returned 4 [0083.541] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0083.541] lstrlenW (lpString=".7z") returned 3 [0083.541] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0083.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.541] lstrlenW (lpString=".dbf") returned 4 [0083.541] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0083.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.541] lstrlenW (lpString=".1cd") returned 4 [0083.541] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0083.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0083.541] lstrlenW (lpString=".jpg") returned 4 [0083.541] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0083.541] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") [0083.542] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=883600) returned 1 [0083.542] CloseHandle (hObject=0x1fc) returned 1 [0083.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20 [0083.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0083.542] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.542] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0083.543] GetLastError () returned 0x0 [0083.543] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd7b90, lpOverlapped=0x0) returned 1 [0083.562] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd7ba0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd7ba0, lpOverlapped=0x0) returned 1 [0083.674] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0083.675] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.675] SetEndOfFile (hFile=0x1c0) returned 1 [0083.675] CloseHandle (hObject=0x1c0) returned 1 [0083.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0083.675] SetEndOfFile (hFile=0x1fc) returned 1 [0083.682] CloseHandle (hObject=0x1fc) returned 1 [0083.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 1 [0083.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.868] lstrlenW (lpString=".doc") returned 4 [0083.868] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString=".docx") returned 5 [0083.868] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0083.868] lstrlenW (lpString=".pdf") returned 4 [0083.868] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString=".xls") returned 4 [0083.868] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString=".xlsx") returned 5 [0083.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0083.868] lstrlenW (lpString=".ppt") returned 4 [0083.868] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.868] lstrlenW (lpString=".zip") returned 4 [0083.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString=".rar") returned 4 [0083.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0083.868] lstrlenW (lpString=".bz2") returned 4 [0083.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0083.868] lstrlenW (lpString=".7z") returned 3 [0083.869] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0083.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.869] lstrlenW (lpString=".dbf") returned 4 [0083.869] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0083.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.869] lstrlenW (lpString=".1cd") returned 4 [0083.869] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0083.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0083.869] lstrlenW (lpString=".jpg") returned 4 [0083.869] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0083.869] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") [0084.026] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=591832) returned 1 [0084.026] CloseHandle (hObject=0x1f0) returned 1 [0084.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20 [0084.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.026] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.026] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0084.027] GetLastError () returned 0x0 [0084.027] ReadFile (in: hFile=0x1f0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x907d8, lpOverlapped=0x0) returned 1 [0084.046] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x907e0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x907e0, lpOverlapped=0x0) returned 1 [0084.056] ReadFile (in: hFile=0x1f0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0084.056] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf0, lpOverlapped=0x0) returned 1 [0084.056] SetEndOfFile (hFile=0x180) returned 1 [0084.056] CloseHandle (hObject=0x180) returned 1 [0084.056] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.056] SetEndOfFile (hFile=0x1f0) returned 1 [0084.062] CloseHandle (hObject=0x1f0) returned 1 [0084.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 1 [0084.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.062] lstrlenW (lpString=".doc") returned 4 [0084.062] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0084.062] lstrlenW (lpString=".docx") returned 5 [0084.062] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0084.062] lstrlenW (lpString=".pdf") returned 4 [0084.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0084.062] lstrlenW (lpString=".xls") returned 4 [0084.062] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0084.062] lstrlenW (lpString=".xlsx") returned 5 [0084.062] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0084.062] lstrlenW (lpString=".ppt") returned 4 [0084.062] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0084.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.062] lstrlenW (lpString=".zip") returned 4 [0084.063] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0084.063] lstrlenW (lpString=".rar") returned 4 [0084.063] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0084.063] lstrlenW (lpString=".bz2") returned 4 [0084.063] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0084.063] lstrlenW (lpString=".7z") returned 3 [0084.063] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.063] lstrlenW (lpString=".dbf") returned 4 [0084.063] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0084.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.063] lstrlenW (lpString=".1cd") returned 4 [0084.063] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0084.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0084.063] lstrlenW (lpString=".jpg") returned 4 [0084.063] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0084.063] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") [0084.261] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1052592) returned 1 [0084.261] CloseHandle (hObject=0x180) returned 1 [0084.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20 [0084.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0084.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0084.262] GetLastError () returned 0x0 [0084.262] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0084.283] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0084.343] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xfc0, lpOverlapped=0x0) returned 1 [0084.352] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0084.358] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0084.358] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.358] SetEndOfFile (hFile=0x1c0) returned 1 [0084.665] CloseHandle (hObject=0x1c0) returned 1 [0084.665] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0084.665] SetEndOfFile (hFile=0x180) returned 1 [0084.666] CloseHandle (hObject=0x180) returned 1 [0084.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.666] lstrlenW (lpString=".doc") returned 4 [0084.666] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString=".docx") returned 5 [0084.667] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0084.667] lstrlenW (lpString=".pdf") returned 4 [0084.667] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString=".xls") returned 4 [0084.667] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString=".xlsx") returned 5 [0084.667] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0084.667] lstrlenW (lpString=".ppt") returned 4 [0084.667] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.667] lstrlenW (lpString=".zip") returned 4 [0084.667] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString=".rar") returned 4 [0084.667] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0084.667] lstrlenW (lpString=".bz2") returned 4 [0084.667] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0084.667] lstrlenW (lpString=".7z") returned 3 [0084.667] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.667] lstrlenW (lpString=".dbf") returned 4 [0084.667] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.667] lstrlenW (lpString=".1cd") returned 4 [0084.667] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0084.667] lstrlenW (lpString=".jpg") returned 4 [0084.667] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0084.667] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") [0085.011] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=12664) returned 1 [0085.011] CloseHandle (hObject=0x180) returned 1 [0085.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20 [0085.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.011] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.011] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.012] GetLastError () returned 0x0 [0085.012] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3178, lpOverlapped=0x0) returned 1 [0085.023] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3180, lpOverlapped=0x0) returned 1 [0085.025] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0085.025] SetEndOfFile (hFile=0x15c) returned 1 [0085.025] CloseHandle (hObject=0x15c) returned 1 [0085.025] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.025] SetEndOfFile (hFile=0x180) returned 1 [0085.026] CloseHandle (hObject=0x180) returned 1 [0085.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 1 [0085.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.026] lstrlenW (lpString=".doc") returned 4 [0085.026] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0085.026] lstrlenW (lpString=".docx") returned 5 [0085.026] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0085.027] lstrlenW (lpString=".pdf") returned 4 [0085.027] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0085.027] lstrlenW (lpString=".xls") returned 4 [0085.027] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0085.027] lstrlenW (lpString=".xlsx") returned 5 [0085.027] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0085.027] lstrlenW (lpString=".ppt") returned 4 [0085.027] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0085.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.027] lstrlenW (lpString=".zip") returned 4 [0085.027] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0085.027] lstrlenW (lpString=".rar") returned 4 [0085.027] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0085.027] lstrlenW (lpString=".bz2") returned 4 [0085.027] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0085.027] lstrlenW (lpString=".7z") returned 3 [0085.027] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0085.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.027] lstrlenW (lpString=".dbf") returned 4 [0085.027] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0085.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.027] lstrlenW (lpString=".1cd") returned 4 [0085.027] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0085.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0085.027] lstrlenW (lpString=".jpg") returned 4 [0085.027] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0085.027] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") [0085.028] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=656) returned 1 [0085.028] CloseHandle (hObject=0x180) returned 1 [0085.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20 [0085.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.029] GetLastError () returned 0x0 [0085.029] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x290, lpOverlapped=0x0) returned 1 [0085.156] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0085.157] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.157] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfc, lpOverlapped=0x0) returned 1 [0085.157] SetEndOfFile (hFile=0x15c) returned 1 [0085.158] CloseHandle (hObject=0x15c) returned 1 [0085.158] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.158] SetEndOfFile (hFile=0x180) returned 1 [0085.159] CloseHandle (hObject=0x180) returned 1 [0085.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.159] lstrlenW (lpString=".doc") returned 4 [0085.159] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.159] lstrlenW (lpString=".docx") returned 5 [0085.159] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.159] lstrlenW (lpString=".pdf") returned 4 [0085.159] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.159] lstrlenW (lpString=".xls") returned 4 [0085.159] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.159] lstrlenW (lpString=".xlsx") returned 5 [0085.159] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.159] lstrlenW (lpString=".ppt") returned 4 [0085.159] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.159] lstrlenW (lpString=".zip") returned 4 [0085.159] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.160] lstrlenW (lpString=".rar") returned 4 [0085.160] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.160] lstrlenW (lpString=".bz2") returned 4 [0085.160] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.160] lstrlenW (lpString=".7z") returned 3 [0085.160] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.160] lstrlenW (lpString=".dbf") returned 4 [0085.160] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.160] lstrlenW (lpString=".1cd") returned 4 [0085.160] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0085.160] lstrlenW (lpString=".jpg") returned 4 [0085.160] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.160] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") [0085.161] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=636) returned 1 [0085.161] CloseHandle (hObject=0x180) returned 1 [0085.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20 [0085.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.162] GetLastError () returned 0x0 [0085.162] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x27c, lpOverlapped=0x0) returned 1 [0085.228] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x280, lpOverlapped=0x0) returned 1 [0085.229] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.229] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0085.229] SetEndOfFile (hFile=0x15c) returned 1 [0085.229] CloseHandle (hObject=0x15c) returned 1 [0085.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.229] SetEndOfFile (hFile=0x180) returned 1 [0085.230] CloseHandle (hObject=0x180) returned 1 [0085.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1 [0085.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.230] lstrlenW (lpString=".doc") returned 4 [0085.230] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.230] lstrlenW (lpString=".docx") returned 5 [0085.230] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.230] lstrlenW (lpString=".pdf") returned 4 [0085.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.230] lstrlenW (lpString=".xls") returned 4 [0085.230] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.230] lstrlenW (lpString=".xlsx") returned 5 [0085.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.230] lstrlenW (lpString=".ppt") returned 4 [0085.230] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.231] lstrlenW (lpString=".zip") returned 4 [0085.231] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.231] lstrlenW (lpString=".rar") returned 4 [0085.231] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.231] lstrlenW (lpString=".bz2") returned 4 [0085.231] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.231] lstrlenW (lpString=".7z") returned 3 [0085.231] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.231] lstrlenW (lpString=".dbf") returned 4 [0085.231] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.231] lstrlenW (lpString=".1cd") returned 4 [0085.231] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0085.231] lstrlenW (lpString=".jpg") returned 4 [0085.231] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.231] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") [0085.232] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=37762) returned 1 [0085.232] CloseHandle (hObject=0x180) returned 1 [0085.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20 [0085.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.232] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.232] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.233] GetLastError () returned 0x0 [0085.233] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x9382, lpOverlapped=0x0) returned 1 [0085.247] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x9390, lpOverlapped=0x0) returned 1 [0085.248] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.248] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0085.249] SetEndOfFile (hFile=0x15c) returned 1 [0085.249] CloseHandle (hObject=0x15c) returned 1 [0085.249] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.249] SetEndOfFile (hFile=0x180) returned 1 [0085.250] CloseHandle (hObject=0x180) returned 1 [0085.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1 [0085.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.250] lstrlenW (lpString=".doc") returned 4 [0085.250] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0085.250] lstrlenW (lpString=".docx") returned 5 [0085.250] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0085.250] lstrlenW (lpString=".pdf") returned 4 [0085.250] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0085.250] lstrlenW (lpString=".xls") returned 4 [0085.250] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString=".xlsx") returned 5 [0085.251] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0085.251] lstrlenW (lpString=".ppt") returned 4 [0085.251] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.251] lstrlenW (lpString=".zip") returned 4 [0085.251] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString=".rar") returned 4 [0085.251] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString=".bz2") returned 4 [0085.251] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString=".7z") returned 3 [0085.251] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0085.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.251] lstrlenW (lpString=".dbf") returned 4 [0085.251] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0085.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.251] lstrlenW (lpString=".1cd") returned 4 [0085.251] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0085.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0085.251] lstrlenW (lpString=".jpg") returned 4 [0085.251] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0085.251] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") [0085.252] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=431456) returned 1 [0085.252] CloseHandle (hObject=0x180) returned 1 [0085.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20 [0085.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.253] GetLastError () returned 0x0 [0085.253] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x69560, lpOverlapped=0x0) returned 1 [0085.333] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x69570, lpOverlapped=0x0) returned 1 [0085.342] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.342] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.342] SetEndOfFile (hFile=0x15c) returned 1 [0085.342] CloseHandle (hObject=0x15c) returned 1 [0085.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.342] SetEndOfFile (hFile=0x180) returned 1 [0085.502] CloseHandle (hObject=0x180) returned 1 [0085.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.503] lstrlenW (lpString=".doc") returned 4 [0085.503] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.503] lstrlenW (lpString=".docx") returned 5 [0085.503] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0085.503] lstrlenW (lpString=".pdf") returned 4 [0085.503] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.503] lstrlenW (lpString=".xls") returned 4 [0085.503] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.503] lstrlenW (lpString=".xlsx") returned 5 [0085.503] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0085.503] lstrlenW (lpString=".ppt") returned 4 [0085.503] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.503] lstrlenW (lpString=".zip") returned 4 [0085.503] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.503] lstrlenW (lpString=".rar") returned 4 [0085.503] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.504] lstrlenW (lpString=".bz2") returned 4 [0085.504] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.504] lstrlenW (lpString=".7z") returned 3 [0085.504] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.504] lstrlenW (lpString=".dbf") returned 4 [0085.504] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.504] lstrlenW (lpString=".1cd") returned 4 [0085.504] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0085.504] lstrlenW (lpString=".jpg") returned 4 [0085.504] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.504] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") [0085.803] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=12024) returned 1 [0085.803] CloseHandle (hObject=0x1c8) returned 1 [0085.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20 [0085.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.803] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.813] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.814] GetLastError () returned 0x0 [0085.814] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0085.890] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2f00, lpOverlapped=0x0) returned 1 [0085.892] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.892] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.892] SetEndOfFile (hFile=0x1c0) returned 1 [0085.892] CloseHandle (hObject=0x1c0) returned 1 [0085.892] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.892] SetEndOfFile (hFile=0x1c8) returned 1 [0085.893] CloseHandle (hObject=0x1c8) returned 1 [0085.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1 [0085.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.894] lstrlenW (lpString=".doc") returned 4 [0085.894] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0085.894] lstrlenW (lpString=".docx") returned 5 [0085.894] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0085.894] lstrlenW (lpString=".pdf") returned 4 [0085.894] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0085.894] lstrlenW (lpString=".xls") returned 4 [0085.894] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0085.894] lstrlenW (lpString=".xlsx") returned 5 [0085.894] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0085.894] lstrlenW (lpString=".ppt") returned 4 [0085.894] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0085.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.894] lstrlenW (lpString=".zip") returned 4 [0085.894] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0085.894] lstrlenW (lpString=".rar") returned 4 [0085.894] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0085.894] lstrlenW (lpString=".bz2") returned 4 [0085.894] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0085.894] lstrlenW (lpString=".7z") returned 3 [0085.894] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0085.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.894] lstrlenW (lpString=".dbf") returned 4 [0085.894] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0085.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.895] lstrlenW (lpString=".1cd") returned 4 [0085.895] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0085.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0085.895] lstrlenW (lpString=".jpg") returned 4 [0085.895] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0085.895] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") [0085.896] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=529280) returned 1 [0085.896] CloseHandle (hObject=0x1c8) returned 1 [0085.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20 [0085.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.896] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.896] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.897] GetLastError () returned 0x0 [0085.897] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x81380, lpOverlapped=0x0) returned 1 [0085.910] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x81390, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x81390, lpOverlapped=0x0) returned 1 [0085.918] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0085.918] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0085.918] SetEndOfFile (hFile=0x1c0) returned 1 [0085.918] CloseHandle (hObject=0x1c0) returned 1 [0085.918] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0085.918] SetEndOfFile (hFile=0x1c8) returned 1 [0086.056] CloseHandle (hObject=0x1c8) returned 1 [0086.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 1 [0086.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.075] lstrlenW (lpString=".doc") returned 4 [0086.075] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0086.075] lstrlenW (lpString=".docx") returned 5 [0086.075] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0086.075] lstrlenW (lpString=".pdf") returned 4 [0086.075] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0086.075] lstrlenW (lpString=".xls") returned 4 [0086.076] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0086.076] lstrlenW (lpString=".xlsx") returned 5 [0086.076] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0086.076] lstrlenW (lpString=".ppt") returned 4 [0086.076] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.076] lstrlenW (lpString=".zip") returned 4 [0086.076] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0086.076] lstrlenW (lpString=".rar") returned 4 [0086.076] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0086.076] lstrlenW (lpString=".bz2") returned 4 [0086.076] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0086.076] lstrlenW (lpString=".7z") returned 3 [0086.076] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.076] lstrlenW (lpString=".dbf") returned 4 [0086.076] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.076] lstrlenW (lpString=".1cd") returned 4 [0086.076] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0086.076] lstrlenW (lpString=".jpg") returned 4 [0086.076] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0086.077] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") [0087.223] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=57224) returned 1 [0087.223] CloseHandle (hObject=0x180) returned 1 [0087.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 0x20 [0087.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0087.224] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.224] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.388] GetLastError () returned 0x0 [0087.388] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdf88, lpOverlapped=0x0) returned 1 [0087.390] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdf90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdf90, lpOverlapped=0x0) returned 1 [0087.392] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0087.392] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0087.392] SetEndOfFile (hFile=0x1c0) returned 1 [0087.392] CloseHandle (hObject=0x1c0) returned 1 [0087.393] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.393] SetEndOfFile (hFile=0x180) returned 1 [0087.394] CloseHandle (hObject=0x180) returned 1 [0087.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 1 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.394] lstrlenW (lpString=".doc") returned 4 [0087.394] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0087.394] lstrlenW (lpString=".docx") returned 5 [0087.394] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0087.394] lstrlenW (lpString=".pdf") returned 4 [0087.394] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0087.394] lstrlenW (lpString=".xls") returned 4 [0087.394] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0087.394] lstrlenW (lpString=".xlsx") returned 5 [0087.394] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0087.395] lstrlenW (lpString=".ppt") returned 4 [0087.395] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0087.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.395] lstrlenW (lpString=".zip") returned 4 [0087.395] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0087.395] lstrlenW (lpString=".rar") returned 4 [0087.395] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0087.395] lstrlenW (lpString=".bz2") returned 4 [0087.395] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0087.395] lstrlenW (lpString=".7z") returned 3 [0087.395] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0087.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.395] lstrlenW (lpString=".dbf") returned 4 [0087.395] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0087.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.395] lstrlenW (lpString=".1cd") returned 4 [0087.395] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0087.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0087.395] lstrlenW (lpString=".jpg") returned 4 [0087.395] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0087.395] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") [0087.397] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=57248) returned 1 [0087.397] CloseHandle (hObject=0x180) returned 1 [0087.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20 [0087.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0087.397] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.397] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.398] GetLastError () returned 0x0 [0087.398] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0087.400] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0087.402] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0087.402] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.403] SetEndOfFile (hFile=0x1c0) returned 1 [0087.403] CloseHandle (hObject=0x1c0) returned 1 [0087.403] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.403] SetEndOfFile (hFile=0x180) returned 1 [0087.404] CloseHandle (hObject=0x180) returned 1 [0087.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1 [0087.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.404] lstrlenW (lpString=".doc") returned 4 [0087.404] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0087.404] lstrlenW (lpString=".docx") returned 5 [0087.405] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0087.405] lstrlenW (lpString=".pdf") returned 4 [0087.405] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString=".xls") returned 4 [0087.405] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0087.405] lstrlenW (lpString=".xlsx") returned 5 [0087.405] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0087.405] lstrlenW (lpString=".ppt") returned 4 [0087.405] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.405] lstrlenW (lpString=".zip") returned 4 [0087.405] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0087.405] lstrlenW (lpString=".rar") returned 4 [0087.405] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString=".bz2") returned 4 [0087.405] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString=".7z") returned 3 [0087.405] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0087.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.405] lstrlenW (lpString=".dbf") returned 4 [0087.405] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.405] lstrlenW (lpString=".1cd") returned 4 [0087.405] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0087.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0087.405] lstrlenW (lpString=".jpg") returned 4 [0087.405] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0087.406] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") [0087.406] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1098) returned 1 [0087.407] CloseHandle (hObject=0x180) returned 1 [0087.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20 [0087.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0087.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.408] GetLastError () returned 0x0 [0087.408] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x44a, lpOverlapped=0x0) returned 1 [0087.409] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x450, lpOverlapped=0x0) returned 1 [0087.410] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0087.410] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0087.410] SetEndOfFile (hFile=0x1c0) returned 1 [0087.410] CloseHandle (hObject=0x1c0) returned 1 [0087.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.410] SetEndOfFile (hFile=0x180) returned 1 [0087.411] CloseHandle (hObject=0x180) returned 1 [0087.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString=".doc") returned 4 [0087.412] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString=".docx") returned 5 [0087.412] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0087.412] lstrlenW (lpString=".pdf") returned 4 [0087.412] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString=".xls") returned 4 [0087.412] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0087.412] lstrlenW (lpString=".xlsx") returned 5 [0087.412] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0087.412] lstrlenW (lpString=".ppt") returned 4 [0087.412] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString=".zip") returned 4 [0087.412] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0087.412] lstrlenW (lpString=".rar") returned 4 [0087.412] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString=".bz2") returned 4 [0087.412] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString=".7z") returned 3 [0087.412] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString=".dbf") returned 4 [0087.412] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString=".1cd") returned 4 [0087.412] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0087.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0087.412] lstrlenW (lpString=".jpg") returned 4 [0087.412] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0087.413] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") [0087.413] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=66992) returned 1 [0087.413] CloseHandle (hObject=0x180) returned 1 [0087.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20 [0087.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0087.413] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.414] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.414] GetLastError () returned 0x0 [0087.414] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x105b0, lpOverlapped=0x0) returned 1 [0087.417] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x105c0, lpOverlapped=0x0) returned 1 [0087.420] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0087.420] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0087.420] SetEndOfFile (hFile=0x1c0) returned 1 [0087.420] CloseHandle (hObject=0x1c0) returned 1 [0087.420] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.420] SetEndOfFile (hFile=0x180) returned 1 [0087.421] CloseHandle (hObject=0x180) returned 1 [0087.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1 [0087.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.422] lstrlenW (lpString=".doc") returned 4 [0087.422] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString=".docx") returned 5 [0087.422] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0087.422] lstrlenW (lpString=".pdf") returned 4 [0087.422] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString=".xls") returned 4 [0087.422] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0087.422] lstrlenW (lpString=".xlsx") returned 5 [0087.422] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0087.422] lstrlenW (lpString=".ppt") returned 4 [0087.422] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.422] lstrlenW (lpString=".zip") returned 4 [0087.422] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0087.422] lstrlenW (lpString=".rar") returned 4 [0087.422] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString=".bz2") returned 4 [0087.422] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString=".7z") returned 3 [0087.422] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0087.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.422] lstrlenW (lpString=".dbf") returned 4 [0087.422] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0087.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.422] lstrlenW (lpString=".1cd") returned 4 [0087.422] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0087.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0087.423] lstrlenW (lpString=".jpg") returned 4 [0087.423] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0087.423] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") [0087.423] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=18320) returned 1 [0087.423] CloseHandle (hObject=0x180) returned 1 [0087.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20 [0087.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0087.424] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.424] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0087.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.424] GetLastError () returned 0x0 [0087.424] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4790, lpOverlapped=0x0) returned 1 [0087.460] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x47a0, lpOverlapped=0x0) returned 1 [0087.461] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0087.461] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0087.461] SetEndOfFile (hFile=0x1c0) returned 1 [0088.131] CloseHandle (hObject=0x1c0) returned 1 [0088.209] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.209] SetEndOfFile (hFile=0x180) returned 1 [0088.458] CloseHandle (hObject=0x180) returned 1 [0088.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 1 [0088.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.467] lstrlenW (lpString=".doc") returned 4 [0088.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.467] lstrlenW (lpString=".docx") returned 5 [0088.467] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0088.467] lstrlenW (lpString=".pdf") returned 4 [0088.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.467] lstrlenW (lpString=".xls") returned 4 [0088.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.467] lstrlenW (lpString=".xlsx") returned 5 [0088.467] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0088.467] lstrlenW (lpString=".ppt") returned 4 [0088.479] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.479] lstrlenW (lpString=".zip") returned 4 [0088.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.479] lstrlenW (lpString=".rar") returned 4 [0088.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.479] lstrlenW (lpString=".bz2") returned 4 [0088.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.479] lstrlenW (lpString=".7z") returned 3 [0088.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.479] lstrlenW (lpString=".dbf") returned 4 [0088.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.479] lstrlenW (lpString=".1cd") returned 4 [0088.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0088.494] lstrlenW (lpString=".jpg") returned 4 [0088.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.494] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") [0088.495] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6988760) returned 1 [0088.495] CloseHandle (hObject=0x1c0) returned 1 [0088.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20 [0088.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0088.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.496] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0088.496] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0088.496] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.499] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x238bf2, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0088.499] ReadFile (in: hFile=0x1c0, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.509] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0088.509] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x66a3d8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0088.509] ReadFile (in: hFile=0x1c0, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.525] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.525] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0088.669] SetEndOfFile (hFile=0x1c0) returned 1 [0088.670] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0088.670] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0088.670] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.671] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x238bf2, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0088.671] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.675] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x66a3d8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0088.675] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.677] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0088.677] CloseHandle (hObject=0x1c0) returned 1 [0088.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString=".doc") returned 4 [0088.678] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0088.678] lstrlenW (lpString=".docx") returned 5 [0088.678] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0088.678] lstrlenW (lpString=".pdf") returned 4 [0088.678] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0088.678] lstrlenW (lpString=".xls") returned 4 [0088.678] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0088.678] lstrlenW (lpString=".xlsx") returned 5 [0088.678] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0088.678] lstrlenW (lpString=".ppt") returned 4 [0088.678] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString=".zip") returned 4 [0088.678] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0088.678] lstrlenW (lpString=".rar") returned 4 [0088.678] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0088.678] lstrlenW (lpString=".bz2") returned 4 [0088.678] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0088.678] lstrlenW (lpString=".7z") returned 3 [0088.678] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString=".dbf") returned 4 [0088.678] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString=".1cd") returned 4 [0088.678] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0088.678] lstrlenW (lpString=".jpg") returned 4 [0088.678] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0088.679] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") [0088.679] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=631) returned 1 [0088.679] CloseHandle (hObject=0x1c0) returned 1 [0088.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20 [0088.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.680] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.680] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.681] GetLastError () returned 0x0 [0088.681] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x277, lpOverlapped=0x0) returned 1 [0088.682] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x280, lpOverlapped=0x0) returned 1 [0088.683] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.683] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf2, lpOverlapped=0x0) returned 1 [0088.684] SetEndOfFile (hFile=0x180) returned 1 [0088.684] CloseHandle (hObject=0x180) returned 1 [0088.684] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.684] SetEndOfFile (hFile=0x1c0) returned 1 [0088.685] CloseHandle (hObject=0x1c0) returned 1 [0088.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1 [0088.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.685] lstrlenW (lpString=".doc") returned 4 [0088.685] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0088.685] lstrlenW (lpString=".docx") returned 5 [0088.685] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0088.685] lstrlenW (lpString=".pdf") returned 4 [0088.685] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0088.685] lstrlenW (lpString=".xls") returned 4 [0088.685] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0088.685] lstrlenW (lpString=".xlsx") returned 5 [0088.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0088.685] lstrlenW (lpString=".ppt") returned 4 [0088.685] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0088.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.685] lstrlenW (lpString=".zip") returned 4 [0088.685] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0088.685] lstrlenW (lpString=".rar") returned 4 [0088.685] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0088.685] lstrlenW (lpString=".bz2") returned 4 [0088.686] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0088.686] lstrlenW (lpString=".7z") returned 3 [0088.686] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.686] lstrlenW (lpString=".dbf") returned 4 [0088.686] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.686] lstrlenW (lpString=".1cd") returned 4 [0088.686] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0088.686] lstrlenW (lpString=".jpg") returned 4 [0088.686] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0088.686] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") [0088.687] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=207) returned 1 [0088.687] CloseHandle (hObject=0x1c0) returned 1 [0088.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20 [0088.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.687] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.687] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.688] GetLastError () returned 0x0 [0088.688] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xcf, lpOverlapped=0x0) returned 1 [0088.689] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd0, lpOverlapped=0x0) returned 1 [0088.690] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.690] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf2, lpOverlapped=0x0) returned 1 [0088.690] SetEndOfFile (hFile=0x180) returned 1 [0088.690] CloseHandle (hObject=0x180) returned 1 [0088.690] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.690] SetEndOfFile (hFile=0x1c0) returned 1 [0088.691] CloseHandle (hObject=0x1c0) returned 1 [0088.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1 [0088.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.691] lstrlenW (lpString=".doc") returned 4 [0088.691] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0088.691] lstrlenW (lpString=".docx") returned 5 [0088.691] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0088.691] lstrlenW (lpString=".pdf") returned 4 [0088.691] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0088.691] lstrlenW (lpString=".xls") returned 4 [0088.691] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0088.691] lstrlenW (lpString=".xlsx") returned 5 [0088.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0088.691] lstrlenW (lpString=".ppt") returned 4 [0088.692] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0088.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.692] lstrlenW (lpString=".zip") returned 4 [0088.692] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0088.692] lstrlenW (lpString=".rar") returned 4 [0088.692] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0088.692] lstrlenW (lpString=".bz2") returned 4 [0088.692] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0088.692] lstrlenW (lpString=".7z") returned 3 [0088.692] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0088.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.692] lstrlenW (lpString=".dbf") returned 4 [0088.692] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0088.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.692] lstrlenW (lpString=".1cd") returned 4 [0088.692] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0088.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0088.692] lstrlenW (lpString=".jpg") returned 4 [0088.692] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0088.692] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") [0088.693] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=114) returned 1 [0088.693] CloseHandle (hObject=0x1c0) returned 1 [0088.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20 [0088.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.693] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.693] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.694] GetLastError () returned 0x0 [0088.694] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x72, lpOverlapped=0x0) returned 1 [0088.695] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0088.696] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.696] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf6, lpOverlapped=0x0) returned 1 [0088.696] SetEndOfFile (hFile=0x180) returned 1 [0088.696] CloseHandle (hObject=0x180) returned 1 [0088.696] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.696] SetEndOfFile (hFile=0x1c0) returned 1 [0088.697] CloseHandle (hObject=0x1c0) returned 1 [0088.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1 [0088.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.697] lstrlenW (lpString=".doc") returned 4 [0088.697] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0088.697] lstrlenW (lpString=".docx") returned 5 [0088.697] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0088.697] lstrlenW (lpString=".pdf") returned 4 [0088.697] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0088.697] lstrlenW (lpString=".xls") returned 4 [0088.697] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0088.698] lstrlenW (lpString=".xlsx") returned 5 [0088.698] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0088.698] lstrlenW (lpString=".ppt") returned 4 [0088.698] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0088.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.698] lstrlenW (lpString=".zip") returned 4 [0088.698] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0088.698] lstrlenW (lpString=".rar") returned 4 [0088.698] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0088.698] lstrlenW (lpString=".bz2") returned 4 [0088.698] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0088.698] lstrlenW (lpString=".7z") returned 3 [0088.698] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0088.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.698] lstrlenW (lpString=".dbf") returned 4 [0088.698] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0088.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.698] lstrlenW (lpString=".1cd") returned 4 [0088.698] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0088.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0088.698] lstrlenW (lpString=".jpg") returned 4 [0088.698] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0088.698] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") [0088.701] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=113) returned 1 [0088.701] CloseHandle (hObject=0x1c0) returned 1 [0088.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20 [0088.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.701] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.702] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.702] GetLastError () returned 0x0 [0088.702] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x71, lpOverlapped=0x0) returned 1 [0088.703] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0088.704] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.704] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf6, lpOverlapped=0x0) returned 1 [0088.704] SetEndOfFile (hFile=0x180) returned 1 [0088.704] CloseHandle (hObject=0x180) returned 1 [0088.704] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.704] SetEndOfFile (hFile=0x1c0) returned 1 [0088.705] CloseHandle (hObject=0x1c0) returned 1 [0088.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString=".doc") returned 4 [0088.706] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0088.706] lstrlenW (lpString=".docx") returned 5 [0088.706] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0088.706] lstrlenW (lpString=".pdf") returned 4 [0088.706] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0088.706] lstrlenW (lpString=".xls") returned 4 [0088.706] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0088.706] lstrlenW (lpString=".xlsx") returned 5 [0088.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0088.706] lstrlenW (lpString=".ppt") returned 4 [0088.706] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString=".zip") returned 4 [0088.706] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0088.706] lstrlenW (lpString=".rar") returned 4 [0088.706] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0088.706] lstrlenW (lpString=".bz2") returned 4 [0088.706] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0088.706] lstrlenW (lpString=".7z") returned 3 [0088.706] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString=".dbf") returned 4 [0088.706] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString=".1cd") returned 4 [0088.706] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0088.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0088.706] lstrlenW (lpString=".jpg") returned 4 [0088.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0088.707] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") [0088.707] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=128864) returned 1 [0088.707] CloseHandle (hObject=0x1c0) returned 1 [0088.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20 [0088.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.708] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.708] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.708] GetLastError () returned 0x0 [0088.708] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1f760, lpOverlapped=0x0) returned 1 [0088.713] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1f770, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1f770, lpOverlapped=0x0) returned 1 [0088.715] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.715] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0088.715] SetEndOfFile (hFile=0x180) returned 1 [0088.716] CloseHandle (hObject=0x180) returned 1 [0088.716] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.716] SetEndOfFile (hFile=0x1c0) returned 1 [0088.717] CloseHandle (hObject=0x1c0) returned 1 [0088.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 1 [0088.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString=".doc") returned 4 [0088.718] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString=".docx") returned 5 [0088.718] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0088.718] lstrlenW (lpString=".pdf") returned 4 [0088.718] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString=".xls") returned 4 [0088.718] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString=".xlsx") returned 5 [0088.718] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0088.718] lstrlenW (lpString=".ppt") returned 4 [0088.718] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString=".zip") returned 4 [0088.718] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString=".rar") returned 4 [0088.718] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.718] lstrlenW (lpString=".bz2") returned 4 [0088.718] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.718] lstrlenW (lpString=".7z") returned 3 [0088.718] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString=".dbf") returned 4 [0088.718] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString=".1cd") returned 4 [0088.718] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0088.718] lstrlenW (lpString=".jpg") returned 4 [0088.718] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.718] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") [0088.719] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11136) returned 1 [0088.719] CloseHandle (hObject=0x1c0) returned 1 [0088.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20 [0088.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.720] GetLastError () returned 0x0 [0088.720] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2b80, lpOverlapped=0x0) returned 1 [0088.722] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0088.723] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.723] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0088.723] SetEndOfFile (hFile=0x180) returned 1 [0088.723] CloseHandle (hObject=0x180) returned 1 [0088.723] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.723] SetEndOfFile (hFile=0x1c0) returned 1 [0088.724] CloseHandle (hObject=0x1c0) returned 1 [0088.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString=".doc") returned 4 [0088.725] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".docx") returned 5 [0088.725] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.725] lstrlenW (lpString=".pdf") returned 4 [0088.725] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".xls") returned 4 [0088.725] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".xlsx") returned 5 [0088.725] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.725] lstrlenW (lpString=".ppt") returned 4 [0088.725] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString=".zip") returned 4 [0088.725] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".rar") returned 4 [0088.725] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".bz2") returned 4 [0088.725] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString=".7z") returned 3 [0088.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString=".dbf") returned 4 [0088.725] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString=".1cd") returned 4 [0088.725] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.725] lstrlenW (lpString=".jpg") returned 4 [0088.725] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".docx") returned 5 [0088.726] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.726] lstrlenW (lpString=".pdf") returned 4 [0088.726] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".xls") returned 4 [0088.726] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".xlsx") returned 5 [0088.726] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.726] lstrlenW (lpString=".ppt") returned 4 [0088.726] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.726] lstrlenW (lpString=".zip") returned 4 [0088.726] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".rar") returned 4 [0088.726] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".bz2") returned 4 [0088.726] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString=".7z") returned 3 [0088.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.726] lstrlenW (lpString=".dbf") returned 4 [0088.726] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.726] lstrlenW (lpString=".1cd") returned 4 [0088.726] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0088.726] lstrlenW (lpString=".jpg") returned 4 [0088.726] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.726] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") [0088.728] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=84352) returned 1 [0088.728] CloseHandle (hObject=0x1c0) returned 1 [0088.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 0x20 [0088.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.728] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.728] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.729] GetLastError () returned 0x0 [0088.729] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x14980, lpOverlapped=0x0) returned 1 [0088.733] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x14990, lpOverlapped=0x0) returned 1 [0088.735] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0088.735] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0088.735] SetEndOfFile (hFile=0x180) returned 1 [0088.735] CloseHandle (hObject=0x180) returned 1 [0088.735] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.735] SetEndOfFile (hFile=0x1c0) returned 1 [0088.736] CloseHandle (hObject=0x1c0) returned 1 [0088.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString=".doc") returned 4 [0088.737] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString=".docx") returned 5 [0088.737] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0088.737] lstrlenW (lpString=".pdf") returned 4 [0088.737] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString=".xls") returned 4 [0088.737] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0088.737] lstrlenW (lpString=".xlsx") returned 5 [0088.737] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0088.737] lstrlenW (lpString=".ppt") returned 4 [0088.737] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString=".zip") returned 4 [0088.737] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0088.737] lstrlenW (lpString=".rar") returned 4 [0088.737] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString=".bz2") returned 4 [0088.737] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString=".7z") returned 3 [0088.737] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString=".dbf") returned 4 [0088.737] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString=".1cd") returned 4 [0088.737] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0088.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0088.737] lstrlenW (lpString=".jpg") returned 4 [0088.738] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0088.738] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") [0088.739] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1920) returned 1 [0088.739] CloseHandle (hObject=0x1c0) returned 1 [0088.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20 [0088.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.739] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.739] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0088.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0088.740] GetLastError () returned 0x0 [0088.740] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x780, lpOverlapped=0x0) returned 1 [0088.995] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x790, lpOverlapped=0x0) returned 1 [0089.060] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.060] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.060] SetEndOfFile (hFile=0x180) returned 1 [0089.060] CloseHandle (hObject=0x180) returned 1 [0089.061] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.061] SetEndOfFile (hFile=0x1c0) returned 1 [0089.061] CloseHandle (hObject=0x1c0) returned 1 [0089.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1 [0089.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.145] lstrlenW (lpString=".doc") returned 4 [0089.145] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0089.145] lstrlenW (lpString=".docx") returned 5 [0089.145] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0089.152] lstrlenW (lpString=".pdf") returned 4 [0089.152] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0089.152] lstrlenW (lpString=".xls") returned 4 [0089.153] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0089.153] lstrlenW (lpString=".xlsx") returned 5 [0089.153] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0089.153] lstrlenW (lpString=".ppt") returned 4 [0089.153] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0089.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.153] lstrlenW (lpString=".zip") returned 4 [0089.153] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0089.153] lstrlenW (lpString=".rar") returned 4 [0089.153] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0089.153] lstrlenW (lpString=".bz2") returned 4 [0089.153] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0089.153] lstrlenW (lpString=".7z") returned 3 [0089.153] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0089.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.153] lstrlenW (lpString=".dbf") returned 4 [0089.153] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0089.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.153] lstrlenW (lpString=".1cd") returned 4 [0089.153] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0089.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0089.153] lstrlenW (lpString=".jpg") returned 4 [0089.158] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0089.158] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") [0089.162] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=656) returned 1 [0089.162] CloseHandle (hObject=0x190) returned 1 [0089.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 0x20 [0089.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.163] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.181] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.182] GetLastError () returned 0x0 [0089.182] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x290, lpOverlapped=0x0) returned 1 [0089.235] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0089.237] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.237] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfc, lpOverlapped=0x0) returned 1 [0089.237] SetEndOfFile (hFile=0x16c) returned 1 [0089.237] CloseHandle (hObject=0x16c) returned 1 [0089.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.237] SetEndOfFile (hFile=0x190) returned 1 [0089.238] CloseHandle (hObject=0x190) returned 1 [0089.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1 [0089.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.238] lstrlenW (lpString=".doc") returned 4 [0089.238] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0089.238] lstrlenW (lpString=".docx") returned 5 [0089.238] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0089.239] lstrlenW (lpString=".pdf") returned 4 [0089.239] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0089.239] lstrlenW (lpString=".xls") returned 4 [0089.239] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0089.239] lstrlenW (lpString=".xlsx") returned 5 [0089.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0089.239] lstrlenW (lpString=".ppt") returned 4 [0089.239] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0089.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.239] lstrlenW (lpString=".zip") returned 4 [0089.239] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0089.239] lstrlenW (lpString=".rar") returned 4 [0089.239] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0089.239] lstrlenW (lpString=".bz2") returned 4 [0089.239] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0089.239] lstrlenW (lpString=".7z") returned 3 [0089.239] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0089.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.239] lstrlenW (lpString=".dbf") returned 4 [0089.239] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0089.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.239] lstrlenW (lpString=".1cd") returned 4 [0089.239] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0089.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0089.239] lstrlenW (lpString=".jpg") returned 4 [0089.239] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0089.239] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") [0089.240] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=636) returned 1 [0089.240] CloseHandle (hObject=0x190) returned 1 [0089.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0089.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.240] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.240] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.241] GetLastError () returned 0x0 [0089.241] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x27c, lpOverlapped=0x0) returned 1 [0089.259] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x280, lpOverlapped=0x0) returned 1 [0089.261] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.261] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0089.261] SetEndOfFile (hFile=0x16c) returned 1 [0089.261] CloseHandle (hObject=0x16c) returned 1 [0089.261] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.261] SetEndOfFile (hFile=0x190) returned 1 [0089.262] CloseHandle (hObject=0x190) returned 1 [0089.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString=".doc") returned 4 [0089.263] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0089.263] lstrlenW (lpString=".docx") returned 5 [0089.263] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0089.263] lstrlenW (lpString=".pdf") returned 4 [0089.263] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0089.263] lstrlenW (lpString=".xls") returned 4 [0089.263] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0089.263] lstrlenW (lpString=".xlsx") returned 5 [0089.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0089.263] lstrlenW (lpString=".ppt") returned 4 [0089.263] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString=".zip") returned 4 [0089.263] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0089.263] lstrlenW (lpString=".rar") returned 4 [0089.263] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0089.263] lstrlenW (lpString=".bz2") returned 4 [0089.263] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0089.263] lstrlenW (lpString=".7z") returned 3 [0089.263] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString=".dbf") returned 4 [0089.263] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString=".1cd") returned 4 [0089.263] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0089.263] lstrlenW (lpString=".jpg") returned 4 [0089.263] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0089.264] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") [0089.265] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=208) returned 1 [0089.265] CloseHandle (hObject=0x190) returned 1 [0089.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0089.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.266] GetLastError () returned 0x0 [0089.266] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd0, lpOverlapped=0x0) returned 1 [0089.267] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0089.268] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.268] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0089.268] SetEndOfFile (hFile=0x16c) returned 1 [0089.268] CloseHandle (hObject=0x16c) returned 1 [0089.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.268] SetEndOfFile (hFile=0x190) returned 1 [0089.269] CloseHandle (hObject=0x190) returned 1 [0089.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1 [0089.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.269] lstrlenW (lpString=".doc") returned 4 [0089.269] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0089.269] lstrlenW (lpString=".docx") returned 5 [0089.269] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0089.269] lstrlenW (lpString=".pdf") returned 4 [0089.269] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0089.270] lstrlenW (lpString=".xls") returned 4 [0089.270] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0089.270] lstrlenW (lpString=".xlsx") returned 5 [0089.270] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0089.270] lstrlenW (lpString=".ppt") returned 4 [0089.270] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.270] lstrlenW (lpString=".zip") returned 4 [0089.270] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0089.270] lstrlenW (lpString=".rar") returned 4 [0089.270] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0089.270] lstrlenW (lpString=".bz2") returned 4 [0089.270] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0089.270] lstrlenW (lpString=".7z") returned 3 [0089.270] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.270] lstrlenW (lpString=".dbf") returned 4 [0089.270] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.270] lstrlenW (lpString=".1cd") returned 4 [0089.270] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0089.270] lstrlenW (lpString=".jpg") returned 4 [0089.270] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0089.270] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") [0089.271] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=114) returned 1 [0089.271] CloseHandle (hObject=0x190) returned 1 [0089.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0089.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.271] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.271] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.272] GetLastError () returned 0x0 [0089.272] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x72, lpOverlapped=0x0) returned 1 [0089.273] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0089.274] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.274] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0089.274] SetEndOfFile (hFile=0x16c) returned 1 [0089.274] CloseHandle (hObject=0x16c) returned 1 [0089.275] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.275] SetEndOfFile (hFile=0x190) returned 1 [0089.275] CloseHandle (hObject=0x190) returned 1 [0089.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1 [0089.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.276] lstrlenW (lpString=".doc") returned 4 [0089.276] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0089.276] lstrlenW (lpString=".docx") returned 5 [0089.276] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0089.276] lstrlenW (lpString=".pdf") returned 4 [0089.276] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0089.276] lstrlenW (lpString=".xls") returned 4 [0089.276] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0089.276] lstrlenW (lpString=".xlsx") returned 5 [0089.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0089.276] lstrlenW (lpString=".ppt") returned 4 [0089.276] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0089.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.276] lstrlenW (lpString=".zip") returned 4 [0089.276] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0089.276] lstrlenW (lpString=".rar") returned 4 [0089.276] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0089.276] lstrlenW (lpString=".bz2") returned 4 [0089.276] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0089.276] lstrlenW (lpString=".7z") returned 3 [0089.276] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0089.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.276] lstrlenW (lpString=".dbf") returned 4 [0089.276] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0089.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.277] lstrlenW (lpString=".1cd") returned 4 [0089.277] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0089.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0089.277] lstrlenW (lpString=".jpg") returned 4 [0089.277] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0089.277] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") [0089.277] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=113) returned 1 [0089.277] CloseHandle (hObject=0x190) returned 1 [0089.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0089.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.278] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.278] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.278] GetLastError () returned 0x0 [0089.278] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x71, lpOverlapped=0x0) returned 1 [0089.279] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0089.280] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.280] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0089.280] SetEndOfFile (hFile=0x16c) returned 1 [0089.281] CloseHandle (hObject=0x16c) returned 1 [0089.281] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.281] SetEndOfFile (hFile=0x190) returned 1 [0089.281] CloseHandle (hObject=0x190) returned 1 [0089.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1 [0089.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.282] lstrlenW (lpString=".doc") returned 4 [0089.282] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0089.282] lstrlenW (lpString=".docx") returned 5 [0089.282] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0089.282] lstrlenW (lpString=".pdf") returned 4 [0089.282] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0089.282] lstrlenW (lpString=".xls") returned 4 [0089.282] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0089.282] lstrlenW (lpString=".xlsx") returned 5 [0089.282] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0089.282] lstrlenW (lpString=".ppt") returned 4 [0089.282] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0089.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.282] lstrlenW (lpString=".zip") returned 4 [0089.282] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0089.282] lstrlenW (lpString=".rar") returned 4 [0089.282] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0089.282] lstrlenW (lpString=".bz2") returned 4 [0089.282] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0089.282] lstrlenW (lpString=".7z") returned 3 [0089.282] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0089.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.282] lstrlenW (lpString=".dbf") returned 4 [0089.283] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0089.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.283] lstrlenW (lpString=".1cd") returned 4 [0089.283] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0089.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0089.283] lstrlenW (lpString=".jpg") returned 4 [0089.283] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0089.283] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") [0089.283] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1284456) returned 1 [0089.283] CloseHandle (hObject=0x190) returned 1 [0089.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20 [0089.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.284] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.284] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.284] GetLastError () returned 0x0 [0089.284] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0089.500] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0089.517] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x39978, lpOverlapped=0x0) returned 1 [0089.727] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x39980, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x39980, lpOverlapped=0x0) returned 1 [0089.750] ReadFile (in: hFile=0x190, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0089.751] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0089.752] SetEndOfFile (hFile=0x16c) returned 1 [0089.897] CloseHandle (hObject=0x16c) returned 1 [0089.897] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0089.897] SetEndOfFile (hFile=0x190) returned 1 [0089.900] CloseHandle (hObject=0x190) returned 1 [0089.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 1 [0090.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString=".doc") returned 4 [0090.019] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString=".docx") returned 5 [0090.019] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0090.019] lstrlenW (lpString=".pdf") returned 4 [0090.019] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString=".xls") returned 4 [0090.019] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString=".xlsx") returned 5 [0090.019] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0090.019] lstrlenW (lpString=".ppt") returned 4 [0090.019] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString=".zip") returned 4 [0090.019] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString=".rar") returned 4 [0090.019] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.019] lstrlenW (lpString=".bz2") returned 4 [0090.019] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.019] lstrlenW (lpString=".7z") returned 3 [0090.019] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString=".dbf") returned 4 [0090.019] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString=".1cd") returned 4 [0090.019] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0090.019] lstrlenW (lpString=".jpg") returned 4 [0090.019] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.019] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") [0090.238] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=48488) returned 1 [0090.238] CloseHandle (hObject=0x22c) returned 1 [0090.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20 [0090.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.238] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.238] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.239] GetLastError () returned 0x0 [0090.239] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbd68, lpOverlapped=0x0) returned 1 [0090.266] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0090.268] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0090.268] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.268] SetEndOfFile (hFile=0x150) returned 1 [0090.269] CloseHandle (hObject=0x150) returned 1 [0090.269] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.269] SetEndOfFile (hFile=0x22c) returned 1 [0090.270] CloseHandle (hObject=0x22c) returned 1 [0090.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString=".doc") returned 4 [0090.401] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString=".docx") returned 5 [0090.401] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0090.401] lstrlenW (lpString=".pdf") returned 4 [0090.401] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString=".xls") returned 4 [0090.401] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.401] lstrlenW (lpString=".xlsx") returned 5 [0090.401] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0090.401] lstrlenW (lpString=".ppt") returned 4 [0090.401] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString=".zip") returned 4 [0090.401] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.401] lstrlenW (lpString=".rar") returned 4 [0090.401] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString=".bz2") returned 4 [0090.401] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString=".7z") returned 3 [0090.401] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString=".dbf") returned 4 [0090.401] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString=".1cd") returned 4 [0090.401] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0090.401] lstrlenW (lpString=".jpg") returned 4 [0090.402] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.402] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") [0090.586] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1604) returned 1 [0090.593] CloseHandle (hObject=0x180) returned 1 [0090.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 0x20 [0090.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.604] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.604] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.616] GetLastError () returned 0x0 [0090.616] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x644, lpOverlapped=0x0) returned 1 [0090.617] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x650, lpOverlapped=0x0) returned 1 [0090.618] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0090.618] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0090.618] SetEndOfFile (hFile=0x1c0) returned 1 [0090.618] CloseHandle (hObject=0x1c0) returned 1 [0090.618] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.618] SetEndOfFile (hFile=0x180) returned 1 [0090.619] CloseHandle (hObject=0x180) returned 1 [0090.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString=".doc") returned 4 [0090.620] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString=".docx") returned 5 [0090.620] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0090.620] lstrlenW (lpString=".pdf") returned 4 [0090.620] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString=".xls") returned 4 [0090.620] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0090.620] lstrlenW (lpString=".xlsx") returned 5 [0090.620] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0090.620] lstrlenW (lpString=".ppt") returned 4 [0090.620] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString=".zip") returned 4 [0090.620] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0090.620] lstrlenW (lpString=".rar") returned 4 [0090.620] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString=".bz2") returned 4 [0090.620] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString=".7z") returned 3 [0090.620] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString=".dbf") returned 4 [0090.620] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString=".1cd") returned 4 [0090.620] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0090.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0090.620] lstrlenW (lpString=".jpg") returned 4 [0090.621] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0090.621] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") [0090.621] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=43392) returned 1 [0090.621] CloseHandle (hObject=0x180) returned 1 [0090.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 0x20 [0090.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.622] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.622] GetLastError () returned 0x0 [0090.622] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa980, lpOverlapped=0x0) returned 1 [0090.624] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa990, lpOverlapped=0x0) returned 1 [0090.626] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0090.626] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.626] SetEndOfFile (hFile=0x1c0) returned 1 [0090.626] CloseHandle (hObject=0x1c0) returned 1 [0090.627] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.627] SetEndOfFile (hFile=0x180) returned 1 [0090.628] CloseHandle (hObject=0x180) returned 1 [0090.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1 [0090.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.628] lstrlenW (lpString=".doc") returned 4 [0090.628] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.628] lstrlenW (lpString=".docx") returned 5 [0090.628] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0090.628] lstrlenW (lpString=".pdf") returned 4 [0090.628] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.628] lstrlenW (lpString=".xls") returned 4 [0090.628] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.628] lstrlenW (lpString=".xlsx") returned 5 [0090.628] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0090.628] lstrlenW (lpString=".ppt") returned 4 [0090.628] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.629] lstrlenW (lpString=".zip") returned 4 [0090.629] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.629] lstrlenW (lpString=".rar") returned 4 [0090.629] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.629] lstrlenW (lpString=".bz2") returned 4 [0090.629] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.629] lstrlenW (lpString=".7z") returned 3 [0090.629] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.629] lstrlenW (lpString=".dbf") returned 4 [0090.629] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.629] lstrlenW (lpString=".1cd") returned 4 [0090.629] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0090.629] lstrlenW (lpString=".jpg") returned 4 [0090.629] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.629] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") [0090.630] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=758648) returned 1 [0090.630] CloseHandle (hObject=0x180) returned 1 [0090.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 0x20 [0090.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.631] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.631] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.631] GetLastError () returned 0x0 [0090.631] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb9378, lpOverlapped=0x0) returned 1 [0090.647] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb9380, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb9380, lpOverlapped=0x0) returned 1 [0090.660] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0090.660] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.660] SetEndOfFile (hFile=0x1c0) returned 1 [0090.660] CloseHandle (hObject=0x1c0) returned 1 [0090.660] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.660] SetEndOfFile (hFile=0x180) returned 1 [0090.816] CloseHandle (hObject=0x180) returned 1 [0090.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 1 [0090.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.816] lstrlenW (lpString=".doc") returned 4 [0090.816] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.816] lstrlenW (lpString=".docx") returned 5 [0090.816] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0090.816] lstrlenW (lpString=".pdf") returned 4 [0090.816] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.816] lstrlenW (lpString=".xls") returned 4 [0090.816] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.816] lstrlenW (lpString=".xlsx") returned 5 [0090.816] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0090.816] lstrlenW (lpString=".ppt") returned 4 [0090.816] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.817] lstrlenW (lpString=".zip") returned 4 [0090.817] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.817] lstrlenW (lpString=".rar") returned 4 [0090.817] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.817] lstrlenW (lpString=".bz2") returned 4 [0090.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.817] lstrlenW (lpString=".7z") returned 3 [0090.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.817] lstrlenW (lpString=".dbf") returned 4 [0090.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.817] lstrlenW (lpString=".1cd") returned 4 [0090.817] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0090.817] lstrlenW (lpString=".jpg") returned 4 [0090.817] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.817] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") [0090.818] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2839338) returned 1 [0090.818] CloseHandle (hObject=0x180) returned 1 [0090.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20 [0090.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0090.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.819] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0090.819] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0090.819] ReadFile (in: hFile=0x180, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.839] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe710e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0090.839] ReadFile (in: hFile=0x180, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0090.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x27532a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0090.934] ReadFile (in: hFile=0x180, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.991] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0090.991] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0091.183] SetEndOfFile (hFile=0x180) returned 1 [0091.184] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0091.184] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.184] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.185] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe710e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.185] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.190] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x27532a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.191] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.193] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0091.193] CloseHandle (hObject=0x180) returned 1 [0091.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.193] lstrlenW (lpString=".doc") returned 4 [0091.193] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.193] lstrlenW (lpString=".docx") returned 5 [0091.193] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0091.193] lstrlenW (lpString=".pdf") returned 4 [0091.193] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.193] lstrlenW (lpString=".xls") returned 4 [0091.193] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.193] lstrlenW (lpString=".xlsx") returned 5 [0091.193] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0091.194] lstrlenW (lpString=".ppt") returned 4 [0091.194] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.194] lstrlenW (lpString=".zip") returned 4 [0091.194] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.194] lstrlenW (lpString=".rar") returned 4 [0091.194] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.194] lstrlenW (lpString=".bz2") returned 4 [0091.194] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.194] lstrlenW (lpString=".7z") returned 3 [0091.194] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.194] lstrlenW (lpString=".dbf") returned 4 [0091.194] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.194] lstrlenW (lpString=".1cd") returned 4 [0091.194] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0091.194] lstrlenW (lpString=".jpg") returned 4 [0091.194] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.194] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") [0091.195] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=209) returned 1 [0091.195] CloseHandle (hObject=0x180) returned 1 [0091.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20 [0091.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.196] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.196] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0091.197] GetLastError () returned 0x0 [0091.197] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd1, lpOverlapped=0x0) returned 1 [0091.239] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0091.240] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.240] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.240] SetEndOfFile (hFile=0x22c) returned 1 [0091.240] CloseHandle (hObject=0x22c) returned 1 [0091.240] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.241] SetEndOfFile (hFile=0x180) returned 1 [0091.241] CloseHandle (hObject=0x180) returned 1 [0091.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.242] lstrlenW (lpString=".doc") returned 4 [0091.242] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0091.242] lstrlenW (lpString=".docx") returned 5 [0091.242] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0091.242] lstrlenW (lpString=".pdf") returned 4 [0091.242] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0091.242] lstrlenW (lpString=".xls") returned 4 [0091.242] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0091.242] lstrlenW (lpString=".xlsx") returned 5 [0091.242] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0091.242] lstrlenW (lpString=".ppt") returned 4 [0091.242] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.242] lstrlenW (lpString=".zip") returned 4 [0091.242] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0091.242] lstrlenW (lpString=".rar") returned 4 [0091.242] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0091.242] lstrlenW (lpString=".bz2") returned 4 [0091.242] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0091.242] lstrlenW (lpString=".7z") returned 3 [0091.242] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.242] lstrlenW (lpString=".dbf") returned 4 [0091.242] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.243] lstrlenW (lpString=".1cd") returned 4 [0091.243] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0091.243] lstrlenW (lpString=".jpg") returned 4 [0091.243] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0091.243] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") [0091.244] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=68488) returned 1 [0091.244] CloseHandle (hObject=0x180) returned 1 [0091.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20 [0091.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.244] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.244] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0091.245] GetLastError () returned 0x0 [0091.245] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x10b88, lpOverlapped=0x0) returned 1 [0091.262] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x10b90, lpOverlapped=0x0) returned 1 [0091.264] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.264] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0091.264] SetEndOfFile (hFile=0x22c) returned 1 [0091.264] CloseHandle (hObject=0x22c) returned 1 [0091.264] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.264] SetEndOfFile (hFile=0x180) returned 1 [0091.266] CloseHandle (hObject=0x180) returned 1 [0091.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1 [0091.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.266] lstrlenW (lpString=".doc") returned 4 [0091.266] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0091.266] lstrlenW (lpString=".docx") returned 5 [0091.266] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0091.266] lstrlenW (lpString=".pdf") returned 4 [0091.266] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0091.266] lstrlenW (lpString=".xls") returned 4 [0091.266] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0091.266] lstrlenW (lpString=".xlsx") returned 5 [0091.266] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0091.266] lstrlenW (lpString=".ppt") returned 4 [0091.266] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0091.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.266] lstrlenW (lpString=".zip") returned 4 [0091.266] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0091.267] lstrlenW (lpString=".rar") returned 4 [0091.267] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0091.267] lstrlenW (lpString=".bz2") returned 4 [0091.267] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0091.267] lstrlenW (lpString=".7z") returned 3 [0091.267] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0091.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.267] lstrlenW (lpString=".dbf") returned 4 [0091.267] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0091.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.267] lstrlenW (lpString=".1cd") returned 4 [0091.267] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0091.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0091.267] lstrlenW (lpString=".jpg") returned 4 [0091.267] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0091.267] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") [0091.287] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1940) returned 1 [0091.287] CloseHandle (hObject=0x180) returned 1 [0091.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 0x20 [0091.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.288] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.288] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0091.288] GetLastError () returned 0x0 [0091.288] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x794, lpOverlapped=0x0) returned 1 [0091.291] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0091.293] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.293] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.293] SetEndOfFile (hFile=0x22c) returned 1 [0091.293] CloseHandle (hObject=0x22c) returned 1 [0091.293] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.293] SetEndOfFile (hFile=0x180) returned 1 [0091.294] CloseHandle (hObject=0x180) returned 1 [0091.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1 [0091.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.294] lstrlenW (lpString=".doc") returned 4 [0091.294] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0091.294] lstrlenW (lpString=".docx") returned 5 [0091.294] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0091.294] lstrlenW (lpString=".pdf") returned 4 [0091.295] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString=".xls") returned 4 [0091.295] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0091.295] lstrlenW (lpString=".xlsx") returned 5 [0091.295] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0091.295] lstrlenW (lpString=".ppt") returned 4 [0091.295] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.295] lstrlenW (lpString=".zip") returned 4 [0091.295] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0091.295] lstrlenW (lpString=".rar") returned 4 [0091.295] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString=".bz2") returned 4 [0091.295] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString=".7z") returned 3 [0091.295] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0091.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.295] lstrlenW (lpString=".dbf") returned 4 [0091.295] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.295] lstrlenW (lpString=".1cd") returned 4 [0091.295] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0091.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0091.295] lstrlenW (lpString=".jpg") returned 4 [0091.295] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0091.295] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") [0091.297] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1826) returned 1 [0091.297] CloseHandle (hObject=0x180) returned 1 [0091.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20 [0091.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.297] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.297] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0091.298] GetLastError () returned 0x0 [0091.298] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x722, lpOverlapped=0x0) returned 1 [0091.304] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x730, lpOverlapped=0x0) returned 1 [0091.305] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.305] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.305] SetEndOfFile (hFile=0x22c) returned 1 [0091.305] CloseHandle (hObject=0x22c) returned 1 [0091.305] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.305] SetEndOfFile (hFile=0x180) returned 1 [0091.306] CloseHandle (hObject=0x180) returned 1 [0091.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString=".doc") returned 4 [0091.307] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString=".docx") returned 5 [0091.307] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0091.307] lstrlenW (lpString=".pdf") returned 4 [0091.307] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString=".xls") returned 4 [0091.307] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0091.307] lstrlenW (lpString=".xlsx") returned 5 [0091.307] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0091.307] lstrlenW (lpString=".ppt") returned 4 [0091.307] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString=".zip") returned 4 [0091.307] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0091.307] lstrlenW (lpString=".rar") returned 4 [0091.307] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString=".bz2") returned 4 [0091.307] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString=".7z") returned 3 [0091.307] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString=".dbf") returned 4 [0091.307] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString=".1cd") returned 4 [0091.307] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0091.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0091.307] lstrlenW (lpString=".jpg") returned 4 [0091.308] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0091.308] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") [0091.308] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4932186) returned 1 [0091.308] CloseHandle (hObject=0x180) returned 1 [0091.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20 [0091.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0091.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.310] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0091.310] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.310] ReadFile (in: hFile=0x180, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.313] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x19161e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.313] ReadFile (in: hFile=0x180, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x47425a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.321] ReadFile (in: hFile=0x180, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.337] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.337] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0091.584] SetEndOfFile (hFile=0x180) returned 1 [0091.584] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0091.584] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.584] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.585] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x19161e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.585] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.587] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x47425a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0091.587] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.589] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0091.590] CloseHandle (hObject=0x180) returned 1 [0091.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.590] lstrlenW (lpString=".doc") returned 4 [0091.590] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.590] lstrlenW (lpString=".docx") returned 5 [0091.590] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0091.590] lstrlenW (lpString=".pdf") returned 4 [0091.590] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.590] lstrlenW (lpString=".xls") returned 4 [0091.590] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.590] lstrlenW (lpString=".xlsx") returned 5 [0091.590] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0091.590] lstrlenW (lpString=".ppt") returned 4 [0091.590] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.590] lstrlenW (lpString=".zip") returned 4 [0091.590] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.590] lstrlenW (lpString=".rar") returned 4 [0091.590] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.590] lstrlenW (lpString=".bz2") returned 4 [0091.590] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.590] lstrlenW (lpString=".7z") returned 3 [0091.590] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.591] lstrlenW (lpString=".dbf") returned 4 [0091.591] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.591] lstrlenW (lpString=".1cd") returned 4 [0091.591] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0091.591] lstrlenW (lpString=".jpg") returned 4 [0091.591] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.591] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") [0091.592] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=651) returned 1 [0091.592] CloseHandle (hObject=0x180) returned 1 [0091.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 0x20 [0091.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.592] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.592] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.593] GetLastError () returned 0x0 [0091.593] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x28b, lpOverlapped=0x0) returned 1 [0091.595] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x290, lpOverlapped=0x0) returned 1 [0091.596] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.596] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.596] SetEndOfFile (hFile=0x1c0) returned 1 [0091.596] CloseHandle (hObject=0x1c0) returned 1 [0091.596] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.596] SetEndOfFile (hFile=0x180) returned 1 [0091.597] CloseHandle (hObject=0x180) returned 1 [0091.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1 [0091.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.598] lstrlenW (lpString=".doc") returned 4 [0091.598] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0091.598] lstrlenW (lpString=".docx") returned 5 [0091.598] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0091.598] lstrlenW (lpString=".pdf") returned 4 [0091.598] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0091.598] lstrlenW (lpString=".xls") returned 4 [0091.598] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0091.598] lstrlenW (lpString=".xlsx") returned 5 [0091.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0091.598] lstrlenW (lpString=".ppt") returned 4 [0091.598] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0091.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.598] lstrlenW (lpString=".zip") returned 4 [0091.598] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0091.598] lstrlenW (lpString=".rar") returned 4 [0091.598] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0091.598] lstrlenW (lpString=".bz2") returned 4 [0091.598] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0091.598] lstrlenW (lpString=".7z") returned 3 [0091.598] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0091.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.599] lstrlenW (lpString=".dbf") returned 4 [0091.599] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0091.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.599] lstrlenW (lpString=".1cd") returned 4 [0091.599] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0091.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0091.599] lstrlenW (lpString=".jpg") returned 4 [0091.599] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0091.599] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") [0091.600] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=211) returned 1 [0091.600] CloseHandle (hObject=0x180) returned 1 [0091.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20 [0091.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.600] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.600] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.601] GetLastError () returned 0x0 [0091.601] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd3, lpOverlapped=0x0) returned 1 [0091.602] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0091.603] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.603] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.603] SetEndOfFile (hFile=0x1c0) returned 1 [0091.603] CloseHandle (hObject=0x1c0) returned 1 [0091.603] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.603] SetEndOfFile (hFile=0x180) returned 1 [0091.604] CloseHandle (hObject=0x180) returned 1 [0091.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString=".doc") returned 4 [0091.605] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0091.605] lstrlenW (lpString=".docx") returned 5 [0091.605] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0091.605] lstrlenW (lpString=".pdf") returned 4 [0091.605] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0091.605] lstrlenW (lpString=".xls") returned 4 [0091.605] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0091.605] lstrlenW (lpString=".xlsx") returned 5 [0091.605] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0091.605] lstrlenW (lpString=".ppt") returned 4 [0091.605] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString=".zip") returned 4 [0091.605] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0091.605] lstrlenW (lpString=".rar") returned 4 [0091.605] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0091.605] lstrlenW (lpString=".bz2") returned 4 [0091.605] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0091.605] lstrlenW (lpString=".7z") returned 3 [0091.605] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString=".dbf") returned 4 [0091.605] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString=".1cd") returned 4 [0091.605] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0091.605] lstrlenW (lpString=".jpg") returned 4 [0091.606] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0091.606] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") [0091.606] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=114) returned 1 [0091.606] CloseHandle (hObject=0x180) returned 1 [0091.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20 [0091.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.607] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.607] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.607] GetLastError () returned 0x0 [0091.607] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x72, lpOverlapped=0x0) returned 1 [0091.608] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.609] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.609] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfe, lpOverlapped=0x0) returned 1 [0091.609] SetEndOfFile (hFile=0x1c0) returned 1 [0091.609] CloseHandle (hObject=0x1c0) returned 1 [0091.609] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.610] SetEndOfFile (hFile=0x180) returned 1 [0091.610] CloseHandle (hObject=0x180) returned 1 [0091.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString=".doc") returned 4 [0091.611] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.611] lstrlenW (lpString=".docx") returned 5 [0091.611] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.611] lstrlenW (lpString=".pdf") returned 4 [0091.611] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.611] lstrlenW (lpString=".xls") returned 4 [0091.611] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.611] lstrlenW (lpString=".xlsx") returned 5 [0091.611] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.611] lstrlenW (lpString=".ppt") returned 4 [0091.611] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString=".zip") returned 4 [0091.611] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.611] lstrlenW (lpString=".rar") returned 4 [0091.611] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.611] lstrlenW (lpString=".bz2") returned 4 [0091.611] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.611] lstrlenW (lpString=".7z") returned 3 [0091.611] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString=".dbf") returned 4 [0091.611] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString=".1cd") returned 4 [0091.611] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0091.611] lstrlenW (lpString=".jpg") returned 4 [0091.611] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.612] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") [0091.612] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=113) returned 1 [0091.612] CloseHandle (hObject=0x180) returned 1 [0091.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20 [0091.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.613] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.613] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.613] GetLastError () returned 0x0 [0091.613] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x71, lpOverlapped=0x0) returned 1 [0091.614] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.615] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0091.615] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfe, lpOverlapped=0x0) returned 1 [0091.615] SetEndOfFile (hFile=0x1c0) returned 1 [0091.615] CloseHandle (hObject=0x1c0) returned 1 [0091.615] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.615] SetEndOfFile (hFile=0x180) returned 1 [0091.616] CloseHandle (hObject=0x180) returned 1 [0091.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString=".doc") returned 4 [0091.617] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.617] lstrlenW (lpString=".docx") returned 5 [0091.617] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.617] lstrlenW (lpString=".pdf") returned 4 [0091.617] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.617] lstrlenW (lpString=".xls") returned 4 [0091.617] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.617] lstrlenW (lpString=".xlsx") returned 5 [0091.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.617] lstrlenW (lpString=".ppt") returned 4 [0091.617] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString=".zip") returned 4 [0091.617] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.617] lstrlenW (lpString=".rar") returned 4 [0091.617] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.617] lstrlenW (lpString=".bz2") returned 4 [0091.617] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.617] lstrlenW (lpString=".7z") returned 3 [0091.617] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString=".dbf") returned 4 [0091.617] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString=".1cd") returned 4 [0091.617] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0091.617] lstrlenW (lpString=".jpg") returned 4 [0091.617] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.618] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") [0091.618] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5240293) returned 1 [0091.618] CloseHandle (hObject=0x180) returned 1 [0091.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20 [0091.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0091.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0091.619] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0091.619] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.620] ReadFile (in: hFile=0x180, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.918] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1aa74c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.918] ReadFile (in: hFile=0x180, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.923] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.923] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4bf5e5, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0091.923] ReadFile (in: hFile=0x180, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.939] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0091.939] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0092.031] SetEndOfFile (hFile=0x180) returned 1 [0092.099] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0092.099] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0092.099] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.114] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1aa74c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0092.114] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.116] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4bf5e5, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0092.116] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.118] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0092.118] CloseHandle (hObject=0x180) returned 1 [0092.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString=".doc") returned 4 [0092.119] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0092.119] lstrlenW (lpString=".docx") returned 5 [0092.119] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0092.119] lstrlenW (lpString=".pdf") returned 4 [0092.119] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0092.119] lstrlenW (lpString=".xls") returned 4 [0092.119] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0092.119] lstrlenW (lpString=".xlsx") returned 5 [0092.119] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0092.119] lstrlenW (lpString=".ppt") returned 4 [0092.119] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString=".zip") returned 4 [0092.119] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0092.119] lstrlenW (lpString=".rar") returned 4 [0092.119] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0092.119] lstrlenW (lpString=".bz2") returned 4 [0092.119] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0092.119] lstrlenW (lpString=".7z") returned 3 [0092.119] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString=".dbf") returned 4 [0092.119] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString=".1cd") returned 4 [0092.119] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0092.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0092.119] lstrlenW (lpString=".jpg") returned 4 [0092.119] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0092.120] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") [0092.120] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=108416) returned 1 [0092.120] CloseHandle (hObject=0x180) returned 1 [0092.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 0x20 [0092.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.121] GetLastError () returned 0x0 [0092.121] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1a780, lpOverlapped=0x0) returned 1 [0092.125] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0092.127] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.127] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0092.127] SetEndOfFile (hFile=0x22c) returned 1 [0092.128] CloseHandle (hObject=0x22c) returned 1 [0092.128] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.128] SetEndOfFile (hFile=0x180) returned 1 [0092.138] CloseHandle (hObject=0x180) returned 1 [0092.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1 [0092.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.138] lstrlenW (lpString=".doc") returned 4 [0092.138] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0092.138] lstrlenW (lpString=".docx") returned 5 [0092.138] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.138] lstrlenW (lpString=".pdf") returned 4 [0092.138] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.138] lstrlenW (lpString=".xls") returned 4 [0092.138] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.138] lstrlenW (lpString=".xlsx") returned 5 [0092.138] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.138] lstrlenW (lpString=".ppt") returned 4 [0092.138] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.138] lstrlenW (lpString=".zip") returned 4 [0092.138] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.138] lstrlenW (lpString=".rar") returned 4 [0092.138] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".bz2") returned 4 [0092.139] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".7z") returned 3 [0092.139] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.139] lstrlenW (lpString=".dbf") returned 4 [0092.139] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.139] lstrlenW (lpString=".1cd") returned 4 [0092.139] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.139] lstrlenW (lpString=".jpg") returned 4 [0092.139] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".docx") returned 5 [0092.139] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.139] lstrlenW (lpString=".pdf") returned 4 [0092.139] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".xls") returned 4 [0092.139] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".xlsx") returned 5 [0092.139] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.139] lstrlenW (lpString=".ppt") returned 4 [0092.139] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.139] lstrlenW (lpString=".zip") returned 4 [0092.139] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".rar") returned 4 [0092.139] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".bz2") returned 4 [0092.139] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.139] lstrlenW (lpString=".7z") returned 3 [0092.139] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.140] lstrlenW (lpString=".dbf") returned 4 [0092.140] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.140] lstrlenW (lpString=".1cd") returned 4 [0092.140] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0092.140] lstrlenW (lpString=".jpg") returned 4 [0092.140] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.140] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") [0092.141] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=614784) returned 1 [0092.141] CloseHandle (hObject=0x180) returned 1 [0092.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20 [0092.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.141] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.141] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.142] GetLastError () returned 0x0 [0092.142] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x96180, lpOverlapped=0x0) returned 1 [0092.156] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x96190, lpOverlapped=0x0) returned 1 [0092.368] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.368] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0092.368] SetEndOfFile (hFile=0x22c) returned 1 [0092.368] CloseHandle (hObject=0x22c) returned 1 [0092.368] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.368] SetEndOfFile (hFile=0x180) returned 1 [0092.373] CloseHandle (hObject=0x180) returned 1 [0092.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1 [0092.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.542] lstrlenW (lpString=".doc") returned 4 [0092.542] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".docx") returned 5 [0092.542] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.542] lstrlenW (lpString=".pdf") returned 4 [0092.542] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".xls") returned 4 [0092.542] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".xlsx") returned 5 [0092.542] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.542] lstrlenW (lpString=".ppt") returned 4 [0092.542] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.542] lstrlenW (lpString=".zip") returned 4 [0092.542] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".rar") returned 4 [0092.542] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".bz2") returned 4 [0092.542] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.542] lstrlenW (lpString=".7z") returned 3 [0092.542] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.542] lstrlenW (lpString=".dbf") returned 4 [0092.542] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.543] lstrlenW (lpString=".1cd") returned 4 [0092.543] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.543] lstrlenW (lpString=".jpg") returned 4 [0092.543] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".docx") returned 5 [0092.543] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.543] lstrlenW (lpString=".pdf") returned 4 [0092.543] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".xls") returned 4 [0092.543] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".xlsx") returned 5 [0092.543] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.543] lstrlenW (lpString=".ppt") returned 4 [0092.543] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.543] lstrlenW (lpString=".zip") returned 4 [0092.543] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".rar") returned 4 [0092.543] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".bz2") returned 4 [0092.543] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString=".7z") returned 3 [0092.543] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.543] lstrlenW (lpString=".dbf") returned 4 [0092.543] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.543] lstrlenW (lpString=".1cd") returned 4 [0092.543] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0092.544] lstrlenW (lpString=".jpg") returned 4 [0092.544] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.544] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") [0092.544] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=43558) returned 1 [0092.544] CloseHandle (hObject=0x158) returned 1 [0092.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0092.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.545] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.545] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.546] GetLastError () returned 0x0 [0092.546] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xaa26, lpOverlapped=0x0) returned 1 [0092.548] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xaa30, lpOverlapped=0x0) returned 1 [0092.549] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.549] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0092.549] SetEndOfFile (hFile=0x180) returned 1 [0092.550] CloseHandle (hObject=0x180) returned 1 [0092.550] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.550] SetEndOfFile (hFile=0x158) returned 1 [0092.551] CloseHandle (hObject=0x158) returned 1 [0092.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1 [0092.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.551] lstrlenW (lpString=".doc") returned 4 [0092.551] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0092.551] lstrlenW (lpString=".docx") returned 5 [0092.551] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0092.551] lstrlenW (lpString=".pdf") returned 4 [0092.551] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0092.551] lstrlenW (lpString=".xls") returned 4 [0092.551] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0092.551] lstrlenW (lpString=".xlsx") returned 5 [0092.551] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0092.551] lstrlenW (lpString=".ppt") returned 4 [0092.551] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0092.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.552] lstrlenW (lpString=".zip") returned 4 [0092.552] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0092.552] lstrlenW (lpString=".rar") returned 4 [0092.552] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0092.552] lstrlenW (lpString=".bz2") returned 4 [0092.552] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0092.552] lstrlenW (lpString=".7z") returned 3 [0092.552] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0092.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.552] lstrlenW (lpString=".dbf") returned 4 [0092.552] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0092.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.552] lstrlenW (lpString=".1cd") returned 4 [0092.552] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0092.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0092.552] lstrlenW (lpString=".jpg") returned 4 [0092.552] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0092.552] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") [0092.553] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=50556) returned 1 [0092.553] CloseHandle (hObject=0x158) returned 1 [0092.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0092.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.553] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.553] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.554] GetLastError () returned 0x0 [0092.554] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc57c, lpOverlapped=0x0) returned 1 [0092.557] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc580, lpOverlapped=0x0) returned 1 [0092.558] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.558] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0092.558] SetEndOfFile (hFile=0x180) returned 1 [0092.558] CloseHandle (hObject=0x180) returned 1 [0092.558] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.559] SetEndOfFile (hFile=0x158) returned 1 [0092.560] CloseHandle (hObject=0x158) returned 1 [0092.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.560] lstrlenW (lpString=".doc") returned 4 [0092.560] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString=".docx") returned 5 [0092.560] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0092.560] lstrlenW (lpString=".pdf") returned 4 [0092.560] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString=".xls") returned 4 [0092.560] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString=".xlsx") returned 5 [0092.560] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0092.560] lstrlenW (lpString=".ppt") returned 4 [0092.560] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.560] lstrlenW (lpString=".zip") returned 4 [0092.560] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString=".rar") returned 4 [0092.560] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0092.560] lstrlenW (lpString=".bz2") returned 4 [0092.561] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0092.561] lstrlenW (lpString=".7z") returned 3 [0092.561] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0092.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.561] lstrlenW (lpString=".dbf") returned 4 [0092.561] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0092.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.561] lstrlenW (lpString=".1cd") returned 4 [0092.561] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0092.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0092.561] lstrlenW (lpString=".jpg") returned 4 [0092.561] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0092.561] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") [0092.561] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1250224) returned 1 [0092.561] CloseHandle (hObject=0x158) returned 1 [0092.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 0x20 [0092.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.562] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.562] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.562] GetLastError () returned 0x0 [0092.563] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0092.611] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0092.627] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x313c0, lpOverlapped=0x0) returned 1 [0092.638] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x313d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x313d0, lpOverlapped=0x0) returned 1 [0092.695] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.695] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0092.697] SetEndOfFile (hFile=0x180) returned 1 [0092.698] CloseHandle (hObject=0x180) returned 1 [0092.698] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.698] SetEndOfFile (hFile=0x158) returned 1 [0092.700] CloseHandle (hObject=0x158) returned 1 [0092.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 1 [0092.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.700] lstrlenW (lpString=".doc") returned 4 [0092.700] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.700] lstrlenW (lpString=".docx") returned 5 [0092.700] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0092.700] lstrlenW (lpString=".pdf") returned 4 [0092.700] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.700] lstrlenW (lpString=".xls") returned 4 [0092.700] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.700] lstrlenW (lpString=".xlsx") returned 5 [0092.700] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0092.700] lstrlenW (lpString=".ppt") returned 4 [0092.701] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.701] lstrlenW (lpString=".zip") returned 4 [0092.701] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.701] lstrlenW (lpString=".rar") returned 4 [0092.701] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.701] lstrlenW (lpString=".bz2") returned 4 [0092.701] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.701] lstrlenW (lpString=".7z") returned 3 [0092.701] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.701] lstrlenW (lpString=".dbf") returned 4 [0092.701] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.701] lstrlenW (lpString=".1cd") returned 4 [0092.701] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0092.701] lstrlenW (lpString=".jpg") returned 4 [0092.701] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.701] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") [0092.702] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1449312) returned 1 [0092.702] CloseHandle (hObject=0x158) returned 1 [0092.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 0x20 [0092.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.702] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.702] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.703] GetLastError () returned 0x0 [0092.703] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0092.726] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0092.826] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x61d70, lpOverlapped=0x0) returned 1 [0092.840] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x61d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x61d80, lpOverlapped=0x0) returned 1 [0092.849] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.849] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.850] SetEndOfFile (hFile=0x180) returned 1 [0092.850] CloseHandle (hObject=0x180) returned 1 [0092.850] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.850] SetEndOfFile (hFile=0x158) returned 1 [0092.853] CloseHandle (hObject=0x158) returned 1 [0092.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 1 [0092.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.854] lstrlenW (lpString=".doc") returned 4 [0092.854] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0092.854] lstrlenW (lpString=".docx") returned 5 [0092.854] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0092.854] lstrlenW (lpString=".pdf") returned 4 [0092.854] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0092.854] lstrlenW (lpString=".xls") returned 4 [0092.854] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0092.854] lstrlenW (lpString=".xlsx") returned 5 [0092.854] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0092.854] lstrlenW (lpString=".ppt") returned 4 [0092.854] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0092.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.854] lstrlenW (lpString=".zip") returned 4 [0092.854] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0092.854] lstrlenW (lpString=".rar") returned 4 [0092.854] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0092.855] lstrlenW (lpString=".bz2") returned 4 [0092.855] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0092.855] lstrlenW (lpString=".7z") returned 3 [0092.855] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0092.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.855] lstrlenW (lpString=".dbf") returned 4 [0092.855] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0092.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.855] lstrlenW (lpString=".1cd") returned 4 [0092.855] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0092.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0092.855] lstrlenW (lpString=".jpg") returned 4 [0092.855] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0092.855] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") [0092.892] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=210304) returned 1 [0092.892] CloseHandle (hObject=0x180) returned 1 [0092.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 0x20 [0092.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.900] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.906] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.924] GetLastError () returned 0x0 [0092.924] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x33580, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x33590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x33590, lpOverlapped=0x0) returned 1 [0092.936] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.936] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0092.936] SetEndOfFile (hFile=0x15c) returned 1 [0092.936] CloseHandle (hObject=0x15c) returned 1 [0092.936] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.936] SetEndOfFile (hFile=0x180) returned 1 [0092.938] CloseHandle (hObject=0x180) returned 1 [0092.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 1 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString=".doc") returned 4 [0092.939] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString=".docx") returned 5 [0092.939] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0092.939] lstrlenW (lpString=".pdf") returned 4 [0092.939] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString=".xls") returned 4 [0092.939] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString=".xlsx") returned 5 [0092.939] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0092.939] lstrlenW (lpString=".ppt") returned 4 [0092.939] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString=".zip") returned 4 [0092.939] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString=".rar") returned 4 [0092.939] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.939] lstrlenW (lpString=".bz2") returned 4 [0092.939] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.939] lstrlenW (lpString=".7z") returned 3 [0092.939] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString=".dbf") returned 4 [0092.939] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString=".1cd") returned 4 [0092.939] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0092.939] lstrlenW (lpString=".jpg") returned 4 [0092.939] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.940] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") [0092.941] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=123784) returned 1 [0092.941] CloseHandle (hObject=0x180) returned 1 [0092.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll")) returned 0x20 [0092.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.941] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.942] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.942] GetLastError () returned 0x0 [0092.942] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1e388, lpOverlapped=0x0) returned 1 [0092.949] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1e390, lpOverlapped=0x0) returned 1 [0092.952] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0092.952] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0092.952] SetEndOfFile (hFile=0x15c) returned 1 [0092.952] CloseHandle (hObject=0x15c) returned 1 [0092.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.952] SetEndOfFile (hFile=0x180) returned 1 [0092.953] CloseHandle (hObject=0x180) returned 1 [0092.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll")) returned 1 [0092.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.954] lstrlenW (lpString=".doc") returned 4 [0092.954] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString=".docx") returned 5 [0092.954] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0092.954] lstrlenW (lpString=".pdf") returned 4 [0092.954] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString=".xls") returned 4 [0092.954] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString=".xlsx") returned 5 [0092.954] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0092.954] lstrlenW (lpString=".ppt") returned 4 [0092.954] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.954] lstrlenW (lpString=".zip") returned 4 [0092.954] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString=".rar") returned 4 [0092.954] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.954] lstrlenW (lpString=".bz2") returned 4 [0092.954] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.954] lstrlenW (lpString=".7z") returned 3 [0092.954] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.954] lstrlenW (lpString=".dbf") returned 4 [0092.954] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.955] lstrlenW (lpString=".1cd") returned 4 [0092.955] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0092.955] lstrlenW (lpString=".jpg") returned 4 [0092.955] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.955] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") [0092.956] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=190336) returned 1 [0092.956] CloseHandle (hObject=0x180) returned 1 [0092.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll")) returned 0x20 [0092.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.957] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.957] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0092.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.957] GetLastError () returned 0x0 [0092.957] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2e780, lpOverlapped=0x0) returned 1 [0093.277] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2e790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2e790, lpOverlapped=0x0) returned 1 [0093.280] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0093.280] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.280] SetEndOfFile (hFile=0x15c) returned 1 [0093.280] CloseHandle (hObject=0x15c) returned 1 [0093.281] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0093.281] SetEndOfFile (hFile=0x180) returned 1 [0093.282] CloseHandle (hObject=0x180) returned 1 [0093.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll")) returned 1 [0093.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.283] lstrlenW (lpString=".doc") returned 4 [0093.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.283] lstrlenW (lpString=".docx") returned 5 [0093.283] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0093.283] lstrlenW (lpString=".pdf") returned 4 [0093.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.283] lstrlenW (lpString=".xls") returned 4 [0093.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.283] lstrlenW (lpString=".xlsx") returned 5 [0093.283] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0093.283] lstrlenW (lpString=".ppt") returned 4 [0093.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.284] lstrlenW (lpString=".zip") returned 4 [0093.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.284] lstrlenW (lpString=".rar") returned 4 [0093.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.284] lstrlenW (lpString=".bz2") returned 4 [0093.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.284] lstrlenW (lpString=".7z") returned 3 [0093.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.284] lstrlenW (lpString=".dbf") returned 4 [0093.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.284] lstrlenW (lpString=".1cd") returned 4 [0093.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0093.284] lstrlenW (lpString=".jpg") returned 4 [0093.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.284] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") [0094.048] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=830) returned 1 [0094.048] CloseHandle (hObject=0x150) returned 1 [0094.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 0x20 [0094.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.060] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.060] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.206] GetLastError () returned 0x0 [0094.206] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x33e, lpOverlapped=0x0) returned 1 [0094.208] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x340, lpOverlapped=0x0) returned 1 [0094.209] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0094.209] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0094.209] SetEndOfFile (hFile=0x16c) returned 1 [0094.209] CloseHandle (hObject=0x16c) returned 1 [0094.209] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.209] SetEndOfFile (hFile=0x150) returned 1 [0094.210] CloseHandle (hObject=0x150) returned 1 [0094.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1 [0094.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.210] lstrlenW (lpString=".doc") returned 4 [0094.210] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0094.210] lstrlenW (lpString=".docx") returned 5 [0094.210] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0094.210] lstrlenW (lpString=".pdf") returned 4 [0094.210] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0094.210] lstrlenW (lpString=".xls") returned 4 [0094.211] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0094.211] lstrlenW (lpString=".xlsx") returned 5 [0094.211] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0094.211] lstrlenW (lpString=".ppt") returned 4 [0094.211] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0094.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.211] lstrlenW (lpString=".zip") returned 4 [0094.211] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0094.211] lstrlenW (lpString=".rar") returned 4 [0094.211] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0094.211] lstrlenW (lpString=".bz2") returned 4 [0094.211] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0094.211] lstrlenW (lpString=".7z") returned 3 [0094.211] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0094.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.211] lstrlenW (lpString=".dbf") returned 4 [0094.211] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0094.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.211] lstrlenW (lpString=".1cd") returned 4 [0094.211] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0094.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0094.211] lstrlenW (lpString=".jpg") returned 4 [0094.211] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0094.211] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") [0094.215] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=142776) returned 1 [0094.215] CloseHandle (hObject=0x150) returned 1 [0094.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20 [0094.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.216] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.216] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.217] GetLastError () returned 0x0 [0094.217] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x22db8, lpOverlapped=0x0) returned 1 [0094.220] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x22dc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x22dc0, lpOverlapped=0x0) returned 1 [0094.223] ReadFile (in: hFile=0x150, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0094.223] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0094.223] SetEndOfFile (hFile=0x16c) returned 1 [0094.223] CloseHandle (hObject=0x16c) returned 1 [0094.224] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.224] SetEndOfFile (hFile=0x150) returned 1 [0094.225] CloseHandle (hObject=0x150) returned 1 [0094.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 1 [0094.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.226] lstrlenW (lpString=".doc") returned 4 [0094.226] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString=".docx") returned 5 [0094.226] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0094.226] lstrlenW (lpString=".pdf") returned 4 [0094.226] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString=".xls") returned 4 [0094.226] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString=".xlsx") returned 5 [0094.226] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0094.226] lstrlenW (lpString=".ppt") returned 4 [0094.226] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.226] lstrlenW (lpString=".zip") returned 4 [0094.226] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString=".rar") returned 4 [0094.226] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.226] lstrlenW (lpString=".bz2") returned 4 [0094.226] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.226] lstrlenW (lpString=".7z") returned 3 [0094.226] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.226] lstrlenW (lpString=".dbf") returned 4 [0094.226] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.227] lstrlenW (lpString=".1cd") returned 4 [0094.227] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0094.227] lstrlenW (lpString=".jpg") returned 4 [0094.227] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.227] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") [0094.228] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1667960) returned 1 [0094.228] CloseHandle (hObject=0x150) returned 1 [0094.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0x20 [0094.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0094.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0094.235] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0094.235] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0094.235] ReadFile (in: hFile=0x150, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.370] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x87bd2, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0094.371] ReadFile (in: hFile=0x150, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.404] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.404] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x157378, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0094.404] ReadFile (in: hFile=0x150, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.456] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0094.456] WriteFile (in: hFile=0x150, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0112, lpOverlapped=0x0) returned 1 [0094.721] SetEndOfFile (hFile=0x150) returned 1 [0094.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0094.721] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0094.721] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.722] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x87bd2, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0094.722] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.724] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x157378, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0094.724] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.726] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0094.726] CloseHandle (hObject=0x150) returned 1 [0094.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString=".doc") returned 4 [0094.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString=".docx") returned 5 [0094.727] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0094.727] lstrlenW (lpString=".pdf") returned 4 [0094.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString=".xls") returned 4 [0094.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString=".xlsx") returned 5 [0094.727] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0094.727] lstrlenW (lpString=".ppt") returned 4 [0094.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString=".zip") returned 4 [0094.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString=".rar") returned 4 [0094.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.727] lstrlenW (lpString=".bz2") returned 4 [0094.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.727] lstrlenW (lpString=".7z") returned 3 [0094.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString=".dbf") returned 4 [0094.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString=".1cd") returned 4 [0094.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0094.727] lstrlenW (lpString=".jpg") returned 4 [0094.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.728] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") [0095.130] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=14594) returned 1 [0095.130] CloseHandle (hObject=0x1f4) returned 1 [0095.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0095.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.131] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.131] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.131] GetLastError () returned 0x0 [0095.131] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3902, lpOverlapped=0x0) returned 1 [0095.133] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3910, lpOverlapped=0x0) returned 1 [0095.135] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.135] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.135] SetEndOfFile (hFile=0x180) returned 1 [0095.135] CloseHandle (hObject=0x180) returned 1 [0095.135] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.135] SetEndOfFile (hFile=0x1f4) returned 1 [0095.136] CloseHandle (hObject=0x1f4) returned 1 [0095.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1 [0095.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.136] lstrlenW (lpString=".doc") returned 4 [0095.136] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.136] lstrlenW (lpString=".docx") returned 5 [0095.136] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0095.136] lstrlenW (lpString=".pdf") returned 4 [0095.136] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.136] lstrlenW (lpString=".xls") returned 4 [0095.136] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.136] lstrlenW (lpString=".xlsx") returned 5 [0095.136] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0095.137] lstrlenW (lpString=".ppt") returned 4 [0095.137] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.137] lstrlenW (lpString=".zip") returned 4 [0095.137] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.137] lstrlenW (lpString=".rar") returned 4 [0095.137] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.137] lstrlenW (lpString=".bz2") returned 4 [0095.137] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.137] lstrlenW (lpString=".7z") returned 3 [0095.137] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.137] lstrlenW (lpString=".dbf") returned 4 [0095.137] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.137] lstrlenW (lpString=".1cd") returned 4 [0095.137] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0095.137] lstrlenW (lpString=".jpg") returned 4 [0095.137] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.137] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") [0095.138] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3876) returned 1 [0095.138] CloseHandle (hObject=0x1f4) returned 1 [0095.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0095.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.138] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.138] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.139] GetLastError () returned 0x0 [0095.139] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xf24, lpOverlapped=0x0) returned 1 [0095.147] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf30, lpOverlapped=0x0) returned 1 [0095.148] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.148] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.148] SetEndOfFile (hFile=0x180) returned 1 [0095.148] CloseHandle (hObject=0x180) returned 1 [0095.148] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.148] SetEndOfFile (hFile=0x1f4) returned 1 [0095.149] CloseHandle (hObject=0x1f4) returned 1 [0095.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1 [0095.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.150] lstrlenW (lpString=".doc") returned 4 [0095.150] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".docx") returned 5 [0095.150] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0095.150] lstrlenW (lpString=".pdf") returned 4 [0095.150] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".xls") returned 4 [0095.150] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".xlsx") returned 5 [0095.150] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0095.150] lstrlenW (lpString=".ppt") returned 4 [0095.150] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.150] lstrlenW (lpString=".zip") returned 4 [0095.150] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".rar") returned 4 [0095.150] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".bz2") returned 4 [0095.150] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString=".7z") returned 3 [0095.150] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.150] lstrlenW (lpString=".dbf") returned 4 [0095.150] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.150] lstrlenW (lpString=".1cd") returned 4 [0095.150] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0095.150] lstrlenW (lpString=".jpg") returned 4 [0095.150] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.150] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") [0095.151] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=49098) returned 1 [0095.151] CloseHandle (hObject=0x1f4) returned 1 [0095.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0095.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.151] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.151] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.152] GetLastError () returned 0x0 [0095.152] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbfca, lpOverlapped=0x0) returned 1 [0095.154] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0095.156] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.156] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.157] SetEndOfFile (hFile=0x180) returned 1 [0095.157] CloseHandle (hObject=0x180) returned 1 [0095.157] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.157] SetEndOfFile (hFile=0x1f4) returned 1 [0095.158] CloseHandle (hObject=0x1f4) returned 1 [0095.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1 [0095.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.158] lstrlenW (lpString=".doc") returned 4 [0095.158] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.158] lstrlenW (lpString=".docx") returned 5 [0095.158] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0095.158] lstrlenW (lpString=".pdf") returned 4 [0095.158] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString=".xls") returned 4 [0095.159] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString=".xlsx") returned 5 [0095.159] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0095.159] lstrlenW (lpString=".ppt") returned 4 [0095.159] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.159] lstrlenW (lpString=".zip") returned 4 [0095.159] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString=".rar") returned 4 [0095.159] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString=".bz2") returned 4 [0095.159] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString=".7z") returned 3 [0095.159] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.159] lstrlenW (lpString=".dbf") returned 4 [0095.159] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.159] lstrlenW (lpString=".1cd") returned 4 [0095.159] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0095.159] lstrlenW (lpString=".jpg") returned 4 [0095.159] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.159] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") [0095.160] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=50838) returned 1 [0095.160] CloseHandle (hObject=0x1f4) returned 1 [0095.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0095.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.160] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.160] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.161] GetLastError () returned 0x0 [0095.161] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc696, lpOverlapped=0x0) returned 1 [0095.163] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0095.165] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.165] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.165] SetEndOfFile (hFile=0x180) returned 1 [0095.226] CloseHandle (hObject=0x180) returned 1 [0095.226] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.226] SetEndOfFile (hFile=0x1f4) returned 1 [0095.227] CloseHandle (hObject=0x1f4) returned 1 [0095.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1 [0095.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.227] lstrlenW (lpString=".doc") returned 4 [0095.227] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.227] lstrlenW (lpString=".docx") returned 5 [0095.228] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0095.228] lstrlenW (lpString=".pdf") returned 4 [0095.228] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString=".xls") returned 4 [0095.228] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString=".xlsx") returned 5 [0095.228] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0095.228] lstrlenW (lpString=".ppt") returned 4 [0095.228] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.228] lstrlenW (lpString=".zip") returned 4 [0095.228] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString=".rar") returned 4 [0095.228] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString=".bz2") returned 4 [0095.228] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString=".7z") returned 3 [0095.228] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.228] lstrlenW (lpString=".dbf") returned 4 [0095.228] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.228] lstrlenW (lpString=".1cd") returned 4 [0095.228] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0095.228] lstrlenW (lpString=".jpg") returned 4 [0095.228] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.228] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") [0095.453] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=31497) returned 1 [0095.454] CloseHandle (hObject=0x158) returned 1 [0095.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 0x20 [0095.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.454] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.454] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.455] GetLastError () returned 0x0 [0095.455] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x7b09, lpOverlapped=0x0) returned 1 [0095.457] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7b10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x7b10, lpOverlapped=0x0) returned 1 [0095.458] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.458] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.458] SetEndOfFile (hFile=0x1ec) returned 1 [0095.458] CloseHandle (hObject=0x1ec) returned 1 [0095.458] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.458] SetEndOfFile (hFile=0x158) returned 1 [0095.459] CloseHandle (hObject=0x158) returned 1 [0095.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 1 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString=".doc") returned 4 [0095.460] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0095.460] lstrlenW (lpString=".docx") returned 5 [0095.460] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0095.460] lstrlenW (lpString=".pdf") returned 4 [0095.460] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0095.460] lstrlenW (lpString=".xls") returned 4 [0095.460] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0095.460] lstrlenW (lpString=".xlsx") returned 5 [0095.460] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0095.460] lstrlenW (lpString=".ppt") returned 4 [0095.460] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString=".zip") returned 4 [0095.460] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0095.460] lstrlenW (lpString=".rar") returned 4 [0095.460] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0095.460] lstrlenW (lpString=".bz2") returned 4 [0095.460] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0095.460] lstrlenW (lpString=".7z") returned 3 [0095.460] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString=".dbf") returned 4 [0095.460] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString=".1cd") returned 4 [0095.460] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0095.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0095.460] lstrlenW (lpString=".jpg") returned 4 [0095.460] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0095.461] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") [0095.461] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=270200) returned 1 [0095.461] CloseHandle (hObject=0x158) returned 1 [0095.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20 [0095.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.462] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.462] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.462] GetLastError () returned 0x0 [0095.462] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x41f78, lpOverlapped=0x0) returned 1 [0095.470] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x41f80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x41f80, lpOverlapped=0x0) returned 1 [0095.475] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.475] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.475] SetEndOfFile (hFile=0x1ec) returned 1 [0095.475] CloseHandle (hObject=0x1ec) returned 1 [0095.475] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.475] SetEndOfFile (hFile=0x158) returned 1 [0095.478] CloseHandle (hObject=0x158) returned 1 [0095.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 1 [0095.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.478] lstrlenW (lpString=".doc") returned 4 [0095.478] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0095.479] lstrlenW (lpString=".docx") returned 5 [0095.479] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0095.479] lstrlenW (lpString=".pdf") returned 4 [0095.479] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0095.479] lstrlenW (lpString=".xls") returned 4 [0095.479] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0095.479] lstrlenW (lpString=".xlsx") returned 5 [0095.479] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0095.479] lstrlenW (lpString=".ppt") returned 4 [0095.479] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0095.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.479] lstrlenW (lpString=".zip") returned 4 [0095.479] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0095.479] lstrlenW (lpString=".rar") returned 4 [0095.479] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0095.479] lstrlenW (lpString=".bz2") returned 4 [0095.479] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0095.479] lstrlenW (lpString=".7z") returned 3 [0095.479] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0095.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.479] lstrlenW (lpString=".dbf") returned 4 [0095.479] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0095.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.479] lstrlenW (lpString=".1cd") returned 4 [0095.479] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0095.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0095.479] lstrlenW (lpString=".jpg") returned 4 [0095.479] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0095.479] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") [0095.481] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=722296) returned 1 [0095.481] CloseHandle (hObject=0x158) returned 1 [0095.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 0x20 [0095.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.481] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.481] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.482] GetLastError () returned 0x0 [0095.482] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb0578, lpOverlapped=0x0) returned 1 [0095.596] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb0580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb0580, lpOverlapped=0x0) returned 1 [0095.609] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.609] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.609] SetEndOfFile (hFile=0x1ec) returned 1 [0095.609] CloseHandle (hObject=0x1ec) returned 1 [0095.609] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.609] SetEndOfFile (hFile=0x158) returned 1 [0095.615] CloseHandle (hObject=0x158) returned 1 [0095.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 1 [0095.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.616] lstrlenW (lpString=".doc") returned 4 [0095.616] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString=".docx") returned 5 [0095.616] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0095.616] lstrlenW (lpString=".pdf") returned 4 [0095.616] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString=".xls") returned 4 [0095.616] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString=".xlsx") returned 5 [0095.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0095.616] lstrlenW (lpString=".ppt") returned 4 [0095.616] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.616] lstrlenW (lpString=".zip") returned 4 [0095.616] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString=".rar") returned 4 [0095.616] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.616] lstrlenW (lpString=".bz2") returned 4 [0095.616] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.616] lstrlenW (lpString=".7z") returned 3 [0095.616] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.616] lstrlenW (lpString=".dbf") returned 4 [0095.617] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.617] lstrlenW (lpString=".1cd") returned 4 [0095.617] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0095.617] lstrlenW (lpString=".jpg") returned 4 [0095.617] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.617] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") [0095.618] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=37248) returned 1 [0095.618] CloseHandle (hObject=0x158) returned 1 [0095.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll")) returned 0x20 [0095.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.618] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.618] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.619] GetLastError () returned 0x0 [0095.619] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x9180, lpOverlapped=0x0) returned 1 [0095.726] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x9190, lpOverlapped=0x0) returned 1 [0095.728] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.728] SetEndOfFile (hFile=0x1ec) returned 1 [0095.733] CloseHandle (hObject=0x1ec) returned 1 [0095.734] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.734] SetEndOfFile (hFile=0x158) returned 1 [0095.735] CloseHandle (hObject=0x158) returned 1 [0095.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll")) returned 1 [0095.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.735] lstrlenW (lpString=".doc") returned 4 [0095.735] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString=".docx") returned 5 [0095.735] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0095.735] lstrlenW (lpString=".pdf") returned 4 [0095.735] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString=".xls") returned 4 [0095.735] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString=".xlsx") returned 5 [0095.735] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0095.735] lstrlenW (lpString=".ppt") returned 4 [0095.735] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.735] lstrlenW (lpString=".zip") returned 4 [0095.735] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString=".rar") returned 4 [0095.735] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.735] lstrlenW (lpString=".bz2") returned 4 [0095.735] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.736] lstrlenW (lpString=".7z") returned 3 [0095.736] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.736] lstrlenW (lpString=".dbf") returned 4 [0095.736] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.736] lstrlenW (lpString=".1cd") returned 4 [0095.736] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0095.736] lstrlenW (lpString=".jpg") returned 4 [0095.736] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.736] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") [0095.736] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11704) returned 1 [0095.736] CloseHandle (hObject=0x158) returned 1 [0095.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0095.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.737] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.737] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.737] GetLastError () returned 0x0 [0095.737] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2db8, lpOverlapped=0x0) returned 1 [0095.834] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2dc0, lpOverlapped=0x0) returned 1 [0095.835] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.836] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.836] SetEndOfFile (hFile=0x1ec) returned 1 [0095.836] CloseHandle (hObject=0x1ec) returned 1 [0095.836] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.836] SetEndOfFile (hFile=0x158) returned 1 [0095.837] CloseHandle (hObject=0x158) returned 1 [0095.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.837] lstrlenW (lpString=".doc") returned 4 [0095.837] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.837] lstrlenW (lpString=".docx") returned 5 [0095.837] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.837] lstrlenW (lpString=".pdf") returned 4 [0095.837] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.837] lstrlenW (lpString=".xls") returned 4 [0095.837] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.837] lstrlenW (lpString=".xlsx") returned 5 [0095.837] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.838] lstrlenW (lpString=".ppt") returned 4 [0095.838] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.838] lstrlenW (lpString=".zip") returned 4 [0095.838] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.838] lstrlenW (lpString=".rar") returned 4 [0095.838] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.838] lstrlenW (lpString=".bz2") returned 4 [0095.838] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.838] lstrlenW (lpString=".7z") returned 3 [0095.838] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.838] lstrlenW (lpString=".dbf") returned 4 [0095.838] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.838] lstrlenW (lpString=".1cd") returned 4 [0095.838] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0095.838] lstrlenW (lpString=".jpg") returned 4 [0095.838] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.838] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") [0095.839] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=15760) returned 1 [0095.839] CloseHandle (hObject=0x158) returned 1 [0095.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0095.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.839] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.839] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.840] GetLastError () returned 0x0 [0095.840] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3d90, lpOverlapped=0x0) returned 1 [0095.851] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0095.852] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0095.852] WriteFile (in: hFile=0x1ec, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0095.852] SetEndOfFile (hFile=0x1ec) returned 1 [0095.856] CloseHandle (hObject=0x1ec) returned 1 [0095.856] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0095.856] SetEndOfFile (hFile=0x158) returned 1 [0095.857] CloseHandle (hObject=0x158) returned 1 [0095.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1 [0096.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.008] lstrlenW (lpString=".doc") returned 4 [0096.008] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.008] lstrlenW (lpString=".docx") returned 5 [0096.008] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0096.008] lstrlenW (lpString=".pdf") returned 4 [0096.008] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.008] lstrlenW (lpString=".xls") returned 4 [0096.008] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.008] lstrlenW (lpString=".xlsx") returned 5 [0096.008] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0096.008] lstrlenW (lpString=".ppt") returned 4 [0096.008] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.008] lstrlenW (lpString=".zip") returned 4 [0096.008] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.008] lstrlenW (lpString=".rar") returned 4 [0096.008] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.008] lstrlenW (lpString=".bz2") returned 4 [0096.008] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.008] lstrlenW (lpString=".7z") returned 3 [0096.008] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.008] lstrlenW (lpString=".dbf") returned 4 [0096.009] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.009] lstrlenW (lpString=".1cd") returned 4 [0096.009] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0096.009] lstrlenW (lpString=".jpg") returned 4 [0096.009] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.009] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") [0096.038] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=29056) returned 1 [0096.038] CloseHandle (hObject=0x19c) returned 1 [0096.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0096.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.038] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.038] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0096.039] GetLastError () returned 0x0 [0096.039] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x7180, lpOverlapped=0x0) returned 1 [0096.041] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x7190, lpOverlapped=0x0) returned 1 [0096.043] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.043] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe0, lpOverlapped=0x0) returned 1 [0096.043] SetEndOfFile (hFile=0x1b8) returned 1 [0096.043] CloseHandle (hObject=0x1b8) returned 1 [0096.043] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.043] SetEndOfFile (hFile=0x19c) returned 1 [0096.044] CloseHandle (hObject=0x19c) returned 1 [0096.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.044] lstrlenW (lpString=".doc") returned 4 [0096.044] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.044] lstrlenW (lpString=".docx") returned 5 [0096.045] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0096.045] lstrlenW (lpString=".pdf") returned 4 [0096.045] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString=".xls") returned 4 [0096.045] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.045] lstrlenW (lpString=".xlsx") returned 5 [0096.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0096.045] lstrlenW (lpString=".ppt") returned 4 [0096.045] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.045] lstrlenW (lpString=".zip") returned 4 [0096.045] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.045] lstrlenW (lpString=".rar") returned 4 [0096.045] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString=".bz2") returned 4 [0096.045] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString=".7z") returned 3 [0096.045] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.045] lstrlenW (lpString=".dbf") returned 4 [0096.045] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.045] lstrlenW (lpString=".1cd") returned 4 [0096.045] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0096.045] lstrlenW (lpString=".jpg") returned 4 [0096.045] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.045] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") [0096.046] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=122280) returned 1 [0096.046] CloseHandle (hObject=0x19c) returned 1 [0096.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0096.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.046] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.046] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0096.047] GetLastError () returned 0x0 [0096.047] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0096.051] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1ddb0, lpOverlapped=0x0) returned 1 [0096.053] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.053] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.053] SetEndOfFile (hFile=0x1b8) returned 1 [0096.053] CloseHandle (hObject=0x1b8) returned 1 [0096.053] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.053] SetEndOfFile (hFile=0x19c) returned 1 [0096.055] CloseHandle (hObject=0x19c) returned 1 [0096.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1 [0096.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.055] lstrlenW (lpString=".doc") returned 4 [0096.055] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.055] lstrlenW (lpString=".docx") returned 5 [0096.055] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0096.055] lstrlenW (lpString=".pdf") returned 4 [0096.055] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.055] lstrlenW (lpString=".xls") returned 4 [0096.055] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.055] lstrlenW (lpString=".xlsx") returned 5 [0096.055] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0096.055] lstrlenW (lpString=".ppt") returned 4 [0096.055] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.055] lstrlenW (lpString=".zip") returned 4 [0096.055] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.056] lstrlenW (lpString=".rar") returned 4 [0096.056] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.056] lstrlenW (lpString=".bz2") returned 4 [0096.056] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.056] lstrlenW (lpString=".7z") returned 3 [0096.056] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.056] lstrlenW (lpString=".dbf") returned 4 [0096.056] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.056] lstrlenW (lpString=".1cd") returned 4 [0096.056] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0096.056] lstrlenW (lpString=".jpg") returned 4 [0096.056] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.056] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") [0096.100] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=71584) returned 1 [0096.100] CloseHandle (hObject=0x1c0) returned 1 [0096.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0096.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0096.101] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.101] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0096.327] GetLastError () returned 0x0 [0096.327] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x117a0, lpOverlapped=0x0) returned 1 [0096.346] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x117b0, lpOverlapped=0x0) returned 1 [0096.347] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.348] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.348] SetEndOfFile (hFile=0x16c) returned 1 [0096.348] CloseHandle (hObject=0x16c) returned 1 [0096.348] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.348] SetEndOfFile (hFile=0x1c0) returned 1 [0096.349] CloseHandle (hObject=0x1c0) returned 1 [0096.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1 [0096.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.349] lstrlenW (lpString=".doc") returned 4 [0096.350] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.350] lstrlenW (lpString=".docx") returned 5 [0096.350] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0096.350] lstrlenW (lpString=".pdf") returned 4 [0096.350] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.350] lstrlenW (lpString=".xls") returned 4 [0096.350] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.350] lstrlenW (lpString=".xlsx") returned 5 [0096.350] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0096.350] lstrlenW (lpString=".ppt") returned 4 [0096.350] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.350] lstrlenW (lpString=".zip") returned 4 [0096.350] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.350] lstrlenW (lpString=".rar") returned 4 [0096.350] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.350] lstrlenW (lpString=".bz2") returned 4 [0096.350] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.350] lstrlenW (lpString=".7z") returned 3 [0096.350] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.350] lstrlenW (lpString=".dbf") returned 4 [0096.350] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.350] lstrlenW (lpString=".1cd") returned 4 [0096.350] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0096.350] lstrlenW (lpString=".jpg") returned 4 [0096.350] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.350] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") [0096.351] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=594288) returned 1 [0096.351] CloseHandle (hObject=0x1c0) returned 1 [0096.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20 [0096.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0096.351] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.351] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0096.352] GetLastError () returned 0x0 [0096.352] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x91170, lpOverlapped=0x0) returned 1 [0096.368] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x91180, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x91180, lpOverlapped=0x0) returned 1 [0096.517] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.517] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.517] SetEndOfFile (hFile=0x16c) returned 1 [0096.517] CloseHandle (hObject=0x16c) returned 1 [0096.517] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.517] SetEndOfFile (hFile=0x1c0) returned 1 [0096.523] CloseHandle (hObject=0x1c0) returned 1 [0096.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 1 [0096.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.523] lstrlenW (lpString=".doc") returned 4 [0096.523] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.523] lstrlenW (lpString=".docx") returned 5 [0096.523] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0096.523] lstrlenW (lpString=".pdf") returned 4 [0096.523] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.524] lstrlenW (lpString=".xls") returned 4 [0096.524] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.524] lstrlenW (lpString=".xlsx") returned 5 [0096.524] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0096.524] lstrlenW (lpString=".ppt") returned 4 [0096.524] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.524] lstrlenW (lpString=".zip") returned 4 [0096.524] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.524] lstrlenW (lpString=".rar") returned 4 [0096.524] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.524] lstrlenW (lpString=".bz2") returned 4 [0096.524] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.524] lstrlenW (lpString=".7z") returned 3 [0096.524] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.524] lstrlenW (lpString=".dbf") returned 4 [0096.524] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.524] lstrlenW (lpString=".1cd") returned 4 [0096.524] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0096.524] lstrlenW (lpString=".jpg") returned 4 [0096.524] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.524] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") [0096.528] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1276776) returned 1 [0096.528] CloseHandle (hObject=0x1c0) returned 1 [0096.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 0x20 [0096.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0096.528] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.529] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0096.530] GetLastError () returned 0x0 [0096.530] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0096.552] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0096.787] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x37b78, lpOverlapped=0x0) returned 1 [0096.798] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x37b80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x37b80, lpOverlapped=0x0) returned 1 [0096.805] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.805] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.805] SetEndOfFile (hFile=0x16c) returned 1 [0096.805] CloseHandle (hObject=0x16c) returned 1 [0096.805] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.805] SetEndOfFile (hFile=0x1c0) returned 1 [0096.807] CloseHandle (hObject=0x1c0) returned 1 [0096.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 1 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString=".doc") returned 4 [0096.808] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString=".docx") returned 5 [0096.808] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0096.808] lstrlenW (lpString=".pdf") returned 4 [0096.808] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString=".xls") returned 4 [0096.808] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString=".xlsx") returned 5 [0096.808] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0096.808] lstrlenW (lpString=".ppt") returned 4 [0096.808] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString=".zip") returned 4 [0096.808] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString=".rar") returned 4 [0096.808] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.808] lstrlenW (lpString=".bz2") returned 4 [0096.808] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.808] lstrlenW (lpString=".7z") returned 3 [0096.808] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString=".dbf") returned 4 [0096.808] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString=".1cd") returned 4 [0096.808] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0096.808] lstrlenW (lpString=".jpg") returned 4 [0096.808] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.808] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") [0096.917] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=199016) returned 1 [0096.917] CloseHandle (hObject=0x1f4) returned 1 [0096.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe")) returned 0x20 [0096.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.918] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.918] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.918] GetLastError () returned 0x0 [0096.918] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x30968, lpOverlapped=0x0) returned 1 [0096.923] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x30970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x30970, lpOverlapped=0x0) returned 1 [0096.927] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.927] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.927] SetEndOfFile (hFile=0x19c) returned 1 [0096.927] CloseHandle (hObject=0x19c) returned 1 [0096.927] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.927] SetEndOfFile (hFile=0x1f4) returned 1 [0096.929] CloseHandle (hObject=0x1f4) returned 1 [0096.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe")) returned 1 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString=".doc") returned 4 [0096.930] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0096.930] lstrlenW (lpString=".docx") returned 5 [0096.930] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0096.930] lstrlenW (lpString=".pdf") returned 4 [0096.930] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0096.930] lstrlenW (lpString=".xls") returned 4 [0096.930] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0096.930] lstrlenW (lpString=".xlsx") returned 5 [0096.930] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0096.930] lstrlenW (lpString=".ppt") returned 4 [0096.930] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString=".zip") returned 4 [0096.930] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0096.930] lstrlenW (lpString=".rar") returned 4 [0096.930] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0096.930] lstrlenW (lpString=".bz2") returned 4 [0096.930] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0096.930] lstrlenW (lpString=".7z") returned 3 [0096.930] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString=".dbf") returned 4 [0096.930] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString=".1cd") returned 4 [0096.930] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0096.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0096.930] lstrlenW (lpString=".jpg") returned 4 [0096.930] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0096.931] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") [0096.932] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=260488) returned 1 [0096.932] CloseHandle (hObject=0x1f4) returned 1 [0096.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll")) returned 0x20 [0096.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.932] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.932] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.933] GetLastError () returned 0x0 [0096.933] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3f988, lpOverlapped=0x0) returned 1 [0096.939] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3f990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3f990, lpOverlapped=0x0) returned 1 [0096.943] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.943] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.943] SetEndOfFile (hFile=0x19c) returned 1 [0096.944] CloseHandle (hObject=0x19c) returned 1 [0096.944] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.944] SetEndOfFile (hFile=0x1f4) returned 1 [0096.946] CloseHandle (hObject=0x1f4) returned 1 [0096.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll")) returned 1 [0096.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.946] lstrlenW (lpString=".doc") returned 4 [0096.946] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.946] lstrlenW (lpString=".docx") returned 5 [0096.946] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0096.946] lstrlenW (lpString=".pdf") returned 4 [0096.946] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.946] lstrlenW (lpString=".xls") returned 4 [0096.947] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.947] lstrlenW (lpString=".xlsx") returned 5 [0096.947] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0096.947] lstrlenW (lpString=".ppt") returned 4 [0096.947] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.947] lstrlenW (lpString=".zip") returned 4 [0096.947] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.947] lstrlenW (lpString=".rar") returned 4 [0096.947] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.947] lstrlenW (lpString=".bz2") returned 4 [0096.947] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.947] lstrlenW (lpString=".7z") returned 3 [0096.947] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.947] lstrlenW (lpString=".dbf") returned 4 [0096.947] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.947] lstrlenW (lpString=".1cd") returned 4 [0096.947] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 55 [0096.947] lstrlenW (lpString=".jpg") returned 4 [0096.947] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.947] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") [0096.948] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=145312) returned 1 [0096.948] CloseHandle (hObject=0x1f4) returned 1 [0096.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll")) returned 0x20 [0096.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.948] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.948] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.949] GetLastError () returned 0x0 [0096.949] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x237a0, lpOverlapped=0x0) returned 1 [0096.953] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x237b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x237b0, lpOverlapped=0x0) returned 1 [0096.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.956] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.956] SetEndOfFile (hFile=0x19c) returned 1 [0096.956] CloseHandle (hObject=0x19c) returned 1 [0096.956] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.956] SetEndOfFile (hFile=0x1f4) returned 1 [0096.958] CloseHandle (hObject=0x1f4) returned 1 [0096.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll")) returned 1 [0096.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.958] lstrlenW (lpString=".doc") returned 4 [0096.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.958] lstrlenW (lpString=".docx") returned 5 [0096.959] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0096.959] lstrlenW (lpString=".pdf") returned 4 [0096.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.959] lstrlenW (lpString=".xls") returned 4 [0096.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.959] lstrlenW (lpString=".xlsx") returned 5 [0096.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0096.959] lstrlenW (lpString=".ppt") returned 4 [0096.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.959] lstrlenW (lpString=".zip") returned 4 [0096.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.959] lstrlenW (lpString=".rar") returned 4 [0096.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.959] lstrlenW (lpString=".bz2") returned 4 [0096.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.959] lstrlenW (lpString=".7z") returned 3 [0096.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.959] lstrlenW (lpString=".dbf") returned 4 [0096.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.959] lstrlenW (lpString=".1cd") returned 4 [0096.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 55 [0096.959] lstrlenW (lpString=".jpg") returned 4 [0096.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.959] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") [0096.960] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=154496) returned 1 [0096.960] CloseHandle (hObject=0x1f4) returned 1 [0096.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll")) returned 0x20 [0096.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.960] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.960] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.961] GetLastError () returned 0x0 [0096.961] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x25b80, lpOverlapped=0x0) returned 1 [0096.971] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x25b90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x25b90, lpOverlapped=0x0) returned 1 [0096.974] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0096.974] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.974] SetEndOfFile (hFile=0x19c) returned 1 [0096.974] CloseHandle (hObject=0x19c) returned 1 [0096.975] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0096.975] SetEndOfFile (hFile=0x1f4) returned 1 [0096.976] CloseHandle (hObject=0x1f4) returned 1 [0096.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll")) returned 1 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString=".doc") returned 4 [0096.977] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString=".docx") returned 5 [0096.977] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0096.977] lstrlenW (lpString=".pdf") returned 4 [0096.977] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString=".xls") returned 4 [0096.977] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString=".xlsx") returned 5 [0096.977] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0096.977] lstrlenW (lpString=".ppt") returned 4 [0096.977] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString=".zip") returned 4 [0096.977] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString=".rar") returned 4 [0096.977] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.977] lstrlenW (lpString=".bz2") returned 4 [0096.977] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.977] lstrlenW (lpString=".7z") returned 3 [0096.977] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString=".dbf") returned 4 [0096.977] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString=".1cd") returned 4 [0096.977] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 55 [0096.977] lstrlenW (lpString=".jpg") returned 4 [0096.977] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.978] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") [0096.978] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2125752) returned 1 [0096.978] CloseHandle (hObject=0x1f4) returned 1 [0096.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll")) returned 0x20 [0096.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0096.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.979] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0096.979] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0096.979] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.984] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xacfe8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0096.984] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.989] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0096.989] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1c6fb8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0096.989] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.027] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.027] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0097.042] SetEndOfFile (hFile=0x1f4) returned 1 [0097.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0097.076] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.076] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xacfe8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.077] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.079] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1c6fb8, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.079] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0097.081] CloseHandle (hObject=0x1f4) returned 1 [0097.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.081] lstrlenW (lpString=".doc") returned 4 [0097.081] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString=".docx") returned 5 [0097.081] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0097.081] lstrlenW (lpString=".pdf") returned 4 [0097.081] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString=".xls") returned 4 [0097.081] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString=".xlsx") returned 5 [0097.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0097.081] lstrlenW (lpString=".ppt") returned 4 [0097.081] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.081] lstrlenW (lpString=".zip") returned 4 [0097.081] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString=".rar") returned 4 [0097.081] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.081] lstrlenW (lpString=".bz2") returned 4 [0097.081] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.081] lstrlenW (lpString=".7z") returned 3 [0097.081] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.082] lstrlenW (lpString=".dbf") returned 4 [0097.082] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.082] lstrlenW (lpString=".1cd") returned 4 [0097.082] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55 [0097.082] lstrlenW (lpString=".jpg") returned 4 [0097.082] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.082] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") [0097.086] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=268672) returned 1 [0097.086] CloseHandle (hObject=0x1f4) returned 1 [0097.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 0x20 [0097.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.086] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.086] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0097.087] GetLastError () returned 0x0 [0097.087] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x41980, lpOverlapped=0x0) returned 1 [0097.131] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x41990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x41990, lpOverlapped=0x0) returned 1 [0097.144] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0097.144] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0097.144] SetEndOfFile (hFile=0x1c8) returned 1 [0097.145] CloseHandle (hObject=0x1c8) returned 1 [0097.145] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.145] SetEndOfFile (hFile=0x1f4) returned 1 [0097.148] CloseHandle (hObject=0x1f4) returned 1 [0097.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 1 [0097.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.148] lstrlenW (lpString=".doc") returned 4 [0097.148] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.148] lstrlenW (lpString=".docx") returned 5 [0097.148] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0097.148] lstrlenW (lpString=".pdf") returned 4 [0097.148] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.148] lstrlenW (lpString=".xls") returned 4 [0097.148] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.148] lstrlenW (lpString=".xlsx") returned 5 [0097.148] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0097.148] lstrlenW (lpString=".ppt") returned 4 [0097.148] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.148] lstrlenW (lpString=".zip") returned 4 [0097.148] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.149] lstrlenW (lpString=".rar") returned 4 [0097.149] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.149] lstrlenW (lpString=".bz2") returned 4 [0097.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.149] lstrlenW (lpString=".7z") returned 3 [0097.149] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.149] lstrlenW (lpString=".dbf") returned 4 [0097.149] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.149] lstrlenW (lpString=".1cd") returned 4 [0097.149] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0097.149] lstrlenW (lpString=".jpg") returned 4 [0097.149] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.149] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") [0097.150] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=85920) returned 1 [0097.150] CloseHandle (hObject=0x1f4) returned 1 [0097.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0097.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.151] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.151] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0097.152] GetLastError () returned 0x0 [0097.152] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x14fa0, lpOverlapped=0x0) returned 1 [0097.163] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x14fb0, lpOverlapped=0x0) returned 1 [0097.165] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0097.165] WriteFile (in: hFile=0x1c8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0097.166] SetEndOfFile (hFile=0x1c8) returned 1 [0097.166] CloseHandle (hObject=0x1c8) returned 1 [0097.166] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.166] SetEndOfFile (hFile=0x1f4) returned 1 [0097.167] CloseHandle (hObject=0x1f4) returned 1 [0097.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1 [0097.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.168] lstrlenW (lpString=".doc") returned 4 [0097.168] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".docx") returned 5 [0097.168] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0097.168] lstrlenW (lpString=".pdf") returned 4 [0097.168] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".xls") returned 4 [0097.168] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".xlsx") returned 5 [0097.168] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0097.168] lstrlenW (lpString=".ppt") returned 4 [0097.168] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.168] lstrlenW (lpString=".zip") returned 4 [0097.168] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".rar") returned 4 [0097.168] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".bz2") returned 4 [0097.168] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0097.168] lstrlenW (lpString=".7z") returned 3 [0097.168] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0097.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.169] lstrlenW (lpString=".dbf") returned 4 [0097.169] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0097.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.169] lstrlenW (lpString=".1cd") returned 4 [0097.169] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0097.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0097.169] lstrlenW (lpString=".jpg") returned 4 [0097.169] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0097.169] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") [0097.170] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=28232544) returned 1 [0097.170] CloseHandle (hObject=0x1f4) returned 1 [0097.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe")) returned 0x20 [0097.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0097.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0097.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0097.172] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.181] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8f9920, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0097.182] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.188] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0097.188] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1aacb60, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0097.188] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.205] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.205] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0097.511] SetEndOfFile (hFile=0x1f4) returned 1 [0097.511] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0097.511] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.511] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.512] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8f9920, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.512] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.514] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1aacb60, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0097.514] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.516] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0097.516] CloseHandle (hObject=0x1f4) returned 1 [0097.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.516] lstrlenW (lpString=".doc") returned 4 [0097.516] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0097.516] lstrlenW (lpString=".docx") returned 5 [0097.517] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0097.517] lstrlenW (lpString=".pdf") returned 4 [0097.517] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0097.517] lstrlenW (lpString=".xls") returned 4 [0097.517] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0097.517] lstrlenW (lpString=".xlsx") returned 5 [0097.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0097.517] lstrlenW (lpString=".ppt") returned 4 [0097.517] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0097.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.517] lstrlenW (lpString=".zip") returned 4 [0097.517] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0097.517] lstrlenW (lpString=".rar") returned 4 [0097.517] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0097.517] lstrlenW (lpString=".bz2") returned 4 [0097.517] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0097.517] lstrlenW (lpString=".7z") returned 3 [0097.517] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0097.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.517] lstrlenW (lpString=".dbf") returned 4 [0097.517] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0097.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.517] lstrlenW (lpString=".1cd") returned 4 [0097.517] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0097.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0097.517] lstrlenW (lpString=".jpg") returned 4 [0097.517] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0097.517] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") [0097.525] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1078) returned 1 [0097.525] CloseHandle (hObject=0x1f4) returned 1 [0097.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20 [0097.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.525] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.525] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.526] GetLastError () returned 0x0 [0097.526] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x436, lpOverlapped=0x0) returned 1 [0097.563] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x440, lpOverlapped=0x0) returned 1 [0097.564] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0097.564] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0097.564] SetEndOfFile (hFile=0x210) returned 1 [0097.564] CloseHandle (hObject=0x210) returned 1 [0097.564] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.564] SetEndOfFile (hFile=0x1f4) returned 1 [0097.753] CloseHandle (hObject=0x1f4) returned 1 [0097.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1 [0097.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.811] lstrlenW (lpString=".doc") returned 4 [0097.811] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0097.811] lstrlenW (lpString=".docx") returned 5 [0097.812] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0097.812] lstrlenW (lpString=".pdf") returned 4 [0097.813] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0097.813] lstrlenW (lpString=".xls") returned 4 [0097.816] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0097.816] lstrlenW (lpString=".xlsx") returned 5 [0097.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0097.817] lstrlenW (lpString=".ppt") returned 4 [0097.817] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0097.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.819] lstrlenW (lpString=".zip") returned 4 [0097.820] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0097.821] lstrlenW (lpString=".rar") returned 4 [0097.821] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0097.821] lstrlenW (lpString=".bz2") returned 4 [0097.822] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0097.822] lstrlenW (lpString=".7z") returned 3 [0097.823] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0097.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.825] lstrlenW (lpString=".dbf") returned 4 [0097.825] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0097.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.826] lstrlenW (lpString=".1cd") returned 4 [0097.826] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0097.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0097.827] lstrlenW (lpString=".jpg") returned 4 [0097.830] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0097.832] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") [0097.845] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0097.847] CloseHandle (hObject=0x1b4) returned 1 [0097.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20 [0097.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.861] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.865] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.902] GetLastError () returned 0x0 [0097.902] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0097.930] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0097.950] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0097.952] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0097.960] SetEndOfFile (hFile=0x1f4) returned 1 [0097.962] CloseHandle (hObject=0x1f4) returned 1 [0097.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.963] SetEndOfFile (hFile=0x1b4) returned 1 [0097.967] CloseHandle (hObject=0x1b4) returned 1 [0097.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1 [0097.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.970] lstrlenW (lpString=".doc") returned 4 [0097.970] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0097.970] lstrlenW (lpString=".docx") returned 5 [0097.970] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0097.970] lstrlenW (lpString=".pdf") returned 4 [0097.970] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0097.970] lstrlenW (lpString=".xls") returned 4 [0097.970] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0097.970] lstrlenW (lpString=".xlsx") returned 5 [0097.971] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0097.971] lstrlenW (lpString=".ppt") returned 4 [0097.971] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0097.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.971] lstrlenW (lpString=".zip") returned 4 [0097.971] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0097.971] lstrlenW (lpString=".rar") returned 4 [0097.971] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0097.972] lstrlenW (lpString=".bz2") returned 4 [0097.972] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0097.972] lstrlenW (lpString=".7z") returned 3 [0097.972] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0097.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.972] lstrlenW (lpString=".dbf") returned 4 [0097.972] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0097.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.972] lstrlenW (lpString=".1cd") returned 4 [0097.972] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0097.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0097.972] lstrlenW (lpString=".jpg") returned 4 [0097.972] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0097.972] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") [0097.975] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=320) returned 1 [0097.976] CloseHandle (hObject=0x1b4) returned 1 [0097.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0097.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.977] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.977] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0097.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0097.979] GetLastError () returned 0x0 [0097.979] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x140, lpOverlapped=0x0) returned 1 [0097.986] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x150, lpOverlapped=0x0) returned 1 [0097.995] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0097.995] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.003] SetEndOfFile (hFile=0x1f4) returned 1 [0098.003] CloseHandle (hObject=0x1f4) returned 1 [0098.003] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.003] SetEndOfFile (hFile=0x1b4) returned 1 [0098.004] CloseHandle (hObject=0x1b4) returned 1 [0098.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1 [0098.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.004] lstrlenW (lpString=".doc") returned 4 [0098.004] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.004] lstrlenW (lpString=".docx") returned 5 [0098.004] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.004] lstrlenW (lpString=".pdf") returned 4 [0098.004] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString=".xls") returned 4 [0098.005] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString=".xlsx") returned 5 [0098.005] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.005] lstrlenW (lpString=".ppt") returned 4 [0098.005] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.005] lstrlenW (lpString=".zip") returned 4 [0098.005] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString=".rar") returned 4 [0098.005] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString=".bz2") returned 4 [0098.005] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.005] lstrlenW (lpString=".7z") returned 3 [0098.005] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.005] lstrlenW (lpString=".dbf") returned 4 [0098.005] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.005] lstrlenW (lpString=".1cd") returned 4 [0098.005] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0098.005] lstrlenW (lpString=".jpg") returned 4 [0098.005] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.005] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") [0098.006] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=338) returned 1 [0098.007] CloseHandle (hObject=0x1b4) returned 1 [0098.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0098.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.007] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.007] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0098.007] GetLastError () returned 0x0 [0098.008] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x152, lpOverlapped=0x0) returned 1 [0098.008] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x160, lpOverlapped=0x0) returned 1 [0098.009] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.009] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.009] SetEndOfFile (hFile=0x1f4) returned 1 [0098.010] CloseHandle (hObject=0x1f4) returned 1 [0098.010] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.010] SetEndOfFile (hFile=0x1b4) returned 1 [0098.010] CloseHandle (hObject=0x1b4) returned 1 [0098.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1 [0098.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.011] lstrlenW (lpString=".doc") returned 4 [0098.011] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString=".docx") returned 5 [0098.011] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0098.011] lstrlenW (lpString=".pdf") returned 4 [0098.011] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString=".xls") returned 4 [0098.011] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString=".xlsx") returned 5 [0098.011] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0098.011] lstrlenW (lpString=".ppt") returned 4 [0098.011] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.011] lstrlenW (lpString=".zip") returned 4 [0098.011] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString=".rar") returned 4 [0098.011] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.011] lstrlenW (lpString=".bz2") returned 4 [0098.011] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.011] lstrlenW (lpString=".7z") returned 3 [0098.011] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.012] lstrlenW (lpString=".dbf") returned 4 [0098.012] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.012] lstrlenW (lpString=".1cd") returned 4 [0098.012] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0098.012] lstrlenW (lpString=".jpg") returned 4 [0098.012] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.012] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") [0098.013] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0098.013] CloseHandle (hObject=0x1b4) returned 1 [0098.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20 [0098.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.013] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.013] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0098.016] GetLastError () returned 0x0 [0098.016] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.017] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.018] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.018] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.018] SetEndOfFile (hFile=0x1f4) returned 1 [0098.019] CloseHandle (hObject=0x1f4) returned 1 [0098.019] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.019] SetEndOfFile (hFile=0x1b4) returned 1 [0098.019] CloseHandle (hObject=0x1b4) returned 1 [0098.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1 [0098.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.020] lstrlenW (lpString=".doc") returned 4 [0098.020] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.020] lstrlenW (lpString=".docx") returned 5 [0098.020] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0098.020] lstrlenW (lpString=".pdf") returned 4 [0098.020] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.020] lstrlenW (lpString=".xls") returned 4 [0098.020] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.020] lstrlenW (lpString=".xlsx") returned 5 [0098.020] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0098.020] lstrlenW (lpString=".ppt") returned 4 [0098.020] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.020] lstrlenW (lpString=".zip") returned 4 [0098.020] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.020] lstrlenW (lpString=".rar") returned 4 [0098.020] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.020] lstrlenW (lpString=".bz2") returned 4 [0098.020] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.020] lstrlenW (lpString=".7z") returned 3 [0098.020] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.021] lstrlenW (lpString=".dbf") returned 4 [0098.021] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.021] lstrlenW (lpString=".1cd") returned 4 [0098.021] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0098.021] lstrlenW (lpString=".jpg") returned 4 [0098.021] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.021] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") [0098.021] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=783) returned 1 [0098.021] CloseHandle (hObject=0x1b4) returned 1 [0098.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0098.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.022] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.022] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0098.022] GetLastError () returned 0x0 [0098.022] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x30f, lpOverlapped=0x0) returned 1 [0098.024] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.025] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.025] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.025] SetEndOfFile (hFile=0x1f4) returned 1 [0098.025] CloseHandle (hObject=0x1f4) returned 1 [0098.025] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.025] SetEndOfFile (hFile=0x1b4) returned 1 [0098.026] CloseHandle (hObject=0x1b4) returned 1 [0098.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1 [0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.027] lstrlenW (lpString=".doc") returned 4 [0098.027] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString=".docx") returned 5 [0098.027] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.027] lstrlenW (lpString=".pdf") returned 4 [0098.027] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString=".xls") returned 4 [0098.027] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString=".xlsx") returned 5 [0098.027] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.027] lstrlenW (lpString=".ppt") returned 4 [0098.027] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.027] lstrlenW (lpString=".zip") returned 4 [0098.027] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString=".rar") returned 4 [0098.027] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString=".bz2") returned 4 [0098.027] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.027] lstrlenW (lpString=".7z") returned 3 [0098.027] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.027] lstrlenW (lpString=".dbf") returned 4 [0098.027] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.027] lstrlenW (lpString=".1cd") returned 4 [0098.028] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0098.028] lstrlenW (lpString=".jpg") returned 4 [0098.028] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.028] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") [0098.028] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1078) returned 1 [0098.028] CloseHandle (hObject=0x1b4) returned 1 [0098.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20 [0098.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.028] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.029] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0098.029] GetLastError () returned 0x0 [0098.029] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x436, lpOverlapped=0x0) returned 1 [0098.031] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.031] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.032] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.032] SetEndOfFile (hFile=0x1f4) returned 1 [0098.032] CloseHandle (hObject=0x1f4) returned 1 [0098.032] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.032] SetEndOfFile (hFile=0x1b4) returned 1 [0098.033] CloseHandle (hObject=0x1b4) returned 1 [0098.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1 [0098.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.033] lstrlenW (lpString=".doc") returned 4 [0098.033] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.033] lstrlenW (lpString=".docx") returned 5 [0098.033] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.033] lstrlenW (lpString=".pdf") returned 4 [0098.033] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.033] lstrlenW (lpString=".xls") returned 4 [0098.033] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.033] lstrlenW (lpString=".xlsx") returned 5 [0098.033] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.033] lstrlenW (lpString=".ppt") returned 4 [0098.033] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.033] lstrlenW (lpString=".zip") returned 4 [0098.033] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.033] lstrlenW (lpString=".rar") returned 4 [0098.033] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.034] lstrlenW (lpString=".bz2") returned 4 [0098.034] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.034] lstrlenW (lpString=".7z") returned 3 [0098.034] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.034] lstrlenW (lpString=".dbf") returned 4 [0098.034] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.034] lstrlenW (lpString=".1cd") returned 4 [0098.034] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0098.034] lstrlenW (lpString=".jpg") returned 4 [0098.034] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.034] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") [0098.034] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0098.035] CloseHandle (hObject=0x1b4) returned 1 [0098.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20 [0098.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.035] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.035] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0098.035] GetLastError () returned 0x0 [0098.035] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.202] ReadFile (in: hFile=0x1b4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.202] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.202] SetEndOfFile (hFile=0x1f4) returned 1 [0098.203] CloseHandle (hObject=0x1f4) returned 1 [0098.203] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.203] SetEndOfFile (hFile=0x1b4) returned 1 [0098.203] CloseHandle (hObject=0x1b4) returned 1 [0098.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1 [0098.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.204] lstrlenW (lpString=".doc") returned 4 [0098.204] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.204] lstrlenW (lpString=".docx") returned 5 [0098.204] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.204] lstrlenW (lpString=".pdf") returned 4 [0098.204] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.204] lstrlenW (lpString=".xls") returned 4 [0098.204] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.204] lstrlenW (lpString=".xlsx") returned 5 [0098.204] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.204] lstrlenW (lpString=".ppt") returned 4 [0098.204] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.204] lstrlenW (lpString=".zip") returned 4 [0098.204] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.204] lstrlenW (lpString=".rar") returned 4 [0098.204] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.204] lstrlenW (lpString=".bz2") returned 4 [0098.204] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.205] lstrlenW (lpString=".7z") returned 3 [0098.205] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.205] lstrlenW (lpString=".dbf") returned 4 [0098.205] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.205] lstrlenW (lpString=".1cd") returned 4 [0098.205] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0098.205] lstrlenW (lpString=".jpg") returned 4 [0098.205] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.205] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") [0098.372] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1078) returned 1 [0098.372] CloseHandle (hObject=0x210) returned 1 [0098.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 0x20 [0098.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.372] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.372] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.373] GetLastError () returned 0x0 [0098.373] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x436, lpOverlapped=0x0) returned 1 [0098.376] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.377] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.377] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.377] SetEndOfFile (hFile=0x19c) returned 1 [0098.377] CloseHandle (hObject=0x19c) returned 1 [0098.377] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.377] SetEndOfFile (hFile=0x210) returned 1 [0098.378] CloseHandle (hObject=0x210) returned 1 [0098.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 1 [0098.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.378] lstrlenW (lpString=".doc") returned 4 [0098.378] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.378] lstrlenW (lpString=".docx") returned 5 [0098.378] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.378] lstrlenW (lpString=".pdf") returned 4 [0098.378] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.378] lstrlenW (lpString=".xls") returned 4 [0098.379] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.379] lstrlenW (lpString=".xlsx") returned 5 [0098.379] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.379] lstrlenW (lpString=".ppt") returned 4 [0098.379] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.379] lstrlenW (lpString=".zip") returned 4 [0098.379] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.379] lstrlenW (lpString=".rar") returned 4 [0098.379] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.379] lstrlenW (lpString=".bz2") returned 4 [0098.379] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.379] lstrlenW (lpString=".7z") returned 3 [0098.379] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.379] lstrlenW (lpString=".dbf") returned 4 [0098.379] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.379] lstrlenW (lpString=".1cd") returned 4 [0098.379] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0098.379] lstrlenW (lpString=".jpg") returned 4 [0098.379] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.379] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") [0098.381] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=781) returned 1 [0098.381] CloseHandle (hObject=0x19c) returned 1 [0098.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0098.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.381] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.381] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.433] GetLastError () returned 0x0 [0098.433] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x30d, lpOverlapped=0x0) returned 1 [0098.487] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.488] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.488] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.488] SetEndOfFile (hFile=0x15c) returned 1 [0098.498] CloseHandle (hObject=0x15c) returned 1 [0098.498] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.498] SetEndOfFile (hFile=0x19c) returned 1 [0098.499] CloseHandle (hObject=0x19c) returned 1 [0098.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.508] lstrlenW (lpString=".doc") returned 4 [0098.508] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString=".docx") returned 5 [0098.508] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0098.508] lstrlenW (lpString=".pdf") returned 4 [0098.508] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString=".xls") returned 4 [0098.508] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString=".xlsx") returned 5 [0098.508] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0098.508] lstrlenW (lpString=".ppt") returned 4 [0098.508] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.508] lstrlenW (lpString=".zip") returned 4 [0098.508] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString=".rar") returned 4 [0098.508] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.508] lstrlenW (lpString=".bz2") returned 4 [0098.508] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.508] lstrlenW (lpString=".7z") returned 3 [0098.508] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.509] lstrlenW (lpString=".dbf") returned 4 [0098.509] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.509] lstrlenW (lpString=".1cd") returned 4 [0098.509] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0098.509] lstrlenW (lpString=".jpg") returned 4 [0098.509] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.509] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") [0098.539] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1617) returned 1 [0098.539] CloseHandle (hObject=0x22c) returned 1 [0098.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 0x20 [0098.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.540] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.540] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.540] GetLastError () returned 0x0 [0098.540] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x651, lpOverlapped=0x0) returned 1 [0098.555] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x660, lpOverlapped=0x0) returned 1 [0098.556] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.556] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0098.556] SetEndOfFile (hFile=0x1fc) returned 1 [0098.556] CloseHandle (hObject=0x1fc) returned 1 [0098.556] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.556] SetEndOfFile (hFile=0x22c) returned 1 [0098.559] CloseHandle (hObject=0x22c) returned 1 [0098.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 1 [0098.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.560] lstrlenW (lpString=".doc") returned 4 [0098.560] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString=".docx") returned 5 [0098.560] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0098.560] lstrlenW (lpString=".pdf") returned 4 [0098.560] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString=".xls") returned 4 [0098.560] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString=".xlsx") returned 5 [0098.560] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0098.560] lstrlenW (lpString=".ppt") returned 4 [0098.560] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.560] lstrlenW (lpString=".zip") returned 4 [0098.560] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString=".rar") returned 4 [0098.560] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString=".bz2") returned 4 [0098.560] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.560] lstrlenW (lpString=".7z") returned 3 [0098.560] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.560] lstrlenW (lpString=".dbf") returned 4 [0098.560] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.560] lstrlenW (lpString=".1cd") returned 4 [0098.561] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0098.561] lstrlenW (lpString=".jpg") returned 4 [0098.561] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.561] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") [0098.575] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0098.575] CloseHandle (hObject=0x22c) returned 1 [0098.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 0x20 [0098.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.576] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.576] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.576] GetLastError () returned 0x0 [0098.576] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.600] ReadFile (in: hFile=0x22c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0098.600] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.600] SetEndOfFile (hFile=0x1fc) returned 1 [0098.600] CloseHandle (hObject=0x1fc) returned 1 [0098.600] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.601] SetEndOfFile (hFile=0x22c) returned 1 [0098.601] CloseHandle (hObject=0x22c) returned 1 [0098.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 1 [0098.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.776] lstrlenW (lpString=".doc") returned 4 [0098.776] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.776] lstrlenW (lpString=".docx") returned 5 [0098.776] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.776] lstrlenW (lpString=".pdf") returned 4 [0098.776] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.776] lstrlenW (lpString=".xls") returned 4 [0098.776] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.776] lstrlenW (lpString=".xlsx") returned 5 [0098.776] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.776] lstrlenW (lpString=".ppt") returned 4 [0098.776] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.776] lstrlenW (lpString=".zip") returned 4 [0098.776] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.776] lstrlenW (lpString=".rar") returned 4 [0098.777] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.777] lstrlenW (lpString=".bz2") returned 4 [0098.777] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.777] lstrlenW (lpString=".7z") returned 3 [0098.777] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.777] lstrlenW (lpString=".dbf") returned 4 [0098.777] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.777] lstrlenW (lpString=".1cd") returned 4 [0098.777] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0098.777] lstrlenW (lpString=".jpg") returned 4 [0098.777] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.777] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") [0098.815] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=779) returned 1 [0098.815] CloseHandle (hObject=0x158) returned 1 [0098.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 0x20 [0098.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.826] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.826] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0098.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.122] GetLastError () returned 0x0 [0099.122] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x30b, lpOverlapped=0x0) returned 1 [0099.123] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x310, lpOverlapped=0x0) returned 1 [0099.124] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.124] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.124] SetEndOfFile (hFile=0x158) returned 1 [0099.124] CloseHandle (hObject=0x158) returned 1 [0099.124] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.124] SetEndOfFile (hFile=0x1a0) returned 1 [0099.125] CloseHandle (hObject=0x1a0) returned 1 [0099.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 1 [0099.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.125] lstrlenW (lpString=".doc") returned 4 [0099.126] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString=".docx") returned 5 [0099.126] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0099.126] lstrlenW (lpString=".pdf") returned 4 [0099.126] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString=".xls") returned 4 [0099.126] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString=".xlsx") returned 5 [0099.126] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0099.126] lstrlenW (lpString=".ppt") returned 4 [0099.126] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.126] lstrlenW (lpString=".zip") returned 4 [0099.126] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString=".rar") returned 4 [0099.126] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString=".bz2") returned 4 [0099.126] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.126] lstrlenW (lpString=".7z") returned 3 [0099.126] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.126] lstrlenW (lpString=".dbf") returned 4 [0099.126] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.126] lstrlenW (lpString=".1cd") returned 4 [0099.126] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0099.126] lstrlenW (lpString=".jpg") returned 4 [0099.126] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.126] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") [0099.127] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1078) returned 1 [0099.127] CloseHandle (hObject=0x1a0) returned 1 [0099.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 0x20 [0099.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.127] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.127] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.128] GetLastError () returned 0x0 [0099.128] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x436, lpOverlapped=0x0) returned 1 [0099.130] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.131] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.131] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.131] SetEndOfFile (hFile=0x158) returned 1 [0099.131] CloseHandle (hObject=0x158) returned 1 [0099.131] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.131] SetEndOfFile (hFile=0x1a0) returned 1 [0099.132] CloseHandle (hObject=0x1a0) returned 1 [0099.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 1 [0099.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.132] lstrlenW (lpString=".doc") returned 4 [0099.132] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.132] lstrlenW (lpString=".docx") returned 5 [0099.132] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.132] lstrlenW (lpString=".pdf") returned 4 [0099.132] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.132] lstrlenW (lpString=".xls") returned 4 [0099.132] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.132] lstrlenW (lpString=".xlsx") returned 5 [0099.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.132] lstrlenW (lpString=".ppt") returned 4 [0099.133] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.133] lstrlenW (lpString=".zip") returned 4 [0099.133] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.133] lstrlenW (lpString=".rar") returned 4 [0099.133] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.133] lstrlenW (lpString=".bz2") returned 4 [0099.133] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.133] lstrlenW (lpString=".7z") returned 3 [0099.133] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.133] lstrlenW (lpString=".dbf") returned 4 [0099.133] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.133] lstrlenW (lpString=".1cd") returned 4 [0099.133] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0099.133] lstrlenW (lpString=".jpg") returned 4 [0099.133] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.141] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") [0099.142] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0099.142] CloseHandle (hObject=0x1a0) returned 1 [0099.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 0x20 [0099.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.142] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.142] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.143] GetLastError () returned 0x0 [0099.143] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.145] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.146] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.146] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.146] SetEndOfFile (hFile=0x158) returned 1 [0099.146] CloseHandle (hObject=0x158) returned 1 [0099.146] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.146] SetEndOfFile (hFile=0x1a0) returned 1 [0099.147] CloseHandle (hObject=0x1a0) returned 1 [0099.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 1 [0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.147] lstrlenW (lpString=".doc") returned 4 [0099.147] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.147] lstrlenW (lpString=".docx") returned 5 [0099.147] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.147] lstrlenW (lpString=".pdf") returned 4 [0099.148] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.148] lstrlenW (lpString=".xls") returned 4 [0099.148] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.148] lstrlenW (lpString=".xlsx") returned 5 [0099.148] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.148] lstrlenW (lpString=".ppt") returned 4 [0099.148] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.148] lstrlenW (lpString=".zip") returned 4 [0099.148] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.148] lstrlenW (lpString=".rar") returned 4 [0099.148] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.148] lstrlenW (lpString=".bz2") returned 4 [0099.148] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.148] lstrlenW (lpString=".7z") returned 3 [0099.148] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.148] lstrlenW (lpString=".dbf") returned 4 [0099.148] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.148] lstrlenW (lpString=".1cd") returned 4 [0099.148] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0099.148] lstrlenW (lpString=".jpg") returned 4 [0099.148] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.148] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") [0099.149] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=647) returned 1 [0099.149] CloseHandle (hObject=0x1a0) returned 1 [0099.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 0x20 [0099.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.149] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.150] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.150] GetLastError () returned 0x0 [0099.150] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x287, lpOverlapped=0x0) returned 1 [0099.151] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x290, lpOverlapped=0x0) returned 1 [0099.152] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.152] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.152] SetEndOfFile (hFile=0x158) returned 1 [0099.152] CloseHandle (hObject=0x158) returned 1 [0099.152] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.152] SetEndOfFile (hFile=0x1a0) returned 1 [0099.153] CloseHandle (hObject=0x1a0) returned 1 [0099.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 1 [0099.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.153] lstrlenW (lpString=".doc") returned 4 [0099.153] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString=".docx") returned 5 [0099.154] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0099.154] lstrlenW (lpString=".pdf") returned 4 [0099.154] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString=".xls") returned 4 [0099.154] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString=".xlsx") returned 5 [0099.154] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0099.154] lstrlenW (lpString=".ppt") returned 4 [0099.154] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.154] lstrlenW (lpString=".zip") returned 4 [0099.154] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString=".rar") returned 4 [0099.154] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString=".bz2") returned 4 [0099.154] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.154] lstrlenW (lpString=".7z") returned 3 [0099.154] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.154] lstrlenW (lpString=".dbf") returned 4 [0099.154] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.154] lstrlenW (lpString=".1cd") returned 4 [0099.154] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0099.154] lstrlenW (lpString=".jpg") returned 4 [0099.154] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.154] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") [0099.155] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1078) returned 1 [0099.155] CloseHandle (hObject=0x1a0) returned 1 [0099.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 0x20 [0099.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.155] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.155] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.156] GetLastError () returned 0x0 [0099.156] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x436, lpOverlapped=0x0) returned 1 [0099.157] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.158] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.158] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.159] SetEndOfFile (hFile=0x158) returned 1 [0099.159] CloseHandle (hObject=0x158) returned 1 [0099.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.159] SetEndOfFile (hFile=0x1a0) returned 1 [0099.160] CloseHandle (hObject=0x1a0) returned 1 [0099.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 1 [0099.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.160] lstrlenW (lpString=".doc") returned 4 [0099.160] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.160] lstrlenW (lpString=".docx") returned 5 [0099.160] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.160] lstrlenW (lpString=".pdf") returned 4 [0099.160] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.160] lstrlenW (lpString=".xls") returned 4 [0099.160] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.160] lstrlenW (lpString=".xlsx") returned 5 [0099.160] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.160] lstrlenW (lpString=".ppt") returned 4 [0099.160] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.160] lstrlenW (lpString=".zip") returned 4 [0099.160] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.160] lstrlenW (lpString=".rar") returned 4 [0099.160] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.160] lstrlenW (lpString=".bz2") returned 4 [0099.161] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.161] lstrlenW (lpString=".7z") returned 3 [0099.161] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.161] lstrlenW (lpString=".dbf") returned 4 [0099.161] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.161] lstrlenW (lpString=".1cd") returned 4 [0099.161] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0099.161] lstrlenW (lpString=".jpg") returned 4 [0099.161] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.161] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") [0099.161] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2998) returned 1 [0099.161] CloseHandle (hObject=0x1a0) returned 1 [0099.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 0x20 [0099.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0099.162] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.162] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.162] GetLastError () returned 0x0 [0099.162] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.271] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.272] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0099.272] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.272] SetEndOfFile (hFile=0x158) returned 1 [0099.422] CloseHandle (hObject=0x158) returned 1 [0099.432] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.432] SetEndOfFile (hFile=0x1a0) returned 1 [0099.439] CloseHandle (hObject=0x1a0) returned 1 [0099.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 1 [0099.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.479] lstrlenW (lpString=".doc") returned 4 [0099.479] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.479] lstrlenW (lpString=".docx") returned 5 [0099.479] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.480] lstrlenW (lpString=".pdf") returned 4 [0099.480] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.480] lstrlenW (lpString=".xls") returned 4 [0099.480] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.480] lstrlenW (lpString=".xlsx") returned 5 [0099.486] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.494] lstrlenW (lpString=".ppt") returned 4 [0099.494] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.494] lstrlenW (lpString=".zip") returned 4 [0099.494] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.494] lstrlenW (lpString=".rar") returned 4 [0099.494] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.494] lstrlenW (lpString=".bz2") returned 4 [0099.494] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.494] lstrlenW (lpString=".7z") returned 3 [0099.494] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.495] lstrlenW (lpString=".dbf") returned 4 [0099.495] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.523] lstrlenW (lpString=".1cd") returned 4 [0099.523] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0099.524] lstrlenW (lpString=".jpg") returned 4 [0099.524] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.524] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") [0099.525] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2542440) returned 1 [0099.525] CloseHandle (hObject=0x22c) returned 1 [0099.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll")) returned 0x20 [0099.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0099.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.527] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0099.527] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0099.527] ReadFile (in: hFile=0x22c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.530] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcee78, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0099.530] ReadFile (in: hFile=0x22c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.542] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0099.542] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x22cb68, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0099.542] ReadFile (in: hFile=0x22c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.558] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0099.559] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0099.705] SetEndOfFile (hFile=0x22c) returned 1 [0099.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0099.714] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0099.714] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.721] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcee78, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0099.721] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.762] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x22cb68, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0099.762] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0099.765] CloseHandle (hObject=0x22c) returned 1 [0099.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString=".doc") returned 4 [0099.766] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString=".docx") returned 5 [0099.766] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0099.766] lstrlenW (lpString=".pdf") returned 4 [0099.766] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString=".xls") returned 4 [0099.766] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString=".xlsx") returned 5 [0099.766] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0099.766] lstrlenW (lpString=".ppt") returned 4 [0099.766] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString=".zip") returned 4 [0099.766] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString=".rar") returned 4 [0099.766] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.766] lstrlenW (lpString=".bz2") returned 4 [0099.766] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.766] lstrlenW (lpString=".7z") returned 3 [0099.766] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString=".dbf") returned 4 [0099.766] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString=".1cd") returned 4 [0099.766] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0099.766] lstrlenW (lpString=".jpg") returned 4 [0099.766] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.767] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") [0100.029] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3114368) returned 1 [0100.029] CloseHandle (hObject=0x210) returned 1 [0100.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll")) returned 0x20 [0100.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0100.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.031] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0100.031] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0100.031] ReadFile (in: hFile=0x210, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.035] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfd72a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0100.035] ReadFile (in: hFile=0x210, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.045] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0100.045] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2b8580, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0100.046] ReadFile (in: hFile=0x210, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.062] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0100.162] SetEndOfFile (hFile=0x210) returned 1 [0100.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0100.162] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0100.162] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.163] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfd72a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0100.163] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.168] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2b8580, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0100.168] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.170] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0100.170] CloseHandle (hObject=0x210) returned 1 [0100.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString=".doc") returned 4 [0100.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString=".docx") returned 5 [0100.171] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0100.171] lstrlenW (lpString=".pdf") returned 4 [0100.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString=".xls") returned 4 [0100.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString=".xlsx") returned 5 [0100.171] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0100.171] lstrlenW (lpString=".ppt") returned 4 [0100.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString=".zip") returned 4 [0100.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString=".rar") returned 4 [0100.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.171] lstrlenW (lpString=".bz2") returned 4 [0100.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.171] lstrlenW (lpString=".7z") returned 3 [0100.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString=".dbf") returned 4 [0100.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString=".1cd") returned 4 [0100.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0100.171] lstrlenW (lpString=".jpg") returned 4 [0100.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.171] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") [0100.380] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=766) returned 1 [0100.381] CloseHandle (hObject=0x15c) returned 1 [0100.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico")) returned 0x20 [0100.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.381] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.381] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.382] GetLastError () returned 0x0 [0100.382] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2fe, lpOverlapped=0x0) returned 1 [0100.384] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x300, lpOverlapped=0x0) returned 1 [0100.385] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.385] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0100.385] SetEndOfFile (hFile=0x19c) returned 1 [0100.385] CloseHandle (hObject=0x19c) returned 1 [0100.385] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.385] SetEndOfFile (hFile=0x15c) returned 1 [0100.386] CloseHandle (hObject=0x15c) returned 1 [0100.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico")) returned 1 [0100.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.386] lstrlenW (lpString=".doc") returned 4 [0100.386] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.386] lstrlenW (lpString=".docx") returned 5 [0100.386] lstrcmpiW (lpString1=".docx", lpString2="H.ICO") returned -1 [0100.386] lstrlenW (lpString=".pdf") returned 4 [0100.386] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.386] lstrlenW (lpString=".xls") returned 4 [0100.386] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.386] lstrlenW (lpString=".xlsx") returned 5 [0100.386] lstrcmpiW (lpString1=".xlsx", lpString2="H.ICO") returned -1 [0100.386] lstrlenW (lpString=".ppt") returned 4 [0100.387] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.387] lstrlenW (lpString=".zip") returned 4 [0100.387] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.387] lstrlenW (lpString=".rar") returned 4 [0100.387] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.387] lstrlenW (lpString=".bz2") returned 4 [0100.387] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.387] lstrlenW (lpString=".7z") returned 3 [0100.387] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.387] lstrlenW (lpString=".dbf") returned 4 [0100.387] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.387] lstrlenW (lpString=".1cd") returned 4 [0100.387] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0100.387] lstrlenW (lpString=".jpg") returned 4 [0100.387] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.387] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") [0100.389] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=318) returned 1 [0100.389] CloseHandle (hObject=0x15c) returned 1 [0100.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico")) returned 0x20 [0100.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.389] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.389] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.390] GetLastError () returned 0x0 [0100.390] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.391] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.392] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.392] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.392] SetEndOfFile (hFile=0x19c) returned 1 [0100.392] CloseHandle (hObject=0x19c) returned 1 [0100.392] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.392] SetEndOfFile (hFile=0x15c) returned 1 [0100.393] CloseHandle (hObject=0x15c) returned 1 [0100.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico")) returned 1 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString=".doc") returned 4 [0100.394] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.394] lstrlenW (lpString=".docx") returned 5 [0100.394] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0100.394] lstrlenW (lpString=".pdf") returned 4 [0100.394] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.394] lstrlenW (lpString=".xls") returned 4 [0100.394] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.394] lstrlenW (lpString=".xlsx") returned 5 [0100.394] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0100.394] lstrlenW (lpString=".ppt") returned 4 [0100.394] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString=".zip") returned 4 [0100.394] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.394] lstrlenW (lpString=".rar") returned 4 [0100.394] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.394] lstrlenW (lpString=".bz2") returned 4 [0100.394] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.394] lstrlenW (lpString=".7z") returned 3 [0100.394] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString=".dbf") returned 4 [0100.394] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString=".1cd") returned 4 [0100.394] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0100.394] lstrlenW (lpString=".jpg") returned 4 [0100.395] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.395] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") [0100.396] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=131614) returned 1 [0100.396] CloseHandle (hObject=0x15c) returned 1 [0100.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt")) returned 0x20 [0100.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.396] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.396] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.398] GetLastError () returned 0x0 [0100.398] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2021e, lpOverlapped=0x0) returned 1 [0100.402] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x20220, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x20220, lpOverlapped=0x0) returned 1 [0100.405] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.405] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfc, lpOverlapped=0x0) returned 1 [0100.405] SetEndOfFile (hFile=0x19c) returned 1 [0100.405] CloseHandle (hObject=0x19c) returned 1 [0100.405] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.405] SetEndOfFile (hFile=0x15c) returned 1 [0100.406] CloseHandle (hObject=0x15c) returned 1 [0100.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt")) returned 1 [0100.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.407] lstrlenW (lpString=".doc") returned 4 [0100.407] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.407] lstrlenW (lpString=".docx") returned 5 [0100.407] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0100.407] lstrlenW (lpString=".pdf") returned 4 [0100.407] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.407] lstrlenW (lpString=".xls") returned 4 [0100.407] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.407] lstrlenW (lpString=".xlsx") returned 5 [0100.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0100.407] lstrlenW (lpString=".ppt") returned 4 [0100.407] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.407] lstrlenW (lpString=".zip") returned 4 [0100.407] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.407] lstrlenW (lpString=".rar") returned 4 [0100.407] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.407] lstrlenW (lpString=".bz2") returned 4 [0100.407] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.408] lstrlenW (lpString=".7z") returned 3 [0100.408] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.408] lstrlenW (lpString=".dbf") returned 4 [0100.408] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.408] lstrlenW (lpString=".1cd") returned 4 [0100.408] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0100.408] lstrlenW (lpString=".jpg") returned 4 [0100.408] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.408] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") [0100.409] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=133955) returned 1 [0100.409] CloseHandle (hObject=0x15c) returned 1 [0100.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt")) returned 0x20 [0100.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.409] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.409] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.410] GetLastError () returned 0x0 [0100.410] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x20b43, lpOverlapped=0x0) returned 1 [0100.415] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x20b50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x20b50, lpOverlapped=0x0) returned 1 [0100.418] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.418] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfc, lpOverlapped=0x0) returned 1 [0100.418] SetEndOfFile (hFile=0x19c) returned 1 [0100.418] CloseHandle (hObject=0x19c) returned 1 [0100.418] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.418] SetEndOfFile (hFile=0x15c) returned 1 [0100.420] CloseHandle (hObject=0x15c) returned 1 [0100.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt")) returned 1 [0100.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.420] lstrlenW (lpString=".doc") returned 4 [0100.420] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.420] lstrlenW (lpString=".docx") returned 5 [0100.420] lstrcmpiW (lpString1=".docx", lpString2="r.fdt") returned -1 [0100.420] lstrlenW (lpString=".pdf") returned 4 [0100.420] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.420] lstrlenW (lpString=".xls") returned 4 [0100.420] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.420] lstrlenW (lpString=".xlsx") returned 5 [0100.420] lstrcmpiW (lpString1=".xlsx", lpString2="r.fdt") returned -1 [0100.420] lstrlenW (lpString=".ppt") returned 4 [0100.420] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.420] lstrlenW (lpString=".zip") returned 4 [0100.421] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.421] lstrlenW (lpString=".rar") returned 4 [0100.421] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.421] lstrlenW (lpString=".bz2") returned 4 [0100.421] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.421] lstrlenW (lpString=".7z") returned 3 [0100.421] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.421] lstrlenW (lpString=".dbf") returned 4 [0100.421] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.421] lstrlenW (lpString=".1cd") returned 4 [0100.421] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0100.421] lstrlenW (lpString=".jpg") returned 4 [0100.421] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.421] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") [0100.422] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=147537) returned 1 [0100.422] CloseHandle (hObject=0x15c) returned 1 [0100.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt")) returned 0x20 [0100.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.422] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.422] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.423] GetLastError () returned 0x0 [0100.423] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x24051, lpOverlapped=0x0) returned 1 [0100.473] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x24060, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x24060, lpOverlapped=0x0) returned 1 [0100.476] ReadFile (in: hFile=0x15c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.476] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x11a, lpOverlapped=0x0) returned 1 [0100.476] SetEndOfFile (hFile=0x19c) returned 1 [0100.664] CloseHandle (hObject=0x19c) returned 1 [0100.664] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.664] SetEndOfFile (hFile=0x15c) returned 1 [0100.673] CloseHandle (hObject=0x15c) returned 1 [0100.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt")) returned 1 [0100.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.674] lstrlenW (lpString=".doc") returned 4 [0100.674] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.674] lstrlenW (lpString=".docx") returned 5 [0100.674] lstrcmpiW (lpString1=".docx", lpString2="d.fdt") returned -1 [0100.674] lstrlenW (lpString=".pdf") returned 4 [0100.674] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.674] lstrlenW (lpString=".xls") returned 4 [0100.674] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.674] lstrlenW (lpString=".xlsx") returned 5 [0100.674] lstrcmpiW (lpString1=".xlsx", lpString2="d.fdt") returned -1 [0100.674] lstrlenW (lpString=".ppt") returned 4 [0100.674] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.674] lstrlenW (lpString=".zip") returned 4 [0100.674] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.674] lstrlenW (lpString=".rar") returned 4 [0100.674] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.674] lstrlenW (lpString=".bz2") returned 4 [0100.674] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.674] lstrlenW (lpString=".7z") returned 3 [0100.674] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.674] lstrlenW (lpString=".dbf") returned 4 [0100.674] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.674] lstrlenW (lpString=".1cd") returned 4 [0100.674] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0100.676] lstrlenW (lpString=".jpg") returned 4 [0100.676] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.676] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") [0100.732] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=318) returned 1 [0100.732] CloseHandle (hObject=0x210) returned 1 [0100.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico")) returned 0x20 [0100.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.733] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.733] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.733] GetLastError () returned 0x0 [0100.733] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.734] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.735] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.735] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.735] SetEndOfFile (hFile=0x168) returned 1 [0100.735] CloseHandle (hObject=0x168) returned 1 [0100.735] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.735] SetEndOfFile (hFile=0x210) returned 1 [0100.736] CloseHandle (hObject=0x210) returned 1 [0100.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico")) returned 1 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString=".doc") returned 4 [0100.737] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.737] lstrlenW (lpString=".docx") returned 5 [0100.737] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0100.737] lstrlenW (lpString=".pdf") returned 4 [0100.737] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.737] lstrlenW (lpString=".xls") returned 4 [0100.737] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.737] lstrlenW (lpString=".xlsx") returned 5 [0100.737] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0100.737] lstrlenW (lpString=".ppt") returned 4 [0100.737] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString=".zip") returned 4 [0100.737] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.737] lstrlenW (lpString=".rar") returned 4 [0100.737] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.737] lstrlenW (lpString=".bz2") returned 4 [0100.737] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.737] lstrlenW (lpString=".7z") returned 3 [0100.737] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString=".dbf") returned 4 [0100.737] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString=".1cd") returned 4 [0100.737] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0100.737] lstrlenW (lpString=".jpg") returned 4 [0100.737] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.738] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") [0100.746] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=169181) returned 1 [0100.746] CloseHandle (hObject=0x210) returned 1 [0100.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico")) returned 0x20 [0100.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.746] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.746] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.747] GetLastError () returned 0x0 [0100.747] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x294dd, lpOverlapped=0x0) returned 1 [0100.752] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x294e0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x294e0, lpOverlapped=0x0) returned 1 [0100.755] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.756] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe2, lpOverlapped=0x0) returned 1 [0100.756] SetEndOfFile (hFile=0x168) returned 1 [0100.756] CloseHandle (hObject=0x168) returned 1 [0100.756] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.756] SetEndOfFile (hFile=0x210) returned 1 [0100.758] CloseHandle (hObject=0x210) returned 1 [0100.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico")) returned 1 [0100.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.758] lstrlenW (lpString=".doc") returned 4 [0100.758] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.758] lstrlenW (lpString=".docx") returned 5 [0100.758] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0100.758] lstrlenW (lpString=".pdf") returned 4 [0100.758] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.758] lstrlenW (lpString=".xls") returned 4 [0100.758] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.758] lstrlenW (lpString=".xlsx") returned 5 [0100.758] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0100.758] lstrlenW (lpString=".ppt") returned 4 [0100.758] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.758] lstrlenW (lpString=".zip") returned 4 [0100.758] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.758] lstrlenW (lpString=".rar") returned 4 [0100.758] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.758] lstrlenW (lpString=".bz2") returned 4 [0100.759] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.759] lstrlenW (lpString=".7z") returned 3 [0100.759] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.759] lstrlenW (lpString=".dbf") returned 4 [0100.759] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.759] lstrlenW (lpString=".1cd") returned 4 [0100.759] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0100.759] lstrlenW (lpString=".jpg") returned 4 [0100.759] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.759] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") [0100.759] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1718) returned 1 [0100.759] CloseHandle (hObject=0x210) returned 1 [0100.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico")) returned 0x20 [0100.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.760] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.760] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.760] GetLastError () returned 0x0 [0100.760] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6b6, lpOverlapped=0x0) returned 1 [0100.762] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0100.763] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.763] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.763] SetEndOfFile (hFile=0x168) returned 1 [0100.763] CloseHandle (hObject=0x168) returned 1 [0100.763] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.763] SetEndOfFile (hFile=0x210) returned 1 [0100.764] CloseHandle (hObject=0x210) returned 1 [0100.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico")) returned 1 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString=".doc") returned 4 [0100.765] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.765] lstrlenW (lpString=".docx") returned 5 [0100.765] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0100.765] lstrlenW (lpString=".pdf") returned 4 [0100.765] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.765] lstrlenW (lpString=".xls") returned 4 [0100.765] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.765] lstrlenW (lpString=".xlsx") returned 5 [0100.765] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0100.765] lstrlenW (lpString=".ppt") returned 4 [0100.765] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString=".zip") returned 4 [0100.765] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.765] lstrlenW (lpString=".rar") returned 4 [0100.765] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.765] lstrlenW (lpString=".bz2") returned 4 [0100.765] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.765] lstrlenW (lpString=".7z") returned 3 [0100.765] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString=".dbf") returned 4 [0100.765] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString=".1cd") returned 4 [0100.765] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0100.765] lstrlenW (lpString=".jpg") returned 4 [0100.766] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.766] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") [0100.766] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=318) returned 1 [0100.766] CloseHandle (hObject=0x210) returned 1 [0100.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico")) returned 0x20 [0100.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.767] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.767] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.767] GetLastError () returned 0x0 [0100.767] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.768] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.769] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.769] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.769] SetEndOfFile (hFile=0x168) returned 1 [0100.769] CloseHandle (hObject=0x168) returned 1 [0100.769] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.769] SetEndOfFile (hFile=0x210) returned 1 [0100.770] CloseHandle (hObject=0x210) returned 1 [0100.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico")) returned 1 [0100.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.771] lstrlenW (lpString=".doc") returned 4 [0100.771] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.771] lstrlenW (lpString=".docx") returned 5 [0100.771] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0100.771] lstrlenW (lpString=".pdf") returned 4 [0100.771] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.771] lstrlenW (lpString=".xls") returned 4 [0100.771] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.771] lstrlenW (lpString=".xlsx") returned 5 [0100.771] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0100.771] lstrlenW (lpString=".ppt") returned 4 [0100.771] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.771] lstrlenW (lpString=".zip") returned 4 [0100.771] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.771] lstrlenW (lpString=".rar") returned 4 [0100.771] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.771] lstrlenW (lpString=".bz2") returned 4 [0100.771] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.771] lstrlenW (lpString=".7z") returned 3 [0100.771] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.771] lstrlenW (lpString=".dbf") returned 4 [0100.771] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.772] lstrlenW (lpString=".1cd") returned 4 [0100.772] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0100.772] lstrlenW (lpString=".jpg") returned 4 [0100.772] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.772] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") [0100.772] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2606) returned 1 [0100.772] CloseHandle (hObject=0x210) returned 1 [0100.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico")) returned 0x20 [0100.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.773] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.773] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.773] GetLastError () returned 0x0 [0100.773] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa2e, lpOverlapped=0x0) returned 1 [0100.775] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa30, lpOverlapped=0x0) returned 1 [0100.776] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.776] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.776] SetEndOfFile (hFile=0x168) returned 1 [0100.776] CloseHandle (hObject=0x168) returned 1 [0100.776] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.776] SetEndOfFile (hFile=0x210) returned 1 [0100.777] CloseHandle (hObject=0x210) returned 1 [0100.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico")) returned 1 [0100.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.777] lstrlenW (lpString=".doc") returned 4 [0100.777] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.777] lstrlenW (lpString=".docx") returned 5 [0100.777] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0100.777] lstrlenW (lpString=".pdf") returned 4 [0100.778] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.778] lstrlenW (lpString=".xls") returned 4 [0100.778] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.778] lstrlenW (lpString=".xlsx") returned 5 [0100.778] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0100.778] lstrlenW (lpString=".ppt") returned 4 [0100.778] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.778] lstrlenW (lpString=".zip") returned 4 [0100.778] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.778] lstrlenW (lpString=".rar") returned 4 [0100.778] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.778] lstrlenW (lpString=".bz2") returned 4 [0100.778] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.778] lstrlenW (lpString=".7z") returned 3 [0100.778] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.778] lstrlenW (lpString=".dbf") returned 4 [0100.778] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.778] lstrlenW (lpString=".1cd") returned 4 [0100.778] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0100.778] lstrlenW (lpString=".jpg") returned 4 [0100.778] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.778] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") [0100.779] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=318) returned 1 [0100.779] CloseHandle (hObject=0x210) returned 1 [0100.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico")) returned 0x20 [0100.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.779] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.779] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.780] GetLastError () returned 0x0 [0100.780] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.781] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.782] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.782] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.782] SetEndOfFile (hFile=0x168) returned 1 [0100.782] CloseHandle (hObject=0x168) returned 1 [0100.782] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.782] SetEndOfFile (hFile=0x210) returned 1 [0100.783] CloseHandle (hObject=0x210) returned 1 [0100.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico")) returned 1 [0100.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.783] lstrlenW (lpString=".doc") returned 4 [0100.783] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.783] lstrlenW (lpString=".docx") returned 5 [0100.783] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0100.784] lstrlenW (lpString=".pdf") returned 4 [0100.784] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.784] lstrlenW (lpString=".xls") returned 4 [0100.784] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.784] lstrlenW (lpString=".xlsx") returned 5 [0100.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0100.784] lstrlenW (lpString=".ppt") returned 4 [0100.784] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.784] lstrlenW (lpString=".zip") returned 4 [0100.784] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.784] lstrlenW (lpString=".rar") returned 4 [0100.784] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.784] lstrlenW (lpString=".bz2") returned 4 [0100.784] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.784] lstrlenW (lpString=".7z") returned 3 [0100.784] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.784] lstrlenW (lpString=".dbf") returned 4 [0100.784] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.784] lstrlenW (lpString=".1cd") returned 4 [0100.784] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0100.784] lstrlenW (lpString=".jpg") returned 4 [0100.784] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.784] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") [0100.785] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2862) returned 1 [0100.785] CloseHandle (hObject=0x210) returned 1 [0100.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico")) returned 0x20 [0100.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.785] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.785] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.786] GetLastError () returned 0x0 [0100.786] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb2e, lpOverlapped=0x0) returned 1 [0100.788] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb30, lpOverlapped=0x0) returned 1 [0100.789] ReadFile (in: hFile=0x210, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0100.789] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0100.789] SetEndOfFile (hFile=0x168) returned 1 [0100.789] CloseHandle (hObject=0x168) returned 1 [0100.789] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.789] SetEndOfFile (hFile=0x210) returned 1 [0100.790] CloseHandle (hObject=0x210) returned 1 [0100.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico")) returned 1 [0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.790] lstrlenW (lpString=".doc") returned 4 [0100.790] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0100.790] lstrlenW (lpString=".docx") returned 5 [0100.790] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0100.790] lstrlenW (lpString=".pdf") returned 4 [0100.790] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0100.790] lstrlenW (lpString=".xls") returned 4 [0100.790] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0100.790] lstrlenW (lpString=".xlsx") returned 5 [0100.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0100.790] lstrlenW (lpString=".ppt") returned 4 [0100.790] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0100.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.790] lstrlenW (lpString=".zip") returned 4 [0100.790] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0100.791] lstrlenW (lpString=".rar") returned 4 [0100.791] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0100.791] lstrlenW (lpString=".bz2") returned 4 [0100.791] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0100.791] lstrlenW (lpString=".7z") returned 3 [0100.791] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.791] lstrlenW (lpString=".dbf") returned 4 [0100.791] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.791] lstrlenW (lpString=".1cd") returned 4 [0100.791] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0100.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0100.791] lstrlenW (lpString=".jpg") returned 4 [0100.791] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0100.791] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") [0100.792] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2862) returned 1 [0100.792] CloseHandle (hObject=0x168) returned 1 [0100.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico")) returned 0x20 [0100.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.792] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.793] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0100.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.097] GetLastError () returned 0x0 [0101.103] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.124] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.125] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.125] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa, lpOverlapped=0x0) returned 1 [0101.125] SetEndOfFile (hFile=0x22c) returned 1 [0101.125] CloseHandle (hObject=0x22c) returned 1 [0101.125] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.125] SetEndOfFile (hFile=0x168) returned 1 [0101.126] CloseHandle (hObject=0x168) returned 1 [0101.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico")) returned 1 [0101.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.164] lstrlenW (lpString=".doc") returned 4 [0101.164] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.164] lstrlenW (lpString=".docx") returned 5 [0101.164] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0101.164] lstrlenW (lpString=".pdf") returned 4 [0101.164] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.164] lstrlenW (lpString=".xls") returned 4 [0101.164] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.164] lstrlenW (lpString=".xlsx") returned 5 [0101.164] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0101.165] lstrlenW (lpString=".ppt") returned 4 [0101.165] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.165] lstrlenW (lpString=".zip") returned 4 [0101.165] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.165] lstrlenW (lpString=".rar") returned 4 [0101.165] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.165] lstrlenW (lpString=".bz2") returned 4 [0101.165] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.165] lstrlenW (lpString=".7z") returned 3 [0101.165] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.165] lstrlenW (lpString=".dbf") returned 4 [0101.165] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.165] lstrlenW (lpString=".1cd") returned 4 [0101.165] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0101.165] lstrlenW (lpString=".jpg") returned 4 [0101.165] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.165] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") [0101.178] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2862) returned 1 [0101.181] CloseHandle (hObject=0x16c) returned 1 [0101.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico")) returned 0x20 [0101.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.191] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.191] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.192] GetLastError () returned 0x0 [0101.192] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.252] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.253] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.253] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0101.253] SetEndOfFile (hFile=0x1c0) returned 1 [0101.253] CloseHandle (hObject=0x1c0) returned 1 [0101.253] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.253] SetEndOfFile (hFile=0x16c) returned 1 [0101.254] CloseHandle (hObject=0x16c) returned 1 [0101.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico")) returned 1 [0101.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.255] lstrlenW (lpString=".doc") returned 4 [0101.255] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.255] lstrlenW (lpString=".docx") returned 5 [0101.255] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0101.255] lstrlenW (lpString=".pdf") returned 4 [0101.255] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.255] lstrlenW (lpString=".xls") returned 4 [0101.255] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.255] lstrlenW (lpString=".xlsx") returned 5 [0101.255] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0101.255] lstrlenW (lpString=".ppt") returned 4 [0101.255] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.255] lstrlenW (lpString=".zip") returned 4 [0101.255] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.255] lstrlenW (lpString=".rar") returned 4 [0101.255] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.255] lstrlenW (lpString=".bz2") returned 4 [0101.255] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.255] lstrlenW (lpString=".7z") returned 3 [0101.255] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.256] lstrlenW (lpString=".dbf") returned 4 [0101.256] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.256] lstrlenW (lpString=".1cd") returned 4 [0101.256] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0101.256] lstrlenW (lpString=".jpg") returned 4 [0101.256] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.256] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") [0101.257] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=596840) returned 1 [0101.257] CloseHandle (hObject=0x16c) returned 1 [0101.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll")) returned 0x20 [0101.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.257] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.257] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.258] GetLastError () returned 0x0 [0101.258] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x91b68, lpOverlapped=0x0) returned 1 [0101.323] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x91b70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x91b70, lpOverlapped=0x0) returned 1 [0101.469] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.469] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0101.469] SetEndOfFile (hFile=0x1c0) returned 1 [0101.469] CloseHandle (hObject=0x1c0) returned 1 [0101.469] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.469] SetEndOfFile (hFile=0x16c) returned 1 [0101.474] CloseHandle (hObject=0x16c) returned 1 [0101.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll")) returned 1 [0101.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.475] lstrlenW (lpString=".doc") returned 4 [0101.475] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString=".docx") returned 5 [0101.475] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0101.475] lstrlenW (lpString=".pdf") returned 4 [0101.475] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString=".xls") returned 4 [0101.475] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString=".xlsx") returned 5 [0101.475] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0101.475] lstrlenW (lpString=".ppt") returned 4 [0101.475] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.475] lstrlenW (lpString=".zip") returned 4 [0101.475] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString=".rar") returned 4 [0101.475] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.475] lstrlenW (lpString=".bz2") returned 4 [0101.475] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.476] lstrlenW (lpString=".7z") returned 3 [0101.476] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.476] lstrlenW (lpString=".dbf") returned 4 [0101.476] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.476] lstrlenW (lpString=".1cd") returned 4 [0101.476] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0101.476] lstrlenW (lpString=".jpg") returned 4 [0101.476] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.476] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") [0101.477] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=29640) returned 1 [0101.477] CloseHandle (hObject=0x16c) returned 1 [0101.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) returned 0x20 [0101.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.478] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.478] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.479] GetLastError () returned 0x0 [0101.479] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x73c8, lpOverlapped=0x0) returned 1 [0101.481] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x73d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x73d0, lpOverlapped=0x0) returned 1 [0101.482] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.482] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0101.482] SetEndOfFile (hFile=0x1c0) returned 1 [0101.483] CloseHandle (hObject=0x1c0) returned 1 [0101.483] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.483] SetEndOfFile (hFile=0x16c) returned 1 [0101.484] CloseHandle (hObject=0x16c) returned 1 [0101.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) returned 1 [0101.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.484] lstrlenW (lpString=".doc") returned 4 [0101.484] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0101.484] lstrlenW (lpString=".docx") returned 5 [0101.484] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0101.484] lstrlenW (lpString=".pdf") returned 4 [0101.484] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0101.484] lstrlenW (lpString=".xls") returned 4 [0101.484] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0101.484] lstrlenW (lpString=".xlsx") returned 5 [0101.484] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0101.484] lstrlenW (lpString=".ppt") returned 4 [0101.484] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0101.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.485] lstrlenW (lpString=".zip") returned 4 [0101.485] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0101.485] lstrlenW (lpString=".rar") returned 4 [0101.485] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0101.485] lstrlenW (lpString=".bz2") returned 4 [0101.485] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0101.485] lstrlenW (lpString=".7z") returned 3 [0101.485] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0101.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.485] lstrlenW (lpString=".dbf") returned 4 [0101.485] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0101.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.485] lstrlenW (lpString=".1cd") returned 4 [0101.485] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0101.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0101.485] lstrlenW (lpString=".jpg") returned 4 [0101.485] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0101.485] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") [0101.486] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=184680) returned 1 [0101.486] CloseHandle (hObject=0x16c) returned 1 [0101.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll")) returned 0x20 [0101.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.486] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.486] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.487] GetLastError () returned 0x0 [0101.487] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2d168, lpOverlapped=0x0) returned 1 [0101.494] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2d170, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2d170, lpOverlapped=0x0) returned 1 [0101.500] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.500] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0101.500] SetEndOfFile (hFile=0x1c0) returned 1 [0101.500] CloseHandle (hObject=0x1c0) returned 1 [0101.500] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.500] SetEndOfFile (hFile=0x16c) returned 1 [0101.502] CloseHandle (hObject=0x16c) returned 1 [0101.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll")) returned 1 [0101.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.502] lstrlenW (lpString=".doc") returned 4 [0101.502] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.502] lstrlenW (lpString=".docx") returned 5 [0101.502] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0101.502] lstrlenW (lpString=".pdf") returned 4 [0101.502] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.502] lstrlenW (lpString=".xls") returned 4 [0101.502] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.503] lstrlenW (lpString=".xlsx") returned 5 [0101.503] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0101.503] lstrlenW (lpString=".ppt") returned 4 [0101.503] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.503] lstrlenW (lpString=".zip") returned 4 [0101.503] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.503] lstrlenW (lpString=".rar") returned 4 [0101.503] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.503] lstrlenW (lpString=".bz2") returned 4 [0101.503] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.503] lstrlenW (lpString=".7z") returned 3 [0101.503] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.503] lstrlenW (lpString=".dbf") returned 4 [0101.503] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.503] lstrlenW (lpString=".1cd") returned 4 [0101.503] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0101.503] lstrlenW (lpString=".jpg") returned 4 [0101.503] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.503] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") [0101.840] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=192896) returned 1 [0101.849] CloseHandle (hObject=0x16c) returned 1 [0101.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll")) returned 0x20 [0101.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.849] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.849] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.852] GetLastError () returned 0x0 [0101.852] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2f180, lpOverlapped=0x0) returned 1 [0101.878] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2f190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2f190, lpOverlapped=0x0) returned 1 [0101.882] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0101.882] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0101.882] SetEndOfFile (hFile=0x1c0) returned 1 [0101.882] CloseHandle (hObject=0x1c0) returned 1 [0101.882] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.882] SetEndOfFile (hFile=0x16c) returned 1 [0101.884] CloseHandle (hObject=0x16c) returned 1 [0101.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll")) returned 1 [0101.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.884] lstrlenW (lpString=".doc") returned 4 [0101.884] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.884] lstrlenW (lpString=".docx") returned 5 [0101.884] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0101.884] lstrlenW (lpString=".pdf") returned 4 [0101.884] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.884] lstrlenW (lpString=".xls") returned 4 [0101.885] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.885] lstrlenW (lpString=".xlsx") returned 5 [0101.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0101.885] lstrlenW (lpString=".ppt") returned 4 [0101.885] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.885] lstrlenW (lpString=".zip") returned 4 [0101.885] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.885] lstrlenW (lpString=".rar") returned 4 [0101.885] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.885] lstrlenW (lpString=".bz2") returned 4 [0101.885] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.885] lstrlenW (lpString=".7z") returned 3 [0101.885] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.885] lstrlenW (lpString=".dbf") returned 4 [0101.885] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.885] lstrlenW (lpString=".1cd") returned 4 [0101.885] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0101.885] lstrlenW (lpString=".jpg") returned 4 [0101.885] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.885] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") [0101.886] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=29016064) returned 1 [0101.886] CloseHandle (hObject=0x16c) returned 1 [0101.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss")) returned 0x20 [0101.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0101.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0101.888] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0101.888] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0101.888] ReadFile (in: hFile=0x16c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.892] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x939555, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0101.892] ReadFile (in: hFile=0x16c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.897] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0101.898] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x1b6c000, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0101.898] ReadFile (in: hFile=0x16c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.945] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0101.945] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc011e, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc011e, lpOverlapped=0x0) returned 1 [0101.994] SetEndOfFile (hFile=0x16c) returned 1 [0101.994] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0101.994] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0101.994] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x939555, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0101.995] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.996] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x1b6c000, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0101.996] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.998] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0101.998] CloseHandle (hObject=0x16c) returned 1 [0101.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.998] lstrlenW (lpString=".doc") returned 4 [0101.998] lstrcmpiW (lpString1=".doc", lpString2=".xss") returned -1 [0101.998] lstrlenW (lpString=".docx") returned 5 [0101.998] lstrcmpiW (lpString1=".docx", lpString2="4.xss") returned -1 [0101.998] lstrlenW (lpString=".pdf") returned 4 [0101.998] lstrcmpiW (lpString1=".pdf", lpString2=".xss") returned -1 [0101.998] lstrlenW (lpString=".xls") returned 4 [0101.998] lstrcmpiW (lpString1=".xls", lpString2=".xss") returned -1 [0101.998] lstrlenW (lpString=".xlsx") returned 5 [0101.998] lstrcmpiW (lpString1=".xlsx", lpString2="4.xss") returned -1 [0101.998] lstrlenW (lpString=".ppt") returned 4 [0101.998] lstrcmpiW (lpString1=".ppt", lpString2=".xss") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.998] lstrlenW (lpString=".zip") returned 4 [0101.998] lstrcmpiW (lpString1=".zip", lpString2=".xss") returned 1 [0101.999] lstrlenW (lpString=".rar") returned 4 [0101.999] lstrcmpiW (lpString1=".rar", lpString2=".xss") returned -1 [0101.999] lstrlenW (lpString=".bz2") returned 4 [0101.999] lstrcmpiW (lpString1=".bz2", lpString2=".xss") returned -1 [0101.999] lstrlenW (lpString=".7z") returned 3 [0101.999] lstrcmpiW (lpString1=".7z", lpString2="xss") returned -1 [0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.999] lstrlenW (lpString=".dbf") returned 4 [0101.999] lstrcmpiW (lpString1=".dbf", lpString2=".xss") returned -1 [0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.999] lstrlenW (lpString=".1cd") returned 4 [0101.999] lstrcmpiW (lpString1=".1cd", lpString2=".xss") returned -1 [0101.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 68 [0101.999] lstrlenW (lpString=".jpg") returned 4 [0101.999] lstrcmpiW (lpString1=".jpg", lpString2=".xss") returned -1 [0101.999] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") [0102.000] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=10007928) returned 1 [0102.000] CloseHandle (hObject=0x16c) returned 1 [0102.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll")) returned 0x20 [0102.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0102.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0102.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0102.002] ReadFile (in: hFile=0x16c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.017] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x32e728, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0102.017] ReadFile (in: hFile=0x16c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.067] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0102.068] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x94b578, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0102.068] ReadFile (in: hFile=0x16c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.083] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.083] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0102.113] SetEndOfFile (hFile=0x16c) returned 1 [0102.168] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0102.168] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0102.168] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.208] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x32e728, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0102.208] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.212] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x94b578, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0102.212] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.214] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0102.214] CloseHandle (hObject=0x16c) returned 1 [0102.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.215] lstrlenW (lpString=".doc") returned 4 [0102.215] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString=".docx") returned 5 [0102.215] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0102.215] lstrlenW (lpString=".pdf") returned 4 [0102.215] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString=".xls") returned 4 [0102.215] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString=".xlsx") returned 5 [0102.215] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0102.215] lstrlenW (lpString=".ppt") returned 4 [0102.215] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.215] lstrlenW (lpString=".zip") returned 4 [0102.215] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString=".rar") returned 4 [0102.215] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.215] lstrlenW (lpString=".bz2") returned 4 [0102.215] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.215] lstrlenW (lpString=".7z") returned 3 [0102.215] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.215] lstrlenW (lpString=".dbf") returned 4 [0102.215] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.215] lstrlenW (lpString=".1cd") returned 4 [0102.215] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 55 [0102.215] lstrlenW (lpString=".jpg") returned 4 [0102.215] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.215] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") [0102.481] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=213384) returned 1 [0102.481] CloseHandle (hObject=0x1c0) returned 1 [0102.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl")) returned 0x20 [0102.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0102.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.490] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0102.490] GetLastError () returned 0x0 [0102.490] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x34188, lpOverlapped=0x0) returned 1 [0102.495] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x34190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x34190, lpOverlapped=0x0) returned 1 [0102.500] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0102.500] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0102.500] SetEndOfFile (hFile=0x210) returned 1 [0102.500] CloseHandle (hObject=0x210) returned 1 [0102.500] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.500] SetEndOfFile (hFile=0x1c0) returned 1 [0102.502] CloseHandle (hObject=0x1c0) returned 1 [0102.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl")) returned 1 [0102.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.502] lstrlenW (lpString=".doc") returned 4 [0102.502] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.502] lstrlenW (lpString=".docx") returned 5 [0102.502] lstrcmpiW (lpString1=".docx", lpString2="2.PDL") returned -1 [0102.502] lstrlenW (lpString=".pdf") returned 4 [0102.503] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.503] lstrlenW (lpString=".xls") returned 4 [0102.503] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.503] lstrlenW (lpString=".xlsx") returned 5 [0102.503] lstrcmpiW (lpString1=".xlsx", lpString2="2.PDL") returned -1 [0102.503] lstrlenW (lpString=".ppt") returned 4 [0102.503] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.503] lstrlenW (lpString=".zip") returned 4 [0102.503] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.503] lstrlenW (lpString=".rar") returned 4 [0102.503] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.503] lstrlenW (lpString=".bz2") returned 4 [0102.503] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.503] lstrlenW (lpString=".7z") returned 3 [0102.503] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.503] lstrlenW (lpString=".dbf") returned 4 [0102.503] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.503] lstrlenW (lpString=".1cd") returned 4 [0102.503] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 52 [0102.503] lstrlenW (lpString=".jpg") returned 4 [0102.503] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.503] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") [0102.504] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=564846) returned 1 [0102.504] CloseHandle (hObject=0x1c0) returned 1 [0102.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp")) returned 0x20 [0102.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0102.504] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.504] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0102.505] GetLastError () returned 0x0 [0102.505] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x89e6e, lpOverlapped=0x0) returned 1 [0102.850] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x89e70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x89e70, lpOverlapped=0x0) returned 1 [0102.861] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0102.861] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0102.861] SetEndOfFile (hFile=0x210) returned 1 [0102.861] CloseHandle (hObject=0x210) returned 1 [0102.861] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.861] SetEndOfFile (hFile=0x1c0) returned 1 [0102.868] CloseHandle (hObject=0x1c0) returned 1 [0102.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp")) returned 1 [0102.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.868] lstrlenW (lpString=".doc") returned 4 [0102.868] lstrcmpiW (lpString1=".doc", lpString2=".SHP") returned -1 [0102.868] lstrlenW (lpString=".docx") returned 5 [0102.868] lstrcmpiW (lpString1=".docx", lpString2="1.SHP") returned -1 [0102.868] lstrlenW (lpString=".pdf") returned 4 [0102.868] lstrcmpiW (lpString1=".pdf", lpString2=".SHP") returned -1 [0102.868] lstrlenW (lpString=".xls") returned 4 [0102.868] lstrcmpiW (lpString1=".xls", lpString2=".SHP") returned 1 [0102.868] lstrlenW (lpString=".xlsx") returned 5 [0102.868] lstrcmpiW (lpString1=".xlsx", lpString2="1.SHP") returned -1 [0102.868] lstrlenW (lpString=".ppt") returned 4 [0102.868] lstrcmpiW (lpString1=".ppt", lpString2=".SHP") returned -1 [0102.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.869] lstrlenW (lpString=".zip") returned 4 [0102.869] lstrcmpiW (lpString1=".zip", lpString2=".SHP") returned 1 [0102.869] lstrlenW (lpString=".rar") returned 4 [0102.869] lstrcmpiW (lpString1=".rar", lpString2=".SHP") returned -1 [0102.869] lstrlenW (lpString=".bz2") returned 4 [0102.869] lstrcmpiW (lpString1=".bz2", lpString2=".SHP") returned -1 [0102.869] lstrlenW (lpString=".7z") returned 3 [0102.869] lstrcmpiW (lpString1=".7z", lpString2="SHP") returned -1 [0102.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.869] lstrlenW (lpString=".dbf") returned 4 [0102.869] lstrcmpiW (lpString1=".dbf", lpString2=".SHP") returned -1 [0102.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.869] lstrlenW (lpString=".1cd") returned 4 [0102.869] lstrcmpiW (lpString1=".1cd", lpString2=".SHP") returned -1 [0102.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 53 [0102.869] lstrlenW (lpString=".jpg") returned 4 [0102.869] lstrcmpiW (lpString1=".jpg", lpString2=".SHP") returned -1 [0102.869] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") [0102.871] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=417184) returned 1 [0102.871] CloseHandle (hObject=0x1c0) returned 1 [0102.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll")) returned 0x20 [0102.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0102.871] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.871] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0102.872] GetLastError () returned 0x0 [0102.872] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x65da0, lpOverlapped=0x0) returned 1 [0102.948] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x65db0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x65db0, lpOverlapped=0x0) returned 1 [0102.954] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0102.954] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0102.954] SetEndOfFile (hFile=0x210) returned 1 [0102.988] CloseHandle (hObject=0x210) returned 1 [0102.988] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0102.988] SetEndOfFile (hFile=0x1c0) returned 1 [0102.991] CloseHandle (hObject=0x1c0) returned 1 [0102.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll")) returned 1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.998] lstrlenW (lpString=".doc") returned 4 [0102.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.998] lstrlenW (lpString=".docx") returned 5 [0102.998] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0102.999] lstrlenW (lpString=".pdf") returned 4 [0102.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.999] lstrlenW (lpString=".xls") returned 4 [0102.999] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.999] lstrlenW (lpString=".xlsx") returned 5 [0102.999] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0102.999] lstrlenW (lpString=".ppt") returned 4 [0102.999] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.999] lstrlenW (lpString=".zip") returned 4 [0102.999] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.999] lstrlenW (lpString=".rar") returned 4 [0102.999] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.999] lstrlenW (lpString=".bz2") returned 4 [0102.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.999] lstrlenW (lpString=".7z") returned 3 [0102.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.999] lstrlenW (lpString=".dbf") returned 4 [0102.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.999] lstrlenW (lpString=".1cd") returned 4 [0102.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 53 [0102.999] lstrlenW (lpString=".jpg") returned 4 [0102.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.999] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") [0103.055] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=116632) returned 1 [0103.055] CloseHandle (hObject=0x1a0) returned 1 [0103.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll")) returned 0x20 [0103.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.055] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.055] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.056] GetLastError () returned 0x0 [0103.056] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1c798, lpOverlapped=0x0) returned 1 [0103.059] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1c7a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1c7a0, lpOverlapped=0x0) returned 1 [0103.062] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.062] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x108, lpOverlapped=0x0) returned 1 [0103.062] SetEndOfFile (hFile=0x15c) returned 1 [0103.062] CloseHandle (hObject=0x15c) returned 1 [0103.062] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.062] SetEndOfFile (hFile=0x1a0) returned 1 [0103.064] CloseHandle (hObject=0x1a0) returned 1 [0103.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll")) returned 1 [0103.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.064] lstrlenW (lpString=".doc") returned 4 [0103.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.064] lstrlenW (lpString=".docx") returned 5 [0103.064] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0103.064] lstrlenW (lpString=".pdf") returned 4 [0103.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.064] lstrlenW (lpString=".xls") returned 4 [0103.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.064] lstrlenW (lpString=".xlsx") returned 5 [0103.064] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0103.065] lstrlenW (lpString=".ppt") returned 4 [0103.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.065] lstrlenW (lpString=".zip") returned 4 [0103.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.065] lstrlenW (lpString=".rar") returned 4 [0103.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.065] lstrlenW (lpString=".bz2") returned 4 [0103.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.065] lstrlenW (lpString=".7z") returned 3 [0103.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.065] lstrlenW (lpString=".dbf") returned 4 [0103.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.065] lstrlenW (lpString=".1cd") returned 4 [0103.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 69 [0103.065] lstrlenW (lpString=".jpg") returned 4 [0103.065] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.065] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") [0103.066] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=665472) returned 1 [0103.066] CloseHandle (hObject=0x1a0) returned 1 [0103.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll")) returned 0x20 [0103.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.067] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.067] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.068] GetLastError () returned 0x0 [0103.068] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa2780, lpOverlapped=0x0) returned 1 [0103.227] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa2790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa2790, lpOverlapped=0x0) returned 1 [0103.239] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.239] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x13a, lpOverlapped=0x0) returned 1 [0103.239] SetEndOfFile (hFile=0x15c) returned 1 [0103.240] CloseHandle (hObject=0x15c) returned 1 [0103.240] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.240] SetEndOfFile (hFile=0x1a0) returned 1 [0103.245] CloseHandle (hObject=0x1a0) returned 1 [0103.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll")) returned 1 [0103.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.246] lstrlenW (lpString=".doc") returned 4 [0103.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString=".docx") returned 5 [0103.246] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0103.246] lstrlenW (lpString=".pdf") returned 4 [0103.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString=".xls") returned 4 [0103.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString=".xlsx") returned 5 [0103.246] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0103.246] lstrlenW (lpString=".ppt") returned 4 [0103.246] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.246] lstrlenW (lpString=".zip") returned 4 [0103.246] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString=".rar") returned 4 [0103.246] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.246] lstrlenW (lpString=".bz2") returned 4 [0103.246] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.246] lstrlenW (lpString=".7z") returned 3 [0103.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.246] lstrlenW (lpString=".dbf") returned 4 [0103.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.246] lstrlenW (lpString=".1cd") returned 4 [0103.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 94 [0103.247] lstrlenW (lpString=".jpg") returned 4 [0103.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.247] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") [0103.248] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=18840) returned 1 [0103.248] CloseHandle (hObject=0x1a0) returned 1 [0103.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll")) returned 0x20 [0103.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.248] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.248] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.250] GetLastError () returned 0x0 [0103.250] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4998, lpOverlapped=0x0) returned 1 [0103.430] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x49a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x49a0, lpOverlapped=0x0) returned 1 [0103.431] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.431] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x13e, lpOverlapped=0x0) returned 1 [0103.431] SetEndOfFile (hFile=0x15c) returned 1 [0103.431] CloseHandle (hObject=0x15c) returned 1 [0103.431] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.431] SetEndOfFile (hFile=0x1a0) returned 1 [0103.432] CloseHandle (hObject=0x1a0) returned 1 [0103.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll")) returned 1 [0103.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.433] lstrlenW (lpString=".doc") returned 4 [0103.433] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString=".docx") returned 5 [0103.433] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0103.433] lstrlenW (lpString=".pdf") returned 4 [0103.433] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString=".xls") returned 4 [0103.433] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString=".xlsx") returned 5 [0103.433] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0103.433] lstrlenW (lpString=".ppt") returned 4 [0103.433] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.433] lstrlenW (lpString=".zip") returned 4 [0103.433] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString=".rar") returned 4 [0103.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.433] lstrlenW (lpString=".bz2") returned 4 [0103.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.433] lstrlenW (lpString=".7z") returned 3 [0103.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.433] lstrlenW (lpString=".dbf") returned 4 [0103.434] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.434] lstrlenW (lpString=".1cd") returned 4 [0103.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 96 [0103.434] lstrlenW (lpString=".jpg") returned 4 [0103.434] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.434] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") [0103.435] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=75672) returned 1 [0103.435] CloseHandle (hObject=0x1a0) returned 1 [0103.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll")) returned 0x20 [0103.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.437] GetLastError () returned 0x0 [0103.437] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x12798, lpOverlapped=0x0) returned 1 [0103.470] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x127a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x127a0, lpOverlapped=0x0) returned 1 [0103.472] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.472] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x13c, lpOverlapped=0x0) returned 1 [0103.473] SetEndOfFile (hFile=0x15c) returned 1 [0103.473] CloseHandle (hObject=0x15c) returned 1 [0103.473] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.473] SetEndOfFile (hFile=0x1a0) returned 1 [0103.474] CloseHandle (hObject=0x1a0) returned 1 [0103.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll")) returned 1 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.475] lstrlenW (lpString=".doc") returned 4 [0103.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString=".docx") returned 5 [0103.475] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0103.475] lstrlenW (lpString=".pdf") returned 4 [0103.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString=".xls") returned 4 [0103.475] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString=".xlsx") returned 5 [0103.475] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0103.475] lstrlenW (lpString=".ppt") returned 4 [0103.475] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.475] lstrlenW (lpString=".zip") returned 4 [0103.475] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString=".rar") returned 4 [0103.475] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.475] lstrlenW (lpString=".bz2") returned 4 [0103.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.475] lstrlenW (lpString=".7z") returned 3 [0103.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.475] lstrlenW (lpString=".dbf") returned 4 [0103.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.475] lstrlenW (lpString=".1cd") returned 4 [0103.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 95 [0103.475] lstrlenW (lpString=".jpg") returned 4 [0103.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.475] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") [0103.476] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=477024) returned 1 [0103.477] CloseHandle (hObject=0x1a0) returned 1 [0103.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll")) returned 0x20 [0103.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.477] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.477] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.478] GetLastError () returned 0x0 [0103.478] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x74760, lpOverlapped=0x0) returned 1 [0103.529] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x74770, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x74770, lpOverlapped=0x0) returned 1 [0103.538] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.538] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x130, lpOverlapped=0x0) returned 1 [0103.538] SetEndOfFile (hFile=0x15c) returned 1 [0103.717] CloseHandle (hObject=0x15c) returned 1 [0103.717] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.717] SetEndOfFile (hFile=0x1a0) returned 1 [0103.721] CloseHandle (hObject=0x1a0) returned 1 [0103.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll")) returned 1 [0103.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.739] lstrlenW (lpString=".doc") returned 4 [0103.739] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.739] lstrlenW (lpString=".docx") returned 5 [0103.739] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0103.739] lstrlenW (lpString=".pdf") returned 4 [0103.739] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.739] lstrlenW (lpString=".xls") returned 4 [0103.739] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.739] lstrlenW (lpString=".xlsx") returned 5 [0103.739] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0103.739] lstrlenW (lpString=".ppt") returned 4 [0103.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.739] lstrlenW (lpString=".zip") returned 4 [0103.739] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.739] lstrlenW (lpString=".rar") returned 4 [0103.739] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.740] lstrlenW (lpString=".bz2") returned 4 [0103.740] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.740] lstrlenW (lpString=".7z") returned 3 [0103.740] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.740] lstrlenW (lpString=".dbf") returned 4 [0103.740] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.740] lstrlenW (lpString=".1cd") returned 4 [0103.740] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 89 [0103.740] lstrlenW (lpString=".jpg") returned 4 [0103.740] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.740] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") [0103.852] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=75144) returned 1 [0103.852] CloseHandle (hObject=0x1c8) returned 1 [0103.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl")) returned 0x20 [0103.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.883] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.883] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.884] GetLastError () returned 0x0 [0103.884] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x12588, lpOverlapped=0x0) returned 1 [0103.886] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x12590, lpOverlapped=0x0) returned 1 [0103.888] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.888] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0103.888] SetEndOfFile (hFile=0x158) returned 1 [0103.888] CloseHandle (hObject=0x158) returned 1 [0103.888] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.888] SetEndOfFile (hFile=0x1c8) returned 1 [0103.889] CloseHandle (hObject=0x1c8) returned 1 [0103.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl")) returned 1 [0103.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.890] lstrlenW (lpString=".doc") returned 4 [0103.890] lstrcmpiW (lpString1=".doc", lpString2=".CPL") returned 1 [0103.890] lstrlenW (lpString=".docx") returned 5 [0103.890] lstrcmpiW (lpString1=".docx", lpString2="2.CPL") returned -1 [0103.891] lstrlenW (lpString=".pdf") returned 4 [0103.891] lstrcmpiW (lpString1=".pdf", lpString2=".CPL") returned 1 [0103.891] lstrlenW (lpString=".xls") returned 4 [0103.891] lstrcmpiW (lpString1=".xls", lpString2=".CPL") returned 1 [0103.891] lstrlenW (lpString=".xlsx") returned 5 [0103.891] lstrcmpiW (lpString1=".xlsx", lpString2="2.CPL") returned -1 [0103.891] lstrlenW (lpString=".ppt") returned 4 [0103.891] lstrcmpiW (lpString1=".ppt", lpString2=".CPL") returned 1 [0103.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.891] lstrlenW (lpString=".zip") returned 4 [0103.891] lstrcmpiW (lpString1=".zip", lpString2=".CPL") returned 1 [0103.891] lstrlenW (lpString=".rar") returned 4 [0103.891] lstrcmpiW (lpString1=".rar", lpString2=".CPL") returned 1 [0103.892] lstrlenW (lpString=".bz2") returned 4 [0103.892] lstrcmpiW (lpString1=".bz2", lpString2=".CPL") returned -1 [0103.892] lstrlenW (lpString=".7z") returned 3 [0103.892] lstrcmpiW (lpString1=".7z", lpString2="CPL") returned -1 [0103.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.892] lstrlenW (lpString=".dbf") returned 4 [0103.892] lstrcmpiW (lpString1=".dbf", lpString2=".CPL") returned 1 [0103.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.892] lstrlenW (lpString=".1cd") returned 4 [0103.892] lstrcmpiW (lpString1=".1cd", lpString2=".CPL") returned -1 [0103.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 54 [0103.892] lstrlenW (lpString=".jpg") returned 4 [0103.892] lstrcmpiW (lpString1=".jpg", lpString2=".CPL") returned 1 [0103.892] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") [0103.893] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=207200) returned 1 [0103.893] CloseHandle (hObject=0x1c8) returned 1 [0103.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll")) returned 0x20 [0103.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.893] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.893] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.894] GetLastError () returned 0x0 [0103.894] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x32960, lpOverlapped=0x0) returned 1 [0103.910] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x32970, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x32970, lpOverlapped=0x0) returned 1 [0103.913] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0103.913] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0103.913] SetEndOfFile (hFile=0x158) returned 1 [0103.913] CloseHandle (hObject=0x158) returned 1 [0103.914] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.914] SetEndOfFile (hFile=0x1c8) returned 1 [0103.915] CloseHandle (hObject=0x1c8) returned 1 [0103.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll")) returned 1 [0103.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.916] lstrlenW (lpString=".doc") returned 4 [0103.916] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString=".docx") returned 5 [0103.916] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0103.916] lstrlenW (lpString=".pdf") returned 4 [0103.916] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString=".xls") returned 4 [0103.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString=".xlsx") returned 5 [0103.916] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0103.916] lstrlenW (lpString=".ppt") returned 4 [0103.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.916] lstrlenW (lpString=".zip") returned 4 [0103.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString=".rar") returned 4 [0103.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.916] lstrlenW (lpString=".bz2") returned 4 [0103.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.916] lstrlenW (lpString=".7z") returned 3 [0103.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.917] lstrlenW (lpString=".dbf") returned 4 [0103.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.917] lstrlenW (lpString=".1cd") returned 4 [0103.917] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 53 [0103.917] lstrlenW (lpString=".jpg") returned 4 [0103.917] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.917] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") [0103.918] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=677248) returned 1 [0103.918] CloseHandle (hObject=0x1c8) returned 1 [0103.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb")) returned 0x20 [0103.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0103.918] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.918] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0103.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.919] GetLastError () returned 0x0 [0103.919] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa5580, lpOverlapped=0x0) returned 1 [0104.067] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa5590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa5590, lpOverlapped=0x0) returned 1 [0104.199] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0104.199] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0104.199] SetEndOfFile (hFile=0x158) returned 1 [0104.208] CloseHandle (hObject=0x158) returned 1 [0104.208] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.208] SetEndOfFile (hFile=0x1c8) returned 1 [0104.215] CloseHandle (hObject=0x1c8) returned 1 [0104.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb")) returned 1 [0104.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.290] lstrlenW (lpString=".doc") returned 4 [0104.290] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0104.290] lstrlenW (lpString=".docx") returned 5 [0104.290] lstrcmpiW (lpString1=".docx", lpString2="C.OLB") returned -1 [0104.290] lstrlenW (lpString=".pdf") returned 4 [0104.290] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0104.290] lstrlenW (lpString=".xls") returned 4 [0104.290] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0104.290] lstrlenW (lpString=".xlsx") returned 5 [0104.290] lstrcmpiW (lpString1=".xlsx", lpString2="C.OLB") returned -1 [0104.290] lstrlenW (lpString=".ppt") returned 4 [0104.290] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0104.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.290] lstrlenW (lpString=".zip") returned 4 [0104.290] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0104.290] lstrlenW (lpString=".rar") returned 4 [0104.290] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0104.290] lstrlenW (lpString=".bz2") returned 4 [0104.290] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0104.290] lstrlenW (lpString=".7z") returned 3 [0104.290] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0104.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.290] lstrlenW (lpString=".dbf") returned 4 [0104.290] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0104.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.291] lstrlenW (lpString=".1cd") returned 4 [0104.291] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0104.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 52 [0104.291] lstrlenW (lpString=".jpg") returned 4 [0104.291] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0104.291] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") [0104.403] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3584) returned 1 [0104.403] CloseHandle (hObject=0x158) returned 1 [0104.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub")) returned 0x20 [0104.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.411] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.411] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.422] GetLastError () returned 0x0 [0104.423] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xe00, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe10, lpOverlapped=0x0) returned 1 [0104.429] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf2, lpOverlapped=0x0) returned 1 [0104.429] SetEndOfFile (hFile=0x15c) returned 1 [0104.429] CloseHandle (hObject=0x15c) returned 1 [0104.429] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.429] SetEndOfFile (hFile=0x158) returned 1 [0104.430] CloseHandle (hObject=0x158) returned 1 [0104.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub")) returned 1 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.430] lstrlenW (lpString=".doc") returned 4 [0104.430] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.430] lstrlenW (lpString=".docx") returned 5 [0104.430] lstrcmpiW (lpString1=".docx", lpString2="n.dub") returned -1 [0104.430] lstrlenW (lpString=".pdf") returned 4 [0104.430] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.431] lstrlenW (lpString=".xls") returned 4 [0104.431] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.431] lstrlenW (lpString=".xlsx") returned 5 [0104.431] lstrcmpiW (lpString1=".xlsx", lpString2="n.dub") returned -1 [0104.431] lstrlenW (lpString=".ppt") returned 4 [0104.431] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.431] lstrlenW (lpString=".zip") returned 4 [0104.431] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.431] lstrlenW (lpString=".rar") returned 4 [0104.431] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.431] lstrlenW (lpString=".bz2") returned 4 [0104.431] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.431] lstrlenW (lpString=".7z") returned 3 [0104.431] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.431] lstrlenW (lpString=".dbf") returned 4 [0104.431] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.431] lstrlenW (lpString=".1cd") returned 4 [0104.431] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 58 [0104.431] lstrlenW (lpString=".jpg") returned 4 [0104.431] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.431] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") [0104.440] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=480152) returned 1 [0104.440] CloseHandle (hObject=0x1f4) returned 1 [0104.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll")) returned 0x20 [0104.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0104.440] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.440] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.441] GetLastError () returned 0x0 [0104.441] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x75398, lpOverlapped=0x0) returned 1 [0104.452] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x753a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x753a0, lpOverlapped=0x0) returned 1 [0104.461] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0104.461] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.462] SetEndOfFile (hFile=0x1b8) returned 1 [0104.462] CloseHandle (hObject=0x1b8) returned 1 [0104.462] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.462] SetEndOfFile (hFile=0x1f4) returned 1 [0104.466] CloseHandle (hObject=0x1f4) returned 1 [0104.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll")) returned 1 [0104.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.466] lstrlenW (lpString=".doc") returned 4 [0104.466] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.466] lstrlenW (lpString=".docx") returned 5 [0104.466] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0104.466] lstrlenW (lpString=".pdf") returned 4 [0104.466] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.466] lstrlenW (lpString=".xls") returned 4 [0104.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.467] lstrlenW (lpString=".xlsx") returned 5 [0104.467] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0104.467] lstrlenW (lpString=".ppt") returned 4 [0104.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.467] lstrlenW (lpString=".zip") returned 4 [0104.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.467] lstrlenW (lpString=".rar") returned 4 [0104.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.467] lstrlenW (lpString=".bz2") returned 4 [0104.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.467] lstrlenW (lpString=".7z") returned 3 [0104.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.467] lstrlenW (lpString=".dbf") returned 4 [0104.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.467] lstrlenW (lpString=".1cd") returned 4 [0104.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 55 [0104.467] lstrlenW (lpString=".jpg") returned 4 [0104.467] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.467] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") [0104.565] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=103424) returned 1 [0104.565] CloseHandle (hObject=0x1f4) returned 1 [0104.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub")) returned 0x20 [0104.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0104.565] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.566] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.593] GetLastError () returned 0x0 [0104.593] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x19400, lpOverlapped=0x0) returned 1 [0104.597] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x19410, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x19410, lpOverlapped=0x0) returned 1 [0104.599] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0104.599] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf4, lpOverlapped=0x0) returned 1 [0104.599] SetEndOfFile (hFile=0x22c) returned 1 [0104.600] CloseHandle (hObject=0x22c) returned 1 [0104.600] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.600] SetEndOfFile (hFile=0x1f4) returned 1 [0104.601] CloseHandle (hObject=0x1f4) returned 1 [0104.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub")) returned 1 [0104.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString=".doc") returned 4 [0104.602] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.602] lstrlenW (lpString=".docx") returned 5 [0104.602] lstrcmpiW (lpString1=".docx", lpString2="n.dub") returned -1 [0104.602] lstrlenW (lpString=".pdf") returned 4 [0104.602] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.602] lstrlenW (lpString=".xls") returned 4 [0104.602] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.602] lstrlenW (lpString=".xlsx") returned 5 [0104.602] lstrcmpiW (lpString1=".xlsx", lpString2="n.dub") returned -1 [0104.602] lstrlenW (lpString=".ppt") returned 4 [0104.602] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString=".zip") returned 4 [0104.602] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.602] lstrlenW (lpString=".rar") returned 4 [0104.602] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.602] lstrlenW (lpString=".bz2") returned 4 [0104.602] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.602] lstrlenW (lpString=".7z") returned 3 [0104.602] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString=".dbf") returned 4 [0104.602] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString=".1cd") returned 4 [0104.602] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 59 [0104.602] lstrlenW (lpString=".jpg") returned 4 [0104.602] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.602] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") [0104.604] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1858366) returned 1 [0104.604] CloseHandle (hObject=0x1f4) returned 1 [0104.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic")) returned 0x20 [0104.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0104.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0104.606] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0104.606] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0104.606] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.618] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x973bf, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0104.618] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.657] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.658] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x185b3e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0104.658] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.677] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0104.677] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0104.978] SetEndOfFile (hFile=0x1f4) returned 1 [0105.011] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0105.011] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.011] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.013] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x973bf, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.013] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.015] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x185b3e, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.015] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.017] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0105.017] CloseHandle (hObject=0x1f4) returned 1 [0105.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.018] lstrlenW (lpString=".doc") returned 4 [0105.018] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0105.018] lstrlenW (lpString=".docx") returned 5 [0105.018] lstrcmpiW (lpString1=".docx", lpString2="n.kic") returned -1 [0105.018] lstrlenW (lpString=".pdf") returned 4 [0105.018] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0105.018] lstrlenW (lpString=".xls") returned 4 [0105.018] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0105.018] lstrlenW (lpString=".xlsx") returned 5 [0105.018] lstrcmpiW (lpString1=".xlsx", lpString2="n.kic") returned -1 [0105.018] lstrlenW (lpString=".ppt") returned 4 [0105.018] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0105.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.018] lstrlenW (lpString=".zip") returned 4 [0105.018] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0105.018] lstrlenW (lpString=".rar") returned 4 [0105.018] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0105.018] lstrlenW (lpString=".bz2") returned 4 [0105.018] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0105.018] lstrlenW (lpString=".7z") returned 3 [0105.018] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0105.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.018] lstrlenW (lpString=".dbf") returned 4 [0105.018] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0105.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.018] lstrlenW (lpString=".1cd") returned 4 [0105.018] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0105.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 54 [0105.018] lstrlenW (lpString=".jpg") returned 4 [0105.018] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0105.018] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") [0105.405] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1942940) returned 1 [0105.405] CloseHandle (hObject=0x15c) returned 1 [0105.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic")) returned 0x20 [0105.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0105.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0105.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0105.407] ReadFile (in: hFile=0x15c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.435] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x9e1de, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0105.435] ReadFile (in: hFile=0x15c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.440] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0105.441] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x19a59c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0105.441] ReadFile (in: hFile=0x15c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.456] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0105.660] SetEndOfFile (hFile=0x15c) returned 1 [0105.660] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0105.660] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.662] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x9e1de, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.662] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.664] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x19a59c, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0105.664] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.666] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0105.666] CloseHandle (hObject=0x15c) returned 1 [0105.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.666] lstrlenW (lpString=".doc") returned 4 [0105.666] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0105.666] lstrlenW (lpString=".docx") returned 5 [0105.666] lstrcmpiW (lpString1=".docx", lpString2="p.kic") returned -1 [0105.666] lstrlenW (lpString=".pdf") returned 4 [0105.666] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0105.666] lstrlenW (lpString=".xls") returned 4 [0105.666] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0105.666] lstrlenW (lpString=".xlsx") returned 5 [0105.666] lstrcmpiW (lpString1=".xlsx", lpString2="p.kic") returned -1 [0105.666] lstrlenW (lpString=".ppt") returned 4 [0105.666] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0105.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.666] lstrlenW (lpString=".zip") returned 4 [0105.666] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0105.666] lstrlenW (lpString=".rar") returned 4 [0105.667] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0105.667] lstrlenW (lpString=".bz2") returned 4 [0105.667] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0105.667] lstrlenW (lpString=".7z") returned 3 [0105.667] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.667] lstrlenW (lpString=".dbf") returned 4 [0105.667] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.667] lstrlenW (lpString=".1cd") returned 4 [0105.667] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 54 [0105.667] lstrlenW (lpString=".jpg") returned 4 [0105.667] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0105.667] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") [0106.071] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=97152) returned 1 [0106.071] CloseHandle (hObject=0x1c8) returned 1 [0106.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll")) returned 0x20 [0106.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.073] GetLastError () returned 0x0 [0106.073] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x17b80, lpOverlapped=0x0) returned 1 [0106.077] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x17b90, lpOverlapped=0x0) returned 1 [0106.080] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0106.080] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0106.080] SetEndOfFile (hFile=0x22c) returned 1 [0106.080] CloseHandle (hObject=0x22c) returned 1 [0106.080] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.080] SetEndOfFile (hFile=0x1c8) returned 1 [0106.082] CloseHandle (hObject=0x1c8) returned 1 [0106.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll")) returned 1 [0106.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.082] lstrlenW (lpString=".doc") returned 4 [0106.082] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.082] lstrlenW (lpString=".docx") returned 5 [0106.082] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0106.082] lstrlenW (lpString=".pdf") returned 4 [0106.082] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.082] lstrlenW (lpString=".xls") returned 4 [0106.082] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.082] lstrlenW (lpString=".xlsx") returned 5 [0106.082] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0106.082] lstrlenW (lpString=".ppt") returned 4 [0106.082] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.082] lstrlenW (lpString=".zip") returned 4 [0106.082] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.082] lstrlenW (lpString=".rar") returned 4 [0106.082] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.083] lstrlenW (lpString=".bz2") returned 4 [0106.083] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.083] lstrlenW (lpString=".7z") returned 3 [0106.083] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.083] lstrlenW (lpString=".dbf") returned 4 [0106.083] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.083] lstrlenW (lpString=".1cd") returned 4 [0106.083] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 53 [0106.083] lstrlenW (lpString=".jpg") returned 4 [0106.083] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.083] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") [0106.084] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=77184) returned 1 [0106.084] CloseHandle (hObject=0x1c8) returned 1 [0106.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll")) returned 0x20 [0106.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.084] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.085] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.085] GetLastError () returned 0x0 [0106.085] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x12d80, lpOverlapped=0x0) returned 1 [0106.088] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x12d90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x12d90, lpOverlapped=0x0) returned 1 [0106.090] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0106.090] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.090] SetEndOfFile (hFile=0x22c) returned 1 [0106.091] CloseHandle (hObject=0x22c) returned 1 [0106.091] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.091] SetEndOfFile (hFile=0x1c8) returned 1 [0106.092] CloseHandle (hObject=0x1c8) returned 1 [0106.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll")) returned 1 [0106.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.092] lstrlenW (lpString=".doc") returned 4 [0106.092] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.092] lstrlenW (lpString=".docx") returned 5 [0106.093] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0106.093] lstrlenW (lpString=".pdf") returned 4 [0106.093] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.093] lstrlenW (lpString=".xls") returned 4 [0106.093] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.093] lstrlenW (lpString=".xlsx") returned 5 [0106.093] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0106.093] lstrlenW (lpString=".ppt") returned 4 [0106.093] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.093] lstrlenW (lpString=".zip") returned 4 [0106.093] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.093] lstrlenW (lpString=".rar") returned 4 [0106.093] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.093] lstrlenW (lpString=".bz2") returned 4 [0106.093] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.093] lstrlenW (lpString=".7z") returned 3 [0106.093] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.093] lstrlenW (lpString=".dbf") returned 4 [0106.093] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.093] lstrlenW (lpString=".1cd") returned 4 [0106.093] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 54 [0106.093] lstrlenW (lpString=".jpg") returned 4 [0106.093] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.093] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") [0106.094] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=87936) returned 1 [0106.094] CloseHandle (hObject=0x1c8) returned 1 [0106.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe")) returned 0x20 [0106.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.094] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.094] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.095] GetLastError () returned 0x0 [0106.095] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x15780, lpOverlapped=0x0) returned 1 [0106.098] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x15790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x15790, lpOverlapped=0x0) returned 1 [0106.100] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0106.100] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.100] SetEndOfFile (hFile=0x22c) returned 1 [0106.100] CloseHandle (hObject=0x22c) returned 1 [0106.101] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.101] SetEndOfFile (hFile=0x1c8) returned 1 [0106.102] CloseHandle (hObject=0x1c8) returned 1 [0106.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe")) returned 1 [0106.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.102] lstrlenW (lpString=".doc") returned 4 [0106.102] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.102] lstrlenW (lpString=".docx") returned 5 [0106.102] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0106.102] lstrlenW (lpString=".pdf") returned 4 [0106.102] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.102] lstrlenW (lpString=".xls") returned 4 [0106.102] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.102] lstrlenW (lpString=".xlsx") returned 5 [0106.103] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0106.103] lstrlenW (lpString=".ppt") returned 4 [0106.103] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.103] lstrlenW (lpString=".zip") returned 4 [0106.103] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.103] lstrlenW (lpString=".rar") returned 4 [0106.103] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.103] lstrlenW (lpString=".bz2") returned 4 [0106.103] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.103] lstrlenW (lpString=".7z") returned 3 [0106.103] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.103] lstrlenW (lpString=".dbf") returned 4 [0106.103] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.103] lstrlenW (lpString=".1cd") returned 4 [0106.103] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 55 [0106.103] lstrlenW (lpString=".jpg") returned 4 [0106.103] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.103] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") [0106.104] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=41880) returned 1 [0106.104] CloseHandle (hObject=0x1c8) returned 1 [0106.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll")) returned 0x20 [0106.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.104] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.104] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.105] GetLastError () returned 0x0 [0106.105] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa398, lpOverlapped=0x0) returned 1 [0106.107] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa3a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa3a0, lpOverlapped=0x0) returned 1 [0106.108] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0106.109] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.109] SetEndOfFile (hFile=0x22c) returned 1 [0106.109] CloseHandle (hObject=0x22c) returned 1 [0106.109] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.109] SetEndOfFile (hFile=0x1c8) returned 1 [0106.110] CloseHandle (hObject=0x1c8) returned 1 [0106.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll")) returned 1 [0106.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.110] lstrlenW (lpString=".doc") returned 4 [0106.110] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.110] lstrlenW (lpString=".docx") returned 5 [0106.110] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0106.110] lstrlenW (lpString=".pdf") returned 4 [0106.110] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.110] lstrlenW (lpString=".xls") returned 4 [0106.111] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.111] lstrlenW (lpString=".xlsx") returned 5 [0106.111] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0106.111] lstrlenW (lpString=".ppt") returned 4 [0106.111] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.111] lstrlenW (lpString=".zip") returned 4 [0106.111] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.111] lstrlenW (lpString=".rar") returned 4 [0106.111] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.111] lstrlenW (lpString=".bz2") returned 4 [0106.111] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.111] lstrlenW (lpString=".7z") returned 3 [0106.111] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.111] lstrlenW (lpString=".dbf") returned 4 [0106.111] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.111] lstrlenW (lpString=".1cd") returned 4 [0106.111] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 55 [0106.111] lstrlenW (lpString=".jpg") returned 4 [0106.111] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.111] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") [0106.112] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=909696) returned 1 [0106.112] CloseHandle (hObject=0x1c8) returned 1 [0106.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe")) returned 0x20 [0106.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.113] GetLastError () returned 0x0 [0106.113] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xde180, lpOverlapped=0x0) returned 1 [0106.131] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xde190, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xde190, lpOverlapped=0x0) returned 1 [0106.263] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0106.263] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.263] SetEndOfFile (hFile=0x22c) returned 1 [0106.263] CloseHandle (hObject=0x22c) returned 1 [0106.263] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.263] SetEndOfFile (hFile=0x1c8) returned 1 [0106.271] CloseHandle (hObject=0x1c8) returned 1 [0106.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe")) returned 1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.335] lstrlenW (lpString=".doc") returned 4 [0106.335] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.335] lstrlenW (lpString=".docx") returned 5 [0106.335] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0106.335] lstrlenW (lpString=".pdf") returned 4 [0106.335] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.335] lstrlenW (lpString=".xls") returned 4 [0106.335] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.335] lstrlenW (lpString=".xlsx") returned 5 [0106.335] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0106.335] lstrlenW (lpString=".ppt") returned 4 [0106.335] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.335] lstrlenW (lpString=".zip") returned 4 [0106.335] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.335] lstrlenW (lpString=".rar") returned 4 [0106.335] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.335] lstrlenW (lpString=".bz2") returned 4 [0106.335] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.335] lstrlenW (lpString=".7z") returned 3 [0106.335] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.335] lstrlenW (lpString=".dbf") returned 4 [0106.335] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.335] lstrlenW (lpString=".1cd") returned 4 [0106.335] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 54 [0106.336] lstrlenW (lpString=".jpg") returned 4 [0106.336] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.336] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") [0106.639] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=877984) returned 1 [0106.646] CloseHandle (hObject=0x1c0) returned 1 [0106.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb")) returned 0x20 [0106.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.652] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.653] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0106.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0106.653] GetLastError () returned 0x0 [0106.653] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xd65a0, lpOverlapped=0x0) returned 1 [0106.672] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xd65b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xd65b0, lpOverlapped=0x0) returned 1 [0107.033] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0107.033] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0107.033] SetEndOfFile (hFile=0x16c) returned 1 [0107.033] CloseHandle (hObject=0x16c) returned 1 [0107.033] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.033] SetEndOfFile (hFile=0x1c0) returned 1 [0107.041] CloseHandle (hObject=0x1c0) returned 1 [0107.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb")) returned 1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.041] lstrlenW (lpString=".doc") returned 4 [0107.041] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0107.041] lstrlenW (lpString=".docx") returned 5 [0107.041] lstrcmpiW (lpString1=".docx", lpString2="J.OLB") returned -1 [0107.041] lstrlenW (lpString=".pdf") returned 4 [0107.041] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0107.041] lstrlenW (lpString=".xls") returned 4 [0107.041] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0107.041] lstrlenW (lpString=".xlsx") returned 5 [0107.041] lstrcmpiW (lpString1=".xlsx", lpString2="J.OLB") returned -1 [0107.041] lstrlenW (lpString=".ppt") returned 4 [0107.041] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.041] lstrlenW (lpString=".zip") returned 4 [0107.041] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0107.042] lstrlenW (lpString=".rar") returned 4 [0107.042] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0107.042] lstrlenW (lpString=".bz2") returned 4 [0107.042] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0107.042] lstrlenW (lpString=".7z") returned 3 [0107.042] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0107.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.042] lstrlenW (lpString=".dbf") returned 4 [0107.042] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0107.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.042] lstrlenW (lpString=".1cd") returned 4 [0107.042] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0107.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 52 [0107.042] lstrlenW (lpString=".jpg") returned 4 [0107.042] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0107.042] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") [0107.043] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=901464) returned 1 [0107.043] CloseHandle (hObject=0x1c0) returned 1 [0107.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb")) returned 0x20 [0107.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0107.043] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.043] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0107.044] GetLastError () returned 0x0 [0107.044] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdc158, lpOverlapped=0x0) returned 1 [0107.062] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdc160, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdc160, lpOverlapped=0x0) returned 1 [0107.079] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0107.079] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0107.079] SetEndOfFile (hFile=0x16c) returned 1 [0107.079] CloseHandle (hObject=0x16c) returned 1 [0107.079] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.079] SetEndOfFile (hFile=0x1c0) returned 1 [0107.086] CloseHandle (hObject=0x1c0) returned 1 [0107.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb")) returned 1 [0107.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.087] lstrlenW (lpString=".doc") returned 4 [0107.087] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0107.087] lstrlenW (lpString=".docx") returned 5 [0107.087] lstrcmpiW (lpString1=".docx", lpString2="D.OLB") returned -1 [0107.087] lstrlenW (lpString=".pdf") returned 4 [0107.087] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0107.087] lstrlenW (lpString=".xls") returned 4 [0107.087] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0107.087] lstrlenW (lpString=".xlsx") returned 5 [0107.087] lstrcmpiW (lpString1=".xlsx", lpString2="D.OLB") returned -1 [0107.087] lstrlenW (lpString=".ppt") returned 4 [0107.087] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0107.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.087] lstrlenW (lpString=".zip") returned 4 [0107.087] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0107.088] lstrlenW (lpString=".rar") returned 4 [0107.088] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0107.088] lstrlenW (lpString=".bz2") returned 4 [0107.088] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0107.088] lstrlenW (lpString=".7z") returned 3 [0107.088] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0107.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.088] lstrlenW (lpString=".dbf") returned 4 [0107.088] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0107.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.088] lstrlenW (lpString=".1cd") returned 4 [0107.088] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0107.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 53 [0107.088] lstrlenW (lpString=".jpg") returned 4 [0107.088] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0107.088] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") [0107.435] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=288048) returned 1 [0107.435] CloseHandle (hObject=0x1f4) returned 1 [0107.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll")) returned 0x20 [0107.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0107.435] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.435] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0107.436] GetLastError () returned 0x0 [0107.436] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x46530, lpOverlapped=0x0) returned 1 [0107.484] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x46540, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x46540, lpOverlapped=0x0) returned 1 [0107.490] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0107.490] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.490] SetEndOfFile (hFile=0x158) returned 1 [0107.490] CloseHandle (hObject=0x158) returned 1 [0107.490] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0107.490] SetEndOfFile (hFile=0x1f4) returned 1 [0107.493] CloseHandle (hObject=0x1f4) returned 1 [0107.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll")) returned 1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.494] lstrlenW (lpString=".doc") returned 4 [0107.494] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString=".docx") returned 5 [0107.494] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0107.494] lstrlenW (lpString=".pdf") returned 4 [0107.494] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString=".xls") returned 4 [0107.494] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString=".xlsx") returned 5 [0107.494] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0107.494] lstrlenW (lpString=".ppt") returned 4 [0107.494] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.494] lstrlenW (lpString=".zip") returned 4 [0107.494] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString=".rar") returned 4 [0107.494] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.494] lstrlenW (lpString=".bz2") returned 4 [0107.494] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.494] lstrlenW (lpString=".7z") returned 3 [0107.495] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.495] lstrlenW (lpString=".dbf") returned 4 [0107.495] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.495] lstrlenW (lpString=".1cd") returned 4 [0107.495] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 55 [0107.495] lstrlenW (lpString=".jpg") returned 4 [0107.495] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.495] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") [0107.496] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5807024) returned 1 [0107.496] CloseHandle (hObject=0x1f4) returned 1 [0107.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll")) returned 0x20 [0107.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0107.498] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0107.498] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0107.498] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.543] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1d893a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0107.543] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.991] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.991] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x549bb0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0107.991] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.008] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0108.008] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0108.286] SetEndOfFile (hFile=0x1f4) returned 1 [0108.447] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0108.447] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0108.447] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.448] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1d893a, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0108.448] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.454] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x549bb0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0108.454] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.456] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0108.456] CloseHandle (hObject=0x1f4) returned 1 [0108.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.456] lstrlenW (lpString=".doc") returned 4 [0108.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0108.456] lstrlenW (lpString=".docx") returned 5 [0108.456] lstrcmpiW (lpString1=".docx", lpString2="9.dll") returned -1 [0108.456] lstrlenW (lpString=".pdf") returned 4 [0108.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0108.456] lstrlenW (lpString=".xls") returned 4 [0108.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0108.456] lstrlenW (lpString=".xlsx") returned 5 [0108.456] lstrcmpiW (lpString1=".xlsx", lpString2="9.dll") returned -1 [0108.456] lstrlenW (lpString=".ppt") returned 4 [0108.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.457] lstrlenW (lpString=".zip") returned 4 [0108.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0108.457] lstrlenW (lpString=".rar") returned 4 [0108.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0108.457] lstrlenW (lpString=".bz2") returned 4 [0108.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0108.457] lstrlenW (lpString=".7z") returned 3 [0108.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.457] lstrlenW (lpString=".dbf") returned 4 [0108.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.457] lstrlenW (lpString=".1cd") returned 4 [0108.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 60 [0108.457] lstrlenW (lpString=".jpg") returned 4 [0108.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0108.457] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") [0108.859] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=19196280) returned 1 [0108.859] CloseHandle (hObject=0x15c) returned 1 [0108.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll")) returned 0x20 [0108.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0108.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.866] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0108.866] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0108.866] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.893] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x61a328, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0108.893] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.947] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0108.947] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x120e978, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0108.947] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.968] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0108.968] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0108.987] SetEndOfFile (hFile=0x1f4) returned 1 [0108.987] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0108.987] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0108.987] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.988] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x61a328, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0108.988] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.097] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x120e978, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0109.097] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.100] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0109.103] CloseHandle (hObject=0x1f4) returned 1 [0109.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.103] lstrlenW (lpString=".doc") returned 4 [0109.103] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString=".docx") returned 5 [0109.104] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0109.104] lstrlenW (lpString=".pdf") returned 4 [0109.104] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString=".xls") returned 4 [0109.104] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString=".xlsx") returned 5 [0109.104] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0109.104] lstrlenW (lpString=".ppt") returned 4 [0109.104] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.104] lstrlenW (lpString=".zip") returned 4 [0109.104] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString=".rar") returned 4 [0109.104] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.104] lstrlenW (lpString=".bz2") returned 4 [0109.104] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.104] lstrlenW (lpString=".7z") returned 3 [0109.104] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.104] lstrlenW (lpString=".dbf") returned 4 [0109.104] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.104] lstrlenW (lpString=".1cd") returned 4 [0109.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 55 [0109.104] lstrlenW (lpString=".jpg") returned 4 [0109.104] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.104] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") [0109.381] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4966264) returned 1 [0109.381] CloseHandle (hObject=0x1f4) returned 1 [0109.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll")) returned 0x20 [0109.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0109.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0109.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0109.383] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.397] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x19427d, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0109.397] ReadFile (in: hFile=0x1f4, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.492] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0109.492] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x47c778, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0109.492] ReadFile (in: hFile=0x1f4, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.555] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc00fc, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc00fc, lpOverlapped=0x0) returned 1 [0109.578] SetEndOfFile (hFile=0x1f4) returned 1 [0109.578] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0109.582] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0109.583] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.584] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x19427d, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0109.584] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x47c778, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0109.709] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0109.711] CloseHandle (hObject=0x1f4) returned 1 [0109.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.711] lstrlenW (lpString=".doc") returned 4 [0109.711] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.711] lstrlenW (lpString=".docx") returned 5 [0109.711] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0109.711] lstrlenW (lpString=".pdf") returned 4 [0109.711] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.711] lstrlenW (lpString=".xls") returned 4 [0109.712] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.712] lstrlenW (lpString=".xlsx") returned 5 [0109.712] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0109.712] lstrlenW (lpString=".ppt") returned 4 [0109.757] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.757] lstrlenW (lpString=".zip") returned 4 [0109.757] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.757] lstrlenW (lpString=".rar") returned 4 [0109.757] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.757] lstrlenW (lpString=".bz2") returned 4 [0109.757] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.757] lstrlenW (lpString=".7z") returned 3 [0109.758] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.758] lstrlenW (lpString=".dbf") returned 4 [0109.758] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.758] lstrlenW (lpString=".1cd") returned 4 [0109.758] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 51 [0109.758] lstrlenW (lpString=".jpg") returned 4 [0109.758] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.758] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") [0109.853] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=803728) returned 1 [0109.853] CloseHandle (hObject=0x1fc) returned 1 [0109.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll")) returned 0x20 [0109.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.854] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.854] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.855] GetLastError () returned 0x0 [0109.855] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc4390, lpOverlapped=0x0) returned 1 [0109.875] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc43a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc43a0, lpOverlapped=0x0) returned 1 [0109.925] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0109.925] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.925] SetEndOfFile (hFile=0x158) returned 1 [0109.925] CloseHandle (hObject=0x158) returned 1 [0109.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.925] SetEndOfFile (hFile=0x1fc) returned 1 [0109.932] CloseHandle (hObject=0x1fc) returned 1 [0109.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll")) returned 1 [0109.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.933] lstrlenW (lpString=".doc") returned 4 [0109.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".docx") returned 5 [0109.933] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0109.933] lstrlenW (lpString=".pdf") returned 4 [0109.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".xls") returned 4 [0109.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".xlsx") returned 5 [0109.933] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0109.933] lstrlenW (lpString=".ppt") returned 4 [0109.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.933] lstrlenW (lpString=".zip") returned 4 [0109.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".rar") returned 4 [0109.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".bz2") returned 4 [0109.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString=".7z") returned 3 [0109.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.934] lstrlenW (lpString=".dbf") returned 4 [0109.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.934] lstrlenW (lpString=".1cd") returned 4 [0109.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 55 [0109.934] lstrlenW (lpString=".jpg") returned 4 [0109.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.934] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") [0109.935] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=644472) returned 1 [0109.935] CloseHandle (hObject=0x1fc) returned 1 [0109.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll")) returned 0x20 [0109.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.935] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.935] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0109.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.936] GetLastError () returned 0x0 [0109.937] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x9d578, lpOverlapped=0x0) returned 1 [0110.001] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9d580, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x9d580, lpOverlapped=0x0) returned 1 [0110.103] ReadFile (in: hFile=0x1fc, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0110.103] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.103] SetEndOfFile (hFile=0x158) returned 1 [0110.103] CloseHandle (hObject=0x158) returned 1 [0110.103] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.104] SetEndOfFile (hFile=0x1fc) returned 1 [0110.109] CloseHandle (hObject=0x1fc) returned 1 [0110.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll")) returned 1 [0110.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.110] lstrlenW (lpString=".doc") returned 4 [0110.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString=".docx") returned 5 [0110.110] lstrcmpiW (lpString1=".docx", lpString2="D.dll") returned -1 [0110.110] lstrlenW (lpString=".pdf") returned 4 [0110.110] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString=".xls") returned 4 [0110.110] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString=".xlsx") returned 5 [0110.110] lstrcmpiW (lpString1=".xlsx", lpString2="D.dll") returned -1 [0110.110] lstrlenW (lpString=".ppt") returned 4 [0110.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.110] lstrlenW (lpString=".zip") returned 4 [0110.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString=".rar") returned 4 [0110.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.110] lstrlenW (lpString=".bz2") returned 4 [0110.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.110] lstrlenW (lpString=".7z") returned 3 [0110.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.111] lstrlenW (lpString=".dbf") returned 4 [0110.111] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.111] lstrlenW (lpString=".1cd") returned 4 [0110.111] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 55 [0110.111] lstrlenW (lpString=".jpg") returned 4 [0110.111] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.111] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") [0110.436] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9600) returned 1 [0110.436] CloseHandle (hObject=0x1c0) returned 1 [0110.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd")) returned 0x20 [0110.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.436] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.436] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.437] GetLastError () returned 0x0 [0110.437] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2580, lpOverlapped=0x0) returned 1 [0110.439] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2590, lpOverlapped=0x0) returned 1 [0110.440] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0110.440] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf6, lpOverlapped=0x0) returned 1 [0110.440] SetEndOfFile (hFile=0x1b8) returned 1 [0110.440] CloseHandle (hObject=0x1b8) returned 1 [0110.440] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.440] SetEndOfFile (hFile=0x1c0) returned 1 [0110.441] CloseHandle (hObject=0x1c0) returned 1 [0110.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd")) returned 1 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.442] lstrlenW (lpString=".doc") returned 4 [0110.442] lstrcmpiW (lpString1=".doc", lpString2=".gpd") returned -1 [0110.442] lstrlenW (lpString=".docx") returned 5 [0110.442] lstrcmpiW (lpString1=".docx", lpString2="e.gpd") returned -1 [0110.442] lstrlenW (lpString=".pdf") returned 4 [0110.442] lstrcmpiW (lpString1=".pdf", lpString2=".gpd") returned 1 [0110.442] lstrlenW (lpString=".xls") returned 4 [0110.442] lstrcmpiW (lpString1=".xls", lpString2=".gpd") returned 1 [0110.442] lstrlenW (lpString=".xlsx") returned 5 [0110.442] lstrcmpiW (lpString1=".xlsx", lpString2="e.gpd") returned -1 [0110.442] lstrlenW (lpString=".ppt") returned 4 [0110.442] lstrcmpiW (lpString1=".ppt", lpString2=".gpd") returned 1 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.442] lstrlenW (lpString=".zip") returned 4 [0110.442] lstrcmpiW (lpString1=".zip", lpString2=".gpd") returned 1 [0110.442] lstrlenW (lpString=".rar") returned 4 [0110.442] lstrcmpiW (lpString1=".rar", lpString2=".gpd") returned 1 [0110.442] lstrlenW (lpString=".bz2") returned 4 [0110.442] lstrcmpiW (lpString1=".bz2", lpString2=".gpd") returned -1 [0110.442] lstrlenW (lpString=".7z") returned 3 [0110.442] lstrcmpiW (lpString1=".7z", lpString2="gpd") returned -1 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.442] lstrlenW (lpString=".dbf") returned 4 [0110.442] lstrcmpiW (lpString1=".dbf", lpString2=".gpd") returned -1 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.442] lstrlenW (lpString=".1cd") returned 4 [0110.442] lstrcmpiW (lpString1=".1cd", lpString2=".gpd") returned -1 [0110.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 68 [0110.443] lstrlenW (lpString=".jpg") returned 4 [0110.443] lstrcmpiW (lpString1=".jpg", lpString2=".gpd") returned 1 [0110.443] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") [0110.443] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=245120) returned 1 [0110.443] CloseHandle (hObject=0x1c0) returned 1 [0110.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe")) returned 0x20 [0110.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.444] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.444] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.445] GetLastError () returned 0x0 [0110.445] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3bd80, lpOverlapped=0x0) returned 1 [0110.487] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3bd90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3bd90, lpOverlapped=0x0) returned 1 [0110.492] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0110.492] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.492] SetEndOfFile (hFile=0x1b8) returned 1 [0110.492] CloseHandle (hObject=0x1b8) returned 1 [0110.492] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.492] SetEndOfFile (hFile=0x1c0) returned 1 [0110.494] CloseHandle (hObject=0x1c0) returned 1 [0110.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe")) returned 1 [0110.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.495] lstrlenW (lpString=".doc") returned 4 [0110.495] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.495] lstrlenW (lpString=".docx") returned 5 [0110.495] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0110.495] lstrlenW (lpString=".pdf") returned 4 [0110.495] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.495] lstrlenW (lpString=".xls") returned 4 [0110.495] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.495] lstrlenW (lpString=".xlsx") returned 5 [0110.495] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0110.495] lstrlenW (lpString=".ppt") returned 4 [0110.495] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.495] lstrlenW (lpString=".zip") returned 4 [0110.495] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.495] lstrlenW (lpString=".rar") returned 4 [0110.495] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.495] lstrlenW (lpString=".bz2") returned 4 [0110.496] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.496] lstrlenW (lpString=".7z") returned 3 [0110.496] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.496] lstrlenW (lpString=".dbf") returned 4 [0110.496] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.496] lstrlenW (lpString=".1cd") returned 4 [0110.496] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 55 [0110.496] lstrlenW (lpString=".jpg") returned 4 [0110.496] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.496] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") [0110.497] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=159088) returned 1 [0110.497] CloseHandle (hObject=0x1c0) returned 1 [0110.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll")) returned 0x20 [0110.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.498] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.498] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.499] GetLastError () returned 0x0 [0110.499] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x26d70, lpOverlapped=0x0) returned 1 [0110.552] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x26d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x26d80, lpOverlapped=0x0) returned 1 [0110.556] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0110.556] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf8, lpOverlapped=0x0) returned 1 [0110.556] SetEndOfFile (hFile=0x1b8) returned 1 [0110.556] CloseHandle (hObject=0x1b8) returned 1 [0110.556] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.556] SetEndOfFile (hFile=0x1c0) returned 1 [0110.558] CloseHandle (hObject=0x1c0) returned 1 [0110.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll")) returned 1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.558] lstrlenW (lpString=".doc") returned 4 [0110.558] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString=".docx") returned 5 [0110.558] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0110.558] lstrlenW (lpString=".pdf") returned 4 [0110.558] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString=".xls") returned 4 [0110.558] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString=".xlsx") returned 5 [0110.558] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0110.558] lstrlenW (lpString=".ppt") returned 4 [0110.558] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.558] lstrlenW (lpString=".zip") returned 4 [0110.558] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString=".rar") returned 4 [0110.558] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.558] lstrlenW (lpString=".bz2") returned 4 [0110.559] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.559] lstrlenW (lpString=".7z") returned 3 [0110.559] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.559] lstrlenW (lpString=".dbf") returned 4 [0110.559] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.559] lstrlenW (lpString=".1cd") returned 4 [0110.559] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 61 [0110.564] lstrlenW (lpString=".jpg") returned 4 [0110.565] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.565] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") [0110.566] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=760184) returned 1 [0110.566] CloseHandle (hObject=0x1c0) returned 1 [0110.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll")) returned 0x20 [0110.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.566] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.566] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.567] GetLastError () returned 0x0 [0110.567] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xb9978, lpOverlapped=0x0) returned 1 [0110.654] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb9980, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xb9980, lpOverlapped=0x0) returned 1 [0110.671] ReadFile (in: hFile=0x1c0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0110.671] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf2, lpOverlapped=0x0) returned 1 [0110.671] SetEndOfFile (hFile=0x1b8) returned 1 [0110.671] CloseHandle (hObject=0x1b8) returned 1 [0110.671] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0110.671] SetEndOfFile (hFile=0x1c0) returned 1 [0110.845] CloseHandle (hObject=0x1c0) returned 1 [0110.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll")) returned 1 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.944] lstrlenW (lpString=".doc") returned 4 [0110.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString=".docx") returned 5 [0110.945] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0110.945] lstrlenW (lpString=".pdf") returned 4 [0110.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString=".xls") returned 4 [0110.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString=".xlsx") returned 5 [0110.945] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0110.945] lstrlenW (lpString=".ppt") returned 4 [0110.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.945] lstrlenW (lpString=".zip") returned 4 [0110.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString=".rar") returned 4 [0110.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.945] lstrlenW (lpString=".bz2") returned 4 [0110.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.945] lstrlenW (lpString=".7z") returned 3 [0110.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.945] lstrlenW (lpString=".dbf") returned 4 [0110.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.945] lstrlenW (lpString=".1cd") returned 4 [0110.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 58 [0110.945] lstrlenW (lpString=".jpg") returned 4 [0110.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.945] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") [0111.157] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=436120) returned 1 [0111.157] CloseHandle (hObject=0x1f4) returned 1 [0111.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll")) returned 0x20 [0111.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.157] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.157] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.158] GetLastError () returned 0x0 [0111.158] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6a798, lpOverlapped=0x0) returned 1 [0111.212] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6a7a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6a7a0, lpOverlapped=0x0) returned 1 [0111.220] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0111.220] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.220] SetEndOfFile (hFile=0x1c0) returned 1 [0111.220] CloseHandle (hObject=0x1c0) returned 1 [0111.221] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.221] SetEndOfFile (hFile=0x1f4) returned 1 [0111.224] CloseHandle (hObject=0x1f4) returned 1 [0111.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll")) returned 1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.225] lstrlenW (lpString=".doc") returned 4 [0111.225] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString=".docx") returned 5 [0111.225] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0111.225] lstrlenW (lpString=".pdf") returned 4 [0111.225] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString=".xls") returned 4 [0111.225] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString=".xlsx") returned 5 [0111.225] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0111.225] lstrlenW (lpString=".ppt") returned 4 [0111.225] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.225] lstrlenW (lpString=".zip") returned 4 [0111.225] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString=".rar") returned 4 [0111.225] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.225] lstrlenW (lpString=".bz2") returned 4 [0111.225] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.225] lstrlenW (lpString=".7z") returned 3 [0111.226] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.226] lstrlenW (lpString=".dbf") returned 4 [0111.226] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.226] lstrlenW (lpString=".1cd") returned 4 [0111.226] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 55 [0111.226] lstrlenW (lpString=".jpg") returned 4 [0111.226] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.226] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") [0111.227] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=72080) returned 1 [0111.227] CloseHandle (hObject=0x1f4) returned 1 [0111.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl")) returned 0x20 [0111.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.227] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.227] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.228] GetLastError () returned 0x0 [0111.228] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x11990, lpOverlapped=0x0) returned 1 [0111.258] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x119a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x119a0, lpOverlapped=0x0) returned 1 [0111.260] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0111.260] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.260] SetEndOfFile (hFile=0x1c0) returned 1 [0111.260] CloseHandle (hObject=0x1c0) returned 1 [0111.260] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.261] SetEndOfFile (hFile=0x1f4) returned 1 [0111.262] CloseHandle (hObject=0x1f4) returned 1 [0111.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl")) returned 1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.263] lstrlenW (lpString=".doc") returned 4 [0111.263] lstrcmpiW (lpString1=".doc", lpString2=".MDL") returned -1 [0111.263] lstrlenW (lpString=".docx") returned 5 [0111.263] lstrcmpiW (lpString1=".docx", lpString2="L.MDL") returned -1 [0111.263] lstrlenW (lpString=".pdf") returned 4 [0111.263] lstrcmpiW (lpString1=".pdf", lpString2=".MDL") returned 1 [0111.263] lstrlenW (lpString=".xls") returned 4 [0111.263] lstrcmpiW (lpString1=".xls", lpString2=".MDL") returned 1 [0111.263] lstrlenW (lpString=".xlsx") returned 5 [0111.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.MDL") returned -1 [0111.263] lstrlenW (lpString=".ppt") returned 4 [0111.263] lstrcmpiW (lpString1=".ppt", lpString2=".MDL") returned 1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.263] lstrlenW (lpString=".zip") returned 4 [0111.263] lstrcmpiW (lpString1=".zip", lpString2=".MDL") returned 1 [0111.263] lstrlenW (lpString=".rar") returned 4 [0111.263] lstrcmpiW (lpString1=".rar", lpString2=".MDL") returned 1 [0111.263] lstrlenW (lpString=".bz2") returned 4 [0111.263] lstrcmpiW (lpString1=".bz2", lpString2=".MDL") returned -1 [0111.263] lstrlenW (lpString=".7z") returned 3 [0111.263] lstrcmpiW (lpString1=".7z", lpString2="MDL") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.263] lstrlenW (lpString=".dbf") returned 4 [0111.263] lstrcmpiW (lpString1=".dbf", lpString2=".MDL") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.263] lstrlenW (lpString=".1cd") returned 4 [0111.263] lstrcmpiW (lpString1=".1cd", lpString2=".MDL") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 55 [0111.264] lstrlenW (lpString=".jpg") returned 4 [0111.264] lstrcmpiW (lpString1=".jpg", lpString2=".MDL") returned -1 [0111.264] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") [0111.265] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=41312) returned 1 [0111.265] CloseHandle (hObject=0x1f4) returned 1 [0111.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll")) returned 0x20 [0111.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.265] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.265] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.266] GetLastError () returned 0x0 [0111.266] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa160, lpOverlapped=0x0) returned 1 [0111.363] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa170, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa170, lpOverlapped=0x0) returned 1 [0111.365] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0111.365] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.365] SetEndOfFile (hFile=0x1c0) returned 1 [0111.365] CloseHandle (hObject=0x1c0) returned 1 [0111.365] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.365] SetEndOfFile (hFile=0x1f4) returned 1 [0111.366] CloseHandle (hObject=0x1f4) returned 1 [0111.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll")) returned 1 [0111.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.367] lstrlenW (lpString=".doc") returned 4 [0111.367] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString=".docx") returned 5 [0111.367] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0111.367] lstrlenW (lpString=".pdf") returned 4 [0111.367] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString=".xls") returned 4 [0111.367] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString=".xlsx") returned 5 [0111.367] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0111.367] lstrlenW (lpString=".ppt") returned 4 [0111.367] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.367] lstrlenW (lpString=".zip") returned 4 [0111.367] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString=".rar") returned 4 [0111.367] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.367] lstrlenW (lpString=".bz2") returned 4 [0111.367] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.367] lstrlenW (lpString=".7z") returned 3 [0111.367] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.367] lstrlenW (lpString=".dbf") returned 4 [0111.367] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.368] lstrlenW (lpString=".1cd") returned 4 [0111.368] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 55 [0111.368] lstrlenW (lpString=".jpg") returned 4 [0111.368] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.368] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") [0111.369] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=720776) returned 1 [0111.369] CloseHandle (hObject=0x1f4) returned 1 [0111.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll")) returned 0x20 [0111.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.370] GetLastError () returned 0x0 [0111.370] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xaff88, lpOverlapped=0x0) returned 1 [0111.517] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xaff90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xaff90, lpOverlapped=0x0) returned 1 [0111.532] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0111.532] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.532] SetEndOfFile (hFile=0x1c0) returned 1 [0111.532] CloseHandle (hObject=0x1c0) returned 1 [0111.532] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.532] SetEndOfFile (hFile=0x1f4) returned 1 [0111.538] CloseHandle (hObject=0x1f4) returned 1 [0111.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll")) returned 1 [0111.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.539] lstrlenW (lpString=".doc") returned 4 [0111.539] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString=".docx") returned 5 [0111.539] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0111.539] lstrlenW (lpString=".pdf") returned 4 [0111.539] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString=".xls") returned 4 [0111.539] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString=".xlsx") returned 5 [0111.539] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0111.539] lstrlenW (lpString=".ppt") returned 4 [0111.539] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.539] lstrlenW (lpString=".zip") returned 4 [0111.539] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString=".rar") returned 4 [0111.539] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.539] lstrlenW (lpString=".bz2") returned 4 [0111.539] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.539] lstrlenW (lpString=".7z") returned 3 [0111.540] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.540] lstrlenW (lpString=".dbf") returned 4 [0111.540] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.540] lstrlenW (lpString=".1cd") returned 4 [0111.540] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 55 [0111.540] lstrlenW (lpString=".jpg") returned 4 [0111.540] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.540] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") [0111.541] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=389520) returned 1 [0111.541] CloseHandle (hObject=0x1f4) returned 1 [0111.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll")) returned 0x20 [0111.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.542] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.542] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0111.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.543] GetLastError () returned 0x0 [0111.543] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5f190, lpOverlapped=0x0) returned 1 [0112.042] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5f1a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5f1a0, lpOverlapped=0x0) returned 1 [0112.049] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0112.049] WriteFile (in: hFile=0x1c0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.049] SetEndOfFile (hFile=0x1c0) returned 1 [0112.049] CloseHandle (hObject=0x1c0) returned 1 [0112.050] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.050] SetEndOfFile (hFile=0x1f4) returned 1 [0112.053] CloseHandle (hObject=0x1f4) returned 1 [0112.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll")) returned 1 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString=".doc") returned 4 [0112.054] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString=".docx") returned 5 [0112.054] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0112.054] lstrlenW (lpString=".pdf") returned 4 [0112.054] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString=".xls") returned 4 [0112.054] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString=".xlsx") returned 5 [0112.054] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0112.054] lstrlenW (lpString=".ppt") returned 4 [0112.054] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString=".zip") returned 4 [0112.054] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString=".rar") returned 4 [0112.054] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.054] lstrlenW (lpString=".bz2") returned 4 [0112.054] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.054] lstrlenW (lpString=".7z") returned 3 [0112.054] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString=".dbf") returned 4 [0112.054] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString=".1cd") returned 4 [0112.054] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 53 [0112.054] lstrlenW (lpString=".jpg") returned 4 [0112.055] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.055] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") [0112.119] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3506) returned 1 [0112.119] CloseHandle (hObject=0x19c) returned 1 [0112.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest")) returned 0x20 [0112.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.119] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.119] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.120] GetLastError () returned 0x0 [0112.120] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xdb2, lpOverlapped=0x0) returned 1 [0112.125] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xdc0, lpOverlapped=0x0) returned 1 [0112.126] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0112.126] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xfe, lpOverlapped=0x0) returned 1 [0112.126] SetEndOfFile (hFile=0x210) returned 1 [0112.127] CloseHandle (hObject=0x210) returned 1 [0112.127] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.127] SetEndOfFile (hFile=0x19c) returned 1 [0112.127] CloseHandle (hObject=0x19c) returned 1 [0112.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest")) returned 1 [0112.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.136] lstrlenW (lpString=".doc") returned 4 [0112.136] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0112.136] lstrlenW (lpString=".docx") returned 5 [0112.136] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0112.136] lstrlenW (lpString=".pdf") returned 4 [0112.136] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0112.136] lstrlenW (lpString=".xls") returned 4 [0112.136] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0112.136] lstrlenW (lpString=".xlsx") returned 5 [0112.136] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0112.137] lstrlenW (lpString=".ppt") returned 4 [0112.137] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.137] lstrlenW (lpString=".zip") returned 4 [0112.137] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString=".rar") returned 4 [0112.137] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString=".bz2") returned 4 [0112.137] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString=".7z") returned 3 [0112.137] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.137] lstrlenW (lpString=".dbf") returned 4 [0112.137] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.137] lstrlenW (lpString=".1cd") returned 4 [0112.137] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0112.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 64 [0112.137] lstrlenW (lpString=".jpg") returned 4 [0112.137] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0112.137] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") [0112.176] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=490896) returned 1 [0112.176] CloseHandle (hObject=0x19c) returned 1 [0112.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll")) returned 0x20 [0112.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.177] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.177] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.178] GetLastError () returned 0x0 [0112.178] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x77d90, lpOverlapped=0x0) returned 1 [0112.189] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x77da0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x77da0, lpOverlapped=0x0) returned 1 [0112.261] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0112.261] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.261] SetEndOfFile (hFile=0x210) returned 1 [0112.261] CloseHandle (hObject=0x210) returned 1 [0112.261] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.261] SetEndOfFile (hFile=0x19c) returned 1 [0112.265] CloseHandle (hObject=0x19c) returned 1 [0112.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll")) returned 1 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.266] lstrlenW (lpString=".doc") returned 4 [0112.266] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString=".docx") returned 5 [0112.266] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0112.266] lstrlenW (lpString=".pdf") returned 4 [0112.266] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString=".xls") returned 4 [0112.266] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString=".xlsx") returned 5 [0112.266] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0112.266] lstrlenW (lpString=".ppt") returned 4 [0112.266] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.266] lstrlenW (lpString=".zip") returned 4 [0112.266] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString=".rar") returned 4 [0112.266] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.266] lstrlenW (lpString=".bz2") returned 4 [0112.266] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.266] lstrlenW (lpString=".7z") returned 3 [0112.266] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.266] lstrlenW (lpString=".dbf") returned 4 [0112.266] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.267] lstrlenW (lpString=".1cd") returned 4 [0112.267] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 53 [0112.267] lstrlenW (lpString=".jpg") returned 4 [0112.267] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.267] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") [0112.298] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=171360) returned 1 [0112.298] CloseHandle (hObject=0x158) returned 1 [0112.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll")) returned 0x20 [0112.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.346] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.346] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.347] GetLastError () returned 0x0 [0112.347] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x29d60, lpOverlapped=0x0) returned 1 [0112.356] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x29d70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x29d70, lpOverlapped=0x0) returned 1 [0112.359] ReadFile (in: hFile=0x158, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0112.360] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.360] SetEndOfFile (hFile=0x1b8) returned 1 [0112.360] CloseHandle (hObject=0x1b8) returned 1 [0112.360] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.360] SetEndOfFile (hFile=0x158) returned 1 [0112.362] CloseHandle (hObject=0x158) returned 1 [0112.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll")) returned 1 [0112.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.362] lstrlenW (lpString=".doc") returned 4 [0112.362] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.362] lstrlenW (lpString=".docx") returned 5 [0112.362] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0112.362] lstrlenW (lpString=".pdf") returned 4 [0112.362] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.362] lstrlenW (lpString=".xls") returned 4 [0112.362] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.362] lstrlenW (lpString=".xlsx") returned 5 [0112.362] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0112.362] lstrlenW (lpString=".ppt") returned 4 [0112.362] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.363] lstrlenW (lpString=".zip") returned 4 [0112.363] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.363] lstrlenW (lpString=".rar") returned 4 [0112.363] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.363] lstrlenW (lpString=".bz2") returned 4 [0112.363] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.363] lstrlenW (lpString=".7z") returned 3 [0112.363] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.363] lstrlenW (lpString=".dbf") returned 4 [0112.363] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.363] lstrlenW (lpString=".1cd") returned 4 [0112.363] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 55 [0112.363] lstrlenW (lpString=".jpg") returned 4 [0112.363] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.363] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") [0112.398] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2259968) returned 1 [0112.398] CloseHandle (hObject=0x158) returned 1 [0112.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll")) returned 0x20 [0112.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.399] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0112.399] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0112.400] ReadFile (in: hFile=0x158, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.539] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb7eaa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0112.539] ReadFile (in: hFile=0x158, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.545] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.545] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e7c00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0112.545] ReadFile (in: hFile=0x158, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.569] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0112.569] WriteFile (in: hFile=0x158, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.705] SetEndOfFile (hFile=0x158) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0112.705] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0112.705] WriteFile (in: hFile=0x158, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.707] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb7eaa, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0112.707] WriteFile (in: hFile=0x158, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.709] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e7c00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0112.709] WriteFile (in: hFile=0x158, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.710] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0112.710] CloseHandle (hObject=0x158) returned 1 [0112.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString=".doc") returned 4 [0112.711] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString=".docx") returned 5 [0112.711] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0112.711] lstrlenW (lpString=".pdf") returned 4 [0112.711] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString=".xls") returned 4 [0112.711] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString=".xlsx") returned 5 [0112.711] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0112.711] lstrlenW (lpString=".ppt") returned 4 [0112.711] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString=".zip") returned 4 [0112.711] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString=".rar") returned 4 [0112.711] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.711] lstrlenW (lpString=".bz2") returned 4 [0112.711] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.711] lstrlenW (lpString=".7z") returned 3 [0112.711] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString=".dbf") returned 4 [0112.711] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString=".1cd") returned 4 [0112.711] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 65 [0112.711] lstrlenW (lpString=".jpg") returned 4 [0112.712] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.712] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") [0113.442] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=223624) returned 1 [0113.442] CloseHandle (hObject=0x1a0) returned 1 [0113.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll")) returned 0x20 [0113.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.443] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.443] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.443] GetLastError () returned 0x0 [0113.443] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x36988, lpOverlapped=0x0) returned 1 [0113.449] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x36990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x36990, lpOverlapped=0x0) returned 1 [0113.453] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0113.453] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.453] SetEndOfFile (hFile=0x180) returned 1 [0113.453] CloseHandle (hObject=0x180) returned 1 [0113.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.453] SetEndOfFile (hFile=0x1a0) returned 1 [0113.455] CloseHandle (hObject=0x1a0) returned 1 [0113.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll")) returned 1 [0113.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.456] lstrlenW (lpString=".doc") returned 4 [0113.456] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString=".docx") returned 5 [0113.456] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0113.456] lstrlenW (lpString=".pdf") returned 4 [0113.456] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString=".xls") returned 4 [0113.456] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString=".xlsx") returned 5 [0113.456] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0113.456] lstrlenW (lpString=".ppt") returned 4 [0113.456] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.456] lstrlenW (lpString=".zip") returned 4 [0113.456] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString=".rar") returned 4 [0113.456] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0113.456] lstrlenW (lpString=".bz2") returned 4 [0113.456] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0113.456] lstrlenW (lpString=".7z") returned 3 [0113.457] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0113.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.457] lstrlenW (lpString=".dbf") returned 4 [0113.457] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0113.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.457] lstrlenW (lpString=".1cd") returned 4 [0113.457] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0113.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 60 [0113.457] lstrlenW (lpString=".jpg") returned 4 [0113.457] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0113.457] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") [0113.457] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16) returned 1 [0113.458] CloseHandle (hObject=0x1a0) returned 1 [0113.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub")) returned 0x20 [0113.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.458] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.458] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.459] GetLastError () returned 0x0 [0113.459] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x10, lpOverlapped=0x0) returned 1 [0113.459] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x20, lpOverlapped=0x0) returned 1 [0113.460] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0113.460] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.460] SetEndOfFile (hFile=0x180) returned 1 [0113.461] CloseHandle (hObject=0x180) returned 1 [0113.461] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.461] SetEndOfFile (hFile=0x1a0) returned 1 [0113.461] CloseHandle (hObject=0x1a0) returned 1 [0113.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub")) returned 1 [0113.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.462] lstrlenW (lpString=".doc") returned 4 [0113.462] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0113.462] lstrlenW (lpString=".docx") returned 5 [0113.462] lstrcmpiW (lpString1=".docx", lpString2="S.dub") returned -1 [0113.462] lstrlenW (lpString=".pdf") returned 4 [0113.462] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0113.462] lstrlenW (lpString=".xls") returned 4 [0113.462] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0113.462] lstrlenW (lpString=".xlsx") returned 5 [0113.462] lstrcmpiW (lpString1=".xlsx", lpString2="S.dub") returned -1 [0113.462] lstrlenW (lpString=".ppt") returned 4 [0113.462] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0113.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.462] lstrlenW (lpString=".zip") returned 4 [0113.462] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0113.462] lstrlenW (lpString=".rar") returned 4 [0113.462] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0113.462] lstrlenW (lpString=".bz2") returned 4 [0113.462] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0113.462] lstrlenW (lpString=".7z") returned 3 [0113.462] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0113.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.463] lstrlenW (lpString=".dbf") returned 4 [0113.463] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0113.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.463] lstrlenW (lpString=".1cd") returned 4 [0113.463] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0113.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 60 [0113.463] lstrlenW (lpString=".jpg") returned 4 [0113.463] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0113.463] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") [0113.463] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1967616) returned 1 [0113.463] CloseHandle (hObject=0x1a0) returned 1 [0113.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex")) returned 0x20 [0113.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0113.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.465] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0113.465] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0113.465] ReadFile (in: hFile=0x1a0, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.468] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa0200, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0113.469] ReadFile (in: hFile=0x1a0, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.474] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0113.474] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a0600, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0113.474] ReadFile (in: hFile=0x1a0, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.554] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0113.554] WriteFile (in: hFile=0x1a0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0113.575] SetEndOfFile (hFile=0x1a0) returned 1 [0113.945] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0113.945] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0113.945] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.947] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa0200, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0113.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.949] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a0600, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0113.949] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0113.951] CloseHandle (hObject=0x1a0) returned 1 [0114.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.138] lstrlenW (lpString=".doc") returned 4 [0114.138] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0114.138] lstrlenW (lpString=".docx") returned 5 [0114.138] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0114.139] lstrlenW (lpString=".pdf") returned 4 [0114.139] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0114.139] lstrlenW (lpString=".xls") returned 4 [0114.139] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0114.139] lstrlenW (lpString=".xlsx") returned 5 [0114.139] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0114.139] lstrlenW (lpString=".ppt") returned 4 [0114.139] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0114.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.139] lstrlenW (lpString=".zip") returned 4 [0114.161] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0114.161] lstrlenW (lpString=".rar") returned 4 [0114.161] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0114.161] lstrlenW (lpString=".bz2") returned 4 [0114.161] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0114.161] lstrlenW (lpString=".7z") returned 3 [0114.161] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0114.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.161] lstrlenW (lpString=".dbf") returned 4 [0114.161] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0114.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.161] lstrlenW (lpString=".1cd") returned 4 [0114.161] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0114.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 60 [0114.161] lstrlenW (lpString=".jpg") returned 4 [0114.161] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0114.162] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") [0114.203] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=454528) returned 1 [0114.203] CloseHandle (hObject=0x19c) returned 1 [0114.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll")) returned 0x20 [0114.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.203] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.203] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.205] GetLastError () returned 0x0 [0114.205] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6ef80, lpOverlapped=0x0) returned 1 [0114.215] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6ef90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6ef90, lpOverlapped=0x0) returned 1 [0114.225] ReadFile (in: hFile=0x19c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.225] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.225] SetEndOfFile (hFile=0x180) returned 1 [0114.225] CloseHandle (hObject=0x180) returned 1 [0114.225] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.225] SetEndOfFile (hFile=0x19c) returned 1 [0114.229] CloseHandle (hObject=0x19c) returned 1 [0114.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll")) returned 1 [0114.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.229] lstrlenW (lpString=".doc") returned 4 [0114.229] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.229] lstrlenW (lpString=".docx") returned 5 [0114.229] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0114.229] lstrlenW (lpString=".pdf") returned 4 [0114.230] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.230] lstrlenW (lpString=".xls") returned 4 [0114.230] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.230] lstrlenW (lpString=".xlsx") returned 5 [0114.230] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0114.230] lstrlenW (lpString=".ppt") returned 4 [0114.230] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.230] lstrlenW (lpString=".zip") returned 4 [0114.230] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.230] lstrlenW (lpString=".rar") returned 4 [0114.230] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.230] lstrlenW (lpString=".bz2") returned 4 [0114.230] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.230] lstrlenW (lpString=".7z") returned 3 [0114.230] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.230] lstrlenW (lpString=".dbf") returned 4 [0114.230] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.230] lstrlenW (lpString=".1cd") returned 4 [0114.230] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 60 [0114.230] lstrlenW (lpString=".jpg") returned 4 [0114.230] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.230] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") [0114.234] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4251136) returned 1 [0114.247] CloseHandle (hObject=0x19c) returned 1 [0114.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex")) returned 0x20 [0114.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0114.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.390] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0x0) returned 1 [0114.390] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0114.390] ReadFile (in: hFile=0x19c, lpBuffer=0x3800058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3800058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.478] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x159f55, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0114.478] ReadFile (in: hFile=0x19c, lpBuffer=0x3840058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3840058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2befc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3cde00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc2c | out: lpNewFilePointer=0x0) returned 1 [0114.500] ReadFile (in: hFile=0x19c, lpBuffer=0x3880058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2befc38, lpOverlapped=0x0 | out: lpBuffer=0x3880058*, lpNumberOfBytesRead=0x2befc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.562] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.562] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2befcb0, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0114.672] SetEndOfFile (hFile=0x19c) returned 1 [0114.672] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0114.672] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0114.672] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.673] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x159f55, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0114.673] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.675] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3cde00, lpNewFilePointer=0x0, dwMoveMethod=0x2befc7c | out: lpNewFilePointer=0x0) returned 1 [0114.675] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2befc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2befc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.677] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0114.677] CloseHandle (hObject=0x19c) returned 1 [0114.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.677] lstrlenW (lpString=".doc") returned 4 [0114.677] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0114.677] lstrlenW (lpString=".docx") returned 5 [0114.677] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0114.677] lstrlenW (lpString=".pdf") returned 4 [0114.677] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0114.677] lstrlenW (lpString=".xls") returned 4 [0114.677] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0114.677] lstrlenW (lpString=".xlsx") returned 5 [0114.677] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0114.677] lstrlenW (lpString=".ppt") returned 4 [0114.677] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0114.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.677] lstrlenW (lpString=".zip") returned 4 [0114.678] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0114.678] lstrlenW (lpString=".rar") returned 4 [0114.678] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0114.678] lstrlenW (lpString=".bz2") returned 4 [0114.678] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0114.678] lstrlenW (lpString=".7z") returned 3 [0114.678] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0114.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.678] lstrlenW (lpString=".dbf") returned 4 [0114.678] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0114.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.678] lstrlenW (lpString=".1cd") returned 4 [0114.678] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0114.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 60 [0114.678] lstrlenW (lpString=".jpg") returned 4 [0114.678] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0114.678] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") [0114.777] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=51808) returned 1 [0114.777] CloseHandle (hObject=0x180) returned 1 [0114.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr")) returned 0x20 [0114.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.778] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.778] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.795] GetLastError () returned 0x0 [0114.795] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xca60, lpOverlapped=0x0) returned 1 [0114.815] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xca70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xca70, lpOverlapped=0x0) returned 1 [0114.816] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.817] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.817] SetEndOfFile (hFile=0x19c) returned 1 [0114.817] CloseHandle (hObject=0x19c) returned 1 [0114.817] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.817] SetEndOfFile (hFile=0x180) returned 1 [0114.818] CloseHandle (hObject=0x180) returned 1 [0114.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr")) returned 1 [0114.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.818] lstrlenW (lpString=".doc") returned 4 [0114.818] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.818] lstrlenW (lpString=".docx") returned 5 [0114.818] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0114.819] lstrlenW (lpString=".pdf") returned 4 [0114.819] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString=".xls") returned 4 [0114.819] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString=".xlsx") returned 5 [0114.819] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0114.819] lstrlenW (lpString=".ppt") returned 4 [0114.819] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.819] lstrlenW (lpString=".zip") returned 4 [0114.819] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString=".rar") returned 4 [0114.819] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString=".bz2") returned 4 [0114.819] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString=".7z") returned 3 [0114.819] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.819] lstrlenW (lpString=".dbf") returned 4 [0114.819] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.819] lstrlenW (lpString=".1cd") returned 4 [0114.819] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 60 [0114.819] lstrlenW (lpString=".jpg") returned 4 [0114.819] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.819] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") [0114.820] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=56920) returned 1 [0114.821] CloseHandle (hObject=0x180) returned 1 [0114.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr")) returned 0x20 [0114.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.821] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.821] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.822] GetLastError () returned 0x0 [0114.822] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xde58, lpOverlapped=0x0) returned 1 [0114.825] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xde60, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xde60, lpOverlapped=0x0) returned 1 [0114.826] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.826] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.826] SetEndOfFile (hFile=0x19c) returned 1 [0114.826] CloseHandle (hObject=0x19c) returned 1 [0114.826] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.826] SetEndOfFile (hFile=0x180) returned 1 [0114.828] CloseHandle (hObject=0x180) returned 1 [0114.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr")) returned 1 [0114.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.828] lstrlenW (lpString=".doc") returned 4 [0114.828] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.828] lstrlenW (lpString=".docx") returned 5 [0114.828] lstrcmpiW (lpString1=".docx", lpString2="A.BDR") returned -1 [0114.828] lstrlenW (lpString=".pdf") returned 4 [0114.828] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.828] lstrlenW (lpString=".xls") returned 4 [0114.828] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString=".xlsx") returned 5 [0114.829] lstrcmpiW (lpString1=".xlsx", lpString2="A.BDR") returned -1 [0114.829] lstrlenW (lpString=".ppt") returned 4 [0114.829] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.829] lstrlenW (lpString=".zip") returned 4 [0114.829] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString=".rar") returned 4 [0114.829] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString=".bz2") returned 4 [0114.829] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString=".7z") returned 3 [0114.829] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.829] lstrlenW (lpString=".dbf") returned 4 [0114.829] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.829] lstrlenW (lpString=".1cd") returned 4 [0114.829] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 60 [0114.829] lstrlenW (lpString=".jpg") returned 4 [0114.829] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.829] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") [0114.831] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3918) returned 1 [0114.831] CloseHandle (hObject=0x180) returned 1 [0114.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr")) returned 0x20 [0114.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.831] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.831] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.832] GetLastError () returned 0x0 [0114.832] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xf4e, lpOverlapped=0x0) returned 1 [0114.834] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf50, lpOverlapped=0x0) returned 1 [0114.834] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.834] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.835] SetEndOfFile (hFile=0x19c) returned 1 [0114.835] CloseHandle (hObject=0x19c) returned 1 [0114.835] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.835] SetEndOfFile (hFile=0x180) returned 1 [0114.836] CloseHandle (hObject=0x180) returned 1 [0114.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr")) returned 1 [0114.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.836] lstrlenW (lpString=".doc") returned 4 [0114.836] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.836] lstrlenW (lpString=".docx") returned 5 [0114.836] lstrcmpiW (lpString1=".docx", lpString2="B.BDR") returned -1 [0114.836] lstrlenW (lpString=".pdf") returned 4 [0114.836] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.836] lstrlenW (lpString=".xls") returned 4 [0114.836] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.836] lstrlenW (lpString=".xlsx") returned 5 [0114.836] lstrcmpiW (lpString1=".xlsx", lpString2="B.BDR") returned -1 [0114.836] lstrlenW (lpString=".ppt") returned 4 [0114.836] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.836] lstrlenW (lpString=".zip") returned 4 [0114.836] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.837] lstrlenW (lpString=".rar") returned 4 [0114.837] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.837] lstrlenW (lpString=".bz2") returned 4 [0114.837] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.837] lstrlenW (lpString=".7z") returned 3 [0114.837] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.837] lstrlenW (lpString=".dbf") returned 4 [0114.837] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.837] lstrlenW (lpString=".1cd") returned 4 [0114.837] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 60 [0114.837] lstrlenW (lpString=".jpg") returned 4 [0114.837] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.837] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") [0114.838] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=49476) returned 1 [0114.838] CloseHandle (hObject=0x180) returned 1 [0114.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr")) returned 0x20 [0114.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.838] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.838] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.839] GetLastError () returned 0x0 [0114.839] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc144, lpOverlapped=0x0) returned 1 [0114.841] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc150, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc150, lpOverlapped=0x0) returned 1 [0114.843] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.843] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.843] SetEndOfFile (hFile=0x19c) returned 1 [0114.843] CloseHandle (hObject=0x19c) returned 1 [0114.843] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.843] SetEndOfFile (hFile=0x180) returned 1 [0114.844] CloseHandle (hObject=0x180) returned 1 [0114.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr")) returned 1 [0114.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.845] lstrlenW (lpString=".doc") returned 4 [0114.845] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".docx") returned 5 [0114.845] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0114.845] lstrlenW (lpString=".pdf") returned 4 [0114.845] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".xls") returned 4 [0114.845] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".xlsx") returned 5 [0114.845] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0114.845] lstrlenW (lpString=".ppt") returned 4 [0114.845] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.845] lstrlenW (lpString=".zip") returned 4 [0114.845] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".rar") returned 4 [0114.845] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".bz2") returned 4 [0114.845] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString=".7z") returned 3 [0114.845] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.845] lstrlenW (lpString=".dbf") returned 4 [0114.845] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.845] lstrlenW (lpString=".1cd") returned 4 [0114.845] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 59 [0114.845] lstrlenW (lpString=".jpg") returned 4 [0114.845] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.845] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") [0114.846] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9334) returned 1 [0114.846] CloseHandle (hObject=0x180) returned 1 [0114.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr")) returned 0x20 [0114.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.847] GetLastError () returned 0x0 [0114.847] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2476, lpOverlapped=0x0) returned 1 [0114.849] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2480, lpOverlapped=0x0) returned 1 [0114.850] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.850] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.850] SetEndOfFile (hFile=0x19c) returned 1 [0114.850] CloseHandle (hObject=0x19c) returned 1 [0114.850] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.850] SetEndOfFile (hFile=0x180) returned 1 [0114.851] CloseHandle (hObject=0x180) returned 1 [0114.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr")) returned 1 [0114.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString=".doc") returned 4 [0114.852] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".docx") returned 5 [0114.852] lstrcmpiW (lpString1=".docx", lpString2="B.BDR") returned -1 [0114.852] lstrlenW (lpString=".pdf") returned 4 [0114.852] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".xls") returned 4 [0114.852] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".xlsx") returned 5 [0114.852] lstrcmpiW (lpString1=".xlsx", lpString2="B.BDR") returned -1 [0114.852] lstrlenW (lpString=".ppt") returned 4 [0114.852] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString=".zip") returned 4 [0114.852] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".rar") returned 4 [0114.852] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".bz2") returned 4 [0114.852] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString=".7z") returned 3 [0114.852] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString=".dbf") returned 4 [0114.852] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString=".1cd") returned 4 [0114.852] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 60 [0114.852] lstrlenW (lpString=".jpg") returned 4 [0114.852] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.852] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") [0114.853] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=32582) returned 1 [0114.853] CloseHandle (hObject=0x180) returned 1 [0114.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr")) returned 0x20 [0114.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.853] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.853] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.854] GetLastError () returned 0x0 [0114.854] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x7f46, lpOverlapped=0x0) returned 1 [0114.856] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x7f50, lpOverlapped=0x0) returned 1 [0114.860] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.860] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.860] SetEndOfFile (hFile=0x19c) returned 1 [0114.860] CloseHandle (hObject=0x19c) returned 1 [0114.860] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.860] SetEndOfFile (hFile=0x180) returned 1 [0114.861] CloseHandle (hObject=0x180) returned 1 [0114.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr")) returned 1 [0114.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.861] lstrlenW (lpString=".doc") returned 4 [0114.861] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".docx") returned 5 [0114.862] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0114.862] lstrlenW (lpString=".pdf") returned 4 [0114.862] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".xls") returned 4 [0114.862] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".xlsx") returned 5 [0114.862] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0114.862] lstrlenW (lpString=".ppt") returned 4 [0114.862] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.862] lstrlenW (lpString=".zip") returned 4 [0114.862] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".rar") returned 4 [0114.862] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".bz2") returned 4 [0114.862] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString=".7z") returned 3 [0114.862] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.862] lstrlenW (lpString=".dbf") returned 4 [0114.862] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.862] lstrlenW (lpString=".1cd") returned 4 [0114.862] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 59 [0114.862] lstrlenW (lpString=".jpg") returned 4 [0114.862] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.862] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") [0114.863] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=31130) returned 1 [0114.863] CloseHandle (hObject=0x180) returned 1 [0114.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr")) returned 0x20 [0114.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.865] GetLastError () returned 0x0 [0114.865] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x799a, lpOverlapped=0x0) returned 1 [0114.866] WriteFile (in: hFile=0x1a0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0114.868] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0114.868] WriteFile (in: hFile=0x1a0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.868] SetEndOfFile (hFile=0x1a0) returned 1 [0114.920] CloseHandle (hObject=0x1a0) returned 1 [0114.920] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0114.920] SetEndOfFile (hFile=0x180) returned 1 [0114.921] CloseHandle (hObject=0x180) returned 1 [0114.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr")) returned 1 [0115.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.095] lstrlenW (lpString=".doc") returned 4 [0115.095] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".docx") returned 5 [0115.095] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0115.095] lstrlenW (lpString=".pdf") returned 4 [0115.095] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".xls") returned 4 [0115.095] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".xlsx") returned 5 [0115.095] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0115.095] lstrlenW (lpString=".ppt") returned 4 [0115.095] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.095] lstrlenW (lpString=".zip") returned 4 [0115.095] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".rar") returned 4 [0115.095] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".bz2") returned 4 [0115.095] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString=".7z") returned 3 [0115.095] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0115.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.095] lstrlenW (lpString=".dbf") returned 4 [0115.095] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0115.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.095] lstrlenW (lpString=".1cd") returned 4 [0115.095] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0115.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 59 [0115.095] lstrlenW (lpString=".jpg") returned 4 [0115.095] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0115.095] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") [0115.346] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11678) returned 1 [0115.347] CloseHandle (hObject=0x1c8) returned 1 [0115.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc")) returned 0x20 [0115.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.355] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0115.355] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0115.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.356] GetLastError () returned 0x0 [0115.356] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2d9e, lpOverlapped=0x0) returned 1 [0115.371] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0115.372] ReadFile (in: hFile=0x1c8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0115.372] WriteFile (in: hFile=0x15c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.372] SetEndOfFile (hFile=0x15c) returned 1 [0115.483] CloseHandle (hObject=0x15c) returned 1 [0115.483] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0115.483] SetEndOfFile (hFile=0x1c8) returned 1 [0115.484] CloseHandle (hObject=0x1c8) returned 1 [0115.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc")) returned 1 [0115.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.668] lstrlenW (lpString=".doc") returned 4 [0115.668] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.668] lstrlenW (lpString=".docx") returned 5 [0115.668] lstrcmpiW (lpString1=".docx", lpString2="R.POC") returned -1 [0115.668] lstrlenW (lpString=".pdf") returned 4 [0115.668] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.668] lstrlenW (lpString=".xls") returned 4 [0115.668] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.668] lstrlenW (lpString=".xlsx") returned 5 [0115.668] lstrcmpiW (lpString1=".xlsx", lpString2="R.POC") returned -1 [0115.668] lstrlenW (lpString=".ppt") returned 4 [0115.669] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.669] lstrlenW (lpString=".zip") returned 4 [0115.669] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.669] lstrlenW (lpString=".rar") returned 4 [0115.669] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.669] lstrlenW (lpString=".bz2") returned 4 [0115.669] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.669] lstrlenW (lpString=".7z") returned 3 [0115.669] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.669] lstrlenW (lpString=".dbf") returned 4 [0115.669] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.669] lstrlenW (lpString=".1cd") returned 4 [0115.669] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 61 [0115.669] lstrlenW (lpString=".jpg") returned 4 [0115.669] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.669] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") [0115.897] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2600) returned 1 [0115.897] CloseHandle (hObject=0x180) returned 1 [0115.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc")) returned 0x20 [0115.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.898] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0115.898] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0115.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0115.933] GetLastError () returned 0x0 [0115.933] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xa28, lpOverlapped=0x0) returned 1 [0116.002] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xa30, lpOverlapped=0x0) returned 1 [0116.003] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.003] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.003] SetEndOfFile (hFile=0x16c) returned 1 [0116.003] CloseHandle (hObject=0x16c) returned 1 [0116.003] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.003] SetEndOfFile (hFile=0x180) returned 1 [0116.004] CloseHandle (hObject=0x180) returned 1 [0116.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc")) returned 1 [0116.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.045] lstrlenW (lpString=".doc") returned 4 [0116.045] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.045] lstrlenW (lpString=".docx") returned 5 [0116.045] lstrcmpiW (lpString1=".docx", lpString2="B.POC") returned -1 [0116.045] lstrlenW (lpString=".pdf") returned 4 [0116.045] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.045] lstrlenW (lpString=".xls") returned 4 [0116.045] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.045] lstrlenW (lpString=".xlsx") returned 5 [0116.045] lstrcmpiW (lpString1=".xlsx", lpString2="B.POC") returned -1 [0116.046] lstrlenW (lpString=".ppt") returned 4 [0116.046] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.046] lstrlenW (lpString=".zip") returned 4 [0116.046] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.046] lstrlenW (lpString=".rar") returned 4 [0116.046] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.046] lstrlenW (lpString=".bz2") returned 4 [0116.046] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.046] lstrlenW (lpString=".7z") returned 3 [0116.046] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.046] lstrlenW (lpString=".dbf") returned 4 [0116.046] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.046] lstrlenW (lpString=".1cd") returned 4 [0116.046] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 61 [0116.046] lstrlenW (lpString=".jpg") returned 4 [0116.046] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.046] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") [0116.047] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=59128) returned 1 [0116.047] CloseHandle (hObject=0x180) returned 1 [0116.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc")) returned 0x20 [0116.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.047] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.047] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.048] GetLastError () returned 0x0 [0116.048] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xe6f8, lpOverlapped=0x0) returned 1 [0116.050] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe700, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe700, lpOverlapped=0x0) returned 1 [0116.052] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.052] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.052] SetEndOfFile (hFile=0x16c) returned 1 [0116.053] CloseHandle (hObject=0x16c) returned 1 [0116.053] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.053] SetEndOfFile (hFile=0x180) returned 1 [0116.054] CloseHandle (hObject=0x180) returned 1 [0116.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc")) returned 1 [0116.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.054] lstrlenW (lpString=".doc") returned 4 [0116.054] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.054] lstrlenW (lpString=".docx") returned 5 [0116.054] lstrcmpiW (lpString1=".docx", lpString2="M.POC") returned -1 [0116.054] lstrlenW (lpString=".pdf") returned 4 [0116.054] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.054] lstrlenW (lpString=".xls") returned 4 [0116.054] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.054] lstrlenW (lpString=".xlsx") returned 5 [0116.054] lstrcmpiW (lpString1=".xlsx", lpString2="M.POC") returned -1 [0116.054] lstrlenW (lpString=".ppt") returned 4 [0116.054] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.054] lstrlenW (lpString=".zip") returned 4 [0116.055] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.055] lstrlenW (lpString=".rar") returned 4 [0116.055] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.055] lstrlenW (lpString=".bz2") returned 4 [0116.055] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.055] lstrlenW (lpString=".7z") returned 3 [0116.055] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.055] lstrlenW (lpString=".dbf") returned 4 [0116.055] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.055] lstrlenW (lpString=".1cd") returned 4 [0116.055] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 62 [0116.055] lstrlenW (lpString=".jpg") returned 4 [0116.055] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.055] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") [0116.056] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=25108) returned 1 [0116.056] CloseHandle (hObject=0x180) returned 1 [0116.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc")) returned 0x20 [0116.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.056] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.056] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.057] GetLastError () returned 0x0 [0116.057] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6214, lpOverlapped=0x0) returned 1 [0116.059] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6220, lpOverlapped=0x0) returned 1 [0116.063] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.063] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.063] SetEndOfFile (hFile=0x16c) returned 1 [0116.063] CloseHandle (hObject=0x16c) returned 1 [0116.063] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.063] SetEndOfFile (hFile=0x180) returned 1 [0116.064] CloseHandle (hObject=0x180) returned 1 [0116.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc")) returned 1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString=".doc") returned 4 [0116.065] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.065] lstrlenW (lpString=".docx") returned 5 [0116.065] lstrcmpiW (lpString1=".docx", lpString2="P.POC") returned -1 [0116.065] lstrlenW (lpString=".pdf") returned 4 [0116.065] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.065] lstrlenW (lpString=".xls") returned 4 [0116.065] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.065] lstrlenW (lpString=".xlsx") returned 5 [0116.065] lstrcmpiW (lpString1=".xlsx", lpString2="P.POC") returned -1 [0116.065] lstrlenW (lpString=".ppt") returned 4 [0116.065] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString=".zip") returned 4 [0116.065] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.065] lstrlenW (lpString=".rar") returned 4 [0116.065] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.065] lstrlenW (lpString=".bz2") returned 4 [0116.065] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.065] lstrlenW (lpString=".7z") returned 3 [0116.065] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString=".dbf") returned 4 [0116.065] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString=".1cd") returned 4 [0116.065] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 62 [0116.065] lstrlenW (lpString=".jpg") returned 4 [0116.065] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.065] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") [0116.066] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=248482) returned 1 [0116.066] CloseHandle (hObject=0x180) returned 1 [0116.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc")) returned 0x20 [0116.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.067] GetLastError () returned 0x0 [0116.067] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x3caa2, lpOverlapped=0x0) returned 1 [0116.073] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3cab0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x3cab0, lpOverlapped=0x0) returned 1 [0116.079] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.079] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.079] SetEndOfFile (hFile=0x16c) returned 1 [0116.079] CloseHandle (hObject=0x16c) returned 1 [0116.079] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.079] SetEndOfFile (hFile=0x180) returned 1 [0116.081] CloseHandle (hObject=0x180) returned 1 [0116.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc")) returned 1 [0116.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.082] lstrlenW (lpString=".doc") returned 4 [0116.082] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.082] lstrlenW (lpString=".docx") returned 5 [0116.082] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0116.082] lstrlenW (lpString=".pdf") returned 4 [0116.082] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.082] lstrlenW (lpString=".xls") returned 4 [0116.082] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.082] lstrlenW (lpString=".xlsx") returned 5 [0116.082] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0116.082] lstrlenW (lpString=".ppt") returned 4 [0116.082] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.082] lstrlenW (lpString=".zip") returned 4 [0116.082] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.082] lstrlenW (lpString=".rar") returned 4 [0116.082] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.082] lstrlenW (lpString=".bz2") returned 4 [0116.082] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.082] lstrlenW (lpString=".7z") returned 3 [0116.082] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.083] lstrlenW (lpString=".dbf") returned 4 [0116.083] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.083] lstrlenW (lpString=".1cd") returned 4 [0116.083] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 61 [0116.083] lstrlenW (lpString=".jpg") returned 4 [0116.083] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.083] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") [0116.083] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1347410) returned 1 [0116.083] CloseHandle (hObject=0x180) returned 1 [0116.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv")) returned 0x20 [0116.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.084] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.084] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.084] GetLastError () returned 0x0 [0116.084] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xffff0, lpOverlapped=0x0) returned 1 [0116.110] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0116.131] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x48f62, lpOverlapped=0x0) returned 1 [0116.155] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x48f70, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x48f70, lpOverlapped=0x0) returned 1 [0116.164] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.164] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.164] SetEndOfFile (hFile=0x16c) returned 1 [0116.164] CloseHandle (hObject=0x16c) returned 1 [0116.164] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.164] SetEndOfFile (hFile=0x180) returned 1 [0116.171] CloseHandle (hObject=0x180) returned 1 [0116.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv")) returned 1 [0116.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.171] lstrlenW (lpString=".doc") returned 4 [0116.171] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.171] lstrlenW (lpString=".docx") returned 5 [0116.171] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0116.171] lstrlenW (lpString=".pdf") returned 4 [0116.171] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.171] lstrlenW (lpString=".xls") returned 4 [0116.172] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.172] lstrlenW (lpString=".xlsx") returned 5 [0116.172] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0116.172] lstrlenW (lpString=".ppt") returned 4 [0116.172] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.172] lstrlenW (lpString=".zip") returned 4 [0116.172] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.172] lstrlenW (lpString=".rar") returned 4 [0116.172] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.172] lstrlenW (lpString=".bz2") returned 4 [0116.172] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.172] lstrlenW (lpString=".7z") returned 3 [0116.172] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.172] lstrlenW (lpString=".dbf") returned 4 [0116.172] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.172] lstrlenW (lpString=".1cd") returned 4 [0116.172] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 62 [0116.172] lstrlenW (lpString=".jpg") returned 4 [0116.172] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.172] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") [0116.174] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=207328) returned 1 [0116.174] CloseHandle (hObject=0x180) returned 1 [0116.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc")) returned 0x20 [0116.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.175] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.175] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.176] GetLastError () returned 0x0 [0116.176] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x329e0, lpOverlapped=0x0) returned 1 [0116.181] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x329f0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x329f0, lpOverlapped=0x0) returned 1 [0116.320] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.320] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.320] SetEndOfFile (hFile=0x16c) returned 1 [0116.321] CloseHandle (hObject=0x16c) returned 1 [0116.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.321] SetEndOfFile (hFile=0x180) returned 1 [0116.323] CloseHandle (hObject=0x180) returned 1 [0116.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc")) returned 1 [0116.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.323] lstrlenW (lpString=".doc") returned 4 [0116.323] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.323] lstrlenW (lpString=".docx") returned 5 [0116.323] lstrcmpiW (lpString1=".docx", lpString2="M.POC") returned -1 [0116.323] lstrlenW (lpString=".pdf") returned 4 [0116.323] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.323] lstrlenW (lpString=".xls") returned 4 [0116.323] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.323] lstrlenW (lpString=".xlsx") returned 5 [0116.323] lstrcmpiW (lpString1=".xlsx", lpString2="M.POC") returned -1 [0116.323] lstrlenW (lpString=".ppt") returned 4 [0116.323] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.324] lstrlenW (lpString=".zip") returned 4 [0116.324] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.324] lstrlenW (lpString=".rar") returned 4 [0116.324] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.324] lstrlenW (lpString=".bz2") returned 4 [0116.324] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.324] lstrlenW (lpString=".7z") returned 3 [0116.324] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.324] lstrlenW (lpString=".dbf") returned 4 [0116.324] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.324] lstrlenW (lpString=".1cd") returned 4 [0116.324] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 59 [0116.324] lstrlenW (lpString=".jpg") returned 4 [0116.324] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.324] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") [0116.326] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=320683) returned 1 [0116.326] CloseHandle (hObject=0x180) returned 1 [0116.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv")) returned 0x20 [0116.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.327] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.327] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.328] GetLastError () returned 0x0 [0116.328] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4e4ab, lpOverlapped=0x0) returned 1 [0116.384] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4e4b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4e4b0, lpOverlapped=0x0) returned 1 [0116.391] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.391] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.391] SetEndOfFile (hFile=0x16c) returned 1 [0116.396] CloseHandle (hObject=0x16c) returned 1 [0116.396] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.396] SetEndOfFile (hFile=0x180) returned 1 [0116.399] CloseHandle (hObject=0x180) returned 1 [0116.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv")) returned 1 [0116.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString=".doc") returned 4 [0116.400] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.400] lstrlenW (lpString=".docx") returned 5 [0116.400] lstrcmpiW (lpString1=".docx", lpString2="G.DPV") returned -1 [0116.400] lstrlenW (lpString=".pdf") returned 4 [0116.400] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.400] lstrlenW (lpString=".xls") returned 4 [0116.400] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.400] lstrlenW (lpString=".xlsx") returned 5 [0116.400] lstrcmpiW (lpString1=".xlsx", lpString2="G.DPV") returned -1 [0116.400] lstrlenW (lpString=".ppt") returned 4 [0116.400] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString=".zip") returned 4 [0116.400] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.400] lstrlenW (lpString=".rar") returned 4 [0116.400] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.400] lstrlenW (lpString=".bz2") returned 4 [0116.400] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.400] lstrlenW (lpString=".7z") returned 3 [0116.400] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString=".dbf") returned 4 [0116.400] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString=".1cd") returned 4 [0116.400] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 61 [0116.400] lstrlenW (lpString=".jpg") returned 4 [0116.400] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.400] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") [0116.401] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=151364) returned 1 [0116.401] CloseHandle (hObject=0x180) returned 1 [0116.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc")) returned 0x20 [0116.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.402] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.402] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.403] GetLastError () returned 0x0 [0116.403] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x24f44, lpOverlapped=0x0) returned 1 [0116.418] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x24f50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x24f50, lpOverlapped=0x0) returned 1 [0116.422] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.422] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.422] SetEndOfFile (hFile=0x16c) returned 1 [0116.422] CloseHandle (hObject=0x16c) returned 1 [0116.422] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.422] SetEndOfFile (hFile=0x180) returned 1 [0116.424] CloseHandle (hObject=0x180) returned 1 [0116.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc")) returned 1 [0116.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.424] lstrlenW (lpString=".doc") returned 4 [0116.424] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.424] lstrlenW (lpString=".docx") returned 5 [0116.424] lstrcmpiW (lpString1=".docx", lpString2="1.POC") returned -1 [0116.424] lstrlenW (lpString=".pdf") returned 4 [0116.424] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.424] lstrlenW (lpString=".xls") returned 4 [0116.424] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.424] lstrlenW (lpString=".xlsx") returned 5 [0116.424] lstrcmpiW (lpString1=".xlsx", lpString2="1.POC") returned -1 [0116.424] lstrlenW (lpString=".ppt") returned 4 [0116.424] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.424] lstrlenW (lpString=".zip") returned 4 [0116.424] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.424] lstrlenW (lpString=".rar") returned 4 [0116.424] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.424] lstrlenW (lpString=".bz2") returned 4 [0116.425] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.425] lstrlenW (lpString=".7z") returned 3 [0116.425] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.425] lstrlenW (lpString=".dbf") returned 4 [0116.425] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.425] lstrlenW (lpString=".1cd") returned 4 [0116.425] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 62 [0116.425] lstrlenW (lpString=".jpg") returned 4 [0116.425] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.425] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") [0116.426] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=72578) returned 1 [0116.426] CloseHandle (hObject=0x180) returned 1 [0116.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc")) returned 0x20 [0116.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.427] GetLastError () returned 0x0 [0116.427] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x11b82, lpOverlapped=0x0) returned 1 [0116.499] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x11b90, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x11b90, lpOverlapped=0x0) returned 1 [0116.502] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.502] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.502] SetEndOfFile (hFile=0x16c) returned 1 [0116.545] CloseHandle (hObject=0x16c) returned 1 [0116.546] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.546] SetEndOfFile (hFile=0x180) returned 1 [0116.547] CloseHandle (hObject=0x180) returned 1 [0116.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc")) returned 1 [0116.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.547] lstrlenW (lpString=".doc") returned 4 [0116.547] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.547] lstrlenW (lpString=".docx") returned 5 [0116.547] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0116.547] lstrlenW (lpString=".pdf") returned 4 [0116.547] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.547] lstrlenW (lpString=".xls") returned 4 [0116.547] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.547] lstrlenW (lpString=".xlsx") returned 5 [0116.547] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0116.547] lstrlenW (lpString=".ppt") returned 4 [0116.547] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.548] lstrlenW (lpString=".zip") returned 4 [0116.548] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.548] lstrlenW (lpString=".rar") returned 4 [0116.548] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.548] lstrlenW (lpString=".bz2") returned 4 [0116.548] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.548] lstrlenW (lpString=".7z") returned 3 [0116.548] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.548] lstrlenW (lpString=".dbf") returned 4 [0116.548] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.548] lstrlenW (lpString=".1cd") returned 4 [0116.548] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 60 [0116.548] lstrlenW (lpString=".jpg") returned 4 [0116.548] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.548] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") [0116.549] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=19688) returned 1 [0116.549] CloseHandle (hObject=0x180) returned 1 [0116.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc")) returned 0x20 [0116.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.550] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.550] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.551] GetLastError () returned 0x0 [0116.551] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4ce8, lpOverlapped=0x0) returned 1 [0116.562] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4cf0, lpOverlapped=0x0) returned 1 [0116.563] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.563] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xf6, lpOverlapped=0x0) returned 1 [0116.564] SetEndOfFile (hFile=0x16c) returned 1 [0116.564] CloseHandle (hObject=0x16c) returned 1 [0116.564] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.564] SetEndOfFile (hFile=0x180) returned 1 [0116.565] CloseHandle (hObject=0x180) returned 1 [0116.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc")) returned 1 [0116.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.565] lstrlenW (lpString=".doc") returned 4 [0116.565] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.565] lstrlenW (lpString=".docx") returned 5 [0116.565] lstrcmpiW (lpString1=".docx", lpString2="B.POC") returned -1 [0116.565] lstrlenW (lpString=".pdf") returned 4 [0116.565] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.565] lstrlenW (lpString=".xls") returned 4 [0116.565] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.565] lstrlenW (lpString=".xlsx") returned 5 [0116.565] lstrcmpiW (lpString1=".xlsx", lpString2="B.POC") returned -1 [0116.565] lstrlenW (lpString=".ppt") returned 4 [0116.565] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.565] lstrlenW (lpString=".zip") returned 4 [0116.565] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.565] lstrlenW (lpString=".rar") returned 4 [0116.565] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.566] lstrlenW (lpString=".bz2") returned 4 [0116.566] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.566] lstrlenW (lpString=".7z") returned 3 [0116.566] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.566] lstrlenW (lpString=".dbf") returned 4 [0116.566] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.566] lstrlenW (lpString=".1cd") returned 4 [0116.566] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 67 [0116.566] lstrlenW (lpString=".jpg") returned 4 [0116.566] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.566] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") [0116.567] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=10752) returned 1 [0116.567] CloseHandle (hObject=0x180) returned 1 [0116.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv")) returned 0x20 [0116.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.568] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.568] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.568] GetLastError () returned 0x0 [0116.568] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2a00, lpOverlapped=0x0) returned 1 [0116.578] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0116.579] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.579] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.579] SetEndOfFile (hFile=0x16c) returned 1 [0116.579] CloseHandle (hObject=0x16c) returned 1 [0116.579] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.579] SetEndOfFile (hFile=0x180) returned 1 [0116.580] CloseHandle (hObject=0x180) returned 1 [0116.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv")) returned 1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.581] lstrlenW (lpString=".doc") returned 4 [0116.581] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.581] lstrlenW (lpString=".docx") returned 5 [0116.581] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0116.581] lstrlenW (lpString=".pdf") returned 4 [0116.581] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.581] lstrlenW (lpString=".xls") returned 4 [0116.581] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.581] lstrlenW (lpString=".xlsx") returned 5 [0116.581] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0116.581] lstrlenW (lpString=".ppt") returned 4 [0116.581] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.581] lstrlenW (lpString=".zip") returned 4 [0116.581] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.581] lstrlenW (lpString=".rar") returned 4 [0116.581] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.581] lstrlenW (lpString=".bz2") returned 4 [0116.581] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.581] lstrlenW (lpString=".7z") returned 3 [0116.581] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.581] lstrlenW (lpString=".dbf") returned 4 [0116.581] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.581] lstrlenW (lpString=".1cd") returned 4 [0116.581] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 62 [0116.582] lstrlenW (lpString=".jpg") returned 4 [0116.582] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.582] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") [0116.583] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=19244) returned 1 [0116.583] CloseHandle (hObject=0x180) returned 1 [0116.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv")) returned 0x20 [0116.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.584] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.584] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.584] GetLastError () returned 0x0 [0116.585] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x4b2c, lpOverlapped=0x0) returned 1 [0116.593] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0116.594] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.594] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0116.594] SetEndOfFile (hFile=0x16c) returned 1 [0116.594] CloseHandle (hObject=0x16c) returned 1 [0116.594] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.594] SetEndOfFile (hFile=0x180) returned 1 [0116.595] CloseHandle (hObject=0x180) returned 1 [0116.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv")) returned 1 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.596] lstrlenW (lpString=".doc") returned 4 [0116.596] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.596] lstrlenW (lpString=".docx") returned 5 [0116.596] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0116.596] lstrlenW (lpString=".pdf") returned 4 [0116.596] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.596] lstrlenW (lpString=".xls") returned 4 [0116.596] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.596] lstrlenW (lpString=".xlsx") returned 5 [0116.596] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0116.596] lstrlenW (lpString=".ppt") returned 4 [0116.596] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.596] lstrlenW (lpString=".zip") returned 4 [0116.596] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.596] lstrlenW (lpString=".rar") returned 4 [0116.596] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.596] lstrlenW (lpString=".bz2") returned 4 [0116.596] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.596] lstrlenW (lpString=".7z") returned 3 [0116.596] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.596] lstrlenW (lpString=".dbf") returned 4 [0116.596] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.597] lstrlenW (lpString=".1cd") returned 4 [0116.597] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 58 [0116.597] lstrlenW (lpString=".jpg") returned 4 [0116.597] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.597] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") [0116.597] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3584) returned 1 [0116.597] CloseHandle (hObject=0x180) returned 1 [0116.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv")) returned 0x20 [0116.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.598] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.598] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.598] GetLastError () returned 0x0 [0116.598] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xe00, lpOverlapped=0x0) returned 1 [0116.603] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe10, lpOverlapped=0x0) returned 1 [0116.603] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.604] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.604] SetEndOfFile (hFile=0x16c) returned 1 [0116.604] CloseHandle (hObject=0x16c) returned 1 [0116.604] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.604] SetEndOfFile (hFile=0x180) returned 1 [0116.605] CloseHandle (hObject=0x180) returned 1 [0116.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv")) returned 1 [0116.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.605] lstrlenW (lpString=".doc") returned 4 [0116.606] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.606] lstrlenW (lpString=".docx") returned 5 [0116.606] lstrcmpiW (lpString1=".docx", lpString2="L.DPV") returned -1 [0116.606] lstrlenW (lpString=".pdf") returned 4 [0116.606] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.606] lstrlenW (lpString=".xls") returned 4 [0116.606] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.606] lstrlenW (lpString=".xlsx") returned 5 [0116.606] lstrcmpiW (lpString1=".xlsx", lpString2="L.DPV") returned -1 [0116.606] lstrlenW (lpString=".ppt") returned 4 [0116.606] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.606] lstrlenW (lpString=".zip") returned 4 [0116.606] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.606] lstrlenW (lpString=".rar") returned 4 [0116.606] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.606] lstrlenW (lpString=".bz2") returned 4 [0116.606] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.606] lstrlenW (lpString=".7z") returned 3 [0116.606] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.606] lstrlenW (lpString=".dbf") returned 4 [0116.606] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.607] lstrlenW (lpString=".1cd") returned 4 [0116.607] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 62 [0116.607] lstrlenW (lpString=".jpg") returned 4 [0116.607] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.607] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") [0116.607] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5632) returned 1 [0116.607] CloseHandle (hObject=0x180) returned 1 [0116.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv")) returned 0x20 [0116.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.608] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.608] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.608] GetLastError () returned 0x0 [0116.608] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1600, lpOverlapped=0x0) returned 1 [0116.617] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1610, lpOverlapped=0x0) returned 1 [0116.618] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.618] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.618] SetEndOfFile (hFile=0x16c) returned 1 [0116.618] CloseHandle (hObject=0x16c) returned 1 [0116.618] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.618] SetEndOfFile (hFile=0x180) returned 1 [0116.619] CloseHandle (hObject=0x180) returned 1 [0116.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv")) returned 1 [0116.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.619] lstrlenW (lpString=".doc") returned 4 [0116.619] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.619] lstrlenW (lpString=".docx") returned 5 [0116.619] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0116.619] lstrlenW (lpString=".pdf") returned 4 [0116.619] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.619] lstrlenW (lpString=".xls") returned 4 [0116.619] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.619] lstrlenW (lpString=".xlsx") returned 5 [0116.619] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0116.619] lstrlenW (lpString=".ppt") returned 4 [0116.619] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.620] lstrlenW (lpString=".zip") returned 4 [0116.620] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.620] lstrlenW (lpString=".rar") returned 4 [0116.620] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.620] lstrlenW (lpString=".bz2") returned 4 [0116.620] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.620] lstrlenW (lpString=".7z") returned 3 [0116.620] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.620] lstrlenW (lpString=".dbf") returned 4 [0116.620] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.620] lstrlenW (lpString=".1cd") returned 4 [0116.620] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 62 [0116.620] lstrlenW (lpString=".jpg") returned 4 [0116.620] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.620] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") [0116.621] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=218216) returned 1 [0116.621] CloseHandle (hObject=0x180) returned 1 [0116.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv")) returned 0x20 [0116.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0116.629] GetLastError () returned 0x0 [0116.629] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x35468, lpOverlapped=0x0) returned 1 [0116.663] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x35470, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x35470, lpOverlapped=0x0) returned 1 [0116.669] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.669] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.669] SetEndOfFile (hFile=0x1b8) returned 1 [0116.669] CloseHandle (hObject=0x1b8) returned 1 [0116.669] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.669] SetEndOfFile (hFile=0x180) returned 1 [0116.671] CloseHandle (hObject=0x180) returned 1 [0116.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv")) returned 1 [0116.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.672] lstrlenW (lpString=".doc") returned 4 [0116.672] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.672] lstrlenW (lpString=".docx") returned 5 [0116.672] lstrcmpiW (lpString1=".docx", lpString2="L.DPV") returned -1 [0116.672] lstrlenW (lpString=".pdf") returned 4 [0116.672] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.672] lstrlenW (lpString=".xls") returned 4 [0116.672] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.672] lstrlenW (lpString=".xlsx") returned 5 [0116.672] lstrcmpiW (lpString1=".xlsx", lpString2="L.DPV") returned -1 [0116.672] lstrlenW (lpString=".ppt") returned 4 [0116.672] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.672] lstrlenW (lpString=".zip") returned 4 [0116.672] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.672] lstrlenW (lpString=".rar") returned 4 [0116.672] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.672] lstrlenW (lpString=".bz2") returned 4 [0116.672] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.673] lstrlenW (lpString=".7z") returned 3 [0116.673] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.673] lstrlenW (lpString=".dbf") returned 4 [0116.673] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.673] lstrlenW (lpString=".1cd") returned 4 [0116.673] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 59 [0116.673] lstrlenW (lpString=".jpg") returned 4 [0116.673] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.673] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") [0116.677] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=9216) returned 1 [0116.677] CloseHandle (hObject=0x180) returned 1 [0116.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv")) returned 0x20 [0116.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0116.679] GetLastError () returned 0x0 [0116.679] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x2400, lpOverlapped=0x0) returned 1 [0116.719] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x2410, lpOverlapped=0x0) returned 1 [0116.720] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.720] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.720] SetEndOfFile (hFile=0x1b8) returned 1 [0116.720] CloseHandle (hObject=0x1b8) returned 1 [0116.720] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.721] SetEndOfFile (hFile=0x180) returned 1 [0116.722] CloseHandle (hObject=0x180) returned 1 [0116.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv")) returned 1 [0116.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.722] lstrlenW (lpString=".doc") returned 4 [0116.722] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.722] lstrlenW (lpString=".docx") returned 5 [0116.722] lstrcmpiW (lpString1=".docx", lpString2="C.DPV") returned -1 [0116.722] lstrlenW (lpString=".pdf") returned 4 [0116.722] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.722] lstrlenW (lpString=".xls") returned 4 [0116.722] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.722] lstrlenW (lpString=".xlsx") returned 5 [0116.722] lstrcmpiW (lpString1=".xlsx", lpString2="C.DPV") returned -1 [0116.722] lstrlenW (lpString=".ppt") returned 4 [0116.722] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.722] lstrlenW (lpString=".zip") returned 4 [0116.722] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.722] lstrlenW (lpString=".rar") returned 4 [0116.722] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.723] lstrlenW (lpString=".bz2") returned 4 [0116.723] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.723] lstrlenW (lpString=".7z") returned 3 [0116.723] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.723] lstrlenW (lpString=".dbf") returned 4 [0116.723] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.723] lstrlenW (lpString=".1cd") returned 4 [0116.723] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 62 [0116.723] lstrlenW (lpString=".jpg") returned 4 [0116.723] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.723] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") [0116.724] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=126682) returned 1 [0116.724] CloseHandle (hObject=0x180) returned 1 [0116.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv")) returned 0x20 [0116.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.724] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.724] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0116.725] GetLastError () returned 0x0 [0116.725] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x1eeda, lpOverlapped=0x0) returned 1 [0116.831] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1eee0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x1eee0, lpOverlapped=0x0) returned 1 [0116.835] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0116.835] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.835] SetEndOfFile (hFile=0x1b8) returned 1 [0116.835] CloseHandle (hObject=0x1b8) returned 1 [0116.835] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0116.835] SetEndOfFile (hFile=0x180) returned 1 [0116.836] CloseHandle (hObject=0x180) returned 1 [0116.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv")) returned 1 [0116.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.837] lstrlenW (lpString=".doc") returned 4 [0116.837] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.837] lstrlenW (lpString=".docx") returned 5 [0116.837] lstrcmpiW (lpString1=".docx", lpString2="P.DPV") returned -1 [0116.837] lstrlenW (lpString=".pdf") returned 4 [0116.837] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.837] lstrlenW (lpString=".xls") returned 4 [0116.837] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.837] lstrlenW (lpString=".xlsx") returned 5 [0116.837] lstrcmpiW (lpString1=".xlsx", lpString2="P.DPV") returned -1 [0116.837] lstrlenW (lpString=".ppt") returned 4 [0116.837] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.837] lstrlenW (lpString=".zip") returned 4 [0116.837] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.837] lstrlenW (lpString=".rar") returned 4 [0116.837] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.837] lstrlenW (lpString=".bz2") returned 4 [0116.837] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.837] lstrlenW (lpString=".7z") returned 3 [0116.837] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.838] lstrlenW (lpString=".dbf") returned 4 [0116.838] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.838] lstrlenW (lpString=".1cd") returned 4 [0116.838] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 62 [0116.838] lstrlenW (lpString=".jpg") returned 4 [0116.838] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.838] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") [0117.217] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=37775) returned 1 [0117.217] CloseHandle (hObject=0x1ec) returned 1 [0117.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv")) returned 0x20 [0117.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.218] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.218] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.219] GetLastError () returned 0x0 [0117.219] ReadFile (in: hFile=0x1ec, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x938f, lpOverlapped=0x0) returned 1 [0117.257] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x9390, lpOverlapped=0x0) returned 1 [0117.258] ReadFile (in: hFile=0x1ec, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0117.258] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.259] SetEndOfFile (hFile=0x210) returned 1 [0117.275] CloseHandle (hObject=0x210) returned 1 [0117.275] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.275] SetEndOfFile (hFile=0x1ec) returned 1 [0117.285] CloseHandle (hObject=0x1ec) returned 1 [0117.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv")) returned 1 [0117.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.285] lstrlenW (lpString=".doc") returned 4 [0117.285] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.285] lstrlenW (lpString=".docx") returned 5 [0117.285] lstrcmpiW (lpString1=".docx", lpString2="T.DPV") returned -1 [0117.285] lstrlenW (lpString=".pdf") returned 4 [0117.285] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.285] lstrlenW (lpString=".xls") returned 4 [0117.285] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.285] lstrlenW (lpString=".xlsx") returned 5 [0117.285] lstrcmpiW (lpString1=".xlsx", lpString2="T.DPV") returned -1 [0117.285] lstrlenW (lpString=".ppt") returned 4 [0117.285] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.285] lstrlenW (lpString=".zip") returned 4 [0117.286] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.286] lstrlenW (lpString=".rar") returned 4 [0117.286] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.286] lstrlenW (lpString=".bz2") returned 4 [0117.286] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.286] lstrlenW (lpString=".7z") returned 3 [0117.286] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.286] lstrlenW (lpString=".dbf") returned 4 [0117.286] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.286] lstrlenW (lpString=".1cd") returned 4 [0117.286] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 61 [0117.286] lstrlenW (lpString=".jpg") returned 4 [0117.286] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.286] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") [0117.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3072) returned 1 [0117.335] CloseHandle (hObject=0x180) returned 1 [0117.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv")) returned 0x20 [0117.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.359] GetLastError () returned 0x0 [0117.359] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0xc00, lpOverlapped=0x0) returned 1 [0117.369] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xc10, lpOverlapped=0x0) returned 1 [0117.373] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0117.373] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0117.373] SetEndOfFile (hFile=0x1b8) returned 1 [0117.373] CloseHandle (hObject=0x1b8) returned 1 [0117.373] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.373] SetEndOfFile (hFile=0x180) returned 1 [0117.374] CloseHandle (hObject=0x180) returned 1 [0117.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv")) returned 1 [0117.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.374] lstrlenW (lpString=".doc") returned 4 [0117.374] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.374] lstrlenW (lpString=".docx") returned 5 [0117.374] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0117.374] lstrlenW (lpString=".pdf") returned 4 [0117.374] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.374] lstrlenW (lpString=".xls") returned 4 [0117.374] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.374] lstrlenW (lpString=".xlsx") returned 5 [0117.374] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0117.374] lstrlenW (lpString=".ppt") returned 4 [0117.374] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.375] lstrlenW (lpString=".zip") returned 4 [0117.375] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.375] lstrlenW (lpString=".rar") returned 4 [0117.375] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.375] lstrlenW (lpString=".bz2") returned 4 [0117.375] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.375] lstrlenW (lpString=".7z") returned 3 [0117.375] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.375] lstrlenW (lpString=".dbf") returned 4 [0117.375] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.375] lstrlenW (lpString=".1cd") returned 4 [0117.375] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 60 [0117.375] lstrlenW (lpString=".jpg") returned 4 [0117.375] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.375] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") [0117.376] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=20480) returned 1 [0117.376] CloseHandle (hObject=0x180) returned 1 [0117.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv")) returned 0x20 [0117.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0117.377] GetLastError () returned 0x0 [0117.377] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x5000, lpOverlapped=0x0) returned 1 [0117.386] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x5010, lpOverlapped=0x0) returned 1 [0117.387] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0117.387] WriteFile (in: hFile=0x1b8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.387] SetEndOfFile (hFile=0x1b8) returned 1 [0117.387] CloseHandle (hObject=0x1b8) returned 1 [0117.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.387] SetEndOfFile (hFile=0x180) returned 1 [0117.388] CloseHandle (hObject=0x180) returned 1 [0117.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv")) returned 1 [0117.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.388] lstrlenW (lpString=".doc") returned 4 [0117.388] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.388] lstrlenW (lpString=".docx") returned 5 [0117.388] lstrcmpiW (lpString1=".docx", lpString2="T.DPV") returned -1 [0117.389] lstrlenW (lpString=".pdf") returned 4 [0117.389] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.389] lstrlenW (lpString=".xls") returned 4 [0117.389] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.389] lstrlenW (lpString=".xlsx") returned 5 [0117.389] lstrcmpiW (lpString1=".xlsx", lpString2="T.DPV") returned -1 [0117.389] lstrlenW (lpString=".ppt") returned 4 [0117.389] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.389] lstrlenW (lpString=".zip") returned 4 [0117.389] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.389] lstrlenW (lpString=".rar") returned 4 [0117.389] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.389] lstrlenW (lpString=".bz2") returned 4 [0117.389] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.389] lstrlenW (lpString=".7z") returned 3 [0117.389] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.389] lstrlenW (lpString=".dbf") returned 4 [0117.389] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.389] lstrlenW (lpString=".1cd") returned 4 [0117.389] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 62 [0117.389] lstrlenW (lpString=".jpg") returned 4 [0117.389] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.389] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") [0117.391] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=28151) returned 1 [0117.391] CloseHandle (hObject=0x180) returned 1 [0117.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv")) returned 0x20 [0117.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.391] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.391] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0117.393] GetLastError () returned 0x0 [0117.393] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x6df7, lpOverlapped=0x0) returned 1 [0117.395] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0x6e00, lpOverlapped=0x0) returned 1 [0117.396] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0117.396] WriteFile (in: hFile=0x22c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.396] SetEndOfFile (hFile=0x22c) returned 1 [0117.396] CloseHandle (hObject=0x22c) returned 1 [0117.396] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0117.397] SetEndOfFile (hFile=0x180) returned 1 [0117.397] CloseHandle (hObject=0x180) returned 1 [0117.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv")) returned 1 [0117.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.398] lstrlenW (lpString=".doc") returned 4 [0117.398] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.398] lstrlenW (lpString=".docx") returned 5 [0117.398] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0117.398] lstrlenW (lpString=".pdf") returned 4 [0117.398] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.398] lstrlenW (lpString=".xls") returned 4 [0117.398] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.398] lstrlenW (lpString=".xlsx") returned 5 [0117.398] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0117.398] lstrlenW (lpString=".ppt") returned 4 [0117.398] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.398] lstrlenW (lpString=".zip") returned 4 [0117.398] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.398] lstrlenW (lpString=".rar") returned 4 [0117.398] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.398] lstrlenW (lpString=".bz2") returned 4 [0117.398] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.398] lstrlenW (lpString=".7z") returned 3 [0117.398] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.398] lstrlenW (lpString=".dbf") returned 4 [0117.398] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.399] lstrlenW (lpString=".1cd") returned 4 [0117.399] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 62 [0117.399] lstrlenW (lpString=".jpg") returned 4 [0117.399] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.399] RtlInitUnicodeStringEx (DestinationString=0x2befee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV") Thread: id = 12 os_tid = 0x9cc [0033.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3710260 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3720268 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641180 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x641670 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641198 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3910020 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411b0 [0033.717] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6411b0, Size=0x20) returned 0x629f48 [0033.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411b0 [0033.717] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6411b0, Size=0x20) returned 0x629f70 [0033.717] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.718] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.718] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2ff58 | out: OldValue=0x2d2ff58*=0x0) returned 1 [0033.718] lstrlenW (lpString="kernel32.dll") returned 12 [0033.718] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.718] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.718] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.718] Sleep (dwMilliseconds=0x64) [0033.911] lstrcmpiW (lpString1=".LOG", lpString2=".zoh") returned -1 [0033.911] lstrlenW (lpString="BCD.LOG") returned 7 [0033.911] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.912] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.912] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.912] lstrlenW (lpString=".doc") returned 4 [0033.912] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.912] lstrlenW (lpString=".docx") returned 5 [0033.912] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.912] lstrlenW (lpString=".pdf") returned 4 [0033.912] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.912] lstrlenW (lpString=".xls") returned 4 [0033.912] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.912] lstrlenW (lpString=".xlsx") returned 5 [0033.912] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.912] lstrlenW (lpString=".ppt") returned 4 [0033.912] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.912] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.912] lstrlenW (lpString=".zip") returned 4 [0033.912] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.912] lstrlenW (lpString=".rar") returned 4 [0033.912] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.912] lstrlenW (lpString=".bz2") returned 4 [0033.912] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.912] lstrlenW (lpString=".7z") returned 3 [0033.912] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.912] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.912] lstrlenW (lpString=".dbf") returned 4 [0033.913] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.913] lstrlenW (lpString=".1cd") returned 4 [0033.913] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.913] lstrlenW (lpString=".jpg") returned 4 [0033.913] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.913] lstrlenW (lpString=".doc") returned 4 [0033.913] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.913] lstrlenW (lpString=".docx") returned 5 [0033.913] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.913] lstrlenW (lpString=".pdf") returned 4 [0033.913] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.913] lstrlenW (lpString=".xls") returned 4 [0033.913] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.913] lstrlenW (lpString=".xlsx") returned 5 [0033.913] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.913] lstrlenW (lpString=".ppt") returned 4 [0033.913] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.913] lstrlenW (lpString=".zip") returned 4 [0033.913] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.913] lstrlenW (lpString=".rar") returned 4 [0033.913] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.913] lstrlenW (lpString=".bz2") returned 4 [0033.913] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.913] lstrlenW (lpString=".7z") returned 3 [0033.914] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.914] lstrlenW (lpString=".dbf") returned 4 [0033.914] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.914] lstrlenW (lpString=".1cd") returned 4 [0033.914] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.914] lstrlenW (lpString=".jpg") returned 4 [0033.914] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.914] lstrcmpiW (lpString1=".DAT", lpString2=".zoh") returned -1 [0033.914] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0033.914] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.914] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=65536) returned 1 [0033.914] CloseHandle (hObject=0x174) returned 1 [0033.914] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0033.914] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.914] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.915] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.915] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.915] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.915] GetLastError () returned 0x0 [0033.915] ReadFile (in: hFile=0x174, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x10000, lpOverlapped=0x0) returned 1 [0033.974] WriteFile (in: hFile=0x178, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0033.976] ReadFile (in: hFile=0x174, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.976] WriteFile (in: hFile=0x178, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0033.976] SetEndOfFile (hFile=0x178) returned 1 [0033.976] CloseHandle (hObject=0x178) returned 1 [0033.977] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.977] SetEndOfFile (hFile=0x174) returned 1 [0033.978] CloseHandle (hObject=0x174) returned 1 [0033.978] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x26) returned 1 [0033.979] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0033.979] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.979] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.979] lstrlenW (lpString=".doc") returned 4 [0033.979] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString=".docx") returned 5 [0033.979] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.979] lstrlenW (lpString=".pdf") returned 4 [0033.979] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString=".xls") returned 4 [0033.979] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString=".xlsx") returned 5 [0033.979] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.979] lstrlenW (lpString=".ppt") returned 4 [0033.979] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.979] lstrlenW (lpString=".zip") returned 4 [0033.979] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString=".rar") returned 4 [0033.979] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.979] lstrlenW (lpString=".bz2") returned 4 [0033.980] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.980] lstrlenW (lpString=".7z") returned 3 [0033.980] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString=".dbf") returned 4 [0033.980] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString=".1cd") returned 4 [0033.980] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString=".jpg") returned 4 [0033.980] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString=".doc") returned 4 [0033.980] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString=".docx") returned 5 [0033.980] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.980] lstrlenW (lpString=".pdf") returned 4 [0033.980] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString=".xls") returned 4 [0033.980] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString=".xlsx") returned 5 [0033.980] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.980] lstrlenW (lpString=".ppt") returned 4 [0033.980] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.980] lstrlenW (lpString=".zip") returned 4 [0033.980] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString=".rar") returned 4 [0033.980] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.980] lstrlenW (lpString=".bz2") returned 4 [0033.980] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.981] lstrlenW (lpString=".7z") returned 3 [0033.981] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.981] lstrlenW (lpString=".dbf") returned 4 [0033.981] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.981] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.981] lstrlenW (lpString=".1cd") returned 4 [0033.981] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.981] lstrlenW (lpString=".jpg") returned 4 [0033.981] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.981] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0033.981] lstrlenW (lpString="Setup.xml") returned 9 [0033.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.983] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2296) returned 1 [0033.983] CloseHandle (hObject=0x180) returned 1 [0033.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0033.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0033.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.983] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.983] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.001] GetLastError () returned 0x0 [0034.001] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0034.003] WriteFile (in: hFile=0x174, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x900, lpOverlapped=0x0) returned 1 [0034.004] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.004] WriteFile (in: hFile=0x174, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.004] SetEndOfFile (hFile=0x174) returned 1 [0034.004] CloseHandle (hObject=0x174) returned 1 [0034.005] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.005] SetEndOfFile (hFile=0x180) returned 1 [0034.006] CloseHandle (hObject=0x180) returned 1 [0034.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.006] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.006] lstrlenW (lpString=".doc") returned 4 [0034.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".docx") returned 5 [0034.007] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.007] lstrlenW (lpString=".pdf") returned 4 [0034.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".xls") returned 4 [0034.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".xlsx") returned 5 [0034.007] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.007] lstrlenW (lpString=".ppt") returned 4 [0034.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString=".zip") returned 4 [0034.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.007] lstrlenW (lpString=".rar") returned 4 [0034.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".bz2") returned 4 [0034.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".7z") returned 3 [0034.007] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString=".dbf") returned 4 [0034.007] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString=".1cd") returned 4 [0034.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString=".jpg") returned 4 [0034.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.007] lstrlenW (lpString=".doc") returned 4 [0034.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.007] lstrlenW (lpString=".docx") returned 5 [0034.008] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.008] lstrlenW (lpString=".pdf") returned 4 [0034.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString=".xls") returned 4 [0034.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString=".xlsx") returned 5 [0034.008] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.008] lstrlenW (lpString=".ppt") returned 4 [0034.008] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.008] lstrlenW (lpString=".zip") returned 4 [0034.008] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.008] lstrlenW (lpString=".rar") returned 4 [0034.008] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString=".bz2") returned 4 [0034.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString=".7z") returned 3 [0034.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.008] lstrlenW (lpString=".dbf") returned 4 [0034.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.008] lstrlenW (lpString=".1cd") returned 4 [0034.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.008] lstrlenW (lpString=".jpg") returned 4 [0034.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.008] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.008] lstrlenW (lpString="Setup.xml") returned 9 [0034.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.009] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1886) returned 1 [0034.009] CloseHandle (hObject=0x180) returned 1 [0034.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.009] GetLastError () returned 0x0 [0034.009] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x75e, lpOverlapped=0x0) returned 1 [0034.011] WriteFile (in: hFile=0x174, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.012] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.012] WriteFile (in: hFile=0x174, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.012] SetEndOfFile (hFile=0x174) returned 1 [0034.012] CloseHandle (hObject=0x174) returned 1 [0034.015] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.015] SetEndOfFile (hFile=0x180) returned 1 [0034.016] CloseHandle (hObject=0x180) returned 1 [0034.016] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.016] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.016] lstrlenW (lpString=".doc") returned 4 [0034.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".docx") returned 5 [0034.016] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.016] lstrlenW (lpString=".pdf") returned 4 [0034.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".xls") returned 4 [0034.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".xlsx") returned 5 [0034.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.017] lstrlenW (lpString=".ppt") returned 4 [0034.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString=".zip") returned 4 [0034.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.017] lstrlenW (lpString=".rar") returned 4 [0034.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString=".bz2") returned 4 [0034.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString=".7z") returned 3 [0034.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString=".dbf") returned 4 [0034.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString=".1cd") returned 4 [0034.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString=".jpg") returned 4 [0034.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.017] lstrlenW (lpString=".doc") returned 4 [0034.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString=".docx") returned 5 [0034.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.017] lstrlenW (lpString=".pdf") returned 4 [0034.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString=".xls") returned 4 [0034.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString=".xlsx") returned 5 [0034.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.017] lstrlenW (lpString=".ppt") returned 4 [0034.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.018] lstrlenW (lpString=".zip") returned 4 [0034.018] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.018] lstrlenW (lpString=".rar") returned 4 [0034.018] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.018] lstrlenW (lpString=".bz2") returned 4 [0034.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.018] lstrlenW (lpString=".7z") returned 3 [0034.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.018] lstrlenW (lpString=".dbf") returned 4 [0034.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.018] lstrlenW (lpString=".1cd") returned 4 [0034.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.018] lstrlenW (lpString=".jpg") returned 4 [0034.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.018] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.018] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0034.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.303] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1450) returned 1 [0034.303] CloseHandle (hObject=0x18c) returned 1 [0034.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0034.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.309] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.309] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.310] GetLastError () returned 0x0 [0034.310] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.311] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.312] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.312] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0034.312] SetEndOfFile (hFile=0x188) returned 1 [0034.312] CloseHandle (hObject=0x188) returned 1 [0034.313] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.313] SetEndOfFile (hFile=0x170) returned 1 [0034.314] CloseHandle (hObject=0x170) returned 1 [0034.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.314] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0034.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.314] lstrlenW (lpString=".doc") returned 4 [0034.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.314] lstrlenW (lpString=".docx") returned 5 [0034.314] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.314] lstrlenW (lpString=".pdf") returned 4 [0034.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.315] lstrlenW (lpString=".xls") returned 4 [0034.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.315] lstrlenW (lpString=".xlsx") returned 5 [0034.315] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.315] lstrlenW (lpString=".ppt") returned 4 [0034.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.315] lstrlenW (lpString=".zip") returned 4 [0034.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.315] lstrlenW (lpString=".rar") returned 4 [0034.315] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.315] lstrlenW (lpString=".bz2") returned 4 [0034.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.315] lstrlenW (lpString=".7z") returned 3 [0034.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.315] lstrlenW (lpString=".dbf") returned 4 [0034.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.316] lstrlenW (lpString=".1cd") returned 4 [0034.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.316] lstrlenW (lpString=".jpg") returned 4 [0034.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.316] lstrlenW (lpString=".doc") returned 4 [0034.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString=".docx") returned 5 [0034.316] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.316] lstrlenW (lpString=".pdf") returned 4 [0034.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString=".xls") returned 4 [0034.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString=".xlsx") returned 5 [0034.316] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.316] lstrlenW (lpString=".ppt") returned 4 [0034.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.316] lstrlenW (lpString=".zip") returned 4 [0034.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.316] lstrlenW (lpString=".rar") returned 4 [0034.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.317] lstrlenW (lpString=".bz2") returned 4 [0034.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.317] lstrlenW (lpString=".7z") returned 3 [0034.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.317] lstrlenW (lpString=".dbf") returned 4 [0034.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.317] lstrlenW (lpString=".1cd") returned 4 [0034.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.317] lstrlenW (lpString=".jpg") returned 4 [0034.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.317] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.317] lstrlenW (lpString="Proof.xml") returned 9 [0034.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.318] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1347) returned 1 [0034.318] CloseHandle (hObject=0x170) returned 1 [0034.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0034.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.318] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.318] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.319] GetLastError () returned 0x0 [0034.319] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x543, lpOverlapped=0x0) returned 1 [0034.320] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x550, lpOverlapped=0x0) returned 1 [0034.321] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.321] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.321] SetEndOfFile (hFile=0x188) returned 1 [0034.321] CloseHandle (hObject=0x188) returned 1 [0034.322] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.322] SetEndOfFile (hFile=0x170) returned 1 [0034.323] CloseHandle (hObject=0x170) returned 1 [0034.323] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.323] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0034.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.323] lstrlenW (lpString=".doc") returned 4 [0034.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.323] lstrlenW (lpString=".docx") returned 5 [0034.323] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.323] lstrlenW (lpString=".pdf") returned 4 [0034.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.323] lstrlenW (lpString=".xls") returned 4 [0034.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.323] lstrlenW (lpString=".xlsx") returned 5 [0034.323] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.323] lstrlenW (lpString=".ppt") returned 4 [0034.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.323] lstrlenW (lpString=".zip") returned 4 [0034.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.324] lstrlenW (lpString=".rar") returned 4 [0034.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString=".bz2") returned 4 [0034.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString=".7z") returned 3 [0034.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString=".dbf") returned 4 [0034.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString=".1cd") returned 4 [0034.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString=".jpg") returned 4 [0034.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString=".doc") returned 4 [0034.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString=".docx") returned 5 [0034.324] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.324] lstrlenW (lpString=".pdf") returned 4 [0034.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString=".xls") returned 4 [0034.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString=".xlsx") returned 5 [0034.324] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.324] lstrlenW (lpString=".ppt") returned 4 [0034.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.324] lstrlenW (lpString=".zip") returned 4 [0034.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.324] lstrlenW (lpString=".rar") returned 4 [0034.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.325] lstrlenW (lpString=".bz2") returned 4 [0034.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.325] lstrlenW (lpString=".7z") returned 3 [0034.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.325] lstrlenW (lpString=".dbf") returned 4 [0034.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.325] lstrlenW (lpString=".1cd") returned 4 [0034.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.325] lstrlenW (lpString=".jpg") returned 4 [0034.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.325] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.325] lstrlenW (lpString="Proof.xml") returned 9 [0034.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.326] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1457) returned 1 [0034.326] CloseHandle (hObject=0x170) returned 1 [0034.326] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0034.326] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.326] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.326] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.327] GetLastError () returned 0x0 [0034.327] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0034.328] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.329] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.329] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.329] SetEndOfFile (hFile=0x188) returned 1 [0034.329] CloseHandle (hObject=0x188) returned 1 [0034.330] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.330] SetEndOfFile (hFile=0x170) returned 1 [0034.331] CloseHandle (hObject=0x170) returned 1 [0034.331] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.332] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0034.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.332] lstrlenW (lpString=".doc") returned 4 [0034.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString=".docx") returned 5 [0034.332] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.332] lstrlenW (lpString=".pdf") returned 4 [0034.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString=".xls") returned 4 [0034.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString=".xlsx") returned 5 [0034.332] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.332] lstrlenW (lpString=".ppt") returned 4 [0034.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.332] lstrlenW (lpString=".zip") returned 4 [0034.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.332] lstrlenW (lpString=".rar") returned 4 [0034.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString=".bz2") returned 4 [0034.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString=".7z") returned 3 [0034.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.332] lstrlenW (lpString=".dbf") returned 4 [0034.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.332] lstrlenW (lpString=".1cd") returned 4 [0034.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString=".jpg") returned 4 [0034.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString=".doc") returned 4 [0034.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString=".docx") returned 5 [0034.333] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.333] lstrlenW (lpString=".pdf") returned 4 [0034.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString=".xls") returned 4 [0034.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString=".xlsx") returned 5 [0034.333] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.333] lstrlenW (lpString=".ppt") returned 4 [0034.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString=".zip") returned 4 [0034.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.333] lstrlenW (lpString=".rar") returned 4 [0034.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString=".bz2") returned 4 [0034.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString=".7z") returned 3 [0034.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString=".dbf") returned 4 [0034.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.333] lstrlenW (lpString=".1cd") returned 4 [0034.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.334] lstrlenW (lpString=".jpg") returned 4 [0034.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.334] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.334] lstrlenW (lpString="Proof.xml") returned 9 [0034.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.334] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1458) returned 1 [0034.334] CloseHandle (hObject=0x170) returned 1 [0034.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0034.334] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.334] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.334] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.335] GetLastError () returned 0x0 [0034.335] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0034.336] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.337] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.337] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.337] SetEndOfFile (hFile=0x188) returned 1 [0034.337] CloseHandle (hObject=0x188) returned 1 [0034.338] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.338] SetEndOfFile (hFile=0x170) returned 1 [0034.339] CloseHandle (hObject=0x170) returned 1 [0034.339] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.339] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0034.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.339] lstrlenW (lpString=".doc") returned 4 [0034.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.339] lstrlenW (lpString=".docx") returned 5 [0034.339] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.339] lstrlenW (lpString=".pdf") returned 4 [0034.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.339] lstrlenW (lpString=".xls") returned 4 [0034.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.339] lstrlenW (lpString=".xlsx") returned 5 [0034.340] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.340] lstrlenW (lpString=".ppt") returned 4 [0034.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString=".zip") returned 4 [0034.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.340] lstrlenW (lpString=".rar") returned 4 [0034.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString=".bz2") returned 4 [0034.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString=".7z") returned 3 [0034.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString=".dbf") returned 4 [0034.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString=".1cd") returned 4 [0034.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString=".jpg") returned 4 [0034.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.340] lstrlenW (lpString=".doc") returned 4 [0034.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString=".docx") returned 5 [0034.340] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.340] lstrlenW (lpString=".pdf") returned 4 [0034.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString=".xls") returned 4 [0034.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.340] lstrlenW (lpString=".xlsx") returned 5 [0034.340] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.340] lstrlenW (lpString=".ppt") returned 4 [0034.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.341] lstrlenW (lpString=".zip") returned 4 [0034.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.341] lstrlenW (lpString=".rar") returned 4 [0034.341] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.341] lstrlenW (lpString=".bz2") returned 4 [0034.341] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.341] lstrlenW (lpString=".7z") returned 3 [0034.341] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.341] lstrlenW (lpString=".dbf") returned 4 [0034.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.341] lstrlenW (lpString=".1cd") returned 4 [0034.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.341] lstrlenW (lpString=".jpg") returned 4 [0034.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.341] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.341] lstrlenW (lpString="Proofing.xml") returned 12 [0034.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.341] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=811) returned 1 [0034.342] CloseHandle (hObject=0x170) returned 1 [0034.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0034.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.342] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.342] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.342] GetLastError () returned 0x0 [0034.342] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x32b, lpOverlapped=0x0) returned 1 [0034.729] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x330, lpOverlapped=0x0) returned 1 [0034.730] ReadFile (in: hFile=0x170, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.730] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.730] SetEndOfFile (hFile=0x188) returned 1 [0034.730] CloseHandle (hObject=0x188) returned 1 [0034.731] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.731] SetEndOfFile (hFile=0x170) returned 1 [0034.732] CloseHandle (hObject=0x170) returned 1 [0034.732] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.732] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.732] lstrlenW (lpString=".doc") returned 4 [0034.732] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".docx") returned 5 [0034.732] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.732] lstrlenW (lpString=".pdf") returned 4 [0034.732] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".xls") returned 4 [0034.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".xlsx") returned 5 [0034.732] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.733] lstrlenW (lpString=".ppt") returned 4 [0034.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString=".zip") returned 4 [0034.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.733] lstrlenW (lpString=".rar") returned 4 [0034.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".bz2") returned 4 [0034.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".7z") returned 3 [0034.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString=".dbf") returned 4 [0034.733] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString=".1cd") returned 4 [0034.733] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString=".jpg") returned 4 [0034.733] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.733] lstrlenW (lpString=".doc") returned 4 [0034.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".docx") returned 5 [0034.733] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.733] lstrlenW (lpString=".pdf") returned 4 [0034.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".xls") returned 4 [0034.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".xlsx") returned 5 [0034.733] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.734] lstrlenW (lpString=".ppt") returned 4 [0034.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.734] lstrlenW (lpString=".zip") returned 4 [0034.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.734] lstrlenW (lpString=".rar") returned 4 [0034.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.734] lstrlenW (lpString=".bz2") returned 4 [0034.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.734] lstrlenW (lpString=".7z") returned 3 [0034.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.734] lstrlenW (lpString=".dbf") returned 4 [0034.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.734] lstrlenW (lpString=".1cd") returned 4 [0034.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.734] lstrlenW (lpString=".jpg") returned 4 [0034.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.734] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.734] lstrlenW (lpString="Setup.xml") returned 9 [0034.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.455] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1988) returned 1 [0035.455] CloseHandle (hObject=0x19c) returned 1 [0035.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.455] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.455] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.456] GetLastError () returned 0x0 [0035.456] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0035.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0035.483] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.484] SetEndOfFile (hFile=0x1a0) returned 1 [0035.484] CloseHandle (hObject=0x1a0) returned 1 [0035.485] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.485] SetEndOfFile (hFile=0x19c) returned 1 [0035.486] CloseHandle (hObject=0x19c) returned 1 [0035.486] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.486] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.486] lstrlenW (lpString=".doc") returned 4 [0035.486] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.486] lstrlenW (lpString=".docx") returned 5 [0035.486] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.486] lstrlenW (lpString=".pdf") returned 4 [0035.486] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.486] lstrlenW (lpString=".xls") returned 4 [0035.486] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.486] lstrlenW (lpString=".xlsx") returned 5 [0035.486] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.486] lstrlenW (lpString=".ppt") returned 4 [0035.486] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".zip") returned 4 [0035.487] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.487] lstrlenW (lpString=".rar") returned 4 [0035.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString=".bz2") returned 4 [0035.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString=".7z") returned 3 [0035.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".dbf") returned 4 [0035.487] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".1cd") returned 4 [0035.487] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".jpg") returned 4 [0035.487] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".doc") returned 4 [0035.487] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString=".docx") returned 5 [0035.487] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.487] lstrlenW (lpString=".pdf") returned 4 [0035.487] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString=".xls") returned 4 [0035.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString=".xlsx") returned 5 [0035.487] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.487] lstrlenW (lpString=".ppt") returned 4 [0035.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.487] lstrlenW (lpString=".zip") returned 4 [0035.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.488] lstrlenW (lpString=".rar") returned 4 [0035.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.488] lstrlenW (lpString=".bz2") returned 4 [0035.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.488] lstrlenW (lpString=".7z") returned 3 [0035.488] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.488] lstrlenW (lpString=".dbf") returned 4 [0035.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.488] lstrlenW (lpString=".1cd") returned 4 [0035.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.488] lstrlenW (lpString=".jpg") returned 4 [0035.488] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.488] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.488] lstrlenW (lpString="branding.xml") returned 12 [0035.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.509] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=596341) returned 1 [0035.509] CloseHandle (hObject=0x16c) returned 1 [0035.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0035.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.518] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.518] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0035.530] GetLastError () returned 0x0 [0035.530] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.578] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.589] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.589] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.589] SetEndOfFile (hFile=0x164) returned 1 [0035.589] CloseHandle (hObject=0x164) returned 1 [0035.594] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.594] SetEndOfFile (hFile=0x16c) returned 1 [0035.599] CloseHandle (hObject=0x16c) returned 1 [0035.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.600] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0035.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.600] lstrlenW (lpString=".doc") returned 4 [0035.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.600] lstrlenW (lpString=".docx") returned 5 [0035.600] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.600] lstrlenW (lpString=".pdf") returned 4 [0035.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.600] lstrlenW (lpString=".xls") returned 4 [0035.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.600] lstrlenW (lpString=".xlsx") returned 5 [0035.600] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.600] lstrlenW (lpString=".ppt") returned 4 [0035.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.600] lstrlenW (lpString=".zip") returned 4 [0035.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.601] lstrlenW (lpString=".rar") returned 4 [0035.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString=".bz2") returned 4 [0035.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString=".7z") returned 3 [0035.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString=".dbf") returned 4 [0035.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString=".1cd") returned 4 [0035.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString=".jpg") returned 4 [0035.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString=".doc") returned 4 [0035.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString=".docx") returned 5 [0035.601] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.601] lstrlenW (lpString=".pdf") returned 4 [0035.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString=".xls") returned 4 [0035.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString=".xlsx") returned 5 [0035.601] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.601] lstrlenW (lpString=".ppt") returned 4 [0035.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.601] lstrlenW (lpString=".zip") returned 4 [0035.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.601] lstrlenW (lpString=".rar") returned 4 [0035.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.602] lstrlenW (lpString=".bz2") returned 4 [0035.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.602] lstrlenW (lpString=".7z") returned 3 [0035.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.602] lstrlenW (lpString=".dbf") returned 4 [0035.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.602] lstrlenW (lpString=".1cd") returned 4 [0035.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.602] lstrlenW (lpString=".jpg") returned 4 [0035.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.602] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.602] lstrlenW (lpString="branding.xml") returned 12 [0035.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.603] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=596341) returned 1 [0035.603] CloseHandle (hObject=0x16c) returned 1 [0035.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0035.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.603] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.603] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0035.603] GetLastError () returned 0x0 [0035.604] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.616] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.626] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.626] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.627] SetEndOfFile (hFile=0x164) returned 1 [0035.627] CloseHandle (hObject=0x164) returned 1 [0035.632] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.632] SetEndOfFile (hFile=0x16c) returned 1 [0035.637] CloseHandle (hObject=0x16c) returned 1 [0035.637] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.637] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString=".doc") returned 4 [0035.638] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString=".docx") returned 5 [0035.638] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.638] lstrlenW (lpString=".pdf") returned 4 [0035.638] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString=".xls") returned 4 [0035.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString=".xlsx") returned 5 [0035.638] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.638] lstrlenW (lpString=".ppt") returned 4 [0035.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString=".zip") returned 4 [0035.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.638] lstrlenW (lpString=".rar") returned 4 [0035.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString=".bz2") returned 4 [0035.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString=".7z") returned 3 [0035.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString=".dbf") returned 4 [0035.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString=".1cd") returned 4 [0035.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.638] lstrlenW (lpString=".jpg") returned 4 [0035.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString=".doc") returned 4 [0035.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString=".docx") returned 5 [0035.639] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.639] lstrlenW (lpString=".pdf") returned 4 [0035.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString=".xls") returned 4 [0035.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString=".xlsx") returned 5 [0035.639] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.639] lstrlenW (lpString=".ppt") returned 4 [0035.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString=".zip") returned 4 [0035.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.639] lstrlenW (lpString=".rar") returned 4 [0035.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString=".bz2") returned 4 [0035.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString=".7z") returned 3 [0035.639] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString=".dbf") returned 4 [0035.639] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString=".1cd") returned 4 [0035.639] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.639] lstrlenW (lpString=".jpg") returned 4 [0035.639] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.640] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.640] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0035.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.640] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=819) returned 1 [0035.640] CloseHandle (hObject=0x16c) returned 1 [0035.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0035.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.640] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.640] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0035.641] GetLastError () returned 0x0 [0035.641] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x333, lpOverlapped=0x0) returned 1 [0036.175] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x340, lpOverlapped=0x0) returned 1 [0036.176] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.176] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0036.176] SetEndOfFile (hFile=0x164) returned 1 [0036.176] CloseHandle (hObject=0x164) returned 1 [0036.176] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.177] SetEndOfFile (hFile=0x16c) returned 1 [0036.179] CloseHandle (hObject=0x16c) returned 1 [0036.179] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.179] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString=".doc") returned 4 [0036.180] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString=".docx") returned 5 [0036.180] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.180] lstrlenW (lpString=".pdf") returned 4 [0036.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString=".xls") returned 4 [0036.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString=".xlsx") returned 5 [0036.180] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.180] lstrlenW (lpString=".ppt") returned 4 [0036.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString=".zip") returned 4 [0036.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.180] lstrlenW (lpString=".rar") returned 4 [0036.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString=".bz2") returned 4 [0036.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString=".7z") returned 3 [0036.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString=".dbf") returned 4 [0036.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString=".1cd") returned 4 [0036.180] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.180] lstrlenW (lpString=".jpg") returned 4 [0036.180] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString=".doc") returned 4 [0036.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString=".docx") returned 5 [0036.181] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.181] lstrlenW (lpString=".pdf") returned 4 [0036.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString=".xls") returned 4 [0036.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString=".xlsx") returned 5 [0036.181] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.181] lstrlenW (lpString=".ppt") returned 4 [0036.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString=".zip") returned 4 [0036.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.181] lstrlenW (lpString=".rar") returned 4 [0036.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString=".bz2") returned 4 [0036.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString=".7z") returned 3 [0036.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString=".dbf") returned 4 [0036.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString=".1cd") returned 4 [0036.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0036.181] lstrlenW (lpString=".jpg") returned 4 [0036.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.182] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.182] lstrlenW (lpString="Office32WW.xml") returned 14 [0036.182] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0036.183] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4274) returned 1 [0036.183] CloseHandle (hObject=0x16c) returned 1 [0036.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0036.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0036.183] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.183] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0036.183] GetLastError () returned 0x0 [0036.184] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0036.226] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0036.228] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.228] WriteFile (in: hFile=0x164, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.228] SetEndOfFile (hFile=0x164) returned 1 [0036.228] CloseHandle (hObject=0x164) returned 1 [0036.229] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.229] SetEndOfFile (hFile=0x16c) returned 1 [0036.230] CloseHandle (hObject=0x16c) returned 1 [0036.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.230] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString=".doc") returned 4 [0036.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString=".docx") returned 5 [0036.231] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.231] lstrlenW (lpString=".pdf") returned 4 [0036.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString=".xls") returned 4 [0036.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString=".xlsx") returned 5 [0036.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.231] lstrlenW (lpString=".ppt") returned 4 [0036.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString=".zip") returned 4 [0036.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.231] lstrlenW (lpString=".rar") returned 4 [0036.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString=".bz2") returned 4 [0036.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString=".7z") returned 3 [0036.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString=".dbf") returned 4 [0036.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString=".1cd") returned 4 [0036.231] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.231] lstrlenW (lpString=".jpg") returned 4 [0036.231] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString=".doc") returned 4 [0036.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString=".docx") returned 5 [0036.232] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.232] lstrlenW (lpString=".pdf") returned 4 [0036.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString=".xls") returned 4 [0036.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString=".xlsx") returned 5 [0036.232] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.232] lstrlenW (lpString=".ppt") returned 4 [0036.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString=".zip") returned 4 [0036.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.232] lstrlenW (lpString=".rar") returned 4 [0036.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString=".bz2") returned 4 [0036.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString=".7z") returned 3 [0036.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString=".dbf") returned 4 [0036.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString=".1cd") returned 4 [0036.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.232] lstrlenW (lpString=".jpg") returned 4 [0036.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.233] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.233] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0036.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.256] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6421) returned 1 [0036.256] CloseHandle (hObject=0x1b0) returned 1 [0036.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0036.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.256] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.256] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.256] GetLastError () returned 0x0 [0036.256] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1915, lpOverlapped=0x0) returned 1 [0036.298] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0036.299] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.299] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.299] SetEndOfFile (hFile=0x1b4) returned 1 [0036.299] CloseHandle (hObject=0x1b4) returned 1 [0036.300] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.300] SetEndOfFile (hFile=0x1b0) returned 1 [0036.301] CloseHandle (hObject=0x1b0) returned 1 [0036.301] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.301] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0036.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString=".doc") returned 4 [0036.302] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString=".docx") returned 5 [0036.302] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.302] lstrlenW (lpString=".pdf") returned 4 [0036.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString=".xls") returned 4 [0036.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString=".xlsx") returned 5 [0036.302] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.302] lstrlenW (lpString=".ppt") returned 4 [0036.302] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString=".zip") returned 4 [0036.302] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.302] lstrlenW (lpString=".rar") returned 4 [0036.302] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString=".bz2") returned 4 [0036.302] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString=".7z") returned 3 [0036.302] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString=".dbf") returned 4 [0036.302] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString=".1cd") returned 4 [0036.302] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString=".jpg") returned 4 [0036.302] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.303] lstrlenW (lpString=".doc") returned 4 [0036.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString=".docx") returned 5 [0036.303] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.303] lstrlenW (lpString=".pdf") returned 4 [0036.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString=".xls") returned 4 [0036.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString=".xlsx") returned 5 [0036.303] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.303] lstrlenW (lpString=".ppt") returned 4 [0036.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.303] lstrlenW (lpString=".zip") returned 4 [0036.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.303] lstrlenW (lpString=".rar") returned 4 [0036.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString=".bz2") returned 4 [0036.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString=".7z") returned 3 [0036.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.303] lstrlenW (lpString=".dbf") returned 4 [0036.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.303] lstrlenW (lpString=".1cd") returned 4 [0036.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0036.303] lstrlenW (lpString=".jpg") returned 4 [0036.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.303] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.304] lstrlenW (lpString="Setup.xml") returned 9 [0036.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.304] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16683) returned 1 [0036.304] CloseHandle (hObject=0x1b0) returned 1 [0036.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.304] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.304] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.305] GetLastError () returned 0x0 [0036.305] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x412b, lpOverlapped=0x0) returned 1 [0036.376] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0036.377] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.377] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.377] SetEndOfFile (hFile=0x1b4) returned 1 [0036.377] CloseHandle (hObject=0x1b4) returned 1 [0036.378] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.378] SetEndOfFile (hFile=0x1b0) returned 1 [0036.379] CloseHandle (hObject=0x1b0) returned 1 [0036.379] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.379] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString=".doc") returned 4 [0036.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString=".docx") returned 5 [0036.380] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.380] lstrlenW (lpString=".pdf") returned 4 [0036.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString=".xls") returned 4 [0036.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString=".xlsx") returned 5 [0036.380] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.380] lstrlenW (lpString=".ppt") returned 4 [0036.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString=".zip") returned 4 [0036.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.380] lstrlenW (lpString=".rar") returned 4 [0036.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString=".bz2") returned 4 [0036.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString=".7z") returned 3 [0036.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString=".dbf") returned 4 [0036.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString=".1cd") returned 4 [0036.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.380] lstrlenW (lpString=".jpg") returned 4 [0036.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString=".doc") returned 4 [0036.381] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString=".docx") returned 5 [0036.381] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.381] lstrlenW (lpString=".pdf") returned 4 [0036.381] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString=".xls") returned 4 [0036.381] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString=".xlsx") returned 5 [0036.381] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.381] lstrlenW (lpString=".ppt") returned 4 [0036.381] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString=".zip") returned 4 [0036.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.381] lstrlenW (lpString=".rar") returned 4 [0036.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString=".bz2") returned 4 [0036.381] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString=".7z") returned 3 [0036.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString=".dbf") returned 4 [0036.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString=".1cd") returned 4 [0036.381] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.381] lstrlenW (lpString=".jpg") returned 4 [0036.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.382] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.382] lstrlenW (lpString="Office32WW.xml") returned 14 [0036.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.383] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4274) returned 1 [0036.383] CloseHandle (hObject=0x1b0) returned 1 [0036.383] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0036.383] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.384] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.384] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.384] GetLastError () returned 0x0 [0036.384] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0036.733] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0036.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.735] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.735] SetEndOfFile (hFile=0x1b4) returned 1 [0036.735] CloseHandle (hObject=0x1b4) returned 1 [0036.736] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.736] SetEndOfFile (hFile=0x1b0) returned 1 [0036.736] CloseHandle (hObject=0x1b0) returned 1 [0036.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.737] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0036.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.737] lstrlenW (lpString=".doc") returned 4 [0036.737] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.737] lstrlenW (lpString=".docx") returned 5 [0036.737] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.737] lstrlenW (lpString=".pdf") returned 4 [0036.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.737] lstrlenW (lpString=".xls") returned 4 [0036.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.737] lstrlenW (lpString=".xlsx") returned 5 [0036.737] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.737] lstrlenW (lpString=".ppt") returned 4 [0036.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.737] lstrlenW (lpString=".zip") returned 4 [0036.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.737] lstrlenW (lpString=".rar") returned 4 [0036.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".bz2") returned 4 [0036.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".7z") returned 3 [0036.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString=".dbf") returned 4 [0036.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString=".1cd") returned 4 [0036.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString=".jpg") returned 4 [0036.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString=".doc") returned 4 [0036.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".docx") returned 5 [0036.738] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.738] lstrlenW (lpString=".pdf") returned 4 [0036.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".xls") returned 4 [0036.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".xlsx") returned 5 [0036.738] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.738] lstrlenW (lpString=".ppt") returned 4 [0036.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.738] lstrlenW (lpString=".zip") returned 4 [0036.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.738] lstrlenW (lpString=".rar") returned 4 [0036.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.738] lstrlenW (lpString=".bz2") returned 4 [0036.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.739] lstrlenW (lpString=".7z") returned 3 [0036.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.739] lstrlenW (lpString=".dbf") returned 4 [0036.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.739] lstrlenW (lpString=".1cd") returned 4 [0036.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.739] lstrlenW (lpString=".jpg") returned 4 [0036.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.739] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0036.739] lstrlenW (lpString="boxed-join.avi") returned 14 [0036.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.139] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33280) returned 1 [0037.139] CloseHandle (hObject=0x1b0) returned 1 [0037.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0037.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString=".doc") returned 4 [0037.140] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".docx") returned 5 [0037.140] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.140] lstrlenW (lpString=".pdf") returned 4 [0037.140] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".xls") returned 4 [0037.140] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".xlsx") returned 5 [0037.140] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.140] lstrlenW (lpString=".ppt") returned 4 [0037.140] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString=".zip") returned 4 [0037.140] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".rar") returned 4 [0037.140] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".bz2") returned 4 [0037.140] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString=".7z") returned 3 [0037.140] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString=".dbf") returned 4 [0037.140] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString=".1cd") returned 4 [0037.140] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.140] lstrlenW (lpString=".jpg") returned 4 [0037.140] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString=".doc") returned 4 [0037.141] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".docx") returned 5 [0037.141] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.141] lstrlenW (lpString=".pdf") returned 4 [0037.141] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".xls") returned 4 [0037.141] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".xlsx") returned 5 [0037.141] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.141] lstrlenW (lpString=".ppt") returned 4 [0037.141] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString=".zip") returned 4 [0037.141] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".rar") returned 4 [0037.141] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".bz2") returned 4 [0037.141] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString=".7z") returned 3 [0037.141] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString=".dbf") returned 4 [0037.141] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString=".1cd") returned 4 [0037.141] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.141] lstrlenW (lpString=".jpg") returned 4 [0037.141] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.142] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0037.142] lstrlenW (lpString="correct.avi") returned 11 [0037.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.142] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=197120) returned 1 [0037.142] CloseHandle (hObject=0x1b0) returned 1 [0037.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0037.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.142] lstrlenW (lpString=".doc") returned 4 [0037.142] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.142] lstrlenW (lpString=".docx") returned 5 [0037.142] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.142] lstrlenW (lpString=".pdf") returned 4 [0037.142] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.142] lstrlenW (lpString=".xls") returned 4 [0037.142] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.142] lstrlenW (lpString=".xlsx") returned 5 [0037.142] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.142] lstrlenW (lpString=".ppt") returned 4 [0037.142] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".zip") returned 4 [0037.143] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".rar") returned 4 [0037.143] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".bz2") returned 4 [0037.143] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".7z") returned 3 [0037.143] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".dbf") returned 4 [0037.143] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".1cd") returned 4 [0037.143] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".jpg") returned 4 [0037.143] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".doc") returned 4 [0037.143] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".docx") returned 5 [0037.143] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.143] lstrlenW (lpString=".pdf") returned 4 [0037.143] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".xls") returned 4 [0037.143] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString=".xlsx") returned 5 [0037.143] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.143] lstrlenW (lpString=".ppt") returned 4 [0037.143] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.143] lstrlenW (lpString=".zip") returned 4 [0037.144] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.144] lstrlenW (lpString=".rar") returned 4 [0037.144] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.144] lstrlenW (lpString=".bz2") returned 4 [0037.144] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.144] lstrlenW (lpString=".7z") returned 3 [0037.144] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.144] lstrlenW (lpString=".dbf") returned 4 [0037.144] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.144] lstrlenW (lpString=".1cd") returned 4 [0037.144] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.144] lstrlenW (lpString=".jpg") returned 4 [0037.144] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.144] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0037.144] lstrlenW (lpString="delete.avi") returned 10 [0037.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.145] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=224256) returned 1 [0037.145] CloseHandle (hObject=0x1b0) returned 1 [0037.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0037.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.145] lstrlenW (lpString=".doc") returned 4 [0037.145] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.145] lstrlenW (lpString=".docx") returned 5 [0037.145] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.145] lstrlenW (lpString=".pdf") returned 4 [0037.145] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.145] lstrlenW (lpString=".xls") returned 4 [0037.145] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.145] lstrlenW (lpString=".xlsx") returned 5 [0037.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.146] lstrlenW (lpString=".ppt") returned 4 [0037.146] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString=".zip") returned 4 [0037.146] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".rar") returned 4 [0037.146] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".bz2") returned 4 [0037.146] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".7z") returned 3 [0037.146] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString=".dbf") returned 4 [0037.146] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString=".1cd") returned 4 [0037.146] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString=".jpg") returned 4 [0037.146] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.146] lstrlenW (lpString=".doc") returned 4 [0037.146] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".docx") returned 5 [0037.146] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.146] lstrlenW (lpString=".pdf") returned 4 [0037.146] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".xls") returned 4 [0037.146] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.146] lstrlenW (lpString=".xlsx") returned 5 [0037.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.146] lstrlenW (lpString=".ppt") returned 4 [0037.147] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.147] lstrlenW (lpString=".zip") returned 4 [0037.147] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.147] lstrlenW (lpString=".rar") returned 4 [0037.147] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.147] lstrlenW (lpString=".bz2") returned 4 [0037.147] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.147] lstrlenW (lpString=".7z") returned 3 [0037.147] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.147] lstrlenW (lpString=".dbf") returned 4 [0037.147] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.147] lstrlenW (lpString=".1cd") returned 4 [0037.147] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0037.147] lstrlenW (lpString=".jpg") returned 4 [0037.147] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.147] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0037.147] lstrlenW (lpString="join.avi") returned 8 [0037.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.147] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=222208) returned 1 [0037.147] CloseHandle (hObject=0x1b0) returned 1 [0037.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0037.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.148] lstrlenW (lpString=".doc") returned 4 [0037.148] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".docx") returned 5 [0037.148] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.148] lstrlenW (lpString=".pdf") returned 4 [0037.148] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".xls") returned 4 [0037.148] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".xlsx") returned 5 [0037.148] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.148] lstrlenW (lpString=".ppt") returned 4 [0037.148] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.148] lstrlenW (lpString=".zip") returned 4 [0037.148] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".rar") returned 4 [0037.148] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".bz2") returned 4 [0037.148] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString=".7z") returned 3 [0037.148] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.148] lstrlenW (lpString=".dbf") returned 4 [0037.148] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.148] lstrlenW (lpString=".1cd") returned 4 [0037.149] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString=".jpg") returned 4 [0037.149] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString=".doc") returned 4 [0037.149] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".docx") returned 5 [0037.149] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.149] lstrlenW (lpString=".pdf") returned 4 [0037.149] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".xls") returned 4 [0037.149] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".xlsx") returned 5 [0037.149] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.149] lstrlenW (lpString=".ppt") returned 4 [0037.149] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString=".zip") returned 4 [0037.149] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".rar") returned 4 [0037.149] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".bz2") returned 4 [0037.149] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString=".7z") returned 3 [0037.149] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString=".dbf") returned 4 [0037.149] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.149] lstrlenW (lpString=".1cd") returned 4 [0037.149] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0037.150] lstrlenW (lpString=".jpg") returned 4 [0037.150] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.150] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0037.150] lstrlenW (lpString="split.avi") returned 9 [0037.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.150] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=194048) returned 1 [0037.150] CloseHandle (hObject=0x1b0) returned 1 [0037.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0037.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.150] lstrlenW (lpString=".doc") returned 4 [0037.150] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.150] lstrlenW (lpString=".docx") returned 5 [0037.150] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.151] lstrlenW (lpString=".pdf") returned 4 [0037.151] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".xls") returned 4 [0037.151] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".xlsx") returned 5 [0037.151] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.151] lstrlenW (lpString=".ppt") returned 4 [0037.151] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString=".zip") returned 4 [0037.151] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".rar") returned 4 [0037.151] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".bz2") returned 4 [0037.151] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".7z") returned 3 [0037.151] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString=".dbf") returned 4 [0037.151] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString=".1cd") returned 4 [0037.151] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString=".jpg") returned 4 [0037.151] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.151] lstrlenW (lpString=".doc") returned 4 [0037.151] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.151] lstrlenW (lpString=".docx") returned 5 [0037.151] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.151] lstrlenW (lpString=".pdf") returned 4 [0037.151] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString=".xls") returned 4 [0037.152] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString=".xlsx") returned 5 [0037.152] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.152] lstrlenW (lpString=".ppt") returned 4 [0037.152] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.152] lstrlenW (lpString=".zip") returned 4 [0037.152] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString=".rar") returned 4 [0037.152] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString=".bz2") returned 4 [0037.152] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString=".7z") returned 3 [0037.152] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.152] lstrlenW (lpString=".dbf") returned 4 [0037.152] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.152] lstrlenW (lpString=".1cd") returned 4 [0037.152] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0037.152] lstrlenW (lpString=".jpg") returned 4 [0037.152] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.152] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0037.152] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0037.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.153] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1600388) returned 1 [0037.153] CloseHandle (hObject=0x1b0) returned 1 [0037.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0037.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0037.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0037.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0037.153] lstrlenW (lpString=".doc") returned 4 [0037.153] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.153] lstrlenW (lpString=".docx") returned 5 [0037.153] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.153] lstrlenW (lpString=".pdf") returned 4 [0037.153] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.153] lstrlenW (lpString=".xls") returned 4 [0037.153] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.153] lstrlenW (lpString=".xlsx") returned 5 [0037.153] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.153] lstrlenW (lpString=".ppt") returned 4 [0037.153] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0037.153] lstrlenW (lpString=".zip") returned 4 [0037.153] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.154] lstrlenW (lpString=".rar") returned 4 [0037.154] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.154] lstrlenW (lpString=".bz2") returned 4 [0037.154] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.154] lstrlenW (lpString=".7z") returned 3 [0037.154] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0037.154] lstrlenW (lpString=".dbf") returned 4 [0037.154] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.154] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.155] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1434) returned 1 [0037.155] CloseHandle (hObject=0x1b0) returned 1 [0037.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0037.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.155] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.156] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=212) returned 1 [0037.156] CloseHandle (hObject=0x1b0) returned 1 [0037.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0037.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.156] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.156] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=384) returned 1 [0037.156] CloseHandle (hObject=0x1b0) returned 1 [0037.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0037.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.157] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.157] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1118) returned 1 [0037.157] CloseHandle (hObject=0x1b0) returned 1 [0037.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0037.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.158] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.158] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=392) returned 1 [0037.158] CloseHandle (hObject=0x1b0) returned 1 [0037.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0037.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.158] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.159] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=727) returned 1 [0037.159] CloseHandle (hObject=0x1b0) returned 1 [0037.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0037.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.159] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.161] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3150) returned 1 [0037.161] CloseHandle (hObject=0x1b0) returned 1 [0037.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0037.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.161] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.161] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=247) returned 1 [0037.161] CloseHandle (hObject=0x1b0) returned 1 [0037.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0037.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.162] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.162] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3161) returned 1 [0037.162] CloseHandle (hObject=0x1b0) returned 1 [0037.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0037.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.163] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.163] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3166) returned 1 [0037.163] CloseHandle (hObject=0x1b0) returned 1 [0037.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0037.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.163] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.164] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=738) returned 1 [0037.164] CloseHandle (hObject=0x1b0) returned 1 [0037.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0037.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.164] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.164] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=804) returned 1 [0037.164] CloseHandle (hObject=0x1b0) returned 1 [0037.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0037.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.165] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.165] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=488) returned 1 [0037.165] CloseHandle (hObject=0x1b0) returned 1 [0037.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0037.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.166] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.166] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=617) returned 1 [0037.166] CloseHandle (hObject=0x1b0) returned 1 [0037.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0037.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.166] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.167] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16616) returned 1 [0037.167] CloseHandle (hObject=0x1b0) returned 1 [0037.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0037.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.167] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.168] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15097) returned 1 [0037.168] CloseHandle (hObject=0x1b0) returned 1 [0037.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0037.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.168] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.169] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9803) returned 1 [0037.169] CloseHandle (hObject=0x1b0) returned 1 [0037.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0037.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.170] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.170] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11067) returned 1 [0037.170] CloseHandle (hObject=0x1b0) returned 1 [0037.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0037.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.170] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.171] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10947) returned 1 [0037.171] CloseHandle (hObject=0x1b0) returned 1 [0037.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0037.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.171] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.172] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=38485) returned 1 [0037.172] CloseHandle (hObject=0x1b0) returned 1 [0037.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0037.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.172] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.172] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1218) returned 1 [0037.172] CloseHandle (hObject=0x1b0) returned 1 [0037.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0037.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.173] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.174] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=209) returned 1 [0037.174] CloseHandle (hObject=0x1b0) returned 1 [0037.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0037.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.174] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0037.692] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=471) returned 1 [0037.692] CloseHandle (hObject=0x188) returned 1 [0037.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0037.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.692] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0038.122] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1166) returned 1 [0038.122] CloseHandle (hObject=0x16c) returned 1 [0038.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0038.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.123] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.040] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3053984) returned 1 [0039.040] CloseHandle (hObject=0x170) returned 1 [0039.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0039.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0039.040] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.040] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2227968) returned 1 [0039.040] CloseHandle (hObject=0x170) returned 1 [0039.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0039.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0039.041] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.041] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3195696) returned 1 [0039.041] CloseHandle (hObject=0x170) returned 1 [0039.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0039.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0039.041] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.042] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4120784) returned 1 [0039.042] CloseHandle (hObject=0x170) returned 1 [0039.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0039.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0039.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.042] lstrlenW (lpString=".doc") returned 4 [0039.043] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString=".docx") returned 5 [0039.043] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0039.043] lstrlenW (lpString=".pdf") returned 4 [0039.043] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString=".xls") returned 4 [0039.043] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString=".xlsx") returned 5 [0039.043] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0039.043] lstrlenW (lpString=".ppt") returned 4 [0039.043] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString=".zip") returned 4 [0039.043] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString=".rar") returned 4 [0039.043] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString=".bz2") returned 4 [0039.043] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.043] lstrlenW (lpString=".7z") returned 3 [0039.043] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString=".dbf") returned 4 [0039.043] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString=".1cd") returned 4 [0039.043] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString=".jpg") returned 4 [0039.043] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.043] lstrlenW (lpString=".doc") returned 4 [0039.044] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString=".docx") returned 5 [0039.044] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0039.044] lstrlenW (lpString=".pdf") returned 4 [0039.044] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString=".xls") returned 4 [0039.044] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString=".xlsx") returned 5 [0039.044] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0039.044] lstrlenW (lpString=".ppt") returned 4 [0039.044] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.044] lstrlenW (lpString=".zip") returned 4 [0039.044] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString=".rar") returned 4 [0039.044] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString=".bz2") returned 4 [0039.044] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.044] lstrlenW (lpString=".7z") returned 3 [0039.044] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.044] lstrlenW (lpString=".dbf") returned 4 [0039.044] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.044] lstrlenW (lpString=".1cd") returned 4 [0039.044] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0039.044] lstrlenW (lpString=".jpg") returned 4 [0039.044] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.045] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.045] lstrlenW (lpString="ipscat.xml") returned 10 [0039.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.045] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2592) returned 1 [0039.045] CloseHandle (hObject=0x170) returned 1 [0039.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0039.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.045] lstrlenW (lpString=".doc") returned 4 [0039.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.045] lstrlenW (lpString=".docx") returned 5 [0039.045] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.045] lstrlenW (lpString=".pdf") returned 4 [0039.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.045] lstrlenW (lpString=".xls") returned 4 [0039.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString=".xlsx") returned 5 [0039.046] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.046] lstrlenW (lpString=".ppt") returned 4 [0039.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString=".zip") returned 4 [0039.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.046] lstrlenW (lpString=".rar") returned 4 [0039.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString=".bz2") returned 4 [0039.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString=".7z") returned 3 [0039.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString=".dbf") returned 4 [0039.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString=".1cd") returned 4 [0039.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString=".jpg") returned 4 [0039.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.046] lstrlenW (lpString=".doc") returned 4 [0039.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString=".docx") returned 5 [0039.046] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.046] lstrlenW (lpString=".pdf") returned 4 [0039.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.046] lstrlenW (lpString=".xls") returned 4 [0039.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString=".xlsx") returned 5 [0039.047] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.047] lstrlenW (lpString=".ppt") returned 4 [0039.047] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.047] lstrlenW (lpString=".zip") returned 4 [0039.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.047] lstrlenW (lpString=".rar") returned 4 [0039.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString=".bz2") returned 4 [0039.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString=".7z") returned 3 [0039.047] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.047] lstrlenW (lpString=".dbf") returned 4 [0039.047] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.047] lstrlenW (lpString=".1cd") returned 4 [0039.047] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0039.047] lstrlenW (lpString=".jpg") returned 4 [0039.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.047] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.047] lstrlenW (lpString="ipschs.xml") returned 10 [0039.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.048] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2462) returned 1 [0039.048] CloseHandle (hObject=0x170) returned 1 [0039.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0039.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.048] lstrlenW (lpString=".doc") returned 4 [0039.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.048] lstrlenW (lpString=".docx") returned 5 [0039.048] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0039.048] lstrlenW (lpString=".pdf") returned 4 [0039.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.048] lstrlenW (lpString=".xls") returned 4 [0039.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.048] lstrlenW (lpString=".xlsx") returned 5 [0039.048] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0039.048] lstrlenW (lpString=".ppt") returned 4 [0039.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.048] lstrlenW (lpString=".zip") returned 4 [0039.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.049] lstrlenW (lpString=".rar") returned 4 [0039.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString=".bz2") returned 4 [0039.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString=".7z") returned 3 [0039.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString=".dbf") returned 4 [0039.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString=".1cd") returned 4 [0039.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString=".jpg") returned 4 [0039.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString=".doc") returned 4 [0039.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString=".docx") returned 5 [0039.049] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0039.049] lstrlenW (lpString=".pdf") returned 4 [0039.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString=".xls") returned 4 [0039.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString=".xlsx") returned 5 [0039.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0039.049] lstrlenW (lpString=".ppt") returned 4 [0039.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.049] lstrlenW (lpString=".zip") returned 4 [0039.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.050] lstrlenW (lpString=".rar") returned 4 [0039.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.050] lstrlenW (lpString=".bz2") returned 4 [0039.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.050] lstrlenW (lpString=".7z") returned 3 [0039.050] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.050] lstrlenW (lpString=".dbf") returned 4 [0039.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.050] lstrlenW (lpString=".1cd") returned 4 [0039.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0039.050] lstrlenW (lpString=".jpg") returned 4 [0039.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.050] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.050] lstrlenW (lpString="ipscht.xml") returned 10 [0039.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.051] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2436) returned 1 [0039.051] CloseHandle (hObject=0x170) returned 1 [0039.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0039.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.051] lstrlenW (lpString=".doc") returned 4 [0039.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.051] lstrlenW (lpString=".docx") returned 5 [0039.051] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.052] lstrlenW (lpString=".pdf") returned 4 [0039.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString=".xls") returned 4 [0039.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString=".xlsx") returned 5 [0039.052] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.052] lstrlenW (lpString=".ppt") returned 4 [0039.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString=".zip") returned 4 [0039.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.052] lstrlenW (lpString=".rar") returned 4 [0039.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString=".bz2") returned 4 [0039.052] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString=".7z") returned 3 [0039.052] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString=".dbf") returned 4 [0039.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString=".1cd") returned 4 [0039.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString=".jpg") returned 4 [0039.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.052] lstrlenW (lpString=".doc") returned 4 [0039.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.052] lstrlenW (lpString=".docx") returned 5 [0039.052] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.053] lstrlenW (lpString=".pdf") returned 4 [0039.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString=".xls") returned 4 [0039.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString=".xlsx") returned 5 [0039.053] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.053] lstrlenW (lpString=".ppt") returned 4 [0039.053] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.053] lstrlenW (lpString=".zip") returned 4 [0039.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.053] lstrlenW (lpString=".rar") returned 4 [0039.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString=".bz2") returned 4 [0039.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString=".7z") returned 3 [0039.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.053] lstrlenW (lpString=".dbf") returned 4 [0039.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.053] lstrlenW (lpString=".1cd") returned 4 [0039.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.053] lstrlenW (lpString=".jpg") returned 4 [0039.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.053] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.053] lstrlenW (lpString="ipscsy.xml") returned 10 [0039.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.054] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2556) returned 1 [0039.054] CloseHandle (hObject=0x170) returned 1 [0039.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0039.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.054] lstrlenW (lpString=".doc") returned 4 [0039.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.054] lstrlenW (lpString=".docx") returned 5 [0039.054] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0039.054] lstrlenW (lpString=".pdf") returned 4 [0039.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.054] lstrlenW (lpString=".xls") returned 4 [0039.054] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.054] lstrlenW (lpString=".xlsx") returned 5 [0039.054] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0039.054] lstrlenW (lpString=".ppt") returned 4 [0039.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString=".zip") returned 4 [0039.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.055] lstrlenW (lpString=".rar") returned 4 [0039.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString=".bz2") returned 4 [0039.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString=".7z") returned 3 [0039.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString=".dbf") returned 4 [0039.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString=".1cd") returned 4 [0039.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString=".jpg") returned 4 [0039.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.055] lstrlenW (lpString=".doc") returned 4 [0039.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString=".docx") returned 5 [0039.055] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0039.055] lstrlenW (lpString=".pdf") returned 4 [0039.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString=".xls") returned 4 [0039.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.055] lstrlenW (lpString=".xlsx") returned 5 [0039.055] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0039.055] lstrlenW (lpString=".ppt") returned 4 [0039.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.056] lstrlenW (lpString=".zip") returned 4 [0039.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.056] lstrlenW (lpString=".rar") returned 4 [0039.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.056] lstrlenW (lpString=".bz2") returned 4 [0039.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.056] lstrlenW (lpString=".7z") returned 3 [0039.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.056] lstrlenW (lpString=".dbf") returned 4 [0039.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.056] lstrlenW (lpString=".1cd") returned 4 [0039.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0039.056] lstrlenW (lpString=".jpg") returned 4 [0039.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.056] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.056] lstrlenW (lpString="ipsdan.xml") returned 10 [0039.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.057] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2514) returned 1 [0039.057] CloseHandle (hObject=0x170) returned 1 [0039.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0039.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.057] lstrlenW (lpString=".doc") returned 4 [0039.057] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.057] lstrlenW (lpString=".docx") returned 5 [0039.057] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.057] lstrlenW (lpString=".pdf") returned 4 [0039.057] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.057] lstrlenW (lpString=".xls") returned 4 [0039.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.057] lstrlenW (lpString=".xlsx") returned 5 [0039.057] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.057] lstrlenW (lpString=".ppt") returned 4 [0039.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.057] lstrlenW (lpString=".zip") returned 4 [0039.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.057] lstrlenW (lpString=".rar") returned 4 [0039.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString=".bz2") returned 4 [0039.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString=".7z") returned 3 [0039.058] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString=".dbf") returned 4 [0039.058] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString=".1cd") returned 4 [0039.058] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString=".jpg") returned 4 [0039.058] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString=".doc") returned 4 [0039.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString=".docx") returned 5 [0039.058] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.058] lstrlenW (lpString=".pdf") returned 4 [0039.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString=".xls") returned 4 [0039.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString=".xlsx") returned 5 [0039.058] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.058] lstrlenW (lpString=".ppt") returned 4 [0039.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.058] lstrlenW (lpString=".zip") returned 4 [0039.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.058] lstrlenW (lpString=".rar") returned 4 [0039.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.059] lstrlenW (lpString=".bz2") returned 4 [0039.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.059] lstrlenW (lpString=".7z") returned 3 [0039.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.059] lstrlenW (lpString=".dbf") returned 4 [0039.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.059] lstrlenW (lpString=".1cd") returned 4 [0039.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.059] lstrlenW (lpString=".jpg") returned 4 [0039.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.059] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0039.059] lstrlenW (lpString="ipsdeu.xml") returned 10 [0039.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.059] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2616) returned 1 [0039.059] CloseHandle (hObject=0x170) returned 1 [0039.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0039.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.060] lstrlenW (lpString=".doc") returned 4 [0039.060] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString=".docx") returned 5 [0039.060] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0039.060] lstrlenW (lpString=".pdf") returned 4 [0039.060] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString=".xls") returned 4 [0039.060] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString=".xlsx") returned 5 [0039.060] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0039.060] lstrlenW (lpString=".ppt") returned 4 [0039.060] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.060] lstrlenW (lpString=".zip") returned 4 [0039.060] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.060] lstrlenW (lpString=".rar") returned 4 [0039.060] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString=".bz2") returned 4 [0039.060] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.060] lstrlenW (lpString=".7z") returned 3 [0039.060] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.060] lstrlenW (lpString=".dbf") returned 4 [0039.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.061] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.061] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2578) returned 1 [0039.061] CloseHandle (hObject=0x170) returned 1 [0039.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0039.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.062] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.062] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3024) returned 1 [0039.062] CloseHandle (hObject=0x170) returned 1 [0039.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0039.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.062] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.063] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2658) returned 1 [0039.063] CloseHandle (hObject=0x170) returned 1 [0039.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0039.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.063] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.064] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2628) returned 1 [0039.064] CloseHandle (hObject=0x170) returned 1 [0039.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0039.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.064] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.065] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2652) returned 1 [0039.065] CloseHandle (hObject=0x170) returned 1 [0039.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0039.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.065] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.065] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2526) returned 1 [0039.065] CloseHandle (hObject=0x170) returned 1 [0039.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0039.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.066] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.066] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2522) returned 1 [0039.066] CloseHandle (hObject=0x170) returned 1 [0039.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0039.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.066] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.067] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2568) returned 1 [0039.067] CloseHandle (hObject=0x170) returned 1 [0039.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0039.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.067] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.068] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2626) returned 1 [0039.068] CloseHandle (hObject=0x170) returned 1 [0039.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0039.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.068] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.068] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2580) returned 1 [0039.068] CloseHandle (hObject=0x170) returned 1 [0039.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0039.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.069] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.070] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2600) returned 1 [0039.070] CloseHandle (hObject=0x170) returned 1 [0039.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0039.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.070] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.070] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2246) returned 1 [0039.070] CloseHandle (hObject=0x170) returned 1 [0039.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0039.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.071] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.071] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2240) returned 1 [0039.071] CloseHandle (hObject=0x170) returned 1 [0039.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0039.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.071] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.072] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2644) returned 1 [0039.072] CloseHandle (hObject=0x170) returned 1 [0039.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0039.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.072] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.629] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2542) returned 1 [0039.629] CloseHandle (hObject=0x1c4) returned 1 [0039.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0039.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.629] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.630] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2568) returned 1 [0039.630] CloseHandle (hObject=0x1c4) returned 1 [0039.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0039.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.630] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.630] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2596) returned 1 [0039.630] CloseHandle (hObject=0x1c4) returned 1 [0039.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0039.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.631] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.631] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2520) returned 1 [0039.631] CloseHandle (hObject=0x1c4) returned 1 [0039.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0039.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.631] NtCreateFile (FileHandle=0x2d2febc, DesiredAccess=0x80100080, ObjectAttributes=0x2d2fe60*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x2d2fe88), IoStatusBlock=0x2d2fea4, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x3, CreateDisposition=0x1, CreateOptions=0x20060, EaBuffer=0x0, EaLength=0x0) [0039.632] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1680383) returned 1 [0039.633] CloseHandle (hObject=0x1c4) returned 1 [0039.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0039.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0039.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0039.952] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.953] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.953] ReadFile (in: hFile=0x1c4, lpBuffer=0x3910058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3910058*, lpNumberOfBytesRead=0x2d2fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.956] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.956] ReadFile (in: hFile=0x1c4, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d2fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.963] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d2fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.963] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.963] ReadFile (in: hFile=0x1c4, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d2fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.987] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.987] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d2fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0040.302] SetEndOfFile (hFile=0x1c4) returned 1 [0040.302] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x40b8628 [0040.322] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.322] WriteFile (in: hFile=0x1c4, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d2fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2d2fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.323] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.323] WriteFile (in: hFile=0x1c4, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d2fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2d2fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.325] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.325] WriteFile (in: hFile=0x1c4, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d2fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2d2fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.328] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40b8628 | out: hHeap=0x5c0000) returned 1 [0040.330] CloseHandle (hObject=0x1c4) returned 1 [0040.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.688] lstrlenW (lpString=".doc") returned 4 [0040.688] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString=".docx") returned 5 [0040.688] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0040.688] lstrlenW (lpString=".pdf") returned 4 [0040.688] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString=".xls") returned 4 [0040.688] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString=".xlsx") returned 5 [0040.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0040.688] lstrlenW (lpString=".ppt") returned 4 [0040.688] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.688] lstrlenW (lpString=".zip") returned 4 [0040.688] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString=".rar") returned 4 [0040.688] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.688] lstrlenW (lpString=".bz2") returned 4 [0040.688] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.688] lstrlenW (lpString=".7z") returned 3 [0040.688] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString=".dbf") returned 4 [0040.689] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString=".1cd") returned 4 [0040.689] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString=".jpg") returned 4 [0040.689] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString=".doc") returned 4 [0040.689] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString=".docx") returned 5 [0040.689] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0040.689] lstrlenW (lpString=".pdf") returned 4 [0040.689] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString=".xls") returned 4 [0040.689] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString=".xlsx") returned 5 [0040.689] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0040.689] lstrlenW (lpString=".ppt") returned 4 [0040.689] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.689] lstrlenW (lpString=".zip") returned 4 [0040.689] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString=".rar") returned 4 [0040.689] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.689] lstrlenW (lpString=".bz2") returned 4 [0040.689] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.689] lstrlenW (lpString=".7z") returned 3 [0040.689] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.690] lstrlenW (lpString=".dbf") returned 4 [0040.690] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.690] lstrlenW (lpString=".1cd") returned 4 [0040.690] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.690] lstrlenW (lpString=".jpg") returned 4 [0040.690] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.690] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0040.690] lstrlenW (lpString="PSS10R.CHM") returned 10 [0040.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.775] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27195) returned 1 [0040.775] CloseHandle (hObject=0x1c8) returned 1 [0040.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0040.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.775] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.775] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.775] GetLastError () returned 0x0 [0040.775] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0041.055] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0041.106] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.106] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.106] SetEndOfFile (hFile=0x1c4) returned 1 [0041.106] CloseHandle (hObject=0x1c4) returned 1 [0041.107] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.107] SetEndOfFile (hFile=0x1c8) returned 1 [0041.108] CloseHandle (hObject=0x1c8) returned 1 [0041.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.108] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0041.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.109] lstrlenW (lpString=".doc") returned 4 [0041.109] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString=".docx") returned 5 [0041.109] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0041.109] lstrlenW (lpString=".pdf") returned 4 [0041.109] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString=".xls") returned 4 [0041.109] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString=".xlsx") returned 5 [0041.109] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0041.109] lstrlenW (lpString=".ppt") returned 4 [0041.109] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.109] lstrlenW (lpString=".zip") returned 4 [0041.109] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString=".rar") returned 4 [0041.109] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString=".bz2") returned 4 [0041.109] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.109] lstrlenW (lpString=".7z") returned 3 [0041.109] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.109] lstrlenW (lpString=".dbf") returned 4 [0041.109] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.109] lstrlenW (lpString=".1cd") returned 4 [0041.110] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString=".jpg") returned 4 [0041.110] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString=".doc") returned 4 [0041.110] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString=".docx") returned 5 [0041.110] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0041.110] lstrlenW (lpString=".pdf") returned 4 [0041.110] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString=".xls") returned 4 [0041.110] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString=".xlsx") returned 5 [0041.110] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0041.110] lstrlenW (lpString=".ppt") returned 4 [0041.110] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString=".zip") returned 4 [0041.110] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString=".rar") returned 4 [0041.110] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString=".bz2") returned 4 [0041.110] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.110] lstrlenW (lpString=".7z") returned 3 [0041.110] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString=".dbf") returned 4 [0041.110] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.110] lstrlenW (lpString=".1cd") returned 4 [0041.110] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0041.111] lstrlenW (lpString=".jpg") returned 4 [0041.111] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.111] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.111] lstrlenW (lpString="SETUP.XML") returned 9 [0041.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.111] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2362) returned 1 [0041.111] CloseHandle (hObject=0x1c8) returned 1 [0041.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0041.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.112] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.112] GetLastError () returned 0x0 [0041.112] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x93a, lpOverlapped=0x0) returned 1 [0041.129] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x940, lpOverlapped=0x0) returned 1 [0041.131] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.131] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.131] SetEndOfFile (hFile=0x1c4) returned 1 [0041.132] CloseHandle (hObject=0x1c4) returned 1 [0041.132] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.132] SetEndOfFile (hFile=0x1c8) returned 1 [0041.133] CloseHandle (hObject=0x1c8) returned 1 [0041.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".doc") returned 4 [0041.134] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".docx") returned 5 [0041.134] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.134] lstrlenW (lpString=".pdf") returned 4 [0041.134] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".xls") returned 4 [0041.134] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".xlsx") returned 5 [0041.134] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.134] lstrlenW (lpString=".ppt") returned 4 [0041.134] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".zip") returned 4 [0041.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.134] lstrlenW (lpString=".rar") returned 4 [0041.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".bz2") returned 4 [0041.134] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".7z") returned 3 [0041.134] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".dbf") returned 4 [0041.134] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".1cd") returned 4 [0041.134] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".jpg") returned 4 [0041.134] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".doc") returned 4 [0041.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString=".docx") returned 5 [0041.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.135] lstrlenW (lpString=".pdf") returned 4 [0041.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString=".xls") returned 4 [0041.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString=".xlsx") returned 5 [0041.135] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.135] lstrlenW (lpString=".ppt") returned 4 [0041.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".zip") returned 4 [0041.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.135] lstrlenW (lpString=".rar") returned 4 [0041.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString=".bz2") returned 4 [0041.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString=".7z") returned 3 [0041.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".dbf") returned 4 [0041.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".1cd") returned 4 [0041.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".jpg") returned 4 [0041.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.136] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.136] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0041.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.136] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1606) returned 1 [0041.136] CloseHandle (hObject=0x1c8) returned 1 [0041.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0041.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.136] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.136] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.139] GetLastError () returned 0x0 [0041.139] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x646, lpOverlapped=0x0) returned 1 [0041.227] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x650, lpOverlapped=0x0) returned 1 [0041.228] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.228] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.228] SetEndOfFile (hFile=0x1c4) returned 1 [0041.228] CloseHandle (hObject=0x1c4) returned 1 [0041.231] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.231] SetEndOfFile (hFile=0x1c8) returned 1 [0041.232] CloseHandle (hObject=0x1c8) returned 1 [0041.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0041.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.233] lstrlenW (lpString=".doc") returned 4 [0041.233] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString=".docx") returned 5 [0041.233] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.233] lstrlenW (lpString=".pdf") returned 4 [0041.233] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString=".xls") returned 4 [0041.233] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString=".xlsx") returned 5 [0041.233] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.233] lstrlenW (lpString=".ppt") returned 4 [0041.233] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.233] lstrlenW (lpString=".zip") returned 4 [0041.233] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.233] lstrlenW (lpString=".rar") returned 4 [0041.233] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString=".bz2") returned 4 [0041.233] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString=".7z") returned 3 [0041.233] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.233] lstrlenW (lpString=".dbf") returned 4 [0041.233] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.233] lstrlenW (lpString=".1cd") returned 4 [0041.233] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString=".jpg") returned 4 [0041.234] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString=".doc") returned 4 [0041.234] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString=".docx") returned 5 [0041.234] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.234] lstrlenW (lpString=".pdf") returned 4 [0041.234] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString=".xls") returned 4 [0041.234] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString=".xlsx") returned 5 [0041.234] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.234] lstrlenW (lpString=".ppt") returned 4 [0041.234] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString=".zip") returned 4 [0041.234] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.234] lstrlenW (lpString=".rar") returned 4 [0041.234] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString=".bz2") returned 4 [0041.234] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString=".7z") returned 3 [0041.234] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString=".dbf") returned 4 [0041.234] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.234] lstrlenW (lpString=".1cd") returned 4 [0041.234] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.235] lstrlenW (lpString=".jpg") returned 4 [0041.235] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.235] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.235] lstrlenW (lpString="SETUP.XML") returned 9 [0041.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.236] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1988) returned 1 [0041.236] CloseHandle (hObject=0x1c8) returned 1 [0041.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0041.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.236] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.236] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.236] GetLastError () returned 0x0 [0041.236] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0041.241] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0041.242] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.242] WriteFile (in: hFile=0x1c4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.242] SetEndOfFile (hFile=0x1c4) returned 1 [0041.243] CloseHandle (hObject=0x1c4) returned 1 [0041.243] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.243] SetEndOfFile (hFile=0x1c8) returned 1 [0041.244] CloseHandle (hObject=0x1c8) returned 1 [0041.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0041.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.244] lstrlenW (lpString=".doc") returned 4 [0041.244] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.244] lstrlenW (lpString=".docx") returned 5 [0041.245] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.245] lstrlenW (lpString=".pdf") returned 4 [0041.245] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString=".xls") returned 4 [0041.245] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString=".xlsx") returned 5 [0041.245] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.245] lstrlenW (lpString=".ppt") returned 4 [0041.245] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString=".zip") returned 4 [0041.245] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.245] lstrlenW (lpString=".rar") returned 4 [0041.245] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString=".bz2") returned 4 [0041.245] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString=".7z") returned 3 [0041.245] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString=".dbf") returned 4 [0041.245] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString=".1cd") returned 4 [0041.245] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString=".jpg") returned 4 [0041.245] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.245] lstrlenW (lpString=".doc") returned 4 [0041.245] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.245] lstrlenW (lpString=".docx") returned 5 [0041.245] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.246] lstrlenW (lpString=".pdf") returned 4 [0041.246] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString=".xls") returned 4 [0041.246] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString=".xlsx") returned 5 [0041.246] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.246] lstrlenW (lpString=".ppt") returned 4 [0041.246] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.246] lstrlenW (lpString=".zip") returned 4 [0041.246] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.246] lstrlenW (lpString=".rar") returned 4 [0041.246] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString=".bz2") returned 4 [0041.246] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString=".7z") returned 3 [0041.246] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.246] lstrlenW (lpString=".dbf") returned 4 [0041.246] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.246] lstrlenW (lpString=".1cd") returned 4 [0041.246] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.246] lstrlenW (lpString=".jpg") returned 4 [0041.246] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.246] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.246] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0041.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.247] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3186) returned 1 [0041.247] CloseHandle (hObject=0x1c8) returned 1 [0041.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0041.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.247] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.247] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.956] GetLastError () returned 0x0 [0041.956] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc72, lpOverlapped=0x0) returned 1 [0041.958] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0041.958] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.959] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.959] SetEndOfFile (hFile=0x200) returned 1 [0041.959] CloseHandle (hObject=0x200) returned 1 [0041.959] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.959] SetEndOfFile (hFile=0x1c8) returned 1 [0041.960] CloseHandle (hObject=0x1c8) returned 1 [0041.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.960] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString=".doc") returned 4 [0041.961] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString=".docx") returned 5 [0041.961] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.961] lstrlenW (lpString=".pdf") returned 4 [0041.961] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString=".xls") returned 4 [0041.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString=".xlsx") returned 5 [0041.961] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.961] lstrlenW (lpString=".ppt") returned 4 [0041.961] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString=".zip") returned 4 [0041.961] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.961] lstrlenW (lpString=".rar") returned 4 [0041.961] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString=".bz2") returned 4 [0041.961] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString=".7z") returned 3 [0041.961] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString=".dbf") returned 4 [0041.961] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString=".1cd") returned 4 [0041.961] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.961] lstrlenW (lpString=".jpg") returned 4 [0041.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString=".doc") returned 4 [0041.962] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString=".docx") returned 5 [0041.962] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.962] lstrlenW (lpString=".pdf") returned 4 [0041.962] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString=".xls") returned 4 [0041.962] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString=".xlsx") returned 5 [0041.962] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.962] lstrlenW (lpString=".ppt") returned 4 [0041.962] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString=".zip") returned 4 [0041.962] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.962] lstrlenW (lpString=".rar") returned 4 [0041.962] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString=".bz2") returned 4 [0041.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString=".7z") returned 3 [0041.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString=".dbf") returned 4 [0041.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString=".1cd") returned 4 [0041.962] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.962] lstrlenW (lpString=".jpg") returned 4 [0041.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.963] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.963] lstrlenW (lpString="Proof.XML") returned 9 [0041.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.963] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1347) returned 1 [0041.963] CloseHandle (hObject=0x1c8) returned 1 [0041.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0041.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.963] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.963] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.964] GetLastError () returned 0x0 [0041.964] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x543, lpOverlapped=0x0) returned 1 [0041.967] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x550, lpOverlapped=0x0) returned 1 [0041.968] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.968] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.968] SetEndOfFile (hFile=0x200) returned 1 [0041.968] CloseHandle (hObject=0x200) returned 1 [0041.969] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.969] SetEndOfFile (hFile=0x1c8) returned 1 [0041.969] CloseHandle (hObject=0x1c8) returned 1 [0041.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.970] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0041.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.970] lstrlenW (lpString=".doc") returned 4 [0041.970] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.970] lstrlenW (lpString=".docx") returned 5 [0041.970] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.970] lstrlenW (lpString=".pdf") returned 4 [0041.970] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.970] lstrlenW (lpString=".xls") returned 4 [0041.970] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.970] lstrlenW (lpString=".xlsx") returned 5 [0041.970] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.970] lstrlenW (lpString=".ppt") returned 4 [0041.970] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.970] lstrlenW (lpString=".zip") returned 4 [0041.970] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.970] lstrlenW (lpString=".rar") returned 4 [0041.970] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.970] lstrlenW (lpString=".bz2") returned 4 [0041.970] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".7z") returned 3 [0041.971] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString=".dbf") returned 4 [0041.971] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString=".1cd") returned 4 [0041.971] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString=".jpg") returned 4 [0041.971] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString=".doc") returned 4 [0041.971] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".docx") returned 5 [0041.971] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.971] lstrlenW (lpString=".pdf") returned 4 [0041.971] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".xls") returned 4 [0041.971] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".xlsx") returned 5 [0041.971] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.971] lstrlenW (lpString=".ppt") returned 4 [0041.971] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.971] lstrlenW (lpString=".zip") returned 4 [0041.971] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.971] lstrlenW (lpString=".rar") returned 4 [0041.971] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".bz2") returned 4 [0041.971] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.971] lstrlenW (lpString=".7z") returned 3 [0041.971] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.972] lstrlenW (lpString=".dbf") returned 4 [0041.972] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.972] lstrlenW (lpString=".1cd") returned 4 [0041.972] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.972] lstrlenW (lpString=".jpg") returned 4 [0041.972] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.972] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.972] lstrlenW (lpString="Proof.XML") returned 9 [0041.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.981] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1457) returned 1 [0041.981] CloseHandle (hObject=0x1c8) returned 1 [0041.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0041.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.981] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.981] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.981] GetLastError () returned 0x0 [0041.981] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0041.983] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0041.984] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.984] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.984] SetEndOfFile (hFile=0x200) returned 1 [0041.984] CloseHandle (hObject=0x200) returned 1 [0041.985] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.985] SetEndOfFile (hFile=0x1c8) returned 1 [0041.986] CloseHandle (hObject=0x1c8) returned 1 [0041.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0041.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString=".doc") returned 4 [0041.987] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString=".docx") returned 5 [0041.987] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.987] lstrlenW (lpString=".pdf") returned 4 [0041.987] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString=".xls") returned 4 [0041.987] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString=".xlsx") returned 5 [0041.987] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.987] lstrlenW (lpString=".ppt") returned 4 [0041.987] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString=".zip") returned 4 [0041.987] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.987] lstrlenW (lpString=".rar") returned 4 [0041.987] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString=".bz2") returned 4 [0041.987] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString=".7z") returned 3 [0041.987] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString=".dbf") returned 4 [0041.987] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString=".1cd") returned 4 [0041.987] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString=".jpg") returned 4 [0041.987] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.988] lstrlenW (lpString=".doc") returned 4 [0041.988] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString=".docx") returned 5 [0041.988] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.988] lstrlenW (lpString=".pdf") returned 4 [0041.988] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString=".xls") returned 4 [0041.988] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString=".xlsx") returned 5 [0041.988] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.988] lstrlenW (lpString=".ppt") returned 4 [0041.988] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.988] lstrlenW (lpString=".zip") returned 4 [0041.988] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.988] lstrlenW (lpString=".rar") returned 4 [0041.988] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString=".bz2") returned 4 [0041.988] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString=".7z") returned 3 [0041.988] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.988] lstrlenW (lpString=".dbf") returned 4 [0041.988] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.988] lstrlenW (lpString=".1cd") returned 4 [0041.988] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.988] lstrlenW (lpString=".jpg") returned 4 [0041.988] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.989] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.989] lstrlenW (lpString="Proof.XML") returned 9 [0041.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.989] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1458) returned 1 [0041.989] CloseHandle (hObject=0x1c8) returned 1 [0041.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0041.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.989] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.989] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.990] GetLastError () returned 0x0 [0041.990] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0042.164] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0042.165] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.165] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.165] SetEndOfFile (hFile=0x200) returned 1 [0042.165] CloseHandle (hObject=0x200) returned 1 [0042.166] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.166] SetEndOfFile (hFile=0x1c8) returned 1 [0042.167] CloseHandle (hObject=0x1c8) returned 1 [0042.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.167] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0042.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.167] lstrlenW (lpString=".doc") returned 4 [0042.167] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.167] lstrlenW (lpString=".docx") returned 5 [0042.167] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0042.167] lstrlenW (lpString=".pdf") returned 4 [0042.167] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.167] lstrlenW (lpString=".xls") returned 4 [0042.167] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.167] lstrlenW (lpString=".xlsx") returned 5 [0042.167] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0042.167] lstrlenW (lpString=".ppt") returned 4 [0042.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.167] lstrlenW (lpString=".zip") returned 4 [0042.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.168] lstrlenW (lpString=".rar") returned 4 [0042.168] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString=".bz2") returned 4 [0042.168] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString=".7z") returned 3 [0042.168] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString=".dbf") returned 4 [0042.168] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString=".1cd") returned 4 [0042.168] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString=".jpg") returned 4 [0042.168] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString=".doc") returned 4 [0042.168] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString=".docx") returned 5 [0042.168] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0042.168] lstrlenW (lpString=".pdf") returned 4 [0042.168] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString=".xls") returned 4 [0042.168] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString=".xlsx") returned 5 [0042.168] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0042.168] lstrlenW (lpString=".ppt") returned 4 [0042.168] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.168] lstrlenW (lpString=".zip") returned 4 [0042.168] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.168] lstrlenW (lpString=".rar") returned 4 [0042.169] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.169] lstrlenW (lpString=".bz2") returned 4 [0042.169] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.169] lstrlenW (lpString=".7z") returned 3 [0042.169] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.169] lstrlenW (lpString=".dbf") returned 4 [0042.169] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.169] lstrlenW (lpString=".1cd") returned 4 [0042.169] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0042.169] lstrlenW (lpString=".jpg") returned 4 [0042.169] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.169] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.169] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0042.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.288] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16852) returned 1 [0042.288] CloseHandle (hObject=0x1f0) returned 1 [0042.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0042.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.288] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.288] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.366] GetLastError () returned 0x0 [0042.366] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0042.403] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0042.404] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.404] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0042.405] SetEndOfFile (hFile=0x200) returned 1 [0042.405] CloseHandle (hObject=0x200) returned 1 [0042.405] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.405] SetEndOfFile (hFile=0x1f0) returned 1 [0042.406] CloseHandle (hObject=0x1f0) returned 1 [0042.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.407] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0042.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.407] lstrlenW (lpString=".doc") returned 4 [0042.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString=".docx") returned 5 [0042.407] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.407] lstrlenW (lpString=".pdf") returned 4 [0042.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString=".xls") returned 4 [0042.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString=".xlsx") returned 5 [0042.407] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.407] lstrlenW (lpString=".ppt") returned 4 [0042.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.407] lstrlenW (lpString=".zip") returned 4 [0042.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.407] lstrlenW (lpString=".rar") returned 4 [0042.407] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString=".bz2") returned 4 [0042.407] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.407] lstrlenW (lpString=".7z") returned 3 [0042.407] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString=".dbf") returned 4 [0042.408] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString=".1cd") returned 4 [0042.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString=".jpg") returned 4 [0042.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString=".doc") returned 4 [0042.408] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString=".docx") returned 5 [0042.408] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.408] lstrlenW (lpString=".pdf") returned 4 [0042.408] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString=".xls") returned 4 [0042.408] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString=".xlsx") returned 5 [0042.408] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.408] lstrlenW (lpString=".ppt") returned 4 [0042.408] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.408] lstrlenW (lpString=".zip") returned 4 [0042.408] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.408] lstrlenW (lpString=".rar") returned 4 [0042.408] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString=".bz2") returned 4 [0042.408] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.408] lstrlenW (lpString=".7z") returned 3 [0042.408] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.409] lstrlenW (lpString=".dbf") returned 4 [0042.409] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.409] lstrlenW (lpString=".1cd") returned 4 [0042.409] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0042.409] lstrlenW (lpString=".jpg") returned 4 [0042.409] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.409] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.409] lstrlenW (lpString="VisiorWW.XML") returned 12 [0042.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.414] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8723) returned 1 [0042.414] CloseHandle (hObject=0x188) returned 1 [0042.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0042.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.415] GetLastError () returned 0x0 [0042.415] ReadFile (in: hFile=0x188, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2213, lpOverlapped=0x0) returned 1 [0042.416] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0042.418] ReadFile (in: hFile=0x188, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.418] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.418] SetEndOfFile (hFile=0x16c) returned 1 [0042.418] CloseHandle (hObject=0x16c) returned 1 [0042.419] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.419] SetEndOfFile (hFile=0x188) returned 1 [0042.419] CloseHandle (hObject=0x188) returned 1 [0042.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.420] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0042.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.420] lstrlenW (lpString=".doc") returned 4 [0042.420] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.420] lstrlenW (lpString=".docx") returned 5 [0042.420] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.420] lstrlenW (lpString=".pdf") returned 4 [0042.420] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.420] lstrlenW (lpString=".xls") returned 4 [0042.420] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.420] lstrlenW (lpString=".xlsx") returned 5 [0042.420] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.420] lstrlenW (lpString=".ppt") returned 4 [0042.420] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.420] lstrlenW (lpString=".zip") returned 4 [0042.420] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.420] lstrlenW (lpString=".rar") returned 4 [0042.420] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.420] lstrlenW (lpString=".bz2") returned 4 [0042.421] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString=".7z") returned 3 [0042.421] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString=".dbf") returned 4 [0042.421] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString=".1cd") returned 4 [0042.421] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString=".jpg") returned 4 [0042.421] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString=".doc") returned 4 [0042.421] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString=".docx") returned 5 [0042.421] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.421] lstrlenW (lpString=".pdf") returned 4 [0042.421] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString=".xls") returned 4 [0042.421] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString=".xlsx") returned 5 [0042.421] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.421] lstrlenW (lpString=".ppt") returned 4 [0042.421] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.421] lstrlenW (lpString=".zip") returned 4 [0042.421] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.421] lstrlenW (lpString=".rar") returned 4 [0042.421] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.421] lstrlenW (lpString=".bz2") returned 4 [0042.422] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.422] lstrlenW (lpString=".7z") returned 3 [0042.422] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.422] lstrlenW (lpString=".dbf") returned 4 [0042.422] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.422] lstrlenW (lpString=".1cd") returned 4 [0042.422] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.422] lstrlenW (lpString=".jpg") returned 4 [0042.422] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.422] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.422] lstrlenW (lpString="SETUP.XML") returned 9 [0042.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.425] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2424) returned 1 [0042.425] CloseHandle (hObject=0x1f0) returned 1 [0042.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0042.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.425] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.425] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.425] GetLastError () returned 0x0 [0042.425] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x978, lpOverlapped=0x0) returned 1 [0042.427] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x980, lpOverlapped=0x0) returned 1 [0042.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.428] WriteFile (in: hFile=0x188, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.428] SetEndOfFile (hFile=0x188) returned 1 [0042.428] CloseHandle (hObject=0x188) returned 1 [0042.429] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.429] SetEndOfFile (hFile=0x1f0) returned 1 [0042.430] CloseHandle (hObject=0x1f0) returned 1 [0042.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.431] lstrlenW (lpString=".doc") returned 4 [0042.431] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString=".docx") returned 5 [0042.431] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.431] lstrlenW (lpString=".pdf") returned 4 [0042.431] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString=".xls") returned 4 [0042.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString=".xlsx") returned 5 [0042.431] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.431] lstrlenW (lpString=".ppt") returned 4 [0042.431] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.431] lstrlenW (lpString=".zip") returned 4 [0042.431] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.431] lstrlenW (lpString=".rar") returned 4 [0042.431] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString=".bz2") returned 4 [0042.431] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString=".7z") returned 3 [0042.431] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.431] lstrlenW (lpString=".dbf") returned 4 [0042.431] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.431] lstrlenW (lpString=".1cd") returned 4 [0042.431] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".jpg") returned 4 [0042.432] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".doc") returned 4 [0042.432] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString=".docx") returned 5 [0042.432] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.432] lstrlenW (lpString=".pdf") returned 4 [0042.432] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString=".xls") returned 4 [0042.432] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString=".xlsx") returned 5 [0042.432] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.432] lstrlenW (lpString=".ppt") returned 4 [0042.432] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".zip") returned 4 [0042.432] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.432] lstrlenW (lpString=".rar") returned 4 [0042.432] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString=".bz2") returned 4 [0042.432] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString=".7z") returned 3 [0042.432] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".dbf") returned 4 [0042.432] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".1cd") returned 4 [0042.432] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0042.432] lstrlenW (lpString=".jpg") returned 4 [0042.433] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.433] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.433] lstrlenW (lpString="WordMUI.XML") returned 11 [0042.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.433] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1800) returned 1 [0042.433] CloseHandle (hObject=0x1f0) returned 1 [0042.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0042.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.433] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.433] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.709] GetLastError () returned 0x0 [0042.710] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x708, lpOverlapped=0x0) returned 1 [0042.711] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x710, lpOverlapped=0x0) returned 1 [0042.712] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.712] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.712] SetEndOfFile (hFile=0x16c) returned 1 [0042.713] CloseHandle (hObject=0x16c) returned 1 [0042.713] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.714] SetEndOfFile (hFile=0x1f0) returned 1 [0042.714] CloseHandle (hObject=0x1f0) returned 1 [0042.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.715] lstrlenW (lpString=".doc") returned 4 [0042.715] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString=".docx") returned 5 [0042.715] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.715] lstrlenW (lpString=".pdf") returned 4 [0042.715] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString=".xls") returned 4 [0042.715] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString=".xlsx") returned 5 [0042.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.715] lstrlenW (lpString=".ppt") returned 4 [0042.715] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.715] lstrlenW (lpString=".zip") returned 4 [0042.715] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.715] lstrlenW (lpString=".rar") returned 4 [0042.715] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString=".bz2") returned 4 [0042.715] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.715] lstrlenW (lpString=".7z") returned 3 [0042.715] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString=".dbf") returned 4 [0042.716] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString=".1cd") returned 4 [0042.716] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString=".jpg") returned 4 [0042.716] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString=".doc") returned 4 [0042.716] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString=".docx") returned 5 [0042.716] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.716] lstrlenW (lpString=".pdf") returned 4 [0042.716] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString=".xls") returned 4 [0042.716] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString=".xlsx") returned 5 [0042.716] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.716] lstrlenW (lpString=".ppt") returned 4 [0042.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.716] lstrlenW (lpString=".zip") returned 4 [0042.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.716] lstrlenW (lpString=".rar") returned 4 [0042.716] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString=".bz2") returned 4 [0042.716] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.716] lstrlenW (lpString=".7z") returned 3 [0042.716] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.717] lstrlenW (lpString=".dbf") returned 4 [0042.717] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.717] lstrlenW (lpString=".1cd") returned 4 [0042.717] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0042.717] lstrlenW (lpString=".jpg") returned 4 [0042.717] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.717] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.717] lstrlenW (lpString="DATES.XML") returned 9 [0042.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.717] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8918) returned 1 [0042.717] CloseHandle (hObject=0x1f0) returned 1 [0042.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0042.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.718] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.718] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.719] GetLastError () returned 0x0 [0042.719] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0042.721] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0042.722] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.722] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.722] SetEndOfFile (hFile=0x16c) returned 1 [0042.722] CloseHandle (hObject=0x16c) returned 1 [0042.723] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.723] SetEndOfFile (hFile=0x1f0) returned 1 [0042.724] CloseHandle (hObject=0x1f0) returned 1 [0042.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.724] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0042.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString=".doc") returned 4 [0042.725] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString=".docx") returned 5 [0042.725] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0042.725] lstrlenW (lpString=".pdf") returned 4 [0042.725] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString=".xls") returned 4 [0042.725] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString=".xlsx") returned 5 [0042.725] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0042.725] lstrlenW (lpString=".ppt") returned 4 [0042.725] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString=".zip") returned 4 [0042.725] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.725] lstrlenW (lpString=".rar") returned 4 [0042.725] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString=".bz2") returned 4 [0042.725] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString=".7z") returned 3 [0042.725] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString=".dbf") returned 4 [0042.725] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString=".1cd") returned 4 [0042.725] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString=".jpg") returned 4 [0042.725] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.726] lstrlenW (lpString=".doc") returned 4 [0042.726] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString=".docx") returned 5 [0042.726] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0042.726] lstrlenW (lpString=".pdf") returned 4 [0042.726] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString=".xls") returned 4 [0042.726] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString=".xlsx") returned 5 [0042.726] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0042.726] lstrlenW (lpString=".ppt") returned 4 [0042.726] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.726] lstrlenW (lpString=".zip") returned 4 [0042.726] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.726] lstrlenW (lpString=".rar") returned 4 [0042.726] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString=".bz2") returned 4 [0042.726] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString=".7z") returned 3 [0042.726] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.726] lstrlenW (lpString=".dbf") returned 4 [0042.726] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.726] lstrlenW (lpString=".1cd") returned 4 [0042.726] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.726] lstrlenW (lpString=".jpg") returned 4 [0042.726] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.727] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.727] lstrlenW (lpString="PHONE.XML") returned 9 [0042.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.727] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1844) returned 1 [0042.727] CloseHandle (hObject=0x1f0) returned 1 [0042.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0042.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.727] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.727] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.728] GetLastError () returned 0x0 [0042.728] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x734, lpOverlapped=0x0) returned 1 [0042.729] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x740, lpOverlapped=0x0) returned 1 [0042.730] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.730] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.730] SetEndOfFile (hFile=0x16c) returned 1 [0042.730] CloseHandle (hObject=0x16c) returned 1 [0042.731] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.731] SetEndOfFile (hFile=0x1f0) returned 1 [0042.732] CloseHandle (hObject=0x1f0) returned 1 [0042.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.732] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0042.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.732] lstrlenW (lpString=".doc") returned 4 [0042.732] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.732] lstrlenW (lpString=".docx") returned 5 [0042.732] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.732] lstrlenW (lpString=".pdf") returned 4 [0042.732] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString=".xls") returned 4 [0042.733] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString=".xlsx") returned 5 [0042.733] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.733] lstrlenW (lpString=".ppt") returned 4 [0042.733] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString=".zip") returned 4 [0042.733] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.733] lstrlenW (lpString=".rar") returned 4 [0042.733] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString=".bz2") returned 4 [0042.733] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString=".7z") returned 3 [0042.733] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString=".dbf") returned 4 [0042.733] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString=".1cd") returned 4 [0042.733] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString=".jpg") returned 4 [0042.733] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.733] lstrlenW (lpString=".doc") returned 4 [0042.733] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString=".docx") returned 5 [0042.734] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.734] lstrlenW (lpString=".pdf") returned 4 [0042.734] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString=".xls") returned 4 [0042.734] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString=".xlsx") returned 5 [0042.734] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.734] lstrlenW (lpString=".ppt") returned 4 [0042.734] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.734] lstrlenW (lpString=".zip") returned 4 [0042.734] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.734] lstrlenW (lpString=".rar") returned 4 [0042.734] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString=".bz2") returned 4 [0042.734] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString=".7z") returned 3 [0042.734] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.734] lstrlenW (lpString=".dbf") returned 4 [0042.734] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.734] lstrlenW (lpString=".1cd") returned 4 [0042.734] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.734] lstrlenW (lpString=".jpg") returned 4 [0042.734] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.735] lstrcmpiW (lpString1=".DAT", lpString2=".zoh") returned -1 [0042.735] lstrlenW (lpString="STOCKS.DAT") returned 10 [0042.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.736] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=39017) returned 1 [0042.736] CloseHandle (hObject=0x1f0) returned 1 [0042.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0042.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.736] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.736] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.737] GetLastError () returned 0x0 [0042.737] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9869, lpOverlapped=0x0) returned 1 [0042.739] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0042.741] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.741] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.741] SetEndOfFile (hFile=0x16c) returned 1 [0042.741] CloseHandle (hObject=0x16c) returned 1 [0042.742] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.742] SetEndOfFile (hFile=0x1f0) returned 1 [0042.743] CloseHandle (hObject=0x1f0) returned 1 [0042.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0042.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.744] lstrlenW (lpString=".doc") returned 4 [0042.744] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString=".docx") returned 5 [0042.744] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0042.744] lstrlenW (lpString=".pdf") returned 4 [0042.744] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString=".xls") returned 4 [0042.744] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString=".xlsx") returned 5 [0042.744] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0042.744] lstrlenW (lpString=".ppt") returned 4 [0042.744] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.744] lstrlenW (lpString=".zip") returned 4 [0042.744] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString=".rar") returned 4 [0042.744] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString=".bz2") returned 4 [0042.744] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0042.744] lstrlenW (lpString=".7z") returned 3 [0042.744] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0042.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.744] lstrlenW (lpString=".dbf") returned 4 [0042.744] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0042.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.744] lstrlenW (lpString=".1cd") returned 4 [0042.745] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.745] lstrlenW (lpString=".jpg") returned 4 [0042.745] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.745] lstrlenW (lpString=".doc") returned 4 [0042.745] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString=".docx") returned 5 [0042.745] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0042.745] lstrlenW (lpString=".pdf") returned 4 [0042.745] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString=".xls") returned 4 [0042.745] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString=".xlsx") returned 5 [0042.745] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0042.745] lstrlenW (lpString=".ppt") returned 4 [0042.745] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.745] lstrlenW (lpString=".zip") returned 4 [0042.745] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString=".rar") returned 4 [0042.745] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString=".bz2") returned 4 [0042.745] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0042.745] lstrlenW (lpString=".7z") returned 3 [0042.745] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.745] lstrlenW (lpString=".dbf") returned 4 [0042.745] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0042.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.746] lstrlenW (lpString=".1cd") returned 4 [0042.746] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0042.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.746] lstrlenW (lpString=".jpg") returned 4 [0042.746] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0042.746] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.746] lstrlenW (lpString="STOCKS.XML") returned 10 [0042.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.746] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2687) returned 1 [0042.746] CloseHandle (hObject=0x1f0) returned 1 [0042.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0042.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.746] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.747] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.747] GetLastError () returned 0x0 [0042.747] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0043.144] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0043.145] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.145] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0043.145] SetEndOfFile (hFile=0x16c) returned 1 [0043.145] CloseHandle (hObject=0x16c) returned 1 [0043.146] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.146] SetEndOfFile (hFile=0x1f0) returned 1 [0043.147] CloseHandle (hObject=0x1f0) returned 1 [0043.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0043.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0043.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.147] lstrlenW (lpString=".doc") returned 4 [0043.147] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.147] lstrlenW (lpString=".docx") returned 5 [0043.147] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0043.147] lstrlenW (lpString=".pdf") returned 4 [0043.147] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".xls") returned 4 [0043.148] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".xlsx") returned 5 [0043.148] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0043.148] lstrlenW (lpString=".ppt") returned 4 [0043.148] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString=".zip") returned 4 [0043.148] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.148] lstrlenW (lpString=".rar") returned 4 [0043.148] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".bz2") returned 4 [0043.148] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".7z") returned 3 [0043.148] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString=".dbf") returned 4 [0043.148] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString=".1cd") returned 4 [0043.148] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString=".jpg") returned 4 [0043.148] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.148] lstrlenW (lpString=".doc") returned 4 [0043.148] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".docx") returned 5 [0043.148] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0043.148] lstrlenW (lpString=".pdf") returned 4 [0043.148] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.148] lstrlenW (lpString=".xls") returned 4 [0043.149] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString=".xlsx") returned 5 [0043.149] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0043.149] lstrlenW (lpString=".ppt") returned 4 [0043.149] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.149] lstrlenW (lpString=".zip") returned 4 [0043.149] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.149] lstrlenW (lpString=".rar") returned 4 [0043.149] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString=".bz2") returned 4 [0043.149] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString=".7z") returned 3 [0043.149] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.149] lstrlenW (lpString=".dbf") returned 4 [0043.149] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.149] lstrlenW (lpString=".1cd") returned 4 [0043.149] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.149] lstrlenW (lpString=".jpg") returned 4 [0043.149] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.149] lstrcmpiW (lpString1=".htm", lpString2=".zoh") returned -1 [0043.149] lstrlenW (lpString="Bears.htm") returned 9 [0043.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.383] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=255) returned 1 [0044.383] CloseHandle (hObject=0x1f4) returned 1 [0044.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0044.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString=".doc") returned 4 [0044.384] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.384] lstrlenW (lpString=".docx") returned 5 [0044.384] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.384] lstrlenW (lpString=".pdf") returned 4 [0044.384] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.384] lstrlenW (lpString=".xls") returned 4 [0044.384] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.384] lstrlenW (lpString=".xlsx") returned 5 [0044.384] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.384] lstrlenW (lpString=".ppt") returned 4 [0044.384] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString=".zip") returned 4 [0044.384] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.384] lstrlenW (lpString=".rar") returned 4 [0044.384] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.384] lstrlenW (lpString=".bz2") returned 4 [0044.384] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.384] lstrlenW (lpString=".7z") returned 3 [0044.384] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString=".dbf") returned 4 [0044.384] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString=".1cd") returned 4 [0044.384] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.384] lstrlenW (lpString=".jpg") returned 4 [0044.384] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString=".doc") returned 4 [0044.385] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.385] lstrlenW (lpString=".docx") returned 5 [0044.385] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.385] lstrlenW (lpString=".pdf") returned 4 [0044.385] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString=".xls") returned 4 [0044.385] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString=".xlsx") returned 5 [0044.385] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.385] lstrlenW (lpString=".ppt") returned 4 [0044.385] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString=".zip") returned 4 [0044.385] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString=".rar") returned 4 [0044.385] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.385] lstrlenW (lpString=".bz2") returned 4 [0044.385] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.385] lstrlenW (lpString=".7z") returned 3 [0044.385] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString=".dbf") returned 4 [0044.385] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString=".1cd") returned 4 [0044.385] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.385] lstrlenW (lpString=".jpg") returned 4 [0044.385] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.386] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0044.386] lstrlenW (lpString="Notebook.jpg") returned 12 [0044.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.568] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2950) returned 1 [0044.568] CloseHandle (hObject=0x16c) returned 1 [0044.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0044.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.568] lstrlenW (lpString=".doc") returned 4 [0044.568] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.568] lstrlenW (lpString=".docx") returned 5 [0044.568] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.568] lstrlenW (lpString=".pdf") returned 4 [0044.568] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.568] lstrlenW (lpString=".xls") returned 4 [0044.568] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.568] lstrlenW (lpString=".xlsx") returned 5 [0044.569] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.569] lstrlenW (lpString=".ppt") returned 4 [0044.569] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString=".zip") returned 4 [0044.569] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.569] lstrlenW (lpString=".rar") returned 4 [0044.569] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.569] lstrlenW (lpString=".bz2") returned 4 [0044.569] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.569] lstrlenW (lpString=".7z") returned 3 [0044.569] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString=".dbf") returned 4 [0044.569] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString=".1cd") returned 4 [0044.569] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString=".jpg") returned 4 [0044.569] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.569] lstrlenW (lpString=".doc") returned 4 [0044.569] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.569] lstrlenW (lpString=".docx") returned 5 [0044.569] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.569] lstrlenW (lpString=".pdf") returned 4 [0044.569] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.569] lstrlenW (lpString=".xls") returned 4 [0044.569] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.569] lstrlenW (lpString=".xlsx") returned 5 [0044.569] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.570] lstrlenW (lpString=".ppt") returned 4 [0044.570] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.570] lstrlenW (lpString=".zip") returned 4 [0044.570] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.570] lstrlenW (lpString=".rar") returned 4 [0044.570] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.570] lstrlenW (lpString=".bz2") returned 4 [0044.570] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.570] lstrlenW (lpString=".7z") returned 3 [0044.570] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.570] lstrlenW (lpString=".dbf") returned 4 [0044.570] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.570] lstrlenW (lpString=".1cd") returned 4 [0044.570] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.570] lstrlenW (lpString=".jpg") returned 4 [0044.570] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.570] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0044.570] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.882] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=34916) returned 1 [0044.883] CloseHandle (hObject=0x204) returned 1 [0044.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0044.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.883] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.883] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.883] GetLastError () returned 0x0 [0044.883] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8864, lpOverlapped=0x0) returned 1 [0044.887] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0044.890] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.890] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.890] SetEndOfFile (hFile=0x1bc) returned 1 [0044.891] CloseHandle (hObject=0x1bc) returned 1 [0044.891] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.891] SetEndOfFile (hFile=0x204) returned 1 [0044.892] CloseHandle (hObject=0x204) returned 1 [0044.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0044.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.892] lstrlenW (lpString=".doc") returned 4 [0044.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.892] lstrlenW (lpString=".docx") returned 5 [0044.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.893] lstrlenW (lpString=".pdf") returned 4 [0044.893] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString=".xls") returned 4 [0044.893] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.893] lstrlenW (lpString=".xlsx") returned 5 [0044.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.893] lstrlenW (lpString=".ppt") returned 4 [0044.893] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString=".zip") returned 4 [0044.893] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.893] lstrlenW (lpString=".rar") returned 4 [0044.893] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.893] lstrlenW (lpString=".bz2") returned 4 [0044.893] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString=".7z") returned 3 [0044.893] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString=".dbf") returned 4 [0044.893] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString=".1cd") returned 4 [0044.893] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString=".jpg") returned 4 [0044.893] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.893] lstrlenW (lpString=".doc") returned 4 [0044.893] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.893] lstrlenW (lpString=".docx") returned 5 [0044.893] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.894] lstrlenW (lpString=".pdf") returned 4 [0044.894] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.894] lstrlenW (lpString=".xls") returned 4 [0044.894] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.894] lstrlenW (lpString=".xlsx") returned 5 [0044.894] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.894] lstrlenW (lpString=".ppt") returned 4 [0044.894] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.894] lstrlenW (lpString=".zip") returned 4 [0044.894] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.894] lstrlenW (lpString=".rar") returned 4 [0044.894] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.894] lstrlenW (lpString=".bz2") returned 4 [0044.894] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.894] lstrlenW (lpString=".7z") returned 3 [0044.894] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.894] lstrlenW (lpString=".dbf") returned 4 [0044.894] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.894] lstrlenW (lpString=".1cd") returned 4 [0044.894] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.894] lstrlenW (lpString=".jpg") returned 4 [0044.894] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.894] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0044.894] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.898] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2181) returned 1 [0044.898] CloseHandle (hObject=0x204) returned 1 [0044.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0044.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.898] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.898] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.900] GetLastError () returned 0x0 [0044.900] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x885, lpOverlapped=0x0) returned 1 [0044.901] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x890, lpOverlapped=0x0) returned 1 [0044.902] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.902] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.902] SetEndOfFile (hFile=0x1bc) returned 1 [0044.902] CloseHandle (hObject=0x1bc) returned 1 [0044.902] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.902] SetEndOfFile (hFile=0x204) returned 1 [0044.903] CloseHandle (hObject=0x204) returned 1 [0044.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString=".doc") returned 4 [0044.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.904] lstrlenW (lpString=".docx") returned 5 [0044.904] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.904] lstrlenW (lpString=".pdf") returned 4 [0044.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.904] lstrlenW (lpString=".xls") returned 4 [0044.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.904] lstrlenW (lpString=".xlsx") returned 5 [0044.904] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.904] lstrlenW (lpString=".ppt") returned 4 [0044.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString=".zip") returned 4 [0044.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.904] lstrlenW (lpString=".rar") returned 4 [0044.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.904] lstrlenW (lpString=".bz2") returned 4 [0044.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.904] lstrlenW (lpString=".7z") returned 3 [0044.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString=".dbf") returned 4 [0044.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString=".1cd") returned 4 [0044.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.904] lstrlenW (lpString=".jpg") returned 4 [0044.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString=".doc") returned 4 [0044.905] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.905] lstrlenW (lpString=".docx") returned 5 [0044.905] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.905] lstrlenW (lpString=".pdf") returned 4 [0044.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString=".xls") returned 4 [0044.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString=".xlsx") returned 5 [0044.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.905] lstrlenW (lpString=".ppt") returned 4 [0044.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString=".zip") returned 4 [0044.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString=".rar") returned 4 [0044.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.905] lstrlenW (lpString=".bz2") returned 4 [0044.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.905] lstrlenW (lpString=".7z") returned 3 [0044.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString=".dbf") returned 4 [0044.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString=".1cd") returned 4 [0044.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.905] lstrlenW (lpString=".jpg") returned 4 [0044.906] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.906] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0044.906] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.906] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=20627) returned 1 [0044.907] CloseHandle (hObject=0x204) returned 1 [0044.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0044.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.907] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.907] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.907] GetLastError () returned 0x0 [0044.907] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5093, lpOverlapped=0x0) returned 1 [0044.909] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0044.910] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.910] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.910] SetEndOfFile (hFile=0x1bc) returned 1 [0044.910] CloseHandle (hObject=0x1bc) returned 1 [0044.911] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.911] SetEndOfFile (hFile=0x204) returned 1 [0044.911] CloseHandle (hObject=0x204) returned 1 [0044.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0044.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.912] lstrlenW (lpString=".doc") returned 4 [0044.912] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.912] lstrlenW (lpString=".docx") returned 5 [0044.912] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.912] lstrlenW (lpString=".pdf") returned 4 [0044.912] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.912] lstrlenW (lpString=".xls") returned 4 [0044.912] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.912] lstrlenW (lpString=".xlsx") returned 5 [0044.912] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.912] lstrlenW (lpString=".ppt") returned 4 [0044.912] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.912] lstrlenW (lpString=".zip") returned 4 [0044.912] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.912] lstrlenW (lpString=".rar") returned 4 [0044.912] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.913] lstrlenW (lpString=".bz2") returned 4 [0044.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString=".7z") returned 3 [0044.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString=".dbf") returned 4 [0044.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString=".1cd") returned 4 [0044.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString=".jpg") returned 4 [0044.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString=".doc") returned 4 [0044.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString=".docx") returned 5 [0044.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.913] lstrlenW (lpString=".pdf") returned 4 [0044.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.913] lstrlenW (lpString=".xls") returned 4 [0044.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.913] lstrlenW (lpString=".xlsx") returned 5 [0044.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.913] lstrlenW (lpString=".ppt") returned 4 [0044.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.913] lstrlenW (lpString=".zip") returned 4 [0044.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.913] lstrlenW (lpString=".rar") returned 4 [0044.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.913] lstrlenW (lpString=".bz2") returned 4 [0044.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.914] lstrlenW (lpString=".7z") returned 3 [0044.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.914] lstrlenW (lpString=".dbf") returned 4 [0044.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.914] lstrlenW (lpString=".1cd") returned 4 [0044.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.914] lstrlenW (lpString=".jpg") returned 4 [0044.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.914] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0044.914] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.914] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1560) returned 1 [0044.914] CloseHandle (hObject=0x204) returned 1 [0044.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0044.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.915] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.915] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.916] GetLastError () returned 0x0 [0044.916] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x618, lpOverlapped=0x0) returned 1 [0044.918] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x620, lpOverlapped=0x0) returned 1 [0044.919] ReadFile (in: hFile=0x204, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.919] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.919] SetEndOfFile (hFile=0x1bc) returned 1 [0044.919] CloseHandle (hObject=0x1bc) returned 1 [0044.919] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.919] SetEndOfFile (hFile=0x204) returned 1 [0044.920] CloseHandle (hObject=0x204) returned 1 [0044.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.920] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.920] lstrlenW (lpString=".doc") returned 4 [0044.920] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.921] lstrlenW (lpString=".docx") returned 5 [0044.921] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.921] lstrlenW (lpString=".pdf") returned 4 [0044.921] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString=".xls") returned 4 [0044.921] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString=".xlsx") returned 5 [0044.921] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.921] lstrlenW (lpString=".ppt") returned 4 [0044.921] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString=".zip") returned 4 [0044.921] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString=".rar") returned 4 [0044.921] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString=".bz2") returned 4 [0044.921] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.921] lstrlenW (lpString=".7z") returned 3 [0044.921] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString=".dbf") returned 4 [0044.921] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString=".1cd") returned 4 [0044.921] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString=".jpg") returned 4 [0044.921] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.921] lstrlenW (lpString=".doc") returned 4 [0044.921] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.921] lstrlenW (lpString=".docx") returned 5 [0044.922] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.922] lstrlenW (lpString=".pdf") returned 4 [0044.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.922] lstrlenW (lpString=".xls") returned 4 [0044.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.922] lstrlenW (lpString=".xlsx") returned 5 [0044.922] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.922] lstrlenW (lpString=".ppt") returned 4 [0044.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.922] lstrlenW (lpString=".zip") returned 4 [0044.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.922] lstrlenW (lpString=".rar") returned 4 [0044.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.922] lstrlenW (lpString=".bz2") returned 4 [0044.922] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.922] lstrlenW (lpString=".7z") returned 3 [0044.922] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.922] lstrlenW (lpString=".dbf") returned 4 [0044.922] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.922] lstrlenW (lpString=".1cd") returned 4 [0044.922] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.922] lstrlenW (lpString=".jpg") returned 4 [0044.922] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.922] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0044.922] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.923] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33009) returned 1 [0044.923] CloseHandle (hObject=0x204) returned 1 [0044.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0044.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.218] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.218] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.242] GetLastError () returned 0x0 [0045.242] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0045.253] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0045.254] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.254] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.254] SetEndOfFile (hFile=0x1fc) returned 1 [0045.254] CloseHandle (hObject=0x1fc) returned 1 [0045.254] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.254] SetEndOfFile (hFile=0x1f0) returned 1 [0045.255] CloseHandle (hObject=0x1f0) returned 1 [0045.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.256] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.256] lstrlenW (lpString=".doc") returned 4 [0045.256] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.256] lstrlenW (lpString=".docx") returned 5 [0045.256] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.256] lstrlenW (lpString=".pdf") returned 4 [0045.256] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.256] lstrlenW (lpString=".xls") returned 4 [0045.256] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.256] lstrlenW (lpString=".xlsx") returned 5 [0045.256] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.256] lstrlenW (lpString=".ppt") returned 4 [0045.256] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.256] lstrlenW (lpString=".zip") returned 4 [0045.256] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.256] lstrlenW (lpString=".rar") returned 4 [0045.256] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.256] lstrlenW (lpString=".bz2") returned 4 [0045.256] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.256] lstrlenW (lpString=".7z") returned 3 [0045.256] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.256] lstrlenW (lpString=".dbf") returned 4 [0045.256] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.257] lstrlenW (lpString=".1cd") returned 4 [0045.257] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.257] lstrlenW (lpString=".jpg") returned 4 [0045.257] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.257] lstrlenW (lpString=".doc") returned 4 [0045.257] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString=".docx") returned 5 [0045.257] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.257] lstrlenW (lpString=".pdf") returned 4 [0045.257] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString=".xls") returned 4 [0045.257] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.257] lstrlenW (lpString=".xlsx") returned 5 [0045.257] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.257] lstrlenW (lpString=".ppt") returned 4 [0045.257] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.257] lstrlenW (lpString=".zip") returned 4 [0045.257] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.257] lstrlenW (lpString=".rar") returned 4 [0045.257] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.257] lstrlenW (lpString=".bz2") returned 4 [0045.257] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.257] lstrlenW (lpString=".7z") returned 3 [0045.257] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.258] lstrlenW (lpString=".dbf") returned 4 [0045.258] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.258] lstrlenW (lpString=".1cd") returned 4 [0045.258] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0045.258] lstrlenW (lpString=".jpg") returned 4 [0045.258] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.258] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.258] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.258] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2722) returned 1 [0045.258] CloseHandle (hObject=0x1f0) returned 1 [0045.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0045.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.259] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.259] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.263] GetLastError () returned 0x0 [0045.263] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0045.265] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0045.266] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.266] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.266] SetEndOfFile (hFile=0x1f4) returned 1 [0045.266] CloseHandle (hObject=0x1f4) returned 1 [0045.267] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.267] SetEndOfFile (hFile=0x1f0) returned 1 [0045.267] CloseHandle (hObject=0x1f0) returned 1 [0045.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0045.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.268] lstrlenW (lpString=".doc") returned 4 [0045.268] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.268] lstrlenW (lpString=".docx") returned 5 [0045.268] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.268] lstrlenW (lpString=".pdf") returned 4 [0045.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.268] lstrlenW (lpString=".xls") returned 4 [0045.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.268] lstrlenW (lpString=".xlsx") returned 5 [0045.268] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.268] lstrlenW (lpString=".ppt") returned 4 [0045.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.268] lstrlenW (lpString=".zip") returned 4 [0045.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.268] lstrlenW (lpString=".rar") returned 4 [0045.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.268] lstrlenW (lpString=".bz2") returned 4 [0045.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.268] lstrlenW (lpString=".7z") returned 3 [0045.268] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.268] lstrlenW (lpString=".dbf") returned 4 [0045.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.269] lstrlenW (lpString=".1cd") returned 4 [0045.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.269] lstrlenW (lpString=".jpg") returned 4 [0045.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.269] lstrlenW (lpString=".doc") returned 4 [0045.269] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.269] lstrlenW (lpString=".docx") returned 5 [0045.269] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.269] lstrlenW (lpString=".pdf") returned 4 [0045.269] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString=".xls") returned 4 [0045.269] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString=".xlsx") returned 5 [0045.269] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.269] lstrlenW (lpString=".ppt") returned 4 [0045.269] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.269] lstrlenW (lpString=".zip") returned 4 [0045.269] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString=".rar") returned 4 [0045.269] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.269] lstrlenW (lpString=".bz2") returned 4 [0045.269] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.269] lstrlenW (lpString=".7z") returned 3 [0045.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.270] lstrlenW (lpString=".dbf") returned 4 [0045.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.270] lstrlenW (lpString=".1cd") returned 4 [0045.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.270] lstrlenW (lpString=".jpg") returned 4 [0045.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.270] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.270] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.271] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=43276) returned 1 [0045.271] CloseHandle (hObject=0x1f0) returned 1 [0045.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0045.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.271] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.271] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.271] GetLastError () returned 0x0 [0045.271] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0045.274] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0045.275] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.275] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.275] SetEndOfFile (hFile=0x1f4) returned 1 [0045.275] CloseHandle (hObject=0x1f4) returned 1 [0045.276] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.276] SetEndOfFile (hFile=0x1f0) returned 1 [0045.277] CloseHandle (hObject=0x1f0) returned 1 [0045.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0045.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.277] lstrlenW (lpString=".doc") returned 4 [0045.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.277] lstrlenW (lpString=".docx") returned 5 [0045.277] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.277] lstrlenW (lpString=".pdf") returned 4 [0045.277] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.277] lstrlenW (lpString=".xls") returned 4 [0045.277] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.277] lstrlenW (lpString=".xlsx") returned 5 [0045.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.277] lstrlenW (lpString=".ppt") returned 4 [0045.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString=".zip") returned 4 [0045.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".rar") returned 4 [0045.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".bz2") returned 4 [0045.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".7z") returned 3 [0045.278] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString=".dbf") returned 4 [0045.278] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString=".1cd") returned 4 [0045.278] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString=".jpg") returned 4 [0045.278] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.278] lstrlenW (lpString=".doc") returned 4 [0045.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".docx") returned 5 [0045.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.278] lstrlenW (lpString=".pdf") returned 4 [0045.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".xls") returned 4 [0045.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".xlsx") returned 5 [0045.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.279] lstrlenW (lpString=".ppt") returned 4 [0045.279] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.279] lstrlenW (lpString=".zip") returned 4 [0045.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString=".rar") returned 4 [0045.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString=".bz2") returned 4 [0045.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString=".7z") returned 3 [0045.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.279] lstrlenW (lpString=".dbf") returned 4 [0045.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.279] lstrlenW (lpString=".1cd") returned 4 [0045.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0045.279] lstrlenW (lpString=".jpg") returned 4 [0045.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.279] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.279] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.280] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=945) returned 1 [0045.280] CloseHandle (hObject=0x1f0) returned 1 [0045.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0045.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.280] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.280] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.282] GetLastError () returned 0x0 [0045.282] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0045.283] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0045.284] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.284] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.284] SetEndOfFile (hFile=0x1fc) returned 1 [0045.284] CloseHandle (hObject=0x1fc) returned 1 [0045.284] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.284] SetEndOfFile (hFile=0x1f0) returned 1 [0045.285] CloseHandle (hObject=0x1f0) returned 1 [0045.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.286] lstrlenW (lpString=".doc") returned 4 [0045.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.286] lstrlenW (lpString=".docx") returned 5 [0045.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.286] lstrlenW (lpString=".pdf") returned 4 [0045.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.286] lstrlenW (lpString=".xls") returned 4 [0045.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.286] lstrlenW (lpString=".xlsx") returned 5 [0045.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.286] lstrlenW (lpString=".ppt") returned 4 [0045.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.286] lstrlenW (lpString=".zip") returned 4 [0045.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.286] lstrlenW (lpString=".rar") returned 4 [0045.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.286] lstrlenW (lpString=".bz2") returned 4 [0045.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.286] lstrlenW (lpString=".7z") returned 3 [0045.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.286] lstrlenW (lpString=".dbf") returned 4 [0045.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.286] lstrlenW (lpString=".1cd") returned 4 [0045.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString=".jpg") returned 4 [0045.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString=".doc") returned 4 [0045.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.287] lstrlenW (lpString=".docx") returned 5 [0045.287] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.287] lstrlenW (lpString=".pdf") returned 4 [0045.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString=".xls") returned 4 [0045.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString=".xlsx") returned 5 [0045.287] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.287] lstrlenW (lpString=".ppt") returned 4 [0045.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString=".zip") returned 4 [0045.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString=".rar") returned 4 [0045.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.287] lstrlenW (lpString=".bz2") returned 4 [0045.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.287] lstrlenW (lpString=".7z") returned 3 [0045.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString=".dbf") returned 4 [0045.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.287] lstrlenW (lpString=".1cd") returned 4 [0045.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0045.288] lstrlenW (lpString=".jpg") returned 4 [0045.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.288] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.288] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.288] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32607) returned 1 [0045.288] CloseHandle (hObject=0x1f0) returned 1 [0045.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0045.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.288] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.288] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.289] GetLastError () returned 0x0 [0045.289] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0045.451] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0045.462] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.462] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.463] SetEndOfFile (hFile=0x1fc) returned 1 [0045.463] CloseHandle (hObject=0x1fc) returned 1 [0045.463] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.463] SetEndOfFile (hFile=0x1f0) returned 1 [0045.464] CloseHandle (hObject=0x1f0) returned 1 [0045.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0045.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.464] lstrlenW (lpString=".doc") returned 4 [0045.464] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.464] lstrlenW (lpString=".docx") returned 5 [0045.464] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.464] lstrlenW (lpString=".pdf") returned 4 [0045.464] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.464] lstrlenW (lpString=".xls") returned 4 [0045.465] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.465] lstrlenW (lpString=".xlsx") returned 5 [0045.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.465] lstrlenW (lpString=".ppt") returned 4 [0045.465] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString=".zip") returned 4 [0045.465] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.465] lstrlenW (lpString=".rar") returned 4 [0045.465] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.465] lstrlenW (lpString=".bz2") returned 4 [0045.465] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.465] lstrlenW (lpString=".7z") returned 3 [0045.465] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString=".dbf") returned 4 [0045.465] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString=".1cd") returned 4 [0045.465] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString=".jpg") returned 4 [0045.465] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.465] lstrlenW (lpString=".doc") returned 4 [0045.465] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.465] lstrlenW (lpString=".docx") returned 5 [0045.465] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.466] lstrlenW (lpString=".pdf") returned 4 [0045.466] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.466] lstrlenW (lpString=".xls") returned 4 [0045.466] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.466] lstrlenW (lpString=".xlsx") returned 5 [0045.466] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.466] lstrlenW (lpString=".ppt") returned 4 [0045.466] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.466] lstrlenW (lpString=".zip") returned 4 [0045.466] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.466] lstrlenW (lpString=".rar") returned 4 [0045.466] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.466] lstrlenW (lpString=".bz2") returned 4 [0045.466] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.466] lstrlenW (lpString=".7z") returned 3 [0045.466] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.466] lstrlenW (lpString=".dbf") returned 4 [0045.466] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.466] lstrlenW (lpString=".1cd") returned 4 [0045.466] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.466] lstrlenW (lpString=".jpg") returned 4 [0045.466] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.466] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.466] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.467] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1293) returned 1 [0045.467] CloseHandle (hObject=0x1f0) returned 1 [0045.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0045.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.467] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.467] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.698] GetLastError () returned 0x0 [0045.698] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x50d, lpOverlapped=0x0) returned 1 [0045.699] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x510, lpOverlapped=0x0) returned 1 [0045.700] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.700] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.700] SetEndOfFile (hFile=0x200) returned 1 [0045.700] CloseHandle (hObject=0x200) returned 1 [0045.701] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.701] SetEndOfFile (hFile=0x1f0) returned 1 [0045.701] CloseHandle (hObject=0x1f0) returned 1 [0045.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0045.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.702] lstrlenW (lpString=".doc") returned 4 [0045.702] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.702] lstrlenW (lpString=".docx") returned 5 [0045.702] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.702] lstrlenW (lpString=".pdf") returned 4 [0045.702] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.702] lstrlenW (lpString=".xls") returned 4 [0045.702] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.702] lstrlenW (lpString=".xlsx") returned 5 [0045.702] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.702] lstrlenW (lpString=".ppt") returned 4 [0045.702] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.702] lstrlenW (lpString=".zip") returned 4 [0045.702] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.702] lstrlenW (lpString=".rar") returned 4 [0045.703] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString=".bz2") returned 4 [0045.703] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.703] lstrlenW (lpString=".7z") returned 3 [0045.703] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.703] lstrlenW (lpString=".dbf") returned 4 [0045.703] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.703] lstrlenW (lpString=".1cd") returned 4 [0045.703] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.703] lstrlenW (lpString=".jpg") returned 4 [0045.703] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.703] lstrlenW (lpString=".doc") returned 4 [0045.703] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.703] lstrlenW (lpString=".docx") returned 5 [0045.703] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.703] lstrlenW (lpString=".pdf") returned 4 [0045.703] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString=".xls") returned 4 [0045.703] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString=".xlsx") returned 5 [0045.704] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.704] lstrlenW (lpString=".ppt") returned 4 [0045.704] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.704] lstrlenW (lpString=".zip") returned 4 [0045.704] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".rar") returned 4 [0045.704] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".bz2") returned 4 [0045.704] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString=".7z") returned 3 [0045.704] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.704] lstrlenW (lpString=".dbf") returned 4 [0045.704] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.704] lstrlenW (lpString=".1cd") returned 4 [0045.704] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0045.704] lstrlenW (lpString=".jpg") returned 4 [0045.704] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.704] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.704] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.705] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3957) returned 1 [0045.705] CloseHandle (hObject=0x1f0) returned 1 [0045.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0045.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.705] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.705] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.707] GetLastError () returned 0x0 [0045.707] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf75, lpOverlapped=0x0) returned 1 [0045.708] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0045.711] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.711] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.711] SetEndOfFile (hFile=0x200) returned 1 [0045.711] CloseHandle (hObject=0x200) returned 1 [0045.711] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.711] SetEndOfFile (hFile=0x1f0) returned 1 [0045.712] CloseHandle (hObject=0x1f0) returned 1 [0045.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0045.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.713] lstrlenW (lpString=".doc") returned 4 [0045.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.713] lstrlenW (lpString=".docx") returned 5 [0045.713] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.713] lstrlenW (lpString=".pdf") returned 4 [0045.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.713] lstrlenW (lpString=".xls") returned 4 [0045.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.713] lstrlenW (lpString=".xlsx") returned 5 [0045.713] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.713] lstrlenW (lpString=".ppt") returned 4 [0045.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.713] lstrlenW (lpString=".zip") returned 4 [0045.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.713] lstrlenW (lpString=".rar") returned 4 [0045.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.713] lstrlenW (lpString=".bz2") returned 4 [0045.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.713] lstrlenW (lpString=".7z") returned 3 [0045.713] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.713] lstrlenW (lpString=".dbf") returned 4 [0045.713] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.713] lstrlenW (lpString=".1cd") returned 4 [0045.713] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.713] lstrlenW (lpString=".jpg") returned 4 [0045.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString=".doc") returned 4 [0045.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.714] lstrlenW (lpString=".docx") returned 5 [0045.714] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.714] lstrlenW (lpString=".pdf") returned 4 [0045.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString=".xls") returned 4 [0045.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString=".xlsx") returned 5 [0045.714] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.714] lstrlenW (lpString=".ppt") returned 4 [0045.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString=".zip") returned 4 [0045.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString=".rar") returned 4 [0045.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.714] lstrlenW (lpString=".bz2") returned 4 [0045.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.714] lstrlenW (lpString=".7z") returned 3 [0045.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString=".dbf") returned 4 [0045.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString=".1cd") returned 4 [0045.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0045.714] lstrlenW (lpString=".jpg") returned 4 [0045.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.715] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.715] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.715] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33277) returned 1 [0045.716] CloseHandle (hObject=0x1f0) returned 1 [0045.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0045.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.716] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.716] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.716] GetLastError () returned 0x0 [0045.716] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0045.718] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0045.720] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.720] WriteFile (in: hFile=0x200, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.720] SetEndOfFile (hFile=0x200) returned 1 [0045.720] CloseHandle (hObject=0x200) returned 1 [0045.720] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.720] SetEndOfFile (hFile=0x1f0) returned 1 [0045.721] CloseHandle (hObject=0x1f0) returned 1 [0045.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.722] lstrlenW (lpString=".doc") returned 4 [0045.722] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.722] lstrlenW (lpString=".docx") returned 5 [0045.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.722] lstrlenW (lpString=".pdf") returned 4 [0045.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.722] lstrlenW (lpString=".xls") returned 4 [0045.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.722] lstrlenW (lpString=".xlsx") returned 5 [0045.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.722] lstrlenW (lpString=".ppt") returned 4 [0045.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.722] lstrlenW (lpString=".zip") returned 4 [0045.722] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.722] lstrlenW (lpString=".rar") returned 4 [0045.722] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.722] lstrlenW (lpString=".bz2") returned 4 [0045.722] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.722] lstrlenW (lpString=".7z") returned 3 [0045.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.722] lstrlenW (lpString=".dbf") returned 4 [0045.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.723] lstrlenW (lpString=".1cd") returned 4 [0045.723] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.723] lstrlenW (lpString=".jpg") returned 4 [0045.723] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.723] lstrlenW (lpString=".doc") returned 4 [0045.723] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString=".docx") returned 5 [0045.723] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.723] lstrlenW (lpString=".pdf") returned 4 [0045.723] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString=".xls") returned 4 [0045.723] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.723] lstrlenW (lpString=".xlsx") returned 5 [0045.723] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.723] lstrlenW (lpString=".ppt") returned 4 [0045.723] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.723] lstrlenW (lpString=".zip") returned 4 [0045.723] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.723] lstrlenW (lpString=".rar") returned 4 [0045.723] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.723] lstrlenW (lpString=".bz2") returned 4 [0045.723] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.723] lstrlenW (lpString=".7z") returned 3 [0045.723] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.724] lstrlenW (lpString=".dbf") returned 4 [0045.724] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.724] lstrlenW (lpString=".1cd") returned 4 [0045.724] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.724] lstrlenW (lpString=".jpg") returned 4 [0045.724] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.724] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.724] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.724] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1453) returned 1 [0045.724] CloseHandle (hObject=0x1f0) returned 1 [0045.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0045.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.725] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.725] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0046.645] GetLastError () returned 0x0 [0046.645] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0046.648] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0046.649] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.649] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.649] SetEndOfFile (hFile=0x1fc) returned 1 [0046.649] CloseHandle (hObject=0x1fc) returned 1 [0046.649] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.650] SetEndOfFile (hFile=0x1f0) returned 1 [0046.650] CloseHandle (hObject=0x1f0) returned 1 [0046.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0046.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.651] lstrlenW (lpString=".doc") returned 4 [0046.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.651] lstrlenW (lpString=".docx") returned 5 [0046.651] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.651] lstrlenW (lpString=".pdf") returned 4 [0046.651] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.651] lstrlenW (lpString=".xls") returned 4 [0046.651] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.651] lstrlenW (lpString=".xlsx") returned 5 [0046.651] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.651] lstrlenW (lpString=".ppt") returned 4 [0046.651] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.651] lstrlenW (lpString=".zip") returned 4 [0046.651] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.651] lstrlenW (lpString=".rar") returned 4 [0046.651] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.651] lstrlenW (lpString=".bz2") returned 4 [0046.651] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.651] lstrlenW (lpString=".7z") returned 3 [0046.651] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString=".dbf") returned 4 [0046.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString=".1cd") returned 4 [0046.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString=".jpg") returned 4 [0046.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString=".doc") returned 4 [0046.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.652] lstrlenW (lpString=".docx") returned 5 [0046.652] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.652] lstrlenW (lpString=".pdf") returned 4 [0046.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString=".xls") returned 4 [0046.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString=".xlsx") returned 5 [0046.652] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.652] lstrlenW (lpString=".ppt") returned 4 [0046.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.652] lstrlenW (lpString=".zip") returned 4 [0046.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString=".rar") returned 4 [0046.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.652] lstrlenW (lpString=".bz2") returned 4 [0046.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.652] lstrlenW (lpString=".7z") returned 3 [0046.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.653] lstrlenW (lpString=".dbf") returned 4 [0046.653] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.653] lstrlenW (lpString=".1cd") returned 4 [0046.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0046.653] lstrlenW (lpString=".jpg") returned 4 [0046.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.653] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.653] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.654] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2552) returned 1 [0046.654] CloseHandle (hObject=0x1f0) returned 1 [0046.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0046.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.654] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.654] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0046.687] GetLastError () returned 0x0 [0046.687] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0046.691] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0046.693] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.693] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.693] SetEndOfFile (hFile=0x1fc) returned 1 [0046.693] CloseHandle (hObject=0x1fc) returned 1 [0046.693] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.693] SetEndOfFile (hFile=0x1f0) returned 1 [0046.694] CloseHandle (hObject=0x1f0) returned 1 [0046.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.694] lstrlenW (lpString=".doc") returned 4 [0046.694] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.695] lstrlenW (lpString=".docx") returned 5 [0046.695] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.695] lstrlenW (lpString=".pdf") returned 4 [0046.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString=".xls") returned 4 [0046.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString=".xlsx") returned 5 [0046.695] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.695] lstrlenW (lpString=".ppt") returned 4 [0046.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.695] lstrlenW (lpString=".zip") returned 4 [0046.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString=".rar") returned 4 [0046.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString=".bz2") returned 4 [0046.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.695] lstrlenW (lpString=".7z") returned 3 [0046.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.695] lstrlenW (lpString=".dbf") returned 4 [0046.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.695] lstrlenW (lpString=".1cd") returned 4 [0046.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.695] lstrlenW (lpString=".jpg") returned 4 [0046.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.696] lstrlenW (lpString=".doc") returned 4 [0046.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.696] lstrlenW (lpString=".docx") returned 5 [0046.696] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.696] lstrlenW (lpString=".pdf") returned 4 [0046.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.696] lstrlenW (lpString=".xls") returned 4 [0046.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.696] lstrlenW (lpString=".xlsx") returned 5 [0046.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.696] lstrlenW (lpString=".ppt") returned 4 [0046.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.696] lstrlenW (lpString=".zip") returned 4 [0046.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.696] lstrlenW (lpString=".rar") returned 4 [0046.696] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.696] lstrlenW (lpString=".bz2") returned 4 [0046.696] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.696] lstrlenW (lpString=".7z") returned 3 [0046.696] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.696] lstrlenW (lpString=".dbf") returned 4 [0046.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.696] lstrlenW (lpString=".1cd") returned 4 [0046.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0046.696] lstrlenW (lpString=".jpg") returned 4 [0046.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.697] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0046.697] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.701] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18817) returned 1 [0046.701] CloseHandle (hObject=0x1f0) returned 1 [0046.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0046.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.701] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.701] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0046.701] GetLastError () returned 0x0 [0046.702] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4981, lpOverlapped=0x0) returned 1 [0046.712] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0046.713] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.713] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.714] SetEndOfFile (hFile=0x1fc) returned 1 [0046.714] CloseHandle (hObject=0x1fc) returned 1 [0046.714] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.714] SetEndOfFile (hFile=0x1f0) returned 1 [0046.715] CloseHandle (hObject=0x1f0) returned 1 [0046.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0046.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.715] lstrlenW (lpString=".doc") returned 4 [0046.715] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.715] lstrlenW (lpString=".docx") returned 5 [0046.715] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.715] lstrlenW (lpString=".pdf") returned 4 [0046.715] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString=".xls") returned 4 [0046.716] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.716] lstrlenW (lpString=".xlsx") returned 5 [0046.716] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.716] lstrlenW (lpString=".ppt") returned 4 [0046.716] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString=".zip") returned 4 [0046.716] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.716] lstrlenW (lpString=".rar") returned 4 [0046.716] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.716] lstrlenW (lpString=".bz2") returned 4 [0046.716] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString=".7z") returned 3 [0046.716] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString=".dbf") returned 4 [0046.716] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString=".1cd") returned 4 [0046.716] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString=".jpg") returned 4 [0046.716] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.716] lstrlenW (lpString=".doc") returned 4 [0046.716] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.716] lstrlenW (lpString=".docx") returned 5 [0046.716] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.716] lstrlenW (lpString=".pdf") returned 4 [0046.717] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.717] lstrlenW (lpString=".xls") returned 4 [0046.717] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.717] lstrlenW (lpString=".xlsx") returned 5 [0046.717] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.717] lstrlenW (lpString=".ppt") returned 4 [0046.717] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.717] lstrlenW (lpString=".zip") returned 4 [0046.717] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.717] lstrlenW (lpString=".rar") returned 4 [0046.717] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.717] lstrlenW (lpString=".bz2") returned 4 [0046.717] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.717] lstrlenW (lpString=".7z") returned 3 [0046.717] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.717] lstrlenW (lpString=".dbf") returned 4 [0046.717] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.717] lstrlenW (lpString=".1cd") returned 4 [0046.717] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0046.718] lstrlenW (lpString=".jpg") returned 4 [0046.718] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.046] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33559) returned 1 [0047.046] CloseHandle (hObject=0x1bc) returned 1 [0047.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0047.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0047.046] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.046] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.047] GetLastError () returned 0x0 [0047.047] ReadFile (in: hFile=0x1bc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8317, lpOverlapped=0x0) returned 1 [0047.051] WriteFile (in: hFile=0x204, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0047.052] ReadFile (in: hFile=0x1bc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.052] WriteFile (in: hFile=0x204, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.053] SetEndOfFile (hFile=0x204) returned 1 [0047.053] CloseHandle (hObject=0x204) returned 1 [0047.053] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.053] SetEndOfFile (hFile=0x1bc) returned 1 [0047.054] CloseHandle (hObject=0x1bc) returned 1 [0047.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0047.054] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0047.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.055] lstrlenW (lpString=".doc") returned 4 [0047.055] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.055] lstrlenW (lpString=".docx") returned 5 [0047.055] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.055] lstrlenW (lpString=".pdf") returned 4 [0047.055] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.055] lstrlenW (lpString=".xls") returned 4 [0047.055] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.055] lstrlenW (lpString=".xlsx") returned 5 [0047.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.055] lstrlenW (lpString=".ppt") returned 4 [0047.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.055] lstrlenW (lpString=".zip") returned 4 [0047.055] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.055] lstrlenW (lpString=".rar") returned 4 [0047.055] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.055] lstrlenW (lpString=".bz2") returned 4 [0047.055] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.055] lstrlenW (lpString=".7z") returned 3 [0047.055] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.055] lstrlenW (lpString=".dbf") returned 4 [0047.055] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.055] lstrlenW (lpString=".1cd") returned 4 [0047.055] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.056] lstrlenW (lpString=".jpg") returned 4 [0047.056] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.780] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=44850) returned 1 [0047.780] CloseHandle (hObject=0x210) returned 1 [0047.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0047.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.780] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.781] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.781] GetLastError () returned 0x0 [0047.781] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0048.116] WriteFile (in: hFile=0x1f8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0048.117] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.117] WriteFile (in: hFile=0x1f8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.118] SetEndOfFile (hFile=0x1f8) returned 1 [0048.118] CloseHandle (hObject=0x1f8) returned 1 [0048.118] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.118] SetEndOfFile (hFile=0x210) returned 1 [0048.119] CloseHandle (hObject=0x210) returned 1 [0048.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0048.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString=".doc") returned 4 [0048.120] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.120] lstrlenW (lpString=".docx") returned 5 [0048.120] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.120] lstrlenW (lpString=".pdf") returned 4 [0048.120] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.120] lstrlenW (lpString=".xls") returned 4 [0048.120] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.120] lstrlenW (lpString=".xlsx") returned 5 [0048.120] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.120] lstrlenW (lpString=".ppt") returned 4 [0048.120] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString=".zip") returned 4 [0048.120] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.120] lstrlenW (lpString=".rar") returned 4 [0048.120] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.120] lstrlenW (lpString=".bz2") returned 4 [0048.120] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.120] lstrlenW (lpString=".7z") returned 3 [0048.120] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString=".dbf") returned 4 [0048.120] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString=".1cd") returned 4 [0048.120] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.120] lstrlenW (lpString=".jpg") returned 4 [0048.121] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.121] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1339) returned 1 [0048.121] CloseHandle (hObject=0x210) returned 1 [0048.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0048.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.121] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.121] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.934] GetLastError () returned 0x0 [0048.934] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x53b, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x540, lpOverlapped=0x0) returned 1 [0048.937] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.937] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.938] SetEndOfFile (hFile=0x1fc) returned 1 [0048.938] CloseHandle (hObject=0x1fc) returned 1 [0048.938] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.938] SetEndOfFile (hFile=0x210) returned 1 [0048.939] CloseHandle (hObject=0x210) returned 1 [0048.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0048.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.940] lstrlenW (lpString=".doc") returned 4 [0048.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.940] lstrlenW (lpString=".docx") returned 5 [0048.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.940] lstrlenW (lpString=".pdf") returned 4 [0048.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.940] lstrlenW (lpString=".xls") returned 4 [0048.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.940] lstrlenW (lpString=".xlsx") returned 5 [0048.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.940] lstrlenW (lpString=".ppt") returned 4 [0048.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.940] lstrlenW (lpString=".zip") returned 4 [0048.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.940] lstrlenW (lpString=".rar") returned 4 [0048.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.940] lstrlenW (lpString=".bz2") returned 4 [0048.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.940] lstrlenW (lpString=".7z") returned 3 [0048.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.940] lstrlenW (lpString=".dbf") returned 4 [0048.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.941] lstrlenW (lpString=".1cd") returned 4 [0048.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.941] lstrlenW (lpString=".jpg") returned 4 [0048.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.941] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4100) returned 1 [0048.941] CloseHandle (hObject=0x210) returned 1 [0048.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0048.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.941] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.942] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.943] GetLastError () returned 0x0 [0048.943] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1004, lpOverlapped=0x0) returned 1 [0048.945] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0048.950] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.950] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.950] SetEndOfFile (hFile=0x1ec) returned 1 [0048.950] CloseHandle (hObject=0x1ec) returned 1 [0048.950] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.950] SetEndOfFile (hFile=0x210) returned 1 [0048.951] CloseHandle (hObject=0x210) returned 1 [0048.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString=".doc") returned 4 [0048.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.952] lstrlenW (lpString=".docx") returned 5 [0048.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.952] lstrlenW (lpString=".pdf") returned 4 [0048.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.952] lstrlenW (lpString=".xls") returned 4 [0048.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.952] lstrlenW (lpString=".xlsx") returned 5 [0048.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.952] lstrlenW (lpString=".ppt") returned 4 [0048.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString=".zip") returned 4 [0048.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.952] lstrlenW (lpString=".rar") returned 4 [0048.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.952] lstrlenW (lpString=".bz2") returned 4 [0048.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.952] lstrlenW (lpString=".7z") returned 3 [0048.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString=".dbf") returned 4 [0048.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString=".1cd") returned 4 [0048.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0048.952] lstrlenW (lpString=".jpg") returned 4 [0048.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.966] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=47962) returned 1 [0048.966] CloseHandle (hObject=0x210) returned 1 [0048.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0048.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.966] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.966] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.967] GetLastError () returned 0x0 [0048.967] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0049.079] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0049.081] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.081] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.081] SetEndOfFile (hFile=0x1ec) returned 1 [0049.081] CloseHandle (hObject=0x1ec) returned 1 [0049.081] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.081] SetEndOfFile (hFile=0x210) returned 1 [0049.082] CloseHandle (hObject=0x210) returned 1 [0049.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0049.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.083] lstrlenW (lpString=".doc") returned 4 [0049.083] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.083] lstrlenW (lpString=".docx") returned 5 [0049.083] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.083] lstrlenW (lpString=".pdf") returned 4 [0049.083] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.083] lstrlenW (lpString=".xls") returned 4 [0049.083] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.083] lstrlenW (lpString=".xlsx") returned 5 [0049.083] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.083] lstrlenW (lpString=".ppt") returned 4 [0049.083] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.083] lstrlenW (lpString=".zip") returned 4 [0049.083] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.083] lstrlenW (lpString=".rar") returned 4 [0049.083] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.084] lstrlenW (lpString=".bz2") returned 4 [0049.084] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.084] lstrlenW (lpString=".7z") returned 3 [0049.084] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.084] lstrlenW (lpString=".dbf") returned 4 [0049.084] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.084] lstrlenW (lpString=".1cd") returned 4 [0049.084] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.084] lstrlenW (lpString=".jpg") returned 4 [0049.084] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.300] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=29305) returned 1 [0049.300] CloseHandle (hObject=0x214) returned 1 [0049.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0049.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.315] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.317] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.326] GetLastError () returned 0x0 [0049.326] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7279, lpOverlapped=0x0) returned 1 [0049.328] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0049.329] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.329] SetEndOfFile (hFile=0x1f4) returned 1 [0049.330] CloseHandle (hObject=0x1f4) returned 1 [0049.330] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.330] SetEndOfFile (hFile=0x214) returned 1 [0049.331] CloseHandle (hObject=0x214) returned 1 [0049.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.331] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0049.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.331] lstrlenW (lpString=".doc") returned 4 [0049.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.331] lstrlenW (lpString=".docx") returned 5 [0049.331] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.331] lstrlenW (lpString=".pdf") returned 4 [0049.331] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.332] lstrlenW (lpString=".xls") returned 4 [0049.332] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.332] lstrlenW (lpString=".xlsx") returned 5 [0049.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.332] lstrlenW (lpString=".ppt") returned 4 [0049.332] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.332] lstrlenW (lpString=".zip") returned 4 [0049.332] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.332] lstrlenW (lpString=".rar") returned 4 [0049.332] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.332] lstrlenW (lpString=".bz2") returned 4 [0049.332] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.332] lstrlenW (lpString=".7z") returned 3 [0049.332] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.332] lstrlenW (lpString=".dbf") returned 4 [0049.332] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.332] lstrlenW (lpString=".1cd") returned 4 [0049.332] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.332] lstrlenW (lpString=".jpg") returned 4 [0049.332] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.332] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2668) returned 1 [0049.333] CloseHandle (hObject=0x214) returned 1 [0049.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0049.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.333] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.333] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.335] GetLastError () returned 0x0 [0049.335] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0049.336] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0049.337] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.337] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.337] SetEndOfFile (hFile=0x1f4) returned 1 [0049.337] CloseHandle (hObject=0x1f4) returned 1 [0049.337] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.337] SetEndOfFile (hFile=0x214) returned 1 [0049.338] CloseHandle (hObject=0x214) returned 1 [0049.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.338] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString=".doc") returned 4 [0049.339] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.339] lstrlenW (lpString=".docx") returned 5 [0049.339] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.339] lstrlenW (lpString=".pdf") returned 4 [0049.339] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.339] lstrlenW (lpString=".xls") returned 4 [0049.339] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.339] lstrlenW (lpString=".xlsx") returned 5 [0049.339] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.339] lstrlenW (lpString=".ppt") returned 4 [0049.339] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString=".zip") returned 4 [0049.339] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.339] lstrlenW (lpString=".rar") returned 4 [0049.339] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.339] lstrlenW (lpString=".bz2") returned 4 [0049.339] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.339] lstrlenW (lpString=".7z") returned 3 [0049.339] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString=".dbf") returned 4 [0049.339] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString=".1cd") returned 4 [0049.339] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.339] lstrlenW (lpString=".jpg") returned 4 [0049.339] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.340] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=42453) returned 1 [0049.340] CloseHandle (hObject=0x214) returned 1 [0049.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0049.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.340] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.340] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.341] GetLastError () returned 0x0 [0049.341] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0049.343] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0049.345] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.345] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.345] SetEndOfFile (hFile=0x1f4) returned 1 [0049.345] CloseHandle (hObject=0x1f4) returned 1 [0049.345] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.345] SetEndOfFile (hFile=0x214) returned 1 [0049.346] CloseHandle (hObject=0x214) returned 1 [0049.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0049.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.347] lstrlenW (lpString=".doc") returned 4 [0049.347] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.347] lstrlenW (lpString=".docx") returned 5 [0049.347] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.347] lstrlenW (lpString=".pdf") returned 4 [0049.347] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.347] lstrlenW (lpString=".xls") returned 4 [0049.347] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.347] lstrlenW (lpString=".xlsx") returned 5 [0049.347] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.347] lstrlenW (lpString=".ppt") returned 4 [0049.347] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.347] lstrlenW (lpString=".zip") returned 4 [0049.347] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.347] lstrlenW (lpString=".rar") returned 4 [0049.347] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.347] lstrlenW (lpString=".bz2") returned 4 [0049.347] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.347] lstrlenW (lpString=".7z") returned 3 [0049.347] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.347] lstrlenW (lpString=".dbf") returned 4 [0049.347] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.347] lstrlenW (lpString=".1cd") returned 4 [0049.347] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.347] lstrlenW (lpString=".jpg") returned 4 [0049.347] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.348] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1571) returned 1 [0049.348] CloseHandle (hObject=0x214) returned 1 [0049.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0049.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.349] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.349] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.350] GetLastError () returned 0x0 [0049.351] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x623, lpOverlapped=0x0) returned 1 [0049.352] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x630, lpOverlapped=0x0) returned 1 [0049.353] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.353] WriteFile (in: hFile=0x1f4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.353] SetEndOfFile (hFile=0x1f4) returned 1 [0049.353] CloseHandle (hObject=0x1f4) returned 1 [0049.581] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.581] SetEndOfFile (hFile=0x214) returned 1 [0049.668] CloseHandle (hObject=0x214) returned 1 [0049.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0049.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.671] lstrlenW (lpString=".doc") returned 4 [0049.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.671] lstrlenW (lpString=".docx") returned 5 [0049.671] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.671] lstrlenW (lpString=".pdf") returned 4 [0049.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.671] lstrlenW (lpString=".xls") returned 4 [0049.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.671] lstrlenW (lpString=".xlsx") returned 5 [0049.672] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.672] lstrlenW (lpString=".ppt") returned 4 [0049.672] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.676] lstrlenW (lpString=".zip") returned 4 [0049.676] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.676] lstrlenW (lpString=".rar") returned 4 [0049.676] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.684] lstrlenW (lpString=".bz2") returned 4 [0049.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.685] lstrlenW (lpString=".7z") returned 3 [0049.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.685] lstrlenW (lpString=".dbf") returned 4 [0049.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.685] lstrlenW (lpString=".1cd") returned 4 [0049.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.685] lstrlenW (lpString=".jpg") returned 4 [0049.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.694] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=30170) returned 1 [0049.694] CloseHandle (hObject=0x214) returned 1 [0049.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0049.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.713] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.714] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.722] GetLastError () returned 0x0 [0049.723] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x75da, lpOverlapped=0x0) returned 1 [0049.740] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0049.741] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.741] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.741] SetEndOfFile (hFile=0x1c0) returned 1 [0049.741] CloseHandle (hObject=0x1c0) returned 1 [0049.742] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.742] SetEndOfFile (hFile=0x214) returned 1 [0049.743] CloseHandle (hObject=0x214) returned 1 [0049.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0049.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.743] lstrlenW (lpString=".doc") returned 4 [0049.743] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.743] lstrlenW (lpString=".docx") returned 5 [0049.743] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.743] lstrlenW (lpString=".pdf") returned 4 [0049.743] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.743] lstrlenW (lpString=".xls") returned 4 [0049.743] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.743] lstrlenW (lpString=".xlsx") returned 5 [0049.743] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.743] lstrlenW (lpString=".ppt") returned 4 [0049.743] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.744] lstrlenW (lpString=".zip") returned 4 [0049.744] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.744] lstrlenW (lpString=".rar") returned 4 [0049.744] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.744] lstrlenW (lpString=".bz2") returned 4 [0049.744] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.744] lstrlenW (lpString=".7z") returned 3 [0049.744] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.744] lstrlenW (lpString=".dbf") returned 4 [0049.744] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.744] lstrlenW (lpString=".1cd") returned 4 [0049.744] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.744] lstrlenW (lpString=".jpg") returned 4 [0049.744] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.745] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=334427) returned 1 [0049.745] CloseHandle (hObject=0x214) returned 1 [0049.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0049.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.745] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.746] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.746] GetLastError () returned 0x0 [0049.746] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0049.755] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0049.761] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.762] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0049.762] SetEndOfFile (hFile=0x1c0) returned 1 [0049.762] CloseHandle (hObject=0x1c0) returned 1 [0049.762] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.762] SetEndOfFile (hFile=0x214) returned 1 [0049.765] CloseHandle (hObject=0x214) returned 1 [0049.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0049.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.766] lstrlenW (lpString=".doc") returned 4 [0049.766] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0049.766] lstrlenW (lpString=".docx") returned 5 [0049.766] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0049.766] lstrlenW (lpString=".pdf") returned 4 [0049.766] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0049.766] lstrlenW (lpString=".xls") returned 4 [0049.766] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0049.766] lstrlenW (lpString=".xlsx") returned 5 [0049.766] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0049.766] lstrlenW (lpString=".ppt") returned 4 [0049.766] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0049.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.766] lstrlenW (lpString=".zip") returned 4 [0049.766] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0049.766] lstrlenW (lpString=".rar") returned 4 [0049.766] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0049.767] lstrlenW (lpString=".bz2") returned 4 [0049.767] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0049.767] lstrlenW (lpString=".7z") returned 3 [0049.767] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0049.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.767] lstrlenW (lpString=".dbf") returned 4 [0049.767] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0049.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.767] lstrlenW (lpString=".1cd") returned 4 [0049.767] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0049.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.767] lstrlenW (lpString=".jpg") returned 4 [0049.767] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0049.767] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=109718) returned 1 [0049.767] CloseHandle (hObject=0x214) returned 1 [0049.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0049.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.768] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.768] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.768] GetLastError () returned 0x0 [0049.768] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0049.917] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0049.920] ReadFile (in: hFile=0x214, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.920] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.920] SetEndOfFile (hFile=0x1c0) returned 1 [0049.920] CloseHandle (hObject=0x1c0) returned 1 [0049.920] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.920] SetEndOfFile (hFile=0x214) returned 1 [0049.921] CloseHandle (hObject=0x214) returned 1 [0049.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.245] lstrlenW (lpString=".doc") returned 4 [0050.245] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.245] lstrlenW (lpString=".docx") returned 5 [0050.246] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.246] lstrlenW (lpString=".pdf") returned 4 [0050.246] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString=".xls") returned 4 [0050.246] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString=".xlsx") returned 5 [0050.246] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.246] lstrlenW (lpString=".ppt") returned 4 [0050.246] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.246] lstrlenW (lpString=".zip") returned 4 [0050.246] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString=".rar") returned 4 [0050.246] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString=".bz2") returned 4 [0050.246] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.246] lstrlenW (lpString=".7z") returned 3 [0050.246] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.246] lstrlenW (lpString=".dbf") returned 4 [0050.246] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.247] lstrlenW (lpString=".1cd") returned 4 [0050.247] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.251] lstrlenW (lpString=".jpg") returned 4 [0050.251] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.608] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=716) returned 1 [0050.608] CloseHandle (hObject=0x1f4) returned 1 [0050.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0050.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.608] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.608] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.609] GetLastError () returned 0x0 [0050.609] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0050.610] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0050.611] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.611] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0050.611] SetEndOfFile (hFile=0x1f0) returned 1 [0050.611] CloseHandle (hObject=0x1f0) returned 1 [0050.612] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.612] SetEndOfFile (hFile=0x1f4) returned 1 [0050.612] CloseHandle (hObject=0x1f4) returned 1 [0050.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0050.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.613] lstrlenW (lpString=".doc") returned 4 [0050.613] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0050.613] lstrlenW (lpString=".docx") returned 5 [0050.613] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0050.613] lstrlenW (lpString=".pdf") returned 4 [0050.613] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0050.613] lstrlenW (lpString=".xls") returned 4 [0050.613] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0050.613] lstrlenW (lpString=".xlsx") returned 5 [0050.613] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0050.613] lstrlenW (lpString=".ppt") returned 4 [0050.613] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0050.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.613] lstrlenW (lpString=".zip") returned 4 [0050.613] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0050.614] lstrlenW (lpString=".rar") returned 4 [0050.614] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0050.614] lstrlenW (lpString=".bz2") returned 4 [0050.614] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0050.614] lstrlenW (lpString=".7z") returned 3 [0050.614] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0050.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.614] lstrlenW (lpString=".dbf") returned 4 [0050.614] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0050.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.614] lstrlenW (lpString=".1cd") returned 4 [0050.614] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0050.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.614] lstrlenW (lpString=".jpg") returned 4 [0050.614] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0050.615] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=630) returned 1 [0050.615] CloseHandle (hObject=0x1f4) returned 1 [0050.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0050.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.615] lstrlenW (lpString=".doc") returned 4 [0050.615] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.615] lstrlenW (lpString=".docx") returned 5 [0050.615] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.615] lstrlenW (lpString=".pdf") returned 4 [0050.615] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.615] lstrlenW (lpString=".xls") returned 4 [0050.615] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.616] lstrlenW (lpString=".xlsx") returned 5 [0050.616] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.616] lstrlenW (lpString=".ppt") returned 4 [0050.616] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.616] lstrlenW (lpString=".zip") returned 4 [0050.616] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.616] lstrlenW (lpString=".rar") returned 4 [0050.616] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.616] lstrlenW (lpString=".bz2") returned 4 [0050.616] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.616] lstrlenW (lpString=".7z") returned 3 [0050.616] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.616] lstrlenW (lpString=".dbf") returned 4 [0050.616] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.616] lstrlenW (lpString=".1cd") returned 4 [0050.616] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.616] lstrlenW (lpString=".jpg") returned 4 [0050.616] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.616] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=623) returned 1 [0050.616] CloseHandle (hObject=0x1f4) returned 1 [0050.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0050.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.617] lstrlenW (lpString=".doc") returned 4 [0050.617] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.617] lstrlenW (lpString=".docx") returned 5 [0050.617] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.617] lstrlenW (lpString=".pdf") returned 4 [0050.617] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.617] lstrlenW (lpString=".xls") returned 4 [0050.617] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.617] lstrlenW (lpString=".xlsx") returned 5 [0050.617] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.617] lstrlenW (lpString=".ppt") returned 4 [0050.617] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.617] lstrlenW (lpString=".zip") returned 4 [0050.617] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.617] lstrlenW (lpString=".rar") returned 4 [0050.617] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.617] lstrlenW (lpString=".bz2") returned 4 [0050.617] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.618] lstrlenW (lpString=".7z") returned 3 [0050.618] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.618] lstrlenW (lpString=".dbf") returned 4 [0050.618] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.618] lstrlenW (lpString=".1cd") returned 4 [0050.618] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.618] lstrlenW (lpString=".jpg") returned 4 [0050.618] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.619] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9804) returned 1 [0050.619] CloseHandle (hObject=0x1f4) returned 1 [0050.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0050.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.620] lstrlenW (lpString=".doc") returned 4 [0050.620] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.620] lstrlenW (lpString=".docx") returned 5 [0050.620] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.620] lstrlenW (lpString=".pdf") returned 4 [0050.620] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.620] lstrlenW (lpString=".xls") returned 4 [0050.620] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.620] lstrlenW (lpString=".xlsx") returned 5 [0050.620] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.620] lstrlenW (lpString=".ppt") returned 4 [0050.620] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.620] lstrlenW (lpString=".zip") returned 4 [0050.620] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.620] lstrlenW (lpString=".rar") returned 4 [0050.620] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.620] lstrlenW (lpString=".bz2") returned 4 [0050.620] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.620] lstrlenW (lpString=".7z") returned 3 [0050.620] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.620] lstrlenW (lpString=".dbf") returned 4 [0050.620] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.620] lstrlenW (lpString=".1cd") returned 4 [0050.621] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.621] lstrlenW (lpString=".jpg") returned 4 [0050.621] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.621] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9975) returned 1 [0050.621] CloseHandle (hObject=0x1f4) returned 1 [0050.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0050.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.621] lstrlenW (lpString=".doc") returned 4 [0050.621] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.621] lstrlenW (lpString=".docx") returned 5 [0050.621] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.621] lstrlenW (lpString=".pdf") returned 4 [0050.621] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.621] lstrlenW (lpString=".xls") returned 4 [0050.621] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.622] lstrlenW (lpString=".xlsx") returned 5 [0050.622] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.622] lstrlenW (lpString=".ppt") returned 4 [0050.622] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.622] lstrlenW (lpString=".zip") returned 4 [0050.622] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.622] lstrlenW (lpString=".rar") returned 4 [0050.622] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.622] lstrlenW (lpString=".bz2") returned 4 [0050.622] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.622] lstrlenW (lpString=".7z") returned 3 [0050.622] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.622] lstrlenW (lpString=".dbf") returned 4 [0050.622] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.622] lstrlenW (lpString=".1cd") returned 4 [0050.622] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.622] lstrlenW (lpString=".jpg") returned 4 [0050.622] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.622] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=174) returned 1 [0050.622] CloseHandle (hObject=0x1f4) returned 1 [0050.622] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0050.622] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.623] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.623] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.623] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.623] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.623] GetLastError () returned 0x0 [0050.623] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xae, lpOverlapped=0x0) returned 1 [0050.624] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0050.625] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.625] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.625] SetEndOfFile (hFile=0x1f0) returned 1 [0050.625] CloseHandle (hObject=0x1f0) returned 1 [0050.625] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.625] SetEndOfFile (hFile=0x1f4) returned 1 [0050.626] CloseHandle (hObject=0x1f4) returned 1 [0050.626] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x26) returned 1 [0050.626] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0050.626] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.626] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.626] lstrlenW (lpString=".doc") returned 4 [0050.627] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.627] lstrlenW (lpString=".docx") returned 5 [0050.627] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.627] lstrlenW (lpString=".pdf") returned 4 [0050.627] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.627] lstrlenW (lpString=".xls") returned 4 [0050.627] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.627] lstrlenW (lpString=".xlsx") returned 5 [0050.627] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.627] lstrlenW (lpString=".ppt") returned 4 [0050.627] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.627] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.627] lstrlenW (lpString=".zip") returned 4 [0050.627] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.627] lstrlenW (lpString=".rar") returned 4 [0050.627] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.627] lstrlenW (lpString=".bz2") returned 4 [0050.627] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.627] lstrlenW (lpString=".7z") returned 3 [0050.627] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.627] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.627] lstrlenW (lpString=".dbf") returned 4 [0050.627] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.627] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.627] lstrlenW (lpString=".1cd") returned 4 [0050.627] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.627] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.627] lstrlenW (lpString=".jpg") returned 4 [0050.627] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.628] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27935) returned 1 [0050.628] CloseHandle (hObject=0x1f4) returned 1 [0050.628] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0050.628] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.628] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString=".doc") returned 4 [0050.629] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.629] lstrlenW (lpString=".docx") returned 5 [0050.629] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0050.629] lstrlenW (lpString=".pdf") returned 4 [0050.629] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.629] lstrlenW (lpString=".xls") returned 4 [0050.629] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.629] lstrlenW (lpString=".xlsx") returned 5 [0050.629] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0050.629] lstrlenW (lpString=".ppt") returned 4 [0050.629] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.629] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString=".zip") returned 4 [0050.629] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.629] lstrlenW (lpString=".rar") returned 4 [0050.629] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.629] lstrlenW (lpString=".bz2") returned 4 [0050.629] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.629] lstrlenW (lpString=".7z") returned 3 [0050.629] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.629] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString=".dbf") returned 4 [0050.629] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.629] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString=".1cd") returned 4 [0050.629] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.629] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.629] lstrlenW (lpString=".jpg") returned 4 [0050.629] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.630] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=751669) returned 1 [0050.630] CloseHandle (hObject=0x1f4) returned 1 [0050.630] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0050.630] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.630] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.630] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.630] lstrlenW (lpString=".doc") returned 4 [0050.630] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.630] lstrlenW (lpString=".docx") returned 5 [0050.630] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.630] lstrlenW (lpString=".pdf") returned 4 [0050.630] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.630] lstrlenW (lpString=".xls") returned 4 [0050.630] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.630] lstrlenW (lpString=".xlsx") returned 5 [0050.630] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.630] lstrlenW (lpString=".ppt") returned 4 [0050.630] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.630] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.630] lstrlenW (lpString=".zip") returned 4 [0050.630] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.630] lstrlenW (lpString=".rar") returned 4 [0050.630] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.631] lstrlenW (lpString=".bz2") returned 4 [0050.631] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.631] lstrlenW (lpString=".7z") returned 3 [0050.631] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.631] lstrlenW (lpString=".dbf") returned 4 [0050.631] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.631] lstrlenW (lpString=".1cd") returned 4 [0050.631] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.631] lstrlenW (lpString=".jpg") returned 4 [0050.631] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.632] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10123) returned 1 [0050.632] CloseHandle (hObject=0x1f0) returned 1 [0050.632] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0050.632] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.632] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.632] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.632] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.632] lstrlenW (lpString=".doc") returned 4 [0050.632] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.632] lstrlenW (lpString=".docx") returned 5 [0050.632] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0050.632] lstrlenW (lpString=".pdf") returned 4 [0050.632] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.632] lstrlenW (lpString=".xls") returned 4 [0050.632] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.632] lstrlenW (lpString=".xlsx") returned 5 [0050.632] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0050.632] lstrlenW (lpString=".ppt") returned 4 [0050.633] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.633] lstrlenW (lpString=".zip") returned 4 [0050.633] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.633] lstrlenW (lpString=".rar") returned 4 [0050.633] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.633] lstrlenW (lpString=".bz2") returned 4 [0050.633] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.633] lstrlenW (lpString=".7z") returned 3 [0050.633] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.633] lstrlenW (lpString=".dbf") returned 4 [0050.633] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.633] lstrlenW (lpString=".1cd") returned 4 [0050.633] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0050.633] lstrlenW (lpString=".jpg") returned 4 [0050.633] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.633] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3286) returned 1 [0050.633] CloseHandle (hObject=0x1f0) returned 1 [0050.634] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0050.634] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.634] lstrlenW (lpString=".doc") returned 4 [0050.634] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.634] lstrlenW (lpString=".docx") returned 5 [0050.634] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.634] lstrlenW (lpString=".pdf") returned 4 [0050.634] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.634] lstrlenW (lpString=".xls") returned 4 [0050.634] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.634] lstrlenW (lpString=".xlsx") returned 5 [0050.634] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.634] lstrlenW (lpString=".ppt") returned 4 [0050.634] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.634] lstrlenW (lpString=".zip") returned 4 [0050.634] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.634] lstrlenW (lpString=".rar") returned 4 [0050.634] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.634] lstrlenW (lpString=".bz2") returned 4 [0050.634] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.634] lstrlenW (lpString=".7z") returned 3 [0050.634] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.635] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.635] lstrlenW (lpString=".dbf") returned 4 [0050.635] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.635] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.635] lstrlenW (lpString=".1cd") returned 4 [0050.635] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.635] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0050.635] lstrlenW (lpString=".jpg") returned 4 [0050.635] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.971] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3316) returned 1 [0050.971] CloseHandle (hObject=0x210) returned 1 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.971] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.971] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.971] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.971] lstrlenW (lpString=".doc") returned 4 [0050.971] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.971] lstrlenW (lpString=".docx") returned 5 [0050.971] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0050.971] lstrlenW (lpString=".pdf") returned 4 [0050.971] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.971] lstrlenW (lpString=".xls") returned 4 [0050.971] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.971] lstrlenW (lpString=".xlsx") returned 5 [0050.971] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0050.971] lstrlenW (lpString=".ppt") returned 4 [0050.971] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.971] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.972] lstrlenW (lpString=".zip") returned 4 [0050.972] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.972] lstrlenW (lpString=".rar") returned 4 [0050.972] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.972] lstrlenW (lpString=".bz2") returned 4 [0050.972] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.972] lstrlenW (lpString=".7z") returned 3 [0050.972] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.972] lstrlenW (lpString=".dbf") returned 4 [0050.972] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.972] lstrlenW (lpString=".1cd") returned 4 [0050.972] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0050.972] lstrlenW (lpString=".jpg") returned 4 [0050.972] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.250] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=47300) returned 1 [0051.255] CloseHandle (hObject=0x180) returned 1 [0051.266] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0051.266] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.266] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.266] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.267] lstrlenW (lpString=".doc") returned 4 [0051.267] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.267] lstrlenW (lpString=".docx") returned 5 [0051.267] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0051.267] lstrlenW (lpString=".pdf") returned 4 [0051.267] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.267] lstrlenW (lpString=".xls") returned 4 [0051.267] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.267] lstrlenW (lpString=".xlsx") returned 5 [0051.267] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0051.267] lstrlenW (lpString=".ppt") returned 4 [0051.267] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.267] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.267] lstrlenW (lpString=".zip") returned 4 [0051.267] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.267] lstrlenW (lpString=".rar") returned 4 [0051.267] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.267] lstrlenW (lpString=".bz2") returned 4 [0051.267] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.267] lstrlenW (lpString=".7z") returned 3 [0051.267] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.267] lstrlenW (lpString=".dbf") returned 4 [0051.267] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.267] lstrlenW (lpString=".1cd") returned 4 [0051.267] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0051.267] lstrlenW (lpString=".jpg") returned 4 [0051.267] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.778] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5025) returned 1 [0051.778] CloseHandle (hObject=0x17c) returned 1 [0051.803] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0051.803] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.803] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.803] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.803] lstrlenW (lpString=".doc") returned 4 [0051.803] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.803] lstrlenW (lpString=".docx") returned 5 [0051.803] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.803] lstrlenW (lpString=".pdf") returned 4 [0051.803] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.803] lstrlenW (lpString=".xls") returned 4 [0051.803] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.803] lstrlenW (lpString=".xlsx") returned 5 [0051.803] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.803] lstrlenW (lpString=".ppt") returned 4 [0051.803] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.803] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.803] lstrlenW (lpString=".zip") returned 4 [0051.803] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.803] lstrlenW (lpString=".rar") returned 4 [0051.803] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.804] lstrlenW (lpString=".bz2") returned 4 [0051.804] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.804] lstrlenW (lpString=".7z") returned 3 [0051.804] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.804] lstrlenW (lpString=".dbf") returned 4 [0051.804] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.804] lstrlenW (lpString=".1cd") returned 4 [0051.804] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0051.804] lstrlenW (lpString=".jpg") returned 4 [0051.804] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.068] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10248) returned 1 [0052.068] CloseHandle (hObject=0x180) returned 1 [0052.068] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0052.068] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.068] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.068] lstrlenW (lpString=".doc") returned 4 [0052.068] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.068] lstrlenW (lpString=".docx") returned 5 [0052.068] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.068] lstrlenW (lpString=".pdf") returned 4 [0052.068] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.068] lstrlenW (lpString=".xls") returned 4 [0052.068] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.068] lstrlenW (lpString=".xlsx") returned 5 [0052.068] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.068] lstrlenW (lpString=".ppt") returned 4 [0052.068] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.069] lstrlenW (lpString=".zip") returned 4 [0052.069] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.069] lstrlenW (lpString=".rar") returned 4 [0052.069] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.069] lstrlenW (lpString=".bz2") returned 4 [0052.069] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.069] lstrlenW (lpString=".7z") returned 3 [0052.069] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.069] lstrlenW (lpString=".dbf") returned 4 [0052.069] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.069] lstrlenW (lpString=".1cd") returned 4 [0052.069] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 76 [0052.069] lstrlenW (lpString=".jpg") returned 4 [0052.069] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.490] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=741220) returned 1 [0052.490] CloseHandle (hObject=0x220) returned 1 [0052.490] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0052.490] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.490] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.490] lstrlenW (lpString=".doc") returned 4 [0052.490] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.490] lstrlenW (lpString=".docx") returned 5 [0052.490] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0052.490] lstrlenW (lpString=".pdf") returned 4 [0052.490] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.490] lstrlenW (lpString=".xls") returned 4 [0052.490] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.490] lstrlenW (lpString=".xlsx") returned 5 [0052.490] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0052.490] lstrlenW (lpString=".ppt") returned 4 [0052.490] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.491] lstrlenW (lpString=".zip") returned 4 [0052.491] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.491] lstrlenW (lpString=".rar") returned 4 [0052.491] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.491] lstrlenW (lpString=".bz2") returned 4 [0052.491] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.491] lstrlenW (lpString=".7z") returned 3 [0052.491] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.491] lstrlenW (lpString=".dbf") returned 4 [0052.491] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.491] lstrlenW (lpString=".1cd") returned 4 [0052.491] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0052.491] lstrlenW (lpString=".jpg") returned 4 [0052.491] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.928] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5072) returned 1 [0052.928] CloseHandle (hObject=0x1f0) returned 1 [0052.928] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0052.928] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.928] lstrlenW (lpString=".doc") returned 4 [0052.928] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0052.928] lstrlenW (lpString=".docx") returned 5 [0052.928] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0052.928] lstrlenW (lpString=".pdf") returned 4 [0052.928] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0052.928] lstrlenW (lpString=".xls") returned 4 [0052.928] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0052.928] lstrlenW (lpString=".xlsx") returned 5 [0052.928] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0052.928] lstrlenW (lpString=".ppt") returned 4 [0052.928] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0052.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.928] lstrlenW (lpString=".zip") returned 4 [0052.929] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0052.929] lstrlenW (lpString=".rar") returned 4 [0052.929] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0052.929] lstrlenW (lpString=".bz2") returned 4 [0052.929] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0052.929] lstrlenW (lpString=".7z") returned 3 [0052.929] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0052.929] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.929] lstrlenW (lpString=".dbf") returned 4 [0052.929] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0052.929] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.929] lstrlenW (lpString=".1cd") returned 4 [0052.929] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0052.929] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0052.929] lstrlenW (lpString=".jpg") returned 4 [0052.929] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.685] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3159) returned 1 [0053.685] CloseHandle (hObject=0x1f0) returned 1 [0053.685] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0053.685] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.685] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.685] lstrlenW (lpString=".doc") returned 4 [0053.685] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.685] lstrlenW (lpString=".docx") returned 5 [0053.685] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.685] lstrlenW (lpString=".pdf") returned 4 [0053.685] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.685] lstrlenW (lpString=".xls") returned 4 [0053.685] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.685] lstrlenW (lpString=".xlsx") returned 5 [0053.686] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.686] lstrlenW (lpString=".ppt") returned 4 [0053.686] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.686] lstrlenW (lpString=".zip") returned 4 [0053.686] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.686] lstrlenW (lpString=".rar") returned 4 [0053.686] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.686] lstrlenW (lpString=".bz2") returned 4 [0053.686] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.686] lstrlenW (lpString=".7z") returned 3 [0053.686] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.686] lstrlenW (lpString=".dbf") returned 4 [0053.686] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.686] lstrlenW (lpString=".1cd") returned 4 [0053.686] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 77 [0053.686] lstrlenW (lpString=".jpg") returned 4 [0053.686] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0055.265] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=28974) returned 1 [0055.265] CloseHandle (hObject=0x208) returned 1 [0055.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0055.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.265] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.265] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.266] GetLastError () returned 0x0 [0055.266] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x712e, lpOverlapped=0x0) returned 1 [0055.268] WriteFile (in: hFile=0x218, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0055.269] ReadFile (in: hFile=0x208, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.269] WriteFile (in: hFile=0x218, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.270] SetEndOfFile (hFile=0x218) returned 1 [0055.270] CloseHandle (hObject=0x218) returned 1 [0055.270] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.270] SetEndOfFile (hFile=0x208) returned 1 [0055.271] CloseHandle (hObject=0x208) returned 1 [0055.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0055.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.271] lstrlenW (lpString=".doc") returned 4 [0055.271] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.271] lstrlenW (lpString=".docx") returned 5 [0055.271] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0055.271] lstrlenW (lpString=".pdf") returned 4 [0055.271] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString=".xls") returned 4 [0055.272] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString=".xlsx") returned 5 [0055.272] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0055.272] lstrlenW (lpString=".ppt") returned 4 [0055.272] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.272] lstrlenW (lpString=".zip") returned 4 [0055.272] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.272] lstrlenW (lpString=".rar") returned 4 [0055.272] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString=".bz2") returned 4 [0055.272] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString=".7z") returned 3 [0055.272] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.272] lstrlenW (lpString=".dbf") returned 4 [0055.272] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.272] lstrlenW (lpString=".1cd") returned 4 [0055.272] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0055.272] lstrlenW (lpString=".jpg") returned 4 [0055.272] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.297] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7686) returned 1 [0055.299] CloseHandle (hObject=0x1f8) returned 1 [0055.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0055.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.306] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.306] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.312] GetLastError () returned 0x0 [0055.312] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0055.314] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0055.315] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.315] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.315] SetEndOfFile (hFile=0x160) returned 1 [0055.315] CloseHandle (hObject=0x160) returned 1 [0055.315] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.315] SetEndOfFile (hFile=0x1f8) returned 1 [0055.316] CloseHandle (hObject=0x1f8) returned 1 [0055.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0055.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.316] lstrlenW (lpString=".doc") returned 4 [0055.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.317] lstrlenW (lpString=".docx") returned 5 [0055.317] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.317] lstrlenW (lpString=".pdf") returned 4 [0055.317] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.317] lstrlenW (lpString=".xls") returned 4 [0055.317] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.317] lstrlenW (lpString=".xlsx") returned 5 [0055.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.317] lstrlenW (lpString=".ppt") returned 4 [0055.317] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.317] lstrlenW (lpString=".zip") returned 4 [0055.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.317] lstrlenW (lpString=".rar") returned 4 [0055.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.317] lstrlenW (lpString=".bz2") returned 4 [0055.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.317] lstrlenW (lpString=".7z") returned 3 [0055.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.317] lstrlenW (lpString=".dbf") returned 4 [0055.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.317] lstrlenW (lpString=".1cd") returned 4 [0055.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0055.317] lstrlenW (lpString=".jpg") returned 4 [0055.317] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.318] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12482) returned 1 [0055.318] CloseHandle (hObject=0x1f8) returned 1 [0055.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0055.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.318] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.318] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.318] GetLastError () returned 0x0 [0055.318] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0055.320] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0055.321] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.321] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.321] SetEndOfFile (hFile=0x160) returned 1 [0055.321] CloseHandle (hObject=0x160) returned 1 [0055.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.322] SetEndOfFile (hFile=0x1f8) returned 1 [0055.322] CloseHandle (hObject=0x1f8) returned 1 [0055.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0055.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.323] lstrlenW (lpString=".doc") returned 4 [0055.323] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.323] lstrlenW (lpString=".docx") returned 5 [0055.323] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.323] lstrlenW (lpString=".pdf") returned 4 [0055.323] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.323] lstrlenW (lpString=".xls") returned 4 [0055.323] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.323] lstrlenW (lpString=".xlsx") returned 5 [0055.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.323] lstrlenW (lpString=".ppt") returned 4 [0055.323] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.323] lstrlenW (lpString=".zip") returned 4 [0055.323] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.323] lstrlenW (lpString=".rar") returned 4 [0055.323] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.323] lstrlenW (lpString=".bz2") returned 4 [0055.323] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.323] lstrlenW (lpString=".7z") returned 3 [0055.323] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.323] lstrlenW (lpString=".dbf") returned 4 [0055.323] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.324] lstrlenW (lpString=".1cd") returned 4 [0055.324] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0055.324] lstrlenW (lpString=".jpg") returned 4 [0055.324] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.324] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5253) returned 1 [0055.324] CloseHandle (hObject=0x1f8) returned 1 [0055.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0055.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.324] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.324] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.325] GetLastError () returned 0x0 [0055.325] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1485, lpOverlapped=0x0) returned 1 [0055.326] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0055.327] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.327] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.327] SetEndOfFile (hFile=0x160) returned 1 [0055.327] CloseHandle (hObject=0x160) returned 1 [0055.327] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.328] SetEndOfFile (hFile=0x1f8) returned 1 [0055.328] CloseHandle (hObject=0x1f8) returned 1 [0055.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0055.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.329] lstrlenW (lpString=".doc") returned 4 [0055.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.329] lstrlenW (lpString=".docx") returned 5 [0055.329] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.329] lstrlenW (lpString=".pdf") returned 4 [0055.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.329] lstrlenW (lpString=".xls") returned 4 [0055.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.329] lstrlenW (lpString=".xlsx") returned 5 [0055.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.329] lstrlenW (lpString=".ppt") returned 4 [0055.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.329] lstrlenW (lpString=".zip") returned 4 [0055.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.329] lstrlenW (lpString=".rar") returned 4 [0055.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.329] lstrlenW (lpString=".bz2") returned 4 [0055.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.330] lstrlenW (lpString=".7z") returned 3 [0055.330] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.330] lstrlenW (lpString=".dbf") returned 4 [0055.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.330] lstrlenW (lpString=".1cd") returned 4 [0055.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0055.330] lstrlenW (lpString=".jpg") returned 4 [0055.330] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.332] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2596) returned 1 [0055.332] CloseHandle (hObject=0x160) returned 1 [0055.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0055.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.351] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.351] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.357] GetLastError () returned 0x0 [0055.357] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa24, lpOverlapped=0x0) returned 1 [0055.412] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0055.413] ReadFile (in: hFile=0x1f8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.413] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.413] SetEndOfFile (hFile=0x1a8) returned 1 [0055.414] CloseHandle (hObject=0x1a8) returned 1 [0055.414] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.414] SetEndOfFile (hFile=0x1f8) returned 1 [0055.414] CloseHandle (hObject=0x1f8) returned 1 [0055.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.415] lstrlenW (lpString=".doc") returned 4 [0055.415] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.415] lstrlenW (lpString=".docx") returned 5 [0055.415] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.415] lstrlenW (lpString=".pdf") returned 4 [0055.415] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.415] lstrlenW (lpString=".xls") returned 4 [0055.415] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.415] lstrlenW (lpString=".xlsx") returned 5 [0055.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.415] lstrlenW (lpString=".ppt") returned 4 [0055.415] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.415] lstrlenW (lpString=".zip") returned 4 [0055.415] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.415] lstrlenW (lpString=".rar") returned 4 [0055.415] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.415] lstrlenW (lpString=".bz2") returned 4 [0055.415] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.415] lstrlenW (lpString=".7z") returned 3 [0055.415] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.416] lstrlenW (lpString=".dbf") returned 4 [0055.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.416] lstrlenW (lpString=".1cd") returned 4 [0055.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0055.416] lstrlenW (lpString=".jpg") returned 4 [0055.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.422] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6984) returned 1 [0055.422] CloseHandle (hObject=0x1f8) returned 1 [0055.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0055.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.431] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.437] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.444] GetLastError () returned 0x0 [0055.444] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0055.445] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0055.446] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.446] SetEndOfFile (hFile=0x1a8) returned 1 [0055.447] CloseHandle (hObject=0x1a8) returned 1 [0055.447] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.447] SetEndOfFile (hFile=0x228) returned 1 [0055.447] CloseHandle (hObject=0x228) returned 1 [0055.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0055.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.448] lstrlenW (lpString=".doc") returned 4 [0055.448] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.448] lstrlenW (lpString=".docx") returned 5 [0055.448] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.448] lstrlenW (lpString=".pdf") returned 4 [0055.448] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.448] lstrlenW (lpString=".xls") returned 4 [0055.448] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.448] lstrlenW (lpString=".xlsx") returned 5 [0055.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.448] lstrlenW (lpString=".ppt") returned 4 [0055.448] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.448] lstrlenW (lpString=".zip") returned 4 [0055.448] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.448] lstrlenW (lpString=".rar") returned 4 [0055.448] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.448] lstrlenW (lpString=".bz2") returned 4 [0055.448] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.449] lstrlenW (lpString=".7z") returned 3 [0055.449] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.449] lstrlenW (lpString=".dbf") returned 4 [0055.449] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.449] lstrlenW (lpString=".1cd") returned 4 [0055.449] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.449] lstrlenW (lpString=".jpg") returned 4 [0055.449] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.449] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9248) returned 1 [0055.449] CloseHandle (hObject=0x228) returned 1 [0055.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0055.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.449] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.449] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.450] GetLastError () returned 0x0 [0055.450] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2420, lpOverlapped=0x0) returned 1 [0055.452] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0055.452] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.452] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.453] SetEndOfFile (hFile=0x1a8) returned 1 [0055.453] CloseHandle (hObject=0x1a8) returned 1 [0055.453] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.453] SetEndOfFile (hFile=0x228) returned 1 [0055.454] CloseHandle (hObject=0x228) returned 1 [0055.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0055.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.454] lstrlenW (lpString=".doc") returned 4 [0055.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.454] lstrlenW (lpString=".docx") returned 5 [0055.454] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.454] lstrlenW (lpString=".pdf") returned 4 [0055.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.454] lstrlenW (lpString=".xls") returned 4 [0055.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.454] lstrlenW (lpString=".xlsx") returned 5 [0055.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.454] lstrlenW (lpString=".ppt") returned 4 [0055.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.455] lstrlenW (lpString=".zip") returned 4 [0055.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.455] lstrlenW (lpString=".rar") returned 4 [0055.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.455] lstrlenW (lpString=".bz2") returned 4 [0055.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.455] lstrlenW (lpString=".7z") returned 3 [0055.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.455] lstrlenW (lpString=".dbf") returned 4 [0055.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.455] lstrlenW (lpString=".1cd") returned 4 [0055.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.455] lstrlenW (lpString=".jpg") returned 4 [0055.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.455] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5016) returned 1 [0055.455] CloseHandle (hObject=0x228) returned 1 [0055.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0055.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.456] GetLastError () returned 0x0 [0055.456] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1398, lpOverlapped=0x0) returned 1 [0055.458] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0055.459] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.459] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.459] SetEndOfFile (hFile=0x1a8) returned 1 [0055.459] CloseHandle (hObject=0x1a8) returned 1 [0055.459] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.459] SetEndOfFile (hFile=0x228) returned 1 [0055.460] CloseHandle (hObject=0x228) returned 1 [0055.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0055.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.460] lstrlenW (lpString=".doc") returned 4 [0055.461] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.461] lstrlenW (lpString=".docx") returned 5 [0055.461] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.461] lstrlenW (lpString=".pdf") returned 4 [0055.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.461] lstrlenW (lpString=".xls") returned 4 [0055.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.461] lstrlenW (lpString=".xlsx") returned 5 [0055.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.461] lstrlenW (lpString=".ppt") returned 4 [0055.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.461] lstrlenW (lpString=".zip") returned 4 [0055.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.461] lstrlenW (lpString=".rar") returned 4 [0055.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.461] lstrlenW (lpString=".bz2") returned 4 [0055.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.461] lstrlenW (lpString=".7z") returned 3 [0055.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.461] lstrlenW (lpString=".dbf") returned 4 [0055.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.461] lstrlenW (lpString=".1cd") returned 4 [0055.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.461] lstrlenW (lpString=".jpg") returned 4 [0055.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.462] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4390) returned 1 [0055.462] CloseHandle (hObject=0x228) returned 1 [0055.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0055.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.463] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.463] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.463] GetLastError () returned 0x0 [0055.463] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1126, lpOverlapped=0x0) returned 1 [0055.465] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0055.466] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.466] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.466] SetEndOfFile (hFile=0x1a8) returned 1 [0055.466] CloseHandle (hObject=0x1a8) returned 1 [0055.466] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.466] SetEndOfFile (hFile=0x228) returned 1 [0055.467] CloseHandle (hObject=0x228) returned 1 [0055.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0055.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.467] lstrlenW (lpString=".doc") returned 4 [0055.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.467] lstrlenW (lpString=".docx") returned 5 [0055.467] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.468] lstrlenW (lpString=".pdf") returned 4 [0055.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.468] lstrlenW (lpString=".xls") returned 4 [0055.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.468] lstrlenW (lpString=".xlsx") returned 5 [0055.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.468] lstrlenW (lpString=".ppt") returned 4 [0055.468] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.468] lstrlenW (lpString=".zip") returned 4 [0055.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.468] lstrlenW (lpString=".rar") returned 4 [0055.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.468] lstrlenW (lpString=".bz2") returned 4 [0055.468] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.468] lstrlenW (lpString=".7z") returned 3 [0055.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.468] lstrlenW (lpString=".dbf") returned 4 [0055.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.468] lstrlenW (lpString=".1cd") returned 4 [0055.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.468] lstrlenW (lpString=".jpg") returned 4 [0055.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.468] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3378) returned 1 [0055.469] CloseHandle (hObject=0x228) returned 1 [0055.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0055.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.469] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.469] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.470] GetLastError () returned 0x0 [0055.470] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd32, lpOverlapped=0x0) returned 1 [0055.471] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0055.472] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.472] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.472] SetEndOfFile (hFile=0x1a8) returned 1 [0055.472] CloseHandle (hObject=0x1a8) returned 1 [0055.472] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.472] SetEndOfFile (hFile=0x228) returned 1 [0055.473] CloseHandle (hObject=0x228) returned 1 [0055.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString=".doc") returned 4 [0055.474] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.474] lstrlenW (lpString=".docx") returned 5 [0055.474] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.474] lstrlenW (lpString=".pdf") returned 4 [0055.474] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.474] lstrlenW (lpString=".xls") returned 4 [0055.474] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.474] lstrlenW (lpString=".xlsx") returned 5 [0055.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.474] lstrlenW (lpString=".ppt") returned 4 [0055.474] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString=".zip") returned 4 [0055.474] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.474] lstrlenW (lpString=".rar") returned 4 [0055.474] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.474] lstrlenW (lpString=".bz2") returned 4 [0055.474] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.474] lstrlenW (lpString=".7z") returned 3 [0055.474] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString=".dbf") returned 4 [0055.474] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString=".1cd") returned 4 [0055.474] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.474] lstrlenW (lpString=".jpg") returned 4 [0055.475] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.475] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3120) returned 1 [0055.475] CloseHandle (hObject=0x228) returned 1 [0055.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0055.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.475] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.475] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.475] GetLastError () returned 0x0 [0055.476] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc30, lpOverlapped=0x0) returned 1 [0056.360] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0056.361] ReadFile (in: hFile=0x228, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.361] WriteFile (in: hFile=0x1a8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.361] SetEndOfFile (hFile=0x1a8) returned 1 [0056.711] CloseHandle (hObject=0x1a8) returned 1 [0056.735] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.736] SetEndOfFile (hFile=0x228) returned 1 [0056.878] CloseHandle (hObject=0x228) returned 1 [0056.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.950] lstrlenW (lpString=".doc") returned 4 [0056.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.950] lstrlenW (lpString=".docx") returned 5 [0056.950] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.950] lstrlenW (lpString=".pdf") returned 4 [0056.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.950] lstrlenW (lpString=".xls") returned 4 [0056.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.950] lstrlenW (lpString=".xlsx") returned 5 [0056.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.950] lstrlenW (lpString=".ppt") returned 4 [0056.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.950] lstrlenW (lpString=".zip") returned 4 [0056.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.950] lstrlenW (lpString=".rar") returned 4 [0056.950] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.950] lstrlenW (lpString=".bz2") returned 4 [0056.950] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.950] lstrlenW (lpString=".7z") returned 3 [0056.950] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.950] lstrlenW (lpString=".dbf") returned 4 [0056.950] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.950] lstrlenW (lpString=".1cd") returned 4 [0056.950] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0056.951] lstrlenW (lpString=".jpg") returned 4 [0056.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.237] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27858) returned 1 [0057.237] CloseHandle (hObject=0x150) returned 1 [0057.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0057.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.237] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.237] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.263] GetLastError () returned 0x0 [0057.263] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0057.284] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0057.285] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.285] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.285] SetEndOfFile (hFile=0x154) returned 1 [0057.285] CloseHandle (hObject=0x154) returned 1 [0057.286] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.286] SetEndOfFile (hFile=0x150) returned 1 [0057.287] CloseHandle (hObject=0x150) returned 1 [0057.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0057.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.287] lstrlenW (lpString=".doc") returned 4 [0057.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.287] lstrlenW (lpString=".docx") returned 5 [0057.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.287] lstrlenW (lpString=".pdf") returned 4 [0057.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.287] lstrlenW (lpString=".xls") returned 4 [0057.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.287] lstrlenW (lpString=".xlsx") returned 5 [0057.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.287] lstrlenW (lpString=".ppt") returned 4 [0057.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.288] lstrlenW (lpString=".zip") returned 4 [0057.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.288] lstrlenW (lpString=".rar") returned 4 [0057.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.288] lstrlenW (lpString=".bz2") returned 4 [0057.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.288] lstrlenW (lpString=".7z") returned 3 [0057.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.288] lstrlenW (lpString=".dbf") returned 4 [0057.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.288] lstrlenW (lpString=".1cd") returned 4 [0057.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0057.288] lstrlenW (lpString=".jpg") returned 4 [0057.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.288] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6632) returned 1 [0057.288] CloseHandle (hObject=0x150) returned 1 [0057.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0057.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.289] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.289] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.289] GetLastError () returned 0x0 [0057.289] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0057.338] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0057.339] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.339] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.339] SetEndOfFile (hFile=0x154) returned 1 [0057.339] CloseHandle (hObject=0x154) returned 1 [0057.339] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.339] SetEndOfFile (hFile=0x150) returned 1 [0057.340] CloseHandle (hObject=0x150) returned 1 [0057.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0057.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.341] lstrlenW (lpString=".doc") returned 4 [0057.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.341] lstrlenW (lpString=".docx") returned 5 [0057.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.341] lstrlenW (lpString=".pdf") returned 4 [0057.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.341] lstrlenW (lpString=".xls") returned 4 [0057.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.341] lstrlenW (lpString=".xlsx") returned 5 [0057.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.341] lstrlenW (lpString=".ppt") returned 4 [0057.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.341] lstrlenW (lpString=".zip") returned 4 [0057.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.341] lstrlenW (lpString=".rar") returned 4 [0057.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.341] lstrlenW (lpString=".bz2") returned 4 [0057.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.342] lstrlenW (lpString=".7z") returned 3 [0057.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.342] lstrlenW (lpString=".dbf") returned 4 [0057.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.342] lstrlenW (lpString=".1cd") returned 4 [0057.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0057.342] lstrlenW (lpString=".jpg") returned 4 [0057.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.342] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9240) returned 1 [0057.342] CloseHandle (hObject=0x150) returned 1 [0057.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0057.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.342] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.343] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.343] GetLastError () returned 0x0 [0057.343] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2418, lpOverlapped=0x0) returned 1 [0057.346] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0057.347] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.347] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.347] SetEndOfFile (hFile=0x154) returned 1 [0057.347] CloseHandle (hObject=0x154) returned 1 [0057.348] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.348] SetEndOfFile (hFile=0x150) returned 1 [0057.348] CloseHandle (hObject=0x150) returned 1 [0057.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.349] lstrlenW (lpString=".doc") returned 4 [0057.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.349] lstrlenW (lpString=".docx") returned 5 [0057.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.349] lstrlenW (lpString=".pdf") returned 4 [0057.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.349] lstrlenW (lpString=".xls") returned 4 [0057.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.349] lstrlenW (lpString=".xlsx") returned 5 [0057.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.349] lstrlenW (lpString=".ppt") returned 4 [0057.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.349] lstrlenW (lpString=".zip") returned 4 [0057.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.349] lstrlenW (lpString=".rar") returned 4 [0057.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.349] lstrlenW (lpString=".bz2") returned 4 [0057.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.350] lstrlenW (lpString=".7z") returned 3 [0057.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.350] lstrlenW (lpString=".dbf") returned 4 [0057.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.350] lstrlenW (lpString=".1cd") returned 4 [0057.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0057.350] lstrlenW (lpString=".jpg") returned 4 [0057.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.350] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2344) returned 1 [0057.350] CloseHandle (hObject=0x150) returned 1 [0057.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0057.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.350] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.351] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.351] GetLastError () returned 0x0 [0057.351] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x928, lpOverlapped=0x0) returned 1 [0057.353] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x930, lpOverlapped=0x0) returned 1 [0057.354] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.354] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.354] SetEndOfFile (hFile=0x154) returned 1 [0057.354] CloseHandle (hObject=0x154) returned 1 [0057.355] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.355] SetEndOfFile (hFile=0x150) returned 1 [0057.355] CloseHandle (hObject=0x150) returned 1 [0057.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0057.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.356] lstrlenW (lpString=".doc") returned 4 [0057.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.356] lstrlenW (lpString=".docx") returned 5 [0057.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.356] lstrlenW (lpString=".pdf") returned 4 [0057.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.356] lstrlenW (lpString=".xls") returned 4 [0057.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.356] lstrlenW (lpString=".xlsx") returned 5 [0057.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.356] lstrlenW (lpString=".ppt") returned 4 [0057.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.356] lstrlenW (lpString=".zip") returned 4 [0057.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.357] lstrlenW (lpString=".rar") returned 4 [0057.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.357] lstrlenW (lpString=".bz2") returned 4 [0057.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.357] lstrlenW (lpString=".7z") returned 3 [0057.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.357] lstrlenW (lpString=".dbf") returned 4 [0057.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.357] lstrlenW (lpString=".1cd") returned 4 [0057.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0057.357] lstrlenW (lpString=".jpg") returned 4 [0057.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.357] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6060) returned 1 [0057.357] CloseHandle (hObject=0x150) returned 1 [0057.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0057.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.358] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.358] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.358] GetLastError () returned 0x0 [0057.358] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0057.360] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0057.361] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.361] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.361] SetEndOfFile (hFile=0x154) returned 1 [0057.361] CloseHandle (hObject=0x154) returned 1 [0057.361] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.361] SetEndOfFile (hFile=0x150) returned 1 [0057.362] CloseHandle (hObject=0x150) returned 1 [0057.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.363] lstrlenW (lpString=".doc") returned 4 [0057.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString=".docx") returned 5 [0057.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.363] lstrlenW (lpString=".pdf") returned 4 [0057.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString=".xls") returned 4 [0057.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.363] lstrlenW (lpString=".xlsx") returned 5 [0057.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.363] lstrlenW (lpString=".ppt") returned 4 [0057.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.363] lstrlenW (lpString=".zip") returned 4 [0057.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.363] lstrlenW (lpString=".rar") returned 4 [0057.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString=".bz2") returned 4 [0057.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString=".7z") returned 3 [0057.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.363] lstrlenW (lpString=".dbf") returned 4 [0057.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.363] lstrlenW (lpString=".1cd") returned 4 [0057.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.364] lstrlenW (lpString=".jpg") returned 4 [0057.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.364] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3416) returned 1 [0057.364] CloseHandle (hObject=0x150) returned 1 [0057.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0057.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0057.364] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.364] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0057.365] GetLastError () returned 0x0 [0057.365] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd58, lpOverlapped=0x0) returned 1 [0057.901] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0057.902] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.902] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.903] SetEndOfFile (hFile=0x154) returned 1 [0058.045] CloseHandle (hObject=0x154) returned 1 [0058.052] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.052] SetEndOfFile (hFile=0x150) returned 1 [0058.067] CloseHandle (hObject=0x150) returned 1 [0058.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0058.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.082] lstrlenW (lpString=".doc") returned 4 [0058.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.082] lstrlenW (lpString=".docx") returned 5 [0058.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.082] lstrlenW (lpString=".pdf") returned 4 [0058.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.082] lstrlenW (lpString=".xls") returned 4 [0058.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.083] lstrlenW (lpString=".xlsx") returned 5 [0058.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.083] lstrlenW (lpString=".ppt") returned 4 [0058.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.083] lstrlenW (lpString=".zip") returned 4 [0058.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.083] lstrlenW (lpString=".rar") returned 4 [0058.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString=".bz2") returned 4 [0058.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString=".7z") returned 3 [0058.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.083] lstrlenW (lpString=".dbf") returned 4 [0058.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.083] lstrlenW (lpString=".1cd") returned 4 [0058.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.083] lstrlenW (lpString=".jpg") returned 4 [0058.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.084] lstrlenW (lpString=".doc") returned 4 [0058.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString=".docx") returned 5 [0058.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.084] lstrlenW (lpString=".pdf") returned 4 [0058.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString=".xls") returned 4 [0058.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.084] lstrlenW (lpString=".xlsx") returned 5 [0058.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.084] lstrlenW (lpString=".ppt") returned 4 [0058.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.084] lstrlenW (lpString=".zip") returned 4 [0058.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.084] lstrlenW (lpString=".rar") returned 4 [0058.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString=".bz2") returned 4 [0058.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString=".7z") returned 3 [0058.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.084] lstrlenW (lpString=".dbf") returned 4 [0058.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.084] lstrlenW (lpString=".1cd") returned 4 [0058.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.084] lstrlenW (lpString=".jpg") returned 4 [0058.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.084] @NlsCompareInvariantNoCase@16 () [0058.084] lstrlenW (lpString="AN04235_.WMF") returned 12 [0058.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.085] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7804) returned 1 [0058.085] CloseHandle (hObject=0x1fc) returned 1 [0058.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0058.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.085] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.085] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.085] GetLastError () returned 0x0 [0058.085] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.087] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0058.088] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.088] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.088] SetEndOfFile (hFile=0x154) returned 1 [0058.088] CloseHandle (hObject=0x154) returned 1 [0058.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.088] SetEndOfFile (hFile=0x1fc) returned 1 [0058.089] CloseHandle (hObject=0x1fc) returned 1 [0058.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0058.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.090] lstrlenW (lpString=".doc") returned 4 [0058.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.090] lstrlenW (lpString=".docx") returned 5 [0058.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.090] lstrlenW (lpString=".pdf") returned 4 [0058.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.090] lstrlenW (lpString=".xls") returned 4 [0058.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.090] lstrlenW (lpString=".xlsx") returned 5 [0058.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.090] lstrlenW (lpString=".ppt") returned 4 [0058.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.090] lstrlenW (lpString=".zip") returned 4 [0058.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.090] lstrlenW (lpString=".rar") returned 4 [0058.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.090] lstrlenW (lpString=".bz2") returned 4 [0058.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.090] lstrlenW (lpString=".7z") returned 3 [0058.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.090] lstrlenW (lpString=".dbf") returned 4 [0058.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".1cd") returned 4 [0058.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".jpg") returned 4 [0058.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".doc") returned 4 [0058.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString=".docx") returned 5 [0058.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.091] lstrlenW (lpString=".pdf") returned 4 [0058.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString=".xls") returned 4 [0058.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.091] lstrlenW (lpString=".xlsx") returned 5 [0058.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.091] lstrlenW (lpString=".ppt") returned 4 [0058.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".zip") returned 4 [0058.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.091] lstrlenW (lpString=".rar") returned 4 [0058.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString=".bz2") returned 4 [0058.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString=".7z") returned 3 [0058.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".dbf") returned 4 [0058.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.091] lstrlenW (lpString=".1cd") returned 4 [0058.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0058.092] lstrlenW (lpString=".jpg") returned 4 [0058.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.092] @NlsCompareInvariantNoCase@16 () [0058.092] lstrlenW (lpString="AN04267_.WMF") returned 12 [0058.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.092] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7804) returned 1 [0058.092] CloseHandle (hObject=0x1fc) returned 1 [0058.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0058.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.092] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.092] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.093] GetLastError () returned 0x0 [0058.093] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.094] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0058.095] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.095] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.095] SetEndOfFile (hFile=0x154) returned 1 [0058.095] CloseHandle (hObject=0x154) returned 1 [0058.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.095] SetEndOfFile (hFile=0x1fc) returned 1 [0058.096] CloseHandle (hObject=0x1fc) returned 1 [0058.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString=".doc") returned 4 [0058.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString=".docx") returned 5 [0058.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.097] lstrlenW (lpString=".pdf") returned 4 [0058.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString=".xls") returned 4 [0058.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.097] lstrlenW (lpString=".xlsx") returned 5 [0058.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.097] lstrlenW (lpString=".ppt") returned 4 [0058.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString=".zip") returned 4 [0058.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.097] lstrlenW (lpString=".rar") returned 4 [0058.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString=".bz2") returned 4 [0058.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString=".7z") returned 3 [0058.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString=".dbf") returned 4 [0058.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString=".1cd") returned 4 [0058.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.097] lstrlenW (lpString=".jpg") returned 4 [0058.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString=".doc") returned 4 [0058.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString=".docx") returned 5 [0058.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.098] lstrlenW (lpString=".pdf") returned 4 [0058.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString=".xls") returned 4 [0058.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.098] lstrlenW (lpString=".xlsx") returned 5 [0058.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.098] lstrlenW (lpString=".ppt") returned 4 [0058.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString=".zip") returned 4 [0058.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.098] lstrlenW (lpString=".rar") returned 4 [0058.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString=".bz2") returned 4 [0058.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString=".7z") returned 3 [0058.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString=".dbf") returned 4 [0058.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString=".1cd") returned 4 [0058.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0058.098] lstrlenW (lpString=".jpg") returned 4 [0058.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.099] @NlsCompareInvariantNoCase@16 () [0058.099] lstrlenW (lpString="AN04269_.WMF") returned 12 [0058.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.099] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2016) returned 1 [0058.099] CloseHandle (hObject=0x1fc) returned 1 [0058.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0058.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.099] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.099] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.100] GetLastError () returned 0x0 [0058.100] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0058.102] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.102] SetEndOfFile (hFile=0x154) returned 1 [0058.102] CloseHandle (hObject=0x154) returned 1 [0058.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.102] SetEndOfFile (hFile=0x1fc) returned 1 [0058.103] CloseHandle (hObject=0x1fc) returned 1 [0058.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0058.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.103] lstrlenW (lpString=".doc") returned 4 [0058.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.103] lstrlenW (lpString=".docx") returned 5 [0058.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.104] lstrlenW (lpString=".pdf") returned 4 [0058.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString=".xls") returned 4 [0058.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.104] lstrlenW (lpString=".xlsx") returned 5 [0058.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.104] lstrlenW (lpString=".ppt") returned 4 [0058.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString=".zip") returned 4 [0058.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.104] lstrlenW (lpString=".rar") returned 4 [0058.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString=".bz2") returned 4 [0058.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString=".7z") returned 3 [0058.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString=".dbf") returned 4 [0058.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString=".1cd") returned 4 [0058.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString=".jpg") returned 4 [0058.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.104] lstrlenW (lpString=".doc") returned 4 [0058.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.104] lstrlenW (lpString=".docx") returned 5 [0058.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.104] lstrlenW (lpString=".pdf") returned 4 [0058.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString=".xls") returned 4 [0058.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.105] lstrlenW (lpString=".xlsx") returned 5 [0058.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.105] lstrlenW (lpString=".ppt") returned 4 [0058.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.105] lstrlenW (lpString=".zip") returned 4 [0058.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.105] lstrlenW (lpString=".rar") returned 4 [0058.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString=".bz2") returned 4 [0058.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString=".7z") returned 3 [0058.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.105] lstrlenW (lpString=".dbf") returned 4 [0058.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.105] lstrlenW (lpString=".1cd") returned 4 [0058.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0058.105] lstrlenW (lpString=".jpg") returned 4 [0058.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.105] @NlsCompareInvariantNoCase@16 () [0058.105] lstrlenW (lpString="AN04323_.WMF") returned 12 [0058.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.106] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2492) returned 1 [0058.106] CloseHandle (hObject=0x1fc) returned 1 [0058.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0058.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.106] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0058.108] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0058.109] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.109] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.109] SetEndOfFile (hFile=0x154) returned 1 [0058.110] CloseHandle (hObject=0x154) returned 1 [0058.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.110] SetEndOfFile (hFile=0x1fc) returned 1 [0058.111] CloseHandle (hObject=0x1fc) returned 1 [0058.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0058.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.111] lstrlenW (lpString=".doc") returned 4 [0058.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.111] lstrlenW (lpString=".docx") returned 5 [0058.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.111] lstrlenW (lpString=".pdf") returned 4 [0058.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.111] lstrlenW (lpString=".xls") returned 4 [0058.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.111] lstrlenW (lpString=".xlsx") returned 5 [0058.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.111] lstrlenW (lpString=".ppt") returned 4 [0058.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.111] lstrlenW (lpString=".zip") returned 4 [0058.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.111] lstrlenW (lpString=".rar") returned 4 [0058.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".bz2") returned 4 [0058.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".7z") returned 3 [0058.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString=".dbf") returned 4 [0058.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString=".1cd") returned 4 [0058.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString=".jpg") returned 4 [0058.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString=".doc") returned 4 [0058.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".docx") returned 5 [0058.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.112] lstrlenW (lpString=".pdf") returned 4 [0058.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".xls") returned 4 [0058.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.112] lstrlenW (lpString=".xlsx") returned 5 [0058.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.112] lstrlenW (lpString=".ppt") returned 4 [0058.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.112] lstrlenW (lpString=".zip") returned 4 [0058.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.112] lstrlenW (lpString=".rar") returned 4 [0058.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".bz2") returned 4 [0058.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.112] lstrlenW (lpString=".7z") returned 3 [0058.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.113] lstrlenW (lpString=".dbf") returned 4 [0058.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.113] lstrlenW (lpString=".1cd") returned 4 [0058.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0058.113] lstrlenW (lpString=".jpg") returned 4 [0058.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.113] @NlsCompareInvariantNoCase@16 () [0058.113] lstrlenW (lpString="AN04326_.WMF") returned 12 [0058.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.113] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3348) returned 1 [0058.113] CloseHandle (hObject=0x1fc) returned 1 [0058.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0058.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.114] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.114] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.114] GetLastError () returned 0x0 [0058.114] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd14, lpOverlapped=0x0) returned 1 [0058.309] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0058.310] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.310] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.310] SetEndOfFile (hFile=0x154) returned 1 [0058.310] CloseHandle (hObject=0x154) returned 1 [0058.310] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.310] SetEndOfFile (hFile=0x1fc) returned 1 [0058.311] CloseHandle (hObject=0x1fc) returned 1 [0058.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString=".doc") returned 4 [0058.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString=".docx") returned 5 [0058.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.312] lstrlenW (lpString=".pdf") returned 4 [0058.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString=".xls") returned 4 [0058.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.312] lstrlenW (lpString=".xlsx") returned 5 [0058.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.312] lstrlenW (lpString=".ppt") returned 4 [0058.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString=".zip") returned 4 [0058.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.312] lstrlenW (lpString=".rar") returned 4 [0058.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString=".bz2") returned 4 [0058.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString=".7z") returned 3 [0058.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString=".dbf") returned 4 [0058.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString=".1cd") returned 4 [0058.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0058.312] lstrlenW (lpString=".jpg") returned 4 [0058.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.313] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=28948) returned 1 [0058.313] CloseHandle (hObject=0x1fc) returned 1 [0058.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0058.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.313] GetLastError () returned 0x0 [0058.313] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7114, lpOverlapped=0x0) returned 1 [0058.340] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0058.345] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.345] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.345] SetEndOfFile (hFile=0x154) returned 1 [0058.349] CloseHandle (hObject=0x154) returned 1 [0058.349] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.349] SetEndOfFile (hFile=0x1fc) returned 1 [0058.350] CloseHandle (hObject=0x1fc) returned 1 [0058.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0058.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.350] lstrlenW (lpString=".doc") returned 4 [0058.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.350] lstrlenW (lpString=".docx") returned 5 [0058.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.350] lstrlenW (lpString=".pdf") returned 4 [0058.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.350] lstrlenW (lpString=".xls") returned 4 [0058.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.351] lstrlenW (lpString=".xlsx") returned 5 [0058.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.351] lstrlenW (lpString=".ppt") returned 4 [0058.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.351] lstrlenW (lpString=".zip") returned 4 [0058.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.351] lstrlenW (lpString=".rar") returned 4 [0058.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.351] lstrlenW (lpString=".bz2") returned 4 [0058.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.351] lstrlenW (lpString=".7z") returned 3 [0058.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.351] lstrlenW (lpString=".dbf") returned 4 [0058.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.351] lstrlenW (lpString=".1cd") returned 4 [0058.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0058.351] lstrlenW (lpString=".jpg") returned 4 [0058.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.352] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11636) returned 1 [0058.352] CloseHandle (hObject=0x1fc) returned 1 [0058.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0058.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.352] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.352] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.352] GetLastError () returned 0x0 [0058.352] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0058.354] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0058.355] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.355] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.355] SetEndOfFile (hFile=0x154) returned 1 [0058.355] CloseHandle (hObject=0x154) returned 1 [0058.356] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.356] SetEndOfFile (hFile=0x1fc) returned 1 [0058.356] CloseHandle (hObject=0x1fc) returned 1 [0058.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0058.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.357] lstrlenW (lpString=".doc") returned 4 [0058.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.357] lstrlenW (lpString=".docx") returned 5 [0058.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.357] lstrlenW (lpString=".pdf") returned 4 [0058.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.357] lstrlenW (lpString=".xls") returned 4 [0058.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.357] lstrlenW (lpString=".xlsx") returned 5 [0058.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.357] lstrlenW (lpString=".ppt") returned 4 [0058.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.357] lstrlenW (lpString=".zip") returned 4 [0058.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.357] lstrlenW (lpString=".rar") returned 4 [0058.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.357] lstrlenW (lpString=".bz2") returned 4 [0058.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.357] lstrlenW (lpString=".7z") returned 3 [0058.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.358] lstrlenW (lpString=".dbf") returned 4 [0058.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.358] lstrlenW (lpString=".1cd") returned 4 [0058.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0058.358] lstrlenW (lpString=".jpg") returned 4 [0058.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.359] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=22516) returned 1 [0058.359] CloseHandle (hObject=0x1fc) returned 1 [0058.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0058.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.359] GetLastError () returned 0x0 [0058.359] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0058.362] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0058.363] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.363] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.363] SetEndOfFile (hFile=0x154) returned 1 [0058.363] CloseHandle (hObject=0x154) returned 1 [0058.363] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.363] SetEndOfFile (hFile=0x1fc) returned 1 [0058.364] CloseHandle (hObject=0x1fc) returned 1 [0058.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0058.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.365] lstrlenW (lpString=".doc") returned 4 [0058.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString=".docx") returned 5 [0058.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.365] lstrlenW (lpString=".pdf") returned 4 [0058.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString=".xls") returned 4 [0058.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.365] lstrlenW (lpString=".xlsx") returned 5 [0058.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.365] lstrlenW (lpString=".ppt") returned 4 [0058.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.365] lstrlenW (lpString=".zip") returned 4 [0058.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.365] lstrlenW (lpString=".rar") returned 4 [0058.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString=".bz2") returned 4 [0058.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString=".7z") returned 3 [0058.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.365] lstrlenW (lpString=".dbf") returned 4 [0058.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.366] lstrlenW (lpString=".1cd") returned 4 [0058.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0058.366] lstrlenW (lpString=".jpg") returned 4 [0058.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.366] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16180) returned 1 [0058.366] CloseHandle (hObject=0x1fc) returned 1 [0058.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0058.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.367] GetLastError () returned 0x0 [0058.367] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0058.369] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0058.370] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.370] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.370] SetEndOfFile (hFile=0x154) returned 1 [0058.370] CloseHandle (hObject=0x154) returned 1 [0058.370] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.370] SetEndOfFile (hFile=0x1fc) returned 1 [0058.371] CloseHandle (hObject=0x1fc) returned 1 [0058.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.372] lstrlenW (lpString=".doc") returned 4 [0058.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.372] lstrlenW (lpString=".docx") returned 5 [0058.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.372] lstrlenW (lpString=".pdf") returned 4 [0058.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.372] lstrlenW (lpString=".xls") returned 4 [0058.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.372] lstrlenW (lpString=".xlsx") returned 5 [0058.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.372] lstrlenW (lpString=".ppt") returned 4 [0058.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.372] lstrlenW (lpString=".zip") returned 4 [0058.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.372] lstrlenW (lpString=".rar") returned 4 [0058.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.372] lstrlenW (lpString=".bz2") returned 4 [0058.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.372] lstrlenW (lpString=".7z") returned 3 [0058.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.373] lstrlenW (lpString=".dbf") returned 4 [0058.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.373] lstrlenW (lpString=".1cd") returned 4 [0058.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0058.373] lstrlenW (lpString=".jpg") returned 4 [0058.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.373] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17236) returned 1 [0058.373] CloseHandle (hObject=0x1fc) returned 1 [0058.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0058.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.374] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.374] GetLastError () returned 0x0 [0058.374] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4354, lpOverlapped=0x0) returned 1 [0058.376] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0058.377] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.377] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.377] SetEndOfFile (hFile=0x154) returned 1 [0058.377] CloseHandle (hObject=0x154) returned 1 [0058.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.378] SetEndOfFile (hFile=0x1fc) returned 1 [0058.379] CloseHandle (hObject=0x1fc) returned 1 [0058.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.379] lstrlenW (lpString=".doc") returned 4 [0058.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.379] lstrlenW (lpString=".docx") returned 5 [0058.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.379] lstrlenW (lpString=".pdf") returned 4 [0058.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.379] lstrlenW (lpString=".xls") returned 4 [0058.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.379] lstrlenW (lpString=".xlsx") returned 5 [0058.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.379] lstrlenW (lpString=".ppt") returned 4 [0058.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.379] lstrlenW (lpString=".zip") returned 4 [0058.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.379] lstrlenW (lpString=".rar") returned 4 [0058.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.380] lstrlenW (lpString=".bz2") returned 4 [0058.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.380] lstrlenW (lpString=".7z") returned 3 [0058.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.380] lstrlenW (lpString=".dbf") returned 4 [0058.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.380] lstrlenW (lpString=".1cd") returned 4 [0058.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0058.380] lstrlenW (lpString=".jpg") returned 4 [0058.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.380] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16112) returned 1 [0058.380] CloseHandle (hObject=0x1fc) returned 1 [0058.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0058.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.381] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.381] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0058.381] GetLastError () returned 0x0 [0058.381] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0058.453] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0058.454] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.454] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.454] SetEndOfFile (hFile=0x154) returned 1 [0059.109] CloseHandle (hObject=0x154) returned 1 [0059.187] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.187] SetEndOfFile (hFile=0x1fc) returned 1 [0059.337] CloseHandle (hObject=0x1fc) returned 1 [0059.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.338] lstrlenW (lpString=".doc") returned 4 [0059.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString=".docx") returned 5 [0059.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.338] lstrlenW (lpString=".pdf") returned 4 [0059.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString=".xls") returned 4 [0059.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.338] lstrlenW (lpString=".xlsx") returned 5 [0059.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.338] lstrlenW (lpString=".ppt") returned 4 [0059.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.338] lstrlenW (lpString=".zip") returned 4 [0059.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.338] lstrlenW (lpString=".rar") returned 4 [0059.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString=".bz2") returned 4 [0059.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString=".7z") returned 3 [0059.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.338] lstrlenW (lpString=".dbf") returned 4 [0059.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.338] lstrlenW (lpString=".1cd") returned 4 [0059.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0059.338] lstrlenW (lpString=".jpg") returned 4 [0059.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.339] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7966) returned 1 [0059.339] CloseHandle (hObject=0x1fc) returned 1 [0059.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0059.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0059.340] GetLastError () returned 0x0 [0059.340] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0059.351] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0059.352] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.352] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.352] SetEndOfFile (hFile=0x16c) returned 1 [0059.352] CloseHandle (hObject=0x16c) returned 1 [0059.353] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.353] SetEndOfFile (hFile=0x1fc) returned 1 [0059.353] CloseHandle (hObject=0x1fc) returned 1 [0059.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0059.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.354] lstrlenW (lpString=".doc") returned 4 [0059.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.354] lstrlenW (lpString=".docx") returned 5 [0059.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.354] lstrlenW (lpString=".pdf") returned 4 [0059.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.354] lstrlenW (lpString=".xls") returned 4 [0059.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.354] lstrlenW (lpString=".xlsx") returned 5 [0059.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.354] lstrlenW (lpString=".ppt") returned 4 [0059.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.354] lstrlenW (lpString=".zip") returned 4 [0059.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.354] lstrlenW (lpString=".rar") returned 4 [0059.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.354] lstrlenW (lpString=".bz2") returned 4 [0059.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.355] lstrlenW (lpString=".7z") returned 3 [0059.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.355] lstrlenW (lpString=".dbf") returned 4 [0059.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.355] lstrlenW (lpString=".1cd") returned 4 [0059.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0059.355] lstrlenW (lpString=".jpg") returned 4 [0059.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.276] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=20189) returned 1 [0060.276] CloseHandle (hObject=0x22c) returned 1 [0060.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0060.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.277] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.277] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.546] GetLastError () returned 0x0 [0060.546] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0060.581] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.581] SetEndOfFile (hFile=0x160) returned 1 [0060.581] CloseHandle (hObject=0x160) returned 1 [0060.581] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.581] SetEndOfFile (hFile=0x22c) returned 1 [0060.582] CloseHandle (hObject=0x22c) returned 1 [0060.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.582] lstrlenW (lpString=".doc") returned 4 [0060.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.582] lstrlenW (lpString=".docx") returned 5 [0060.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.582] lstrlenW (lpString=".pdf") returned 4 [0060.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".xls") returned 4 [0060.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".xlsx") returned 5 [0060.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.583] lstrlenW (lpString=".ppt") returned 4 [0060.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.583] lstrlenW (lpString=".zip") returned 4 [0060.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".rar") returned 4 [0060.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".bz2") returned 4 [0060.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString=".7z") returned 3 [0060.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.583] lstrlenW (lpString=".dbf") returned 4 [0060.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.583] lstrlenW (lpString=".1cd") returned 4 [0060.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0060.583] lstrlenW (lpString=".jpg") returned 4 [0060.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.584] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1516) returned 1 [0060.584] CloseHandle (hObject=0x22c) returned 1 [0060.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0060.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.584] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.584] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.584] GetLastError () returned 0x0 [0060.584] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0060.586] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0060.587] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.587] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.587] SetEndOfFile (hFile=0x160) returned 1 [0060.587] CloseHandle (hObject=0x160) returned 1 [0060.587] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.587] SetEndOfFile (hFile=0x22c) returned 1 [0060.588] CloseHandle (hObject=0x22c) returned 1 [0060.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.589] lstrlenW (lpString=".doc") returned 4 [0060.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.589] lstrlenW (lpString=".docx") returned 5 [0060.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.589] lstrlenW (lpString=".pdf") returned 4 [0060.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.589] lstrlenW (lpString=".xls") returned 4 [0060.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.589] lstrlenW (lpString=".xlsx") returned 5 [0060.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.589] lstrlenW (lpString=".ppt") returned 4 [0060.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.589] lstrlenW (lpString=".zip") returned 4 [0060.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.589] lstrlenW (lpString=".rar") returned 4 [0060.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.589] lstrlenW (lpString=".bz2") returned 4 [0060.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.589] lstrlenW (lpString=".7z") returned 3 [0060.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.589] lstrlenW (lpString=".dbf") returned 4 [0060.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.590] lstrlenW (lpString=".1cd") returned 4 [0060.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0060.590] lstrlenW (lpString=".jpg") returned 4 [0060.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.590] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3986) returned 1 [0060.590] CloseHandle (hObject=0x22c) returned 1 [0060.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0060.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.590] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.590] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.591] GetLastError () returned 0x0 [0060.591] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf92, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0060.596] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.597] SetEndOfFile (hFile=0x160) returned 1 [0060.597] CloseHandle (hObject=0x160) returned 1 [0060.597] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.597] SetEndOfFile (hFile=0x22c) returned 1 [0060.598] CloseHandle (hObject=0x22c) returned 1 [0060.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0060.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.598] lstrlenW (lpString=".doc") returned 4 [0060.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.598] lstrlenW (lpString=".docx") returned 5 [0060.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.598] lstrlenW (lpString=".pdf") returned 4 [0060.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.598] lstrlenW (lpString=".xls") returned 4 [0060.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.599] lstrlenW (lpString=".xlsx") returned 5 [0060.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.599] lstrlenW (lpString=".ppt") returned 4 [0060.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.599] lstrlenW (lpString=".zip") returned 4 [0060.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.599] lstrlenW (lpString=".rar") returned 4 [0060.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".bz2") returned 4 [0060.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString=".7z") returned 3 [0060.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.599] lstrlenW (lpString=".dbf") returned 4 [0060.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.599] lstrlenW (lpString=".1cd") returned 4 [0060.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0060.599] lstrlenW (lpString=".jpg") returned 4 [0060.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.600] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8070) returned 1 [0060.600] CloseHandle (hObject=0x22c) returned 1 [0060.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0060.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.600] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.600] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.601] GetLastError () returned 0x0 [0060.601] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0060.602] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0060.603] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.603] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.604] SetEndOfFile (hFile=0x160) returned 1 [0060.604] CloseHandle (hObject=0x160) returned 1 [0060.604] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.604] SetEndOfFile (hFile=0x22c) returned 1 [0060.605] CloseHandle (hObject=0x22c) returned 1 [0060.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0060.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.605] lstrlenW (lpString=".doc") returned 4 [0060.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.605] lstrlenW (lpString=".docx") returned 5 [0060.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.605] lstrlenW (lpString=".pdf") returned 4 [0060.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.605] lstrlenW (lpString=".xls") returned 4 [0060.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.605] lstrlenW (lpString=".xlsx") returned 5 [0060.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.606] lstrlenW (lpString=".ppt") returned 4 [0060.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.606] lstrlenW (lpString=".zip") returned 4 [0060.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.606] lstrlenW (lpString=".rar") returned 4 [0060.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString=".bz2") returned 4 [0060.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString=".7z") returned 3 [0060.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.606] lstrlenW (lpString=".dbf") returned 4 [0060.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.606] lstrlenW (lpString=".1cd") returned 4 [0060.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0060.606] lstrlenW (lpString=".jpg") returned 4 [0060.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.606] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9304) returned 1 [0060.606] CloseHandle (hObject=0x22c) returned 1 [0060.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0060.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.607] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.607] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.607] GetLastError () returned 0x0 [0060.607] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2458, lpOverlapped=0x0) returned 1 [0060.609] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0060.610] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.610] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.610] SetEndOfFile (hFile=0x160) returned 1 [0060.610] CloseHandle (hObject=0x160) returned 1 [0060.611] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.611] SetEndOfFile (hFile=0x22c) returned 1 [0060.611] CloseHandle (hObject=0x22c) returned 1 [0060.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.612] lstrlenW (lpString=".doc") returned 4 [0060.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".docx") returned 5 [0060.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.612] lstrlenW (lpString=".pdf") returned 4 [0060.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".xls") returned 4 [0060.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.612] lstrlenW (lpString=".xlsx") returned 5 [0060.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.612] lstrlenW (lpString=".ppt") returned 4 [0060.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.612] lstrlenW (lpString=".zip") returned 4 [0060.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.612] lstrlenW (lpString=".rar") returned 4 [0060.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".bz2") returned 4 [0060.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".7z") returned 3 [0060.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.613] lstrlenW (lpString=".dbf") returned 4 [0060.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.613] lstrlenW (lpString=".1cd") returned 4 [0060.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0060.613] lstrlenW (lpString=".jpg") returned 4 [0060.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.613] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4024) returned 1 [0060.613] CloseHandle (hObject=0x22c) returned 1 [0060.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0060.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0060.614] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.614] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0060.614] GetLastError () returned 0x0 [0060.614] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0060.822] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0060.823] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.824] WriteFile (in: hFile=0x160, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.824] SetEndOfFile (hFile=0x160) returned 1 [0060.924] CloseHandle (hObject=0x160) returned 1 [0060.924] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.924] SetEndOfFile (hFile=0x22c) returned 1 [0060.925] CloseHandle (hObject=0x22c) returned 1 [0060.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0061.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.255] lstrlenW (lpString=".doc") returned 4 [0061.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.255] lstrlenW (lpString=".docx") returned 5 [0061.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.266] lstrlenW (lpString=".pdf") returned 4 [0061.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.270] lstrlenW (lpString=".xls") returned 4 [0061.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.282] lstrlenW (lpString=".xlsx") returned 5 [0061.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.286] lstrlenW (lpString=".ppt") returned 4 [0061.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.299] lstrlenW (lpString=".zip") returned 4 [0061.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.302] lstrlenW (lpString=".rar") returned 4 [0061.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.304] lstrlenW (lpString=".bz2") returned 4 [0061.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString=".7z") returned 3 [0061.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.316] lstrlenW (lpString=".dbf") returned 4 [0061.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.328] lstrlenW (lpString=".1cd") returned 4 [0061.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0061.334] lstrlenW (lpString=".jpg") returned 4 [0061.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.359] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2644) returned 1 [0062.359] CloseHandle (hObject=0x1f4) returned 1 [0062.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0062.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.359] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.359] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.360] GetLastError () returned 0x0 [0062.360] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa54, lpOverlapped=0x0) returned 1 [0062.362] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0062.362] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.362] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.363] SetEndOfFile (hFile=0x1bc) returned 1 [0062.363] CloseHandle (hObject=0x1bc) returned 1 [0062.363] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.363] SetEndOfFile (hFile=0x1f4) returned 1 [0062.364] CloseHandle (hObject=0x1f4) returned 1 [0062.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0062.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.364] lstrlenW (lpString=".doc") returned 4 [0062.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.364] lstrlenW (lpString=".docx") returned 5 [0062.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.364] lstrlenW (lpString=".pdf") returned 4 [0062.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.364] lstrlenW (lpString=".xls") returned 4 [0062.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.364] lstrlenW (lpString=".xlsx") returned 5 [0062.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.364] lstrlenW (lpString=".ppt") returned 4 [0062.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.365] lstrlenW (lpString=".zip") returned 4 [0062.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.365] lstrlenW (lpString=".rar") returned 4 [0062.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.365] lstrlenW (lpString=".bz2") returned 4 [0062.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.365] lstrlenW (lpString=".7z") returned 3 [0062.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.365] lstrlenW (lpString=".dbf") returned 4 [0062.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.365] lstrlenW (lpString=".1cd") returned 4 [0062.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0062.365] lstrlenW (lpString=".jpg") returned 4 [0062.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.366] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1044) returned 1 [0062.366] CloseHandle (hObject=0x1f4) returned 1 [0062.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0062.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.366] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.366] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.366] GetLastError () returned 0x0 [0062.366] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x414, lpOverlapped=0x0) returned 1 [0062.368] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x420, lpOverlapped=0x0) returned 1 [0062.369] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.369] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.369] SetEndOfFile (hFile=0x1bc) returned 1 [0062.369] CloseHandle (hObject=0x1bc) returned 1 [0062.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.369] SetEndOfFile (hFile=0x1f4) returned 1 [0062.370] CloseHandle (hObject=0x1f4) returned 1 [0062.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString=".doc") returned 4 [0062.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString=".docx") returned 5 [0062.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.371] lstrlenW (lpString=".pdf") returned 4 [0062.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString=".xls") returned 4 [0062.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.371] lstrlenW (lpString=".xlsx") returned 5 [0062.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.371] lstrlenW (lpString=".ppt") returned 4 [0062.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString=".zip") returned 4 [0062.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.371] lstrlenW (lpString=".rar") returned 4 [0062.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString=".bz2") returned 4 [0062.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString=".7z") returned 3 [0062.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString=".dbf") returned 4 [0062.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString=".1cd") returned 4 [0062.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0062.371] lstrlenW (lpString=".jpg") returned 4 [0062.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.372] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2166) returned 1 [0062.372] CloseHandle (hObject=0x1f4) returned 1 [0062.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0062.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.372] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.372] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.372] GetLastError () returned 0x0 [0062.373] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x876, lpOverlapped=0x0) returned 1 [0062.374] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x880, lpOverlapped=0x0) returned 1 [0062.375] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.375] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.375] SetEndOfFile (hFile=0x1bc) returned 1 [0062.375] CloseHandle (hObject=0x1bc) returned 1 [0062.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.375] SetEndOfFile (hFile=0x1f4) returned 1 [0062.376] CloseHandle (hObject=0x1f4) returned 1 [0062.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString=".doc") returned 4 [0062.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".docx") returned 5 [0062.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.377] lstrlenW (lpString=".pdf") returned 4 [0062.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".xls") returned 4 [0062.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.377] lstrlenW (lpString=".xlsx") returned 5 [0062.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.377] lstrlenW (lpString=".ppt") returned 4 [0062.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString=".zip") returned 4 [0062.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.377] lstrlenW (lpString=".rar") returned 4 [0062.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".bz2") returned 4 [0062.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".7z") returned 3 [0062.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString=".dbf") returned 4 [0062.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString=".1cd") returned 4 [0062.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0062.377] lstrlenW (lpString=".jpg") returned 4 [0062.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.378] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1712) returned 1 [0062.378] CloseHandle (hObject=0x1f4) returned 1 [0062.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0062.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.379] GetLastError () returned 0x0 [0062.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0062.381] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0062.382] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.382] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.382] SetEndOfFile (hFile=0x1bc) returned 1 [0062.382] CloseHandle (hObject=0x1bc) returned 1 [0062.382] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.382] SetEndOfFile (hFile=0x1f4) returned 1 [0062.383] CloseHandle (hObject=0x1f4) returned 1 [0062.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0062.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.383] lstrlenW (lpString=".doc") returned 4 [0062.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.383] lstrlenW (lpString=".docx") returned 5 [0062.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.384] lstrlenW (lpString=".pdf") returned 4 [0062.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString=".xls") returned 4 [0062.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.384] lstrlenW (lpString=".xlsx") returned 5 [0062.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.384] lstrlenW (lpString=".ppt") returned 4 [0062.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.384] lstrlenW (lpString=".zip") returned 4 [0062.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.384] lstrlenW (lpString=".rar") returned 4 [0062.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString=".bz2") returned 4 [0062.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString=".7z") returned 3 [0062.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.384] lstrlenW (lpString=".dbf") returned 4 [0062.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.384] lstrlenW (lpString=".1cd") returned 4 [0062.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0062.384] lstrlenW (lpString=".jpg") returned 4 [0062.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.385] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8366) returned 1 [0062.385] CloseHandle (hObject=0x1f4) returned 1 [0062.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0062.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.385] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.385] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.385] GetLastError () returned 0x0 [0062.385] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0062.387] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0062.388] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.388] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.388] SetEndOfFile (hFile=0x1bc) returned 1 [0062.388] CloseHandle (hObject=0x1bc) returned 1 [0062.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.389] SetEndOfFile (hFile=0x1f4) returned 1 [0062.389] CloseHandle (hObject=0x1f4) returned 1 [0062.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.390] lstrlenW (lpString=".doc") returned 4 [0062.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.390] lstrlenW (lpString=".docx") returned 5 [0062.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.390] lstrlenW (lpString=".pdf") returned 4 [0062.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.390] lstrlenW (lpString=".xls") returned 4 [0062.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.390] lstrlenW (lpString=".xlsx") returned 5 [0062.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.390] lstrlenW (lpString=".ppt") returned 4 [0062.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.390] lstrlenW (lpString=".zip") returned 4 [0062.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.390] lstrlenW (lpString=".rar") returned 4 [0062.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.390] lstrlenW (lpString=".bz2") returned 4 [0062.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.390] lstrlenW (lpString=".7z") returned 3 [0062.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.390] lstrlenW (lpString=".dbf") returned 4 [0062.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.391] lstrlenW (lpString=".1cd") returned 4 [0062.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0062.391] lstrlenW (lpString=".jpg") returned 4 [0062.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.391] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4976) returned 1 [0062.391] CloseHandle (hObject=0x1f4) returned 1 [0062.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0062.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.392] GetLastError () returned 0x0 [0062.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1370, lpOverlapped=0x0) returned 1 [0062.393] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0062.394] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.395] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.395] SetEndOfFile (hFile=0x1bc) returned 1 [0062.395] CloseHandle (hObject=0x1bc) returned 1 [0062.395] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.395] SetEndOfFile (hFile=0x1f4) returned 1 [0062.909] CloseHandle (hObject=0x1f4) returned 1 [0062.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0062.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.941] lstrlenW (lpString=".doc") returned 4 [0062.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.941] lstrlenW (lpString=".docx") returned 5 [0062.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.941] lstrlenW (lpString=".pdf") returned 4 [0062.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.941] lstrlenW (lpString=".xls") returned 4 [0062.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.941] lstrlenW (lpString=".xlsx") returned 5 [0062.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.942] lstrlenW (lpString=".ppt") returned 4 [0062.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.942] lstrlenW (lpString=".zip") returned 4 [0062.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.942] lstrlenW (lpString=".rar") returned 4 [0062.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".bz2") returned 4 [0062.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".7z") returned 3 [0062.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.942] lstrlenW (lpString=".dbf") returned 4 [0062.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.942] lstrlenW (lpString=".1cd") returned 4 [0062.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0062.942] lstrlenW (lpString=".jpg") returned 4 [0062.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.942] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2732) returned 1 [0062.942] CloseHandle (hObject=0x1f4) returned 1 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.944] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.944] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.944] GetLastError () returned 0x0 [0062.944] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xaac, lpOverlapped=0x0) returned 1 [0062.948] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0062.949] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.949] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.949] SetEndOfFile (hFile=0x1bc) returned 1 [0062.949] CloseHandle (hObject=0x1bc) returned 1 [0062.949] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.949] SetEndOfFile (hFile=0x1f4) returned 1 [0062.950] CloseHandle (hObject=0x1f4) returned 1 [0062.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString=".doc") returned 4 [0062.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString=".docx") returned 5 [0062.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.951] lstrlenW (lpString=".pdf") returned 4 [0062.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString=".xls") returned 4 [0062.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.951] lstrlenW (lpString=".xlsx") returned 5 [0062.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.951] lstrlenW (lpString=".ppt") returned 4 [0062.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString=".zip") returned 4 [0062.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.951] lstrlenW (lpString=".rar") returned 4 [0062.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString=".bz2") returned 4 [0062.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString=".7z") returned 3 [0062.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString=".dbf") returned 4 [0062.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString=".1cd") returned 4 [0062.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.951] lstrlenW (lpString=".jpg") returned 4 [0062.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.952] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7176) returned 1 [0062.952] CloseHandle (hObject=0x1f4) returned 1 [0062.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0062.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.953] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.953] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.953] GetLastError () returned 0x0 [0062.953] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0062.955] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0062.955] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.955] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.956] SetEndOfFile (hFile=0x1bc) returned 1 [0062.956] CloseHandle (hObject=0x1bc) returned 1 [0062.956] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.956] SetEndOfFile (hFile=0x1f4) returned 1 [0062.957] CloseHandle (hObject=0x1f4) returned 1 [0062.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0062.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.957] lstrlenW (lpString=".doc") returned 4 [0062.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.957] lstrlenW (lpString=".docx") returned 5 [0062.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.957] lstrlenW (lpString=".pdf") returned 4 [0062.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString=".xls") returned 4 [0062.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.958] lstrlenW (lpString=".xlsx") returned 5 [0062.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.958] lstrlenW (lpString=".ppt") returned 4 [0062.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.958] lstrlenW (lpString=".zip") returned 4 [0062.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.958] lstrlenW (lpString=".rar") returned 4 [0062.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString=".bz2") returned 4 [0062.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString=".7z") returned 3 [0062.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.958] lstrlenW (lpString=".dbf") returned 4 [0062.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.958] lstrlenW (lpString=".1cd") returned 4 [0062.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.958] lstrlenW (lpString=".jpg") returned 4 [0062.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.958] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3494) returned 1 [0062.959] CloseHandle (hObject=0x1f4) returned 1 [0062.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0062.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.959] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.959] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.959] GetLastError () returned 0x0 [0062.959] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xda6, lpOverlapped=0x0) returned 1 [0062.961] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0062.962] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.962] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.962] SetEndOfFile (hFile=0x1bc) returned 1 [0062.962] CloseHandle (hObject=0x1bc) returned 1 [0062.962] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.962] SetEndOfFile (hFile=0x1f4) returned 1 [0062.963] CloseHandle (hObject=0x1f4) returned 1 [0062.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0062.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.963] lstrlenW (lpString=".doc") returned 4 [0062.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.963] lstrlenW (lpString=".docx") returned 5 [0062.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.963] lstrlenW (lpString=".pdf") returned 4 [0062.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.963] lstrlenW (lpString=".xls") returned 4 [0062.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.963] lstrlenW (lpString=".xlsx") returned 5 [0062.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.964] lstrlenW (lpString=".ppt") returned 4 [0062.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.964] lstrlenW (lpString=".zip") returned 4 [0062.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.964] lstrlenW (lpString=".rar") returned 4 [0062.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.964] lstrlenW (lpString=".bz2") returned 4 [0062.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.964] lstrlenW (lpString=".7z") returned 3 [0062.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.964] lstrlenW (lpString=".dbf") returned 4 [0062.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.964] lstrlenW (lpString=".1cd") returned 4 [0062.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.964] lstrlenW (lpString=".jpg") returned 4 [0062.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.964] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=14996) returned 1 [0062.964] CloseHandle (hObject=0x1f4) returned 1 [0062.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0062.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.965] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.965] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.965] GetLastError () returned 0x0 [0062.965] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0062.967] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0062.968] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.968] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.968] SetEndOfFile (hFile=0x1bc) returned 1 [0062.969] CloseHandle (hObject=0x1bc) returned 1 [0062.969] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.969] SetEndOfFile (hFile=0x1f4) returned 1 [0062.970] CloseHandle (hObject=0x1f4) returned 1 [0062.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0062.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.970] lstrlenW (lpString=".doc") returned 4 [0062.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.970] lstrlenW (lpString=".docx") returned 5 [0062.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.970] lstrlenW (lpString=".pdf") returned 4 [0062.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.970] lstrlenW (lpString=".xls") returned 4 [0062.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.970] lstrlenW (lpString=".xlsx") returned 5 [0062.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.970] lstrlenW (lpString=".ppt") returned 4 [0062.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.970] lstrlenW (lpString=".zip") returned 4 [0062.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.970] lstrlenW (lpString=".rar") returned 4 [0062.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.971] lstrlenW (lpString=".bz2") returned 4 [0062.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.971] lstrlenW (lpString=".7z") returned 3 [0062.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.971] lstrlenW (lpString=".dbf") returned 4 [0062.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.971] lstrlenW (lpString=".1cd") returned 4 [0062.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0062.971] lstrlenW (lpString=".jpg") returned 4 [0062.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.971] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1874) returned 1 [0062.971] CloseHandle (hObject=0x1f4) returned 1 [0062.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0062.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.971] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.972] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.972] GetLastError () returned 0x0 [0062.972] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x752, lpOverlapped=0x0) returned 1 [0062.974] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x760, lpOverlapped=0x0) returned 1 [0062.975] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.975] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.975] SetEndOfFile (hFile=0x1bc) returned 1 [0062.975] CloseHandle (hObject=0x1bc) returned 1 [0062.975] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.975] SetEndOfFile (hFile=0x1f4) returned 1 [0062.976] CloseHandle (hObject=0x1f4) returned 1 [0062.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0062.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.976] lstrlenW (lpString=".doc") returned 4 [0062.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.976] lstrlenW (lpString=".docx") returned 5 [0062.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.976] lstrlenW (lpString=".pdf") returned 4 [0062.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString=".xls") returned 4 [0062.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.977] lstrlenW (lpString=".xlsx") returned 5 [0062.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.977] lstrlenW (lpString=".ppt") returned 4 [0062.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.977] lstrlenW (lpString=".zip") returned 4 [0062.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.977] lstrlenW (lpString=".rar") returned 4 [0062.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString=".bz2") returned 4 [0062.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString=".7z") returned 3 [0062.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.977] lstrlenW (lpString=".dbf") returned 4 [0062.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.977] lstrlenW (lpString=".1cd") returned 4 [0062.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.977] lstrlenW (lpString=".jpg") returned 4 [0062.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.977] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3948) returned 1 [0062.977] CloseHandle (hObject=0x1f4) returned 1 [0062.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0062.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.978] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.978] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.978] GetLastError () returned 0x0 [0062.978] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf6c, lpOverlapped=0x0) returned 1 [0063.583] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0063.584] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.584] WriteFile (in: hFile=0x1bc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.584] SetEndOfFile (hFile=0x1bc) returned 1 [0063.899] CloseHandle (hObject=0x1bc) returned 1 [0063.899] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.899] SetEndOfFile (hFile=0x1f4) returned 1 [0063.900] CloseHandle (hObject=0x1f4) returned 1 [0063.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString=".doc") returned 4 [0063.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString=".docx") returned 5 [0063.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.914] lstrlenW (lpString=".pdf") returned 4 [0063.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString=".xls") returned 4 [0063.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.914] lstrlenW (lpString=".xlsx") returned 5 [0063.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.914] lstrlenW (lpString=".ppt") returned 4 [0063.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString=".zip") returned 4 [0063.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.914] lstrlenW (lpString=".rar") returned 4 [0063.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString=".bz2") returned 4 [0063.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString=".7z") returned 3 [0063.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString=".dbf") returned 4 [0063.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString=".1cd") returned 4 [0063.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0063.914] lstrlenW (lpString=".jpg") returned 4 [0063.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.943] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8256) returned 1 [0063.943] CloseHandle (hObject=0x160) returned 1 [0063.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0063.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.944] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.944] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.944] GetLastError () returned 0x0 [0063.944] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2040, lpOverlapped=0x0) returned 1 [0063.953] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0063.954] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.954] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.954] SetEndOfFile (hFile=0x158) returned 1 [0063.954] CloseHandle (hObject=0x158) returned 1 [0063.954] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.954] SetEndOfFile (hFile=0x160) returned 1 [0063.955] CloseHandle (hObject=0x160) returned 1 [0063.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0063.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.955] lstrlenW (lpString=".doc") returned 4 [0063.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString=".docx") returned 5 [0063.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.956] lstrlenW (lpString=".pdf") returned 4 [0063.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString=".xls") returned 4 [0063.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.956] lstrlenW (lpString=".xlsx") returned 5 [0063.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.956] lstrlenW (lpString=".ppt") returned 4 [0063.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.956] lstrlenW (lpString=".zip") returned 4 [0063.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.956] lstrlenW (lpString=".rar") returned 4 [0063.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString=".bz2") returned 4 [0063.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString=".7z") returned 3 [0063.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.956] lstrlenW (lpString=".dbf") returned 4 [0063.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.956] lstrlenW (lpString=".1cd") returned 4 [0063.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0063.956] lstrlenW (lpString=".jpg") returned 4 [0063.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.957] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2690) returned 1 [0063.957] CloseHandle (hObject=0x160) returned 1 [0063.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0063.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.958] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.958] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.958] GetLastError () returned 0x0 [0063.958] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa82, lpOverlapped=0x0) returned 1 [0063.960] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0063.961] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.961] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.961] SetEndOfFile (hFile=0x158) returned 1 [0063.961] CloseHandle (hObject=0x158) returned 1 [0063.961] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.961] SetEndOfFile (hFile=0x160) returned 1 [0063.962] CloseHandle (hObject=0x160) returned 1 [0063.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0063.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.962] lstrlenW (lpString=".doc") returned 4 [0063.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.962] lstrlenW (lpString=".docx") returned 5 [0063.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.962] lstrlenW (lpString=".pdf") returned 4 [0063.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.962] lstrlenW (lpString=".xls") returned 4 [0063.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.962] lstrlenW (lpString=".xlsx") returned 5 [0063.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.962] lstrlenW (lpString=".ppt") returned 4 [0063.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.962] lstrlenW (lpString=".zip") returned 4 [0063.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.963] lstrlenW (lpString=".rar") returned 4 [0063.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.963] lstrlenW (lpString=".bz2") returned 4 [0063.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.963] lstrlenW (lpString=".7z") returned 3 [0063.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.963] lstrlenW (lpString=".dbf") returned 4 [0063.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.963] lstrlenW (lpString=".1cd") returned 4 [0063.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0063.963] lstrlenW (lpString=".jpg") returned 4 [0063.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.963] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2832) returned 1 [0063.963] CloseHandle (hObject=0x160) returned 1 [0063.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0063.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.964] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.964] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.964] GetLastError () returned 0x0 [0063.964] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb10, lpOverlapped=0x0) returned 1 [0063.966] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0063.966] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.966] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.967] SetEndOfFile (hFile=0x158) returned 1 [0063.967] CloseHandle (hObject=0x158) returned 1 [0063.967] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.967] SetEndOfFile (hFile=0x160) returned 1 [0063.967] CloseHandle (hObject=0x160) returned 1 [0063.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0063.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.968] lstrlenW (lpString=".doc") returned 4 [0063.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.968] lstrlenW (lpString=".docx") returned 5 [0063.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.968] lstrlenW (lpString=".pdf") returned 4 [0063.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.968] lstrlenW (lpString=".xls") returned 4 [0063.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.968] lstrlenW (lpString=".xlsx") returned 5 [0063.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.968] lstrlenW (lpString=".ppt") returned 4 [0063.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.968] lstrlenW (lpString=".zip") returned 4 [0063.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.968] lstrlenW (lpString=".rar") returned 4 [0063.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.968] lstrlenW (lpString=".bz2") returned 4 [0063.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.968] lstrlenW (lpString=".7z") returned 3 [0063.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.969] lstrlenW (lpString=".dbf") returned 4 [0063.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.969] lstrlenW (lpString=".1cd") returned 4 [0063.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0063.969] lstrlenW (lpString=".jpg") returned 4 [0063.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.969] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=37974) returned 1 [0063.969] CloseHandle (hObject=0x160) returned 1 [0063.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0063.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.969] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.969] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.970] GetLastError () returned 0x0 [0063.970] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9456, lpOverlapped=0x0) returned 1 [0063.972] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0063.973] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.973] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.973] SetEndOfFile (hFile=0x158) returned 1 [0063.973] CloseHandle (hObject=0x158) returned 1 [0063.973] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.973] SetEndOfFile (hFile=0x160) returned 1 [0063.974] CloseHandle (hObject=0x160) returned 1 [0063.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.975] lstrlenW (lpString=".doc") returned 4 [0063.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.975] lstrlenW (lpString=".docx") returned 5 [0063.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.975] lstrlenW (lpString=".pdf") returned 4 [0063.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.975] lstrlenW (lpString=".xls") returned 4 [0063.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.975] lstrlenW (lpString=".xlsx") returned 5 [0063.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.975] lstrlenW (lpString=".ppt") returned 4 [0063.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.975] lstrlenW (lpString=".zip") returned 4 [0063.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.975] lstrlenW (lpString=".rar") returned 4 [0063.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.975] lstrlenW (lpString=".bz2") returned 4 [0063.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.975] lstrlenW (lpString=".7z") returned 3 [0063.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.975] lstrlenW (lpString=".dbf") returned 4 [0063.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.976] lstrlenW (lpString=".1cd") returned 4 [0063.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0063.976] lstrlenW (lpString=".jpg") returned 4 [0063.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.976] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=40030) returned 1 [0063.976] CloseHandle (hObject=0x160) returned 1 [0063.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0063.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.976] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.976] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0063.977] GetLastError () returned 0x0 [0063.977] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0063.979] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0063.980] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.980] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.981] SetEndOfFile (hFile=0x158) returned 1 [0063.981] CloseHandle (hObject=0x158) returned 1 [0063.981] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.981] SetEndOfFile (hFile=0x160) returned 1 [0063.982] CloseHandle (hObject=0x160) returned 1 [0063.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.982] lstrlenW (lpString=".doc") returned 4 [0063.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.982] lstrlenW (lpString=".docx") returned 5 [0063.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.982] lstrlenW (lpString=".pdf") returned 4 [0063.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.982] lstrlenW (lpString=".xls") returned 4 [0063.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.982] lstrlenW (lpString=".xlsx") returned 5 [0063.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.982] lstrlenW (lpString=".ppt") returned 4 [0063.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.983] lstrlenW (lpString=".zip") returned 4 [0063.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.983] lstrlenW (lpString=".rar") returned 4 [0063.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.983] lstrlenW (lpString=".bz2") returned 4 [0063.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.983] lstrlenW (lpString=".7z") returned 3 [0063.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.983] lstrlenW (lpString=".dbf") returned 4 [0063.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.983] lstrlenW (lpString=".1cd") returned 4 [0063.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0063.983] lstrlenW (lpString=".jpg") returned 4 [0063.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.984] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=792) returned 1 [0063.984] CloseHandle (hObject=0x160) returned 1 [0063.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0063.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0063.984] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.984] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.204] GetLastError () returned 0x0 [0064.208] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x318, lpOverlapped=0x0) returned 1 [0064.248] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x320, lpOverlapped=0x0) returned 1 [0064.785] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.785] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.785] SetEndOfFile (hFile=0x1ec) returned 1 [0064.836] CloseHandle (hObject=0x1ec) returned 1 [0064.847] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.847] SetEndOfFile (hFile=0x160) returned 1 [0064.861] CloseHandle (hObject=0x160) returned 1 [0064.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0064.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.869] lstrlenW (lpString=".doc") returned 4 [0064.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.869] lstrlenW (lpString=".docx") returned 5 [0064.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.869] lstrlenW (lpString=".pdf") returned 4 [0064.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.869] lstrlenW (lpString=".xls") returned 4 [0064.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.869] lstrlenW (lpString=".xlsx") returned 5 [0064.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.869] lstrlenW (lpString=".ppt") returned 4 [0064.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.869] lstrlenW (lpString=".zip") returned 4 [0064.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.869] lstrlenW (lpString=".rar") returned 4 [0064.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.870] lstrlenW (lpString=".bz2") returned 4 [0064.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.870] lstrlenW (lpString=".7z") returned 3 [0064.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.870] lstrlenW (lpString=".dbf") returned 4 [0064.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.870] lstrlenW (lpString=".1cd") returned 4 [0064.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0064.870] lstrlenW (lpString=".jpg") returned 4 [0064.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.870] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=712) returned 1 [0064.870] CloseHandle (hObject=0x160) returned 1 [0064.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0064.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0064.876] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.876] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.876] GetLastError () returned 0x0 [0064.876] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0064.877] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0064.878] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.878] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.878] SetEndOfFile (hFile=0x1fc) returned 1 [0064.878] CloseHandle (hObject=0x1fc) returned 1 [0064.878] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.878] SetEndOfFile (hFile=0x160) returned 1 [0064.879] CloseHandle (hObject=0x160) returned 1 [0064.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0064.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.879] lstrlenW (lpString=".doc") returned 4 [0064.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.879] lstrlenW (lpString=".docx") returned 5 [0064.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.880] lstrlenW (lpString=".pdf") returned 4 [0064.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString=".xls") returned 4 [0064.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.880] lstrlenW (lpString=".xlsx") returned 5 [0064.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.880] lstrlenW (lpString=".ppt") returned 4 [0064.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.880] lstrlenW (lpString=".zip") returned 4 [0064.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.880] lstrlenW (lpString=".rar") returned 4 [0064.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString=".bz2") returned 4 [0064.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString=".7z") returned 3 [0064.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.880] lstrlenW (lpString=".dbf") returned 4 [0064.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.880] lstrlenW (lpString=".1cd") returned 4 [0064.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0064.880] lstrlenW (lpString=".jpg") returned 4 [0064.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.881] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1932) returned 1 [0064.881] CloseHandle (hObject=0x160) returned 1 [0064.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0064.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0064.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.881] GetLastError () returned 0x0 [0064.881] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x78c, lpOverlapped=0x0) returned 1 [0064.883] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x790, lpOverlapped=0x0) returned 1 [0064.884] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.884] SetEndOfFile (hFile=0x1fc) returned 1 [0064.884] CloseHandle (hObject=0x1fc) returned 1 [0064.884] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.884] SetEndOfFile (hFile=0x160) returned 1 [0064.885] CloseHandle (hObject=0x160) returned 1 [0064.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString=".doc") returned 4 [0064.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString=".docx") returned 5 [0064.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.886] lstrlenW (lpString=".pdf") returned 4 [0064.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString=".xls") returned 4 [0064.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.886] lstrlenW (lpString=".xlsx") returned 5 [0064.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.886] lstrlenW (lpString=".ppt") returned 4 [0064.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString=".zip") returned 4 [0064.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.886] lstrlenW (lpString=".rar") returned 4 [0064.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString=".bz2") returned 4 [0064.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString=".7z") returned 3 [0064.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString=".dbf") returned 4 [0064.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString=".1cd") returned 4 [0064.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0064.886] lstrlenW (lpString=".jpg") returned 4 [0064.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.887] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2952) returned 1 [0064.887] CloseHandle (hObject=0x160) returned 1 [0064.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0064.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0064.888] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.888] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.888] GetLastError () returned 0x0 [0064.888] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb88, lpOverlapped=0x0) returned 1 [0064.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0064.890] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.891] SetEndOfFile (hFile=0x1fc) returned 1 [0064.891] CloseHandle (hObject=0x1fc) returned 1 [0064.891] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.891] SetEndOfFile (hFile=0x160) returned 1 [0064.892] CloseHandle (hObject=0x160) returned 1 [0064.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0064.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.892] lstrlenW (lpString=".doc") returned 4 [0064.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.892] lstrlenW (lpString=".docx") returned 5 [0064.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.892] lstrlenW (lpString=".pdf") returned 4 [0064.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.892] lstrlenW (lpString=".xls") returned 4 [0064.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.892] lstrlenW (lpString=".xlsx") returned 5 [0064.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.892] lstrlenW (lpString=".ppt") returned 4 [0064.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.893] lstrlenW (lpString=".zip") returned 4 [0064.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.893] lstrlenW (lpString=".rar") returned 4 [0064.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.893] lstrlenW (lpString=".bz2") returned 4 [0064.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.893] lstrlenW (lpString=".7z") returned 3 [0064.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.893] lstrlenW (lpString=".dbf") returned 4 [0064.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.893] lstrlenW (lpString=".1cd") returned 4 [0064.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0064.893] lstrlenW (lpString=".jpg") returned 4 [0064.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.893] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9992) returned 1 [0064.893] CloseHandle (hObject=0x160) returned 1 [0064.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0064.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0064.894] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.894] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.894] GetLastError () returned 0x0 [0064.894] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2708, lpOverlapped=0x0) returned 1 [0065.127] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2710, lpOverlapped=0x0) returned 1 [0065.128] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.128] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.128] SetEndOfFile (hFile=0x1fc) returned 1 [0065.128] CloseHandle (hObject=0x1fc) returned 1 [0065.128] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.128] SetEndOfFile (hFile=0x160) returned 1 [0065.129] CloseHandle (hObject=0x160) returned 1 [0065.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0065.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.178] lstrlenW (lpString=".doc") returned 4 [0065.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.178] lstrlenW (lpString=".docx") returned 5 [0065.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.178] lstrlenW (lpString=".pdf") returned 4 [0065.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.178] lstrlenW (lpString=".xls") returned 4 [0065.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.178] lstrlenW (lpString=".xlsx") returned 5 [0065.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.178] lstrlenW (lpString=".ppt") returned 4 [0065.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.178] lstrlenW (lpString=".zip") returned 4 [0065.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.179] lstrlenW (lpString=".rar") returned 4 [0065.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.179] lstrlenW (lpString=".bz2") returned 4 [0065.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.179] lstrlenW (lpString=".7z") returned 3 [0065.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.179] lstrlenW (lpString=".dbf") returned 4 [0065.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.179] lstrlenW (lpString=".1cd") returned 4 [0065.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0065.179] lstrlenW (lpString=".jpg") returned 4 [0065.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.314] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2080) returned 1 [0066.314] CloseHandle (hObject=0x1f4) returned 1 [0066.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0066.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.332] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.339] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.348] GetLastError () returned 0x0 [0066.348] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x820, lpOverlapped=0x0) returned 1 [0066.350] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x830, lpOverlapped=0x0) returned 1 [0066.352] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.352] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.352] SetEndOfFile (hFile=0x1ec) returned 1 [0066.352] CloseHandle (hObject=0x1ec) returned 1 [0066.353] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.353] SetEndOfFile (hFile=0x1f4) returned 1 [0066.353] CloseHandle (hObject=0x1f4) returned 1 [0066.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.354] lstrlenW (lpString=".doc") returned 4 [0066.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString=".docx") returned 5 [0066.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.354] lstrlenW (lpString=".pdf") returned 4 [0066.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString=".xls") returned 4 [0066.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.354] lstrlenW (lpString=".xlsx") returned 5 [0066.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.354] lstrlenW (lpString=".ppt") returned 4 [0066.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.354] lstrlenW (lpString=".zip") returned 4 [0066.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.354] lstrlenW (lpString=".rar") returned 4 [0066.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString=".bz2") returned 4 [0066.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString=".7z") returned 3 [0066.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.354] lstrlenW (lpString=".dbf") returned 4 [0066.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.354] lstrlenW (lpString=".1cd") returned 4 [0066.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0066.355] lstrlenW (lpString=".jpg") returned 4 [0066.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.355] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3796) returned 1 [0066.355] CloseHandle (hObject=0x1f4) returned 1 [0066.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0066.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.355] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.355] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.356] GetLastError () returned 0x0 [0066.356] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xed4, lpOverlapped=0x0) returned 1 [0066.357] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0066.358] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.358] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.358] SetEndOfFile (hFile=0x1ec) returned 1 [0066.358] CloseHandle (hObject=0x1ec) returned 1 [0066.359] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.359] SetEndOfFile (hFile=0x1f4) returned 1 [0066.360] CloseHandle (hObject=0x1f4) returned 1 [0066.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0066.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.361] lstrlenW (lpString=".doc") returned 4 [0066.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.361] lstrlenW (lpString=".docx") returned 5 [0066.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.361] lstrlenW (lpString=".pdf") returned 4 [0066.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.361] lstrlenW (lpString=".xls") returned 4 [0066.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.361] lstrlenW (lpString=".xlsx") returned 5 [0066.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.361] lstrlenW (lpString=".ppt") returned 4 [0066.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.361] lstrlenW (lpString=".zip") returned 4 [0066.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.361] lstrlenW (lpString=".rar") returned 4 [0066.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.361] lstrlenW (lpString=".bz2") returned 4 [0066.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.361] lstrlenW (lpString=".7z") returned 3 [0066.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.362] lstrlenW (lpString=".dbf") returned 4 [0066.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.362] lstrlenW (lpString=".1cd") returned 4 [0066.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0066.362] lstrlenW (lpString=".jpg") returned 4 [0066.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.362] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2024) returned 1 [0066.362] CloseHandle (hObject=0x1f4) returned 1 [0066.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0066.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.362] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.362] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.363] GetLastError () returned 0x0 [0066.363] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7e8, lpOverlapped=0x0) returned 1 [0066.364] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0066.365] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.365] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.365] SetEndOfFile (hFile=0x1ec) returned 1 [0066.365] CloseHandle (hObject=0x1ec) returned 1 [0066.365] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.365] SetEndOfFile (hFile=0x1f4) returned 1 [0066.366] CloseHandle (hObject=0x1f4) returned 1 [0066.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString=".doc") returned 4 [0066.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString=".docx") returned 5 [0066.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.367] lstrlenW (lpString=".pdf") returned 4 [0066.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString=".xls") returned 4 [0066.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.367] lstrlenW (lpString=".xlsx") returned 5 [0066.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.367] lstrlenW (lpString=".ppt") returned 4 [0066.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString=".zip") returned 4 [0066.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.367] lstrlenW (lpString=".rar") returned 4 [0066.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString=".bz2") returned 4 [0066.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString=".7z") returned 3 [0066.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString=".dbf") returned 4 [0066.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString=".1cd") returned 4 [0066.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0066.367] lstrlenW (lpString=".jpg") returned 4 [0066.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.368] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2084) returned 1 [0066.368] CloseHandle (hObject=0x1f4) returned 1 [0066.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0066.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.368] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.368] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.369] GetLastError () returned 0x0 [0066.369] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x824, lpOverlapped=0x0) returned 1 [0066.370] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x830, lpOverlapped=0x0) returned 1 [0066.371] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.371] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.371] SetEndOfFile (hFile=0x1ec) returned 1 [0066.371] CloseHandle (hObject=0x1ec) returned 1 [0066.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.371] SetEndOfFile (hFile=0x1f4) returned 1 [0066.372] CloseHandle (hObject=0x1f4) returned 1 [0066.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0066.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.372] lstrlenW (lpString=".doc") returned 4 [0066.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.372] lstrlenW (lpString=".docx") returned 5 [0066.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.372] lstrlenW (lpString=".pdf") returned 4 [0066.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString=".xls") returned 4 [0066.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.373] lstrlenW (lpString=".xlsx") returned 5 [0066.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.373] lstrlenW (lpString=".ppt") returned 4 [0066.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.373] lstrlenW (lpString=".zip") returned 4 [0066.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.373] lstrlenW (lpString=".rar") returned 4 [0066.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString=".bz2") returned 4 [0066.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString=".7z") returned 3 [0066.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.373] lstrlenW (lpString=".dbf") returned 4 [0066.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.373] lstrlenW (lpString=".1cd") returned 4 [0066.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0066.373] lstrlenW (lpString=".jpg") returned 4 [0066.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.374] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1448) returned 1 [0066.374] CloseHandle (hObject=0x1f4) returned 1 [0066.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0066.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.375] GetLastError () returned 0x0 [0066.375] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0066.376] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0066.378] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.378] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.378] SetEndOfFile (hFile=0x1ec) returned 1 [0066.378] CloseHandle (hObject=0x1ec) returned 1 [0066.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.378] SetEndOfFile (hFile=0x1f4) returned 1 [0066.379] CloseHandle (hObject=0x1f4) returned 1 [0066.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0066.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.379] lstrlenW (lpString=".doc") returned 4 [0066.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.379] lstrlenW (lpString=".docx") returned 5 [0066.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.379] lstrlenW (lpString=".pdf") returned 4 [0066.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.379] lstrlenW (lpString=".xls") returned 4 [0066.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.379] lstrlenW (lpString=".xlsx") returned 5 [0066.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.379] lstrlenW (lpString=".ppt") returned 4 [0066.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.380] lstrlenW (lpString=".zip") returned 4 [0066.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.380] lstrlenW (lpString=".rar") returned 4 [0066.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.380] lstrlenW (lpString=".bz2") returned 4 [0066.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.380] lstrlenW (lpString=".7z") returned 3 [0066.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.380] lstrlenW (lpString=".dbf") returned 4 [0066.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.380] lstrlenW (lpString=".1cd") returned 4 [0066.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0066.380] lstrlenW (lpString=".jpg") returned 4 [0066.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.380] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2996) returned 1 [0066.380] CloseHandle (hObject=0x1f4) returned 1 [0066.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0066.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.381] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.381] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.381] GetLastError () returned 0x0 [0066.381] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0066.507] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0066.511] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.511] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.511] SetEndOfFile (hFile=0x1ec) returned 1 [0067.352] CloseHandle (hObject=0x1ec) returned 1 [0067.353] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.353] SetEndOfFile (hFile=0x1f4) returned 1 [0067.354] CloseHandle (hObject=0x1f4) returned 1 [0067.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0067.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.473] lstrlenW (lpString=".doc") returned 4 [0067.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.473] lstrlenW (lpString=".docx") returned 5 [0067.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.473] lstrlenW (lpString=".pdf") returned 4 [0067.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.473] lstrlenW (lpString=".xls") returned 4 [0067.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.473] lstrlenW (lpString=".xlsx") returned 5 [0067.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.473] lstrlenW (lpString=".ppt") returned 4 [0067.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.473] lstrlenW (lpString=".zip") returned 4 [0067.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.474] lstrlenW (lpString=".rar") returned 4 [0067.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.474] lstrlenW (lpString=".bz2") returned 4 [0067.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.474] lstrlenW (lpString=".7z") returned 3 [0067.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.474] lstrlenW (lpString=".dbf") returned 4 [0067.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.474] lstrlenW (lpString=".1cd") returned 4 [0067.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0067.474] lstrlenW (lpString=".jpg") returned 4 [0067.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.445] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13936) returned 1 [0068.445] CloseHandle (hObject=0x1c8) returned 1 [0068.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0068.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.445] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.445] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.446] GetLastError () returned 0x0 [0068.446] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3670, lpOverlapped=0x0) returned 1 [0068.674] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3680, lpOverlapped=0x0) returned 1 [0068.675] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.675] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.675] SetEndOfFile (hFile=0x1fc) returned 1 [0068.675] CloseHandle (hObject=0x1fc) returned 1 [0068.675] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.675] SetEndOfFile (hFile=0x1c8) returned 1 [0068.676] CloseHandle (hObject=0x1c8) returned 1 [0068.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0068.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString=".doc") returned 4 [0068.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString=".docx") returned 5 [0068.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.677] lstrlenW (lpString=".pdf") returned 4 [0068.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString=".xls") returned 4 [0068.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.677] lstrlenW (lpString=".xlsx") returned 5 [0068.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.677] lstrlenW (lpString=".ppt") returned 4 [0068.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString=".zip") returned 4 [0068.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.677] lstrlenW (lpString=".rar") returned 4 [0068.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString=".bz2") returned 4 [0068.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString=".7z") returned 3 [0068.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString=".dbf") returned 4 [0068.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString=".1cd") returned 4 [0068.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.677] lstrlenW (lpString=".jpg") returned 4 [0068.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString=".pdf") returned 4 [0068.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString=".xls") returned 4 [0068.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.678] lstrlenW (lpString=".xlsx") returned 5 [0068.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.678] lstrlenW (lpString=".ppt") returned 4 [0068.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.678] lstrlenW (lpString=".zip") returned 4 [0068.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.678] lstrlenW (lpString=".rar") returned 4 [0068.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString=".bz2") returned 4 [0068.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString=".7z") returned 3 [0068.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.678] lstrlenW (lpString=".dbf") returned 4 [0068.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.678] lstrlenW (lpString=".1cd") returned 4 [0068.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0068.678] lstrlenW (lpString=".jpg") returned 4 [0068.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.678] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") [0068.679] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=29212) returned 1 [0068.679] CloseHandle (hObject=0x1c8) returned 1 [0068.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0068.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.679] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.679] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.679] GetLastError () returned 0x0 [0068.679] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x721c, lpOverlapped=0x0) returned 1 [0068.785] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0068.786] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.786] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.786] SetEndOfFile (hFile=0x1fc) returned 1 [0068.786] CloseHandle (hObject=0x1fc) returned 1 [0068.786] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.786] SetEndOfFile (hFile=0x1c8) returned 1 [0068.787] CloseHandle (hObject=0x1c8) returned 1 [0068.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.204] lstrlenW (lpString=".doc") returned 4 [0069.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".docx") returned 5 [0069.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.205] lstrlenW (lpString=".pdf") returned 4 [0069.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".xls") returned 4 [0069.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.205] lstrlenW (lpString=".xlsx") returned 5 [0069.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.205] lstrlenW (lpString=".ppt") returned 4 [0069.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.205] lstrlenW (lpString=".zip") returned 4 [0069.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.205] lstrlenW (lpString=".rar") returned 4 [0069.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".bz2") returned 4 [0069.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".7z") returned 3 [0069.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.205] lstrlenW (lpString=".dbf") returned 4 [0069.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.205] lstrlenW (lpString=".1cd") returned 4 [0069.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.205] lstrlenW (lpString=".jpg") returned 4 [0069.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".pdf") returned 4 [0069.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.205] lstrlenW (lpString=".xls") returned 4 [0069.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.206] lstrlenW (lpString=".xlsx") returned 5 [0069.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.206] lstrlenW (lpString=".ppt") returned 4 [0069.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.206] lstrlenW (lpString=".zip") returned 4 [0069.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.206] lstrlenW (lpString=".rar") returned 4 [0069.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.206] lstrlenW (lpString=".bz2") returned 4 [0069.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.206] lstrlenW (lpString=".7z") returned 3 [0069.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.206] lstrlenW (lpString=".dbf") returned 4 [0069.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.206] lstrlenW (lpString=".1cd") returned 4 [0069.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0069.206] lstrlenW (lpString=".jpg") returned 4 [0069.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.206] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") [0070.087] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=46814) returned 1 [0070.087] CloseHandle (hObject=0x1fc) returned 1 [0070.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0070.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.087] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.087] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.088] GetLastError () returned 0x0 [0070.088] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb6de, lpOverlapped=0x0) returned 1 [0070.099] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0070.700] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.700] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.700] SetEndOfFile (hFile=0x190) returned 1 [0070.700] CloseHandle (hObject=0x190) returned 1 [0070.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.701] SetEndOfFile (hFile=0x1fc) returned 1 [0070.702] CloseHandle (hObject=0x1fc) returned 1 [0070.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0070.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.702] lstrlenW (lpString=".doc") returned 4 [0070.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.702] lstrlenW (lpString=".docx") returned 5 [0070.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.702] lstrlenW (lpString=".pdf") returned 4 [0070.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.702] lstrlenW (lpString=".xls") returned 4 [0070.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.702] lstrlenW (lpString=".xlsx") returned 5 [0070.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.702] lstrlenW (lpString=".ppt") returned 4 [0070.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.702] lstrlenW (lpString=".zip") returned 4 [0070.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.702] lstrlenW (lpString=".rar") returned 4 [0070.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.702] lstrlenW (lpString=".bz2") returned 4 [0070.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".7z") returned 3 [0070.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.703] lstrlenW (lpString=".dbf") returned 4 [0070.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.703] lstrlenW (lpString=".1cd") returned 4 [0070.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.703] lstrlenW (lpString=".jpg") returned 4 [0070.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".pdf") returned 4 [0070.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".xls") returned 4 [0070.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.703] lstrlenW (lpString=".xlsx") returned 5 [0070.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.703] lstrlenW (lpString=".ppt") returned 4 [0070.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.703] lstrlenW (lpString=".zip") returned 4 [0070.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.703] lstrlenW (lpString=".rar") returned 4 [0070.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".bz2") returned 4 [0070.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".7z") returned 3 [0070.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.703] lstrlenW (lpString=".dbf") returned 4 [0070.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.704] lstrlenW (lpString=".1cd") returned 4 [0070.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0070.704] lstrlenW (lpString=".jpg") returned 4 [0070.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.704] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") [0070.704] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8926) returned 1 [0070.704] CloseHandle (hObject=0x1fc) returned 1 [0070.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0070.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.704] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.704] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.705] GetLastError () returned 0x0 [0070.705] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x22de, lpOverlapped=0x0) returned 1 [0070.706] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0070.707] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.708] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.708] SetEndOfFile (hFile=0x190) returned 1 [0070.708] CloseHandle (hObject=0x190) returned 1 [0070.708] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.708] SetEndOfFile (hFile=0x1fc) returned 1 [0070.709] CloseHandle (hObject=0x1fc) returned 1 [0070.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0070.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.709] lstrlenW (lpString=".doc") returned 4 [0070.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.709] lstrlenW (lpString=".docx") returned 5 [0070.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.709] lstrlenW (lpString=".pdf") returned 4 [0070.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.709] lstrlenW (lpString=".xls") returned 4 [0070.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.709] lstrlenW (lpString=".xlsx") returned 5 [0070.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.709] lstrlenW (lpString=".ppt") returned 4 [0070.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.709] lstrlenW (lpString=".zip") returned 4 [0070.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.710] lstrlenW (lpString=".rar") returned 4 [0070.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".bz2") returned 4 [0070.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".7z") returned 3 [0070.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.710] lstrlenW (lpString=".dbf") returned 4 [0070.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.710] lstrlenW (lpString=".1cd") returned 4 [0070.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.710] lstrlenW (lpString=".jpg") returned 4 [0070.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".pdf") returned 4 [0070.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".xls") returned 4 [0070.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.710] lstrlenW (lpString=".xlsx") returned 5 [0070.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.710] lstrlenW (lpString=".ppt") returned 4 [0070.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.710] lstrlenW (lpString=".zip") returned 4 [0070.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.710] lstrlenW (lpString=".rar") returned 4 [0070.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".bz2") returned 4 [0070.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.710] lstrlenW (lpString=".7z") returned 3 [0070.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.711] lstrlenW (lpString=".dbf") returned 4 [0070.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.711] lstrlenW (lpString=".1cd") returned 4 [0070.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0070.711] lstrlenW (lpString=".jpg") returned 4 [0070.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.711] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") [0070.711] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17406) returned 1 [0070.711] CloseHandle (hObject=0x1fc) returned 1 [0070.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0070.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.712] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.712] GetLastError () returned 0x0 [0070.712] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x43fe, lpOverlapped=0x0) returned 1 [0070.728] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4400, lpOverlapped=0x0) returned 1 [0070.730] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.730] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.730] SetEndOfFile (hFile=0x190) returned 1 [0070.730] CloseHandle (hObject=0x190) returned 1 [0070.730] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.730] SetEndOfFile (hFile=0x1fc) returned 1 [0070.731] CloseHandle (hObject=0x1fc) returned 1 [0070.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0070.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.760] lstrlenW (lpString=".doc") returned 4 [0070.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.760] lstrlenW (lpString=".docx") returned 5 [0070.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.760] lstrlenW (lpString=".pdf") returned 4 [0070.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.760] lstrlenW (lpString=".xls") returned 4 [0070.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.760] lstrlenW (lpString=".xlsx") returned 5 [0070.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.760] lstrlenW (lpString=".ppt") returned 4 [0070.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.760] lstrlenW (lpString=".zip") returned 4 [0070.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.760] lstrlenW (lpString=".rar") returned 4 [0070.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.760] lstrlenW (lpString=".bz2") returned 4 [0070.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.760] lstrlenW (lpString=".7z") returned 3 [0070.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".dbf") returned 4 [0070.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".1cd") returned 4 [0070.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".jpg") returned 4 [0070.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString=".pdf") returned 4 [0070.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString=".xls") returned 4 [0070.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.761] lstrlenW (lpString=".xlsx") returned 5 [0070.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.761] lstrlenW (lpString=".ppt") returned 4 [0070.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".zip") returned 4 [0070.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.761] lstrlenW (lpString=".rar") returned 4 [0070.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString=".bz2") returned 4 [0070.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString=".7z") returned 3 [0070.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".dbf") returned 4 [0070.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.761] lstrlenW (lpString=".1cd") returned 4 [0070.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0070.762] lstrlenW (lpString=".jpg") returned 4 [0070.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.762] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") [0070.772] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13968) returned 1 [0070.772] CloseHandle (hObject=0x210) returned 1 [0070.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0070.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.772] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.779] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0070.788] GetLastError () returned 0x0 [0070.789] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3690, lpOverlapped=0x0) returned 1 [0070.798] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0070.799] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.799] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.799] SetEndOfFile (hFile=0x1c8) returned 1 [0070.802] CloseHandle (hObject=0x1c8) returned 1 [0070.802] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.802] SetEndOfFile (hFile=0x210) returned 1 [0070.802] CloseHandle (hObject=0x210) returned 1 [0070.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0070.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.803] lstrlenW (lpString=".doc") returned 4 [0070.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.803] lstrlenW (lpString=".docx") returned 5 [0070.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.803] lstrlenW (lpString=".pdf") returned 4 [0070.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.803] lstrlenW (lpString=".xls") returned 4 [0070.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.803] lstrlenW (lpString=".xlsx") returned 5 [0070.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.803] lstrlenW (lpString=".ppt") returned 4 [0070.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.803] lstrlenW (lpString=".zip") returned 4 [0070.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.803] lstrlenW (lpString=".rar") returned 4 [0070.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.803] lstrlenW (lpString=".bz2") returned 4 [0070.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString=".7z") returned 3 [0070.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".dbf") returned 4 [0070.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".1cd") returned 4 [0070.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".jpg") returned 4 [0070.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString=".pdf") returned 4 [0070.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString=".xls") returned 4 [0070.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.804] lstrlenW (lpString=".xlsx") returned 5 [0070.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.804] lstrlenW (lpString=".ppt") returned 4 [0070.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".zip") returned 4 [0070.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.804] lstrlenW (lpString=".rar") returned 4 [0070.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString=".bz2") returned 4 [0070.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString=".7z") returned 3 [0070.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".dbf") returned 4 [0070.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.804] lstrlenW (lpString=".1cd") returned 4 [0070.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0070.805] lstrlenW (lpString=".jpg") returned 4 [0070.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.805] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") [0070.805] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4984) returned 1 [0070.805] CloseHandle (hObject=0x210) returned 1 [0070.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0070.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0070.806] GetLastError () returned 0x0 [0070.806] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1378, lpOverlapped=0x0) returned 1 [0070.807] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0070.808] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.808] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.808] SetEndOfFile (hFile=0x1c8) returned 1 [0070.809] CloseHandle (hObject=0x1c8) returned 1 [0070.809] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.809] SetEndOfFile (hFile=0x210) returned 1 [0070.810] CloseHandle (hObject=0x210) returned 1 [0070.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0070.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.810] lstrlenW (lpString=".doc") returned 4 [0070.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.810] lstrlenW (lpString=".docx") returned 5 [0070.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.810] lstrlenW (lpString=".pdf") returned 4 [0070.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.810] lstrlenW (lpString=".xls") returned 4 [0070.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.810] lstrlenW (lpString=".xlsx") returned 5 [0070.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.810] lstrlenW (lpString=".ppt") returned 4 [0070.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.810] lstrlenW (lpString=".zip") returned 4 [0070.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.811] lstrlenW (lpString=".rar") returned 4 [0070.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".bz2") returned 4 [0070.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".7z") returned 3 [0070.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.811] lstrlenW (lpString=".dbf") returned 4 [0070.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.811] lstrlenW (lpString=".1cd") returned 4 [0070.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.811] lstrlenW (lpString=".jpg") returned 4 [0070.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".pdf") returned 4 [0070.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".xls") returned 4 [0070.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.811] lstrlenW (lpString=".xlsx") returned 5 [0070.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.811] lstrlenW (lpString=".ppt") returned 4 [0070.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.811] lstrlenW (lpString=".zip") returned 4 [0070.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.811] lstrlenW (lpString=".rar") returned 4 [0070.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".bz2") returned 4 [0070.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.811] lstrlenW (lpString=".7z") returned 3 [0070.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.812] lstrlenW (lpString=".dbf") returned 4 [0070.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.812] lstrlenW (lpString=".1cd") returned 4 [0070.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0070.812] lstrlenW (lpString=".jpg") returned 4 [0070.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.812] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") [0071.913] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3964) returned 1 [0071.913] CloseHandle (hObject=0x160) returned 1 [0071.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0071.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.084] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.085] GetLastError () returned 0x0 [0072.085] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf7c, lpOverlapped=0x0) returned 1 [0072.086] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0072.087] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.087] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.088] SetEndOfFile (hFile=0x210) returned 1 [0072.088] CloseHandle (hObject=0x210) returned 1 [0072.088] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.088] SetEndOfFile (hFile=0x1f4) returned 1 [0072.091] CloseHandle (hObject=0x1f4) returned 1 [0072.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0072.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.091] lstrlenW (lpString=".doc") returned 4 [0072.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.091] lstrlenW (lpString=".docx") returned 5 [0072.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.091] lstrlenW (lpString=".pdf") returned 4 [0072.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString=".xls") returned 4 [0072.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.092] lstrlenW (lpString=".xlsx") returned 5 [0072.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.092] lstrlenW (lpString=".ppt") returned 4 [0072.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.092] lstrlenW (lpString=".zip") returned 4 [0072.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.092] lstrlenW (lpString=".rar") returned 4 [0072.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString=".bz2") returned 4 [0072.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString=".7z") returned 3 [0072.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.092] lstrlenW (lpString=".dbf") returned 4 [0072.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.092] lstrlenW (lpString=".1cd") returned 4 [0072.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.092] lstrlenW (lpString=".jpg") returned 4 [0072.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString=".pdf") returned 4 [0072.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.092] lstrlenW (lpString=".xls") returned 4 [0072.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.092] lstrlenW (lpString=".xlsx") returned 5 [0072.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.092] lstrlenW (lpString=".ppt") returned 4 [0072.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.093] lstrlenW (lpString=".zip") returned 4 [0072.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.093] lstrlenW (lpString=".rar") returned 4 [0072.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.093] lstrlenW (lpString=".bz2") returned 4 [0072.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.093] lstrlenW (lpString=".7z") returned 3 [0072.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.093] lstrlenW (lpString=".dbf") returned 4 [0072.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.093] lstrlenW (lpString=".1cd") returned 4 [0072.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0072.093] lstrlenW (lpString=".jpg") returned 4 [0072.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.093] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") [0072.105] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17924) returned 1 [0072.105] CloseHandle (hObject=0x210) returned 1 [0072.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0072.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.105] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.105] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0072.106] GetLastError () returned 0x0 [0072.106] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4604, lpOverlapped=0x0) returned 1 [0072.128] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4610, lpOverlapped=0x0) returned 1 [0072.129] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.129] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.137] SetEndOfFile (hFile=0x22c) returned 1 [0072.137] CloseHandle (hObject=0x22c) returned 1 [0072.137] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.137] SetEndOfFile (hFile=0x210) returned 1 [0072.138] CloseHandle (hObject=0x210) returned 1 [0072.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0072.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.140] lstrlenW (lpString=".doc") returned 4 [0072.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString=".docx") returned 5 [0072.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.140] lstrlenW (lpString=".pdf") returned 4 [0072.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString=".xls") returned 4 [0072.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.140] lstrlenW (lpString=".xlsx") returned 5 [0072.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.140] lstrlenW (lpString=".ppt") returned 4 [0072.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.140] lstrlenW (lpString=".zip") returned 4 [0072.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.140] lstrlenW (lpString=".rar") returned 4 [0072.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString=".bz2") returned 4 [0072.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString=".7z") returned 3 [0072.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.140] lstrlenW (lpString=".dbf") returned 4 [0072.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".1cd") returned 4 [0072.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".jpg") returned 4 [0072.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString=".pdf") returned 4 [0072.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString=".xls") returned 4 [0072.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.141] lstrlenW (lpString=".xlsx") returned 5 [0072.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.141] lstrlenW (lpString=".ppt") returned 4 [0072.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".zip") returned 4 [0072.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.141] lstrlenW (lpString=".rar") returned 4 [0072.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString=".bz2") returned 4 [0072.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString=".7z") returned 3 [0072.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".dbf") returned 4 [0072.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".1cd") returned 4 [0072.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0072.141] lstrlenW (lpString=".jpg") returned 4 [0072.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.142] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") [0072.142] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12958) returned 1 [0072.142] CloseHandle (hObject=0x210) returned 1 [0072.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0072.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.142] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.142] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0072.143] GetLastError () returned 0x0 [0072.143] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x329e, lpOverlapped=0x0) returned 1 [0072.145] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0072.146] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.146] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.146] SetEndOfFile (hFile=0x22c) returned 1 [0072.146] CloseHandle (hObject=0x22c) returned 1 [0072.147] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.147] SetEndOfFile (hFile=0x210) returned 1 [0072.147] CloseHandle (hObject=0x210) returned 1 [0072.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0072.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.148] lstrlenW (lpString=".doc") returned 4 [0072.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.148] lstrlenW (lpString=".docx") returned 5 [0072.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.148] lstrlenW (lpString=".pdf") returned 4 [0072.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.148] lstrlenW (lpString=".xls") returned 4 [0072.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.148] lstrlenW (lpString=".xlsx") returned 5 [0072.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.148] lstrlenW (lpString=".ppt") returned 4 [0072.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.148] lstrlenW (lpString=".zip") returned 4 [0072.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.148] lstrlenW (lpString=".rar") returned 4 [0072.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.148] lstrlenW (lpString=".bz2") returned 4 [0072.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.148] lstrlenW (lpString=".7z") returned 3 [0072.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".dbf") returned 4 [0072.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".1cd") returned 4 [0072.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".jpg") returned 4 [0072.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString=".pdf") returned 4 [0072.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString=".xls") returned 4 [0072.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.149] lstrlenW (lpString=".xlsx") returned 5 [0072.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.149] lstrlenW (lpString=".ppt") returned 4 [0072.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".zip") returned 4 [0072.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.149] lstrlenW (lpString=".rar") returned 4 [0072.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString=".bz2") returned 4 [0072.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString=".7z") returned 3 [0072.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".dbf") returned 4 [0072.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.149] lstrlenW (lpString=".1cd") returned 4 [0072.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0072.150] lstrlenW (lpString=".jpg") returned 4 [0072.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.150] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") [0072.150] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2488) returned 1 [0072.150] CloseHandle (hObject=0x210) returned 1 [0072.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0072.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.150] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.150] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0072.151] GetLastError () returned 0x0 [0072.151] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0072.152] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0072.153] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.153] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.153] SetEndOfFile (hFile=0x22c) returned 1 [0072.153] CloseHandle (hObject=0x22c) returned 1 [0072.153] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.153] SetEndOfFile (hFile=0x210) returned 1 [0072.154] CloseHandle (hObject=0x210) returned 1 [0072.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString=".doc") returned 4 [0072.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString=".docx") returned 5 [0072.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.155] lstrlenW (lpString=".pdf") returned 4 [0072.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString=".xls") returned 4 [0072.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.155] lstrlenW (lpString=".xlsx") returned 5 [0072.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.155] lstrlenW (lpString=".ppt") returned 4 [0072.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString=".zip") returned 4 [0072.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.155] lstrlenW (lpString=".rar") returned 4 [0072.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString=".bz2") returned 4 [0072.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString=".7z") returned 3 [0072.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString=".dbf") returned 4 [0072.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString=".1cd") returned 4 [0072.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.155] lstrlenW (lpString=".jpg") returned 4 [0072.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString=".pdf") returned 4 [0072.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString=".xls") returned 4 [0072.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.156] lstrlenW (lpString=".xlsx") returned 5 [0072.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.156] lstrlenW (lpString=".ppt") returned 4 [0072.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.156] lstrlenW (lpString=".zip") returned 4 [0072.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.156] lstrlenW (lpString=".rar") returned 4 [0072.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString=".bz2") returned 4 [0072.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString=".7z") returned 3 [0072.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.156] lstrlenW (lpString=".dbf") returned 4 [0072.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.156] lstrlenW (lpString=".1cd") returned 4 [0072.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0072.156] lstrlenW (lpString=".jpg") returned 4 [0072.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.156] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") [0072.157] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2188) returned 1 [0072.157] CloseHandle (hObject=0x210) returned 1 [0072.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0072.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.157] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.157] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0072.158] GetLastError () returned 0x0 [0072.158] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x88c, lpOverlapped=0x0) returned 1 [0072.268] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x890, lpOverlapped=0x0) returned 1 [0072.310] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.310] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.319] SetEndOfFile (hFile=0x22c) returned 1 [0072.417] CloseHandle (hObject=0x22c) returned 1 [0072.417] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.425] SetEndOfFile (hFile=0x210) returned 1 [0072.432] CloseHandle (hObject=0x210) returned 1 [0072.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0072.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.453] lstrlenW (lpString=".doc") returned 4 [0072.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.453] lstrlenW (lpString=".docx") returned 5 [0072.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.453] lstrlenW (lpString=".pdf") returned 4 [0072.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString=".xls") returned 4 [0072.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.454] lstrlenW (lpString=".xlsx") returned 5 [0072.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.454] lstrlenW (lpString=".ppt") returned 4 [0072.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.454] lstrlenW (lpString=".zip") returned 4 [0072.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.454] lstrlenW (lpString=".rar") returned 4 [0072.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString=".bz2") returned 4 [0072.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString=".7z") returned 3 [0072.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.454] lstrlenW (lpString=".dbf") returned 4 [0072.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.454] lstrlenW (lpString=".1cd") returned 4 [0072.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.454] lstrlenW (lpString=".jpg") returned 4 [0072.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.454] lstrlenW (lpString=".pdf") returned 4 [0072.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString=".xls") returned 4 [0072.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.455] lstrlenW (lpString=".xlsx") returned 5 [0072.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.455] lstrlenW (lpString=".ppt") returned 4 [0072.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.455] lstrlenW (lpString=".zip") returned 4 [0072.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.455] lstrlenW (lpString=".rar") returned 4 [0072.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString=".bz2") returned 4 [0072.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString=".7z") returned 3 [0072.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.455] lstrlenW (lpString=".dbf") returned 4 [0072.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.455] lstrlenW (lpString=".1cd") returned 4 [0072.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0072.455] lstrlenW (lpString=".jpg") returned 4 [0072.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.455] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") [0073.623] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3764) returned 1 [0073.623] CloseHandle (hObject=0x1c0) returned 1 [0073.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0073.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.623] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.623] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.623] GetLastError () returned 0x0 [0073.623] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0073.648] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0073.649] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.649] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.649] SetEndOfFile (hFile=0x180) returned 1 [0073.649] CloseHandle (hObject=0x180) returned 1 [0073.649] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.649] SetEndOfFile (hFile=0x1c0) returned 1 [0073.650] CloseHandle (hObject=0x1c0) returned 1 [0073.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.666] lstrlenW (lpString=".doc") returned 4 [0073.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".docx") returned 5 [0073.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.666] lstrlenW (lpString=".pdf") returned 4 [0073.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".xls") returned 4 [0073.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.666] lstrlenW (lpString=".xlsx") returned 5 [0073.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.666] lstrlenW (lpString=".ppt") returned 4 [0073.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.666] lstrlenW (lpString=".zip") returned 4 [0073.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.666] lstrlenW (lpString=".rar") returned 4 [0073.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".bz2") returned 4 [0073.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".7z") returned 3 [0073.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.666] lstrlenW (lpString=".dbf") returned 4 [0073.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.667] lstrlenW (lpString=".1cd") returned 4 [0073.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.667] lstrlenW (lpString=".jpg") returned 4 [0073.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString=".pdf") returned 4 [0073.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString=".xls") returned 4 [0073.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.667] lstrlenW (lpString=".xlsx") returned 5 [0073.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.667] lstrlenW (lpString=".ppt") returned 4 [0073.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.667] lstrlenW (lpString=".zip") returned 4 [0073.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.674] lstrlenW (lpString=".rar") returned 4 [0073.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.674] lstrlenW (lpString=".bz2") returned 4 [0073.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.674] lstrlenW (lpString=".7z") returned 3 [0073.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.674] lstrlenW (lpString=".dbf") returned 4 [0073.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.674] lstrlenW (lpString=".1cd") returned 4 [0073.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0073.674] lstrlenW (lpString=".jpg") returned 4 [0073.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.674] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") [0073.696] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5798) returned 1 [0073.696] CloseHandle (hObject=0x150) returned 1 [0073.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0073.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0073.703] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.704] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.704] GetLastError () returned 0x0 [0073.704] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x16a6, lpOverlapped=0x0) returned 1 [0073.706] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0073.707] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.707] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.707] SetEndOfFile (hFile=0x1ec) returned 1 [0073.707] CloseHandle (hObject=0x1ec) returned 1 [0073.707] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.707] SetEndOfFile (hFile=0x150) returned 1 [0073.708] CloseHandle (hObject=0x150) returned 1 [0073.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.708] lstrlenW (lpString=".doc") returned 4 [0073.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.708] lstrlenW (lpString=".docx") returned 5 [0073.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.708] lstrlenW (lpString=".pdf") returned 4 [0073.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.708] lstrlenW (lpString=".xls") returned 4 [0073.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.709] lstrlenW (lpString=".xlsx") returned 5 [0073.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.709] lstrlenW (lpString=".ppt") returned 4 [0073.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.709] lstrlenW (lpString=".zip") returned 4 [0073.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.709] lstrlenW (lpString=".rar") returned 4 [0073.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString=".bz2") returned 4 [0073.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString=".7z") returned 3 [0073.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.709] lstrlenW (lpString=".dbf") returned 4 [0073.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.709] lstrlenW (lpString=".1cd") returned 4 [0073.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.709] lstrlenW (lpString=".jpg") returned 4 [0073.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString=".pdf") returned 4 [0073.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString=".xls") returned 4 [0073.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.709] lstrlenW (lpString=".xlsx") returned 5 [0073.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.709] lstrlenW (lpString=".ppt") returned 4 [0073.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.709] lstrlenW (lpString=".zip") returned 4 [0073.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.710] lstrlenW (lpString=".rar") returned 4 [0073.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.710] lstrlenW (lpString=".bz2") returned 4 [0073.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.710] lstrlenW (lpString=".7z") returned 3 [0073.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.710] lstrlenW (lpString=".dbf") returned 4 [0073.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.710] lstrlenW (lpString=".1cd") returned 4 [0073.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0073.710] lstrlenW (lpString=".jpg") returned 4 [0073.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.710] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") [0073.711] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12632) returned 1 [0073.711] CloseHandle (hObject=0x150) returned 1 [0073.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0073.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0073.711] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.711] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.720] GetLastError () returned 0x0 [0073.720] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3158, lpOverlapped=0x0) returned 1 [0073.725] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0073.726] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.726] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.726] SetEndOfFile (hFile=0x1ec) returned 1 [0073.726] CloseHandle (hObject=0x1ec) returned 1 [0073.726] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.726] SetEndOfFile (hFile=0x150) returned 1 [0073.727] CloseHandle (hObject=0x150) returned 1 [0073.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString=".doc") returned 4 [0073.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString=".docx") returned 5 [0073.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.728] lstrlenW (lpString=".pdf") returned 4 [0073.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString=".xls") returned 4 [0073.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.728] lstrlenW (lpString=".xlsx") returned 5 [0073.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.728] lstrlenW (lpString=".ppt") returned 4 [0073.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString=".zip") returned 4 [0073.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.728] lstrlenW (lpString=".rar") returned 4 [0073.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString=".bz2") returned 4 [0073.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString=".7z") returned 3 [0073.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString=".dbf") returned 4 [0073.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString=".1cd") returned 4 [0073.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.728] lstrlenW (lpString=".jpg") returned 4 [0073.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString=".pdf") returned 4 [0073.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString=".xls") returned 4 [0073.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.729] lstrlenW (lpString=".xlsx") returned 5 [0073.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.729] lstrlenW (lpString=".ppt") returned 4 [0073.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.729] lstrlenW (lpString=".zip") returned 4 [0073.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.729] lstrlenW (lpString=".rar") returned 4 [0073.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString=".bz2") returned 4 [0073.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString=".7z") returned 3 [0073.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.729] lstrlenW (lpString=".dbf") returned 4 [0073.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.729] lstrlenW (lpString=".1cd") returned 4 [0073.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0073.729] lstrlenW (lpString=".jpg") returned 4 [0073.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.729] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") [0073.730] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10644) returned 1 [0073.730] CloseHandle (hObject=0x150) returned 1 [0073.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0073.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0073.730] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.730] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.730] GetLastError () returned 0x0 [0073.730] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2994, lpOverlapped=0x0) returned 1 [0073.793] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0073.794] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.794] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.794] SetEndOfFile (hFile=0x1ec) returned 1 [0073.794] CloseHandle (hObject=0x1ec) returned 1 [0073.794] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.794] SetEndOfFile (hFile=0x150) returned 1 [0073.795] CloseHandle (hObject=0x150) returned 1 [0073.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0074.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.061] lstrlenW (lpString=".doc") returned 4 [0074.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.061] lstrlenW (lpString=".docx") returned 5 [0074.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.061] lstrlenW (lpString=".pdf") returned 4 [0074.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.061] lstrlenW (lpString=".xls") returned 4 [0074.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.061] lstrlenW (lpString=".xlsx") returned 5 [0074.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.061] lstrlenW (lpString=".ppt") returned 4 [0074.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.061] lstrlenW (lpString=".zip") returned 4 [0074.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.061] lstrlenW (lpString=".rar") returned 4 [0074.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.061] lstrlenW (lpString=".bz2") returned 4 [0074.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.061] lstrlenW (lpString=".7z") returned 3 [0074.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.061] lstrlenW (lpString=".dbf") returned 4 [0074.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString=".1cd") returned 4 [0074.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString=".jpg") returned 4 [0074.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString=".doc") returned 4 [0074.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString=".docx") returned 5 [0074.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.062] lstrlenW (lpString=".pdf") returned 4 [0074.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString=".xls") returned 4 [0074.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.062] lstrlenW (lpString=".xlsx") returned 5 [0074.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.062] lstrlenW (lpString=".ppt") returned 4 [0074.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString=".zip") returned 4 [0074.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.062] lstrlenW (lpString=".rar") returned 4 [0074.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString=".bz2") returned 4 [0074.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.062] lstrlenW (lpString=".7z") returned 3 [0074.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.062] lstrlenW (lpString=".dbf") returned 4 [0074.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.063] lstrlenW (lpString=".1cd") returned 4 [0074.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0074.063] lstrlenW (lpString=".jpg") returned 4 [0074.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.063] lstrlenW (lpString="HH00669_.WMF") returned 12 [0074.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.231] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11490) returned 1 [0074.232] CloseHandle (hObject=0x150) returned 1 [0074.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0074.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.232] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.232] GetLastError () returned 0x0 [0074.232] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0074.241] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0074.242] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.242] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.242] SetEndOfFile (hFile=0x210) returned 1 [0074.242] CloseHandle (hObject=0x210) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.242] SetEndOfFile (hFile=0x150) returned 1 [0074.243] CloseHandle (hObject=0x150) returned 1 [0074.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0074.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.244] lstrlenW (lpString=".doc") returned 4 [0074.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.244] lstrlenW (lpString=".docx") returned 5 [0074.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.244] lstrlenW (lpString=".pdf") returned 4 [0074.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.244] lstrlenW (lpString=".xls") returned 4 [0074.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.244] lstrlenW (lpString=".xlsx") returned 5 [0074.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.244] lstrlenW (lpString=".ppt") returned 4 [0074.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.244] lstrlenW (lpString=".zip") returned 4 [0074.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.244] lstrlenW (lpString=".rar") returned 4 [0074.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.244] lstrlenW (lpString=".bz2") returned 4 [0074.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.244] lstrlenW (lpString=".7z") returned 3 [0074.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".dbf") returned 4 [0074.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".1cd") returned 4 [0074.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".jpg") returned 4 [0074.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString=".pdf") returned 4 [0074.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString=".xls") returned 4 [0074.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.245] lstrlenW (lpString=".xlsx") returned 5 [0074.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.245] lstrlenW (lpString=".ppt") returned 4 [0074.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".zip") returned 4 [0074.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.245] lstrlenW (lpString=".rar") returned 4 [0074.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString=".bz2") returned 4 [0074.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString=".7z") returned 3 [0074.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".dbf") returned 4 [0074.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.245] lstrlenW (lpString=".1cd") returned 4 [0074.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0074.246] lstrlenW (lpString=".jpg") returned 4 [0074.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.246] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") [0074.246] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7084) returned 1 [0074.246] CloseHandle (hObject=0x150) returned 1 [0074.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0074.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.246] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.246] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.247] GetLastError () returned 0x0 [0074.247] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1bac, lpOverlapped=0x0) returned 1 [0074.256] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0074.257] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.257] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.257] SetEndOfFile (hFile=0x210) returned 1 [0074.257] CloseHandle (hObject=0x210) returned 1 [0074.257] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.257] SetEndOfFile (hFile=0x150) returned 1 [0074.258] CloseHandle (hObject=0x150) returned 1 [0074.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0074.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.258] lstrlenW (lpString=".doc") returned 4 [0074.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.258] lstrlenW (lpString=".docx") returned 5 [0074.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.258] lstrlenW (lpString=".pdf") returned 4 [0074.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.258] lstrlenW (lpString=".xls") returned 4 [0074.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.258] lstrlenW (lpString=".xlsx") returned 5 [0074.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.259] lstrlenW (lpString=".ppt") returned 4 [0074.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.259] lstrlenW (lpString=".zip") returned 4 [0074.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.259] lstrlenW (lpString=".rar") returned 4 [0074.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString=".bz2") returned 4 [0074.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString=".7z") returned 3 [0074.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.259] lstrlenW (lpString=".dbf") returned 4 [0074.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.259] lstrlenW (lpString=".1cd") returned 4 [0074.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.259] lstrlenW (lpString=".jpg") returned 4 [0074.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString=".pdf") returned 4 [0074.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString=".xls") returned 4 [0074.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.259] lstrlenW (lpString=".xlsx") returned 5 [0074.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.259] lstrlenW (lpString=".ppt") returned 4 [0074.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.259] lstrlenW (lpString=".zip") returned 4 [0074.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.259] lstrlenW (lpString=".rar") returned 4 [0074.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.260] lstrlenW (lpString=".bz2") returned 4 [0074.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.260] lstrlenW (lpString=".7z") returned 3 [0074.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.260] lstrlenW (lpString=".dbf") returned 4 [0074.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.260] lstrlenW (lpString=".1cd") returned 4 [0074.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0074.260] lstrlenW (lpString=".jpg") returned 4 [0074.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.260] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") [0074.268] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2848) returned 1 [0074.268] CloseHandle (hObject=0x150) returned 1 [0074.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0074.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.269] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.269] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.269] GetLastError () returned 0x0 [0074.269] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb20, lpOverlapped=0x0) returned 1 [0074.270] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0074.271] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.271] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.271] SetEndOfFile (hFile=0x210) returned 1 [0074.272] CloseHandle (hObject=0x210) returned 1 [0074.272] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.272] SetEndOfFile (hFile=0x150) returned 1 [0074.272] CloseHandle (hObject=0x150) returned 1 [0074.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0074.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.273] lstrlenW (lpString=".doc") returned 4 [0074.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.273] lstrlenW (lpString=".docx") returned 5 [0074.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.273] lstrlenW (lpString=".pdf") returned 4 [0074.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.273] lstrlenW (lpString=".xls") returned 4 [0074.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.273] lstrlenW (lpString=".xlsx") returned 5 [0074.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.273] lstrlenW (lpString=".ppt") returned 4 [0074.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.273] lstrlenW (lpString=".zip") returned 4 [0074.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.273] lstrlenW (lpString=".rar") returned 4 [0074.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.273] lstrlenW (lpString=".bz2") returned 4 [0074.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.273] lstrlenW (lpString=".7z") returned 3 [0074.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".dbf") returned 4 [0074.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".1cd") returned 4 [0074.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".jpg") returned 4 [0074.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString=".pdf") returned 4 [0074.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString=".xls") returned 4 [0074.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.274] lstrlenW (lpString=".xlsx") returned 5 [0074.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.274] lstrlenW (lpString=".ppt") returned 4 [0074.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".zip") returned 4 [0074.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.274] lstrlenW (lpString=".rar") returned 4 [0074.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString=".bz2") returned 4 [0074.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString=".7z") returned 3 [0074.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".dbf") returned 4 [0074.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.274] lstrlenW (lpString=".1cd") returned 4 [0074.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0074.275] lstrlenW (lpString=".jpg") returned 4 [0074.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.275] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") [0074.275] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2756) returned 1 [0074.275] CloseHandle (hObject=0x150) returned 1 [0074.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0074.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.275] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.275] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.276] GetLastError () returned 0x0 [0074.276] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xac4, lpOverlapped=0x0) returned 1 [0074.277] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0074.278] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.278] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.278] SetEndOfFile (hFile=0x210) returned 1 [0074.278] CloseHandle (hObject=0x210) returned 1 [0074.278] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.278] SetEndOfFile (hFile=0x150) returned 1 [0074.279] CloseHandle (hObject=0x150) returned 1 [0074.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0074.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.280] lstrlenW (lpString=".doc") returned 4 [0074.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString=".docx") returned 5 [0074.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.280] lstrlenW (lpString=".pdf") returned 4 [0074.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString=".xls") returned 4 [0074.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.280] lstrlenW (lpString=".xlsx") returned 5 [0074.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.280] lstrlenW (lpString=".ppt") returned 4 [0074.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.280] lstrlenW (lpString=".zip") returned 4 [0074.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.280] lstrlenW (lpString=".rar") returned 4 [0074.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString=".bz2") returned 4 [0074.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString=".7z") returned 3 [0074.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.280] lstrlenW (lpString=".dbf") returned 4 [0074.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.280] lstrlenW (lpString=".1cd") returned 4 [0074.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.281] lstrlenW (lpString=".jpg") returned 4 [0074.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString=".pdf") returned 4 [0074.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString=".xls") returned 4 [0074.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.281] lstrlenW (lpString=".xlsx") returned 5 [0074.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.281] lstrlenW (lpString=".ppt") returned 4 [0074.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.281] lstrlenW (lpString=".zip") returned 4 [0074.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.281] lstrlenW (lpString=".rar") returned 4 [0074.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString=".bz2") returned 4 [0074.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString=".7z") returned 3 [0074.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.281] lstrlenW (lpString=".dbf") returned 4 [0074.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.281] lstrlenW (lpString=".1cd") returned 4 [0074.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0074.281] lstrlenW (lpString=".jpg") returned 4 [0074.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.281] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") [0074.289] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1268) returned 1 [0074.289] CloseHandle (hObject=0x150) returned 1 [0074.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0074.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.289] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.289] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.297] GetLastError () returned 0x0 [0074.297] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0074.299] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x500, lpOverlapped=0x0) returned 1 [0074.299] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.299] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.300] SetEndOfFile (hFile=0x210) returned 1 [0074.300] CloseHandle (hObject=0x210) returned 1 [0074.300] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.300] SetEndOfFile (hFile=0x150) returned 1 [0074.301] CloseHandle (hObject=0x150) returned 1 [0074.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0074.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.301] lstrlenW (lpString=".doc") returned 4 [0074.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.301] lstrlenW (lpString=".docx") returned 5 [0074.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.301] lstrlenW (lpString=".pdf") returned 4 [0074.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.301] lstrlenW (lpString=".xls") returned 4 [0074.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.301] lstrlenW (lpString=".xlsx") returned 5 [0074.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.301] lstrlenW (lpString=".ppt") returned 4 [0074.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.301] lstrlenW (lpString=".zip") returned 4 [0074.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.301] lstrlenW (lpString=".rar") returned 4 [0074.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".bz2") returned 4 [0074.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".7z") returned 3 [0074.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.302] lstrlenW (lpString=".dbf") returned 4 [0074.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.302] lstrlenW (lpString=".1cd") returned 4 [0074.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.302] lstrlenW (lpString=".jpg") returned 4 [0074.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".pdf") returned 4 [0074.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".xls") returned 4 [0074.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.302] lstrlenW (lpString=".xlsx") returned 5 [0074.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.302] lstrlenW (lpString=".ppt") returned 4 [0074.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.302] lstrlenW (lpString=".zip") returned 4 [0074.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.302] lstrlenW (lpString=".rar") returned 4 [0074.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".bz2") returned 4 [0074.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.302] lstrlenW (lpString=".7z") returned 3 [0074.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.302] lstrlenW (lpString=".dbf") returned 4 [0074.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.303] lstrlenW (lpString=".1cd") returned 4 [0074.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0074.303] lstrlenW (lpString=".jpg") returned 4 [0074.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.303] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") [0074.303] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15806) returned 1 [0074.303] CloseHandle (hObject=0x150) returned 1 [0074.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0074.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.304] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.304] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.304] GetLastError () returned 0x0 [0074.304] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0074.440] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0074.441] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.441] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.441] SetEndOfFile (hFile=0x210) returned 1 [0074.442] CloseHandle (hObject=0x210) returned 1 [0074.442] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.442] SetEndOfFile (hFile=0x150) returned 1 [0074.443] CloseHandle (hObject=0x150) returned 1 [0074.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.443] lstrlenW (lpString=".doc") returned 4 [0074.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.443] lstrlenW (lpString=".docx") returned 5 [0074.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.443] lstrlenW (lpString=".pdf") returned 4 [0074.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.443] lstrlenW (lpString=".xls") returned 4 [0074.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.443] lstrlenW (lpString=".xlsx") returned 5 [0074.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.443] lstrlenW (lpString=".ppt") returned 4 [0074.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.443] lstrlenW (lpString=".zip") returned 4 [0074.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.443] lstrlenW (lpString=".rar") returned 4 [0074.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.443] lstrlenW (lpString=".bz2") returned 4 [0074.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".7z") returned 3 [0074.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.444] lstrlenW (lpString=".dbf") returned 4 [0074.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.444] lstrlenW (lpString=".1cd") returned 4 [0074.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.444] lstrlenW (lpString=".jpg") returned 4 [0074.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".pdf") returned 4 [0074.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".xls") returned 4 [0074.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.444] lstrlenW (lpString=".xlsx") returned 5 [0074.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.444] lstrlenW (lpString=".ppt") returned 4 [0074.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.444] lstrlenW (lpString=".zip") returned 4 [0074.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.444] lstrlenW (lpString=".rar") returned 4 [0074.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".bz2") returned 4 [0074.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".7z") returned 3 [0074.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.444] lstrlenW (lpString=".dbf") returned 4 [0074.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.445] lstrlenW (lpString=".1cd") returned 4 [0074.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0074.445] lstrlenW (lpString=".jpg") returned 4 [0074.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.445] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") [0074.445] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7932) returned 1 [0074.445] CloseHandle (hObject=0x150) returned 1 [0074.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0074.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.446] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.446] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.446] GetLastError () returned 0x0 [0074.446] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0074.466] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0074.467] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.467] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.467] SetEndOfFile (hFile=0x210) returned 1 [0074.467] CloseHandle (hObject=0x210) returned 1 [0074.467] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.467] SetEndOfFile (hFile=0x150) returned 1 [0074.468] CloseHandle (hObject=0x150) returned 1 [0074.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0074.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.468] lstrlenW (lpString=".doc") returned 4 [0074.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString=".docx") returned 5 [0074.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.469] lstrlenW (lpString=".pdf") returned 4 [0074.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString=".xls") returned 4 [0074.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.469] lstrlenW (lpString=".xlsx") returned 5 [0074.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.469] lstrlenW (lpString=".ppt") returned 4 [0074.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.469] lstrlenW (lpString=".zip") returned 4 [0074.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.469] lstrlenW (lpString=".rar") returned 4 [0074.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString=".bz2") returned 4 [0074.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString=".7z") returned 3 [0074.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.469] lstrlenW (lpString=".dbf") returned 4 [0074.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.469] lstrlenW (lpString=".1cd") returned 4 [0074.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.469] lstrlenW (lpString=".jpg") returned 4 [0074.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.470] lstrlenW (lpString=".doc") returned 4 [0074.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.470] lstrlenW (lpString=".docx") returned 5 [0074.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.470] lstrlenW (lpString=".pdf") returned 4 [0074.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.470] lstrlenW (lpString=".xls") returned 4 [0074.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.470] lstrlenW (lpString=".xlsx") returned 5 [0074.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.470] lstrlenW (lpString=".ppt") returned 4 [0074.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.470] lstrlenW (lpString=".zip") returned 4 [0074.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.470] lstrlenW (lpString=".rar") returned 4 [0074.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.471] lstrlenW (lpString=".bz2") returned 4 [0074.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.471] lstrlenW (lpString=".7z") returned 3 [0074.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.471] lstrlenW (lpString=".dbf") returned 4 [0074.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.471] lstrlenW (lpString=".1cd") returned 4 [0074.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0074.471] lstrlenW (lpString=".jpg") returned 4 [0074.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.471] lstrlenW (lpString="HH02313_.WMF") returned 12 [0074.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.471] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3082) returned 1 [0074.472] CloseHandle (hObject=0x150) returned 1 [0074.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0074.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.472] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.472] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.472] GetLastError () returned 0x0 [0074.472] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0074.481] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0074.482] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.482] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.482] SetEndOfFile (hFile=0x210) returned 1 [0074.482] CloseHandle (hObject=0x210) returned 1 [0074.482] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.482] SetEndOfFile (hFile=0x150) returned 1 [0074.483] CloseHandle (hObject=0x150) returned 1 [0074.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0074.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.484] lstrlenW (lpString=".doc") returned 4 [0074.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.484] lstrlenW (lpString=".docx") returned 5 [0074.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.484] lstrlenW (lpString=".pdf") returned 4 [0074.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.484] lstrlenW (lpString=".xls") returned 4 [0074.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.484] lstrlenW (lpString=".xlsx") returned 5 [0074.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.484] lstrlenW (lpString=".ppt") returned 4 [0074.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.484] lstrlenW (lpString=".zip") returned 4 [0074.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.484] lstrlenW (lpString=".rar") returned 4 [0074.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString=".bz2") returned 4 [0074.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString=".7z") returned 3 [0074.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.485] lstrlenW (lpString=".dbf") returned 4 [0074.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.485] lstrlenW (lpString=".1cd") returned 4 [0074.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.485] lstrlenW (lpString=".jpg") returned 4 [0074.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.485] lstrlenW (lpString=".doc") returned 4 [0074.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString=".docx") returned 5 [0074.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.485] lstrlenW (lpString=".pdf") returned 4 [0074.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.485] lstrlenW (lpString=".xls") returned 4 [0074.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.486] lstrlenW (lpString=".xlsx") returned 5 [0074.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.486] lstrlenW (lpString=".ppt") returned 4 [0074.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.486] lstrlenW (lpString=".zip") returned 4 [0074.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.486] lstrlenW (lpString=".rar") returned 4 [0074.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.486] lstrlenW (lpString=".bz2") returned 4 [0074.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.486] lstrlenW (lpString=".7z") returned 3 [0074.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.486] lstrlenW (lpString=".dbf") returned 4 [0074.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.486] lstrlenW (lpString=".1cd") returned 4 [0074.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0074.486] lstrlenW (lpString=".jpg") returned 4 [0074.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.487] lstrlenW (lpString="HM00005_.WMF") returned 12 [0074.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.514] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=23300) returned 1 [0074.514] CloseHandle (hObject=0x1c0) returned 1 [0074.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0074.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.514] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.515] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.515] GetLastError () returned 0x0 [0074.515] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b04, lpOverlapped=0x0) returned 1 [0074.524] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0074.525] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.525] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.525] SetEndOfFile (hFile=0x180) returned 1 [0074.526] CloseHandle (hObject=0x180) returned 1 [0074.526] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.526] SetEndOfFile (hFile=0x1c0) returned 1 [0074.526] CloseHandle (hObject=0x1c0) returned 1 [0074.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0074.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.527] lstrlenW (lpString=".doc") returned 4 [0074.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.527] lstrlenW (lpString=".docx") returned 5 [0074.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.527] lstrlenW (lpString=".pdf") returned 4 [0074.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.527] lstrlenW (lpString=".xls") returned 4 [0074.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.527] lstrlenW (lpString=".xlsx") returned 5 [0074.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.527] lstrlenW (lpString=".ppt") returned 4 [0074.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.527] lstrlenW (lpString=".zip") returned 4 [0074.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.527] lstrlenW (lpString=".rar") returned 4 [0074.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.527] lstrlenW (lpString=".bz2") returned 4 [0074.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString=".7z") returned 3 [0074.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString=".dbf") returned 4 [0074.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString=".1cd") returned 4 [0074.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString=".jpg") returned 4 [0074.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString=".doc") returned 4 [0074.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString=".docx") returned 5 [0074.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.528] lstrlenW (lpString=".pdf") returned 4 [0074.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString=".xls") returned 4 [0074.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.528] lstrlenW (lpString=".xlsx") returned 5 [0074.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.528] lstrlenW (lpString=".ppt") returned 4 [0074.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.528] lstrlenW (lpString=".zip") returned 4 [0074.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.528] lstrlenW (lpString=".rar") returned 4 [0074.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString=".bz2") returned 4 [0074.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.528] lstrlenW (lpString=".7z") returned 3 [0074.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.529] lstrlenW (lpString=".dbf") returned 4 [0074.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.529] lstrlenW (lpString=".1cd") returned 4 [0074.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0074.529] lstrlenW (lpString=".jpg") returned 4 [0074.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.529] lstrlenW (lpString="IN00046_.WMF") returned 12 [0074.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.552] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1158) returned 1 [0074.552] CloseHandle (hObject=0x150) returned 1 [0074.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0074.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.553] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.553] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.554] GetLastError () returned 0x0 [0074.554] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x486, lpOverlapped=0x0) returned 1 [0074.568] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x490, lpOverlapped=0x0) returned 1 [0074.569] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.569] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.569] SetEndOfFile (hFile=0x210) returned 1 [0074.569] CloseHandle (hObject=0x210) returned 1 [0074.569] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.569] SetEndOfFile (hFile=0x150) returned 1 [0074.570] CloseHandle (hObject=0x150) returned 1 [0074.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0074.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.570] lstrlenW (lpString=".doc") returned 4 [0074.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.570] lstrlenW (lpString=".docx") returned 5 [0074.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.570] lstrlenW (lpString=".pdf") returned 4 [0074.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.570] lstrlenW (lpString=".xls") returned 4 [0074.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.570] lstrlenW (lpString=".xlsx") returned 5 [0074.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.570] lstrlenW (lpString=".ppt") returned 4 [0074.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".zip") returned 4 [0074.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.571] lstrlenW (lpString=".rar") returned 4 [0074.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString=".bz2") returned 4 [0074.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString=".7z") returned 3 [0074.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".dbf") returned 4 [0074.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".1cd") returned 4 [0074.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".jpg") returned 4 [0074.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".doc") returned 4 [0074.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString=".docx") returned 5 [0074.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.571] lstrlenW (lpString=".pdf") returned 4 [0074.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString=".xls") returned 4 [0074.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.571] lstrlenW (lpString=".xlsx") returned 5 [0074.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.571] lstrlenW (lpString=".ppt") returned 4 [0074.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.571] lstrlenW (lpString=".zip") returned 4 [0074.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.572] lstrlenW (lpString=".rar") returned 4 [0074.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.572] lstrlenW (lpString=".bz2") returned 4 [0074.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.572] lstrlenW (lpString=".7z") returned 3 [0074.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.572] lstrlenW (lpString=".dbf") returned 4 [0074.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.572] lstrlenW (lpString=".1cd") returned 4 [0074.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0074.572] lstrlenW (lpString=".jpg") returned 4 [0074.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.572] lstrlenW (lpString="IN00233_.WMF") returned 12 [0074.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.573] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11190) returned 1 [0074.573] CloseHandle (hObject=0x150) returned 1 [0074.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0074.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.573] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.573] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.574] GetLastError () returned 0x0 [0074.574] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0074.584] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0074.585] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.585] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.585] SetEndOfFile (hFile=0x210) returned 1 [0074.585] CloseHandle (hObject=0x210) returned 1 [0074.585] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.585] SetEndOfFile (hFile=0x150) returned 1 [0074.586] CloseHandle (hObject=0x150) returned 1 [0074.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0074.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.586] lstrlenW (lpString=".doc") returned 4 [0074.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.586] lstrlenW (lpString=".docx") returned 5 [0074.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.586] lstrlenW (lpString=".pdf") returned 4 [0074.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.586] lstrlenW (lpString=".xls") returned 4 [0074.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.586] lstrlenW (lpString=".xlsx") returned 5 [0074.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.586] lstrlenW (lpString=".ppt") returned 4 [0074.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".zip") returned 4 [0074.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.587] lstrlenW (lpString=".rar") returned 4 [0074.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString=".bz2") returned 4 [0074.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString=".7z") returned 3 [0074.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".dbf") returned 4 [0074.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".1cd") returned 4 [0074.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".jpg") returned 4 [0074.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".doc") returned 4 [0074.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString=".docx") returned 5 [0074.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.587] lstrlenW (lpString=".pdf") returned 4 [0074.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString=".xls") returned 4 [0074.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.587] lstrlenW (lpString=".xlsx") returned 5 [0074.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.587] lstrlenW (lpString=".ppt") returned 4 [0074.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.587] lstrlenW (lpString=".zip") returned 4 [0074.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.588] lstrlenW (lpString=".rar") returned 4 [0074.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.588] lstrlenW (lpString=".bz2") returned 4 [0074.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.588] lstrlenW (lpString=".7z") returned 3 [0074.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.588] lstrlenW (lpString=".dbf") returned 4 [0074.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.588] lstrlenW (lpString=".1cd") returned 4 [0074.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0074.588] lstrlenW (lpString=".jpg") returned 4 [0074.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.588] lstrlenW (lpString="IN00343_.WMF") returned 12 [0074.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.589] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1892) returned 1 [0074.589] CloseHandle (hObject=0x150) returned 1 [0074.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0074.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.589] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.589] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.590] GetLastError () returned 0x0 [0074.590] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x764, lpOverlapped=0x0) returned 1 [0074.757] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x770, lpOverlapped=0x0) returned 1 [0074.758] ReadFile (in: hFile=0x150, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.758] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.758] SetEndOfFile (hFile=0x210) returned 1 [0075.254] CloseHandle (hObject=0x210) returned 1 [0075.255] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.255] SetEndOfFile (hFile=0x150) returned 1 [0075.259] CloseHandle (hObject=0x150) returned 1 [0075.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.260] lstrlenW (lpString=".doc") returned 4 [0075.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.260] lstrlenW (lpString=".docx") returned 5 [0075.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.260] lstrlenW (lpString=".pdf") returned 4 [0075.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.260] lstrlenW (lpString=".xls") returned 4 [0075.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.260] lstrlenW (lpString=".xlsx") returned 5 [0075.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.260] lstrlenW (lpString=".ppt") returned 4 [0075.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.266] lstrlenW (lpString=".zip") returned 4 [0075.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.267] lstrlenW (lpString=".rar") returned 4 [0075.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.267] lstrlenW (lpString=".bz2") returned 4 [0075.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.267] lstrlenW (lpString=".7z") returned 3 [0075.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.267] lstrlenW (lpString=".dbf") returned 4 [0075.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.325] lstrlenW (lpString=".1cd") returned 4 [0075.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.325] lstrlenW (lpString=".jpg") returned 4 [0075.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.325] lstrlenW (lpString=".pdf") returned 4 [0075.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.326] lstrlenW (lpString=".xls") returned 4 [0075.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.326] lstrlenW (lpString=".xlsx") returned 5 [0075.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.326] lstrlenW (lpString=".ppt") returned 4 [0075.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.326] lstrlenW (lpString=".zip") returned 4 [0075.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.326] lstrlenW (lpString=".rar") returned 4 [0075.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.326] lstrlenW (lpString=".bz2") returned 4 [0075.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.326] lstrlenW (lpString=".7z") returned 3 [0075.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.328] lstrlenW (lpString=".dbf") returned 4 [0075.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.328] lstrlenW (lpString=".1cd") returned 4 [0075.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0075.329] lstrlenW (lpString=".jpg") returned 4 [0075.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.329] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") [0075.339] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=35346) returned 1 [0075.339] CloseHandle (hObject=0x1fc) returned 1 [0075.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0075.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0075.340] GetLastError () returned 0x0 [0075.340] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8a12, lpOverlapped=0x0) returned 1 [0075.342] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0075.343] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.343] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.343] SetEndOfFile (hFile=0x1c0) returned 1 [0075.343] CloseHandle (hObject=0x1c0) returned 1 [0075.343] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.344] SetEndOfFile (hFile=0x1fc) returned 1 [0075.344] CloseHandle (hObject=0x1fc) returned 1 [0075.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0075.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.345] lstrlenW (lpString=".doc") returned 4 [0075.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.345] lstrlenW (lpString=".docx") returned 5 [0075.345] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0075.345] lstrlenW (lpString=".pdf") returned 4 [0075.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.345] lstrlenW (lpString=".xls") returned 4 [0075.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.345] lstrlenW (lpString=".xlsx") returned 5 [0075.345] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0075.345] lstrlenW (lpString=".ppt") returned 4 [0075.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.345] lstrlenW (lpString=".zip") returned 4 [0075.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.345] lstrlenW (lpString=".rar") returned 4 [0075.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.345] lstrlenW (lpString=".bz2") returned 4 [0075.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.346] lstrlenW (lpString=".7z") returned 3 [0075.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.346] lstrlenW (lpString=".dbf") returned 4 [0075.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.346] lstrlenW (lpString=".1cd") returned 4 [0075.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0075.346] lstrlenW (lpString=".jpg") returned 4 [0075.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.346] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") [0075.346] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=14174) returned 1 [0075.346] CloseHandle (hObject=0x1fc) returned 1 [0075.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0075.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.347] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.347] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0075.347] GetLastError () returned 0x0 [0075.347] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x375e, lpOverlapped=0x0) returned 1 [0075.364] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3760, lpOverlapped=0x0) returned 1 [0075.366] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.367] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.367] SetEndOfFile (hFile=0x1c0) returned 1 [0075.367] CloseHandle (hObject=0x1c0) returned 1 [0075.367] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.367] SetEndOfFile (hFile=0x1fc) returned 1 [0075.368] CloseHandle (hObject=0x1fc) returned 1 [0075.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0075.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.368] lstrlenW (lpString=".doc") returned 4 [0075.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.368] lstrlenW (lpString=".docx") returned 5 [0075.368] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0075.368] lstrlenW (lpString=".pdf") returned 4 [0075.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.368] lstrlenW (lpString=".xls") returned 4 [0075.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.368] lstrlenW (lpString=".xlsx") returned 5 [0075.368] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0075.368] lstrlenW (lpString=".ppt") returned 4 [0075.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.369] lstrlenW (lpString=".zip") returned 4 [0075.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.369] lstrlenW (lpString=".rar") returned 4 [0075.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.369] lstrlenW (lpString=".bz2") returned 4 [0075.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.369] lstrlenW (lpString=".7z") returned 3 [0075.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.369] lstrlenW (lpString=".dbf") returned 4 [0075.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.369] lstrlenW (lpString=".1cd") returned 4 [0075.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0075.369] lstrlenW (lpString=".jpg") returned 4 [0075.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.369] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") [0075.370] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19898) returned 1 [0075.370] CloseHandle (hObject=0x1fc) returned 1 [0075.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0075.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.370] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.370] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0075.371] GetLastError () returned 0x0 [0075.371] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0075.381] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0075.382] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.382] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.383] SetEndOfFile (hFile=0x1c0) returned 1 [0075.383] CloseHandle (hObject=0x1c0) returned 1 [0075.383] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.383] SetEndOfFile (hFile=0x1fc) returned 1 [0075.384] CloseHandle (hObject=0x1fc) returned 1 [0075.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0075.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.384] lstrlenW (lpString=".doc") returned 4 [0075.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.384] lstrlenW (lpString=".docx") returned 5 [0075.384] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0075.384] lstrlenW (lpString=".pdf") returned 4 [0075.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.384] lstrlenW (lpString=".xls") returned 4 [0075.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.384] lstrlenW (lpString=".xlsx") returned 5 [0075.384] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0075.384] lstrlenW (lpString=".ppt") returned 4 [0075.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.384] lstrlenW (lpString=".zip") returned 4 [0075.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.385] lstrlenW (lpString=".rar") returned 4 [0075.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.385] lstrlenW (lpString=".bz2") returned 4 [0075.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.385] lstrlenW (lpString=".7z") returned 3 [0075.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.385] lstrlenW (lpString=".dbf") returned 4 [0075.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.385] lstrlenW (lpString=".1cd") returned 4 [0075.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0075.385] lstrlenW (lpString=".jpg") returned 4 [0075.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.385] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") [0075.385] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21268) returned 1 [0075.385] CloseHandle (hObject=0x1fc) returned 1 [0075.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0075.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0075.386] GetLastError () returned 0x0 [0075.386] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5314, lpOverlapped=0x0) returned 1 [0075.389] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5320, lpOverlapped=0x0) returned 1 [0075.396] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.396] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.397] SetEndOfFile (hFile=0x1c0) returned 1 [0075.397] CloseHandle (hObject=0x1c0) returned 1 [0075.397] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.397] SetEndOfFile (hFile=0x1fc) returned 1 [0075.398] CloseHandle (hObject=0x1fc) returned 1 [0075.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0075.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.398] lstrlenW (lpString=".doc") returned 4 [0075.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.398] lstrlenW (lpString=".docx") returned 5 [0075.398] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0075.398] lstrlenW (lpString=".pdf") returned 4 [0075.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.398] lstrlenW (lpString=".xls") returned 4 [0075.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.398] lstrlenW (lpString=".xlsx") returned 5 [0075.398] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0075.398] lstrlenW (lpString=".ppt") returned 4 [0075.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.398] lstrlenW (lpString=".zip") returned 4 [0075.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.398] lstrlenW (lpString=".rar") returned 4 [0075.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.399] lstrlenW (lpString=".bz2") returned 4 [0075.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.399] lstrlenW (lpString=".7z") returned 3 [0075.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.399] lstrlenW (lpString=".dbf") returned 4 [0075.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.399] lstrlenW (lpString=".1cd") returned 4 [0075.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0075.399] lstrlenW (lpString=".jpg") returned 4 [0075.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.399] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") [0075.400] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15760) returned 1 [0075.400] CloseHandle (hObject=0x1fc) returned 1 [0075.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0075.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0075.400] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.400] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0075.401] GetLastError () returned 0x0 [0075.401] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0075.881] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0075.883] ReadFile (in: hFile=0x1fc, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.883] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.883] SetEndOfFile (hFile=0x1c0) returned 1 [0075.926] CloseHandle (hObject=0x1c0) returned 1 [0075.928] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.929] SetEndOfFile (hFile=0x1fc) returned 1 [0075.981] CloseHandle (hObject=0x1fc) returned 1 [0075.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0076.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.078] lstrlenW (lpString=".doc") returned 4 [0076.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString=".docx") returned 5 [0076.078] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0076.078] lstrlenW (lpString=".pdf") returned 4 [0076.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString=".xls") returned 4 [0076.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.078] lstrlenW (lpString=".xlsx") returned 5 [0076.078] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0076.078] lstrlenW (lpString=".ppt") returned 4 [0076.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.078] lstrlenW (lpString=".zip") returned 4 [0076.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.078] lstrlenW (lpString=".rar") returned 4 [0076.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString=".bz2") returned 4 [0076.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString=".7z") returned 3 [0076.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.078] lstrlenW (lpString=".dbf") returned 4 [0076.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.078] lstrlenW (lpString=".1cd") returned 4 [0076.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0076.081] lstrlenW (lpString=".jpg") returned 4 [0076.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.081] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") [0076.193] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=26086) returned 1 [0076.193] CloseHandle (hObject=0x160) returned 1 [0076.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0076.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0076.194] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.194] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.194] GetLastError () returned 0x0 [0076.194] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x65e6, lpOverlapped=0x0) returned 1 [0076.249] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0076.250] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.251] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.251] SetEndOfFile (hFile=0x15c) returned 1 [0076.251] CloseHandle (hObject=0x15c) returned 1 [0076.251] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.251] SetEndOfFile (hFile=0x160) returned 1 [0076.252] CloseHandle (hObject=0x160) returned 1 [0076.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0076.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.252] lstrlenW (lpString=".doc") returned 4 [0076.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.252] lstrlenW (lpString=".docx") returned 5 [0076.252] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0076.252] lstrlenW (lpString=".pdf") returned 4 [0076.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.252] lstrlenW (lpString=".xls") returned 4 [0076.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.252] lstrlenW (lpString=".xlsx") returned 5 [0076.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0076.253] lstrlenW (lpString=".ppt") returned 4 [0076.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.253] lstrlenW (lpString=".zip") returned 4 [0076.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.253] lstrlenW (lpString=".rar") returned 4 [0076.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.253] lstrlenW (lpString=".bz2") returned 4 [0076.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.253] lstrlenW (lpString=".7z") returned 3 [0076.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.253] lstrlenW (lpString=".dbf") returned 4 [0076.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.253] lstrlenW (lpString=".1cd") returned 4 [0076.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0076.253] lstrlenW (lpString=".jpg") returned 4 [0076.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.253] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") [0076.253] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27546) returned 1 [0076.254] CloseHandle (hObject=0x160) returned 1 [0076.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0076.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0076.254] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.254] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0076.254] GetLastError () returned 0x0 [0076.254] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0076.612] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0076.613] ReadFile (in: hFile=0x160, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.613] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.613] SetEndOfFile (hFile=0x15c) returned 1 [0076.613] CloseHandle (hObject=0x15c) returned 1 [0076.613] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.613] SetEndOfFile (hFile=0x160) returned 1 [0076.614] CloseHandle (hObject=0x160) returned 1 [0076.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0076.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.615] lstrlenW (lpString=".doc") returned 4 [0076.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.615] lstrlenW (lpString=".docx") returned 5 [0076.615] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0076.615] lstrlenW (lpString=".pdf") returned 4 [0076.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.615] lstrlenW (lpString=".xls") returned 4 [0076.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.615] lstrlenW (lpString=".xlsx") returned 5 [0076.615] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0076.615] lstrlenW (lpString=".ppt") returned 4 [0076.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.615] lstrlenW (lpString=".zip") returned 4 [0076.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.622] lstrlenW (lpString=".rar") returned 4 [0076.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.622] lstrlenW (lpString=".bz2") returned 4 [0076.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.622] lstrlenW (lpString=".7z") returned 3 [0076.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.622] lstrlenW (lpString=".dbf") returned 4 [0076.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.622] lstrlenW (lpString=".1cd") returned 4 [0076.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0076.622] lstrlenW (lpString=".jpg") returned 4 [0076.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.622] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") [0076.724] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21946) returned 1 [0076.724] CloseHandle (hObject=0x1f4) returned 1 [0076.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0076.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.724] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.724] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.725] GetLastError () returned 0x0 [0076.725] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0076.727] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0076.728] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.728] SetEndOfFile (hFile=0x154) returned 1 [0076.728] CloseHandle (hObject=0x154) returned 1 [0076.728] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.728] SetEndOfFile (hFile=0x1f4) returned 1 [0076.729] CloseHandle (hObject=0x1f4) returned 1 [0076.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0076.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.729] lstrlenW (lpString=".doc") returned 4 [0076.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.729] lstrlenW (lpString=".docx") returned 5 [0076.729] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0076.730] lstrlenW (lpString=".pdf") returned 4 [0076.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString=".xls") returned 4 [0076.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.730] lstrlenW (lpString=".xlsx") returned 5 [0076.730] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0076.730] lstrlenW (lpString=".ppt") returned 4 [0076.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.730] lstrlenW (lpString=".zip") returned 4 [0076.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.730] lstrlenW (lpString=".rar") returned 4 [0076.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString=".bz2") returned 4 [0076.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString=".7z") returned 3 [0076.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.730] lstrlenW (lpString=".dbf") returned 4 [0076.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.730] lstrlenW (lpString=".1cd") returned 4 [0076.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0076.730] lstrlenW (lpString=".jpg") returned 4 [0076.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.730] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") [0076.731] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10192) returned 1 [0076.731] CloseHandle (hObject=0x1f4) returned 1 [0076.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0076.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.731] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.731] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.731] GetLastError () returned 0x0 [0076.732] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x27d0, lpOverlapped=0x0) returned 1 [0076.734] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0076.736] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.736] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.736] SetEndOfFile (hFile=0x154) returned 1 [0076.736] CloseHandle (hObject=0x154) returned 1 [0076.736] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.736] SetEndOfFile (hFile=0x1f4) returned 1 [0076.737] CloseHandle (hObject=0x1f4) returned 1 [0076.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0076.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.737] lstrlenW (lpString=".doc") returned 4 [0076.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.737] lstrlenW (lpString=".docx") returned 5 [0076.737] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0076.737] lstrlenW (lpString=".pdf") returned 4 [0076.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.737] lstrlenW (lpString=".xls") returned 4 [0076.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.737] lstrlenW (lpString=".xlsx") returned 5 [0076.737] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0076.738] lstrlenW (lpString=".ppt") returned 4 [0076.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.738] lstrlenW (lpString=".zip") returned 4 [0076.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.738] lstrlenW (lpString=".rar") returned 4 [0076.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.738] lstrlenW (lpString=".bz2") returned 4 [0076.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.738] lstrlenW (lpString=".7z") returned 3 [0076.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.738] lstrlenW (lpString=".dbf") returned 4 [0076.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.738] lstrlenW (lpString=".1cd") returned 4 [0076.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0076.738] lstrlenW (lpString=".jpg") returned 4 [0076.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.738] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") [0076.738] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24292) returned 1 [0076.739] CloseHandle (hObject=0x1f4) returned 1 [0076.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0076.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.739] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.739] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.739] GetLastError () returned 0x0 [0076.739] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0076.748] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0076.752] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.752] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.752] SetEndOfFile (hFile=0x154) returned 1 [0076.753] CloseHandle (hObject=0x154) returned 1 [0076.753] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.753] SetEndOfFile (hFile=0x1f4) returned 1 [0076.754] CloseHandle (hObject=0x1f4) returned 1 [0076.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0076.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.754] lstrlenW (lpString=".doc") returned 4 [0076.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.754] lstrlenW (lpString=".docx") returned 5 [0076.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0076.754] lstrlenW (lpString=".pdf") returned 4 [0076.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.754] lstrlenW (lpString=".xls") returned 4 [0076.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.754] lstrlenW (lpString=".xlsx") returned 5 [0076.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0076.754] lstrlenW (lpString=".ppt") returned 4 [0076.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.754] lstrlenW (lpString=".zip") returned 4 [0076.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.754] lstrlenW (lpString=".rar") returned 4 [0076.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.755] lstrlenW (lpString=".bz2") returned 4 [0076.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.755] lstrlenW (lpString=".7z") returned 3 [0076.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.755] lstrlenW (lpString=".dbf") returned 4 [0076.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.755] lstrlenW (lpString=".1cd") returned 4 [0076.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0076.755] lstrlenW (lpString=".jpg") returned 4 [0076.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.755] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") [0076.755] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8754) returned 1 [0076.755] CloseHandle (hObject=0x1f4) returned 1 [0076.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0076.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.756] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.756] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0076.756] GetLastError () returned 0x0 [0076.756] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2232, lpOverlapped=0x0) returned 1 [0076.760] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0076.769] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.769] WriteFile (in: hFile=0x154, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.769] SetEndOfFile (hFile=0x154) returned 1 [0076.769] CloseHandle (hObject=0x154) returned 1 [0076.769] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.769] SetEndOfFile (hFile=0x1f4) returned 1 [0076.770] CloseHandle (hObject=0x1f4) returned 1 [0076.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.770] lstrlenW (lpString=".doc") returned 4 [0076.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.770] lstrlenW (lpString=".docx") returned 5 [0076.770] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0076.770] lstrlenW (lpString=".pdf") returned 4 [0076.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString=".xls") returned 4 [0076.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.771] lstrlenW (lpString=".xlsx") returned 5 [0076.771] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0076.771] lstrlenW (lpString=".ppt") returned 4 [0076.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.771] lstrlenW (lpString=".zip") returned 4 [0076.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.771] lstrlenW (lpString=".rar") returned 4 [0076.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString=".bz2") returned 4 [0076.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString=".7z") returned 3 [0076.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.771] lstrlenW (lpString=".dbf") returned 4 [0076.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.771] lstrlenW (lpString=".1cd") returned 4 [0076.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0076.771] lstrlenW (lpString=".jpg") returned 4 [0076.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.771] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") [0076.830] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=58258) returned 1 [0076.831] CloseHandle (hObject=0x1c0) returned 1 [0076.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0076.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.831] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.831] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.831] GetLastError () returned 0x0 [0076.831] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xe392, lpOverlapped=0x0) returned 1 [0076.835] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0076.837] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.837] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.837] SetEndOfFile (hFile=0x1f0) returned 1 [0076.837] CloseHandle (hObject=0x1f0) returned 1 [0076.837] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.837] SetEndOfFile (hFile=0x1c0) returned 1 [0076.838] CloseHandle (hObject=0x1c0) returned 1 [0076.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0076.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.839] lstrlenW (lpString=".doc") returned 4 [0076.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString=".docx") returned 5 [0076.839] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0076.839] lstrlenW (lpString=".pdf") returned 4 [0076.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString=".xls") returned 4 [0076.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.839] lstrlenW (lpString=".xlsx") returned 5 [0076.839] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0076.839] lstrlenW (lpString=".ppt") returned 4 [0076.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.839] lstrlenW (lpString=".zip") returned 4 [0076.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.839] lstrlenW (lpString=".rar") returned 4 [0076.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString=".bz2") returned 4 [0076.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString=".7z") returned 3 [0076.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.839] lstrlenW (lpString=".dbf") returned 4 [0076.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.839] lstrlenW (lpString=".1cd") returned 4 [0076.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0076.840] lstrlenW (lpString=".jpg") returned 4 [0076.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.840] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") [0076.840] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=37140) returned 1 [0076.840] CloseHandle (hObject=0x1c0) returned 1 [0076.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0076.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.841] GetLastError () returned 0x0 [0076.841] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9114, lpOverlapped=0x0) returned 1 [0076.854] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9120, lpOverlapped=0x0) returned 1 [0076.857] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.857] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.857] SetEndOfFile (hFile=0x1f0) returned 1 [0076.857] CloseHandle (hObject=0x1f0) returned 1 [0076.857] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.857] SetEndOfFile (hFile=0x1c0) returned 1 [0076.858] CloseHandle (hObject=0x1c0) returned 1 [0076.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0076.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.859] lstrlenW (lpString=".doc") returned 4 [0076.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.859] lstrlenW (lpString=".docx") returned 5 [0076.859] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0076.859] lstrlenW (lpString=".pdf") returned 4 [0076.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.859] lstrlenW (lpString=".xls") returned 4 [0076.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.859] lstrlenW (lpString=".xlsx") returned 5 [0076.859] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0076.859] lstrlenW (lpString=".ppt") returned 4 [0076.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.859] lstrlenW (lpString=".zip") returned 4 [0076.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.859] lstrlenW (lpString=".rar") returned 4 [0076.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.859] lstrlenW (lpString=".bz2") returned 4 [0076.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.860] lstrlenW (lpString=".7z") returned 3 [0076.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.860] lstrlenW (lpString=".dbf") returned 4 [0076.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.860] lstrlenW (lpString=".1cd") returned 4 [0076.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0076.860] lstrlenW (lpString=".jpg") returned 4 [0076.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.860] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") [0076.860] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6214) returned 1 [0076.860] CloseHandle (hObject=0x1c0) returned 1 [0076.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0076.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.861] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.861] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.861] GetLastError () returned 0x0 [0076.861] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1846, lpOverlapped=0x0) returned 1 [0076.865] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0076.866] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.866] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.866] SetEndOfFile (hFile=0x1f0) returned 1 [0076.867] CloseHandle (hObject=0x1f0) returned 1 [0076.867] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.867] SetEndOfFile (hFile=0x1c0) returned 1 [0076.868] CloseHandle (hObject=0x1c0) returned 1 [0076.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0076.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.868] lstrlenW (lpString=".doc") returned 4 [0076.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.868] lstrlenW (lpString=".docx") returned 5 [0076.868] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0076.868] lstrlenW (lpString=".pdf") returned 4 [0076.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.868] lstrlenW (lpString=".xls") returned 4 [0076.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.868] lstrlenW (lpString=".xlsx") returned 5 [0076.868] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0076.868] lstrlenW (lpString=".ppt") returned 4 [0076.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.868] lstrlenW (lpString=".zip") returned 4 [0076.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.868] lstrlenW (lpString=".rar") returned 4 [0076.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.869] lstrlenW (lpString=".bz2") returned 4 [0076.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.869] lstrlenW (lpString=".7z") returned 3 [0076.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.869] lstrlenW (lpString=".dbf") returned 4 [0076.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.869] lstrlenW (lpString=".1cd") returned 4 [0076.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0076.869] lstrlenW (lpString=".jpg") returned 4 [0076.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.869] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") [0076.874] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9744) returned 1 [0076.874] CloseHandle (hObject=0x1c0) returned 1 [0076.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0076.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.874] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.874] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.875] GetLastError () returned 0x0 [0076.875] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2610, lpOverlapped=0x0) returned 1 [0076.896] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2620, lpOverlapped=0x0) returned 1 [0076.897] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.897] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.897] SetEndOfFile (hFile=0x1f0) returned 1 [0076.897] CloseHandle (hObject=0x1f0) returned 1 [0076.897] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.897] SetEndOfFile (hFile=0x1c0) returned 1 [0076.898] CloseHandle (hObject=0x1c0) returned 1 [0076.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0076.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.898] lstrlenW (lpString=".doc") returned 4 [0076.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.898] lstrlenW (lpString=".docx") returned 5 [0076.898] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0076.898] lstrlenW (lpString=".pdf") returned 4 [0076.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.898] lstrlenW (lpString=".xls") returned 4 [0076.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.898] lstrlenW (lpString=".xlsx") returned 5 [0076.899] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0076.899] lstrlenW (lpString=".ppt") returned 4 [0076.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.899] lstrlenW (lpString=".zip") returned 4 [0076.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.899] lstrlenW (lpString=".rar") returned 4 [0076.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.899] lstrlenW (lpString=".bz2") returned 4 [0076.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.899] lstrlenW (lpString=".7z") returned 3 [0076.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.899] lstrlenW (lpString=".dbf") returned 4 [0076.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.899] lstrlenW (lpString=".1cd") returned 4 [0076.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0076.899] lstrlenW (lpString=".jpg") returned 4 [0076.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.899] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") [0076.899] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2488) returned 1 [0076.900] CloseHandle (hObject=0x1c0) returned 1 [0076.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0076.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.900] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.900] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.900] GetLastError () returned 0x0 [0076.900] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0076.919] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0076.920] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.920] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.920] SetEndOfFile (hFile=0x1f0) returned 1 [0076.920] CloseHandle (hObject=0x1f0) returned 1 [0076.920] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.920] SetEndOfFile (hFile=0x1c0) returned 1 [0076.921] CloseHandle (hObject=0x1c0) returned 1 [0076.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString=".doc") returned 4 [0076.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString=".docx") returned 5 [0076.922] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0076.922] lstrlenW (lpString=".pdf") returned 4 [0076.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString=".xls") returned 4 [0076.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.922] lstrlenW (lpString=".xlsx") returned 5 [0076.922] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0076.922] lstrlenW (lpString=".ppt") returned 4 [0076.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString=".zip") returned 4 [0076.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.922] lstrlenW (lpString=".rar") returned 4 [0076.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString=".bz2") returned 4 [0076.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString=".7z") returned 3 [0076.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString=".dbf") returned 4 [0076.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString=".1cd") returned 4 [0076.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0076.922] lstrlenW (lpString=".jpg") returned 4 [0076.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.923] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") [0076.923] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5386) returned 1 [0076.923] CloseHandle (hObject=0x1c0) returned 1 [0076.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0076.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.923] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.923] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.924] GetLastError () returned 0x0 [0076.924] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x150a, lpOverlapped=0x0) returned 1 [0076.965] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0076.967] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.967] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.967] SetEndOfFile (hFile=0x1f0) returned 1 [0077.443] CloseHandle (hObject=0x1f0) returned 1 [0077.443] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.443] SetEndOfFile (hFile=0x1c0) returned 1 [0077.444] CloseHandle (hObject=0x1c0) returned 1 [0077.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0077.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.479] lstrlenW (lpString=".doc") returned 4 [0077.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.506] lstrlenW (lpString=".docx") returned 5 [0077.506] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0077.506] lstrlenW (lpString=".pdf") returned 4 [0077.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.506] lstrlenW (lpString=".xls") returned 4 [0077.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.506] lstrlenW (lpString=".xlsx") returned 5 [0077.506] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0077.506] lstrlenW (lpString=".ppt") returned 4 [0077.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.561] lstrlenW (lpString=".zip") returned 4 [0077.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.561] lstrlenW (lpString=".rar") returned 4 [0077.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.561] lstrlenW (lpString=".bz2") returned 4 [0077.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.561] lstrlenW (lpString=".7z") returned 3 [0077.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.561] lstrlenW (lpString=".dbf") returned 4 [0077.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.561] lstrlenW (lpString=".1cd") returned 4 [0077.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0077.561] lstrlenW (lpString=".jpg") returned 4 [0077.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.561] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") [0077.562] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=25265) returned 1 [0077.562] CloseHandle (hObject=0x1f0) returned 1 [0077.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0077.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.562] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.562] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.562] GetLastError () returned 0x0 [0077.562] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x62b1, lpOverlapped=0x0) returned 1 [0077.565] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0077.567] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.567] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.567] SetEndOfFile (hFile=0x15c) returned 1 [0077.567] CloseHandle (hObject=0x15c) returned 1 [0077.567] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.567] SetEndOfFile (hFile=0x1f0) returned 1 [0077.568] CloseHandle (hObject=0x1f0) returned 1 [0077.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0077.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.568] lstrlenW (lpString=".doc") returned 4 [0077.568] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.568] lstrlenW (lpString=".docx") returned 5 [0077.568] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0077.568] lstrlenW (lpString=".pdf") returned 4 [0077.568] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.569] lstrlenW (lpString=".xls") returned 4 [0077.569] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.569] lstrlenW (lpString=".xlsx") returned 5 [0077.569] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0077.569] lstrlenW (lpString=".ppt") returned 4 [0077.569] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.569] lstrlenW (lpString=".zip") returned 4 [0077.569] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.569] lstrlenW (lpString=".rar") returned 4 [0077.569] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.569] lstrlenW (lpString=".bz2") returned 4 [0077.569] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.569] lstrlenW (lpString=".7z") returned 3 [0077.569] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.569] lstrlenW (lpString=".dbf") returned 4 [0077.569] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.569] lstrlenW (lpString=".1cd") returned 4 [0077.569] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0077.569] lstrlenW (lpString=".jpg") returned 4 [0077.569] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.569] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") [0077.570] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19923) returned 1 [0077.570] CloseHandle (hObject=0x1f0) returned 1 [0077.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0077.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.570] GetLastError () returned 0x0 [0077.570] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0077.619] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.619] SetEndOfFile (hFile=0x15c) returned 1 [0077.623] CloseHandle (hObject=0x15c) returned 1 [0077.623] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.623] SetEndOfFile (hFile=0x1f0) returned 1 [0077.624] CloseHandle (hObject=0x1f0) returned 1 [0077.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString=".doc") returned 4 [0077.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.638] lstrlenW (lpString=".docx") returned 5 [0077.638] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0077.638] lstrlenW (lpString=".pdf") returned 4 [0077.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.638] lstrlenW (lpString=".xls") returned 4 [0077.638] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.638] lstrlenW (lpString=".xlsx") returned 5 [0077.638] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0077.638] lstrlenW (lpString=".ppt") returned 4 [0077.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString=".zip") returned 4 [0077.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.638] lstrlenW (lpString=".rar") returned 4 [0077.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.638] lstrlenW (lpString=".bz2") returned 4 [0077.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.638] lstrlenW (lpString=".7z") returned 3 [0077.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString=".dbf") returned 4 [0077.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString=".1cd") returned 4 [0077.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0077.638] lstrlenW (lpString=".jpg") returned 4 [0077.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.639] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") [0077.639] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10898) returned 1 [0077.639] CloseHandle (hObject=0x22c) returned 1 [0077.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0077.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0077.639] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.639] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.640] GetLastError () returned 0x0 [0077.640] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2a92, lpOverlapped=0x0) returned 1 [0077.921] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0077.922] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.922] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.922] SetEndOfFile (hFile=0x210) returned 1 [0077.922] CloseHandle (hObject=0x210) returned 1 [0077.922] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.922] SetEndOfFile (hFile=0x22c) returned 1 [0077.923] CloseHandle (hObject=0x22c) returned 1 [0077.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0077.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString=".doc") returned 4 [0077.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.924] lstrlenW (lpString=".docx") returned 5 [0077.924] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0077.924] lstrlenW (lpString=".pdf") returned 4 [0077.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.924] lstrlenW (lpString=".xls") returned 4 [0077.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.924] lstrlenW (lpString=".xlsx") returned 5 [0077.924] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0077.924] lstrlenW (lpString=".ppt") returned 4 [0077.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString=".zip") returned 4 [0077.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.924] lstrlenW (lpString=".rar") returned 4 [0077.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.924] lstrlenW (lpString=".bz2") returned 4 [0077.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.924] lstrlenW (lpString=".7z") returned 3 [0077.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString=".dbf") returned 4 [0077.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString=".1cd") returned 4 [0077.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0077.924] lstrlenW (lpString=".jpg") returned 4 [0077.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.924] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") [0077.925] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3904) returned 1 [0077.925] CloseHandle (hObject=0x22c) returned 1 [0077.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0077.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0077.925] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.925] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.926] GetLastError () returned 0x0 [0077.926] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf40, lpOverlapped=0x0) returned 1 [0077.944] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0077.944] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.945] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.945] SetEndOfFile (hFile=0x210) returned 1 [0077.949] CloseHandle (hObject=0x210) returned 1 [0077.949] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.949] SetEndOfFile (hFile=0x22c) returned 1 [0077.957] CloseHandle (hObject=0x22c) returned 1 [0077.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0077.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.973] lstrlenW (lpString=".doc") returned 4 [0077.980] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.980] lstrlenW (lpString=".docx") returned 5 [0077.980] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0077.980] lstrlenW (lpString=".pdf") returned 4 [0077.980] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.980] lstrlenW (lpString=".xls") returned 4 [0077.980] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.980] lstrlenW (lpString=".xlsx") returned 5 [0077.980] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0077.980] lstrlenW (lpString=".ppt") returned 4 [0077.980] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.980] lstrlenW (lpString=".zip") returned 4 [0077.980] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.980] lstrlenW (lpString=".rar") returned 4 [0077.980] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.980] lstrlenW (lpString=".bz2") returned 4 [0077.980] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.980] lstrlenW (lpString=".7z") returned 3 [0077.980] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.980] lstrlenW (lpString=".dbf") returned 4 [0077.980] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.980] lstrlenW (lpString=".1cd") returned 4 [0077.980] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0077.980] lstrlenW (lpString=".jpg") returned 4 [0077.980] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.980] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") [0077.981] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31968) returned 1 [0077.981] CloseHandle (hObject=0x180) returned 1 [0077.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0077.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.981] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.981] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0077.982] GetLastError () returned 0x0 [0077.982] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0077.987] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0077.989] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.989] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.989] SetEndOfFile (hFile=0x22c) returned 1 [0077.989] CloseHandle (hObject=0x22c) returned 1 [0077.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.989] SetEndOfFile (hFile=0x180) returned 1 [0077.990] CloseHandle (hObject=0x180) returned 1 [0077.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0077.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString=".doc") returned 4 [0077.991] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".docx") returned 5 [0077.991] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0077.991] lstrlenW (lpString=".pdf") returned 4 [0077.991] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".xls") returned 4 [0077.991] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".xlsx") returned 5 [0077.991] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0077.991] lstrlenW (lpString=".ppt") returned 4 [0077.991] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString=".zip") returned 4 [0077.991] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".rar") returned 4 [0077.991] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".bz2") returned 4 [0077.991] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString=".7z") returned 3 [0077.991] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0077.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString=".dbf") returned 4 [0077.991] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0077.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString=".1cd") returned 4 [0077.991] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0077.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0077.991] lstrlenW (lpString=".jpg") returned 4 [0077.991] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0077.991] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") [0077.999] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32184) returned 1 [0077.999] CloseHandle (hObject=0x180) returned 1 [0077.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0077.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.009] GetLastError () returned 0x0 [0078.009] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.026] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.027] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.027] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.027] SetEndOfFile (hFile=0x22c) returned 1 [0078.027] CloseHandle (hObject=0x22c) returned 1 [0078.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.028] SetEndOfFile (hFile=0x180) returned 1 [0078.028] CloseHandle (hObject=0x180) returned 1 [0078.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0078.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.029] lstrlenW (lpString=".doc") returned 4 [0078.029] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".docx") returned 5 [0078.029] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0078.029] lstrlenW (lpString=".pdf") returned 4 [0078.029] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".xls") returned 4 [0078.029] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".xlsx") returned 5 [0078.029] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0078.029] lstrlenW (lpString=".ppt") returned 4 [0078.029] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.029] lstrlenW (lpString=".zip") returned 4 [0078.029] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".rar") returned 4 [0078.029] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".bz2") returned 4 [0078.029] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.029] lstrlenW (lpString=".7z") returned 3 [0078.029] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.030] lstrlenW (lpString=".dbf") returned 4 [0078.030] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.030] lstrlenW (lpString=".1cd") returned 4 [0078.030] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0078.030] lstrlenW (lpString=".jpg") returned 4 [0078.030] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.030] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") [0078.030] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32184) returned 1 [0078.030] CloseHandle (hObject=0x180) returned 1 [0078.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0078.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.031] GetLastError () returned 0x0 [0078.031] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.033] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.034] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.035] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.035] SetEndOfFile (hFile=0x22c) returned 1 [0078.035] CloseHandle (hObject=0x22c) returned 1 [0078.035] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.035] SetEndOfFile (hFile=0x180) returned 1 [0078.036] CloseHandle (hObject=0x180) returned 1 [0078.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0078.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.036] lstrlenW (lpString=".doc") returned 4 [0078.036] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.036] lstrlenW (lpString=".docx") returned 5 [0078.036] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0078.036] lstrlenW (lpString=".pdf") returned 4 [0078.036] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.036] lstrlenW (lpString=".xls") returned 4 [0078.036] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.036] lstrlenW (lpString=".xlsx") returned 5 [0078.036] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0078.036] lstrlenW (lpString=".ppt") returned 4 [0078.036] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.037] lstrlenW (lpString=".zip") returned 4 [0078.037] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.037] lstrlenW (lpString=".rar") returned 4 [0078.037] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.037] lstrlenW (lpString=".bz2") returned 4 [0078.037] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.037] lstrlenW (lpString=".7z") returned 3 [0078.037] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.037] lstrlenW (lpString=".dbf") returned 4 [0078.037] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.037] lstrlenW (lpString=".1cd") returned 4 [0078.037] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0078.037] lstrlenW (lpString=".jpg") returned 4 [0078.037] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.037] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") [0078.114] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32616) returned 1 [0078.114] CloseHandle (hObject=0x190) returned 1 [0078.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0078.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0078.115] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.115] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0078.115] GetLastError () returned 0x0 [0078.115] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7f68, lpOverlapped=0x0) returned 1 [0078.124] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0078.125] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.125] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.125] SetEndOfFile (hFile=0x158) returned 1 [0078.126] CloseHandle (hObject=0x158) returned 1 [0078.126] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.126] SetEndOfFile (hFile=0x190) returned 1 [0078.127] CloseHandle (hObject=0x190) returned 1 [0078.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0078.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.251] lstrlenW (lpString=".doc") returned 4 [0078.251] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.251] lstrlenW (lpString=".docx") returned 5 [0078.251] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0078.251] lstrlenW (lpString=".pdf") returned 4 [0078.251] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.251] lstrlenW (lpString=".xls") returned 4 [0078.251] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.251] lstrlenW (lpString=".xlsx") returned 5 [0078.251] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0078.251] lstrlenW (lpString=".ppt") returned 4 [0078.251] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.252] lstrlenW (lpString=".zip") returned 4 [0078.252] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.252] lstrlenW (lpString=".rar") returned 4 [0078.252] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.252] lstrlenW (lpString=".bz2") returned 4 [0078.252] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.252] lstrlenW (lpString=".7z") returned 3 [0078.252] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.252] lstrlenW (lpString=".dbf") returned 4 [0078.252] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.252] lstrlenW (lpString=".1cd") returned 4 [0078.252] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0078.252] lstrlenW (lpString=".jpg") returned 4 [0078.252] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.252] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") [0078.252] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17172) returned 1 [0078.253] CloseHandle (hObject=0x15c) returned 1 [0078.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0078.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.253] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.253] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.253] GetLastError () returned 0x0 [0078.253] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4314, lpOverlapped=0x0) returned 1 [0078.293] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4320, lpOverlapped=0x0) returned 1 [0078.294] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.294] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.295] SetEndOfFile (hFile=0x180) returned 1 [0078.295] CloseHandle (hObject=0x180) returned 1 [0078.295] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.295] SetEndOfFile (hFile=0x15c) returned 1 [0078.296] CloseHandle (hObject=0x15c) returned 1 [0078.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0078.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.296] lstrlenW (lpString=".doc") returned 4 [0078.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.296] lstrlenW (lpString=".docx") returned 5 [0078.296] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.296] lstrlenW (lpString=".pdf") returned 4 [0078.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.296] lstrlenW (lpString=".xls") returned 4 [0078.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.296] lstrlenW (lpString=".xlsx") returned 5 [0078.296] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.296] lstrlenW (lpString=".ppt") returned 4 [0078.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.297] lstrlenW (lpString=".zip") returned 4 [0078.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.297] lstrlenW (lpString=".rar") returned 4 [0078.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.297] lstrlenW (lpString=".bz2") returned 4 [0078.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.297] lstrlenW (lpString=".7z") returned 3 [0078.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.297] lstrlenW (lpString=".dbf") returned 4 [0078.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.297] lstrlenW (lpString=".1cd") returned 4 [0078.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0078.297] lstrlenW (lpString=".jpg") returned 4 [0078.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.297] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") [0078.297] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19328) returned 1 [0078.298] CloseHandle (hObject=0x15c) returned 1 [0078.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0078.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.298] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.298] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.298] GetLastError () returned 0x0 [0078.298] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0078.308] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0078.309] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.309] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.309] SetEndOfFile (hFile=0x180) returned 1 [0078.311] CloseHandle (hObject=0x180) returned 1 [0078.311] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.312] SetEndOfFile (hFile=0x15c) returned 1 [0078.312] CloseHandle (hObject=0x15c) returned 1 [0078.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0078.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.313] lstrlenW (lpString=".doc") returned 4 [0078.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.313] lstrlenW (lpString=".docx") returned 5 [0078.313] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.313] lstrlenW (lpString=".pdf") returned 4 [0078.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.313] lstrlenW (lpString=".xls") returned 4 [0078.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.313] lstrlenW (lpString=".xlsx") returned 5 [0078.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.313] lstrlenW (lpString=".ppt") returned 4 [0078.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.313] lstrlenW (lpString=".zip") returned 4 [0078.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.313] lstrlenW (lpString=".rar") returned 4 [0078.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.313] lstrlenW (lpString=".bz2") returned 4 [0078.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.313] lstrlenW (lpString=".7z") returned 3 [0078.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.313] lstrlenW (lpString=".dbf") returned 4 [0078.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.314] lstrlenW (lpString=".1cd") returned 4 [0078.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0078.314] lstrlenW (lpString=".jpg") returned 4 [0078.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.314] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") [0078.314] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5908) returned 1 [0078.314] CloseHandle (hObject=0x15c) returned 1 [0078.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0078.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.314] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.315] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.315] GetLastError () returned 0x0 [0078.315] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1714, lpOverlapped=0x0) returned 1 [0078.324] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0078.325] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.325] SetEndOfFile (hFile=0x180) returned 1 [0078.325] CloseHandle (hObject=0x180) returned 1 [0078.325] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.325] SetEndOfFile (hFile=0x15c) returned 1 [0078.326] CloseHandle (hObject=0x15c) returned 1 [0078.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0078.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.327] lstrlenW (lpString=".doc") returned 4 [0078.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString=".docx") returned 5 [0078.327] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.327] lstrlenW (lpString=".pdf") returned 4 [0078.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString=".xls") returned 4 [0078.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.327] lstrlenW (lpString=".xlsx") returned 5 [0078.327] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.327] lstrlenW (lpString=".ppt") returned 4 [0078.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.327] lstrlenW (lpString=".zip") returned 4 [0078.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.327] lstrlenW (lpString=".rar") returned 4 [0078.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString=".bz2") returned 4 [0078.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString=".7z") returned 3 [0078.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.327] lstrlenW (lpString=".dbf") returned 4 [0078.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.327] lstrlenW (lpString=".1cd") returned 4 [0078.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0078.328] lstrlenW (lpString=".jpg") returned 4 [0078.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.328] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") [0078.328] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19240) returned 1 [0078.328] CloseHandle (hObject=0x15c) returned 1 [0078.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0078.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.328] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.328] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.329] GetLastError () returned 0x0 [0078.329] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4b28, lpOverlapped=0x0) returned 1 [0078.354] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0078.355] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.356] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.356] SetEndOfFile (hFile=0x180) returned 1 [0078.356] CloseHandle (hObject=0x180) returned 1 [0078.356] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.356] SetEndOfFile (hFile=0x15c) returned 1 [0078.357] CloseHandle (hObject=0x15c) returned 1 [0078.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0078.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.357] lstrlenW (lpString=".doc") returned 4 [0078.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.357] lstrlenW (lpString=".docx") returned 5 [0078.357] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.357] lstrlenW (lpString=".pdf") returned 4 [0078.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.357] lstrlenW (lpString=".xls") returned 4 [0078.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.357] lstrlenW (lpString=".xlsx") returned 5 [0078.357] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.357] lstrlenW (lpString=".ppt") returned 4 [0078.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.358] lstrlenW (lpString=".zip") returned 4 [0078.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.358] lstrlenW (lpString=".rar") returned 4 [0078.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.358] lstrlenW (lpString=".bz2") returned 4 [0078.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.358] lstrlenW (lpString=".7z") returned 3 [0078.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.358] lstrlenW (lpString=".dbf") returned 4 [0078.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.358] lstrlenW (lpString=".1cd") returned 4 [0078.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0078.358] lstrlenW (lpString=".jpg") returned 4 [0078.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.358] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") [0078.358] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15832) returned 1 [0078.358] CloseHandle (hObject=0x15c) returned 1 [0078.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0078.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.359] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.359] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.359] GetLastError () returned 0x0 [0078.359] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0078.366] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0078.368] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.368] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.368] SetEndOfFile (hFile=0x180) returned 1 [0078.368] CloseHandle (hObject=0x180) returned 1 [0078.368] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.368] SetEndOfFile (hFile=0x15c) returned 1 [0078.369] CloseHandle (hObject=0x15c) returned 1 [0078.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.370] lstrlenW (lpString=".doc") returned 4 [0078.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".docx") returned 5 [0078.370] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.370] lstrlenW (lpString=".pdf") returned 4 [0078.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".xls") returned 4 [0078.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".xlsx") returned 5 [0078.370] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.370] lstrlenW (lpString=".ppt") returned 4 [0078.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.370] lstrlenW (lpString=".zip") returned 4 [0078.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".rar") returned 4 [0078.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".bz2") returned 4 [0078.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".7z") returned 3 [0078.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.370] lstrlenW (lpString=".dbf") returned 4 [0078.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.371] lstrlenW (lpString=".1cd") returned 4 [0078.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0078.371] lstrlenW (lpString=".jpg") returned 4 [0078.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.371] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") [0078.371] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5504) returned 1 [0078.371] CloseHandle (hObject=0x15c) returned 1 [0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.371] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.372] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.372] GetLastError () returned 0x0 [0078.372] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1580, lpOverlapped=0x0) returned 1 [0078.378] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0078.379] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.379] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.379] SetEndOfFile (hFile=0x180) returned 1 [0078.379] CloseHandle (hObject=0x180) returned 1 [0078.379] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.379] SetEndOfFile (hFile=0x15c) returned 1 [0078.380] CloseHandle (hObject=0x15c) returned 1 [0078.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0078.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.381] lstrlenW (lpString=".doc") returned 4 [0078.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString=".docx") returned 5 [0078.381] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.381] lstrlenW (lpString=".pdf") returned 4 [0078.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString=".xls") returned 4 [0078.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.381] lstrlenW (lpString=".xlsx") returned 5 [0078.381] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.381] lstrlenW (lpString=".ppt") returned 4 [0078.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.381] lstrlenW (lpString=".zip") returned 4 [0078.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.381] lstrlenW (lpString=".rar") returned 4 [0078.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString=".bz2") returned 4 [0078.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString=".7z") returned 3 [0078.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.381] lstrlenW (lpString=".dbf") returned 4 [0078.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.381] lstrlenW (lpString=".1cd") returned 4 [0078.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0078.381] lstrlenW (lpString=".jpg") returned 4 [0078.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.381] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") [0078.382] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4320) returned 1 [0078.382] CloseHandle (hObject=0x15c) returned 1 [0078.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0078.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.382] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.382] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.383] GetLastError () returned 0x0 [0078.383] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x10e0, lpOverlapped=0x0) returned 1 [0078.385] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0078.386] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.386] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.386] SetEndOfFile (hFile=0x180) returned 1 [0078.386] CloseHandle (hObject=0x180) returned 1 [0078.386] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.386] SetEndOfFile (hFile=0x15c) returned 1 [0078.387] CloseHandle (hObject=0x15c) returned 1 [0078.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0078.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.387] lstrlenW (lpString=".doc") returned 4 [0078.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.387] lstrlenW (lpString=".docx") returned 5 [0078.387] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.388] lstrlenW (lpString=".pdf") returned 4 [0078.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString=".xls") returned 4 [0078.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.388] lstrlenW (lpString=".xlsx") returned 5 [0078.388] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.388] lstrlenW (lpString=".ppt") returned 4 [0078.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.388] lstrlenW (lpString=".zip") returned 4 [0078.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.388] lstrlenW (lpString=".rar") returned 4 [0078.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString=".bz2") returned 4 [0078.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString=".7z") returned 3 [0078.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.388] lstrlenW (lpString=".dbf") returned 4 [0078.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.388] lstrlenW (lpString=".1cd") returned 4 [0078.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0078.388] lstrlenW (lpString=".jpg") returned 4 [0078.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.388] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") [0078.390] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2020) returned 1 [0078.390] CloseHandle (hObject=0x15c) returned 1 [0078.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0078.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.390] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.390] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.391] GetLastError () returned 0x0 [0078.391] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0078.393] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0078.394] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.394] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.394] SetEndOfFile (hFile=0x180) returned 1 [0078.394] CloseHandle (hObject=0x180) returned 1 [0078.394] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.394] SetEndOfFile (hFile=0x15c) returned 1 [0078.395] CloseHandle (hObject=0x15c) returned 1 [0078.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0078.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.396] lstrlenW (lpString=".doc") returned 4 [0078.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.396] lstrlenW (lpString=".docx") returned 5 [0078.396] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.396] lstrlenW (lpString=".pdf") returned 4 [0078.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.396] lstrlenW (lpString=".xls") returned 4 [0078.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.396] lstrlenW (lpString=".xlsx") returned 5 [0078.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.397] lstrlenW (lpString=".ppt") returned 4 [0078.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.397] lstrlenW (lpString=".zip") returned 4 [0078.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.397] lstrlenW (lpString=".rar") returned 4 [0078.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.397] lstrlenW (lpString=".bz2") returned 4 [0078.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.397] lstrlenW (lpString=".7z") returned 3 [0078.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.397] lstrlenW (lpString=".dbf") returned 4 [0078.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.397] lstrlenW (lpString=".1cd") returned 4 [0078.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0078.397] lstrlenW (lpString=".jpg") returned 4 [0078.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.397] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") [0078.398] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7992) returned 1 [0078.398] CloseHandle (hObject=0x15c) returned 1 [0078.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0078.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.398] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.398] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.399] GetLastError () returned 0x0 [0078.399] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0078.402] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0078.403] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.403] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.403] SetEndOfFile (hFile=0x180) returned 1 [0078.403] CloseHandle (hObject=0x180) returned 1 [0078.404] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.404] SetEndOfFile (hFile=0x15c) returned 1 [0078.404] CloseHandle (hObject=0x15c) returned 1 [0078.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0078.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.405] lstrlenW (lpString=".doc") returned 4 [0078.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.405] lstrlenW (lpString=".docx") returned 5 [0078.405] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.405] lstrlenW (lpString=".pdf") returned 4 [0078.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.405] lstrlenW (lpString=".xls") returned 4 [0078.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.405] lstrlenW (lpString=".xlsx") returned 5 [0078.405] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.405] lstrlenW (lpString=".ppt") returned 4 [0078.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.405] lstrlenW (lpString=".zip") returned 4 [0078.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.405] lstrlenW (lpString=".rar") returned 4 [0078.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.405] lstrlenW (lpString=".bz2") returned 4 [0078.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.405] lstrlenW (lpString=".7z") returned 3 [0078.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.406] lstrlenW (lpString=".dbf") returned 4 [0078.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.406] lstrlenW (lpString=".1cd") returned 4 [0078.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0078.406] lstrlenW (lpString=".jpg") returned 4 [0078.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.406] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") [0078.406] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10508) returned 1 [0078.406] CloseHandle (hObject=0x15c) returned 1 [0078.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0078.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.407] GetLastError () returned 0x0 [0078.407] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x290c, lpOverlapped=0x0) returned 1 [0078.409] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0078.410] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.410] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.410] SetEndOfFile (hFile=0x180) returned 1 [0078.410] CloseHandle (hObject=0x180) returned 1 [0078.410] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.410] SetEndOfFile (hFile=0x15c) returned 1 [0078.411] CloseHandle (hObject=0x15c) returned 1 [0078.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0078.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.412] lstrlenW (lpString=".doc") returned 4 [0078.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString=".docx") returned 5 [0078.412] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.412] lstrlenW (lpString=".pdf") returned 4 [0078.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString=".xls") returned 4 [0078.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.412] lstrlenW (lpString=".xlsx") returned 5 [0078.412] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.412] lstrlenW (lpString=".ppt") returned 4 [0078.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.412] lstrlenW (lpString=".zip") returned 4 [0078.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.412] lstrlenW (lpString=".rar") returned 4 [0078.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString=".bz2") returned 4 [0078.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString=".7z") returned 3 [0078.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.412] lstrlenW (lpString=".dbf") returned 4 [0078.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.412] lstrlenW (lpString=".1cd") returned 4 [0078.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0078.412] lstrlenW (lpString=".jpg") returned 4 [0078.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.413] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") [0078.413] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2900) returned 1 [0078.413] CloseHandle (hObject=0x15c) returned 1 [0078.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0078.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.413] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.413] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0078.414] GetLastError () returned 0x0 [0078.414] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb54, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb60, lpOverlapped=0x0) returned 1 [0078.445] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.445] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.445] SetEndOfFile (hFile=0x180) returned 1 [0078.449] CloseHandle (hObject=0x180) returned 1 [0078.449] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.449] SetEndOfFile (hFile=0x15c) returned 1 [0078.450] CloseHandle (hObject=0x15c) returned 1 [0078.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0079.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.150] lstrlenW (lpString=".doc") returned 4 [0079.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.150] lstrlenW (lpString=".docx") returned 5 [0079.151] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.154] lstrlenW (lpString=".pdf") returned 4 [0079.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.154] lstrlenW (lpString=".xls") returned 4 [0079.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.155] lstrlenW (lpString=".xlsx") returned 5 [0079.155] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.155] lstrlenW (lpString=".ppt") returned 4 [0079.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.156] lstrlenW (lpString=".zip") returned 4 [0079.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.156] lstrlenW (lpString=".rar") returned 4 [0079.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.160] lstrlenW (lpString=".bz2") returned 4 [0079.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.160] lstrlenW (lpString=".7z") returned 3 [0079.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.162] lstrlenW (lpString=".dbf") returned 4 [0079.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.162] lstrlenW (lpString=".1cd") returned 4 [0079.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0079.162] lstrlenW (lpString=".jpg") returned 4 [0079.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.162] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") [0079.218] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4964) returned 1 [0079.218] CloseHandle (hObject=0x1f0) returned 1 [0079.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0079.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.218] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.218] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.219] GetLastError () returned 0x0 [0079.219] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1364, lpOverlapped=0x0) returned 1 [0079.310] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0079.311] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.311] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.312] SetEndOfFile (hFile=0x1fc) returned 1 [0079.312] CloseHandle (hObject=0x1fc) returned 1 [0079.312] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.312] SetEndOfFile (hFile=0x1f0) returned 1 [0079.313] CloseHandle (hObject=0x1f0) returned 1 [0079.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0079.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.313] lstrlenW (lpString=".doc") returned 4 [0079.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.313] lstrlenW (lpString=".docx") returned 5 [0079.313] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.313] lstrlenW (lpString=".pdf") returned 4 [0079.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.313] lstrlenW (lpString=".xls") returned 4 [0079.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.313] lstrlenW (lpString=".xlsx") returned 5 [0079.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.313] lstrlenW (lpString=".ppt") returned 4 [0079.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.314] lstrlenW (lpString=".zip") returned 4 [0079.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.314] lstrlenW (lpString=".rar") returned 4 [0079.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.314] lstrlenW (lpString=".bz2") returned 4 [0079.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.314] lstrlenW (lpString=".7z") returned 3 [0079.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.314] lstrlenW (lpString=".dbf") returned 4 [0079.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.314] lstrlenW (lpString=".1cd") returned 4 [0079.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0079.314] lstrlenW (lpString=".jpg") returned 4 [0079.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.314] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") [0079.314] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5880) returned 1 [0079.315] CloseHandle (hObject=0x1f0) returned 1 [0079.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0079.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.315] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.315] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.315] GetLastError () returned 0x0 [0079.315] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0079.374] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0079.375] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.375] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.375] SetEndOfFile (hFile=0x1fc) returned 1 [0079.512] CloseHandle (hObject=0x1fc) returned 1 [0079.512] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.512] SetEndOfFile (hFile=0x1f0) returned 1 [0079.528] CloseHandle (hObject=0x1f0) returned 1 [0079.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0079.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.545] lstrlenW (lpString=".doc") returned 4 [0079.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString=".docx") returned 5 [0079.545] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.545] lstrlenW (lpString=".pdf") returned 4 [0079.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString=".xls") returned 4 [0079.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.545] lstrlenW (lpString=".xlsx") returned 5 [0079.545] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.545] lstrlenW (lpString=".ppt") returned 4 [0079.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.545] lstrlenW (lpString=".zip") returned 4 [0079.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.545] lstrlenW (lpString=".rar") returned 4 [0079.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString=".bz2") returned 4 [0079.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString=".7z") returned 3 [0079.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.545] lstrlenW (lpString=".dbf") returned 4 [0079.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.546] lstrlenW (lpString=".1cd") returned 4 [0079.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0079.546] lstrlenW (lpString=".jpg") returned 4 [0079.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.546] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") [0079.546] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17332) returned 1 [0079.546] CloseHandle (hObject=0x1f0) returned 1 [0079.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0079.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0079.548] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.548] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0079.548] GetLastError () returned 0x0 [0079.548] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x43b4, lpOverlapped=0x0) returned 1 [0079.574] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0079.575] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.575] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.575] SetEndOfFile (hFile=0x1fc) returned 1 [0079.575] CloseHandle (hObject=0x1fc) returned 1 [0079.576] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.576] SetEndOfFile (hFile=0x1f0) returned 1 [0079.576] CloseHandle (hObject=0x1f0) returned 1 [0079.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0079.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.577] lstrlenW (lpString=".doc") returned 4 [0079.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.577] lstrlenW (lpString=".docx") returned 5 [0079.577] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.577] lstrlenW (lpString=".pdf") returned 4 [0079.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.577] lstrlenW (lpString=".xls") returned 4 [0079.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.577] lstrlenW (lpString=".xlsx") returned 5 [0079.577] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.577] lstrlenW (lpString=".ppt") returned 4 [0079.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.577] lstrlenW (lpString=".zip") returned 4 [0079.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.577] lstrlenW (lpString=".rar") returned 4 [0079.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.577] lstrlenW (lpString=".bz2") returned 4 [0079.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.578] lstrlenW (lpString=".7z") returned 3 [0079.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.578] lstrlenW (lpString=".dbf") returned 4 [0079.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.578] lstrlenW (lpString=".1cd") returned 4 [0079.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0079.578] lstrlenW (lpString=".jpg") returned 4 [0079.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.578] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") [0079.584] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8680) returned 1 [0079.584] CloseHandle (hObject=0x158) returned 1 [0079.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0079.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.584] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.585] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.585] GetLastError () returned 0x0 [0079.585] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x21e8, lpOverlapped=0x0) returned 1 [0079.587] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0079.588] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.588] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.588] SetEndOfFile (hFile=0x180) returned 1 [0079.588] CloseHandle (hObject=0x180) returned 1 [0079.588] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.588] SetEndOfFile (hFile=0x158) returned 1 [0079.589] CloseHandle (hObject=0x158) returned 1 [0079.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0079.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.590] lstrlenW (lpString=".doc") returned 4 [0079.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString=".docx") returned 5 [0079.590] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.590] lstrlenW (lpString=".pdf") returned 4 [0079.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString=".xls") returned 4 [0079.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.590] lstrlenW (lpString=".xlsx") returned 5 [0079.590] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.590] lstrlenW (lpString=".ppt") returned 4 [0079.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.590] lstrlenW (lpString=".zip") returned 4 [0079.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.590] lstrlenW (lpString=".rar") returned 4 [0079.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString=".bz2") returned 4 [0079.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString=".7z") returned 3 [0079.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.590] lstrlenW (lpString=".dbf") returned 4 [0079.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.591] lstrlenW (lpString=".1cd") returned 4 [0079.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0079.591] lstrlenW (lpString=".jpg") returned 4 [0079.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.591] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") [0079.591] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10364) returned 1 [0079.591] CloseHandle (hObject=0x158) returned 1 [0079.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0079.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.592] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.592] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.592] GetLastError () returned 0x0 [0079.592] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x287c, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0079.595] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.595] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.596] SetEndOfFile (hFile=0x180) returned 1 [0079.596] CloseHandle (hObject=0x180) returned 1 [0079.596] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.596] SetEndOfFile (hFile=0x158) returned 1 [0079.597] CloseHandle (hObject=0x158) returned 1 [0079.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0079.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.597] lstrlenW (lpString=".doc") returned 4 [0079.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.597] lstrlenW (lpString=".docx") returned 5 [0079.597] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.597] lstrlenW (lpString=".pdf") returned 4 [0079.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.597] lstrlenW (lpString=".xls") returned 4 [0079.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.597] lstrlenW (lpString=".xlsx") returned 5 [0079.597] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.597] lstrlenW (lpString=".ppt") returned 4 [0079.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.598] lstrlenW (lpString=".zip") returned 4 [0079.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.598] lstrlenW (lpString=".rar") returned 4 [0079.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.598] lstrlenW (lpString=".bz2") returned 4 [0079.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.598] lstrlenW (lpString=".7z") returned 3 [0079.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.598] lstrlenW (lpString=".dbf") returned 4 [0079.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.598] lstrlenW (lpString=".1cd") returned 4 [0079.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0079.598] lstrlenW (lpString=".jpg") returned 4 [0079.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.598] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") [0079.599] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13808) returned 1 [0079.599] CloseHandle (hObject=0x158) returned 1 [0079.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0079.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.599] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.599] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.600] GetLastError () returned 0x0 [0079.600] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x35f0, lpOverlapped=0x0) returned 1 [0079.610] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3600, lpOverlapped=0x0) returned 1 [0079.611] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.612] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.612] SetEndOfFile (hFile=0x180) returned 1 [0079.612] CloseHandle (hObject=0x180) returned 1 [0079.612] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.612] SetEndOfFile (hFile=0x158) returned 1 [0079.613] CloseHandle (hObject=0x158) returned 1 [0079.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0079.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.613] lstrlenW (lpString=".doc") returned 4 [0079.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.613] lstrlenW (lpString=".docx") returned 5 [0079.613] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.613] lstrlenW (lpString=".pdf") returned 4 [0079.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.613] lstrlenW (lpString=".xls") returned 4 [0079.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.613] lstrlenW (lpString=".xlsx") returned 5 [0079.614] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.614] lstrlenW (lpString=".ppt") returned 4 [0079.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.614] lstrlenW (lpString=".zip") returned 4 [0079.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.614] lstrlenW (lpString=".rar") returned 4 [0079.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.614] lstrlenW (lpString=".bz2") returned 4 [0079.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.614] lstrlenW (lpString=".7z") returned 3 [0079.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.614] lstrlenW (lpString=".dbf") returned 4 [0079.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.614] lstrlenW (lpString=".1cd") returned 4 [0079.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0079.614] lstrlenW (lpString=".jpg") returned 4 [0079.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.614] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") [0079.615] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4612) returned 1 [0079.615] CloseHandle (hObject=0x158) returned 1 [0079.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0079.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.615] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.615] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.616] GetLastError () returned 0x0 [0079.616] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1204, lpOverlapped=0x0) returned 1 [0079.729] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0079.730] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.730] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.731] SetEndOfFile (hFile=0x180) returned 1 [0079.803] CloseHandle (hObject=0x180) returned 1 [0079.803] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.803] SetEndOfFile (hFile=0x158) returned 1 [0079.804] CloseHandle (hObject=0x158) returned 1 [0079.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0079.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.978] lstrlenW (lpString=".doc") returned 4 [0079.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.978] lstrlenW (lpString=".docx") returned 5 [0079.978] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.978] lstrlenW (lpString=".pdf") returned 4 [0079.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.979] lstrlenW (lpString=".xls") returned 4 [0079.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.998] lstrlenW (lpString=".xlsx") returned 5 [0079.998] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.998] lstrlenW (lpString=".ppt") returned 4 [0079.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.998] lstrlenW (lpString=".zip") returned 4 [0079.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.998] lstrlenW (lpString=".rar") returned 4 [0079.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.998] lstrlenW (lpString=".bz2") returned 4 [0079.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.998] lstrlenW (lpString=".7z") returned 3 [0079.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.998] lstrlenW (lpString=".dbf") returned 4 [0079.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.999] lstrlenW (lpString=".1cd") returned 4 [0079.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0079.999] lstrlenW (lpString=".jpg") returned 4 [0079.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.999] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") [0080.830] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13784) returned 1 [0080.839] CloseHandle (hObject=0x210) returned 1 [0080.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0080.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0080.840] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.850] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.975] GetLastError () returned 0x0 [0080.975] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x35d8, lpOverlapped=0x0) returned 1 [0080.977] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0080.978] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.978] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.978] SetEndOfFile (hFile=0x150) returned 1 [0081.148] CloseHandle (hObject=0x150) returned 1 [0081.148] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.148] SetEndOfFile (hFile=0x210) returned 1 [0081.149] CloseHandle (hObject=0x210) returned 1 [0081.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0081.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.818] lstrlenW (lpString=".doc") returned 4 [0081.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString=".docx") returned 5 [0081.818] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0081.818] lstrlenW (lpString=".pdf") returned 4 [0081.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString=".xls") returned 4 [0081.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.818] lstrlenW (lpString=".xlsx") returned 5 [0081.818] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0081.818] lstrlenW (lpString=".ppt") returned 4 [0081.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.818] lstrlenW (lpString=".zip") returned 4 [0081.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.818] lstrlenW (lpString=".rar") returned 4 [0081.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString=".bz2") returned 4 [0081.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString=".7z") returned 3 [0081.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.818] lstrlenW (lpString=".dbf") returned 4 [0081.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.818] lstrlenW (lpString=".1cd") returned 4 [0081.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0081.819] lstrlenW (lpString=".jpg") returned 4 [0081.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.819] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") [0081.914] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=22532) returned 1 [0081.914] CloseHandle (hObject=0x210) returned 1 [0081.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0081.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.914] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.914] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.915] GetLastError () returned 0x0 [0081.915] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5804, lpOverlapped=0x0) returned 1 [0081.917] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5810, lpOverlapped=0x0) returned 1 [0081.919] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.919] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.919] SetEndOfFile (hFile=0x150) returned 1 [0081.919] CloseHandle (hObject=0x150) returned 1 [0081.919] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.919] SetEndOfFile (hFile=0x210) returned 1 [0081.920] CloseHandle (hObject=0x210) returned 1 [0081.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0081.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.921] lstrlenW (lpString=".doc") returned 4 [0081.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString=".docx") returned 5 [0081.921] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0081.921] lstrlenW (lpString=".pdf") returned 4 [0081.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString=".xls") returned 4 [0081.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.921] lstrlenW (lpString=".xlsx") returned 5 [0081.921] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0081.921] lstrlenW (lpString=".ppt") returned 4 [0081.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.921] lstrlenW (lpString=".zip") returned 4 [0081.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.921] lstrlenW (lpString=".rar") returned 4 [0081.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString=".bz2") returned 4 [0081.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString=".7z") returned 3 [0081.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.921] lstrlenW (lpString=".dbf") returned 4 [0081.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.921] lstrlenW (lpString=".1cd") returned 4 [0081.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0081.922] lstrlenW (lpString=".jpg") returned 4 [0081.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.922] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") [0081.922] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=22300) returned 1 [0081.922] CloseHandle (hObject=0x210) returned 1 [0081.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0081.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.923] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.923] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.923] GetLastError () returned 0x0 [0081.923] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x571c, lpOverlapped=0x0) returned 1 [0081.926] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5720, lpOverlapped=0x0) returned 1 [0081.927] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.927] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.928] SetEndOfFile (hFile=0x150) returned 1 [0081.928] CloseHandle (hObject=0x150) returned 1 [0081.928] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.928] SetEndOfFile (hFile=0x210) returned 1 [0081.929] CloseHandle (hObject=0x210) returned 1 [0081.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0081.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.929] lstrlenW (lpString=".doc") returned 4 [0081.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString=".docx") returned 5 [0081.930] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0081.930] lstrlenW (lpString=".pdf") returned 4 [0081.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString=".xls") returned 4 [0081.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.930] lstrlenW (lpString=".xlsx") returned 5 [0081.930] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0081.930] lstrlenW (lpString=".ppt") returned 4 [0081.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.930] lstrlenW (lpString=".zip") returned 4 [0081.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.930] lstrlenW (lpString=".rar") returned 4 [0081.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString=".bz2") returned 4 [0081.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString=".7z") returned 3 [0081.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.930] lstrlenW (lpString=".dbf") returned 4 [0081.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.930] lstrlenW (lpString=".1cd") returned 4 [0081.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0081.930] lstrlenW (lpString=".jpg") returned 4 [0081.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.931] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") [0081.932] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24908) returned 1 [0081.932] CloseHandle (hObject=0x210) returned 1 [0081.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0081.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.932] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.932] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.933] GetLastError () returned 0x0 [0081.933] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x614c, lpOverlapped=0x0) returned 1 [0081.936] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0081.937] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.937] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.937] SetEndOfFile (hFile=0x150) returned 1 [0081.938] CloseHandle (hObject=0x150) returned 1 [0081.938] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.938] SetEndOfFile (hFile=0x210) returned 1 [0081.939] CloseHandle (hObject=0x210) returned 1 [0081.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0081.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.939] lstrlenW (lpString=".doc") returned 4 [0081.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.939] lstrlenW (lpString=".docx") returned 5 [0081.939] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0081.939] lstrlenW (lpString=".pdf") returned 4 [0081.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.939] lstrlenW (lpString=".xls") returned 4 [0081.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.939] lstrlenW (lpString=".xlsx") returned 5 [0081.939] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0081.939] lstrlenW (lpString=".ppt") returned 4 [0081.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.939] lstrlenW (lpString=".zip") returned 4 [0081.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.939] lstrlenW (lpString=".rar") returned 4 [0081.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.940] lstrlenW (lpString=".bz2") returned 4 [0081.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.940] lstrlenW (lpString=".7z") returned 3 [0081.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.940] lstrlenW (lpString=".dbf") returned 4 [0081.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.940] lstrlenW (lpString=".1cd") returned 4 [0081.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0081.940] lstrlenW (lpString=".jpg") returned 4 [0081.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.940] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") [0081.940] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16100) returned 1 [0081.940] CloseHandle (hObject=0x210) returned 1 [0081.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0081.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.941] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.941] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.941] GetLastError () returned 0x0 [0081.941] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0081.944] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0081.945] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.945] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.945] SetEndOfFile (hFile=0x150) returned 1 [0081.945] CloseHandle (hObject=0x150) returned 1 [0081.945] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.945] SetEndOfFile (hFile=0x210) returned 1 [0081.946] CloseHandle (hObject=0x210) returned 1 [0081.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0081.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.946] lstrlenW (lpString=".doc") returned 4 [0081.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.946] lstrlenW (lpString=".docx") returned 5 [0081.946] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0081.947] lstrlenW (lpString=".pdf") returned 4 [0081.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString=".xls") returned 4 [0081.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.947] lstrlenW (lpString=".xlsx") returned 5 [0081.947] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0081.947] lstrlenW (lpString=".ppt") returned 4 [0081.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.947] lstrlenW (lpString=".zip") returned 4 [0081.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.947] lstrlenW (lpString=".rar") returned 4 [0081.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString=".bz2") returned 4 [0081.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString=".7z") returned 3 [0081.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.947] lstrlenW (lpString=".dbf") returned 4 [0081.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.947] lstrlenW (lpString=".1cd") returned 4 [0081.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0081.947] lstrlenW (lpString=".jpg") returned 4 [0081.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.947] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") [0081.948] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4536) returned 1 [0081.948] CloseHandle (hObject=0x210) returned 1 [0081.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0081.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.948] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.948] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.949] GetLastError () returned 0x0 [0081.949] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0082.183] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0082.184] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.184] WriteFile (in: hFile=0x150, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.185] SetEndOfFile (hFile=0x150) returned 1 [0082.185] CloseHandle (hObject=0x150) returned 1 [0082.185] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.185] SetEndOfFile (hFile=0x210) returned 1 [0082.186] CloseHandle (hObject=0x210) returned 1 [0082.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0082.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.385] lstrlenW (lpString=".doc") returned 4 [0082.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.385] lstrlenW (lpString=".docx") returned 5 [0082.385] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0082.385] lstrlenW (lpString=".pdf") returned 4 [0082.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.385] lstrlenW (lpString=".xls") returned 4 [0082.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.386] lstrlenW (lpString=".xlsx") returned 5 [0082.386] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0082.386] lstrlenW (lpString=".ppt") returned 4 [0082.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.386] lstrlenW (lpString=".zip") returned 4 [0082.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.386] lstrlenW (lpString=".rar") returned 4 [0082.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.386] lstrlenW (lpString=".bz2") returned 4 [0082.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.386] lstrlenW (lpString=".7z") returned 3 [0082.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.386] lstrlenW (lpString=".dbf") returned 4 [0082.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.386] lstrlenW (lpString=".1cd") returned 4 [0082.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0082.386] lstrlenW (lpString=".jpg") returned 4 [0082.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.386] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") [0083.451] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15888) returned 1 [0083.458] CloseHandle (hObject=0x1f0) returned 1 [0083.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0083.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.466] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.470] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0083.480] GetLastError () returned 0x0 [0083.480] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0083.482] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0083.483] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.483] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.483] SetEndOfFile (hFile=0x180) returned 1 [0083.483] CloseHandle (hObject=0x180) returned 1 [0083.483] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.483] SetEndOfFile (hFile=0x1f0) returned 1 [0083.484] CloseHandle (hObject=0x1f0) returned 1 [0083.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString=".doc") returned 4 [0083.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString=".docx") returned 5 [0083.485] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.485] lstrlenW (lpString=".pdf") returned 4 [0083.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString=".xls") returned 4 [0083.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.485] lstrlenW (lpString=".xlsx") returned 5 [0083.485] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.485] lstrlenW (lpString=".ppt") returned 4 [0083.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString=".zip") returned 4 [0083.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.485] lstrlenW (lpString=".rar") returned 4 [0083.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString=".bz2") returned 4 [0083.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString=".7z") returned 3 [0083.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString=".dbf") returned 4 [0083.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString=".1cd") returned 4 [0083.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0083.485] lstrlenW (lpString=".jpg") returned 4 [0083.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.486] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") [0083.486] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16588) returned 1 [0083.486] CloseHandle (hObject=0x1f0) returned 1 [0083.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0083.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.487] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.487] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0083.487] GetLastError () returned 0x0 [0083.487] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0083.489] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0083.490] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.490] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.490] SetEndOfFile (hFile=0x180) returned 1 [0083.490] CloseHandle (hObject=0x180) returned 1 [0083.490] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.491] SetEndOfFile (hFile=0x1f0) returned 1 [0083.491] CloseHandle (hObject=0x1f0) returned 1 [0083.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0083.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.492] lstrlenW (lpString=".doc") returned 4 [0083.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString=".docx") returned 5 [0083.492] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0083.492] lstrlenW (lpString=".pdf") returned 4 [0083.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString=".xls") returned 4 [0083.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.492] lstrlenW (lpString=".xlsx") returned 5 [0083.492] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0083.492] lstrlenW (lpString=".ppt") returned 4 [0083.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.492] lstrlenW (lpString=".zip") returned 4 [0083.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.492] lstrlenW (lpString=".rar") returned 4 [0083.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString=".bz2") returned 4 [0083.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString=".7z") returned 3 [0083.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.492] lstrlenW (lpString=".dbf") returned 4 [0083.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.493] lstrlenW (lpString=".1cd") returned 4 [0083.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0083.493] lstrlenW (lpString=".jpg") returned 4 [0083.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.493] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") [0083.493] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11492) returned 1 [0083.493] CloseHandle (hObject=0x1f0) returned 1 [0083.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0083.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.493] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.494] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0083.494] GetLastError () returned 0x0 [0083.494] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0083.496] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0083.497] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.497] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.497] SetEndOfFile (hFile=0x180) returned 1 [0083.497] CloseHandle (hObject=0x180) returned 1 [0083.497] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.497] SetEndOfFile (hFile=0x1f0) returned 1 [0083.498] CloseHandle (hObject=0x1f0) returned 1 [0083.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0083.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.498] lstrlenW (lpString=".doc") returned 4 [0083.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.498] lstrlenW (lpString=".docx") returned 5 [0083.498] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0083.498] lstrlenW (lpString=".pdf") returned 4 [0083.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.498] lstrlenW (lpString=".xls") returned 4 [0083.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.499] lstrlenW (lpString=".xlsx") returned 5 [0083.499] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0083.499] lstrlenW (lpString=".ppt") returned 4 [0083.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.499] lstrlenW (lpString=".zip") returned 4 [0083.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.499] lstrlenW (lpString=".rar") returned 4 [0083.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.499] lstrlenW (lpString=".bz2") returned 4 [0083.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.499] lstrlenW (lpString=".7z") returned 3 [0083.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.499] lstrlenW (lpString=".dbf") returned 4 [0083.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.499] lstrlenW (lpString=".1cd") returned 4 [0083.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0083.499] lstrlenW (lpString=".jpg") returned 4 [0083.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.499] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") [0083.500] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=30336) returned 1 [0083.500] CloseHandle (hObject=0x1f0) returned 1 [0083.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0083.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.500] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.500] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0083.500] GetLastError () returned 0x0 [0083.500] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7680, lpOverlapped=0x0) returned 1 [0083.504] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7690, lpOverlapped=0x0) returned 1 [0083.505] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.505] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.505] SetEndOfFile (hFile=0x180) returned 1 [0083.505] CloseHandle (hObject=0x180) returned 1 [0083.505] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.505] SetEndOfFile (hFile=0x1f0) returned 1 [0083.506] CloseHandle (hObject=0x1f0) returned 1 [0083.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString=".doc") returned 4 [0083.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString=".docx") returned 5 [0083.507] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0083.507] lstrlenW (lpString=".pdf") returned 4 [0083.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString=".xls") returned 4 [0083.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.507] lstrlenW (lpString=".xlsx") returned 5 [0083.507] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0083.507] lstrlenW (lpString=".ppt") returned 4 [0083.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString=".zip") returned 4 [0083.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.507] lstrlenW (lpString=".rar") returned 4 [0083.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString=".bz2") returned 4 [0083.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString=".7z") returned 3 [0083.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString=".dbf") returned 4 [0083.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString=".1cd") returned 4 [0083.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0083.507] lstrlenW (lpString=".jpg") returned 4 [0083.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.508] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") [0083.511] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4920) returned 1 [0083.511] CloseHandle (hObject=0x1f0) returned 1 [0083.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0083.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.511] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.511] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0083.512] GetLastError () returned 0x0 [0083.512] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1338, lpOverlapped=0x0) returned 1 [0083.513] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0083.514] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.514] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.514] SetEndOfFile (hFile=0x180) returned 1 [0083.514] CloseHandle (hObject=0x180) returned 1 [0083.514] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.515] SetEndOfFile (hFile=0x1f0) returned 1 [0083.515] CloseHandle (hObject=0x1f0) returned 1 [0083.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0083.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.516] lstrlenW (lpString=".doc") returned 4 [0083.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString=".docx") returned 5 [0083.516] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0083.516] lstrlenW (lpString=".pdf") returned 4 [0083.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString=".xls") returned 4 [0083.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.516] lstrlenW (lpString=".xlsx") returned 5 [0083.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0083.516] lstrlenW (lpString=".ppt") returned 4 [0083.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.516] lstrlenW (lpString=".zip") returned 4 [0083.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.516] lstrlenW (lpString=".rar") returned 4 [0083.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString=".bz2") returned 4 [0083.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString=".7z") returned 3 [0083.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.516] lstrlenW (lpString=".dbf") returned 4 [0083.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.517] lstrlenW (lpString=".1cd") returned 4 [0083.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0083.517] lstrlenW (lpString=".jpg") returned 4 [0083.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.517] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") [0083.928] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21216) returned 1 [0083.934] CloseHandle (hObject=0x15c) returned 1 [0083.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0083.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.941] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.947] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.960] GetLastError () returned 0x0 [0083.960] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x52e0, lpOverlapped=0x0) returned 1 [0083.962] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0083.964] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.964] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.964] SetEndOfFile (hFile=0x190) returned 1 [0083.964] CloseHandle (hObject=0x190) returned 1 [0083.964] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.964] SetEndOfFile (hFile=0x15c) returned 1 [0083.965] CloseHandle (hObject=0x15c) returned 1 [0083.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0083.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.965] lstrlenW (lpString=".doc") returned 4 [0083.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString=".docx") returned 5 [0083.966] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0083.966] lstrlenW (lpString=".pdf") returned 4 [0083.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString=".xls") returned 4 [0083.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.966] lstrlenW (lpString=".xlsx") returned 5 [0083.966] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0083.966] lstrlenW (lpString=".ppt") returned 4 [0083.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.966] lstrlenW (lpString=".zip") returned 4 [0083.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.966] lstrlenW (lpString=".rar") returned 4 [0083.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString=".bz2") returned 4 [0083.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString=".7z") returned 3 [0083.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.966] lstrlenW (lpString=".dbf") returned 4 [0083.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.966] lstrlenW (lpString=".1cd") returned 4 [0083.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0083.966] lstrlenW (lpString=".jpg") returned 4 [0083.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.966] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") [0083.967] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8000) returned 1 [0083.967] CloseHandle (hObject=0x15c) returned 1 [0083.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0083.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.967] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.967] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.968] GetLastError () returned 0x0 [0083.968] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1f40, lpOverlapped=0x0) returned 1 [0083.969] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0083.970] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.971] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.971] SetEndOfFile (hFile=0x190) returned 1 [0083.971] CloseHandle (hObject=0x190) returned 1 [0083.971] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.971] SetEndOfFile (hFile=0x15c) returned 1 [0083.972] CloseHandle (hObject=0x15c) returned 1 [0083.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0083.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.972] lstrlenW (lpString=".doc") returned 4 [0083.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.972] lstrlenW (lpString=".docx") returned 5 [0083.972] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.972] lstrlenW (lpString=".pdf") returned 4 [0083.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.972] lstrlenW (lpString=".xls") returned 4 [0083.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.972] lstrlenW (lpString=".xlsx") returned 5 [0083.972] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.973] lstrlenW (lpString=".ppt") returned 4 [0083.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.973] lstrlenW (lpString=".zip") returned 4 [0083.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.973] lstrlenW (lpString=".rar") returned 4 [0083.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.973] lstrlenW (lpString=".bz2") returned 4 [0083.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.973] lstrlenW (lpString=".7z") returned 3 [0083.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.973] lstrlenW (lpString=".dbf") returned 4 [0083.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.973] lstrlenW (lpString=".1cd") returned 4 [0083.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0083.973] lstrlenW (lpString=".jpg") returned 4 [0083.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.973] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") [0083.974] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16468) returned 1 [0083.974] CloseHandle (hObject=0x15c) returned 1 [0083.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0083.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.974] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.974] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.974] GetLastError () returned 0x0 [0083.974] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4054, lpOverlapped=0x0) returned 1 [0083.976] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4060, lpOverlapped=0x0) returned 1 [0083.977] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.977] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.978] SetEndOfFile (hFile=0x190) returned 1 [0083.978] CloseHandle (hObject=0x190) returned 1 [0083.978] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.978] SetEndOfFile (hFile=0x15c) returned 1 [0083.981] CloseHandle (hObject=0x15c) returned 1 [0083.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0083.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.981] lstrlenW (lpString=".doc") returned 4 [0083.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.981] lstrlenW (lpString=".docx") returned 5 [0083.981] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0083.982] lstrlenW (lpString=".pdf") returned 4 [0083.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString=".xls") returned 4 [0083.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.982] lstrlenW (lpString=".xlsx") returned 5 [0083.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0083.982] lstrlenW (lpString=".ppt") returned 4 [0083.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.982] lstrlenW (lpString=".zip") returned 4 [0083.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.982] lstrlenW (lpString=".rar") returned 4 [0083.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString=".bz2") returned 4 [0083.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString=".7z") returned 3 [0083.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.982] lstrlenW (lpString=".dbf") returned 4 [0083.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.982] lstrlenW (lpString=".1cd") returned 4 [0083.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0083.982] lstrlenW (lpString=".jpg") returned 4 [0083.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.982] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") [0083.983] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6860) returned 1 [0083.983] CloseHandle (hObject=0x15c) returned 1 [0083.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0083.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.984] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.984] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.984] GetLastError () returned 0x0 [0083.984] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1acc, lpOverlapped=0x0) returned 1 [0083.986] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1ad0, lpOverlapped=0x0) returned 1 [0083.987] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.987] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.987] SetEndOfFile (hFile=0x190) returned 1 [0083.987] CloseHandle (hObject=0x190) returned 1 [0083.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.987] SetEndOfFile (hFile=0x15c) returned 1 [0083.988] CloseHandle (hObject=0x15c) returned 1 [0083.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0083.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.988] lstrlenW (lpString=".doc") returned 4 [0083.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.988] lstrlenW (lpString=".docx") returned 5 [0083.988] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0083.988] lstrlenW (lpString=".pdf") returned 4 [0083.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString=".xls") returned 4 [0083.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.989] lstrlenW (lpString=".xlsx") returned 5 [0083.989] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0083.989] lstrlenW (lpString=".ppt") returned 4 [0083.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.989] lstrlenW (lpString=".zip") returned 4 [0083.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.989] lstrlenW (lpString=".rar") returned 4 [0083.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString=".bz2") returned 4 [0083.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString=".7z") returned 3 [0083.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.989] lstrlenW (lpString=".dbf") returned 4 [0083.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.989] lstrlenW (lpString=".1cd") returned 4 [0083.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0083.989] lstrlenW (lpString=".jpg") returned 4 [0083.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.989] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") [0083.990] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6424) returned 1 [0083.990] CloseHandle (hObject=0x15c) returned 1 [0083.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0083.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.990] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.990] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.991] GetLastError () returned 0x0 [0083.991] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1918, lpOverlapped=0x0) returned 1 [0083.992] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0083.993] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.993] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.993] SetEndOfFile (hFile=0x190) returned 1 [0083.994] CloseHandle (hObject=0x190) returned 1 [0083.994] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.994] SetEndOfFile (hFile=0x15c) returned 1 [0083.994] CloseHandle (hObject=0x15c) returned 1 [0083.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0083.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.995] lstrlenW (lpString=".doc") returned 4 [0083.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.995] lstrlenW (lpString=".docx") returned 5 [0083.995] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0083.995] lstrlenW (lpString=".pdf") returned 4 [0083.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.995] lstrlenW (lpString=".xls") returned 4 [0083.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.995] lstrlenW (lpString=".xlsx") returned 5 [0083.995] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0083.995] lstrlenW (lpString=".ppt") returned 4 [0083.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.995] lstrlenW (lpString=".zip") returned 4 [0083.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.995] lstrlenW (lpString=".rar") returned 4 [0083.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.995] lstrlenW (lpString=".bz2") returned 4 [0083.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.995] lstrlenW (lpString=".7z") returned 3 [0083.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.995] lstrlenW (lpString=".dbf") returned 4 [0083.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.996] lstrlenW (lpString=".1cd") returned 4 [0083.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0083.996] lstrlenW (lpString=".jpg") returned 4 [0083.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.996] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") [0083.996] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8864) returned 1 [0083.996] CloseHandle (hObject=0x15c) returned 1 [0083.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0083.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.997] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.997] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.997] GetLastError () returned 0x0 [0083.997] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x22a0, lpOverlapped=0x0) returned 1 [0084.192] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x22b0, lpOverlapped=0x0) returned 1 [0084.201] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.201] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.201] SetEndOfFile (hFile=0x190) returned 1 [0084.201] CloseHandle (hObject=0x190) returned 1 [0084.201] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.201] SetEndOfFile (hFile=0x15c) returned 1 [0084.202] CloseHandle (hObject=0x15c) returned 1 [0084.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0084.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.202] lstrlenW (lpString=".doc") returned 4 [0084.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.202] lstrlenW (lpString=".docx") returned 5 [0084.202] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0084.202] lstrlenW (lpString=".pdf") returned 4 [0084.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString=".xls") returned 4 [0084.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.203] lstrlenW (lpString=".xlsx") returned 5 [0084.203] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0084.203] lstrlenW (lpString=".ppt") returned 4 [0084.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.203] lstrlenW (lpString=".zip") returned 4 [0084.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.203] lstrlenW (lpString=".rar") returned 4 [0084.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString=".bz2") returned 4 [0084.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString=".7z") returned 3 [0084.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.203] lstrlenW (lpString=".dbf") returned 4 [0084.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.203] lstrlenW (lpString=".1cd") returned 4 [0084.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0084.203] lstrlenW (lpString=".jpg") returned 4 [0084.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.203] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") [0084.204] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5492) returned 1 [0084.204] CloseHandle (hObject=0x15c) returned 1 [0084.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0084.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.204] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.204] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.205] GetLastError () returned 0x0 [0084.205] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1574, lpOverlapped=0x0) returned 1 [0084.222] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1580, lpOverlapped=0x0) returned 1 [0084.223] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.223] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.223] SetEndOfFile (hFile=0x190) returned 1 [0084.223] CloseHandle (hObject=0x190) returned 1 [0084.223] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.223] SetEndOfFile (hFile=0x15c) returned 1 [0084.224] CloseHandle (hObject=0x15c) returned 1 [0084.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.225] lstrlenW (lpString=".doc") returned 4 [0084.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString=".docx") returned 5 [0084.225] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0084.225] lstrlenW (lpString=".pdf") returned 4 [0084.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString=".xls") returned 4 [0084.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.225] lstrlenW (lpString=".xlsx") returned 5 [0084.225] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0084.225] lstrlenW (lpString=".ppt") returned 4 [0084.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.225] lstrlenW (lpString=".zip") returned 4 [0084.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.225] lstrlenW (lpString=".rar") returned 4 [0084.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString=".bz2") returned 4 [0084.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString=".7z") returned 3 [0084.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.225] lstrlenW (lpString=".dbf") returned 4 [0084.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.226] lstrlenW (lpString=".1cd") returned 4 [0084.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0084.226] lstrlenW (lpString=".jpg") returned 4 [0084.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.226] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") [0084.227] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3060) returned 1 [0084.227] CloseHandle (hObject=0x15c) returned 1 [0084.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0084.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.227] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.227] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.228] GetLastError () returned 0x0 [0084.228] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xbf4, lpOverlapped=0x0) returned 1 [0084.229] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc00, lpOverlapped=0x0) returned 1 [0084.230] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.230] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.230] SetEndOfFile (hFile=0x190) returned 1 [0084.230] CloseHandle (hObject=0x190) returned 1 [0084.230] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.231] SetEndOfFile (hFile=0x15c) returned 1 [0084.231] CloseHandle (hObject=0x15c) returned 1 [0084.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.232] lstrlenW (lpString=".doc") returned 4 [0084.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString=".docx") returned 5 [0084.232] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0084.232] lstrlenW (lpString=".pdf") returned 4 [0084.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString=".xls") returned 4 [0084.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.232] lstrlenW (lpString=".xlsx") returned 5 [0084.232] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0084.232] lstrlenW (lpString=".ppt") returned 4 [0084.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.232] lstrlenW (lpString=".zip") returned 4 [0084.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.232] lstrlenW (lpString=".rar") returned 4 [0084.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString=".bz2") returned 4 [0084.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString=".7z") returned 3 [0084.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.232] lstrlenW (lpString=".dbf") returned 4 [0084.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.232] lstrlenW (lpString=".1cd") returned 4 [0084.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0084.233] lstrlenW (lpString=".jpg") returned 4 [0084.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.233] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") [0084.233] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3140) returned 1 [0084.233] CloseHandle (hObject=0x15c) returned 1 [0084.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0084.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.233] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.233] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.234] GetLastError () returned 0x0 [0084.234] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc44, lpOverlapped=0x0) returned 1 [0084.236] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0084.236] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.236] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.237] SetEndOfFile (hFile=0x190) returned 1 [0084.237] CloseHandle (hObject=0x190) returned 1 [0084.237] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.237] SetEndOfFile (hFile=0x15c) returned 1 [0084.238] CloseHandle (hObject=0x15c) returned 1 [0084.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0084.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.238] lstrlenW (lpString=".doc") returned 4 [0084.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.238] lstrlenW (lpString=".docx") returned 5 [0084.238] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0084.238] lstrlenW (lpString=".pdf") returned 4 [0084.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.238] lstrlenW (lpString=".xls") returned 4 [0084.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.238] lstrlenW (lpString=".xlsx") returned 5 [0084.238] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0084.238] lstrlenW (lpString=".ppt") returned 4 [0084.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.238] lstrlenW (lpString=".zip") returned 4 [0084.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.238] lstrlenW (lpString=".rar") returned 4 [0084.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.239] lstrlenW (lpString=".bz2") returned 4 [0084.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.239] lstrlenW (lpString=".7z") returned 3 [0084.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.239] lstrlenW (lpString=".dbf") returned 4 [0084.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.239] lstrlenW (lpString=".1cd") returned 4 [0084.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0084.239] lstrlenW (lpString=".jpg") returned 4 [0084.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.239] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") [0084.239] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3644) returned 1 [0084.239] CloseHandle (hObject=0x15c) returned 1 [0084.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0084.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.240] GetLastError () returned 0x0 [0084.240] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xe3c, lpOverlapped=0x0) returned 1 [0084.242] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0084.243] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.243] SetEndOfFile (hFile=0x190) returned 1 [0084.243] CloseHandle (hObject=0x190) returned 1 [0084.243] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.243] SetEndOfFile (hFile=0x15c) returned 1 [0084.244] CloseHandle (hObject=0x15c) returned 1 [0084.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0084.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.244] lstrlenW (lpString=".doc") returned 4 [0084.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.244] lstrlenW (lpString=".docx") returned 5 [0084.244] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0084.244] lstrlenW (lpString=".pdf") returned 4 [0084.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.244] lstrlenW (lpString=".xls") returned 4 [0084.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.245] lstrlenW (lpString=".xlsx") returned 5 [0084.245] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0084.245] lstrlenW (lpString=".ppt") returned 4 [0084.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.245] lstrlenW (lpString=".zip") returned 4 [0084.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.245] lstrlenW (lpString=".rar") returned 4 [0084.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.245] lstrlenW (lpString=".bz2") returned 4 [0084.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.245] lstrlenW (lpString=".7z") returned 3 [0084.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.245] lstrlenW (lpString=".dbf") returned 4 [0084.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.245] lstrlenW (lpString=".1cd") returned 4 [0084.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0084.245] lstrlenW (lpString=".jpg") returned 4 [0084.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.245] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") [0084.246] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5004) returned 1 [0084.246] CloseHandle (hObject=0x15c) returned 1 [0084.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0084.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.246] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.247] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0084.247] GetLastError () returned 0x0 [0084.247] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x138c, lpOverlapped=0x0) returned 1 [0084.249] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0084.249] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.250] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.250] SetEndOfFile (hFile=0x190) returned 1 [0084.250] CloseHandle (hObject=0x190) returned 1 [0084.250] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.250] SetEndOfFile (hFile=0x15c) returned 1 [0084.644] CloseHandle (hObject=0x15c) returned 1 [0084.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0085.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.296] lstrlenW (lpString=".doc") returned 4 [0085.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString=".docx") returned 5 [0085.297] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0085.297] lstrlenW (lpString=".pdf") returned 4 [0085.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString=".xls") returned 4 [0085.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.297] lstrlenW (lpString=".xlsx") returned 5 [0085.297] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0085.297] lstrlenW (lpString=".ppt") returned 4 [0085.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.297] lstrlenW (lpString=".zip") returned 4 [0085.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.297] lstrlenW (lpString=".rar") returned 4 [0085.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString=".bz2") returned 4 [0085.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString=".7z") returned 3 [0085.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.297] lstrlenW (lpString=".dbf") returned 4 [0085.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.297] lstrlenW (lpString=".1cd") returned 4 [0085.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0085.297] lstrlenW (lpString=".jpg") returned 4 [0085.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.297] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") [0085.667] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=40231) returned 1 [0085.667] CloseHandle (hObject=0x1c0) returned 1 [0085.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0085.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.667] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.667] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.668] GetLastError () returned 0x0 [0085.668] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9d27, lpOverlapped=0x0) returned 1 [0085.713] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0085.714] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.715] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.715] SetEndOfFile (hFile=0x15c) returned 1 [0085.715] CloseHandle (hObject=0x15c) returned 1 [0085.715] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.715] SetEndOfFile (hFile=0x1c0) returned 1 [0085.716] CloseHandle (hObject=0x1c0) returned 1 [0085.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0085.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.716] lstrlenW (lpString=".doc") returned 4 [0085.716] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.716] lstrlenW (lpString=".docx") returned 5 [0085.716] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0085.717] lstrlenW (lpString=".pdf") returned 4 [0085.717] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.717] lstrlenW (lpString=".xls") returned 4 [0085.717] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.717] lstrlenW (lpString=".xlsx") returned 5 [0085.717] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0085.717] lstrlenW (lpString=".ppt") returned 4 [0085.717] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.717] lstrlenW (lpString=".zip") returned 4 [0085.717] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.717] lstrlenW (lpString=".rar") returned 4 [0085.717] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.717] lstrlenW (lpString=".bz2") returned 4 [0085.717] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.717] lstrlenW (lpString=".7z") returned 3 [0085.717] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.717] lstrlenW (lpString=".dbf") returned 4 [0085.717] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.717] lstrlenW (lpString=".1cd") returned 4 [0085.717] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0085.717] lstrlenW (lpString=".jpg") returned 4 [0085.717] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.717] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") [0085.718] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=38237) returned 1 [0085.718] CloseHandle (hObject=0x1c0) returned 1 [0085.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0085.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.719] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.719] GetLastError () returned 0x0 [0085.719] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x955d, lpOverlapped=0x0) returned 1 [0085.731] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9560, lpOverlapped=0x0) returned 1 [0085.737] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.737] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.738] SetEndOfFile (hFile=0x15c) returned 1 [0085.738] CloseHandle (hObject=0x15c) returned 1 [0085.738] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.738] SetEndOfFile (hFile=0x1c0) returned 1 [0085.739] CloseHandle (hObject=0x1c0) returned 1 [0085.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0085.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.739] lstrlenW (lpString=".doc") returned 4 [0085.739] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.739] lstrlenW (lpString=".docx") returned 5 [0085.739] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0085.739] lstrlenW (lpString=".pdf") returned 4 [0085.739] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.739] lstrlenW (lpString=".xls") returned 4 [0085.739] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.739] lstrlenW (lpString=".xlsx") returned 5 [0085.739] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0085.740] lstrlenW (lpString=".ppt") returned 4 [0085.740] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.740] lstrlenW (lpString=".zip") returned 4 [0085.740] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.740] lstrlenW (lpString=".rar") returned 4 [0085.740] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.740] lstrlenW (lpString=".bz2") returned 4 [0085.740] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.740] lstrlenW (lpString=".7z") returned 3 [0085.740] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.740] lstrlenW (lpString=".dbf") returned 4 [0085.740] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.740] lstrlenW (lpString=".1cd") returned 4 [0085.740] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0085.740] lstrlenW (lpString=".jpg") returned 4 [0085.740] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.740] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") [0085.742] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27393) returned 1 [0085.742] CloseHandle (hObject=0x1c0) returned 1 [0085.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0085.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.742] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.742] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.743] GetLastError () returned 0x0 [0085.743] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6b01, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0085.746] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.746] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.746] SetEndOfFile (hFile=0x15c) returned 1 [0085.746] CloseHandle (hObject=0x15c) returned 1 [0085.746] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.746] SetEndOfFile (hFile=0x1c0) returned 1 [0085.747] CloseHandle (hObject=0x1c0) returned 1 [0085.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0085.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.748] lstrlenW (lpString=".doc") returned 4 [0085.748] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.748] lstrlenW (lpString=".docx") returned 5 [0085.748] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0085.748] lstrlenW (lpString=".pdf") returned 4 [0085.748] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.748] lstrlenW (lpString=".xls") returned 4 [0085.748] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.748] lstrlenW (lpString=".xlsx") returned 5 [0085.748] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0085.748] lstrlenW (lpString=".ppt") returned 4 [0085.748] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.748] lstrlenW (lpString=".zip") returned 4 [0085.748] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.748] lstrlenW (lpString=".rar") returned 4 [0085.748] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.748] lstrlenW (lpString=".bz2") returned 4 [0085.748] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.748] lstrlenW (lpString=".7z") returned 3 [0085.748] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.749] lstrlenW (lpString=".dbf") returned 4 [0085.749] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.749] lstrlenW (lpString=".1cd") returned 4 [0085.749] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0085.749] lstrlenW (lpString=".jpg") returned 4 [0085.749] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.749] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") [0085.749] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=46404) returned 1 [0085.749] CloseHandle (hObject=0x1c0) returned 1 [0085.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0085.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.750] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.750] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.750] GetLastError () returned 0x0 [0085.750] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb544, lpOverlapped=0x0) returned 1 [0085.753] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb550, lpOverlapped=0x0) returned 1 [0085.754] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.754] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.754] SetEndOfFile (hFile=0x15c) returned 1 [0085.754] CloseHandle (hObject=0x15c) returned 1 [0085.754] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.754] SetEndOfFile (hFile=0x1c0) returned 1 [0085.755] CloseHandle (hObject=0x1c0) returned 1 [0085.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString=".doc") returned 4 [0085.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString=".docx") returned 5 [0085.775] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0085.775] lstrlenW (lpString=".pdf") returned 4 [0085.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString=".xls") returned 4 [0085.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.775] lstrlenW (lpString=".xlsx") returned 5 [0085.775] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0085.775] lstrlenW (lpString=".ppt") returned 4 [0085.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString=".zip") returned 4 [0085.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.775] lstrlenW (lpString=".rar") returned 4 [0085.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString=".bz2") returned 4 [0085.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString=".7z") returned 3 [0085.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString=".dbf") returned 4 [0085.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString=".1cd") returned 4 [0085.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0085.775] lstrlenW (lpString=".jpg") returned 4 [0085.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.776] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") [0086.087] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8494) returned 1 [0086.087] CloseHandle (hObject=0x210) returned 1 [0086.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0086.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.088] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.088] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.089] GetLastError () returned 0x0 [0086.089] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x212e, lpOverlapped=0x0) returned 1 [0086.091] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0086.092] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.093] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.093] SetEndOfFile (hFile=0x22c) returned 1 [0086.093] CloseHandle (hObject=0x22c) returned 1 [0086.093] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.093] SetEndOfFile (hFile=0x210) returned 1 [0086.094] CloseHandle (hObject=0x210) returned 1 [0086.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.095] lstrlenW (lpString=".doc") returned 4 [0086.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString=".docx") returned 5 [0086.095] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.095] lstrlenW (lpString=".pdf") returned 4 [0086.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString=".xls") returned 4 [0086.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.095] lstrlenW (lpString=".xlsx") returned 5 [0086.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.095] lstrlenW (lpString=".ppt") returned 4 [0086.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.095] lstrlenW (lpString=".zip") returned 4 [0086.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.095] lstrlenW (lpString=".rar") returned 4 [0086.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString=".bz2") returned 4 [0086.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString=".7z") returned 3 [0086.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.096] lstrlenW (lpString=".dbf") returned 4 [0086.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.096] lstrlenW (lpString=".1cd") returned 4 [0086.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0086.096] lstrlenW (lpString=".jpg") returned 4 [0086.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.096] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") [0086.097] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4356) returned 1 [0086.097] CloseHandle (hObject=0x210) returned 1 [0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.098] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.098] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.099] GetLastError () returned 0x0 [0086.099] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1104, lpOverlapped=0x0) returned 1 [0086.101] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1110, lpOverlapped=0x0) returned 1 [0086.102] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.102] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.102] SetEndOfFile (hFile=0x22c) returned 1 [0086.102] CloseHandle (hObject=0x22c) returned 1 [0086.102] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.103] SetEndOfFile (hFile=0x210) returned 1 [0086.104] CloseHandle (hObject=0x210) returned 1 [0086.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.104] lstrlenW (lpString=".doc") returned 4 [0086.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".docx") returned 5 [0086.105] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0086.105] lstrlenW (lpString=".pdf") returned 4 [0086.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".xls") returned 4 [0086.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.105] lstrlenW (lpString=".xlsx") returned 5 [0086.105] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0086.105] lstrlenW (lpString=".ppt") returned 4 [0086.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.105] lstrlenW (lpString=".zip") returned 4 [0086.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.105] lstrlenW (lpString=".rar") returned 4 [0086.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".bz2") returned 4 [0086.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".7z") returned 3 [0086.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.105] lstrlenW (lpString=".dbf") returned 4 [0086.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.105] lstrlenW (lpString=".1cd") returned 4 [0086.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0086.106] lstrlenW (lpString=".jpg") returned 4 [0086.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.106] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") [0086.106] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15464) returned 1 [0086.106] CloseHandle (hObject=0x210) returned 1 [0086.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0086.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.107] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.107] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.108] GetLastError () returned 0x0 [0086.108] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c68, lpOverlapped=0x0) returned 1 [0086.177] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3c70, lpOverlapped=0x0) returned 1 [0086.178] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.178] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.178] SetEndOfFile (hFile=0x22c) returned 1 [0086.178] CloseHandle (hObject=0x22c) returned 1 [0086.178] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.178] SetEndOfFile (hFile=0x210) returned 1 [0086.396] CloseHandle (hObject=0x210) returned 1 [0086.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString=".doc") returned 4 [0086.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".docx") returned 5 [0086.476] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0086.476] lstrlenW (lpString=".pdf") returned 4 [0086.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".xls") returned 4 [0086.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.476] lstrlenW (lpString=".xlsx") returned 5 [0086.476] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0086.476] lstrlenW (lpString=".ppt") returned 4 [0086.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString=".zip") returned 4 [0086.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.476] lstrlenW (lpString=".rar") returned 4 [0086.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".bz2") returned 4 [0086.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".7z") returned 3 [0086.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString=".dbf") returned 4 [0086.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString=".1cd") returned 4 [0086.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0086.476] lstrlenW (lpString=".jpg") returned 4 [0086.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.477] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") [0086.477] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10632) returned 1 [0086.477] CloseHandle (hObject=0x22c) returned 1 [0086.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0086.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.477] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.477] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0086.478] GetLastError () returned 0x0 [0086.478] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2988, lpOverlapped=0x0) returned 1 [0086.868] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0086.869] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.869] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.869] SetEndOfFile (hFile=0x15c) returned 1 [0086.870] CloseHandle (hObject=0x15c) returned 1 [0086.870] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.870] SetEndOfFile (hFile=0x22c) returned 1 [0086.870] CloseHandle (hObject=0x22c) returned 1 [0086.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0086.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.873] lstrlenW (lpString=".doc") returned 4 [0086.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.873] lstrlenW (lpString=".docx") returned 5 [0086.873] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0086.873] lstrlenW (lpString=".pdf") returned 4 [0086.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.873] lstrlenW (lpString=".xls") returned 4 [0086.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.873] lstrlenW (lpString=".xlsx") returned 5 [0086.873] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0086.873] lstrlenW (lpString=".ppt") returned 4 [0086.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.873] lstrlenW (lpString=".zip") returned 4 [0086.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.873] lstrlenW (lpString=".rar") returned 4 [0086.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.873] lstrlenW (lpString=".bz2") returned 4 [0086.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString=".7z") returned 3 [0086.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.874] lstrlenW (lpString=".dbf") returned 4 [0086.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.874] lstrlenW (lpString=".1cd") returned 4 [0086.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.874] lstrlenW (lpString=".jpg") returned 4 [0086.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.874] @NlsCompareInvariantNoCase@16 () [0086.874] lstrlenW (lpString=".docx") returned 5 [0086.874] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0086.874] lstrlenW (lpString=".pdf") returned 4 [0086.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString=".xls") returned 4 [0086.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.874] lstrlenW (lpString=".xlsx") returned 5 [0086.874] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0086.874] lstrlenW (lpString=".ppt") returned 4 [0086.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.874] lstrlenW (lpString=".zip") returned 4 [0086.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.874] lstrlenW (lpString=".rar") returned 4 [0086.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString=".bz2") returned 4 [0086.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.874] lstrlenW (lpString=".7z") returned 3 [0086.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.875] lstrlenW (lpString=".dbf") returned 4 [0086.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.875] lstrlenW (lpString=".1cd") returned 4 [0086.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0086.875] lstrlenW (lpString=".jpg") returned 4 [0086.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.875] @NlsCompareInvariantNoCase@16 () [0086.875] lstrlenW (lpString="J0152414.WMF") returned 12 [0086.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.878] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24844) returned 1 [0086.878] CloseHandle (hObject=0x1f0) returned 1 [0086.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0086.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.878] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.878] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.903] GetLastError () returned 0x0 [0086.903] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x610c, lpOverlapped=0x0) returned 1 [0086.905] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6110, lpOverlapped=0x0) returned 1 [0086.906] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.906] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.906] SetEndOfFile (hFile=0x210) returned 1 [0086.906] CloseHandle (hObject=0x210) returned 1 [0086.907] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.907] SetEndOfFile (hFile=0x1f0) returned 1 [0086.907] CloseHandle (hObject=0x1f0) returned 1 [0086.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0086.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.908] lstrlenW (lpString=".doc") returned 4 [0086.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.908] lstrlenW (lpString=".docx") returned 5 [0086.908] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0086.908] lstrlenW (lpString=".pdf") returned 4 [0086.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.908] lstrlenW (lpString=".xls") returned 4 [0086.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.908] lstrlenW (lpString=".xlsx") returned 5 [0086.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0086.908] lstrlenW (lpString=".ppt") returned 4 [0086.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.908] lstrlenW (lpString=".zip") returned 4 [0086.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.908] lstrlenW (lpString=".rar") returned 4 [0086.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.908] lstrlenW (lpString=".bz2") returned 4 [0086.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.908] lstrlenW (lpString=".7z") returned 3 [0086.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.909] lstrlenW (lpString=".dbf") returned 4 [0086.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.909] lstrlenW (lpString=".1cd") returned 4 [0086.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.909] lstrlenW (lpString=".jpg") returned 4 [0086.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.909] @NlsCompareInvariantNoCase@16 () [0086.909] lstrlenW (lpString=".docx") returned 5 [0086.909] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0086.909] lstrlenW (lpString=".pdf") returned 4 [0086.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString=".xls") returned 4 [0086.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.909] lstrlenW (lpString=".xlsx") returned 5 [0086.909] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0086.909] lstrlenW (lpString=".ppt") returned 4 [0086.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.909] lstrlenW (lpString=".zip") returned 4 [0086.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.909] lstrlenW (lpString=".rar") returned 4 [0086.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString=".bz2") returned 4 [0086.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString=".7z") returned 3 [0086.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.909] lstrlenW (lpString=".dbf") returned 4 [0086.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.910] lstrlenW (lpString=".1cd") returned 4 [0086.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0086.910] lstrlenW (lpString=".jpg") returned 4 [0086.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.910] @NlsCompareInvariantNoCase@16 () [0086.910] lstrlenW (lpString="J0152556.WMF") returned 12 [0086.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.910] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16432) returned 1 [0086.910] CloseHandle (hObject=0x1f0) returned 1 [0086.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0086.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.911] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.911] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.912] GetLastError () returned 0x0 [0086.912] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4030, lpOverlapped=0x0) returned 1 [0086.914] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4040, lpOverlapped=0x0) returned 1 [0086.915] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.915] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.916] SetEndOfFile (hFile=0x210) returned 1 [0086.916] CloseHandle (hObject=0x210) returned 1 [0086.916] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.916] SetEndOfFile (hFile=0x1f0) returned 1 [0086.917] CloseHandle (hObject=0x1f0) returned 1 [0086.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.917] lstrlenW (lpString=".doc") returned 4 [0086.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".docx") returned 5 [0086.917] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0086.917] lstrlenW (lpString=".pdf") returned 4 [0086.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".xls") returned 4 [0086.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.917] lstrlenW (lpString=".xlsx") returned 5 [0086.917] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0086.917] lstrlenW (lpString=".ppt") returned 4 [0086.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.917] lstrlenW (lpString=".zip") returned 4 [0086.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.917] lstrlenW (lpString=".rar") returned 4 [0086.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".bz2") returned 4 [0086.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".7z") returned 3 [0086.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.918] lstrlenW (lpString=".dbf") returned 4 [0086.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.918] lstrlenW (lpString=".1cd") returned 4 [0086.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.918] lstrlenW (lpString=".jpg") returned 4 [0086.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.918] @NlsCompareInvariantNoCase@16 () [0086.918] lstrlenW (lpString=".docx") returned 5 [0086.918] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0086.918] lstrlenW (lpString=".pdf") returned 4 [0086.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".xls") returned 4 [0086.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.918] lstrlenW (lpString=".xlsx") returned 5 [0086.918] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0086.918] lstrlenW (lpString=".ppt") returned 4 [0086.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.919] lstrlenW (lpString=".zip") returned 4 [0086.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.919] lstrlenW (lpString=".rar") returned 4 [0086.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.919] lstrlenW (lpString=".bz2") returned 4 [0086.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.919] lstrlenW (lpString=".7z") returned 3 [0086.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.919] lstrlenW (lpString=".dbf") returned 4 [0086.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.919] lstrlenW (lpString=".1cd") returned 4 [0086.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0086.919] lstrlenW (lpString=".jpg") returned 4 [0086.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.919] @NlsCompareInvariantNoCase@16 () [0086.919] lstrlenW (lpString="J0152558.WMF") returned 12 [0086.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.920] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16052) returned 1 [0086.920] CloseHandle (hObject=0x1f0) returned 1 [0086.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0086.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.920] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.920] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.920] GetLastError () returned 0x0 [0086.921] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0087.011] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0087.162] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.162] SetEndOfFile (hFile=0x210) returned 1 [0087.163] CloseHandle (hObject=0x210) returned 1 [0087.163] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.163] SetEndOfFile (hFile=0x1f0) returned 1 [0087.164] CloseHandle (hObject=0x1f0) returned 1 [0087.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0087.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.164] lstrlenW (lpString=".doc") returned 4 [0087.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.164] lstrlenW (lpString=".docx") returned 5 [0087.164] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.164] lstrlenW (lpString=".pdf") returned 4 [0087.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.164] lstrlenW (lpString=".xls") returned 4 [0087.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.164] lstrlenW (lpString=".xlsx") returned 5 [0087.164] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.164] lstrlenW (lpString=".ppt") returned 4 [0087.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.165] lstrlenW (lpString=".zip") returned 4 [0087.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.165] lstrlenW (lpString=".rar") returned 4 [0087.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.165] lstrlenW (lpString=".bz2") returned 4 [0087.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.165] lstrlenW (lpString=".7z") returned 3 [0087.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.165] lstrlenW (lpString=".dbf") returned 4 [0087.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.165] lstrlenW (lpString=".1cd") returned 4 [0087.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0087.165] lstrlenW (lpString=".jpg") returned 4 [0087.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.165] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") [0087.165] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1208) returned 1 [0087.166] CloseHandle (hObject=0x1f0) returned 1 [0087.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0087.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0087.166] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.166] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.166] GetLastError () returned 0x0 [0087.166] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0087.169] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0087.170] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.170] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.170] SetEndOfFile (hFile=0x210) returned 1 [0087.170] CloseHandle (hObject=0x210) returned 1 [0087.170] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.170] SetEndOfFile (hFile=0x1f0) returned 1 [0087.171] CloseHandle (hObject=0x1f0) returned 1 [0087.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0087.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.171] lstrlenW (lpString=".doc") returned 4 [0087.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.171] lstrlenW (lpString=".docx") returned 5 [0087.171] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.171] lstrlenW (lpString=".pdf") returned 4 [0087.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.171] lstrlenW (lpString=".xls") returned 4 [0087.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.171] lstrlenW (lpString=".xlsx") returned 5 [0087.171] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.171] lstrlenW (lpString=".ppt") returned 4 [0087.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.172] lstrlenW (lpString=".zip") returned 4 [0087.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.172] lstrlenW (lpString=".rar") returned 4 [0087.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.172] lstrlenW (lpString=".bz2") returned 4 [0087.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.172] lstrlenW (lpString=".7z") returned 3 [0087.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.172] lstrlenW (lpString=".dbf") returned 4 [0087.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.172] lstrlenW (lpString=".1cd") returned 4 [0087.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0087.172] lstrlenW (lpString=".jpg") returned 4 [0087.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.172] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") [0087.173] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1208) returned 1 [0087.173] CloseHandle (hObject=0x1f0) returned 1 [0087.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0087.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0087.173] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.173] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.174] GetLastError () returned 0x0 [0087.174] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0087.176] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0087.177] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.177] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.177] SetEndOfFile (hFile=0x210) returned 1 [0087.177] CloseHandle (hObject=0x210) returned 1 [0087.177] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.177] SetEndOfFile (hFile=0x1f0) returned 1 [0087.178] CloseHandle (hObject=0x1f0) returned 1 [0087.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.178] lstrlenW (lpString=".doc") returned 4 [0087.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.178] lstrlenW (lpString=".docx") returned 5 [0087.178] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.178] lstrlenW (lpString=".pdf") returned 4 [0087.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.178] lstrlenW (lpString=".xls") returned 4 [0087.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.178] lstrlenW (lpString=".xlsx") returned 5 [0087.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.178] lstrlenW (lpString=".ppt") returned 4 [0087.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.178] lstrlenW (lpString=".zip") returned 4 [0087.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.179] lstrlenW (lpString=".rar") returned 4 [0087.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.179] lstrlenW (lpString=".bz2") returned 4 [0087.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.179] lstrlenW (lpString=".7z") returned 3 [0087.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.179] lstrlenW (lpString=".dbf") returned 4 [0087.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.179] lstrlenW (lpString=".1cd") returned 4 [0087.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0087.179] lstrlenW (lpString=".jpg") returned 4 [0087.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.179] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") [0087.179] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1652) returned 1 [0087.180] CloseHandle (hObject=0x1f0) returned 1 [0087.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0087.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0087.180] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.180] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.180] GetLastError () returned 0x0 [0087.180] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x674, lpOverlapped=0x0) returned 1 [0087.182] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x680, lpOverlapped=0x0) returned 1 [0087.183] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.183] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.183] SetEndOfFile (hFile=0x210) returned 1 [0087.183] CloseHandle (hObject=0x210) returned 1 [0087.183] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.183] SetEndOfFile (hFile=0x1f0) returned 1 [0087.184] CloseHandle (hObject=0x1f0) returned 1 [0087.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0087.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.184] lstrlenW (lpString=".doc") returned 4 [0087.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString=".docx") returned 5 [0087.185] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0087.185] lstrlenW (lpString=".pdf") returned 4 [0087.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString=".xls") returned 4 [0087.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.185] lstrlenW (lpString=".xlsx") returned 5 [0087.185] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0087.185] lstrlenW (lpString=".ppt") returned 4 [0087.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.185] lstrlenW (lpString=".zip") returned 4 [0087.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.185] lstrlenW (lpString=".rar") returned 4 [0087.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString=".bz2") returned 4 [0087.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString=".7z") returned 3 [0087.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.185] lstrlenW (lpString=".dbf") returned 4 [0087.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.185] lstrlenW (lpString=".1cd") returned 4 [0087.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0087.185] lstrlenW (lpString=".jpg") returned 4 [0087.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.185] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") [0087.186] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4908) returned 1 [0087.186] CloseHandle (hObject=0x1f0) returned 1 [0087.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0087.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0087.186] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.186] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.195] GetLastError () returned 0x0 [0087.195] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x132c, lpOverlapped=0x0) returned 1 [0087.339] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0087.352] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.352] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.352] SetEndOfFile (hFile=0x210) returned 1 [0087.353] CloseHandle (hObject=0x210) returned 1 [0087.353] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.353] SetEndOfFile (hFile=0x1f0) returned 1 [0087.353] CloseHandle (hObject=0x1f0) returned 1 [0087.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.386] lstrlenW (lpString=".doc") returned 4 [0087.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".docx") returned 5 [0087.386] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.386] lstrlenW (lpString=".pdf") returned 4 [0087.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".xls") returned 4 [0087.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.386] lstrlenW (lpString=".xlsx") returned 5 [0087.386] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.386] lstrlenW (lpString=".ppt") returned 4 [0087.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.386] lstrlenW (lpString=".zip") returned 4 [0087.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.386] lstrlenW (lpString=".rar") returned 4 [0087.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".bz2") returned 4 [0087.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".7z") returned 3 [0087.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.386] lstrlenW (lpString=".dbf") returned 4 [0087.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.387] lstrlenW (lpString=".1cd") returned 4 [0087.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0087.387] lstrlenW (lpString=".jpg") returned 4 [0087.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.387] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") [0088.397] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1912) returned 1 [0088.399] CloseHandle (hObject=0x16c) returned 1 [0088.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0088.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.406] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.406] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0088.415] GetLastError () returned 0x0 [0088.415] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x778, lpOverlapped=0x0) returned 1 [0088.430] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x780, lpOverlapped=0x0) returned 1 [0088.431] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.431] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.431] SetEndOfFile (hFile=0x1f0) returned 1 [0088.431] CloseHandle (hObject=0x1f0) returned 1 [0088.431] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.431] SetEndOfFile (hFile=0x16c) returned 1 [0088.432] CloseHandle (hObject=0x16c) returned 1 [0088.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString=".doc") returned 4 [0088.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString=".docx") returned 5 [0088.433] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0088.433] lstrlenW (lpString=".pdf") returned 4 [0088.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString=".xls") returned 4 [0088.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.433] lstrlenW (lpString=".xlsx") returned 5 [0088.433] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0088.433] lstrlenW (lpString=".ppt") returned 4 [0088.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString=".zip") returned 4 [0088.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.433] lstrlenW (lpString=".rar") returned 4 [0088.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString=".bz2") returned 4 [0088.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString=".7z") returned 3 [0088.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString=".dbf") returned 4 [0088.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString=".1cd") returned 4 [0088.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0088.433] lstrlenW (lpString=".jpg") returned 4 [0088.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.434] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") [0089.406] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=34256) returned 1 [0089.406] CloseHandle (hObject=0x22c) returned 1 [0089.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0089.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0089.413] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.413] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0089.435] GetLastError () returned 0x0 [0089.435] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x85d0, lpOverlapped=0x0) returned 1 [0089.437] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x85e0, lpOverlapped=0x0) returned 1 [0089.439] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.439] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.439] SetEndOfFile (hFile=0x15c) returned 1 [0089.439] CloseHandle (hObject=0x15c) returned 1 [0089.439] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.439] SetEndOfFile (hFile=0x22c) returned 1 [0089.440] CloseHandle (hObject=0x22c) returned 1 [0089.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0089.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.673] lstrlenW (lpString=".doc") returned 4 [0089.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.673] lstrlenW (lpString=".docx") returned 5 [0089.673] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0089.673] lstrlenW (lpString=".pdf") returned 4 [0089.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.673] lstrlenW (lpString=".xls") returned 4 [0089.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.673] lstrlenW (lpString=".xlsx") returned 5 [0089.673] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0089.673] lstrlenW (lpString=".ppt") returned 4 [0089.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.673] lstrlenW (lpString=".zip") returned 4 [0089.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.673] lstrlenW (lpString=".rar") returned 4 [0089.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.673] lstrlenW (lpString=".bz2") returned 4 [0089.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.673] lstrlenW (lpString=".7z") returned 3 [0089.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.674] lstrlenW (lpString=".dbf") returned 4 [0089.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.674] lstrlenW (lpString=".1cd") returned 4 [0089.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0089.674] lstrlenW (lpString=".jpg") returned 4 [0089.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.674] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") [0090.281] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=46484) returned 1 [0090.281] CloseHandle (hObject=0x1c8) returned 1 [0090.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0090.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.439] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.439] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.099] GetLastError () returned 0x0 [0091.099] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb594, lpOverlapped=0x0) returned 1 [0091.103] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0091.104] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.104] WriteFile (in: hFile=0x1f0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.104] SetEndOfFile (hFile=0x1f0) returned 1 [0091.104] CloseHandle (hObject=0x1f0) returned 1 [0091.104] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.104] SetEndOfFile (hFile=0x190) returned 1 [0091.105] CloseHandle (hObject=0x190) returned 1 [0091.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0091.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.353] lstrlenW (lpString=".doc") returned 4 [0091.353] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.353] lstrlenW (lpString=".docx") returned 5 [0091.354] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0091.354] lstrlenW (lpString=".pdf") returned 4 [0091.354] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.354] lstrlenW (lpString=".xls") returned 4 [0091.354] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.354] lstrlenW (lpString=".xlsx") returned 5 [0091.354] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0091.354] lstrlenW (lpString=".ppt") returned 4 [0091.354] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.354] lstrlenW (lpString=".zip") returned 4 [0091.354] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.354] lstrlenW (lpString=".rar") returned 4 [0091.354] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.354] lstrlenW (lpString=".bz2") returned 4 [0091.354] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.354] lstrlenW (lpString=".7z") returned 3 [0091.354] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.354] lstrlenW (lpString=".dbf") returned 4 [0091.354] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.354] lstrlenW (lpString=".1cd") returned 4 [0091.354] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0091.354] lstrlenW (lpString=".jpg") returned 4 [0091.354] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.354] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") [0091.355] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=59734) returned 1 [0091.355] CloseHandle (hObject=0x15c) returned 1 [0091.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0091.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.355] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.355] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.494] GetLastError () returned 0x0 [0091.494] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xe956, lpOverlapped=0x0) returned 1 [0091.497] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe960, lpOverlapped=0x0) returned 1 [0091.498] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.498] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.499] SetEndOfFile (hFile=0x158) returned 1 [0091.499] CloseHandle (hObject=0x158) returned 1 [0091.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.499] SetEndOfFile (hFile=0x15c) returned 1 [0091.500] CloseHandle (hObject=0x15c) returned 1 [0091.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0091.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.500] lstrlenW (lpString=".doc") returned 4 [0091.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.500] lstrlenW (lpString=".docx") returned 5 [0091.500] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.500] lstrlenW (lpString=".pdf") returned 4 [0091.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.500] lstrlenW (lpString=".xls") returned 4 [0091.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.501] lstrlenW (lpString=".xlsx") returned 5 [0091.501] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.501] lstrlenW (lpString=".ppt") returned 4 [0091.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.501] lstrlenW (lpString=".zip") returned 4 [0091.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.501] lstrlenW (lpString=".rar") returned 4 [0091.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.501] lstrlenW (lpString=".bz2") returned 4 [0091.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.501] lstrlenW (lpString=".7z") returned 3 [0091.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.501] lstrlenW (lpString=".dbf") returned 4 [0091.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.501] lstrlenW (lpString=".1cd") returned 4 [0091.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0091.501] lstrlenW (lpString=".jpg") returned 4 [0091.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.501] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") [0091.502] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=39330) returned 1 [0091.502] CloseHandle (hObject=0x15c) returned 1 [0091.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0091.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.502] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.502] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.503] GetLastError () returned 0x0 [0091.503] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x99a2, lpOverlapped=0x0) returned 1 [0091.506] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x99b0, lpOverlapped=0x0) returned 1 [0091.509] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.510] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.510] SetEndOfFile (hFile=0x158) returned 1 [0091.510] CloseHandle (hObject=0x158) returned 1 [0091.510] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.510] SetEndOfFile (hFile=0x15c) returned 1 [0091.511] CloseHandle (hObject=0x15c) returned 1 [0091.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0091.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.511] lstrlenW (lpString=".doc") returned 4 [0091.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.511] lstrlenW (lpString=".docx") returned 5 [0091.511] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0091.511] lstrlenW (lpString=".pdf") returned 4 [0091.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString=".xls") returned 4 [0091.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.512] lstrlenW (lpString=".xlsx") returned 5 [0091.512] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0091.512] lstrlenW (lpString=".ppt") returned 4 [0091.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.512] lstrlenW (lpString=".zip") returned 4 [0091.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.512] lstrlenW (lpString=".rar") returned 4 [0091.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString=".bz2") returned 4 [0091.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString=".7z") returned 3 [0091.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.512] lstrlenW (lpString=".dbf") returned 4 [0091.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.512] lstrlenW (lpString=".1cd") returned 4 [0091.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0091.512] lstrlenW (lpString=".jpg") returned 4 [0091.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.512] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") [0091.513] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=20662) returned 1 [0091.513] CloseHandle (hObject=0x15c) returned 1 [0091.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0091.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.514] GetLastError () returned 0x0 [0091.514] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x50b6, lpOverlapped=0x0) returned 1 [0091.516] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x50c0, lpOverlapped=0x0) returned 1 [0091.517] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.517] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.517] SetEndOfFile (hFile=0x158) returned 1 [0091.517] CloseHandle (hObject=0x158) returned 1 [0091.517] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.517] SetEndOfFile (hFile=0x15c) returned 1 [0091.518] CloseHandle (hObject=0x15c) returned 1 [0091.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0091.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.518] lstrlenW (lpString=".doc") returned 4 [0091.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString=".docx") returned 5 [0091.519] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.519] lstrlenW (lpString=".pdf") returned 4 [0091.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString=".xls") returned 4 [0091.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.519] lstrlenW (lpString=".xlsx") returned 5 [0091.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.519] lstrlenW (lpString=".ppt") returned 4 [0091.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.519] lstrlenW (lpString=".zip") returned 4 [0091.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.519] lstrlenW (lpString=".rar") returned 4 [0091.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString=".bz2") returned 4 [0091.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString=".7z") returned 3 [0091.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.519] lstrlenW (lpString=".dbf") returned 4 [0091.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.519] lstrlenW (lpString=".1cd") returned 4 [0091.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0091.519] lstrlenW (lpString=".jpg") returned 4 [0091.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.519] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") [0091.520] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33824) returned 1 [0091.520] CloseHandle (hObject=0x15c) returned 1 [0091.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0091.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.520] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.520] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.521] GetLastError () returned 0x0 [0091.521] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8420, lpOverlapped=0x0) returned 1 [0091.523] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8430, lpOverlapped=0x0) returned 1 [0091.525] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.525] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.525] SetEndOfFile (hFile=0x158) returned 1 [0091.525] CloseHandle (hObject=0x158) returned 1 [0091.525] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.525] SetEndOfFile (hFile=0x15c) returned 1 [0091.528] CloseHandle (hObject=0x15c) returned 1 [0091.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0091.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.529] lstrlenW (lpString=".doc") returned 4 [0091.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.529] lstrlenW (lpString=".docx") returned 5 [0091.529] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0091.529] lstrlenW (lpString=".pdf") returned 4 [0091.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.529] lstrlenW (lpString=".xls") returned 4 [0091.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.529] lstrlenW (lpString=".xlsx") returned 5 [0091.529] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0091.529] lstrlenW (lpString=".ppt") returned 4 [0091.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.529] lstrlenW (lpString=".zip") returned 4 [0091.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.529] lstrlenW (lpString=".rar") returned 4 [0091.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.529] lstrlenW (lpString=".bz2") returned 4 [0091.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.529] lstrlenW (lpString=".7z") returned 3 [0091.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.530] lstrlenW (lpString=".dbf") returned 4 [0091.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.530] lstrlenW (lpString=".1cd") returned 4 [0091.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0091.530] lstrlenW (lpString=".jpg") returned 4 [0091.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.530] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") [0092.374] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24238) returned 1 [0092.375] CloseHandle (hObject=0x180) returned 1 [0092.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0092.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.375] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.375] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.376] GetLastError () returned 0x0 [0092.376] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5eae, lpOverlapped=0x0) returned 1 [0092.378] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5eb0, lpOverlapped=0x0) returned 1 [0092.379] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.379] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.379] SetEndOfFile (hFile=0x22c) returned 1 [0092.379] CloseHandle (hObject=0x22c) returned 1 [0092.379] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.380] SetEndOfFile (hFile=0x180) returned 1 [0092.380] CloseHandle (hObject=0x180) returned 1 [0092.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0092.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.381] lstrlenW (lpString=".doc") returned 4 [0092.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.381] lstrlenW (lpString=".docx") returned 5 [0092.381] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0092.381] lstrlenW (lpString=".pdf") returned 4 [0092.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.381] lstrlenW (lpString=".xls") returned 4 [0092.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.381] lstrlenW (lpString=".xlsx") returned 5 [0092.381] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0092.381] lstrlenW (lpString=".ppt") returned 4 [0092.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.381] lstrlenW (lpString=".zip") returned 4 [0092.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.381] lstrlenW (lpString=".rar") returned 4 [0092.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.381] lstrlenW (lpString=".bz2") returned 4 [0092.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.381] lstrlenW (lpString=".7z") returned 3 [0092.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.382] lstrlenW (lpString=".dbf") returned 4 [0092.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.382] lstrlenW (lpString=".1cd") returned 4 [0092.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0092.382] lstrlenW (lpString=".jpg") returned 4 [0092.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.382] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") [0092.382] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9344) returned 1 [0092.382] CloseHandle (hObject=0x180) returned 1 [0092.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0092.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.383] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.383] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.384] GetLastError () returned 0x0 [0092.384] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2480, lpOverlapped=0x0) returned 1 [0092.385] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0092.386] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.386] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.386] SetEndOfFile (hFile=0x22c) returned 1 [0092.387] CloseHandle (hObject=0x22c) returned 1 [0092.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.387] SetEndOfFile (hFile=0x180) returned 1 [0092.388] CloseHandle (hObject=0x180) returned 1 [0092.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0092.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.388] lstrlenW (lpString=".doc") returned 4 [0092.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.388] lstrlenW (lpString=".docx") returned 5 [0092.388] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0092.388] lstrlenW (lpString=".pdf") returned 4 [0092.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.388] lstrlenW (lpString=".xls") returned 4 [0092.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.388] lstrlenW (lpString=".xlsx") returned 5 [0092.388] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0092.388] lstrlenW (lpString=".ppt") returned 4 [0092.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.389] lstrlenW (lpString=".zip") returned 4 [0092.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.389] lstrlenW (lpString=".rar") returned 4 [0092.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.389] lstrlenW (lpString=".bz2") returned 4 [0092.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.389] lstrlenW (lpString=".7z") returned 3 [0092.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.389] lstrlenW (lpString=".dbf") returned 4 [0092.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.389] lstrlenW (lpString=".1cd") returned 4 [0092.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0092.389] lstrlenW (lpString=".jpg") returned 4 [0092.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.389] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") [0092.390] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16354) returned 1 [0092.390] CloseHandle (hObject=0x180) returned 1 [0092.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0092.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.390] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.390] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.391] GetLastError () returned 0x0 [0092.391] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3fe2, lpOverlapped=0x0) returned 1 [0092.393] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3ff0, lpOverlapped=0x0) returned 1 [0092.394] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.394] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.394] SetEndOfFile (hFile=0x22c) returned 1 [0092.395] CloseHandle (hObject=0x22c) returned 1 [0092.395] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.395] SetEndOfFile (hFile=0x180) returned 1 [0092.396] CloseHandle (hObject=0x180) returned 1 [0092.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0092.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.396] lstrlenW (lpString=".doc") returned 4 [0092.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.396] lstrlenW (lpString=".docx") returned 5 [0092.396] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0092.396] lstrlenW (lpString=".pdf") returned 4 [0092.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.396] lstrlenW (lpString=".xls") returned 4 [0092.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.396] lstrlenW (lpString=".xlsx") returned 5 [0092.396] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0092.396] lstrlenW (lpString=".ppt") returned 4 [0092.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.396] lstrlenW (lpString=".zip") returned 4 [0092.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.397] lstrlenW (lpString=".rar") returned 4 [0092.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.397] lstrlenW (lpString=".bz2") returned 4 [0092.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.397] lstrlenW (lpString=".7z") returned 3 [0092.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.397] lstrlenW (lpString=".dbf") returned 4 [0092.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.397] lstrlenW (lpString=".1cd") returned 4 [0092.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0092.397] lstrlenW (lpString=".jpg") returned 4 [0092.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.397] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") [0092.398] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5372) returned 1 [0092.398] CloseHandle (hObject=0x180) returned 1 [0092.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0092.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.398] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.398] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.398] GetLastError () returned 0x0 [0092.399] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x14fc, lpOverlapped=0x0) returned 1 [0092.400] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0092.401] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.401] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.401] SetEndOfFile (hFile=0x22c) returned 1 [0092.404] CloseHandle (hObject=0x22c) returned 1 [0092.404] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.404] SetEndOfFile (hFile=0x180) returned 1 [0092.405] CloseHandle (hObject=0x180) returned 1 [0092.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0092.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.405] lstrlenW (lpString=".doc") returned 4 [0092.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.405] lstrlenW (lpString=".docx") returned 5 [0092.405] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0092.405] lstrlenW (lpString=".pdf") returned 4 [0092.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.405] lstrlenW (lpString=".xls") returned 4 [0092.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.405] lstrlenW (lpString=".xlsx") returned 5 [0092.405] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0092.405] lstrlenW (lpString=".ppt") returned 4 [0092.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.405] lstrlenW (lpString=".zip") returned 4 [0092.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.405] lstrlenW (lpString=".rar") returned 4 [0092.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.406] lstrlenW (lpString=".bz2") returned 4 [0092.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.406] lstrlenW (lpString=".7z") returned 3 [0092.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.406] lstrlenW (lpString=".dbf") returned 4 [0092.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.406] lstrlenW (lpString=".1cd") returned 4 [0092.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0092.406] lstrlenW (lpString=".jpg") returned 4 [0092.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.406] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") [0092.406] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7116) returned 1 [0092.406] CloseHandle (hObject=0x180) returned 1 [0092.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0092.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0092.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0092.407] GetLastError () returned 0x0 [0092.407] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1bcc, lpOverlapped=0x0) returned 1 [0092.409] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0092.522] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.522] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.522] SetEndOfFile (hFile=0x22c) returned 1 [0092.522] CloseHandle (hObject=0x22c) returned 1 [0092.522] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.522] SetEndOfFile (hFile=0x180) returned 1 [0092.523] CloseHandle (hObject=0x180) returned 1 [0092.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0092.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.583] lstrlenW (lpString=".doc") returned 4 [0092.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString=".docx") returned 5 [0092.583] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0092.583] lstrlenW (lpString=".pdf") returned 4 [0092.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString=".xls") returned 4 [0092.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.583] lstrlenW (lpString=".xlsx") returned 5 [0092.583] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0092.583] lstrlenW (lpString=".ppt") returned 4 [0092.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.583] lstrlenW (lpString=".zip") returned 4 [0092.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.583] lstrlenW (lpString=".rar") returned 4 [0092.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString=".bz2") returned 4 [0092.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString=".7z") returned 3 [0092.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.583] lstrlenW (lpString=".dbf") returned 4 [0092.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.583] lstrlenW (lpString=".1cd") returned 4 [0092.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0092.583] lstrlenW (lpString=".jpg") returned 4 [0092.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.583] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") [0093.092] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12292) returned 1 [0093.095] CloseHandle (hObject=0x1f0) returned 1 [0093.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0093.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.095] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.095] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.111] GetLastError () returned 0x0 [0093.111] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3004, lpOverlapped=0x0) returned 1 [0093.120] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0093.121] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.121] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.121] SetEndOfFile (hFile=0x190) returned 1 [0093.121] CloseHandle (hObject=0x190) returned 1 [0093.121] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.121] SetEndOfFile (hFile=0x1f0) returned 1 [0093.122] CloseHandle (hObject=0x1f0) returned 1 [0093.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0093.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.122] lstrlenW (lpString=".doc") returned 4 [0093.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.122] lstrlenW (lpString=".docx") returned 5 [0093.122] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.122] lstrlenW (lpString=".pdf") returned 4 [0093.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString=".xls") returned 4 [0093.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.123] lstrlenW (lpString=".xlsx") returned 5 [0093.123] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.123] lstrlenW (lpString=".ppt") returned 4 [0093.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.123] lstrlenW (lpString=".zip") returned 4 [0093.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.123] lstrlenW (lpString=".rar") returned 4 [0093.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString=".bz2") returned 4 [0093.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString=".7z") returned 3 [0093.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.123] lstrlenW (lpString=".dbf") returned 4 [0093.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.123] lstrlenW (lpString=".1cd") returned 4 [0093.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0093.123] lstrlenW (lpString=".jpg") returned 4 [0093.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.123] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") [0093.124] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8314) returned 1 [0093.124] CloseHandle (hObject=0x1f0) returned 1 [0093.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0093.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.124] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.124] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.125] GetLastError () returned 0x0 [0093.125] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x207a, lpOverlapped=0x0) returned 1 [0093.126] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2080, lpOverlapped=0x0) returned 1 [0093.207] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.207] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.207] SetEndOfFile (hFile=0x190) returned 1 [0093.207] CloseHandle (hObject=0x190) returned 1 [0093.207] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.207] SetEndOfFile (hFile=0x1f0) returned 1 [0093.208] CloseHandle (hObject=0x1f0) returned 1 [0093.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0093.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString=".doc") returned 4 [0093.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString=".docx") returned 5 [0093.209] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.209] lstrlenW (lpString=".pdf") returned 4 [0093.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString=".xls") returned 4 [0093.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.209] lstrlenW (lpString=".xlsx") returned 5 [0093.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.209] lstrlenW (lpString=".ppt") returned 4 [0093.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString=".zip") returned 4 [0093.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.209] lstrlenW (lpString=".rar") returned 4 [0093.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString=".bz2") returned 4 [0093.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString=".7z") returned 3 [0093.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString=".dbf") returned 4 [0093.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString=".1cd") returned 4 [0093.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0093.209] lstrlenW (lpString=".jpg") returned 4 [0093.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.210] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") [0093.211] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=29432) returned 1 [0093.211] CloseHandle (hObject=0x1f0) returned 1 [0093.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0093.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.211] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.212] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.212] GetLastError () returned 0x0 [0093.212] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x72f8, lpOverlapped=0x0) returned 1 [0093.214] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7300, lpOverlapped=0x0) returned 1 [0093.215] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.215] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.216] SetEndOfFile (hFile=0x190) returned 1 [0093.216] CloseHandle (hObject=0x190) returned 1 [0093.216] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.216] SetEndOfFile (hFile=0x1f0) returned 1 [0093.217] CloseHandle (hObject=0x1f0) returned 1 [0093.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0093.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.217] lstrlenW (lpString=".doc") returned 4 [0093.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.217] lstrlenW (lpString=".docx") returned 5 [0093.217] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.217] lstrlenW (lpString=".pdf") returned 4 [0093.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.217] lstrlenW (lpString=".xls") returned 4 [0093.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.217] lstrlenW (lpString=".xlsx") returned 5 [0093.217] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.218] lstrlenW (lpString=".ppt") returned 4 [0093.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.218] lstrlenW (lpString=".zip") returned 4 [0093.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.218] lstrlenW (lpString=".rar") returned 4 [0093.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.218] lstrlenW (lpString=".bz2") returned 4 [0093.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.218] lstrlenW (lpString=".7z") returned 3 [0093.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.218] lstrlenW (lpString=".dbf") returned 4 [0093.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.218] lstrlenW (lpString=".1cd") returned 4 [0093.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0093.218] lstrlenW (lpString=".jpg") returned 4 [0093.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.218] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") [0093.219] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21328) returned 1 [0093.219] CloseHandle (hObject=0x1f0) returned 1 [0093.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0093.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.219] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.219] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.220] GetLastError () returned 0x0 [0093.220] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5350, lpOverlapped=0x0) returned 1 [0093.222] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5360, lpOverlapped=0x0) returned 1 [0093.223] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.223] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.223] SetEndOfFile (hFile=0x190) returned 1 [0093.223] CloseHandle (hObject=0x190) returned 1 [0093.223] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.223] SetEndOfFile (hFile=0x1f0) returned 1 [0093.224] CloseHandle (hObject=0x1f0) returned 1 [0093.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString=".doc") returned 4 [0093.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString=".docx") returned 5 [0093.225] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.225] lstrlenW (lpString=".pdf") returned 4 [0093.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString=".xls") returned 4 [0093.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.225] lstrlenW (lpString=".xlsx") returned 5 [0093.225] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.225] lstrlenW (lpString=".ppt") returned 4 [0093.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString=".zip") returned 4 [0093.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.225] lstrlenW (lpString=".rar") returned 4 [0093.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString=".bz2") returned 4 [0093.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString=".7z") returned 3 [0093.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString=".dbf") returned 4 [0093.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString=".1cd") returned 4 [0093.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0093.225] lstrlenW (lpString=".jpg") returned 4 [0093.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.226] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") [0093.226] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18622) returned 1 [0093.226] CloseHandle (hObject=0x1f0) returned 1 [0093.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0093.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.226] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.227] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.227] GetLastError () returned 0x0 [0093.227] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x48be, lpOverlapped=0x0) returned 1 [0093.375] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x48c0, lpOverlapped=0x0) returned 1 [0093.376] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.376] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.376] SetEndOfFile (hFile=0x190) returned 1 [0093.376] CloseHandle (hObject=0x190) returned 1 [0093.376] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.376] SetEndOfFile (hFile=0x1f0) returned 1 [0093.377] CloseHandle (hObject=0x1f0) returned 1 [0093.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.405] lstrlenW (lpString=".doc") returned 4 [0093.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".docx") returned 5 [0093.405] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.405] lstrlenW (lpString=".pdf") returned 4 [0093.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".xls") returned 4 [0093.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.405] lstrlenW (lpString=".xlsx") returned 5 [0093.405] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.405] lstrlenW (lpString=".ppt") returned 4 [0093.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.405] lstrlenW (lpString=".zip") returned 4 [0093.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.405] lstrlenW (lpString=".rar") returned 4 [0093.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".bz2") returned 4 [0093.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".7z") returned 3 [0093.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.405] lstrlenW (lpString=".dbf") returned 4 [0093.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.405] lstrlenW (lpString=".1cd") returned 4 [0093.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0093.406] lstrlenW (lpString=".jpg") returned 4 [0093.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.406] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") [0093.408] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=26148) returned 1 [0093.408] CloseHandle (hObject=0x1f0) returned 1 [0093.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0093.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.409] GetLastError () returned 0x0 [0093.409] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6624, lpOverlapped=0x0) returned 1 [0093.411] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6630, lpOverlapped=0x0) returned 1 [0093.412] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.413] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.413] SetEndOfFile (hFile=0x190) returned 1 [0093.413] CloseHandle (hObject=0x190) returned 1 [0093.413] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.413] SetEndOfFile (hFile=0x1f0) returned 1 [0093.414] CloseHandle (hObject=0x1f0) returned 1 [0093.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.414] lstrlenW (lpString=".doc") returned 4 [0093.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".docx") returned 5 [0093.414] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.414] lstrlenW (lpString=".pdf") returned 4 [0093.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".xls") returned 4 [0093.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.414] lstrlenW (lpString=".xlsx") returned 5 [0093.414] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.414] lstrlenW (lpString=".ppt") returned 4 [0093.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.415] lstrlenW (lpString=".zip") returned 4 [0093.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.415] lstrlenW (lpString=".rar") returned 4 [0093.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".bz2") returned 4 [0093.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".7z") returned 3 [0093.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.415] lstrlenW (lpString=".dbf") returned 4 [0093.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.415] lstrlenW (lpString=".1cd") returned 4 [0093.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0093.415] lstrlenW (lpString=".jpg") returned 4 [0093.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.415] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") [0093.415] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=54964) returned 1 [0093.416] CloseHandle (hObject=0x1f0) returned 1 [0093.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0093.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.416] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.416] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.416] GetLastError () returned 0x0 [0093.416] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd6b4, lpOverlapped=0x0) returned 1 [0093.419] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd6c0, lpOverlapped=0x0) returned 1 [0093.420] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.420] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.420] SetEndOfFile (hFile=0x190) returned 1 [0093.420] CloseHandle (hObject=0x190) returned 1 [0093.421] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.421] SetEndOfFile (hFile=0x1f0) returned 1 [0093.422] CloseHandle (hObject=0x1f0) returned 1 [0093.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.422] lstrlenW (lpString=".doc") returned 4 [0093.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".docx") returned 5 [0093.422] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.422] lstrlenW (lpString=".pdf") returned 4 [0093.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".xls") returned 4 [0093.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.422] lstrlenW (lpString=".xlsx") returned 5 [0093.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.422] lstrlenW (lpString=".ppt") returned 4 [0093.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.422] lstrlenW (lpString=".zip") returned 4 [0093.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.422] lstrlenW (lpString=".rar") returned 4 [0093.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".bz2") returned 4 [0093.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".7z") returned 3 [0093.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.423] lstrlenW (lpString=".dbf") returned 4 [0093.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.423] lstrlenW (lpString=".1cd") returned 4 [0093.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0093.423] lstrlenW (lpString=".jpg") returned 4 [0093.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.423] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") [0093.423] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=42272) returned 1 [0093.423] CloseHandle (hObject=0x1f0) returned 1 [0093.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0093.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.424] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.424] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.424] GetLastError () returned 0x0 [0093.424] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa520, lpOverlapped=0x0) returned 1 [0093.427] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa530, lpOverlapped=0x0) returned 1 [0093.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.428] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.428] SetEndOfFile (hFile=0x190) returned 1 [0093.428] CloseHandle (hObject=0x190) returned 1 [0093.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.428] SetEndOfFile (hFile=0x1f0) returned 1 [0093.429] CloseHandle (hObject=0x1f0) returned 1 [0093.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0093.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.430] lstrlenW (lpString=".doc") returned 4 [0093.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.430] lstrlenW (lpString=".docx") returned 5 [0093.430] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.430] lstrlenW (lpString=".pdf") returned 4 [0093.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.430] lstrlenW (lpString=".xls") returned 4 [0093.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.430] lstrlenW (lpString=".xlsx") returned 5 [0093.430] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.430] lstrlenW (lpString=".ppt") returned 4 [0093.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.430] lstrlenW (lpString=".zip") returned 4 [0093.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.430] lstrlenW (lpString=".rar") returned 4 [0093.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.430] lstrlenW (lpString=".bz2") returned 4 [0093.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.430] lstrlenW (lpString=".7z") returned 3 [0093.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.430] lstrlenW (lpString=".dbf") returned 4 [0093.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.431] lstrlenW (lpString=".1cd") returned 4 [0093.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0093.431] lstrlenW (lpString=".jpg") returned 4 [0093.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.431] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") [0093.431] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=41906) returned 1 [0093.431] CloseHandle (hObject=0x1f0) returned 1 [0093.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0093.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.432] GetLastError () returned 0x0 [0093.432] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa3b2, lpOverlapped=0x0) returned 1 [0093.435] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa3c0, lpOverlapped=0x0) returned 1 [0093.436] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.436] WriteFile (in: hFile=0x190, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.436] SetEndOfFile (hFile=0x190) returned 1 [0093.436] CloseHandle (hObject=0x190) returned 1 [0093.436] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.436] SetEndOfFile (hFile=0x1f0) returned 1 [0093.437] CloseHandle (hObject=0x1f0) returned 1 [0093.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0093.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.438] lstrlenW (lpString=".doc") returned 4 [0093.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.438] lstrlenW (lpString=".docx") returned 5 [0093.438] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.438] lstrlenW (lpString=".pdf") returned 4 [0093.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.438] lstrlenW (lpString=".xls") returned 4 [0093.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.438] lstrlenW (lpString=".xlsx") returned 5 [0093.438] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.438] lstrlenW (lpString=".ppt") returned 4 [0093.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.438] lstrlenW (lpString=".zip") returned 4 [0093.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.438] lstrlenW (lpString=".rar") returned 4 [0093.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.438] lstrlenW (lpString=".bz2") returned 4 [0093.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.438] lstrlenW (lpString=".7z") returned 3 [0093.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.438] lstrlenW (lpString=".dbf") returned 4 [0093.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.439] lstrlenW (lpString=".1cd") returned 4 [0093.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0093.439] lstrlenW (lpString=".jpg") returned 4 [0093.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.439] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") [0093.501] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=42654) returned 1 [0093.501] CloseHandle (hObject=0x1f0) returned 1 [0093.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0093.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.508] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.508] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.532] GetLastError () returned 0x0 [0093.532] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa69e, lpOverlapped=0x0) returned 1 [0093.549] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa6a0, lpOverlapped=0x0) returned 1 [0093.550] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.550] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.551] SetEndOfFile (hFile=0x1c0) returned 1 [0093.551] CloseHandle (hObject=0x1c0) returned 1 [0093.551] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.551] SetEndOfFile (hFile=0x1f0) returned 1 [0093.552] CloseHandle (hObject=0x1f0) returned 1 [0093.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 1 [0093.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.552] lstrlenW (lpString=".doc") returned 4 [0093.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.552] lstrlenW (lpString=".docx") returned 5 [0093.552] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.552] lstrlenW (lpString=".pdf") returned 4 [0093.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.552] lstrlenW (lpString=".xls") returned 4 [0093.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.552] lstrlenW (lpString=".xlsx") returned 5 [0093.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.553] lstrlenW (lpString=".ppt") returned 4 [0093.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.553] lstrlenW (lpString=".zip") returned 4 [0093.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.553] lstrlenW (lpString=".rar") returned 4 [0093.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.553] lstrlenW (lpString=".bz2") returned 4 [0093.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.553] lstrlenW (lpString=".7z") returned 3 [0093.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.553] lstrlenW (lpString=".dbf") returned 4 [0093.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.553] lstrlenW (lpString=".1cd") returned 4 [0093.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0093.553] lstrlenW (lpString=".jpg") returned 4 [0093.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.553] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") [0093.554] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5252) returned 1 [0093.554] CloseHandle (hObject=0x1f0) returned 1 [0093.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 0x20 [0093.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.554] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.554] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.555] GetLastError () returned 0x0 [0093.555] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1484, lpOverlapped=0x0) returned 1 [0093.562] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0093.563] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.564] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.564] SetEndOfFile (hFile=0x1c0) returned 1 [0093.564] CloseHandle (hObject=0x1c0) returned 1 [0093.564] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.564] SetEndOfFile (hFile=0x1f0) returned 1 [0093.565] CloseHandle (hObject=0x1f0) returned 1 [0093.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 1 [0093.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.565] lstrlenW (lpString=".doc") returned 4 [0093.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.565] lstrlenW (lpString=".docx") returned 5 [0093.565] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0093.565] lstrlenW (lpString=".pdf") returned 4 [0093.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString=".xls") returned 4 [0093.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.566] lstrlenW (lpString=".xlsx") returned 5 [0093.566] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0093.566] lstrlenW (lpString=".ppt") returned 4 [0093.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.566] lstrlenW (lpString=".zip") returned 4 [0093.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.566] lstrlenW (lpString=".rar") returned 4 [0093.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString=".bz2") returned 4 [0093.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString=".7z") returned 3 [0093.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.566] lstrlenW (lpString=".dbf") returned 4 [0093.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.566] lstrlenW (lpString=".1cd") returned 4 [0093.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0093.566] lstrlenW (lpString=".jpg") returned 4 [0093.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.566] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") [0093.567] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12332) returned 1 [0093.567] CloseHandle (hObject=0x1f0) returned 1 [0093.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 0x20 [0093.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.567] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.567] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.568] GetLastError () returned 0x0 [0093.568] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x302c, lpOverlapped=0x0) returned 1 [0093.573] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3030, lpOverlapped=0x0) returned 1 [0093.574] ReadFile (in: hFile=0x1f0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.575] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.575] SetEndOfFile (hFile=0x1c0) returned 1 [0093.575] CloseHandle (hObject=0x1c0) returned 1 [0093.575] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.575] SetEndOfFile (hFile=0x1f0) returned 1 [0093.576] CloseHandle (hObject=0x1f0) returned 1 [0093.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0093.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.576] lstrlenW (lpString=".doc") returned 4 [0093.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.576] lstrlenW (lpString=".docx") returned 5 [0093.576] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.576] lstrlenW (lpString=".pdf") returned 4 [0093.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.576] lstrlenW (lpString=".xls") returned 4 [0093.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.576] lstrlenW (lpString=".xlsx") returned 5 [0093.576] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.577] lstrlenW (lpString=".ppt") returned 4 [0093.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.577] lstrlenW (lpString=".zip") returned 4 [0093.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.577] lstrlenW (lpString=".rar") returned 4 [0093.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.577] lstrlenW (lpString=".bz2") returned 4 [0093.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.577] lstrlenW (lpString=".7z") returned 3 [0093.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.577] lstrlenW (lpString=".dbf") returned 4 [0093.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.577] lstrlenW (lpString=".1cd") returned 4 [0093.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0093.577] lstrlenW (lpString=".jpg") returned 4 [0093.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.577] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") [0093.587] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7180) returned 1 [0093.587] CloseHandle (hObject=0x190) returned 1 [0093.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 0x20 [0093.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.864] GetLastError () returned 0x0 [0093.865] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1c0c, lpOverlapped=0x0) returned 1 [0093.906] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0093.908] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.908] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.908] SetEndOfFile (hFile=0x22c) returned 1 [0093.908] CloseHandle (hObject=0x22c) returned 1 [0093.908] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.908] SetEndOfFile (hFile=0x190) returned 1 [0093.909] CloseHandle (hObject=0x190) returned 1 [0093.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 1 [0093.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.909] lstrlenW (lpString=".doc") returned 4 [0093.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.909] lstrlenW (lpString=".docx") returned 5 [0093.909] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.909] lstrlenW (lpString=".pdf") returned 4 [0093.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.909] lstrlenW (lpString=".xls") returned 4 [0093.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.909] lstrlenW (lpString=".xlsx") returned 5 [0093.910] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.910] lstrlenW (lpString=".ppt") returned 4 [0093.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.910] lstrlenW (lpString=".zip") returned 4 [0093.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.910] lstrlenW (lpString=".rar") returned 4 [0093.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.910] lstrlenW (lpString=".bz2") returned 4 [0093.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.910] lstrlenW (lpString=".7z") returned 3 [0093.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.910] lstrlenW (lpString=".dbf") returned 4 [0093.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.910] lstrlenW (lpString=".1cd") returned 4 [0093.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0093.910] lstrlenW (lpString=".jpg") returned 4 [0093.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.910] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") [0093.911] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19466) returned 1 [0093.911] CloseHandle (hObject=0x190) returned 1 [0093.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 0x20 [0093.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.912] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.912] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.913] GetLastError () returned 0x0 [0093.913] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4c0a, lpOverlapped=0x0) returned 1 [0093.947] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4c10, lpOverlapped=0x0) returned 1 [0093.948] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.948] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.948] SetEndOfFile (hFile=0x22c) returned 1 [0093.949] CloseHandle (hObject=0x22c) returned 1 [0093.949] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.949] SetEndOfFile (hFile=0x190) returned 1 [0093.949] CloseHandle (hObject=0x190) returned 1 [0093.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 1 [0093.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.950] lstrlenW (lpString=".doc") returned 4 [0093.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.950] lstrlenW (lpString=".docx") returned 5 [0093.950] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.950] lstrlenW (lpString=".pdf") returned 4 [0093.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.950] lstrlenW (lpString=".xls") returned 4 [0093.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.950] lstrlenW (lpString=".xlsx") returned 5 [0093.950] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.950] lstrlenW (lpString=".ppt") returned 4 [0093.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.950] lstrlenW (lpString=".zip") returned 4 [0093.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.951] lstrlenW (lpString=".rar") returned 4 [0093.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString=".bz2") returned 4 [0093.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString=".7z") returned 3 [0093.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.951] lstrlenW (lpString=".dbf") returned 4 [0093.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.951] lstrlenW (lpString=".1cd") returned 4 [0093.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0093.951] lstrlenW (lpString=".jpg") returned 4 [0093.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.951] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") [0093.952] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=41136) returned 1 [0093.952] CloseHandle (hObject=0x190) returned 1 [0093.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 0x20 [0093.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.952] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.952] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.953] GetLastError () returned 0x0 [0093.953] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa0b0, lpOverlapped=0x0) returned 1 [0093.956] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa0c0, lpOverlapped=0x0) returned 1 [0093.957] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.957] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.958] SetEndOfFile (hFile=0x22c) returned 1 [0093.958] CloseHandle (hObject=0x22c) returned 1 [0093.958] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.958] SetEndOfFile (hFile=0x190) returned 1 [0093.959] CloseHandle (hObject=0x190) returned 1 [0093.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.959] lstrlenW (lpString=".doc") returned 4 [0093.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".docx") returned 5 [0093.959] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.959] lstrlenW (lpString=".pdf") returned 4 [0093.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".xls") returned 4 [0093.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.959] lstrlenW (lpString=".xlsx") returned 5 [0093.959] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.960] lstrlenW (lpString=".ppt") returned 4 [0093.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.960] lstrlenW (lpString=".zip") returned 4 [0093.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.960] lstrlenW (lpString=".rar") returned 4 [0093.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".bz2") returned 4 [0093.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".7z") returned 3 [0093.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.960] lstrlenW (lpString=".dbf") returned 4 [0093.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.960] lstrlenW (lpString=".1cd") returned 4 [0093.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0093.960] lstrlenW (lpString=".jpg") returned 4 [0093.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.960] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") [0093.961] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=20232) returned 1 [0093.961] CloseHandle (hObject=0x190) returned 1 [0093.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 0x20 [0093.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.961] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.961] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.962] GetLastError () returned 0x0 [0093.962] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4f08, lpOverlapped=0x0) returned 1 [0093.964] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4f10, lpOverlapped=0x0) returned 1 [0093.965] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.965] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.965] SetEndOfFile (hFile=0x22c) returned 1 [0093.965] CloseHandle (hObject=0x22c) returned 1 [0093.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.965] SetEndOfFile (hFile=0x190) returned 1 [0093.966] CloseHandle (hObject=0x190) returned 1 [0093.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0093.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.966] lstrlenW (lpString=".doc") returned 4 [0093.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.966] lstrlenW (lpString=".docx") returned 5 [0093.966] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.966] lstrlenW (lpString=".pdf") returned 4 [0093.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString=".xls") returned 4 [0093.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.967] lstrlenW (lpString=".xlsx") returned 5 [0093.967] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.967] lstrlenW (lpString=".ppt") returned 4 [0093.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.967] lstrlenW (lpString=".zip") returned 4 [0093.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.967] lstrlenW (lpString=".rar") returned 4 [0093.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString=".bz2") returned 4 [0093.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString=".7z") returned 3 [0093.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.967] lstrlenW (lpString=".dbf") returned 4 [0093.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.967] lstrlenW (lpString=".1cd") returned 4 [0093.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0093.967] lstrlenW (lpString=".jpg") returned 4 [0093.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.967] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") [0093.968] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21400) returned 1 [0093.968] CloseHandle (hObject=0x190) returned 1 [0093.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 0x20 [0093.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.969] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.969] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.969] GetLastError () returned 0x0 [0093.969] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5398, lpOverlapped=0x0) returned 1 [0093.972] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x53a0, lpOverlapped=0x0) returned 1 [0093.973] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.973] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.973] SetEndOfFile (hFile=0x22c) returned 1 [0093.973] CloseHandle (hObject=0x22c) returned 1 [0093.973] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.973] SetEndOfFile (hFile=0x190) returned 1 [0093.974] CloseHandle (hObject=0x190) returned 1 [0093.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.977] lstrlenW (lpString=".doc") returned 4 [0093.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".docx") returned 5 [0093.977] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.977] lstrlenW (lpString=".pdf") returned 4 [0093.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".xls") returned 4 [0093.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.977] lstrlenW (lpString=".xlsx") returned 5 [0093.977] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.977] lstrlenW (lpString=".ppt") returned 4 [0093.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.977] lstrlenW (lpString=".zip") returned 4 [0093.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.977] lstrlenW (lpString=".rar") returned 4 [0093.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".bz2") returned 4 [0093.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".7z") returned 3 [0093.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.977] lstrlenW (lpString=".dbf") returned 4 [0093.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.978] lstrlenW (lpString=".1cd") returned 4 [0093.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0093.978] lstrlenW (lpString=".jpg") returned 4 [0093.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.978] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") [0093.978] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13934) returned 1 [0093.978] CloseHandle (hObject=0x190) returned 1 [0093.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 0x20 [0093.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.979] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.979] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.979] GetLastError () returned 0x0 [0093.979] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x366e, lpOverlapped=0x0) returned 1 [0094.160] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3670, lpOverlapped=0x0) returned 1 [0094.161] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.161] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.161] SetEndOfFile (hFile=0x22c) returned 1 [0094.161] CloseHandle (hObject=0x22c) returned 1 [0094.161] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.161] SetEndOfFile (hFile=0x190) returned 1 [0094.162] CloseHandle (hObject=0x190) returned 1 [0094.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 1 [0094.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.163] lstrlenW (lpString=".doc") returned 4 [0094.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.163] lstrlenW (lpString=".docx") returned 5 [0094.163] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0094.163] lstrlenW (lpString=".pdf") returned 4 [0094.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.163] lstrlenW (lpString=".xls") returned 4 [0094.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.163] lstrlenW (lpString=".xlsx") returned 5 [0094.163] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0094.163] lstrlenW (lpString=".ppt") returned 4 [0094.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.163] lstrlenW (lpString=".zip") returned 4 [0094.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.163] lstrlenW (lpString=".rar") returned 4 [0094.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.163] lstrlenW (lpString=".bz2") returned 4 [0094.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.163] lstrlenW (lpString=".7z") returned 3 [0094.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.163] lstrlenW (lpString=".dbf") returned 4 [0094.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.164] lstrlenW (lpString=".1cd") returned 4 [0094.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0094.164] lstrlenW (lpString=".jpg") returned 4 [0094.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.164] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") [0094.165] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33230) returned 1 [0094.165] CloseHandle (hObject=0x190) returned 1 [0094.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 0x20 [0094.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.165] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.165] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.166] GetLastError () returned 0x0 [0094.166] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x81ce, lpOverlapped=0x0) returned 1 [0094.168] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x81d0, lpOverlapped=0x0) returned 1 [0094.170] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.170] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.170] SetEndOfFile (hFile=0x22c) returned 1 [0094.170] CloseHandle (hObject=0x22c) returned 1 [0094.170] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.170] SetEndOfFile (hFile=0x190) returned 1 [0094.171] CloseHandle (hObject=0x190) returned 1 [0094.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 1 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString=".doc") returned 4 [0094.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString=".docx") returned 5 [0094.172] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.172] lstrlenW (lpString=".pdf") returned 4 [0094.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString=".xls") returned 4 [0094.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.172] lstrlenW (lpString=".xlsx") returned 5 [0094.172] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.172] lstrlenW (lpString=".ppt") returned 4 [0094.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString=".zip") returned 4 [0094.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.172] lstrlenW (lpString=".rar") returned 4 [0094.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString=".bz2") returned 4 [0094.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString=".7z") returned 3 [0094.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString=".dbf") returned 4 [0094.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString=".1cd") returned 4 [0094.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0094.172] lstrlenW (lpString=".jpg") returned 4 [0094.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.173] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") [0094.173] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9290) returned 1 [0094.174] CloseHandle (hObject=0x190) returned 1 [0094.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 0x20 [0094.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.174] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.174] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.175] GetLastError () returned 0x0 [0094.175] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x244a, lpOverlapped=0x0) returned 1 [0094.176] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2450, lpOverlapped=0x0) returned 1 [0094.177] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.178] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.178] SetEndOfFile (hFile=0x22c) returned 1 [0094.178] CloseHandle (hObject=0x22c) returned 1 [0094.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.178] SetEndOfFile (hFile=0x190) returned 1 [0094.179] CloseHandle (hObject=0x190) returned 1 [0094.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0094.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.179] lstrlenW (lpString=".doc") returned 4 [0094.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.179] lstrlenW (lpString=".docx") returned 5 [0094.179] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.179] lstrlenW (lpString=".pdf") returned 4 [0094.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString=".xls") returned 4 [0094.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.180] lstrlenW (lpString=".xlsx") returned 5 [0094.180] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.180] lstrlenW (lpString=".ppt") returned 4 [0094.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.180] lstrlenW (lpString=".zip") returned 4 [0094.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.180] lstrlenW (lpString=".rar") returned 4 [0094.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString=".bz2") returned 4 [0094.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString=".7z") returned 3 [0094.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.180] lstrlenW (lpString=".dbf") returned 4 [0094.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.180] lstrlenW (lpString=".1cd") returned 4 [0094.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0094.180] lstrlenW (lpString=".jpg") returned 4 [0094.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.180] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") [0094.181] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17826) returned 1 [0094.181] CloseHandle (hObject=0x190) returned 1 [0094.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 0x20 [0094.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.181] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.182] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.182] GetLastError () returned 0x0 [0094.182] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x45a2, lpOverlapped=0x0) returned 1 [0094.184] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x45b0, lpOverlapped=0x0) returned 1 [0094.186] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.186] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.186] SetEndOfFile (hFile=0x22c) returned 1 [0094.186] CloseHandle (hObject=0x22c) returned 1 [0094.186] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.186] SetEndOfFile (hFile=0x190) returned 1 [0094.187] CloseHandle (hObject=0x190) returned 1 [0094.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0094.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.187] lstrlenW (lpString=".doc") returned 4 [0094.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString=".docx") returned 5 [0094.188] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.188] lstrlenW (lpString=".pdf") returned 4 [0094.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString=".xls") returned 4 [0094.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.188] lstrlenW (lpString=".xlsx") returned 5 [0094.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.188] lstrlenW (lpString=".ppt") returned 4 [0094.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.188] lstrlenW (lpString=".zip") returned 4 [0094.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.188] lstrlenW (lpString=".rar") returned 4 [0094.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString=".bz2") returned 4 [0094.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString=".7z") returned 3 [0094.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.188] lstrlenW (lpString=".dbf") returned 4 [0094.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.188] lstrlenW (lpString=".1cd") returned 4 [0094.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0094.188] lstrlenW (lpString=".jpg") returned 4 [0094.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.189] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") [0094.189] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5618) returned 1 [0094.189] CloseHandle (hObject=0x190) returned 1 [0094.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 0x20 [0094.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.190] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.190] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.190] GetLastError () returned 0x0 [0094.190] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x15f2, lpOverlapped=0x0) returned 1 [0094.192] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1600, lpOverlapped=0x0) returned 1 [0094.193] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.193] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.193] SetEndOfFile (hFile=0x22c) returned 1 [0094.193] CloseHandle (hObject=0x22c) returned 1 [0094.193] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.193] SetEndOfFile (hFile=0x190) returned 1 [0094.194] CloseHandle (hObject=0x190) returned 1 [0094.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString=".doc") returned 4 [0094.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString=".docx") returned 5 [0094.195] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.195] lstrlenW (lpString=".pdf") returned 4 [0094.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString=".xls") returned 4 [0094.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.195] lstrlenW (lpString=".xlsx") returned 5 [0094.195] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.195] lstrlenW (lpString=".ppt") returned 4 [0094.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString=".zip") returned 4 [0094.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.195] lstrlenW (lpString=".rar") returned 4 [0094.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString=".bz2") returned 4 [0094.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString=".7z") returned 3 [0094.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString=".dbf") returned 4 [0094.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString=".1cd") returned 4 [0094.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0094.195] lstrlenW (lpString=".jpg") returned 4 [0094.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.196] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") [0094.196] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=42883) returned 1 [0094.196] CloseHandle (hObject=0x190) returned 1 [0094.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 0x20 [0094.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.196] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.197] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.197] GetLastError () returned 0x0 [0094.197] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa783, lpOverlapped=0x0) returned 1 [0094.212] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa790, lpOverlapped=0x0) returned 1 [0094.214] ReadFile (in: hFile=0x190, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.214] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.214] SetEndOfFile (hFile=0x22c) returned 1 [0094.469] CloseHandle (hObject=0x22c) returned 1 [0094.469] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.469] SetEndOfFile (hFile=0x190) returned 1 [0094.495] CloseHandle (hObject=0x190) returned 1 [0094.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 1 [0094.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.495] lstrlenW (lpString=".doc") returned 4 [0094.495] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0094.496] lstrlenW (lpString=".docx") returned 5 [0094.496] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0094.496] lstrlenW (lpString=".pdf") returned 4 [0094.496] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0094.496] lstrlenW (lpString=".xls") returned 4 [0094.496] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0094.496] lstrlenW (lpString=".xlsx") returned 5 [0094.496] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0094.496] lstrlenW (lpString=".ppt") returned 4 [0094.496] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0094.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.496] lstrlenW (lpString=".zip") returned 4 [0094.496] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0094.496] lstrlenW (lpString=".rar") returned 4 [0094.496] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0094.496] lstrlenW (lpString=".bz2") returned 4 [0094.496] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0094.496] lstrlenW (lpString=".7z") returned 3 [0094.496] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0094.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.496] lstrlenW (lpString=".dbf") returned 4 [0094.496] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0094.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.496] lstrlenW (lpString=".1cd") returned 4 [0094.496] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0094.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0094.496] lstrlenW (lpString=".jpg") returned 4 [0094.496] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0094.496] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") [0094.518] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9442) returned 1 [0094.518] CloseHandle (hObject=0x1c0) returned 1 [0094.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 0x20 [0094.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.519] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.519] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.519] GetLastError () returned 0x0 [0094.519] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x24e2, lpOverlapped=0x0) returned 1 [0094.521] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x24f0, lpOverlapped=0x0) returned 1 [0094.522] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.522] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.522] SetEndOfFile (hFile=0x158) returned 1 [0094.522] CloseHandle (hObject=0x158) returned 1 [0094.522] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.522] SetEndOfFile (hFile=0x1c0) returned 1 [0094.523] CloseHandle (hObject=0x1c0) returned 1 [0094.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 1 [0094.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.523] lstrlenW (lpString=".doc") returned 4 [0094.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.523] lstrlenW (lpString=".docx") returned 5 [0094.523] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.524] lstrlenW (lpString=".pdf") returned 4 [0094.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString=".xls") returned 4 [0094.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.524] lstrlenW (lpString=".xlsx") returned 5 [0094.524] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.524] lstrlenW (lpString=".ppt") returned 4 [0094.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.524] lstrlenW (lpString=".zip") returned 4 [0094.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.524] lstrlenW (lpString=".rar") returned 4 [0094.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString=".bz2") returned 4 [0094.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString=".7z") returned 3 [0094.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.524] lstrlenW (lpString=".dbf") returned 4 [0094.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.524] lstrlenW (lpString=".1cd") returned 4 [0094.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 63 [0094.524] lstrlenW (lpString=".jpg") returned 4 [0094.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.524] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") [0094.525] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5252) returned 1 [0094.525] CloseHandle (hObject=0x1c0) returned 1 [0094.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 0x20 [0094.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.525] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.525] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.526] GetLastError () returned 0x0 [0094.526] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1484, lpOverlapped=0x0) returned 1 [0094.527] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0094.528] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.528] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.528] SetEndOfFile (hFile=0x158) returned 1 [0094.529] CloseHandle (hObject=0x158) returned 1 [0094.529] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.529] SetEndOfFile (hFile=0x1c0) returned 1 [0094.530] CloseHandle (hObject=0x1c0) returned 1 [0094.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 1 [0094.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.530] lstrlenW (lpString=".doc") returned 4 [0094.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.530] lstrlenW (lpString=".docx") returned 5 [0094.530] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.530] lstrlenW (lpString=".pdf") returned 4 [0094.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.530] lstrlenW (lpString=".xls") returned 4 [0094.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.530] lstrlenW (lpString=".xlsx") returned 5 [0094.530] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.530] lstrlenW (lpString=".ppt") returned 4 [0094.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.530] lstrlenW (lpString=".zip") returned 4 [0094.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.530] lstrlenW (lpString=".rar") returned 4 [0094.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.530] lstrlenW (lpString=".bz2") returned 4 [0094.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.531] lstrlenW (lpString=".7z") returned 3 [0094.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.531] lstrlenW (lpString=".dbf") returned 4 [0094.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.531] lstrlenW (lpString=".1cd") returned 4 [0094.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0094.531] lstrlenW (lpString=".jpg") returned 4 [0094.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.531] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") [0094.532] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3482) returned 1 [0094.532] CloseHandle (hObject=0x1c0) returned 1 [0094.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 0x20 [0094.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.533] GetLastError () returned 0x0 [0094.533] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd9a, lpOverlapped=0x0) returned 1 [0094.535] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0094.536] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.536] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.536] SetEndOfFile (hFile=0x158) returned 1 [0094.536] CloseHandle (hObject=0x158) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.536] SetEndOfFile (hFile=0x1c0) returned 1 [0094.537] CloseHandle (hObject=0x1c0) returned 1 [0094.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.537] lstrlenW (lpString=".doc") returned 4 [0094.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".docx") returned 5 [0094.538] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.538] lstrlenW (lpString=".pdf") returned 4 [0094.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".xls") returned 4 [0094.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.538] lstrlenW (lpString=".xlsx") returned 5 [0094.538] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.538] lstrlenW (lpString=".ppt") returned 4 [0094.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.538] lstrlenW (lpString=".zip") returned 4 [0094.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.538] lstrlenW (lpString=".rar") returned 4 [0094.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".bz2") returned 4 [0094.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".7z") returned 3 [0094.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.538] lstrlenW (lpString=".dbf") returned 4 [0094.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.538] lstrlenW (lpString=".1cd") returned 4 [0094.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0094.538] lstrlenW (lpString=".jpg") returned 4 [0094.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.538] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") [0094.539] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7336) returned 1 [0094.539] CloseHandle (hObject=0x1c0) returned 1 [0094.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 0x20 [0094.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.539] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.540] GetLastError () returned 0x0 [0094.540] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ca8, lpOverlapped=0x0) returned 1 [0094.541] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0094.542] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.542] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.542] SetEndOfFile (hFile=0x158) returned 1 [0094.543] CloseHandle (hObject=0x158) returned 1 [0094.543] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.543] SetEndOfFile (hFile=0x1c0) returned 1 [0094.543] CloseHandle (hObject=0x1c0) returned 1 [0094.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.544] lstrlenW (lpString=".doc") returned 4 [0094.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.544] lstrlenW (lpString=".docx") returned 5 [0094.544] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.544] lstrlenW (lpString=".pdf") returned 4 [0094.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.544] lstrlenW (lpString=".xls") returned 4 [0094.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.544] lstrlenW (lpString=".xlsx") returned 5 [0094.544] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.544] lstrlenW (lpString=".ppt") returned 4 [0094.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.544] lstrlenW (lpString=".zip") returned 4 [0094.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.544] lstrlenW (lpString=".rar") returned 4 [0094.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.544] lstrlenW (lpString=".bz2") returned 4 [0094.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.544] lstrlenW (lpString=".7z") returned 3 [0094.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.545] lstrlenW (lpString=".dbf") returned 4 [0094.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.545] lstrlenW (lpString=".1cd") returned 4 [0094.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0094.545] lstrlenW (lpString=".jpg") returned 4 [0094.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.545] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") [0094.545] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=35542) returned 1 [0094.545] CloseHandle (hObject=0x1c0) returned 1 [0094.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 0x20 [0094.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.546] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.546] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.546] GetLastError () returned 0x0 [0094.546] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8ad6, lpOverlapped=0x0) returned 1 [0094.780] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0094.781] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.781] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.781] SetEndOfFile (hFile=0x158) returned 1 [0094.781] CloseHandle (hObject=0x158) returned 1 [0094.781] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.782] SetEndOfFile (hFile=0x1c0) returned 1 [0094.782] CloseHandle (hObject=0x1c0) returned 1 [0094.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 1 [0094.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.783] lstrlenW (lpString=".doc") returned 4 [0094.783] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0094.783] lstrlenW (lpString=".docx") returned 5 [0094.783] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0094.783] lstrlenW (lpString=".pdf") returned 4 [0094.783] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0094.783] lstrlenW (lpString=".xls") returned 4 [0094.783] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0094.783] lstrlenW (lpString=".xlsx") returned 5 [0094.783] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0094.783] lstrlenW (lpString=".ppt") returned 4 [0094.783] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0094.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.783] lstrlenW (lpString=".zip") returned 4 [0094.783] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0094.783] lstrlenW (lpString=".rar") returned 4 [0094.783] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0094.783] lstrlenW (lpString=".bz2") returned 4 [0094.783] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0094.784] lstrlenW (lpString=".7z") returned 3 [0094.784] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0094.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.784] lstrlenW (lpString=".dbf") returned 4 [0094.784] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0094.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.784] lstrlenW (lpString=".1cd") returned 4 [0094.784] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0094.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0094.784] lstrlenW (lpString=".jpg") returned 4 [0094.784] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0094.784] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") [0094.784] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19942) returned 1 [0094.784] CloseHandle (hObject=0x1c0) returned 1 [0094.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 0x20 [0094.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.785] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.785] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.785] GetLastError () returned 0x0 [0094.785] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4de6, lpOverlapped=0x0) returned 1 [0094.787] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4df0, lpOverlapped=0x0) returned 1 [0094.788] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.788] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.788] SetEndOfFile (hFile=0x158) returned 1 [0094.788] CloseHandle (hObject=0x158) returned 1 [0094.788] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.788] SetEndOfFile (hFile=0x1c0) returned 1 [0094.789] CloseHandle (hObject=0x1c0) returned 1 [0094.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 1 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString=".doc") returned 4 [0094.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString=".docx") returned 5 [0094.790] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.790] lstrlenW (lpString=".pdf") returned 4 [0094.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString=".xls") returned 4 [0094.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.790] lstrlenW (lpString=".xlsx") returned 5 [0094.790] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.790] lstrlenW (lpString=".ppt") returned 4 [0094.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString=".zip") returned 4 [0094.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.790] lstrlenW (lpString=".rar") returned 4 [0094.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString=".bz2") returned 4 [0094.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString=".7z") returned 3 [0094.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString=".dbf") returned 4 [0094.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString=".1cd") returned 4 [0094.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0094.790] lstrlenW (lpString=".jpg") returned 4 [0094.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.791] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") [0094.791] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9960) returned 1 [0094.791] CloseHandle (hObject=0x1c0) returned 1 [0094.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 0x20 [0094.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.791] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.791] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.792] GetLastError () returned 0x0 [0094.792] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x26e8, lpOverlapped=0x0) returned 1 [0094.794] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x26f0, lpOverlapped=0x0) returned 1 [0094.795] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.795] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.795] SetEndOfFile (hFile=0x158) returned 1 [0094.795] CloseHandle (hObject=0x158) returned 1 [0094.795] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.795] SetEndOfFile (hFile=0x1c0) returned 1 [0094.796] CloseHandle (hObject=0x1c0) returned 1 [0094.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 1 [0094.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.796] lstrlenW (lpString=".doc") returned 4 [0094.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.796] lstrlenW (lpString=".docx") returned 5 [0094.796] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.796] lstrlenW (lpString=".pdf") returned 4 [0094.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.796] lstrlenW (lpString=".xls") returned 4 [0094.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.797] lstrlenW (lpString=".xlsx") returned 5 [0094.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.797] lstrlenW (lpString=".ppt") returned 4 [0094.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.797] lstrlenW (lpString=".zip") returned 4 [0094.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.797] lstrlenW (lpString=".rar") returned 4 [0094.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.797] lstrlenW (lpString=".bz2") returned 4 [0094.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.797] lstrlenW (lpString=".7z") returned 3 [0094.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.797] lstrlenW (lpString=".dbf") returned 4 [0094.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.797] lstrlenW (lpString=".1cd") returned 4 [0094.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0094.797] lstrlenW (lpString=".jpg") returned 4 [0094.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.797] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") [0094.798] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12588) returned 1 [0094.798] CloseHandle (hObject=0x1c0) returned 1 [0094.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 0x20 [0094.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.799] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.799] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.799] GetLastError () returned 0x0 [0094.799] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x312c, lpOverlapped=0x0) returned 1 [0094.801] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3130, lpOverlapped=0x0) returned 1 [0094.802] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.802] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.802] SetEndOfFile (hFile=0x158) returned 1 [0094.802] CloseHandle (hObject=0x158) returned 1 [0094.803] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.803] SetEndOfFile (hFile=0x1c0) returned 1 [0094.803] CloseHandle (hObject=0x1c0) returned 1 [0094.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.804] lstrlenW (lpString=".doc") returned 4 [0094.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.804] lstrlenW (lpString=".docx") returned 5 [0094.804] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.804] lstrlenW (lpString=".pdf") returned 4 [0094.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.804] lstrlenW (lpString=".xls") returned 4 [0094.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.804] lstrlenW (lpString=".xlsx") returned 5 [0094.804] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.804] lstrlenW (lpString=".ppt") returned 4 [0094.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.804] lstrlenW (lpString=".zip") returned 4 [0094.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.804] lstrlenW (lpString=".rar") returned 4 [0094.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.804] lstrlenW (lpString=".bz2") returned 4 [0094.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.804] lstrlenW (lpString=".7z") returned 3 [0094.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.804] lstrlenW (lpString=".dbf") returned 4 [0094.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.805] lstrlenW (lpString=".1cd") returned 4 [0094.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 63 [0094.805] lstrlenW (lpString=".jpg") returned 4 [0094.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.805] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") [0094.805] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=38750) returned 1 [0094.805] CloseHandle (hObject=0x1c0) returned 1 [0094.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 0x20 [0094.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.806] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.806] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.806] GetLastError () returned 0x0 [0094.806] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x975e, lpOverlapped=0x0) returned 1 [0094.809] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9760, lpOverlapped=0x0) returned 1 [0094.810] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.810] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.810] SetEndOfFile (hFile=0x158) returned 1 [0094.810] CloseHandle (hObject=0x158) returned 1 [0094.810] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.810] SetEndOfFile (hFile=0x1c0) returned 1 [0094.811] CloseHandle (hObject=0x1c0) returned 1 [0094.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 1 [0094.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.812] lstrlenW (lpString=".doc") returned 4 [0094.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.812] lstrlenW (lpString=".docx") returned 5 [0094.812] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.812] lstrlenW (lpString=".pdf") returned 4 [0094.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.812] lstrlenW (lpString=".xls") returned 4 [0094.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.812] lstrlenW (lpString=".xlsx") returned 5 [0094.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.812] lstrlenW (lpString=".ppt") returned 4 [0094.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.812] lstrlenW (lpString=".zip") returned 4 [0094.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.812] lstrlenW (lpString=".rar") returned 4 [0094.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.812] lstrlenW (lpString=".bz2") returned 4 [0094.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.812] lstrlenW (lpString=".7z") returned 3 [0094.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.812] lstrlenW (lpString=".dbf") returned 4 [0094.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.813] lstrlenW (lpString=".1cd") returned 4 [0094.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 63 [0094.813] lstrlenW (lpString=".jpg") returned 4 [0094.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.813] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") [0094.813] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=52934) returned 1 [0094.813] CloseHandle (hObject=0x1c0) returned 1 [0094.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 0x20 [0094.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.814] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.814] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.814] GetLastError () returned 0x0 [0094.814] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xcec6, lpOverlapped=0x0) returned 1 [0094.966] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xced0, lpOverlapped=0x0) returned 1 [0094.968] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.968] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.968] SetEndOfFile (hFile=0x158) returned 1 [0094.968] CloseHandle (hObject=0x158) returned 1 [0094.968] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.968] SetEndOfFile (hFile=0x1c0) returned 1 [0094.969] CloseHandle (hObject=0x1c0) returned 1 [0094.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 1 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString=".doc") returned 4 [0094.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString=".docx") returned 5 [0094.970] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.970] lstrlenW (lpString=".pdf") returned 4 [0094.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString=".xls") returned 4 [0094.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.970] lstrlenW (lpString=".xlsx") returned 5 [0094.970] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.970] lstrlenW (lpString=".ppt") returned 4 [0094.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString=".zip") returned 4 [0094.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.970] lstrlenW (lpString=".rar") returned 4 [0094.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString=".bz2") returned 4 [0094.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString=".7z") returned 3 [0094.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString=".dbf") returned 4 [0094.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString=".1cd") returned 4 [0094.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 63 [0094.970] lstrlenW (lpString=".jpg") returned 4 [0094.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.971] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") [0094.971] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33828) returned 1 [0094.971] CloseHandle (hObject=0x1c0) returned 1 [0094.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 0x20 [0094.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.971] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.971] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.972] GetLastError () returned 0x0 [0094.972] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8424, lpOverlapped=0x0) returned 1 [0094.974] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8430, lpOverlapped=0x0) returned 1 [0094.976] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.976] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.976] SetEndOfFile (hFile=0x158) returned 1 [0094.976] CloseHandle (hObject=0x158) returned 1 [0094.976] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.976] SetEndOfFile (hFile=0x1c0) returned 1 [0094.977] CloseHandle (hObject=0x1c0) returned 1 [0094.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 1 [0094.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.977] lstrlenW (lpString=".doc") returned 4 [0094.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.977] lstrlenW (lpString=".docx") returned 5 [0094.977] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.977] lstrlenW (lpString=".pdf") returned 4 [0094.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.977] lstrlenW (lpString=".xls") returned 4 [0094.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.978] lstrlenW (lpString=".xlsx") returned 5 [0094.978] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.978] lstrlenW (lpString=".ppt") returned 4 [0094.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.978] lstrlenW (lpString=".zip") returned 4 [0094.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.978] lstrlenW (lpString=".rar") returned 4 [0094.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.978] lstrlenW (lpString=".bz2") returned 4 [0094.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.978] lstrlenW (lpString=".7z") returned 3 [0094.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.978] lstrlenW (lpString=".dbf") returned 4 [0094.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.978] lstrlenW (lpString=".1cd") returned 4 [0094.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 63 [0094.978] lstrlenW (lpString=".jpg") returned 4 [0094.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.978] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") [0094.979] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4884) returned 1 [0094.979] CloseHandle (hObject=0x1c0) returned 1 [0094.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 0x20 [0094.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.979] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.980] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.980] GetLastError () returned 0x0 [0094.980] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1314, lpOverlapped=0x0) returned 1 [0094.982] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0094.983] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.983] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.983] SetEndOfFile (hFile=0x158) returned 1 [0094.983] CloseHandle (hObject=0x158) returned 1 [0094.983] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.983] SetEndOfFile (hFile=0x1c0) returned 1 [0094.984] CloseHandle (hObject=0x1c0) returned 1 [0094.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 1 [0094.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.984] lstrlenW (lpString=".doc") returned 4 [0094.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.984] lstrlenW (lpString=".docx") returned 5 [0094.984] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.984] lstrlenW (lpString=".pdf") returned 4 [0094.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.984] lstrlenW (lpString=".xls") returned 4 [0094.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.984] lstrlenW (lpString=".xlsx") returned 5 [0094.984] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.985] lstrlenW (lpString=".ppt") returned 4 [0094.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.985] lstrlenW (lpString=".zip") returned 4 [0094.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.985] lstrlenW (lpString=".rar") returned 4 [0094.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.985] lstrlenW (lpString=".bz2") returned 4 [0094.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.985] lstrlenW (lpString=".7z") returned 3 [0094.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.985] lstrlenW (lpString=".dbf") returned 4 [0094.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.985] lstrlenW (lpString=".1cd") returned 4 [0094.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 63 [0094.985] lstrlenW (lpString=".jpg") returned 4 [0094.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.985] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") [0094.986] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5144) returned 1 [0094.986] CloseHandle (hObject=0x1c0) returned 1 [0094.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 0x20 [0094.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.986] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.986] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.987] GetLastError () returned 0x0 [0094.987] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1418, lpOverlapped=0x0) returned 1 [0094.988] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1420, lpOverlapped=0x0) returned 1 [0094.989] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.989] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.989] SetEndOfFile (hFile=0x158) returned 1 [0094.989] CloseHandle (hObject=0x158) returned 1 [0094.989] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.989] SetEndOfFile (hFile=0x1c0) returned 1 [0094.990] CloseHandle (hObject=0x1c0) returned 1 [0094.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 1 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString=".doc") returned 4 [0094.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString=".docx") returned 5 [0094.991] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.991] lstrlenW (lpString=".pdf") returned 4 [0094.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString=".xls") returned 4 [0094.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.991] lstrlenW (lpString=".xlsx") returned 5 [0094.991] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.991] lstrlenW (lpString=".ppt") returned 4 [0094.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString=".zip") returned 4 [0094.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.991] lstrlenW (lpString=".rar") returned 4 [0094.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString=".bz2") returned 4 [0094.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString=".7z") returned 3 [0094.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString=".dbf") returned 4 [0094.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString=".1cd") returned 4 [0094.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 63 [0094.991] lstrlenW (lpString=".jpg") returned 4 [0094.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.992] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") [0094.992] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6552) returned 1 [0094.992] CloseHandle (hObject=0x1c0) returned 1 [0094.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 0x20 [0094.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.992] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.992] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.993] GetLastError () returned 0x0 [0094.993] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1998, lpOverlapped=0x0) returned 1 [0094.995] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x19a0, lpOverlapped=0x0) returned 1 [0094.996] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.996] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.996] SetEndOfFile (hFile=0x158) returned 1 [0094.996] CloseHandle (hObject=0x158) returned 1 [0094.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.996] SetEndOfFile (hFile=0x1c0) returned 1 [0094.997] CloseHandle (hObject=0x1c0) returned 1 [0094.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 1 [0094.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.997] lstrlenW (lpString=".doc") returned 4 [0094.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.997] lstrlenW (lpString=".docx") returned 5 [0094.997] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.997] lstrlenW (lpString=".pdf") returned 4 [0094.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString=".xls") returned 4 [0094.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.998] lstrlenW (lpString=".xlsx") returned 5 [0094.998] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.998] lstrlenW (lpString=".ppt") returned 4 [0094.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.998] lstrlenW (lpString=".zip") returned 4 [0094.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.998] lstrlenW (lpString=".rar") returned 4 [0094.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString=".bz2") returned 4 [0094.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString=".7z") returned 3 [0094.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.998] lstrlenW (lpString=".dbf") returned 4 [0094.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.998] lstrlenW (lpString=".1cd") returned 4 [0094.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 63 [0094.998] lstrlenW (lpString=".jpg") returned 4 [0094.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.998] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") [0094.999] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7232) returned 1 [0094.999] CloseHandle (hObject=0x1c0) returned 1 [0094.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 0x20 [0094.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0094.999] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.999] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.000] GetLastError () returned 0x0 [0095.000] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1c40, lpOverlapped=0x0) returned 1 [0095.108] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1c50, lpOverlapped=0x0) returned 1 [0095.113] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.113] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.113] SetEndOfFile (hFile=0x158) returned 1 [0095.113] CloseHandle (hObject=0x158) returned 1 [0095.114] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.114] SetEndOfFile (hFile=0x1c0) returned 1 [0095.117] CloseHandle (hObject=0x1c0) returned 1 [0095.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 1 [0095.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.124] lstrlenW (lpString=".doc") returned 4 [0095.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.124] lstrlenW (lpString=".docx") returned 5 [0095.124] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0095.124] lstrlenW (lpString=".pdf") returned 4 [0095.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.124] lstrlenW (lpString=".xls") returned 4 [0095.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.124] lstrlenW (lpString=".xlsx") returned 5 [0095.124] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0095.124] lstrlenW (lpString=".ppt") returned 4 [0095.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.124] lstrlenW (lpString=".zip") returned 4 [0095.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.125] lstrlenW (lpString=".rar") returned 4 [0095.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.125] lstrlenW (lpString=".bz2") returned 4 [0095.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.125] lstrlenW (lpString=".7z") returned 3 [0095.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.125] lstrlenW (lpString=".dbf") returned 4 [0095.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.125] lstrlenW (lpString=".1cd") returned 4 [0095.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 63 [0095.125] lstrlenW (lpString=".jpg") returned 4 [0095.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.125] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") [0095.260] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1970) returned 1 [0095.260] CloseHandle (hObject=0x16c) returned 1 [0095.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 0x20 [0095.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.271] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.271] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.293] GetLastError () returned 0x0 [0095.293] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7b2, lpOverlapped=0x0) returned 1 [0095.295] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7c0, lpOverlapped=0x0) returned 1 [0095.296] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.296] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.296] SetEndOfFile (hFile=0x1c0) returned 1 [0095.296] CloseHandle (hObject=0x1c0) returned 1 [0095.296] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.296] SetEndOfFile (hFile=0x16c) returned 1 [0095.297] CloseHandle (hObject=0x16c) returned 1 [0095.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 1 [0095.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.297] lstrlenW (lpString=".doc") returned 4 [0095.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.297] lstrlenW (lpString=".docx") returned 5 [0095.297] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0095.297] lstrlenW (lpString=".pdf") returned 4 [0095.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString=".xls") returned 4 [0095.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.298] lstrlenW (lpString=".xlsx") returned 5 [0095.298] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0095.298] lstrlenW (lpString=".ppt") returned 4 [0095.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.298] lstrlenW (lpString=".zip") returned 4 [0095.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.298] lstrlenW (lpString=".rar") returned 4 [0095.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString=".bz2") returned 4 [0095.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString=".7z") returned 3 [0095.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.298] lstrlenW (lpString=".dbf") returned 4 [0095.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.298] lstrlenW (lpString=".1cd") returned 4 [0095.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 63 [0095.298] lstrlenW (lpString=".jpg") returned 4 [0095.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.298] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") [0095.299] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=17200) returned 1 [0095.299] CloseHandle (hObject=0x16c) returned 1 [0095.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 0x20 [0095.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.300] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.300] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.300] GetLastError () returned 0x0 [0095.300] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4330, lpOverlapped=0x0) returned 1 [0095.302] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4340, lpOverlapped=0x0) returned 1 [0095.303] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.303] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.303] SetEndOfFile (hFile=0x1c0) returned 1 [0095.303] CloseHandle (hObject=0x1c0) returned 1 [0095.303] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.303] SetEndOfFile (hFile=0x16c) returned 1 [0095.304] CloseHandle (hObject=0x16c) returned 1 [0095.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 1 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString=".doc") returned 4 [0095.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString=".docx") returned 5 [0095.305] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0095.305] lstrlenW (lpString=".pdf") returned 4 [0095.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString=".xls") returned 4 [0095.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.305] lstrlenW (lpString=".xlsx") returned 5 [0095.305] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0095.305] lstrlenW (lpString=".ppt") returned 4 [0095.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString=".zip") returned 4 [0095.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.305] lstrlenW (lpString=".rar") returned 4 [0095.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString=".bz2") returned 4 [0095.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString=".7z") returned 3 [0095.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString=".dbf") returned 4 [0095.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString=".1cd") returned 4 [0095.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 63 [0095.305] lstrlenW (lpString=".jpg") returned 4 [0095.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.306] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") [0095.306] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=73198) returned 1 [0095.306] CloseHandle (hObject=0x16c) returned 1 [0095.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 0x20 [0095.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.306] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.306] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.307] GetLastError () returned 0x0 [0095.307] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x11dee, lpOverlapped=0x0) returned 1 [0095.310] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x11df0, lpOverlapped=0x0) returned 1 [0095.312] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.312] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.312] SetEndOfFile (hFile=0x1c0) returned 1 [0095.312] CloseHandle (hObject=0x1c0) returned 1 [0095.313] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.313] SetEndOfFile (hFile=0x16c) returned 1 [0095.314] CloseHandle (hObject=0x16c) returned 1 [0095.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.314] lstrlenW (lpString=".doc") returned 4 [0095.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".docx") returned 5 [0095.314] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.314] lstrlenW (lpString=".pdf") returned 4 [0095.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".xls") returned 4 [0095.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.314] lstrlenW (lpString=".xlsx") returned 5 [0095.314] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.314] lstrlenW (lpString=".ppt") returned 4 [0095.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.315] lstrlenW (lpString=".zip") returned 4 [0095.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.315] lstrlenW (lpString=".rar") returned 4 [0095.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.315] lstrlenW (lpString=".bz2") returned 4 [0095.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.315] lstrlenW (lpString=".7z") returned 3 [0095.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.315] lstrlenW (lpString=".dbf") returned 4 [0095.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.315] lstrlenW (lpString=".1cd") returned 4 [0095.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 63 [0095.315] lstrlenW (lpString=".jpg") returned 4 [0095.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.315] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") [0095.316] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=38084) returned 1 [0095.316] CloseHandle (hObject=0x16c) returned 1 [0095.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 0x20 [0095.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.316] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.316] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.316] GetLastError () returned 0x0 [0095.316] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x94c4, lpOverlapped=0x0) returned 1 [0095.319] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x94d0, lpOverlapped=0x0) returned 1 [0095.320] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.320] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.320] SetEndOfFile (hFile=0x1c0) returned 1 [0095.320] CloseHandle (hObject=0x1c0) returned 1 [0095.321] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.321] SetEndOfFile (hFile=0x16c) returned 1 [0095.322] CloseHandle (hObject=0x16c) returned 1 [0095.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 1 [0095.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.322] lstrlenW (lpString=".doc") returned 4 [0095.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.322] lstrlenW (lpString=".docx") returned 5 [0095.322] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.322] lstrlenW (lpString=".pdf") returned 4 [0095.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.322] lstrlenW (lpString=".xls") returned 4 [0095.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.322] lstrlenW (lpString=".xlsx") returned 5 [0095.322] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.322] lstrlenW (lpString=".ppt") returned 4 [0095.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.322] lstrlenW (lpString=".zip") returned 4 [0095.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.322] lstrlenW (lpString=".rar") returned 4 [0095.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.323] lstrlenW (lpString=".bz2") returned 4 [0095.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.323] lstrlenW (lpString=".7z") returned 3 [0095.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.323] lstrlenW (lpString=".dbf") returned 4 [0095.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.323] lstrlenW (lpString=".1cd") returned 4 [0095.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 63 [0095.323] lstrlenW (lpString=".jpg") returned 4 [0095.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.323] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") [0095.323] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=46516) returned 1 [0095.323] CloseHandle (hObject=0x16c) returned 1 [0095.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 0x20 [0095.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.324] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.324] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.324] GetLastError () returned 0x0 [0095.324] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb5b4, lpOverlapped=0x0) returned 1 [0095.413] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb5c0, lpOverlapped=0x0) returned 1 [0095.415] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.415] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.415] SetEndOfFile (hFile=0x1c0) returned 1 [0095.415] CloseHandle (hObject=0x1c0) returned 1 [0095.415] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.415] SetEndOfFile (hFile=0x16c) returned 1 [0095.416] CloseHandle (hObject=0x16c) returned 1 [0095.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 1 [0095.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.451] lstrlenW (lpString=".doc") returned 4 [0095.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.451] lstrlenW (lpString=".docx") returned 5 [0095.452] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0095.452] lstrlenW (lpString=".pdf") returned 4 [0095.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString=".xls") returned 4 [0095.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.452] lstrlenW (lpString=".xlsx") returned 5 [0095.452] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0095.452] lstrlenW (lpString=".ppt") returned 4 [0095.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.452] lstrlenW (lpString=".zip") returned 4 [0095.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.452] lstrlenW (lpString=".rar") returned 4 [0095.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString=".bz2") returned 4 [0095.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString=".7z") returned 3 [0095.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.452] lstrlenW (lpString=".dbf") returned 4 [0095.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.452] lstrlenW (lpString=".1cd") returned 4 [0095.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 63 [0095.452] lstrlenW (lpString=".jpg") returned 4 [0095.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.452] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") [0095.748] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11956) returned 1 [0095.748] CloseHandle (hObject=0x1b4) returned 1 [0095.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 0x20 [0095.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0095.749] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.749] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0095.749] GetLastError () returned 0x0 [0095.749] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2eb4, lpOverlapped=0x0) returned 1 [0095.820] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2ec0, lpOverlapped=0x0) returned 1 [0095.820] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.821] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.821] SetEndOfFile (hFile=0x168) returned 1 [0095.821] CloseHandle (hObject=0x168) returned 1 [0095.821] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.821] SetEndOfFile (hFile=0x1b4) returned 1 [0095.822] CloseHandle (hObject=0x1b4) returned 1 [0095.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 1 [0095.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.822] lstrlenW (lpString=".doc") returned 4 [0095.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString=".docx") returned 5 [0095.823] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.823] lstrlenW (lpString=".pdf") returned 4 [0095.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString=".xls") returned 4 [0095.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.823] lstrlenW (lpString=".xlsx") returned 5 [0095.823] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.823] lstrlenW (lpString=".ppt") returned 4 [0095.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.823] lstrlenW (lpString=".zip") returned 4 [0095.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.823] lstrlenW (lpString=".rar") returned 4 [0095.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString=".bz2") returned 4 [0095.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString=".7z") returned 3 [0095.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.823] lstrlenW (lpString=".dbf") returned 4 [0095.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.823] lstrlenW (lpString=".1cd") returned 4 [0095.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 63 [0095.823] lstrlenW (lpString=".jpg") returned 4 [0095.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.823] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") [0095.858] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8608) returned 1 [0095.858] CloseHandle (hObject=0x158) returned 1 [0095.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 0x20 [0095.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.858] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.858] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.859] GetLastError () returned 0x0 [0095.859] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x21a0, lpOverlapped=0x0) returned 1 [0095.860] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x21b0, lpOverlapped=0x0) returned 1 [0095.861] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.862] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.862] SetEndOfFile (hFile=0x1ec) returned 1 [0095.862] CloseHandle (hObject=0x1ec) returned 1 [0095.862] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.862] SetEndOfFile (hFile=0x158) returned 1 [0095.863] CloseHandle (hObject=0x158) returned 1 [0095.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.863] lstrlenW (lpString=".doc") returned 4 [0095.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".docx") returned 5 [0095.863] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.863] lstrlenW (lpString=".pdf") returned 4 [0095.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".xls") returned 4 [0095.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.863] lstrlenW (lpString=".xlsx") returned 5 [0095.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.863] lstrlenW (lpString=".ppt") returned 4 [0095.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.863] lstrlenW (lpString=".zip") returned 4 [0095.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.864] lstrlenW (lpString=".rar") returned 4 [0095.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString=".bz2") returned 4 [0095.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString=".7z") returned 3 [0095.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.864] lstrlenW (lpString=".dbf") returned 4 [0095.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.864] lstrlenW (lpString=".1cd") returned 4 [0095.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 63 [0095.864] lstrlenW (lpString=".jpg") returned 4 [0095.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.864] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") [0095.865] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=37658) returned 1 [0095.865] CloseHandle (hObject=0x158) returned 1 [0095.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 0x20 [0095.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.865] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.865] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.866] GetLastError () returned 0x0 [0095.866] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x931a, lpOverlapped=0x0) returned 1 [0095.868] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9320, lpOverlapped=0x0) returned 1 [0095.870] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.870] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.870] SetEndOfFile (hFile=0x1ec) returned 1 [0095.870] CloseHandle (hObject=0x1ec) returned 1 [0095.870] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.870] SetEndOfFile (hFile=0x158) returned 1 [0095.871] CloseHandle (hObject=0x158) returned 1 [0095.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.872] lstrlenW (lpString=".doc") returned 4 [0095.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".docx") returned 5 [0095.872] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.872] lstrlenW (lpString=".pdf") returned 4 [0095.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".xls") returned 4 [0095.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.872] lstrlenW (lpString=".xlsx") returned 5 [0095.872] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.872] lstrlenW (lpString=".ppt") returned 4 [0095.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.872] lstrlenW (lpString=".zip") returned 4 [0095.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.872] lstrlenW (lpString=".rar") returned 4 [0095.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".bz2") returned 4 [0095.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".7z") returned 3 [0095.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.872] lstrlenW (lpString=".dbf") returned 4 [0095.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.872] lstrlenW (lpString=".1cd") returned 4 [0095.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 63 [0095.873] lstrlenW (lpString=".jpg") returned 4 [0095.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.873] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") [0095.873] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32984) returned 1 [0095.873] CloseHandle (hObject=0x158) returned 1 [0095.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 0x20 [0095.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.874] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.874] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.874] GetLastError () returned 0x0 [0095.874] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x80d8, lpOverlapped=0x0) returned 1 [0095.879] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x80e0, lpOverlapped=0x0) returned 1 [0095.880] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.880] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.880] SetEndOfFile (hFile=0x1ec) returned 1 [0095.880] CloseHandle (hObject=0x1ec) returned 1 [0095.880] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.880] SetEndOfFile (hFile=0x158) returned 1 [0095.881] CloseHandle (hObject=0x158) returned 1 [0095.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString=".doc") returned 4 [0095.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString=".docx") returned 5 [0095.882] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0095.882] lstrlenW (lpString=".pdf") returned 4 [0095.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString=".xls") returned 4 [0095.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.882] lstrlenW (lpString=".xlsx") returned 5 [0095.882] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0095.882] lstrlenW (lpString=".ppt") returned 4 [0095.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString=".zip") returned 4 [0095.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.882] lstrlenW (lpString=".rar") returned 4 [0095.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString=".bz2") returned 4 [0095.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString=".7z") returned 3 [0095.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString=".dbf") returned 4 [0095.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString=".1cd") returned 4 [0095.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 63 [0095.882] lstrlenW (lpString=".jpg") returned 4 [0095.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.883] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") [0095.883] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=50898) returned 1 [0095.883] CloseHandle (hObject=0x158) returned 1 [0095.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 0x20 [0095.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.883] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.883] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.884] GetLastError () returned 0x0 [0095.884] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc6d2, lpOverlapped=0x0) returned 1 [0096.003] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc6e0, lpOverlapped=0x0) returned 1 [0096.004] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.004] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.005] SetEndOfFile (hFile=0x1ec) returned 1 [0096.073] CloseHandle (hObject=0x1ec) returned 1 [0096.083] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.083] SetEndOfFile (hFile=0x158) returned 1 [0096.092] CloseHandle (hObject=0x158) returned 1 [0096.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.157] lstrlenW (lpString=".doc") returned 4 [0096.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString=".docx") returned 5 [0096.157] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0096.157] lstrlenW (lpString=".pdf") returned 4 [0096.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString=".xls") returned 4 [0096.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.157] lstrlenW (lpString=".xlsx") returned 5 [0096.157] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0096.157] lstrlenW (lpString=".ppt") returned 4 [0096.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.157] lstrlenW (lpString=".zip") returned 4 [0096.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.157] lstrlenW (lpString=".rar") returned 4 [0096.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString=".bz2") returned 4 [0096.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString=".7z") returned 3 [0096.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.157] lstrlenW (lpString=".dbf") returned 4 [0096.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.157] lstrlenW (lpString=".1cd") returned 4 [0096.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 63 [0096.158] lstrlenW (lpString=".jpg") returned 4 [0096.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.158] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") [0096.254] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=40586) returned 1 [0096.254] CloseHandle (hObject=0x180) returned 1 [0096.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 0x20 [0096.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.254] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.254] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.255] GetLastError () returned 0x0 [0096.255] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9e8a, lpOverlapped=0x0) returned 1 [0096.258] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9e90, lpOverlapped=0x0) returned 1 [0096.260] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.260] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.260] SetEndOfFile (hFile=0x15c) returned 1 [0096.260] CloseHandle (hObject=0x15c) returned 1 [0096.260] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.260] SetEndOfFile (hFile=0x180) returned 1 [0096.261] CloseHandle (hObject=0x180) returned 1 [0096.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 1 [0096.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.261] lstrlenW (lpString=".doc") returned 4 [0096.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.261] lstrlenW (lpString=".docx") returned 5 [0096.261] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0096.261] lstrlenW (lpString=".pdf") returned 4 [0096.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString=".xls") returned 4 [0096.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.262] lstrlenW (lpString=".xlsx") returned 5 [0096.262] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0096.262] lstrlenW (lpString=".ppt") returned 4 [0096.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.262] lstrlenW (lpString=".zip") returned 4 [0096.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.262] lstrlenW (lpString=".rar") returned 4 [0096.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString=".bz2") returned 4 [0096.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString=".7z") returned 3 [0096.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.262] lstrlenW (lpString=".dbf") returned 4 [0096.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.262] lstrlenW (lpString=".1cd") returned 4 [0096.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 63 [0096.262] lstrlenW (lpString=".jpg") returned 4 [0096.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.262] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") [0096.263] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9616) returned 1 [0096.263] CloseHandle (hObject=0x180) returned 1 [0096.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 0x20 [0096.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.263] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.263] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.264] GetLastError () returned 0x0 [0096.264] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2590, lpOverlapped=0x0) returned 1 [0096.268] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x25a0, lpOverlapped=0x0) returned 1 [0096.269] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.269] WriteFile (in: hFile=0x15c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.270] SetEndOfFile (hFile=0x15c) returned 1 [0096.270] CloseHandle (hObject=0x15c) returned 1 [0096.270] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.270] SetEndOfFile (hFile=0x180) returned 1 [0096.271] CloseHandle (hObject=0x180) returned 1 [0096.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 1 [0096.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.271] lstrlenW (lpString=".doc") returned 4 [0096.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.271] lstrlenW (lpString=".docx") returned 5 [0096.271] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0096.271] lstrlenW (lpString=".pdf") returned 4 [0096.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.271] lstrlenW (lpString=".xls") returned 4 [0096.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.271] lstrlenW (lpString=".xlsx") returned 5 [0096.271] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0096.271] lstrlenW (lpString=".ppt") returned 4 [0096.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.271] lstrlenW (lpString=".zip") returned 4 [0096.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.271] lstrlenW (lpString=".rar") returned 4 [0096.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.272] lstrlenW (lpString=".bz2") returned 4 [0096.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.272] lstrlenW (lpString=".7z") returned 3 [0096.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.272] lstrlenW (lpString=".dbf") returned 4 [0096.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.272] lstrlenW (lpString=".1cd") returned 4 [0096.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 63 [0096.272] lstrlenW (lpString=".jpg") returned 4 [0096.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.272] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") [0096.464] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8420) returned 1 [0096.464] CloseHandle (hObject=0x1b4) returned 1 [0096.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 0x20 [0096.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0096.464] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.464] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0096.465] GetLastError () returned 0x0 [0096.465] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x20e4, lpOverlapped=0x0) returned 1 [0096.564] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0096.565] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.565] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.565] SetEndOfFile (hFile=0x168) returned 1 [0096.595] CloseHandle (hObject=0x168) returned 1 [0096.595] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.595] SetEndOfFile (hFile=0x1b4) returned 1 [0096.605] CloseHandle (hObject=0x1b4) returned 1 [0096.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 1 [0096.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.620] lstrlenW (lpString=".doc") returned 4 [0096.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.620] lstrlenW (lpString=".docx") returned 5 [0096.620] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0096.620] lstrlenW (lpString=".pdf") returned 4 [0096.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.620] lstrlenW (lpString=".xls") returned 4 [0096.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.620] lstrlenW (lpString=".xlsx") returned 5 [0096.620] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0096.621] lstrlenW (lpString=".ppt") returned 4 [0096.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.621] lstrlenW (lpString=".zip") returned 4 [0096.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.621] lstrlenW (lpString=".rar") returned 4 [0096.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.621] lstrlenW (lpString=".bz2") returned 4 [0096.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.621] lstrlenW (lpString=".7z") returned 3 [0096.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.621] lstrlenW (lpString=".dbf") returned 4 [0096.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.621] lstrlenW (lpString=".1cd") returned 4 [0096.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 63 [0096.621] lstrlenW (lpString=".jpg") returned 4 [0096.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.621] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") [0096.622] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15516) returned 1 [0096.622] CloseHandle (hObject=0x1b4) returned 1 [0096.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 0x20 [0096.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0096.622] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.622] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0096.623] GetLastError () returned 0x0 [0096.623] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c9c, lpOverlapped=0x0) returned 1 [0096.631] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3ca0, lpOverlapped=0x0) returned 1 [0096.632] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.633] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.633] SetEndOfFile (hFile=0x168) returned 1 [0096.633] CloseHandle (hObject=0x168) returned 1 [0096.633] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.633] SetEndOfFile (hFile=0x1b4) returned 1 [0096.634] CloseHandle (hObject=0x1b4) returned 1 [0096.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 1 [0096.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.634] lstrlenW (lpString=".doc") returned 4 [0096.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.634] lstrlenW (lpString=".docx") returned 5 [0096.634] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0096.634] lstrlenW (lpString=".pdf") returned 4 [0096.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.634] lstrlenW (lpString=".xls") returned 4 [0096.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.635] lstrlenW (lpString=".xlsx") returned 5 [0096.635] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0096.635] lstrlenW (lpString=".ppt") returned 4 [0096.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.635] lstrlenW (lpString=".zip") returned 4 [0096.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.635] lstrlenW (lpString=".rar") returned 4 [0096.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.635] lstrlenW (lpString=".bz2") returned 4 [0096.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.635] lstrlenW (lpString=".7z") returned 3 [0096.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.635] lstrlenW (lpString=".dbf") returned 4 [0096.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.635] lstrlenW (lpString=".1cd") returned 4 [0096.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 63 [0096.635] lstrlenW (lpString=".jpg") returned 4 [0096.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.635] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") [0097.116] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18750) returned 1 [0097.116] CloseHandle (hObject=0x1b4) returned 1 [0097.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 0x20 [0097.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.116] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.116] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0097.117] GetLastError () returned 0x0 [0097.117] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x493e, lpOverlapped=0x0) returned 1 [0097.263] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0097.264] ReadFile (in: hFile=0x1b4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.264] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.265] SetEndOfFile (hFile=0x168) returned 1 [0097.285] CloseHandle (hObject=0x168) returned 1 [0097.285] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.285] SetEndOfFile (hFile=0x1b4) returned 1 [0097.286] CloseHandle (hObject=0x1b4) returned 1 [0097.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 1 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.421] lstrlenW (lpString=".doc") returned 4 [0097.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.421] lstrlenW (lpString=".docx") returned 5 [0097.421] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0097.421] lstrlenW (lpString=".pdf") returned 4 [0097.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.421] lstrlenW (lpString=".xls") returned 4 [0097.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.421] lstrlenW (lpString=".xlsx") returned 5 [0097.421] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0097.421] lstrlenW (lpString=".ppt") returned 4 [0097.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.422] lstrlenW (lpString=".zip") returned 4 [0097.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.422] lstrlenW (lpString=".rar") returned 4 [0097.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.422] lstrlenW (lpString=".bz2") returned 4 [0097.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.422] lstrlenW (lpString=".7z") returned 3 [0097.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.422] lstrlenW (lpString=".dbf") returned 4 [0097.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.422] lstrlenW (lpString=".1cd") returned 4 [0097.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 63 [0097.422] lstrlenW (lpString=".jpg") returned 4 [0097.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.422] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") [0097.423] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19962) returned 1 [0097.423] CloseHandle (hObject=0x19c) returned 1 [0097.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 0x20 [0097.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.423] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.423] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0097.424] GetLastError () returned 0x0 [0097.424] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4dfa, lpOverlapped=0x0) returned 1 [0097.455] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4e00, lpOverlapped=0x0) returned 1 [0097.789] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.790] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.793] SetEndOfFile (hFile=0x168) returned 1 [0098.214] CloseHandle (hObject=0x168) returned 1 [0098.214] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.214] SetEndOfFile (hFile=0x19c) returned 1 [0098.215] CloseHandle (hObject=0x19c) returned 1 [0098.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 1 [0098.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.246] lstrlenW (lpString=".doc") returned 4 [0098.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.248] lstrlenW (lpString=".docx") returned 5 [0098.260] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0098.260] lstrlenW (lpString=".pdf") returned 4 [0098.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.260] lstrlenW (lpString=".xls") returned 4 [0098.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.268] lstrlenW (lpString=".xlsx") returned 5 [0098.268] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0098.268] lstrlenW (lpString=".ppt") returned 4 [0098.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.268] lstrlenW (lpString=".zip") returned 4 [0098.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.268] lstrlenW (lpString=".rar") returned 4 [0098.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.268] lstrlenW (lpString=".bz2") returned 4 [0098.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.276] lstrlenW (lpString=".7z") returned 3 [0098.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.276] lstrlenW (lpString=".dbf") returned 4 [0098.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.276] lstrlenW (lpString=".1cd") returned 4 [0098.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 63 [0098.276] lstrlenW (lpString=".jpg") returned 4 [0098.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.283] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") [0098.284] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33264) returned 1 [0098.284] CloseHandle (hObject=0x1ec) returned 1 [0098.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 0x20 [0098.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.284] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.284] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.285] GetLastError () returned 0x0 [0098.285] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x81f0, lpOverlapped=0x0) returned 1 [0098.287] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0098.289] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.289] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.289] SetEndOfFile (hFile=0x1c0) returned 1 [0098.289] CloseHandle (hObject=0x1c0) returned 1 [0098.289] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.289] SetEndOfFile (hFile=0x1ec) returned 1 [0098.290] CloseHandle (hObject=0x1ec) returned 1 [0098.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 1 [0098.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.290] lstrlenW (lpString=".doc") returned 4 [0098.291] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.291] lstrlenW (lpString=".docx") returned 5 [0098.291] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.291] lstrlenW (lpString=".pdf") returned 4 [0098.291] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.291] lstrlenW (lpString=".xls") returned 4 [0098.291] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.291] lstrlenW (lpString=".xlsx") returned 5 [0098.291] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.291] lstrlenW (lpString=".ppt") returned 4 [0098.291] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.291] lstrlenW (lpString=".zip") returned 4 [0098.291] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.291] lstrlenW (lpString=".rar") returned 4 [0098.291] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.291] lstrlenW (lpString=".bz2") returned 4 [0098.291] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.291] lstrlenW (lpString=".7z") returned 3 [0098.291] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.291] lstrlenW (lpString=".dbf") returned 4 [0098.291] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.291] lstrlenW (lpString=".1cd") returned 4 [0098.291] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 63 [0098.291] lstrlenW (lpString=".jpg") returned 4 [0098.291] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.291] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") [0098.292] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=43707) returned 1 [0098.292] CloseHandle (hObject=0x1ec) returned 1 [0098.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 0x20 [0098.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.293] GetLastError () returned 0x0 [0098.293] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xaabb, lpOverlapped=0x0) returned 1 [0098.296] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xaac0, lpOverlapped=0x0) returned 1 [0098.298] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.298] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.298] SetEndOfFile (hFile=0x1c0) returned 1 [0098.298] CloseHandle (hObject=0x1c0) returned 1 [0098.298] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.298] SetEndOfFile (hFile=0x1ec) returned 1 [0098.299] CloseHandle (hObject=0x1ec) returned 1 [0098.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 1 [0098.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.299] lstrlenW (lpString=".doc") returned 4 [0098.299] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.299] lstrlenW (lpString=".docx") returned 5 [0098.299] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.299] lstrlenW (lpString=".pdf") returned 4 [0098.299] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.299] lstrlenW (lpString=".xls") returned 4 [0098.299] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.300] lstrlenW (lpString=".xlsx") returned 5 [0098.300] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.300] lstrlenW (lpString=".ppt") returned 4 [0098.300] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.300] lstrlenW (lpString=".zip") returned 4 [0098.300] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.300] lstrlenW (lpString=".rar") returned 4 [0098.300] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.300] lstrlenW (lpString=".bz2") returned 4 [0098.300] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.300] lstrlenW (lpString=".7z") returned 3 [0098.300] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.300] lstrlenW (lpString=".dbf") returned 4 [0098.300] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.300] lstrlenW (lpString=".1cd") returned 4 [0098.300] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 63 [0098.300] lstrlenW (lpString=".jpg") returned 4 [0098.300] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.300] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") [0098.301] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19162) returned 1 [0098.301] CloseHandle (hObject=0x1ec) returned 1 [0098.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 0x20 [0098.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.301] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.301] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.302] GetLastError () returned 0x0 [0098.302] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4ada, lpOverlapped=0x0) returned 1 [0098.304] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4ae0, lpOverlapped=0x0) returned 1 [0098.305] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.305] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.305] SetEndOfFile (hFile=0x1c0) returned 1 [0098.305] CloseHandle (hObject=0x1c0) returned 1 [0098.305] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.305] SetEndOfFile (hFile=0x1ec) returned 1 [0098.306] CloseHandle (hObject=0x1ec) returned 1 [0098.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 1 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.307] lstrlenW (lpString=".doc") returned 4 [0098.307] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.307] lstrlenW (lpString=".docx") returned 5 [0098.307] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.307] lstrlenW (lpString=".pdf") returned 4 [0098.307] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.307] lstrlenW (lpString=".xls") returned 4 [0098.307] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.307] lstrlenW (lpString=".xlsx") returned 5 [0098.307] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.307] lstrlenW (lpString=".ppt") returned 4 [0098.307] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.307] lstrlenW (lpString=".zip") returned 4 [0098.307] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.307] lstrlenW (lpString=".rar") returned 4 [0098.307] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.307] lstrlenW (lpString=".bz2") returned 4 [0098.307] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.307] lstrlenW (lpString=".7z") returned 3 [0098.307] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.307] lstrlenW (lpString=".dbf") returned 4 [0098.307] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.307] lstrlenW (lpString=".1cd") returned 4 [0098.307] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 63 [0098.308] lstrlenW (lpString=".jpg") returned 4 [0098.308] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.308] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") [0098.308] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6656) returned 1 [0098.308] CloseHandle (hObject=0x1ec) returned 1 [0098.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 0x20 [0098.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.308] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.308] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.309] GetLastError () returned 0x0 [0098.309] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1a00, lpOverlapped=0x0) returned 1 [0098.311] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1a10, lpOverlapped=0x0) returned 1 [0098.312] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.312] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.312] SetEndOfFile (hFile=0x1c0) returned 1 [0098.312] CloseHandle (hObject=0x1c0) returned 1 [0098.312] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.312] SetEndOfFile (hFile=0x1ec) returned 1 [0098.313] CloseHandle (hObject=0x1ec) returned 1 [0098.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 1 [0098.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.313] lstrlenW (lpString=".doc") returned 4 [0098.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.313] lstrlenW (lpString=".docx") returned 5 [0098.313] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0098.313] lstrlenW (lpString=".pdf") returned 4 [0098.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.313] lstrlenW (lpString=".xls") returned 4 [0098.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.313] lstrlenW (lpString=".xlsx") returned 5 [0098.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0098.313] lstrlenW (lpString=".ppt") returned 4 [0098.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.314] lstrlenW (lpString=".zip") returned 4 [0098.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.314] lstrlenW (lpString=".rar") returned 4 [0098.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.314] lstrlenW (lpString=".bz2") returned 4 [0098.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.314] lstrlenW (lpString=".7z") returned 3 [0098.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.314] lstrlenW (lpString=".dbf") returned 4 [0098.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.314] lstrlenW (lpString=".1cd") returned 4 [0098.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 63 [0098.314] lstrlenW (lpString=".jpg") returned 4 [0098.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.314] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") [0098.315] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8420) returned 1 [0098.315] CloseHandle (hObject=0x1ec) returned 1 [0098.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 0x20 [0098.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.315] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.315] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.315] GetLastError () returned 0x0 [0098.315] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x20e4, lpOverlapped=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0098.362] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.362] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.363] SetEndOfFile (hFile=0x1c0) returned 1 [0098.366] CloseHandle (hObject=0x1c0) returned 1 [0098.367] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.367] SetEndOfFile (hFile=0x1ec) returned 1 [0098.367] CloseHandle (hObject=0x1ec) returned 1 [0098.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 1 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString=".doc") returned 4 [0098.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString=".docx") returned 5 [0098.389] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0098.389] lstrlenW (lpString=".pdf") returned 4 [0098.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString=".xls") returned 4 [0098.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.389] lstrlenW (lpString=".xlsx") returned 5 [0098.389] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0098.389] lstrlenW (lpString=".ppt") returned 4 [0098.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString=".zip") returned 4 [0098.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.389] lstrlenW (lpString=".rar") returned 4 [0098.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString=".bz2") returned 4 [0098.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString=".7z") returned 3 [0098.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString=".dbf") returned 4 [0098.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString=".1cd") returned 4 [0098.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 63 [0098.389] lstrlenW (lpString=".jpg") returned 4 [0098.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.390] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") [0098.650] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16954) returned 1 [0098.655] CloseHandle (hObject=0x158) returned 1 [0098.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 0x20 [0098.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.665] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.666] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.674] GetLastError () returned 0x0 [0098.674] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x423a, lpOverlapped=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4240, lpOverlapped=0x0) returned 1 [0098.677] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.677] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.677] SetEndOfFile (hFile=0x1ec) returned 1 [0098.678] CloseHandle (hObject=0x1ec) returned 1 [0098.678] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.678] SetEndOfFile (hFile=0x158) returned 1 [0098.678] CloseHandle (hObject=0x158) returned 1 [0098.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 1 [0098.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.679] lstrlenW (lpString=".doc") returned 4 [0098.679] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.679] lstrlenW (lpString=".docx") returned 5 [0098.679] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0098.679] lstrlenW (lpString=".pdf") returned 4 [0098.679] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.679] lstrlenW (lpString=".xls") returned 4 [0098.679] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.679] lstrlenW (lpString=".xlsx") returned 5 [0098.679] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0098.679] lstrlenW (lpString=".ppt") returned 4 [0098.679] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.679] lstrlenW (lpString=".zip") returned 4 [0098.679] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.679] lstrlenW (lpString=".rar") returned 4 [0098.679] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.679] lstrlenW (lpString=".bz2") returned 4 [0098.679] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.680] lstrlenW (lpString=".7z") returned 3 [0098.680] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.680] lstrlenW (lpString=".dbf") returned 4 [0098.680] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.680] lstrlenW (lpString=".1cd") returned 4 [0098.680] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 63 [0098.680] lstrlenW (lpString=".jpg") returned 4 [0098.680] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.680] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") [0098.680] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8074) returned 1 [0098.680] CloseHandle (hObject=0x158) returned 1 [0098.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0098.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.681] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.681] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.682] GetLastError () returned 0x0 [0098.682] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1f8a, lpOverlapped=0x0) returned 1 [0098.683] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0098.684] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.684] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.684] SetEndOfFile (hFile=0x1ec) returned 1 [0098.685] CloseHandle (hObject=0x1ec) returned 1 [0098.685] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.685] SetEndOfFile (hFile=0x158) returned 1 [0098.685] CloseHandle (hObject=0x158) returned 1 [0098.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 1 [0098.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.686] lstrlenW (lpString=".doc") returned 4 [0098.686] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.686] lstrlenW (lpString=".docx") returned 5 [0098.686] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.686] lstrlenW (lpString=".pdf") returned 4 [0098.686] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.686] lstrlenW (lpString=".xls") returned 4 [0098.686] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.686] lstrlenW (lpString=".xlsx") returned 5 [0098.686] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.686] lstrlenW (lpString=".ppt") returned 4 [0098.686] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.686] lstrlenW (lpString=".zip") returned 4 [0098.686] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.686] lstrlenW (lpString=".rar") returned 4 [0098.686] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.686] lstrlenW (lpString=".bz2") returned 4 [0098.686] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.687] lstrlenW (lpString=".7z") returned 3 [0098.687] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.687] lstrlenW (lpString=".dbf") returned 4 [0098.687] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.687] lstrlenW (lpString=".1cd") returned 4 [0098.687] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 63 [0098.687] lstrlenW (lpString=".jpg") returned 4 [0098.687] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.687] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") [0098.687] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=23126) returned 1 [0098.687] CloseHandle (hObject=0x158) returned 1 [0098.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0098.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.688] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.688] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.688] GetLastError () returned 0x0 [0098.688] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5a56, lpOverlapped=0x0) returned 1 [0098.690] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5a60, lpOverlapped=0x0) returned 1 [0098.692] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.692] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.692] SetEndOfFile (hFile=0x1ec) returned 1 [0098.692] CloseHandle (hObject=0x1ec) returned 1 [0098.692] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.692] SetEndOfFile (hFile=0x158) returned 1 [0098.693] CloseHandle (hObject=0x158) returned 1 [0098.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 1 [0098.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.693] lstrlenW (lpString=".doc") returned 4 [0098.693] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.693] lstrlenW (lpString=".docx") returned 5 [0098.693] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0098.693] lstrlenW (lpString=".pdf") returned 4 [0098.693] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.693] lstrlenW (lpString=".xls") returned 4 [0098.694] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.694] lstrlenW (lpString=".xlsx") returned 5 [0098.694] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0098.694] lstrlenW (lpString=".ppt") returned 4 [0098.694] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.694] lstrlenW (lpString=".zip") returned 4 [0098.694] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.694] lstrlenW (lpString=".rar") returned 4 [0098.694] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.694] lstrlenW (lpString=".bz2") returned 4 [0098.694] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.694] lstrlenW (lpString=".7z") returned 3 [0098.694] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.694] lstrlenW (lpString=".dbf") returned 4 [0098.694] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.694] lstrlenW (lpString=".1cd") returned 4 [0098.694] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 63 [0098.694] lstrlenW (lpString=".jpg") returned 4 [0098.694] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.694] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") [0098.695] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=28483) returned 1 [0098.695] CloseHandle (hObject=0x158) returned 1 [0098.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0098.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.696] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.696] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.696] GetLastError () returned 0x0 [0098.696] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6f43, lpOverlapped=0x0) returned 1 [0098.698] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6f50, lpOverlapped=0x0) returned 1 [0098.699] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.700] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.700] SetEndOfFile (hFile=0x1ec) returned 1 [0098.700] CloseHandle (hObject=0x1ec) returned 1 [0098.700] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.700] SetEndOfFile (hFile=0x158) returned 1 [0098.701] CloseHandle (hObject=0x158) returned 1 [0098.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 1 [0098.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.701] lstrlenW (lpString=".doc") returned 4 [0098.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.701] lstrlenW (lpString=".docx") returned 5 [0098.701] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.701] lstrlenW (lpString=".pdf") returned 4 [0098.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.701] lstrlenW (lpString=".xls") returned 4 [0098.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.701] lstrlenW (lpString=".xlsx") returned 5 [0098.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.702] lstrlenW (lpString=".ppt") returned 4 [0098.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.702] lstrlenW (lpString=".zip") returned 4 [0098.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.702] lstrlenW (lpString=".rar") returned 4 [0098.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.702] lstrlenW (lpString=".bz2") returned 4 [0098.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.702] lstrlenW (lpString=".7z") returned 3 [0098.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.702] lstrlenW (lpString=".dbf") returned 4 [0098.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.702] lstrlenW (lpString=".1cd") returned 4 [0098.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 63 [0098.702] lstrlenW (lpString=".jpg") returned 4 [0098.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.702] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") [0098.703] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27304) returned 1 [0098.703] CloseHandle (hObject=0x158) returned 1 [0098.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0098.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.703] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.703] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.704] GetLastError () returned 0x0 [0098.704] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6aa8, lpOverlapped=0x0) returned 1 [0098.751] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6ab0, lpOverlapped=0x0) returned 1 [0098.752] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.752] WriteFile (in: hFile=0x1ec, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.752] SetEndOfFile (hFile=0x1ec) returned 1 [0098.779] CloseHandle (hObject=0x1ec) returned 1 [0098.779] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.779] SetEndOfFile (hFile=0x158) returned 1 [0098.780] CloseHandle (hObject=0x158) returned 1 [0098.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 1 [0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.786] lstrlenW (lpString=".doc") returned 4 [0098.786] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.786] lstrlenW (lpString=".docx") returned 5 [0098.786] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0098.786] lstrlenW (lpString=".pdf") returned 4 [0098.786] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.786] lstrlenW (lpString=".xls") returned 4 [0098.786] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.786] lstrlenW (lpString=".xlsx") returned 5 [0098.786] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0098.786] lstrlenW (lpString=".ppt") returned 4 [0098.786] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.786] lstrlenW (lpString=".zip") returned 4 [0098.786] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.786] lstrlenW (lpString=".rar") returned 4 [0098.786] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.786] lstrlenW (lpString=".bz2") returned 4 [0098.787] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.787] lstrlenW (lpString=".7z") returned 3 [0098.787] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.787] lstrlenW (lpString=".dbf") returned 4 [0098.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.787] lstrlenW (lpString=".1cd") returned 4 [0098.787] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 63 [0098.787] lstrlenW (lpString=".jpg") returned 4 [0098.787] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.787] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") [0098.845] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15743) returned 1 [0098.845] CloseHandle (hObject=0x1ec) returned 1 [0098.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 0x20 [0098.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.845] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.845] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.867] GetLastError () returned 0x0 [0098.867] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3d7f, lpOverlapped=0x0) returned 1 [0098.882] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0098.883] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.883] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.883] SetEndOfFile (hFile=0x19c) returned 1 [0098.883] CloseHandle (hObject=0x19c) returned 1 [0098.883] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.883] SetEndOfFile (hFile=0x1ec) returned 1 [0098.884] CloseHandle (hObject=0x1ec) returned 1 [0098.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 1 [0098.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.885] lstrlenW (lpString=".doc") returned 4 [0098.885] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.885] lstrlenW (lpString=".docx") returned 5 [0098.885] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.885] lstrlenW (lpString=".pdf") returned 4 [0098.885] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.885] lstrlenW (lpString=".xls") returned 4 [0098.885] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.885] lstrlenW (lpString=".xlsx") returned 5 [0098.885] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.885] lstrlenW (lpString=".ppt") returned 4 [0098.885] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.885] lstrlenW (lpString=".zip") returned 4 [0098.885] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.885] lstrlenW (lpString=".rar") returned 4 [0098.885] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.885] lstrlenW (lpString=".bz2") returned 4 [0098.885] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.885] lstrlenW (lpString=".7z") returned 3 [0098.885] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.885] lstrlenW (lpString=".dbf") returned 4 [0098.885] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.885] lstrlenW (lpString=".1cd") returned 4 [0098.885] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 63 [0098.885] lstrlenW (lpString=".jpg") returned 4 [0098.885] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.885] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") [0098.886] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=112698) returned 1 [0098.886] CloseHandle (hObject=0x1ec) returned 1 [0098.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 0x20 [0098.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.887] GetLastError () returned 0x0 [0098.887] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1b83a, lpOverlapped=0x0) returned 1 [0098.898] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1b840, lpOverlapped=0x0) returned 1 [0098.900] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.900] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.900] SetEndOfFile (hFile=0x19c) returned 1 [0098.900] CloseHandle (hObject=0x19c) returned 1 [0098.900] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.900] SetEndOfFile (hFile=0x1ec) returned 1 [0098.902] CloseHandle (hObject=0x1ec) returned 1 [0098.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 1 [0098.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.902] lstrlenW (lpString=".doc") returned 4 [0098.902] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.902] lstrlenW (lpString=".docx") returned 5 [0098.902] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0098.902] lstrlenW (lpString=".pdf") returned 4 [0098.902] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.902] lstrlenW (lpString=".xls") returned 4 [0098.902] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.902] lstrlenW (lpString=".xlsx") returned 5 [0098.902] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0098.902] lstrlenW (lpString=".ppt") returned 4 [0098.902] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.903] lstrlenW (lpString=".zip") returned 4 [0098.903] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.903] lstrlenW (lpString=".rar") returned 4 [0098.903] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.903] lstrlenW (lpString=".bz2") returned 4 [0098.903] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.903] lstrlenW (lpString=".7z") returned 3 [0098.903] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.903] lstrlenW (lpString=".dbf") returned 4 [0098.903] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.903] lstrlenW (lpString=".1cd") returned 4 [0098.903] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 63 [0098.903] lstrlenW (lpString=".jpg") returned 4 [0098.903] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.903] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") [0098.904] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=122691) returned 1 [0098.904] CloseHandle (hObject=0x1ec) returned 1 [0098.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 0x20 [0098.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.904] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.904] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.905] GetLastError () returned 0x0 [0098.905] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1df43, lpOverlapped=0x0) returned 1 [0098.915] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1df50, lpOverlapped=0x0) returned 1 [0098.917] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.918] SetEndOfFile (hFile=0x19c) returned 1 [0098.918] CloseHandle (hObject=0x19c) returned 1 [0098.918] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.918] SetEndOfFile (hFile=0x1ec) returned 1 [0098.919] CloseHandle (hObject=0x1ec) returned 1 [0098.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 1 [0098.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.920] lstrlenW (lpString=".doc") returned 4 [0098.920] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.920] lstrlenW (lpString=".docx") returned 5 [0098.920] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0098.920] lstrlenW (lpString=".pdf") returned 4 [0098.920] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.920] lstrlenW (lpString=".xls") returned 4 [0098.920] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.920] lstrlenW (lpString=".xlsx") returned 5 [0098.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0098.920] lstrlenW (lpString=".ppt") returned 4 [0098.920] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.920] lstrlenW (lpString=".zip") returned 4 [0098.920] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.920] lstrlenW (lpString=".rar") returned 4 [0098.920] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.920] lstrlenW (lpString=".bz2") returned 4 [0098.920] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.920] lstrlenW (lpString=".7z") returned 3 [0098.920] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.920] lstrlenW (lpString=".dbf") returned 4 [0098.921] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.921] lstrlenW (lpString=".1cd") returned 4 [0098.921] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 63 [0098.921] lstrlenW (lpString=".jpg") returned 4 [0098.921] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.921] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") [0098.929] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=99539) returned 1 [0098.929] CloseHandle (hObject=0x1ec) returned 1 [0098.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 0x20 [0098.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.929] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.929] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.930] GetLastError () returned 0x0 [0098.930] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x184d3, lpOverlapped=0x0) returned 1 [0098.937] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x184e0, lpOverlapped=0x0) returned 1 [0098.939] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.939] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.939] SetEndOfFile (hFile=0x19c) returned 1 [0098.939] CloseHandle (hObject=0x19c) returned 1 [0098.939] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.939] SetEndOfFile (hFile=0x1ec) returned 1 [0098.941] CloseHandle (hObject=0x1ec) returned 1 [0098.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.941] lstrlenW (lpString=".doc") returned 4 [0098.941] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.941] lstrlenW (lpString=".docx") returned 5 [0098.941] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.941] lstrlenW (lpString=".pdf") returned 4 [0098.941] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.941] lstrlenW (lpString=".xls") returned 4 [0098.941] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.941] lstrlenW (lpString=".xlsx") returned 5 [0098.941] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.941] lstrlenW (lpString=".ppt") returned 4 [0098.941] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.942] lstrlenW (lpString=".zip") returned 4 [0098.942] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.942] lstrlenW (lpString=".rar") returned 4 [0098.942] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.942] lstrlenW (lpString=".bz2") returned 4 [0098.942] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.942] lstrlenW (lpString=".7z") returned 3 [0098.942] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.942] lstrlenW (lpString=".dbf") returned 4 [0098.942] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.942] lstrlenW (lpString=".1cd") returned 4 [0098.942] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 63 [0098.942] lstrlenW (lpString=".jpg") returned 4 [0098.942] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.942] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") [0098.943] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=109477) returned 1 [0098.943] CloseHandle (hObject=0x1ec) returned 1 [0098.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 0x20 [0098.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.943] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.943] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.944] GetLastError () returned 0x0 [0098.944] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1aba5, lpOverlapped=0x0) returned 1 [0099.012] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1abb0, lpOverlapped=0x0) returned 1 [0099.015] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.015] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.015] SetEndOfFile (hFile=0x19c) returned 1 [0099.118] CloseHandle (hObject=0x19c) returned 1 [0099.118] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.118] SetEndOfFile (hFile=0x1ec) returned 1 [0099.278] CloseHandle (hObject=0x1ec) returned 1 [0099.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.399] lstrlenW (lpString=".doc") returned 4 [0099.399] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.399] lstrlenW (lpString=".docx") returned 5 [0099.399] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0099.399] lstrlenW (lpString=".pdf") returned 4 [0099.409] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.409] lstrlenW (lpString=".xls") returned 4 [0099.409] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.409] lstrlenW (lpString=".xlsx") returned 5 [0099.409] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0099.409] lstrlenW (lpString=".ppt") returned 4 [0099.409] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.409] lstrlenW (lpString=".zip") returned 4 [0099.409] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.409] lstrlenW (lpString=".rar") returned 4 [0099.409] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.409] lstrlenW (lpString=".bz2") returned 4 [0099.409] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.409] lstrlenW (lpString=".7z") returned 3 [0099.409] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.409] lstrlenW (lpString=".dbf") returned 4 [0099.410] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.410] lstrlenW (lpString=".1cd") returned 4 [0099.410] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 63 [0099.410] lstrlenW (lpString=".jpg") returned 4 [0099.410] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.410] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") [0099.777] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=96159) returned 1 [0099.777] CloseHandle (hObject=0x22c) returned 1 [0099.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 0x20 [0099.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.777] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.777] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.778] GetLastError () returned 0x0 [0099.779] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1779f, lpOverlapped=0x0) returned 1 [0099.782] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x177a0, lpOverlapped=0x0) returned 1 [0099.784] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.784] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.785] SetEndOfFile (hFile=0x168) returned 1 [0099.785] CloseHandle (hObject=0x168) returned 1 [0099.785] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.785] SetEndOfFile (hFile=0x22c) returned 1 [0099.786] CloseHandle (hObject=0x22c) returned 1 [0099.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 1 [0099.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.787] lstrlenW (lpString=".doc") returned 4 [0099.787] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.787] lstrlenW (lpString=".docx") returned 5 [0099.787] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0099.787] lstrlenW (lpString=".pdf") returned 4 [0099.787] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.787] lstrlenW (lpString=".xls") returned 4 [0099.787] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.787] lstrlenW (lpString=".xlsx") returned 5 [0099.787] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0099.787] lstrlenW (lpString=".ppt") returned 4 [0099.787] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.787] lstrlenW (lpString=".zip") returned 4 [0099.787] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.787] lstrlenW (lpString=".rar") returned 4 [0099.787] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.787] lstrlenW (lpString=".bz2") returned 4 [0099.787] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.787] lstrlenW (lpString=".7z") returned 3 [0099.787] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.787] lstrlenW (lpString=".dbf") returned 4 [0099.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.787] lstrlenW (lpString=".1cd") returned 4 [0099.788] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 63 [0099.788] lstrlenW (lpString=".jpg") returned 4 [0099.788] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.788] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") [0099.789] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=81971) returned 1 [0099.789] CloseHandle (hObject=0x22c) returned 1 [0099.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 0x20 [0099.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.789] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.789] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.790] GetLastError () returned 0x0 [0099.790] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x14033, lpOverlapped=0x0) returned 1 [0099.793] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x14040, lpOverlapped=0x0) returned 1 [0099.795] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.795] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.795] SetEndOfFile (hFile=0x168) returned 1 [0099.796] CloseHandle (hObject=0x168) returned 1 [0099.796] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.796] SetEndOfFile (hFile=0x22c) returned 1 [0099.797] CloseHandle (hObject=0x22c) returned 1 [0099.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 1 [0099.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.797] lstrlenW (lpString=".doc") returned 4 [0099.797] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.797] lstrlenW (lpString=".docx") returned 5 [0099.797] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0099.797] lstrlenW (lpString=".pdf") returned 4 [0099.797] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.798] lstrlenW (lpString=".xls") returned 4 [0099.798] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.798] lstrlenW (lpString=".xlsx") returned 5 [0099.798] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0099.798] lstrlenW (lpString=".ppt") returned 4 [0099.798] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.798] lstrlenW (lpString=".zip") returned 4 [0099.798] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.798] lstrlenW (lpString=".rar") returned 4 [0099.798] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.798] lstrlenW (lpString=".bz2") returned 4 [0099.798] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.798] lstrlenW (lpString=".7z") returned 3 [0099.798] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.798] lstrlenW (lpString=".dbf") returned 4 [0099.798] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.798] lstrlenW (lpString=".1cd") returned 4 [0099.798] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 63 [0099.798] lstrlenW (lpString=".jpg") returned 4 [0099.798] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.798] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") [0099.799] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=55542) returned 1 [0099.799] CloseHandle (hObject=0x22c) returned 1 [0099.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 0x20 [0099.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.800] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.800] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.801] GetLastError () returned 0x0 [0099.801] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd8f6, lpOverlapped=0x0) returned 1 [0099.803] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd900, lpOverlapped=0x0) returned 1 [0099.805] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.805] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.805] SetEndOfFile (hFile=0x168) returned 1 [0099.805] CloseHandle (hObject=0x168) returned 1 [0099.805] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.805] SetEndOfFile (hFile=0x22c) returned 1 [0099.806] CloseHandle (hObject=0x22c) returned 1 [0099.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 1 [0099.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.807] lstrlenW (lpString=".doc") returned 4 [0099.807] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.807] lstrlenW (lpString=".docx") returned 5 [0099.807] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0099.807] lstrlenW (lpString=".pdf") returned 4 [0099.807] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.807] lstrlenW (lpString=".xls") returned 4 [0099.807] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.807] lstrlenW (lpString=".xlsx") returned 5 [0099.807] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0099.807] lstrlenW (lpString=".ppt") returned 4 [0099.807] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.807] lstrlenW (lpString=".zip") returned 4 [0099.807] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.807] lstrlenW (lpString=".rar") returned 4 [0099.807] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.807] lstrlenW (lpString=".bz2") returned 4 [0099.808] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.808] lstrlenW (lpString=".7z") returned 3 [0099.808] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.808] lstrlenW (lpString=".dbf") returned 4 [0099.808] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.808] lstrlenW (lpString=".1cd") returned 4 [0099.808] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 63 [0099.808] lstrlenW (lpString=".jpg") returned 4 [0099.808] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.808] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") [0099.810] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=71552) returned 1 [0099.810] CloseHandle (hObject=0x22c) returned 1 [0099.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0099.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.810] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.810] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.811] GetLastError () returned 0x0 [0099.811] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x11780, lpOverlapped=0x0) returned 1 [0099.899] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x11790, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x11790, lpOverlapped=0x0) returned 1 [0099.901] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.901] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.901] SetEndOfFile (hFile=0x168) returned 1 [0099.901] CloseHandle (hObject=0x168) returned 1 [0099.901] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.901] SetEndOfFile (hFile=0x22c) returned 1 [0099.902] CloseHandle (hObject=0x22c) returned 1 [0099.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 1 [0099.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.933] lstrlenW (lpString=".doc") returned 4 [0099.933] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.933] lstrlenW (lpString=".docx") returned 5 [0099.933] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.933] lstrlenW (lpString=".pdf") returned 4 [0099.933] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.933] lstrlenW (lpString=".xls") returned 4 [0099.933] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.933] lstrlenW (lpString=".xlsx") returned 5 [0099.933] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.933] lstrlenW (lpString=".ppt") returned 4 [0099.933] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.933] lstrlenW (lpString=".zip") returned 4 [0099.933] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.934] lstrlenW (lpString=".rar") returned 4 [0099.934] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.934] lstrlenW (lpString=".bz2") returned 4 [0099.934] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.934] lstrlenW (lpString=".7z") returned 3 [0099.934] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.934] lstrlenW (lpString=".dbf") returned 4 [0099.934] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.934] lstrlenW (lpString=".1cd") returned 4 [0099.934] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 63 [0099.934] lstrlenW (lpString=".jpg") returned 4 [0099.934] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.934] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") [0099.935] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=27884) returned 1 [0099.935] CloseHandle (hObject=0x168) returned 1 [0099.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 0x20 [0099.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.935] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.935] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.935] GetLastError () returned 0x0 [0099.935] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6cec, lpOverlapped=0x0) returned 1 [0099.943] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6cf0, lpOverlapped=0x0) returned 1 [0099.944] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.945] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.945] SetEndOfFile (hFile=0x16c) returned 1 [0099.945] CloseHandle (hObject=0x16c) returned 1 [0099.945] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.945] SetEndOfFile (hFile=0x168) returned 1 [0099.946] CloseHandle (hObject=0x168) returned 1 [0099.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 1 [0100.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.222] lstrlenW (lpString=".doc") returned 4 [0100.222] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.222] lstrlenW (lpString=".docx") returned 5 [0100.222] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0100.222] lstrlenW (lpString=".pdf") returned 4 [0100.222] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.222] lstrlenW (lpString=".xls") returned 4 [0100.222] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.222] lstrlenW (lpString=".xlsx") returned 5 [0100.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0100.222] lstrlenW (lpString=".ppt") returned 4 [0100.222] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.222] lstrlenW (lpString=".zip") returned 4 [0100.222] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.233] lstrlenW (lpString=".rar") returned 4 [0100.256] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.256] lstrlenW (lpString=".bz2") returned 4 [0100.256] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.256] lstrlenW (lpString=".7z") returned 3 [0100.256] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.256] lstrlenW (lpString=".dbf") returned 4 [0100.257] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.257] lstrlenW (lpString=".1cd") returned 4 [0100.257] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 63 [0100.257] lstrlenW (lpString=".jpg") returned 4 [0100.257] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.257] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") [0100.258] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=96066) returned 1 [0100.258] CloseHandle (hObject=0x15c) returned 1 [0100.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 0x20 [0100.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.258] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.258] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.259] GetLastError () returned 0x0 [0100.259] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x17742, lpOverlapped=0x0) returned 1 [0100.271] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x17750, lpOverlapped=0x0) returned 1 [0100.273] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.273] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.274] SetEndOfFile (hFile=0x19c) returned 1 [0100.274] CloseHandle (hObject=0x19c) returned 1 [0100.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.274] SetEndOfFile (hFile=0x15c) returned 1 [0100.275] CloseHandle (hObject=0x15c) returned 1 [0100.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 1 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString=".doc") returned 4 [0100.276] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0100.276] lstrlenW (lpString=".docx") returned 5 [0100.276] lstrcmpiW (lpString1=".docx", lpString2="5.PNG") returned -1 [0100.276] lstrlenW (lpString=".pdf") returned 4 [0100.276] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0100.276] lstrlenW (lpString=".xls") returned 4 [0100.276] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0100.276] lstrlenW (lpString=".xlsx") returned 5 [0100.276] lstrcmpiW (lpString1=".xlsx", lpString2="5.PNG") returned -1 [0100.276] lstrlenW (lpString=".ppt") returned 4 [0100.276] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString=".zip") returned 4 [0100.276] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0100.276] lstrlenW (lpString=".rar") returned 4 [0100.276] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0100.276] lstrlenW (lpString=".bz2") returned 4 [0100.276] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0100.276] lstrlenW (lpString=".7z") returned 3 [0100.276] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString=".dbf") returned 4 [0100.276] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString=".1cd") returned 4 [0100.276] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0100.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 63 [0100.276] lstrlenW (lpString=".jpg") returned 4 [0100.276] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0100.277] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") [0100.278] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5622) returned 1 [0100.278] CloseHandle (hObject=0x15c) returned 1 [0100.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x20 [0100.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.279] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.279] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.280] GetLastError () returned 0x0 [0100.280] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x15f6, lpOverlapped=0x0) returned 1 [0100.282] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1600, lpOverlapped=0x0) returned 1 [0100.283] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.283] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.283] SetEndOfFile (hFile=0x19c) returned 1 [0100.283] CloseHandle (hObject=0x19c) returned 1 [0100.286] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.286] SetEndOfFile (hFile=0x15c) returned 1 [0100.286] CloseHandle (hObject=0x15c) returned 1 [0100.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 1 [0100.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.287] lstrlenW (lpString=".doc") returned 4 [0100.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.287] lstrlenW (lpString=".docx") returned 5 [0100.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.287] lstrlenW (lpString=".pdf") returned 4 [0100.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.287] lstrlenW (lpString=".xls") returned 4 [0100.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.287] lstrlenW (lpString=".xlsx") returned 5 [0100.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.287] lstrlenW (lpString=".ppt") returned 4 [0100.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.287] lstrlenW (lpString=".zip") returned 4 [0100.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.287] lstrlenW (lpString=".rar") returned 4 [0100.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".bz2") returned 4 [0100.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".7z") returned 3 [0100.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.288] lstrlenW (lpString=".dbf") returned 4 [0100.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.288] lstrlenW (lpString=".1cd") returned 4 [0100.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.288] lstrlenW (lpString=".jpg") returned 4 [0100.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".pdf") returned 4 [0100.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".xls") returned 4 [0100.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.288] lstrlenW (lpString=".xlsx") returned 5 [0100.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.288] lstrlenW (lpString=".ppt") returned 4 [0100.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.288] lstrlenW (lpString=".zip") returned 4 [0100.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.288] lstrlenW (lpString=".rar") returned 4 [0100.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".bz2") returned 4 [0100.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.288] lstrlenW (lpString=".7z") returned 3 [0100.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.289] lstrlenW (lpString=".dbf") returned 4 [0100.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.289] lstrlenW (lpString=".1cd") returned 4 [0100.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 63 [0100.289] lstrlenW (lpString=".jpg") returned 4 [0100.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.289] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") [0100.289] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4240) returned 1 [0100.290] CloseHandle (hObject=0x15c) returned 1 [0100.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 0x20 [0100.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.290] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.290] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.291] GetLastError () returned 0x0 [0100.291] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1090, lpOverlapped=0x0) returned 1 [0100.377] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0100.378] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.378] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.378] SetEndOfFile (hFile=0x19c) returned 1 [0100.378] CloseHandle (hObject=0x19c) returned 1 [0100.378] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.378] SetEndOfFile (hFile=0x15c) returned 1 [0100.379] CloseHandle (hObject=0x15c) returned 1 [0100.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 1 [0100.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.524] lstrlenW (lpString=".doc") returned 4 [0100.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.532] lstrlenW (lpString=".docx") returned 5 [0100.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.532] lstrlenW (lpString=".pdf") returned 4 [0100.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.533] lstrlenW (lpString=".xls") returned 4 [0100.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.533] lstrlenW (lpString=".xlsx") returned 5 [0100.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.540] lstrlenW (lpString=".ppt") returned 4 [0100.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.541] lstrlenW (lpString=".zip") returned 4 [0100.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.548] lstrlenW (lpString=".rar") returned 4 [0100.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.548] lstrlenW (lpString=".bz2") returned 4 [0100.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.548] lstrlenW (lpString=".7z") returned 3 [0100.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.548] lstrlenW (lpString=".dbf") returned 4 [0100.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.553] lstrlenW (lpString=".1cd") returned 4 [0100.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.553] lstrlenW (lpString=".jpg") returned 4 [0100.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString=".pdf") returned 4 [0100.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString=".xls") returned 4 [0100.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.553] lstrlenW (lpString=".xlsx") returned 5 [0100.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.553] lstrlenW (lpString=".ppt") returned 4 [0100.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.553] lstrlenW (lpString=".zip") returned 4 [0100.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.553] lstrlenW (lpString=".rar") returned 4 [0100.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString=".bz2") returned 4 [0100.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString=".7z") returned 3 [0100.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.554] lstrlenW (lpString=".dbf") returned 4 [0100.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.554] lstrlenW (lpString=".1cd") returned 4 [0100.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 63 [0100.554] lstrlenW (lpString=".jpg") returned 4 [0100.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.554] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") [0100.554] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5950) returned 1 [0100.554] CloseHandle (hObject=0x210) returned 1 [0100.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 0x20 [0100.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.555] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.555] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.555] GetLastError () returned 0x0 [0100.555] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x173e, lpOverlapped=0x0) returned 1 [0100.557] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1740, lpOverlapped=0x0) returned 1 [0100.558] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.558] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.558] SetEndOfFile (hFile=0x168) returned 1 [0100.558] CloseHandle (hObject=0x168) returned 1 [0100.558] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.558] SetEndOfFile (hFile=0x210) returned 1 [0100.559] CloseHandle (hObject=0x210) returned 1 [0100.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 1 [0100.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.559] lstrlenW (lpString=".doc") returned 4 [0100.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".docx") returned 5 [0100.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.560] lstrlenW (lpString=".pdf") returned 4 [0100.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".xls") returned 4 [0100.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.560] lstrlenW (lpString=".xlsx") returned 5 [0100.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.560] lstrlenW (lpString=".ppt") returned 4 [0100.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.560] lstrlenW (lpString=".zip") returned 4 [0100.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.560] lstrlenW (lpString=".rar") returned 4 [0100.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".bz2") returned 4 [0100.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".7z") returned 3 [0100.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.560] lstrlenW (lpString=".dbf") returned 4 [0100.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.560] lstrlenW (lpString=".1cd") returned 4 [0100.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.560] lstrlenW (lpString=".jpg") returned 4 [0100.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".pdf") returned 4 [0100.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.560] lstrlenW (lpString=".xls") returned 4 [0100.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.560] lstrlenW (lpString=".xlsx") returned 5 [0100.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.561] lstrlenW (lpString=".ppt") returned 4 [0100.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.561] lstrlenW (lpString=".zip") returned 4 [0100.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.561] lstrlenW (lpString=".rar") returned 4 [0100.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.561] lstrlenW (lpString=".bz2") returned 4 [0100.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.561] lstrlenW (lpString=".7z") returned 3 [0100.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.561] lstrlenW (lpString=".dbf") returned 4 [0100.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.561] lstrlenW (lpString=".1cd") returned 4 [0100.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 63 [0100.561] lstrlenW (lpString=".jpg") returned 4 [0100.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.561] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") [0100.562] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18070) returned 1 [0100.562] CloseHandle (hObject=0x210) returned 1 [0100.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 0x20 [0100.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.562] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.562] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.563] GetLastError () returned 0x0 [0100.563] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4696, lpOverlapped=0x0) returned 1 [0100.571] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x46a0, lpOverlapped=0x0) returned 1 [0100.572] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.572] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.573] SetEndOfFile (hFile=0x168) returned 1 [0100.573] CloseHandle (hObject=0x168) returned 1 [0100.573] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.573] SetEndOfFile (hFile=0x210) returned 1 [0100.574] CloseHandle (hObject=0x210) returned 1 [0100.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 1 [0100.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.574] lstrlenW (lpString=".doc") returned 4 [0100.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.574] lstrlenW (lpString=".docx") returned 5 [0100.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.574] lstrlenW (lpString=".pdf") returned 4 [0100.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.574] lstrlenW (lpString=".xls") returned 4 [0100.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.574] lstrlenW (lpString=".xlsx") returned 5 [0100.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.574] lstrlenW (lpString=".ppt") returned 4 [0100.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.574] lstrlenW (lpString=".zip") returned 4 [0100.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.574] lstrlenW (lpString=".rar") returned 4 [0100.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".bz2") returned 4 [0100.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".7z") returned 3 [0100.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.575] lstrlenW (lpString=".dbf") returned 4 [0100.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.575] lstrlenW (lpString=".1cd") returned 4 [0100.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.575] lstrlenW (lpString=".jpg") returned 4 [0100.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".pdf") returned 4 [0100.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".xls") returned 4 [0100.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.575] lstrlenW (lpString=".xlsx") returned 5 [0100.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.575] lstrlenW (lpString=".ppt") returned 4 [0100.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.575] lstrlenW (lpString=".zip") returned 4 [0100.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.575] lstrlenW (lpString=".rar") returned 4 [0100.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".bz2") returned 4 [0100.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.575] lstrlenW (lpString=".7z") returned 3 [0100.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.575] lstrlenW (lpString=".dbf") returned 4 [0100.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.576] lstrlenW (lpString=".1cd") returned 4 [0100.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 63 [0100.576] lstrlenW (lpString=".jpg") returned 4 [0100.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.576] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") [0100.577] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12088) returned 1 [0100.577] CloseHandle (hObject=0x210) returned 1 [0100.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 0x20 [0100.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.577] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.577] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.578] GetLastError () returned 0x0 [0100.578] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2f38, lpOverlapped=0x0) returned 1 [0100.581] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2f40, lpOverlapped=0x0) returned 1 [0100.582] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.582] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.583] SetEndOfFile (hFile=0x168) returned 1 [0100.583] CloseHandle (hObject=0x168) returned 1 [0100.583] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.583] SetEndOfFile (hFile=0x210) returned 1 [0100.584] CloseHandle (hObject=0x210) returned 1 [0100.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 1 [0100.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.584] lstrlenW (lpString=".doc") returned 4 [0100.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.584] lstrlenW (lpString=".docx") returned 5 [0100.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.584] lstrlenW (lpString=".pdf") returned 4 [0100.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.584] lstrlenW (lpString=".xls") returned 4 [0100.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.585] lstrlenW (lpString=".xlsx") returned 5 [0100.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.585] lstrlenW (lpString=".ppt") returned 4 [0100.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.585] lstrlenW (lpString=".zip") returned 4 [0100.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.585] lstrlenW (lpString=".rar") returned 4 [0100.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString=".bz2") returned 4 [0100.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString=".7z") returned 3 [0100.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.585] lstrlenW (lpString=".dbf") returned 4 [0100.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.585] lstrlenW (lpString=".1cd") returned 4 [0100.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.585] lstrlenW (lpString=".jpg") returned 4 [0100.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString=".pdf") returned 4 [0100.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.585] lstrlenW (lpString=".xls") returned 4 [0100.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.585] lstrlenW (lpString=".xlsx") returned 5 [0100.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.585] lstrlenW (lpString=".ppt") returned 4 [0100.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.586] lstrlenW (lpString=".zip") returned 4 [0100.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.586] lstrlenW (lpString=".rar") returned 4 [0100.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.586] lstrlenW (lpString=".bz2") returned 4 [0100.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.586] lstrlenW (lpString=".7z") returned 3 [0100.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.586] lstrlenW (lpString=".dbf") returned 4 [0100.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.586] lstrlenW (lpString=".1cd") returned 4 [0100.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 63 [0100.586] lstrlenW (lpString=".jpg") returned 4 [0100.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.586] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") [0100.587] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5308) returned 1 [0100.587] CloseHandle (hObject=0x210) returned 1 [0100.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 0x20 [0100.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.588] GetLastError () returned 0x0 [0100.588] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x14bc, lpOverlapped=0x0) returned 1 [0100.589] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x14c0, lpOverlapped=0x0) returned 1 [0100.590] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.590] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.590] SetEndOfFile (hFile=0x168) returned 1 [0100.591] CloseHandle (hObject=0x168) returned 1 [0100.591] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.591] SetEndOfFile (hFile=0x210) returned 1 [0100.591] CloseHandle (hObject=0x210) returned 1 [0100.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 1 [0100.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.592] lstrlenW (lpString=".doc") returned 4 [0100.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.592] lstrlenW (lpString=".docx") returned 5 [0100.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.592] lstrlenW (lpString=".pdf") returned 4 [0100.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.592] lstrlenW (lpString=".xls") returned 4 [0100.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.592] lstrlenW (lpString=".xlsx") returned 5 [0100.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.592] lstrlenW (lpString=".ppt") returned 4 [0100.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.592] lstrlenW (lpString=".zip") returned 4 [0100.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.592] lstrlenW (lpString=".rar") returned 4 [0100.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.592] lstrlenW (lpString=".bz2") returned 4 [0100.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.592] lstrlenW (lpString=".7z") returned 3 [0100.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".dbf") returned 4 [0100.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".1cd") returned 4 [0100.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".jpg") returned 4 [0100.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString=".pdf") returned 4 [0100.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString=".xls") returned 4 [0100.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.593] lstrlenW (lpString=".xlsx") returned 5 [0100.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.593] lstrlenW (lpString=".ppt") returned 4 [0100.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".zip") returned 4 [0100.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.593] lstrlenW (lpString=".rar") returned 4 [0100.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString=".bz2") returned 4 [0100.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString=".7z") returned 3 [0100.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".dbf") returned 4 [0100.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.593] lstrlenW (lpString=".1cd") returned 4 [0100.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 63 [0100.594] lstrlenW (lpString=".jpg") returned 4 [0100.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.594] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") [0100.594] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5504) returned 1 [0100.594] CloseHandle (hObject=0x210) returned 1 [0100.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 0x20 [0100.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.594] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.595] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.595] GetLastError () returned 0x0 [0100.595] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1580, lpOverlapped=0x0) returned 1 [0100.650] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0100.651] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.651] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.651] SetEndOfFile (hFile=0x168) returned 1 [0100.723] CloseHandle (hObject=0x168) returned 1 [0100.723] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.723] SetEndOfFile (hFile=0x210) returned 1 [0100.724] CloseHandle (hObject=0x210) returned 1 [0100.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 1 [0100.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.743] lstrlenW (lpString=".doc") returned 4 [0100.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.743] lstrlenW (lpString=".docx") returned 5 [0100.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.743] lstrlenW (lpString=".pdf") returned 4 [0100.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.743] lstrlenW (lpString=".xls") returned 4 [0100.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.743] lstrlenW (lpString=".xlsx") returned 5 [0100.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.743] lstrlenW (lpString=".ppt") returned 4 [0100.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.743] lstrlenW (lpString=".zip") returned 4 [0100.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.743] lstrlenW (lpString=".rar") returned 4 [0100.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.743] lstrlenW (lpString=".bz2") returned 4 [0100.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.743] lstrlenW (lpString=".7z") returned 3 [0100.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.743] lstrlenW (lpString=".dbf") returned 4 [0100.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".1cd") returned 4 [0100.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".jpg") returned 4 [0100.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString=".pdf") returned 4 [0100.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString=".xls") returned 4 [0100.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.744] lstrlenW (lpString=".xlsx") returned 5 [0100.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.744] lstrlenW (lpString=".ppt") returned 4 [0100.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".zip") returned 4 [0100.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.744] lstrlenW (lpString=".rar") returned 4 [0100.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString=".bz2") returned 4 [0100.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString=".7z") returned 3 [0100.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".dbf") returned 4 [0100.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".1cd") returned 4 [0100.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 63 [0100.744] lstrlenW (lpString=".jpg") returned 4 [0100.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.745] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") [0100.976] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=28410) returned 1 [0100.976] CloseHandle (hObject=0x1c0) returned 1 [0100.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 0x20 [0100.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.976] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.976] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.977] GetLastError () returned 0x0 [0100.977] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6efa, lpOverlapped=0x0) returned 1 [0100.979] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6f00, lpOverlapped=0x0) returned 1 [0100.980] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.980] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.980] SetEndOfFile (hFile=0x210) returned 1 [0100.981] CloseHandle (hObject=0x210) returned 1 [0100.983] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.983] SetEndOfFile (hFile=0x1c0) returned 1 [0100.984] CloseHandle (hObject=0x1c0) returned 1 [0100.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 1 [0100.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString=".doc") returned 4 [0100.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString=".docx") returned 5 [0100.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.985] lstrlenW (lpString=".pdf") returned 4 [0100.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString=".xls") returned 4 [0100.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.985] lstrlenW (lpString=".xlsx") returned 5 [0100.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.985] lstrlenW (lpString=".ppt") returned 4 [0100.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString=".zip") returned 4 [0100.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.985] lstrlenW (lpString=".rar") returned 4 [0100.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString=".bz2") returned 4 [0100.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString=".7z") returned 3 [0100.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString=".dbf") returned 4 [0100.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString=".1cd") returned 4 [0100.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.985] lstrlenW (lpString=".jpg") returned 4 [0100.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.985] lstrlenW (lpString=".pdf") returned 4 [0100.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString=".xls") returned 4 [0100.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.986] lstrlenW (lpString=".xlsx") returned 5 [0100.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.986] lstrlenW (lpString=".ppt") returned 4 [0100.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.986] lstrlenW (lpString=".zip") returned 4 [0100.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.986] lstrlenW (lpString=".rar") returned 4 [0100.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString=".bz2") returned 4 [0100.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString=".7z") returned 3 [0100.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.986] lstrlenW (lpString=".dbf") returned 4 [0100.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.986] lstrlenW (lpString=".1cd") returned 4 [0100.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 63 [0100.986] lstrlenW (lpString=".jpg") returned 4 [0100.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.986] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") [0100.987] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2928) returned 1 [0100.987] CloseHandle (hObject=0x1c0) returned 1 [0100.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 0x20 [0100.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.987] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.987] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.988] GetLastError () returned 0x0 [0100.988] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb70, lpOverlapped=0x0) returned 1 [0100.990] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb80, lpOverlapped=0x0) returned 1 [0100.991] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.991] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.991] SetEndOfFile (hFile=0x210) returned 1 [0100.991] CloseHandle (hObject=0x210) returned 1 [0100.991] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.991] SetEndOfFile (hFile=0x1c0) returned 1 [0100.992] CloseHandle (hObject=0x1c0) returned 1 [0100.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 1 [0100.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.992] lstrlenW (lpString=".doc") returned 4 [0100.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.992] lstrlenW (lpString=".docx") returned 5 [0100.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.993] lstrlenW (lpString=".pdf") returned 4 [0100.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString=".xls") returned 4 [0100.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.993] lstrlenW (lpString=".xlsx") returned 5 [0100.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.993] lstrlenW (lpString=".ppt") returned 4 [0100.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.993] lstrlenW (lpString=".zip") returned 4 [0100.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.993] lstrlenW (lpString=".rar") returned 4 [0100.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString=".bz2") returned 4 [0100.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString=".7z") returned 3 [0100.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.993] lstrlenW (lpString=".dbf") returned 4 [0100.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.993] lstrlenW (lpString=".1cd") returned 4 [0100.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.993] lstrlenW (lpString=".jpg") returned 4 [0100.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString=".pdf") returned 4 [0100.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.993] lstrlenW (lpString=".xls") returned 4 [0100.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.993] lstrlenW (lpString=".xlsx") returned 5 [0100.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.994] lstrlenW (lpString=".ppt") returned 4 [0100.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.994] lstrlenW (lpString=".zip") returned 4 [0100.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.994] lstrlenW (lpString=".rar") returned 4 [0100.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.994] lstrlenW (lpString=".bz2") returned 4 [0100.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.994] lstrlenW (lpString=".7z") returned 3 [0100.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.994] lstrlenW (lpString=".dbf") returned 4 [0100.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.994] lstrlenW (lpString=".1cd") returned 4 [0100.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 63 [0100.994] lstrlenW (lpString=".jpg") returned 4 [0100.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.994] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") [0100.995] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5792) returned 1 [0100.995] CloseHandle (hObject=0x1c0) returned 1 [0100.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 0x20 [0100.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.995] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.995] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.996] GetLastError () returned 0x0 [0100.996] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x16a0, lpOverlapped=0x0) returned 1 [0100.997] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0100.998] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.998] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.998] SetEndOfFile (hFile=0x210) returned 1 [0100.998] CloseHandle (hObject=0x210) returned 1 [0100.998] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.999] SetEndOfFile (hFile=0x1c0) returned 1 [0100.999] CloseHandle (hObject=0x1c0) returned 1 [0100.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 1 [0101.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.000] lstrlenW (lpString=".doc") returned 4 [0101.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString=".docx") returned 5 [0101.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.000] lstrlenW (lpString=".pdf") returned 4 [0101.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString=".xls") returned 4 [0101.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.000] lstrlenW (lpString=".xlsx") returned 5 [0101.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.000] lstrlenW (lpString=".ppt") returned 4 [0101.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.000] lstrlenW (lpString=".zip") returned 4 [0101.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.000] lstrlenW (lpString=".rar") returned 4 [0101.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString=".bz2") returned 4 [0101.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString=".7z") returned 3 [0101.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.000] lstrlenW (lpString=".dbf") returned 4 [0101.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.000] lstrlenW (lpString=".1cd") returned 4 [0101.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.001] lstrlenW (lpString=".jpg") returned 4 [0101.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString=".pdf") returned 4 [0101.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString=".xls") returned 4 [0101.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.001] lstrlenW (lpString=".xlsx") returned 5 [0101.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.001] lstrlenW (lpString=".ppt") returned 4 [0101.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.001] lstrlenW (lpString=".zip") returned 4 [0101.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.001] lstrlenW (lpString=".rar") returned 4 [0101.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString=".bz2") returned 4 [0101.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString=".7z") returned 3 [0101.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.001] lstrlenW (lpString=".dbf") returned 4 [0101.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.001] lstrlenW (lpString=".1cd") returned 4 [0101.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 63 [0101.001] lstrlenW (lpString=".jpg") returned 4 [0101.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.001] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") [0101.002] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5848) returned 1 [0101.002] CloseHandle (hObject=0x1c0) returned 1 [0101.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 0x20 [0101.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.002] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.002] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.003] GetLastError () returned 0x0 [0101.003] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x16d8, lpOverlapped=0x0) returned 1 [0101.055] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0101.056] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.056] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.056] SetEndOfFile (hFile=0x210) returned 1 [0101.128] CloseHandle (hObject=0x210) returned 1 [0101.128] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.128] SetEndOfFile (hFile=0x1c0) returned 1 [0101.129] CloseHandle (hObject=0x1c0) returned 1 [0101.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 1 [0101.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.166] lstrlenW (lpString=".doc") returned 4 [0101.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.166] lstrlenW (lpString=".docx") returned 5 [0101.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.166] lstrlenW (lpString=".pdf") returned 4 [0101.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.166] lstrlenW (lpString=".xls") returned 4 [0101.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.166] lstrlenW (lpString=".xlsx") returned 5 [0101.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.166] lstrlenW (lpString=".ppt") returned 4 [0101.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.166] lstrlenW (lpString=".zip") returned 4 [0101.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.166] lstrlenW (lpString=".rar") returned 4 [0101.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.166] lstrlenW (lpString=".bz2") returned 4 [0101.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.166] lstrlenW (lpString=".7z") returned 3 [0101.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".dbf") returned 4 [0101.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".1cd") returned 4 [0101.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".jpg") returned 4 [0101.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString=".pdf") returned 4 [0101.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString=".xls") returned 4 [0101.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.167] lstrlenW (lpString=".xlsx") returned 5 [0101.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.167] lstrlenW (lpString=".ppt") returned 4 [0101.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".zip") returned 4 [0101.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.167] lstrlenW (lpString=".rar") returned 4 [0101.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString=".bz2") returned 4 [0101.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString=".7z") returned 3 [0101.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".dbf") returned 4 [0101.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".1cd") returned 4 [0101.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 63 [0101.167] lstrlenW (lpString=".jpg") returned 4 [0101.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.168] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") [0101.195] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2564) returned 1 [0101.195] CloseHandle (hObject=0x168) returned 1 [0101.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 0x20 [0101.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0101.196] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.196] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.196] GetLastError () returned 0x0 [0101.196] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa04, lpOverlapped=0x0) returned 1 [0101.279] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0101.280] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.281] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.281] SetEndOfFile (hFile=0x22c) returned 1 [0101.281] CloseHandle (hObject=0x22c) returned 1 [0101.281] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.281] SetEndOfFile (hFile=0x168) returned 1 [0101.282] CloseHandle (hObject=0x168) returned 1 [0101.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.282] lstrlenW (lpString=".doc") returned 4 [0101.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.282] lstrlenW (lpString=".docx") returned 5 [0101.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.283] lstrlenW (lpString=".pdf") returned 4 [0101.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString=".xls") returned 4 [0101.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.283] lstrlenW (lpString=".xlsx") returned 5 [0101.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.283] lstrlenW (lpString=".ppt") returned 4 [0101.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.283] lstrlenW (lpString=".zip") returned 4 [0101.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.283] lstrlenW (lpString=".rar") returned 4 [0101.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString=".bz2") returned 4 [0101.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString=".7z") returned 3 [0101.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.283] lstrlenW (lpString=".dbf") returned 4 [0101.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.283] lstrlenW (lpString=".1cd") returned 4 [0101.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.283] lstrlenW (lpString=".jpg") returned 4 [0101.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString=".pdf") returned 4 [0101.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.283] lstrlenW (lpString=".xls") returned 4 [0101.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.283] lstrlenW (lpString=".xlsx") returned 5 [0101.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.284] lstrlenW (lpString=".ppt") returned 4 [0101.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.284] lstrlenW (lpString=".zip") returned 4 [0101.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.284] lstrlenW (lpString=".rar") returned 4 [0101.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.284] lstrlenW (lpString=".bz2") returned 4 [0101.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.284] lstrlenW (lpString=".7z") returned 3 [0101.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.284] lstrlenW (lpString=".dbf") returned 4 [0101.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.284] lstrlenW (lpString=".1cd") returned 4 [0101.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 63 [0101.284] lstrlenW (lpString=".jpg") returned 4 [0101.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.284] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") [0101.285] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18226) returned 1 [0101.285] CloseHandle (hObject=0x168) returned 1 [0101.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 0x20 [0101.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0101.286] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.286] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.287] GetLastError () returned 0x0 [0101.287] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4732, lpOverlapped=0x0) returned 1 [0101.354] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0101.356] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.356] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.356] SetEndOfFile (hFile=0x22c) returned 1 [0101.543] CloseHandle (hObject=0x22c) returned 1 [0101.770] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.770] SetEndOfFile (hFile=0x168) returned 1 [0102.065] CloseHandle (hObject=0x168) returned 1 [0102.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 1 [0102.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.163] lstrlenW (lpString=".doc") returned 4 [0102.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.163] lstrlenW (lpString=".docx") returned 5 [0102.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.163] lstrlenW (lpString=".pdf") returned 4 [0102.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.163] lstrlenW (lpString=".xls") returned 4 [0102.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.163] lstrlenW (lpString=".xlsx") returned 5 [0102.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.163] lstrlenW (lpString=".ppt") returned 4 [0102.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.163] lstrlenW (lpString=".zip") returned 4 [0102.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.163] lstrlenW (lpString=".rar") returned 4 [0102.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.163] lstrlenW (lpString=".bz2") returned 4 [0102.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.163] lstrlenW (lpString=".7z") returned 3 [0102.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".dbf") returned 4 [0102.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".1cd") returned 4 [0102.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".jpg") returned 4 [0102.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString=".pdf") returned 4 [0102.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString=".xls") returned 4 [0102.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.164] lstrlenW (lpString=".xlsx") returned 5 [0102.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.164] lstrlenW (lpString=".ppt") returned 4 [0102.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".zip") returned 4 [0102.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.164] lstrlenW (lpString=".rar") returned 4 [0102.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString=".bz2") returned 4 [0102.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString=".7z") returned 3 [0102.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".dbf") returned 4 [0102.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.164] lstrlenW (lpString=".1cd") returned 4 [0102.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 63 [0102.165] lstrlenW (lpString=".jpg") returned 4 [0102.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.165] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") [0102.230] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19162) returned 1 [0102.240] CloseHandle (hObject=0x158) returned 1 [0102.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 0x20 [0102.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.247] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.247] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.254] GetLastError () returned 0x0 [0102.254] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4ada, lpOverlapped=0x0) returned 1 [0102.256] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4ae0, lpOverlapped=0x0) returned 1 [0102.257] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.257] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.257] SetEndOfFile (hFile=0x16c) returned 1 [0102.257] CloseHandle (hObject=0x16c) returned 1 [0102.257] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.257] SetEndOfFile (hFile=0x158) returned 1 [0102.258] CloseHandle (hObject=0x158) returned 1 [0102.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 1 [0102.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString=".doc") returned 4 [0102.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".docx") returned 5 [0102.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.259] lstrlenW (lpString=".pdf") returned 4 [0102.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".xls") returned 4 [0102.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.259] lstrlenW (lpString=".xlsx") returned 5 [0102.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.259] lstrlenW (lpString=".ppt") returned 4 [0102.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString=".zip") returned 4 [0102.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.259] lstrlenW (lpString=".rar") returned 4 [0102.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".bz2") returned 4 [0102.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".7z") returned 3 [0102.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString=".dbf") returned 4 [0102.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString=".1cd") returned 4 [0102.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.259] lstrlenW (lpString=".jpg") returned 4 [0102.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".pdf") returned 4 [0102.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.259] lstrlenW (lpString=".xls") returned 4 [0102.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.260] lstrlenW (lpString=".xlsx") returned 5 [0102.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.260] lstrlenW (lpString=".ppt") returned 4 [0102.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.260] lstrlenW (lpString=".zip") returned 4 [0102.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.260] lstrlenW (lpString=".rar") returned 4 [0102.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.260] lstrlenW (lpString=".bz2") returned 4 [0102.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.260] lstrlenW (lpString=".7z") returned 3 [0102.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.260] lstrlenW (lpString=".dbf") returned 4 [0102.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.260] lstrlenW (lpString=".1cd") returned 4 [0102.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 63 [0102.260] lstrlenW (lpString=".jpg") returned 4 [0102.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.260] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") [0102.261] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2974) returned 1 [0102.261] CloseHandle (hObject=0x158) returned 1 [0102.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 0x20 [0102.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.261] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.261] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.262] GetLastError () returned 0x0 [0102.262] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb9e, lpOverlapped=0x0) returned 1 [0102.272] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0102.273] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.273] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.273] SetEndOfFile (hFile=0x16c) returned 1 [0102.273] CloseHandle (hObject=0x16c) returned 1 [0102.273] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.273] SetEndOfFile (hFile=0x158) returned 1 [0102.274] CloseHandle (hObject=0x158) returned 1 [0102.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 1 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString=".doc") returned 4 [0102.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString=".docx") returned 5 [0102.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.275] lstrlenW (lpString=".pdf") returned 4 [0102.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString=".xls") returned 4 [0102.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.275] lstrlenW (lpString=".xlsx") returned 5 [0102.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.275] lstrlenW (lpString=".ppt") returned 4 [0102.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString=".zip") returned 4 [0102.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.275] lstrlenW (lpString=".rar") returned 4 [0102.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString=".bz2") returned 4 [0102.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString=".7z") returned 3 [0102.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString=".dbf") returned 4 [0102.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString=".1cd") returned 4 [0102.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.275] lstrlenW (lpString=".jpg") returned 4 [0102.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString=".pdf") returned 4 [0102.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString=".xls") returned 4 [0102.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.276] lstrlenW (lpString=".xlsx") returned 5 [0102.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.276] lstrlenW (lpString=".ppt") returned 4 [0102.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.276] lstrlenW (lpString=".zip") returned 4 [0102.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.276] lstrlenW (lpString=".rar") returned 4 [0102.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString=".bz2") returned 4 [0102.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString=".7z") returned 3 [0102.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.276] lstrlenW (lpString=".dbf") returned 4 [0102.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.276] lstrlenW (lpString=".1cd") returned 4 [0102.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 63 [0102.276] lstrlenW (lpString=".jpg") returned 4 [0102.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.276] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") [0102.277] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3208) returned 1 [0102.277] CloseHandle (hObject=0x158) returned 1 [0102.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 0x20 [0102.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.279] GetLastError () returned 0x0 [0102.279] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc88, lpOverlapped=0x0) returned 1 [0102.280] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc90, lpOverlapped=0x0) returned 1 [0102.281] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.281] WriteFile (in: hFile=0x16c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.282] SetEndOfFile (hFile=0x16c) returned 1 [0102.282] CloseHandle (hObject=0x16c) returned 1 [0102.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.282] SetEndOfFile (hFile=0x158) returned 1 [0102.283] CloseHandle (hObject=0x158) returned 1 [0102.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 1 [0102.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.283] lstrlenW (lpString=".doc") returned 4 [0102.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.283] lstrlenW (lpString=".docx") returned 5 [0102.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.283] lstrlenW (lpString=".pdf") returned 4 [0102.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.283] lstrlenW (lpString=".xls") returned 4 [0102.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.283] lstrlenW (lpString=".xlsx") returned 5 [0102.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.283] lstrlenW (lpString=".ppt") returned 4 [0102.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.283] lstrlenW (lpString=".zip") returned 4 [0102.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.283] lstrlenW (lpString=".rar") returned 4 [0102.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString=".bz2") returned 4 [0102.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString=".7z") returned 3 [0102.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.284] lstrlenW (lpString=".dbf") returned 4 [0102.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.284] lstrlenW (lpString=".1cd") returned 4 [0102.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.284] lstrlenW (lpString=".jpg") returned 4 [0102.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString=".pdf") returned 4 [0102.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString=".xls") returned 4 [0102.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.284] lstrlenW (lpString=".xlsx") returned 5 [0102.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.284] lstrlenW (lpString=".ppt") returned 4 [0102.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.284] lstrlenW (lpString=".zip") returned 4 [0102.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.315] lstrlenW (lpString=".rar") returned 4 [0102.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.315] lstrlenW (lpString=".bz2") returned 4 [0102.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.316] lstrlenW (lpString=".7z") returned 3 [0102.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.316] lstrlenW (lpString=".dbf") returned 4 [0102.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.316] lstrlenW (lpString=".1cd") returned 4 [0102.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 63 [0102.316] lstrlenW (lpString=".jpg") returned 4 [0102.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.316] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") [0102.374] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1120) returned 1 [0102.374] CloseHandle (hObject=0x15c) returned 1 [0102.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 0x20 [0102.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.374] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.375] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.375] GetLastError () returned 0x0 [0102.375] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x460, lpOverlapped=0x0) returned 1 [0102.394] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x470, lpOverlapped=0x0) returned 1 [0102.395] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.395] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.395] SetEndOfFile (hFile=0x180) returned 1 [0102.395] CloseHandle (hObject=0x180) returned 1 [0102.395] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.395] SetEndOfFile (hFile=0x15c) returned 1 [0102.396] CloseHandle (hObject=0x15c) returned 1 [0102.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 1 [0102.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.396] lstrlenW (lpString=".doc") returned 4 [0102.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.396] lstrlenW (lpString=".docx") returned 5 [0102.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.396] lstrlenW (lpString=".pdf") returned 4 [0102.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.396] lstrlenW (lpString=".xls") returned 4 [0102.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.397] lstrlenW (lpString=".xlsx") returned 5 [0102.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.397] lstrlenW (lpString=".ppt") returned 4 [0102.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.397] lstrlenW (lpString=".zip") returned 4 [0102.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.397] lstrlenW (lpString=".rar") returned 4 [0102.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString=".bz2") returned 4 [0102.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString=".7z") returned 3 [0102.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.397] lstrlenW (lpString=".dbf") returned 4 [0102.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.397] lstrlenW (lpString=".1cd") returned 4 [0102.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.397] lstrlenW (lpString=".jpg") returned 4 [0102.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString=".pdf") returned 4 [0102.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.397] lstrlenW (lpString=".xls") returned 4 [0102.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.397] lstrlenW (lpString=".xlsx") returned 5 [0102.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.397] lstrlenW (lpString=".ppt") returned 4 [0102.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.398] lstrlenW (lpString=".zip") returned 4 [0102.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.398] lstrlenW (lpString=".rar") returned 4 [0102.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.398] lstrlenW (lpString=".bz2") returned 4 [0102.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.398] lstrlenW (lpString=".7z") returned 3 [0102.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.398] lstrlenW (lpString=".dbf") returned 4 [0102.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.398] lstrlenW (lpString=".1cd") returned 4 [0102.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 63 [0102.398] lstrlenW (lpString=".jpg") returned 4 [0102.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.398] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") [0102.400] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=624) returned 1 [0102.400] CloseHandle (hObject=0x15c) returned 1 [0102.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 0x20 [0102.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.400] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.400] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.402] GetLastError () returned 0x0 [0102.402] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x270, lpOverlapped=0x0) returned 1 [0102.403] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x280, lpOverlapped=0x0) returned 1 [0102.403] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.403] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.404] SetEndOfFile (hFile=0x180) returned 1 [0102.404] CloseHandle (hObject=0x180) returned 1 [0102.404] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.404] SetEndOfFile (hFile=0x15c) returned 1 [0102.405] CloseHandle (hObject=0x15c) returned 1 [0102.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 1 [0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.405] lstrlenW (lpString=".doc") returned 4 [0102.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.405] lstrlenW (lpString=".docx") returned 5 [0102.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.405] lstrlenW (lpString=".pdf") returned 4 [0102.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.405] lstrlenW (lpString=".xls") returned 4 [0102.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.405] lstrlenW (lpString=".xlsx") returned 5 [0102.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.405] lstrlenW (lpString=".ppt") returned 4 [0102.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.405] lstrlenW (lpString=".zip") returned 4 [0102.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.405] lstrlenW (lpString=".rar") returned 4 [0102.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".bz2") returned 4 [0102.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".7z") returned 3 [0102.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.406] lstrlenW (lpString=".dbf") returned 4 [0102.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.406] lstrlenW (lpString=".1cd") returned 4 [0102.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.406] lstrlenW (lpString=".jpg") returned 4 [0102.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".pdf") returned 4 [0102.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".xls") returned 4 [0102.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.406] lstrlenW (lpString=".xlsx") returned 5 [0102.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.406] lstrlenW (lpString=".ppt") returned 4 [0102.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.406] lstrlenW (lpString=".zip") returned 4 [0102.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.406] lstrlenW (lpString=".rar") returned 4 [0102.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".bz2") returned 4 [0102.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.406] lstrlenW (lpString=".7z") returned 3 [0102.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.406] lstrlenW (lpString=".dbf") returned 4 [0102.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.407] lstrlenW (lpString=".1cd") returned 4 [0102.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 63 [0102.407] lstrlenW (lpString=".jpg") returned 4 [0102.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.407] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") [0102.408] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4408) returned 1 [0102.408] CloseHandle (hObject=0x15c) returned 1 [0102.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 0x20 [0102.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.408] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.408] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.409] GetLastError () returned 0x0 [0102.409] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1138, lpOverlapped=0x0) returned 1 [0102.411] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0102.412] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.412] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.412] SetEndOfFile (hFile=0x180) returned 1 [0102.412] CloseHandle (hObject=0x180) returned 1 [0102.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.412] SetEndOfFile (hFile=0x15c) returned 1 [0102.413] CloseHandle (hObject=0x15c) returned 1 [0102.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 1 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString=".doc") returned 4 [0102.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString=".docx") returned 5 [0102.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.414] lstrlenW (lpString=".pdf") returned 4 [0102.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString=".xls") returned 4 [0102.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.414] lstrlenW (lpString=".xlsx") returned 5 [0102.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.414] lstrlenW (lpString=".ppt") returned 4 [0102.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString=".zip") returned 4 [0102.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.414] lstrlenW (lpString=".rar") returned 4 [0102.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString=".bz2") returned 4 [0102.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString=".7z") returned 3 [0102.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString=".dbf") returned 4 [0102.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString=".1cd") returned 4 [0102.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.414] lstrlenW (lpString=".jpg") returned 4 [0102.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString=".pdf") returned 4 [0102.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString=".xls") returned 4 [0102.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.415] lstrlenW (lpString=".xlsx") returned 5 [0102.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.415] lstrlenW (lpString=".ppt") returned 4 [0102.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.415] lstrlenW (lpString=".zip") returned 4 [0102.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.415] lstrlenW (lpString=".rar") returned 4 [0102.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString=".bz2") returned 4 [0102.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString=".7z") returned 3 [0102.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.415] lstrlenW (lpString=".dbf") returned 4 [0102.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.415] lstrlenW (lpString=".1cd") returned 4 [0102.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 63 [0102.415] lstrlenW (lpString=".jpg") returned 4 [0102.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.415] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") [0102.416] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4296) returned 1 [0102.416] CloseHandle (hObject=0x15c) returned 1 [0102.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 0x20 [0102.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.416] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.416] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.417] GetLastError () returned 0x0 [0102.417] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0102.419] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0102.420] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.420] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.420] SetEndOfFile (hFile=0x180) returned 1 [0102.420] CloseHandle (hObject=0x180) returned 1 [0102.420] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.420] SetEndOfFile (hFile=0x15c) returned 1 [0102.421] CloseHandle (hObject=0x15c) returned 1 [0102.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 1 [0102.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.421] lstrlenW (lpString=".doc") returned 4 [0102.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.421] lstrlenW (lpString=".docx") returned 5 [0102.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.421] lstrlenW (lpString=".pdf") returned 4 [0102.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.421] lstrlenW (lpString=".xls") returned 4 [0102.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.421] lstrlenW (lpString=".xlsx") returned 5 [0102.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.422] lstrlenW (lpString=".ppt") returned 4 [0102.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.422] lstrlenW (lpString=".zip") returned 4 [0102.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.422] lstrlenW (lpString=".rar") returned 4 [0102.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString=".bz2") returned 4 [0102.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString=".7z") returned 3 [0102.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.422] lstrlenW (lpString=".dbf") returned 4 [0102.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.422] lstrlenW (lpString=".1cd") returned 4 [0102.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.422] lstrlenW (lpString=".jpg") returned 4 [0102.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString=".pdf") returned 4 [0102.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString=".xls") returned 4 [0102.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.422] lstrlenW (lpString=".xlsx") returned 5 [0102.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.422] lstrlenW (lpString=".ppt") returned 4 [0102.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.422] lstrlenW (lpString=".zip") returned 4 [0102.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.423] lstrlenW (lpString=".rar") returned 4 [0102.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.423] lstrlenW (lpString=".bz2") returned 4 [0102.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.423] lstrlenW (lpString=".7z") returned 3 [0102.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.423] lstrlenW (lpString=".dbf") returned 4 [0102.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.423] lstrlenW (lpString=".1cd") returned 4 [0102.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 63 [0102.423] lstrlenW (lpString=".jpg") returned 4 [0102.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.423] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") [0102.423] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3512) returned 1 [0102.424] CloseHandle (hObject=0x15c) returned 1 [0102.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 0x20 [0102.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.424] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.424] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.424] GetLastError () returned 0x0 [0102.425] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xdb8, lpOverlapped=0x0) returned 1 [0102.664] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xdc0, lpOverlapped=0x0) returned 1 [0102.665] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.665] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.666] SetEndOfFile (hFile=0x180) returned 1 [0102.666] CloseHandle (hObject=0x180) returned 1 [0102.666] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.666] SetEndOfFile (hFile=0x15c) returned 1 [0102.667] CloseHandle (hObject=0x15c) returned 1 [0102.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 1 [0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.667] lstrlenW (lpString=".doc") returned 4 [0102.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.667] lstrlenW (lpString=".docx") returned 5 [0102.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.667] lstrlenW (lpString=".pdf") returned 4 [0102.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.667] lstrlenW (lpString=".xls") returned 4 [0102.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.667] lstrlenW (lpString=".xlsx") returned 5 [0102.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.667] lstrlenW (lpString=".ppt") returned 4 [0102.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.667] lstrlenW (lpString=".zip") returned 4 [0102.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.667] lstrlenW (lpString=".rar") returned 4 [0102.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.667] lstrlenW (lpString=".bz2") returned 4 [0102.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString=".7z") returned 3 [0102.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.668] lstrlenW (lpString=".dbf") returned 4 [0102.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.668] lstrlenW (lpString=".1cd") returned 4 [0102.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.668] lstrlenW (lpString=".jpg") returned 4 [0102.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString=".pdf") returned 4 [0102.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString=".xls") returned 4 [0102.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.668] lstrlenW (lpString=".xlsx") returned 5 [0102.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.668] lstrlenW (lpString=".ppt") returned 4 [0102.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.668] lstrlenW (lpString=".zip") returned 4 [0102.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.668] lstrlenW (lpString=".rar") returned 4 [0102.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString=".bz2") returned 4 [0102.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString=".7z") returned 3 [0102.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.668] lstrlenW (lpString=".dbf") returned 4 [0102.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.669] lstrlenW (lpString=".1cd") returned 4 [0102.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 63 [0102.669] lstrlenW (lpString=".jpg") returned 4 [0102.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.669] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") [0102.669] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3604) returned 1 [0102.669] CloseHandle (hObject=0x15c) returned 1 [0102.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 0x20 [0102.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.670] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.670] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.670] GetLastError () returned 0x0 [0102.670] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xe14, lpOverlapped=0x0) returned 1 [0102.720] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0102.727] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.727] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.727] SetEndOfFile (hFile=0x180) returned 1 [0102.727] CloseHandle (hObject=0x180) returned 1 [0102.727] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.727] SetEndOfFile (hFile=0x15c) returned 1 [0102.728] CloseHandle (hObject=0x15c) returned 1 [0102.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 1 [0102.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.803] lstrlenW (lpString=".doc") returned 4 [0102.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.803] lstrlenW (lpString=".docx") returned 5 [0102.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.803] lstrlenW (lpString=".pdf") returned 4 [0102.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".xls") returned 4 [0102.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".xlsx") returned 5 [0102.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.804] lstrlenW (lpString=".ppt") returned 4 [0102.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.804] lstrlenW (lpString=".zip") returned 4 [0102.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".rar") returned 4 [0102.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".bz2") returned 4 [0102.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".7z") returned 3 [0102.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.804] lstrlenW (lpString=".dbf") returned 4 [0102.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.804] lstrlenW (lpString=".1cd") returned 4 [0102.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.804] lstrlenW (lpString=".jpg") returned 4 [0102.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".pdf") returned 4 [0102.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".xls") returned 4 [0102.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".xlsx") returned 5 [0102.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.804] lstrlenW (lpString=".ppt") returned 4 [0102.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.805] lstrlenW (lpString=".zip") returned 4 [0102.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.805] lstrlenW (lpString=".rar") returned 4 [0102.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.805] lstrlenW (lpString=".bz2") returned 4 [0102.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.805] lstrlenW (lpString=".7z") returned 3 [0102.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.805] lstrlenW (lpString=".dbf") returned 4 [0102.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.805] lstrlenW (lpString=".1cd") returned 4 [0102.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 63 [0102.805] lstrlenW (lpString=".jpg") returned 4 [0102.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.805] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") [0102.806] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2860) returned 1 [0102.806] CloseHandle (hObject=0x1ec) returned 1 [0102.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 0x20 [0102.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0102.806] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.806] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0102.807] GetLastError () returned 0x0 [0102.807] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb2c, lpOverlapped=0x0) returned 1 [0102.815] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0102.817] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.817] SetEndOfFile (hFile=0x1b4) returned 1 [0102.817] CloseHandle (hObject=0x1b4) returned 1 [0102.817] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.817] SetEndOfFile (hFile=0x1ec) returned 1 [0102.818] CloseHandle (hObject=0x1ec) returned 1 [0102.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 1 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString=".doc") returned 4 [0102.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString=".docx") returned 5 [0102.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.819] lstrlenW (lpString=".pdf") returned 4 [0102.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString=".xls") returned 4 [0102.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.819] lstrlenW (lpString=".xlsx") returned 5 [0102.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.819] lstrlenW (lpString=".ppt") returned 4 [0102.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString=".zip") returned 4 [0102.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.819] lstrlenW (lpString=".rar") returned 4 [0102.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString=".bz2") returned 4 [0102.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString=".7z") returned 3 [0102.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString=".dbf") returned 4 [0102.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString=".1cd") returned 4 [0102.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.819] lstrlenW (lpString=".jpg") returned 4 [0102.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString=".pdf") returned 4 [0102.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString=".xls") returned 4 [0102.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.820] lstrlenW (lpString=".xlsx") returned 5 [0102.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.820] lstrlenW (lpString=".ppt") returned 4 [0102.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.820] lstrlenW (lpString=".zip") returned 4 [0102.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.820] lstrlenW (lpString=".rar") returned 4 [0102.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString=".bz2") returned 4 [0102.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString=".7z") returned 3 [0102.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.820] lstrlenW (lpString=".dbf") returned 4 [0102.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.820] lstrlenW (lpString=".1cd") returned 4 [0102.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 63 [0102.820] lstrlenW (lpString=".jpg") returned 4 [0102.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.820] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") [0102.821] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7832) returned 1 [0102.821] CloseHandle (hObject=0x1ec) returned 1 [0102.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 0x20 [0102.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0102.821] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.821] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0102.822] GetLastError () returned 0x0 [0102.822] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1e98, lpOverlapped=0x0) returned 1 [0102.826] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0102.827] ReadFile (in: hFile=0x1ec, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.828] WriteFile (in: hFile=0x1b4, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.828] SetEndOfFile (hFile=0x1b4) returned 1 [0102.828] CloseHandle (hObject=0x1b4) returned 1 [0102.828] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.828] SetEndOfFile (hFile=0x1ec) returned 1 [0102.829] CloseHandle (hObject=0x1ec) returned 1 [0102.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 1 [0102.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.829] lstrlenW (lpString=".doc") returned 4 [0102.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.829] lstrlenW (lpString=".docx") returned 5 [0102.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.829] lstrlenW (lpString=".pdf") returned 4 [0102.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.829] lstrlenW (lpString=".xls") returned 4 [0102.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.829] lstrlenW (lpString=".xlsx") returned 5 [0102.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.829] lstrlenW (lpString=".ppt") returned 4 [0102.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.830] lstrlenW (lpString=".zip") returned 4 [0102.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.830] lstrlenW (lpString=".rar") returned 4 [0102.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString=".bz2") returned 4 [0102.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString=".7z") returned 3 [0102.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.830] lstrlenW (lpString=".dbf") returned 4 [0102.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.830] lstrlenW (lpString=".1cd") returned 4 [0102.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.830] lstrlenW (lpString=".jpg") returned 4 [0102.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString=".pdf") returned 4 [0102.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.830] lstrlenW (lpString=".xls") returned 4 [0102.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.830] lstrlenW (lpString=".xlsx") returned 5 [0102.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.830] lstrlenW (lpString=".ppt") returned 4 [0102.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.831] lstrlenW (lpString=".zip") returned 4 [0102.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.831] lstrlenW (lpString=".rar") returned 4 [0102.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.831] lstrlenW (lpString=".bz2") returned 4 [0102.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.831] lstrlenW (lpString=".7z") returned 3 [0102.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.831] lstrlenW (lpString=".dbf") returned 4 [0102.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.831] lstrlenW (lpString=".1cd") returned 4 [0102.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 63 [0102.831] lstrlenW (lpString=".jpg") returned 4 [0102.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.831] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") [0102.957] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3364) returned 1 [0102.957] CloseHandle (hObject=0x180) returned 1 [0102.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 0x20 [0102.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.957] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.957] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.959] GetLastError () returned 0x0 [0102.959] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd24, lpOverlapped=0x0) returned 1 [0103.006] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0103.008] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.008] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.009] SetEndOfFile (hFile=0x168) returned 1 [0103.009] CloseHandle (hObject=0x168) returned 1 [0103.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.009] SetEndOfFile (hFile=0x180) returned 1 [0103.010] CloseHandle (hObject=0x180) returned 1 [0103.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.010] lstrlenW (lpString=".doc") returned 4 [0103.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.010] lstrlenW (lpString=".docx") returned 5 [0103.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.010] lstrlenW (lpString=".pdf") returned 4 [0103.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString=".xls") returned 4 [0103.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.011] lstrlenW (lpString=".xlsx") returned 5 [0103.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.011] lstrlenW (lpString=".ppt") returned 4 [0103.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.011] lstrlenW (lpString=".zip") returned 4 [0103.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.011] lstrlenW (lpString=".rar") returned 4 [0103.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString=".bz2") returned 4 [0103.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString=".7z") returned 3 [0103.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.011] lstrlenW (lpString=".dbf") returned 4 [0103.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.011] lstrlenW (lpString=".1cd") returned 4 [0103.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.011] lstrlenW (lpString=".jpg") returned 4 [0103.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString=".pdf") returned 4 [0103.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString=".xls") returned 4 [0103.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.012] lstrlenW (lpString=".xlsx") returned 5 [0103.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.012] lstrlenW (lpString=".ppt") returned 4 [0103.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.012] lstrlenW (lpString=".zip") returned 4 [0103.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.012] lstrlenW (lpString=".rar") returned 4 [0103.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString=".bz2") returned 4 [0103.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString=".7z") returned 3 [0103.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.012] lstrlenW (lpString=".dbf") returned 4 [0103.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.012] lstrlenW (lpString=".1cd") returned 4 [0103.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 63 [0103.012] lstrlenW (lpString=".jpg") returned 4 [0103.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.012] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") [0103.013] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2852) returned 1 [0103.013] CloseHandle (hObject=0x180) returned 1 [0103.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 0x20 [0103.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.014] GetLastError () returned 0x0 [0103.014] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb24, lpOverlapped=0x0) returned 1 [0103.049] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0103.050] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.050] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.050] SetEndOfFile (hFile=0x168) returned 1 [0103.080] CloseHandle (hObject=0x168) returned 1 [0103.081] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.081] SetEndOfFile (hFile=0x180) returned 1 [0103.081] CloseHandle (hObject=0x180) returned 1 [0103.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 1 [0103.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.082] lstrlenW (lpString=".doc") returned 4 [0103.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.082] lstrlenW (lpString=".docx") returned 5 [0103.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.082] lstrlenW (lpString=".pdf") returned 4 [0103.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.082] lstrlenW (lpString=".xls") returned 4 [0103.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.082] lstrlenW (lpString=".xlsx") returned 5 [0103.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.082] lstrlenW (lpString=".ppt") returned 4 [0103.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.082] lstrlenW (lpString=".zip") returned 4 [0103.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.082] lstrlenW (lpString=".rar") returned 4 [0103.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.082] lstrlenW (lpString=".bz2") returned 4 [0103.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.082] lstrlenW (lpString=".7z") returned 3 [0103.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.082] lstrlenW (lpString=".dbf") returned 4 [0103.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".1cd") returned 4 [0103.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".jpg") returned 4 [0103.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString=".pdf") returned 4 [0103.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString=".xls") returned 4 [0103.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.083] lstrlenW (lpString=".xlsx") returned 5 [0103.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.083] lstrlenW (lpString=".ppt") returned 4 [0103.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".zip") returned 4 [0103.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.083] lstrlenW (lpString=".rar") returned 4 [0103.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString=".bz2") returned 4 [0103.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString=".7z") returned 3 [0103.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".dbf") returned 4 [0103.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".1cd") returned 4 [0103.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 63 [0103.083] lstrlenW (lpString=".jpg") returned 4 [0103.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.084] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") [0103.084] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7212) returned 1 [0103.084] CloseHandle (hObject=0x180) returned 1 [0103.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 0x20 [0103.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.084] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.085] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.085] GetLastError () returned 0x0 [0103.085] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1c2c, lpOverlapped=0x0) returned 1 [0103.296] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1c30, lpOverlapped=0x0) returned 1 [0103.297] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.297] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.297] SetEndOfFile (hFile=0x168) returned 1 [0103.297] CloseHandle (hObject=0x168) returned 1 [0103.297] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.298] SetEndOfFile (hFile=0x180) returned 1 [0103.299] CloseHandle (hObject=0x180) returned 1 [0103.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 1 [0103.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.299] lstrlenW (lpString=".doc") returned 4 [0103.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.299] lstrlenW (lpString=".docx") returned 5 [0103.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.299] lstrlenW (lpString=".pdf") returned 4 [0103.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.299] lstrlenW (lpString=".xls") returned 4 [0103.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.299] lstrlenW (lpString=".xlsx") returned 5 [0103.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.299] lstrlenW (lpString=".ppt") returned 4 [0103.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.299] lstrlenW (lpString=".zip") returned 4 [0103.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.299] lstrlenW (lpString=".rar") returned 4 [0103.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.299] lstrlenW (lpString=".bz2") returned 4 [0103.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString=".7z") returned 3 [0103.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.300] lstrlenW (lpString=".dbf") returned 4 [0103.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.300] lstrlenW (lpString=".1cd") returned 4 [0103.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.300] lstrlenW (lpString=".jpg") returned 4 [0103.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString=".pdf") returned 4 [0103.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString=".xls") returned 4 [0103.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.300] lstrlenW (lpString=".xlsx") returned 5 [0103.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.300] lstrlenW (lpString=".ppt") returned 4 [0103.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.300] lstrlenW (lpString=".zip") returned 4 [0103.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.300] lstrlenW (lpString=".rar") returned 4 [0103.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString=".bz2") returned 4 [0103.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString=".7z") returned 3 [0103.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.300] lstrlenW (lpString=".dbf") returned 4 [0103.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.301] lstrlenW (lpString=".1cd") returned 4 [0103.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 63 [0103.301] lstrlenW (lpString=".jpg") returned 4 [0103.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.301] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") [0103.301] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1372) returned 1 [0103.301] CloseHandle (hObject=0x180) returned 1 [0103.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 0x20 [0103.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.302] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.302] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.302] GetLastError () returned 0x0 [0103.302] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x55c, lpOverlapped=0x0) returned 1 [0103.377] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x560, lpOverlapped=0x0) returned 1 [0103.378] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.378] WriteFile (in: hFile=0x168, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.378] SetEndOfFile (hFile=0x168) returned 1 [0103.378] CloseHandle (hObject=0x168) returned 1 [0103.378] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.378] SetEndOfFile (hFile=0x180) returned 1 [0103.379] CloseHandle (hObject=0x180) returned 1 [0103.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 1 [0103.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.552] lstrlenW (lpString=".doc") returned 4 [0103.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString=".docx") returned 5 [0103.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.552] lstrlenW (lpString=".pdf") returned 4 [0103.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString=".xls") returned 4 [0103.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.552] lstrlenW (lpString=".xlsx") returned 5 [0103.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.552] lstrlenW (lpString=".ppt") returned 4 [0103.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.552] lstrlenW (lpString=".zip") returned 4 [0103.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.552] lstrlenW (lpString=".rar") returned 4 [0103.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString=".bz2") returned 4 [0103.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString=".7z") returned 3 [0103.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.552] lstrlenW (lpString=".dbf") returned 4 [0103.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.552] lstrlenW (lpString=".1cd") returned 4 [0103.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.553] lstrlenW (lpString=".jpg") returned 4 [0103.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString=".pdf") returned 4 [0103.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString=".xls") returned 4 [0103.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.553] lstrlenW (lpString=".xlsx") returned 5 [0103.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.553] lstrlenW (lpString=".ppt") returned 4 [0103.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.553] lstrlenW (lpString=".zip") returned 4 [0103.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.553] lstrlenW (lpString=".rar") returned 4 [0103.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString=".bz2") returned 4 [0103.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString=".7z") returned 3 [0103.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.553] lstrlenW (lpString=".dbf") returned 4 [0103.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.553] lstrlenW (lpString=".1cd") returned 4 [0103.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 63 [0103.553] lstrlenW (lpString=".jpg") returned 4 [0103.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.553] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") [0103.744] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3112) returned 1 [0103.744] CloseHandle (hObject=0x1f4) returned 1 [0103.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 0x20 [0103.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.744] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.744] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.745] GetLastError () returned 0x0 [0103.746] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc28, lpOverlapped=0x0) returned 1 [0103.747] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0103.748] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.748] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.748] SetEndOfFile (hFile=0x1b8) returned 1 [0103.749] CloseHandle (hObject=0x1b8) returned 1 [0103.749] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.749] SetEndOfFile (hFile=0x1f4) returned 1 [0103.749] CloseHandle (hObject=0x1f4) returned 1 [0103.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 1 [0103.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.750] lstrlenW (lpString=".doc") returned 4 [0103.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.750] lstrlenW (lpString=".docx") returned 5 [0103.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.750] lstrlenW (lpString=".pdf") returned 4 [0103.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.750] lstrlenW (lpString=".xls") returned 4 [0103.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.750] lstrlenW (lpString=".xlsx") returned 5 [0103.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.750] lstrlenW (lpString=".ppt") returned 4 [0103.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.750] lstrlenW (lpString=".zip") returned 4 [0103.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.750] lstrlenW (lpString=".rar") returned 4 [0103.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.750] lstrlenW (lpString=".bz2") returned 4 [0103.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.750] lstrlenW (lpString=".7z") returned 3 [0103.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".dbf") returned 4 [0103.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".1cd") returned 4 [0103.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".jpg") returned 4 [0103.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString=".pdf") returned 4 [0103.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString=".xls") returned 4 [0103.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.751] lstrlenW (lpString=".xlsx") returned 5 [0103.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.751] lstrlenW (lpString=".ppt") returned 4 [0103.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".zip") returned 4 [0103.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.751] lstrlenW (lpString=".rar") returned 4 [0103.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString=".bz2") returned 4 [0103.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString=".7z") returned 3 [0103.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".dbf") returned 4 [0103.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.751] lstrlenW (lpString=".1cd") returned 4 [0103.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 63 [0103.752] lstrlenW (lpString=".jpg") returned 4 [0103.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.752] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") [0103.752] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24896) returned 1 [0103.752] CloseHandle (hObject=0x1f4) returned 1 [0103.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x20 [0103.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.753] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.753] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.753] GetLastError () returned 0x0 [0103.753] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6140, lpOverlapped=0x0) returned 1 [0103.756] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0103.757] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.757] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.757] SetEndOfFile (hFile=0x1b8) returned 1 [0103.757] CloseHandle (hObject=0x1b8) returned 1 [0103.757] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.758] SetEndOfFile (hFile=0x1f4) returned 1 [0103.758] CloseHandle (hObject=0x1f4) returned 1 [0103.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.759] lstrlenW (lpString=".doc") returned 4 [0103.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.759] lstrlenW (lpString=".docx") returned 5 [0103.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.759] lstrlenW (lpString=".pdf") returned 4 [0103.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.759] lstrlenW (lpString=".xls") returned 4 [0103.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.759] lstrlenW (lpString=".xlsx") returned 5 [0103.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.759] lstrlenW (lpString=".ppt") returned 4 [0103.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.759] lstrlenW (lpString=".zip") returned 4 [0103.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.759] lstrlenW (lpString=".rar") returned 4 [0103.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.759] lstrlenW (lpString=".bz2") returned 4 [0103.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.759] lstrlenW (lpString=".7z") returned 3 [0103.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.759] lstrlenW (lpString=".dbf") returned 4 [0103.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".1cd") returned 4 [0103.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".jpg") returned 4 [0103.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString=".pdf") returned 4 [0103.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString=".xls") returned 4 [0103.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.760] lstrlenW (lpString=".xlsx") returned 5 [0103.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.760] lstrlenW (lpString=".ppt") returned 4 [0103.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".zip") returned 4 [0103.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.760] lstrlenW (lpString=".rar") returned 4 [0103.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString=".bz2") returned 4 [0103.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString=".7z") returned 3 [0103.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".dbf") returned 4 [0103.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".1cd") returned 4 [0103.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 63 [0103.760] lstrlenW (lpString=".jpg") returned 4 [0103.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.761] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") [0103.761] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16666) returned 1 [0103.761] CloseHandle (hObject=0x1f4) returned 1 [0103.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 0x20 [0103.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.762] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.762] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.762] GetLastError () returned 0x0 [0103.762] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x411a, lpOverlapped=0x0) returned 1 [0103.764] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4120, lpOverlapped=0x0) returned 1 [0103.765] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.765] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.765] SetEndOfFile (hFile=0x1b8) returned 1 [0103.766] CloseHandle (hObject=0x1b8) returned 1 [0103.766] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.766] SetEndOfFile (hFile=0x1f4) returned 1 [0103.767] CloseHandle (hObject=0x1f4) returned 1 [0103.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 1 [0103.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.767] lstrlenW (lpString=".doc") returned 4 [0103.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.767] lstrlenW (lpString=".docx") returned 5 [0103.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.767] lstrlenW (lpString=".pdf") returned 4 [0103.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.767] lstrlenW (lpString=".xls") returned 4 [0103.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.767] lstrlenW (lpString=".xlsx") returned 5 [0103.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.768] lstrlenW (lpString=".ppt") returned 4 [0103.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.768] lstrlenW (lpString=".zip") returned 4 [0103.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.768] lstrlenW (lpString=".rar") returned 4 [0103.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString=".bz2") returned 4 [0103.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString=".7z") returned 3 [0103.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.768] lstrlenW (lpString=".dbf") returned 4 [0103.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.768] lstrlenW (lpString=".1cd") returned 4 [0103.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.768] lstrlenW (lpString=".jpg") returned 4 [0103.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString=".pdf") returned 4 [0103.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString=".xls") returned 4 [0103.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.768] lstrlenW (lpString=".xlsx") returned 5 [0103.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.768] lstrlenW (lpString=".ppt") returned 4 [0103.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.768] lstrlenW (lpString=".zip") returned 4 [0103.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.768] lstrlenW (lpString=".rar") returned 4 [0103.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.769] lstrlenW (lpString=".bz2") returned 4 [0103.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.769] lstrlenW (lpString=".7z") returned 3 [0103.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.769] lstrlenW (lpString=".dbf") returned 4 [0103.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.769] lstrlenW (lpString=".1cd") returned 4 [0103.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 63 [0103.769] lstrlenW (lpString=".jpg") returned 4 [0103.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.769] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") [0103.770] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15708) returned 1 [0103.770] CloseHandle (hObject=0x1f4) returned 1 [0103.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x20 [0103.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.770] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.770] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.771] GetLastError () returned 0x0 [0103.771] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3d5c, lpOverlapped=0x0) returned 1 [0103.773] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d60, lpOverlapped=0x0) returned 1 [0103.774] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.774] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.774] SetEndOfFile (hFile=0x1b8) returned 1 [0103.774] CloseHandle (hObject=0x1b8) returned 1 [0103.774] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.774] SetEndOfFile (hFile=0x1f4) returned 1 [0103.775] CloseHandle (hObject=0x1f4) returned 1 [0103.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 1 [0103.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.776] lstrlenW (lpString=".doc") returned 4 [0103.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString=".docx") returned 5 [0103.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.776] lstrlenW (lpString=".pdf") returned 4 [0103.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString=".xls") returned 4 [0103.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.776] lstrlenW (lpString=".xlsx") returned 5 [0103.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.776] lstrlenW (lpString=".ppt") returned 4 [0103.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.776] lstrlenW (lpString=".zip") returned 4 [0103.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.776] lstrlenW (lpString=".rar") returned 4 [0103.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString=".bz2") returned 4 [0103.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString=".7z") returned 3 [0103.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.776] lstrlenW (lpString=".dbf") returned 4 [0103.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.776] lstrlenW (lpString=".1cd") returned 4 [0103.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.776] lstrlenW (lpString=".jpg") returned 4 [0103.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.776] lstrlenW (lpString=".pdf") returned 4 [0103.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString=".xls") returned 4 [0103.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.777] lstrlenW (lpString=".xlsx") returned 5 [0103.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.777] lstrlenW (lpString=".ppt") returned 4 [0103.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.777] lstrlenW (lpString=".zip") returned 4 [0103.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.777] lstrlenW (lpString=".rar") returned 4 [0103.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString=".bz2") returned 4 [0103.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString=".7z") returned 3 [0103.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.777] lstrlenW (lpString=".dbf") returned 4 [0103.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.777] lstrlenW (lpString=".1cd") returned 4 [0103.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 63 [0103.777] lstrlenW (lpString=".jpg") returned 4 [0103.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.777] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") [0103.778] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16448) returned 1 [0103.778] CloseHandle (hObject=0x1f4) returned 1 [0103.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x20 [0103.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.778] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.778] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.779] GetLastError () returned 0x0 [0103.779] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4040, lpOverlapped=0x0) returned 1 [0103.812] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4050, lpOverlapped=0x0) returned 1 [0103.813] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.813] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.813] SetEndOfFile (hFile=0x1b8) returned 1 [0104.066] CloseHandle (hObject=0x1b8) returned 1 [0104.130] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.131] SetEndOfFile (hFile=0x1f4) returned 1 [0104.156] CloseHandle (hObject=0x1f4) returned 1 [0104.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.178] lstrlenW (lpString=".doc") returned 4 [0104.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.178] lstrlenW (lpString=".docx") returned 5 [0104.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.178] lstrlenW (lpString=".pdf") returned 4 [0104.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString=".xls") returned 4 [0104.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.179] lstrlenW (lpString=".xlsx") returned 5 [0104.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.179] lstrlenW (lpString=".ppt") returned 4 [0104.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.179] lstrlenW (lpString=".zip") returned 4 [0104.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.179] lstrlenW (lpString=".rar") returned 4 [0104.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString=".bz2") returned 4 [0104.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString=".7z") returned 3 [0104.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.179] lstrlenW (lpString=".dbf") returned 4 [0104.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.179] lstrlenW (lpString=".1cd") returned 4 [0104.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.180] lstrlenW (lpString=".jpg") returned 4 [0104.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString=".pdf") returned 4 [0104.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString=".xls") returned 4 [0104.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.180] lstrlenW (lpString=".xlsx") returned 5 [0104.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.180] lstrlenW (lpString=".ppt") returned 4 [0104.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.180] lstrlenW (lpString=".zip") returned 4 [0104.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.180] lstrlenW (lpString=".rar") returned 4 [0104.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString=".bz2") returned 4 [0104.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString=".7z") returned 3 [0104.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.180] lstrlenW (lpString=".dbf") returned 4 [0104.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.180] lstrlenW (lpString=".1cd") returned 4 [0104.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 63 [0104.181] lstrlenW (lpString=".jpg") returned 4 [0104.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.181] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") [0104.218] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=81964) returned 1 [0104.218] CloseHandle (hObject=0x1c8) returned 1 [0104.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x20 [0104.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.221] GetLastError () returned 0x0 [0104.221] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1402c, lpOverlapped=0x0) returned 1 [0104.224] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x14030, lpOverlapped=0x0) returned 1 [0104.226] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.226] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.226] SetEndOfFile (hFile=0x158) returned 1 [0104.226] CloseHandle (hObject=0x158) returned 1 [0104.226] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.227] SetEndOfFile (hFile=0x1c8) returned 1 [0104.228] CloseHandle (hObject=0x1c8) returned 1 [0104.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 1 [0104.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.228] lstrlenW (lpString=".doc") returned 4 [0104.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.228] lstrlenW (lpString=".docx") returned 5 [0104.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.228] lstrlenW (lpString=".pdf") returned 4 [0104.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString=".xls") returned 4 [0104.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.229] lstrlenW (lpString=".xlsx") returned 5 [0104.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.229] lstrlenW (lpString=".ppt") returned 4 [0104.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.229] lstrlenW (lpString=".zip") returned 4 [0104.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.229] lstrlenW (lpString=".rar") returned 4 [0104.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString=".bz2") returned 4 [0104.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString=".7z") returned 3 [0104.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.229] lstrlenW (lpString=".dbf") returned 4 [0104.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.229] lstrlenW (lpString=".1cd") returned 4 [0104.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.229] lstrlenW (lpString=".jpg") returned 4 [0104.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString=".pdf") returned 4 [0104.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.229] lstrlenW (lpString=".xls") returned 4 [0104.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.230] lstrlenW (lpString=".xlsx") returned 5 [0104.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.230] lstrlenW (lpString=".ppt") returned 4 [0104.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.230] lstrlenW (lpString=".zip") returned 4 [0104.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.230] lstrlenW (lpString=".rar") returned 4 [0104.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.230] lstrlenW (lpString=".bz2") returned 4 [0104.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.230] lstrlenW (lpString=".7z") returned 3 [0104.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.230] lstrlenW (lpString=".dbf") returned 4 [0104.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.230] lstrlenW (lpString=".1cd") returned 4 [0104.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 63 [0104.230] lstrlenW (lpString=".jpg") returned 4 [0104.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.230] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") [0104.232] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7908) returned 1 [0104.232] CloseHandle (hObject=0x1c8) returned 1 [0104.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x20 [0104.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.233] GetLastError () returned 0x0 [0104.233] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ee4, lpOverlapped=0x0) returned 1 [0104.235] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1ef0, lpOverlapped=0x0) returned 1 [0104.236] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.236] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.236] SetEndOfFile (hFile=0x158) returned 1 [0104.236] CloseHandle (hObject=0x158) returned 1 [0104.237] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.237] SetEndOfFile (hFile=0x1c8) returned 1 [0104.237] CloseHandle (hObject=0x1c8) returned 1 [0104.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 1 [0104.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.238] lstrlenW (lpString=".doc") returned 4 [0104.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.238] lstrlenW (lpString=".docx") returned 5 [0104.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.238] lstrlenW (lpString=".pdf") returned 4 [0104.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.238] lstrlenW (lpString=".xls") returned 4 [0104.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.238] lstrlenW (lpString=".xlsx") returned 5 [0104.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.238] lstrlenW (lpString=".ppt") returned 4 [0104.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.238] lstrlenW (lpString=".zip") returned 4 [0104.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.238] lstrlenW (lpString=".rar") returned 4 [0104.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.238] lstrlenW (lpString=".bz2") returned 4 [0104.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.238] lstrlenW (lpString=".7z") returned 3 [0104.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.238] lstrlenW (lpString=".dbf") returned 4 [0104.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".1cd") returned 4 [0104.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".jpg") returned 4 [0104.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString=".pdf") returned 4 [0104.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString=".xls") returned 4 [0104.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.239] lstrlenW (lpString=".xlsx") returned 5 [0104.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.239] lstrlenW (lpString=".ppt") returned 4 [0104.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".zip") returned 4 [0104.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.239] lstrlenW (lpString=".rar") returned 4 [0104.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString=".bz2") returned 4 [0104.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString=".7z") returned 3 [0104.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".dbf") returned 4 [0104.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".1cd") returned 4 [0104.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 63 [0104.239] lstrlenW (lpString=".jpg") returned 4 [0104.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.240] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") [0104.241] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=36264) returned 1 [0104.241] CloseHandle (hObject=0x1c8) returned 1 [0104.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 0x20 [0104.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.241] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.241] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.242] GetLastError () returned 0x0 [0104.242] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8da8, lpOverlapped=0x0) returned 1 [0104.244] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8db0, lpOverlapped=0x0) returned 1 [0104.245] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.245] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.245] SetEndOfFile (hFile=0x158) returned 1 [0104.245] CloseHandle (hObject=0x158) returned 1 [0104.245] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.246] SetEndOfFile (hFile=0x1c8) returned 1 [0104.246] CloseHandle (hObject=0x1c8) returned 1 [0104.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.247] lstrlenW (lpString=".doc") returned 4 [0104.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".docx") returned 5 [0104.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.247] lstrlenW (lpString=".pdf") returned 4 [0104.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".xls") returned 4 [0104.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.247] lstrlenW (lpString=".xlsx") returned 5 [0104.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.247] lstrlenW (lpString=".ppt") returned 4 [0104.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.247] lstrlenW (lpString=".zip") returned 4 [0104.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.247] lstrlenW (lpString=".rar") returned 4 [0104.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".bz2") returned 4 [0104.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".7z") returned 3 [0104.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".dbf") returned 4 [0104.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".1cd") returned 4 [0104.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".jpg") returned 4 [0104.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".pdf") returned 4 [0104.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".xls") returned 4 [0104.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.248] lstrlenW (lpString=".xlsx") returned 5 [0104.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.248] lstrlenW (lpString=".ppt") returned 4 [0104.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".zip") returned 4 [0104.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.248] lstrlenW (lpString=".rar") returned 4 [0104.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".bz2") returned 4 [0104.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".7z") returned 3 [0104.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".dbf") returned 4 [0104.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.248] lstrlenW (lpString=".1cd") returned 4 [0104.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 63 [0104.249] lstrlenW (lpString=".jpg") returned 4 [0104.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.249] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") [0104.249] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5132) returned 1 [0104.249] CloseHandle (hObject=0x1c8) returned 1 [0104.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x20 [0104.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.250] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.289] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.748] GetLastError () returned 0x0 [0104.751] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x140c, lpOverlapped=0x0) returned 1 [0104.766] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0104.767] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.767] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.767] SetEndOfFile (hFile=0x19c) returned 1 [0104.767] CloseHandle (hObject=0x19c) returned 1 [0104.767] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.767] SetEndOfFile (hFile=0x1c8) returned 1 [0104.768] CloseHandle (hObject=0x1c8) returned 1 [0104.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 1 [0104.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.768] lstrlenW (lpString=".doc") returned 4 [0104.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.768] lstrlenW (lpString=".docx") returned 5 [0104.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.768] lstrlenW (lpString=".pdf") returned 4 [0104.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString=".xls") returned 4 [0104.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.769] lstrlenW (lpString=".xlsx") returned 5 [0104.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.769] lstrlenW (lpString=".ppt") returned 4 [0104.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.769] lstrlenW (lpString=".zip") returned 4 [0104.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.769] lstrlenW (lpString=".rar") returned 4 [0104.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString=".bz2") returned 4 [0104.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString=".7z") returned 3 [0104.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.769] lstrlenW (lpString=".dbf") returned 4 [0104.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.769] lstrlenW (lpString=".1cd") returned 4 [0104.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.769] lstrlenW (lpString=".jpg") returned 4 [0104.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString=".pdf") returned 4 [0104.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.769] lstrlenW (lpString=".xls") returned 4 [0104.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.769] lstrlenW (lpString=".xlsx") returned 5 [0104.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.769] lstrlenW (lpString=".ppt") returned 4 [0104.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.770] lstrlenW (lpString=".zip") returned 4 [0104.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.770] lstrlenW (lpString=".rar") returned 4 [0104.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.770] lstrlenW (lpString=".bz2") returned 4 [0104.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.770] lstrlenW (lpString=".7z") returned 3 [0104.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.770] lstrlenW (lpString=".dbf") returned 4 [0104.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.770] lstrlenW (lpString=".1cd") returned 4 [0104.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 63 [0104.770] lstrlenW (lpString=".jpg") returned 4 [0104.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.770] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") [0104.771] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9172) returned 1 [0104.771] CloseHandle (hObject=0x1c8) returned 1 [0104.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x20 [0104.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.771] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.771] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.772] GetLastError () returned 0x0 [0104.772] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x23d4, lpOverlapped=0x0) returned 1 [0104.774] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0104.775] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.775] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.775] SetEndOfFile (hFile=0x19c) returned 1 [0104.775] CloseHandle (hObject=0x19c) returned 1 [0104.779] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.779] SetEndOfFile (hFile=0x1c8) returned 1 [0104.779] CloseHandle (hObject=0x1c8) returned 1 [0104.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 1 [0104.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.782] lstrlenW (lpString=".doc") returned 4 [0104.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.782] lstrlenW (lpString=".docx") returned 5 [0104.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.782] lstrlenW (lpString=".pdf") returned 4 [0104.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.782] lstrlenW (lpString=".xls") returned 4 [0104.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.783] lstrlenW (lpString=".xlsx") returned 5 [0104.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.783] lstrlenW (lpString=".ppt") returned 4 [0104.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.783] lstrlenW (lpString=".zip") returned 4 [0104.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.783] lstrlenW (lpString=".rar") returned 4 [0104.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString=".bz2") returned 4 [0104.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString=".7z") returned 3 [0104.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.783] lstrlenW (lpString=".dbf") returned 4 [0104.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.783] lstrlenW (lpString=".1cd") returned 4 [0104.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.783] lstrlenW (lpString=".jpg") returned 4 [0104.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString=".pdf") returned 4 [0104.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString=".xls") returned 4 [0104.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.783] lstrlenW (lpString=".xlsx") returned 5 [0104.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.783] lstrlenW (lpString=".ppt") returned 4 [0104.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.783] lstrlenW (lpString=".zip") returned 4 [0104.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.784] lstrlenW (lpString=".rar") returned 4 [0104.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.784] lstrlenW (lpString=".bz2") returned 4 [0104.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.784] lstrlenW (lpString=".7z") returned 3 [0104.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.784] lstrlenW (lpString=".dbf") returned 4 [0104.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.784] lstrlenW (lpString=".1cd") returned 4 [0104.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 63 [0104.784] lstrlenW (lpString=".jpg") returned 4 [0104.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.784] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") [0104.785] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8132) returned 1 [0104.785] CloseHandle (hObject=0x1c8) returned 1 [0104.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x20 [0104.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.785] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.785] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.786] GetLastError () returned 0x0 [0104.786] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1fc4, lpOverlapped=0x0) returned 1 [0104.788] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0104.789] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.789] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.789] SetEndOfFile (hFile=0x19c) returned 1 [0104.789] CloseHandle (hObject=0x19c) returned 1 [0104.789] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.789] SetEndOfFile (hFile=0x1c8) returned 1 [0104.790] CloseHandle (hObject=0x1c8) returned 1 [0104.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 1 [0104.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.790] lstrlenW (lpString=".doc") returned 4 [0104.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.790] lstrlenW (lpString=".docx") returned 5 [0104.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.790] lstrlenW (lpString=".pdf") returned 4 [0104.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.790] lstrlenW (lpString=".xls") returned 4 [0104.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.790] lstrlenW (lpString=".xlsx") returned 5 [0104.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.790] lstrlenW (lpString=".ppt") returned 4 [0104.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.791] lstrlenW (lpString=".zip") returned 4 [0104.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.791] lstrlenW (lpString=".rar") returned 4 [0104.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString=".bz2") returned 4 [0104.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString=".7z") returned 3 [0104.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.791] lstrlenW (lpString=".dbf") returned 4 [0104.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.791] lstrlenW (lpString=".1cd") returned 4 [0104.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.791] lstrlenW (lpString=".jpg") returned 4 [0104.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString=".pdf") returned 4 [0104.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString=".xls") returned 4 [0104.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.791] lstrlenW (lpString=".xlsx") returned 5 [0104.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.791] lstrlenW (lpString=".ppt") returned 4 [0104.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.791] lstrlenW (lpString=".zip") returned 4 [0104.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.791] lstrlenW (lpString=".rar") returned 4 [0104.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.792] lstrlenW (lpString=".bz2") returned 4 [0104.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.792] lstrlenW (lpString=".7z") returned 3 [0104.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.792] lstrlenW (lpString=".dbf") returned 4 [0104.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.792] lstrlenW (lpString=".1cd") returned 4 [0104.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 63 [0104.792] lstrlenW (lpString=".jpg") returned 4 [0104.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.792] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") [0104.792] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=30178) returned 1 [0104.793] CloseHandle (hObject=0x1c8) returned 1 [0104.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x20 [0104.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.793] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.793] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.793] GetLastError () returned 0x0 [0104.794] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x75e2, lpOverlapped=0x0) returned 1 [0104.796] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x75f0, lpOverlapped=0x0) returned 1 [0104.797] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.797] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.797] SetEndOfFile (hFile=0x19c) returned 1 [0104.798] CloseHandle (hObject=0x19c) returned 1 [0104.798] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.798] SetEndOfFile (hFile=0x1c8) returned 1 [0104.798] CloseHandle (hObject=0x1c8) returned 1 [0104.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 1 [0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.799] lstrlenW (lpString=".doc") returned 4 [0104.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.799] lstrlenW (lpString=".docx") returned 5 [0104.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.799] lstrlenW (lpString=".pdf") returned 4 [0104.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.799] lstrlenW (lpString=".xls") returned 4 [0104.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.799] lstrlenW (lpString=".xlsx") returned 5 [0104.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.799] lstrlenW (lpString=".ppt") returned 4 [0104.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.799] lstrlenW (lpString=".zip") returned 4 [0104.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.799] lstrlenW (lpString=".rar") returned 4 [0104.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.799] lstrlenW (lpString=".bz2") returned 4 [0104.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString=".7z") returned 3 [0104.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".dbf") returned 4 [0104.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".1cd") returned 4 [0104.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".jpg") returned 4 [0104.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString=".pdf") returned 4 [0104.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString=".xls") returned 4 [0104.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.800] lstrlenW (lpString=".xlsx") returned 5 [0104.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.800] lstrlenW (lpString=".ppt") returned 4 [0104.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".zip") returned 4 [0104.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.800] lstrlenW (lpString=".rar") returned 4 [0104.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString=".bz2") returned 4 [0104.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString=".7z") returned 3 [0104.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".dbf") returned 4 [0104.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.800] lstrlenW (lpString=".1cd") returned 4 [0104.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 63 [0104.801] lstrlenW (lpString=".jpg") returned 4 [0104.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.801] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") [0104.801] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33358) returned 1 [0104.801] CloseHandle (hObject=0x1c8) returned 1 [0104.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 0x20 [0104.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0104.802] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.802] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.802] GetLastError () returned 0x0 [0104.802] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x824e, lpOverlapped=0x0) returned 1 [0104.984] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8250, lpOverlapped=0x0) returned 1 [0104.985] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.985] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.985] SetEndOfFile (hFile=0x19c) returned 1 [0105.023] CloseHandle (hObject=0x19c) returned 1 [0105.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.023] SetEndOfFile (hFile=0x1c8) returned 1 [0105.033] CloseHandle (hObject=0x1c8) returned 1 [0105.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 1 [0105.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.058] lstrlenW (lpString=".doc") returned 4 [0105.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.058] lstrlenW (lpString=".docx") returned 5 [0105.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.058] lstrlenW (lpString=".pdf") returned 4 [0105.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.058] lstrlenW (lpString=".xls") returned 4 [0105.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.058] lstrlenW (lpString=".xlsx") returned 5 [0105.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.058] lstrlenW (lpString=".ppt") returned 4 [0105.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.058] lstrlenW (lpString=".zip") returned 4 [0105.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.058] lstrlenW (lpString=".rar") returned 4 [0105.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".bz2") returned 4 [0105.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".7z") returned 3 [0105.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.059] lstrlenW (lpString=".dbf") returned 4 [0105.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.059] lstrlenW (lpString=".1cd") returned 4 [0105.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.059] lstrlenW (lpString=".jpg") returned 4 [0105.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".pdf") returned 4 [0105.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".xls") returned 4 [0105.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.059] lstrlenW (lpString=".xlsx") returned 5 [0105.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.059] lstrlenW (lpString=".ppt") returned 4 [0105.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.059] lstrlenW (lpString=".zip") returned 4 [0105.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.059] lstrlenW (lpString=".rar") returned 4 [0105.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".bz2") returned 4 [0105.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.059] lstrlenW (lpString=".7z") returned 3 [0105.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.060] lstrlenW (lpString=".dbf") returned 4 [0105.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.060] lstrlenW (lpString=".1cd") returned 4 [0105.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 63 [0105.060] lstrlenW (lpString=".jpg") returned 4 [0105.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.060] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") [0105.060] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=22608) returned 1 [0105.060] CloseHandle (hObject=0x1c8) returned 1 [0105.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x20 [0105.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.061] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.061] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.061] GetLastError () returned 0x0 [0105.061] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5850, lpOverlapped=0x0) returned 1 [0105.064] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5860, lpOverlapped=0x0) returned 1 [0105.068] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.068] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.068] SetEndOfFile (hFile=0x19c) returned 1 [0105.068] CloseHandle (hObject=0x19c) returned 1 [0105.068] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.069] SetEndOfFile (hFile=0x1c8) returned 1 [0105.069] CloseHandle (hObject=0x1c8) returned 1 [0105.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.070] lstrlenW (lpString=".doc") returned 4 [0105.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString=".docx") returned 5 [0105.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.070] lstrlenW (lpString=".pdf") returned 4 [0105.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString=".xls") returned 4 [0105.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.070] lstrlenW (lpString=".xlsx") returned 5 [0105.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.070] lstrlenW (lpString=".ppt") returned 4 [0105.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.070] lstrlenW (lpString=".zip") returned 4 [0105.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.070] lstrlenW (lpString=".rar") returned 4 [0105.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString=".bz2") returned 4 [0105.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString=".7z") returned 3 [0105.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".dbf") returned 4 [0105.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".1cd") returned 4 [0105.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".jpg") returned 4 [0105.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString=".pdf") returned 4 [0105.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString=".xls") returned 4 [0105.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.071] lstrlenW (lpString=".xlsx") returned 5 [0105.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.071] lstrlenW (lpString=".ppt") returned 4 [0105.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".zip") returned 4 [0105.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.071] lstrlenW (lpString=".rar") returned 4 [0105.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString=".bz2") returned 4 [0105.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString=".7z") returned 3 [0105.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".dbf") returned 4 [0105.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.071] lstrlenW (lpString=".1cd") returned 4 [0105.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 63 [0105.072] lstrlenW (lpString=".jpg") returned 4 [0105.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.072] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") [0105.072] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21288) returned 1 [0105.072] CloseHandle (hObject=0x1c8) returned 1 [0105.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x20 [0105.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.073] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.073] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.073] GetLastError () returned 0x0 [0105.073] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5328, lpOverlapped=0x0) returned 1 [0105.075] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5330, lpOverlapped=0x0) returned 1 [0105.076] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.077] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.077] SetEndOfFile (hFile=0x19c) returned 1 [0105.077] CloseHandle (hObject=0x19c) returned 1 [0105.077] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.077] SetEndOfFile (hFile=0x1c8) returned 1 [0105.078] CloseHandle (hObject=0x1c8) returned 1 [0105.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 1 [0105.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.079] lstrlenW (lpString=".doc") returned 4 [0105.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".docx") returned 5 [0105.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.079] lstrlenW (lpString=".pdf") returned 4 [0105.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".xls") returned 4 [0105.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.079] lstrlenW (lpString=".xlsx") returned 5 [0105.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.079] lstrlenW (lpString=".ppt") returned 4 [0105.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.079] lstrlenW (lpString=".zip") returned 4 [0105.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.079] lstrlenW (lpString=".rar") returned 4 [0105.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".bz2") returned 4 [0105.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".7z") returned 3 [0105.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.079] lstrlenW (lpString=".dbf") returned 4 [0105.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.079] lstrlenW (lpString=".1cd") returned 4 [0105.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.079] lstrlenW (lpString=".jpg") returned 4 [0105.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".pdf") returned 4 [0105.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString=".xls") returned 4 [0105.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.080] lstrlenW (lpString=".xlsx") returned 5 [0105.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.080] lstrlenW (lpString=".ppt") returned 4 [0105.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.080] lstrlenW (lpString=".zip") returned 4 [0105.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.080] lstrlenW (lpString=".rar") returned 4 [0105.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString=".bz2") returned 4 [0105.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString=".7z") returned 3 [0105.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.080] lstrlenW (lpString=".dbf") returned 4 [0105.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.080] lstrlenW (lpString=".1cd") returned 4 [0105.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 63 [0105.080] lstrlenW (lpString=".jpg") returned 4 [0105.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.080] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") [0105.081] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2240) returned 1 [0105.081] CloseHandle (hObject=0x1c8) returned 1 [0105.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x20 [0105.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.082] GetLastError () returned 0x0 [0105.082] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x8c0, lpOverlapped=0x0) returned 1 [0105.084] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x8d0, lpOverlapped=0x0) returned 1 [0105.084] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.084] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.085] SetEndOfFile (hFile=0x19c) returned 1 [0105.085] CloseHandle (hObject=0x19c) returned 1 [0105.085] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.085] SetEndOfFile (hFile=0x1c8) returned 1 [0105.086] CloseHandle (hObject=0x1c8) returned 1 [0105.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 1 [0105.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.086] lstrlenW (lpString=".doc") returned 4 [0105.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.086] lstrlenW (lpString=".docx") returned 5 [0105.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.086] lstrlenW (lpString=".pdf") returned 4 [0105.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.086] lstrlenW (lpString=".xls") returned 4 [0105.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".xlsx") returned 5 [0105.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.087] lstrlenW (lpString=".ppt") returned 4 [0105.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.087] lstrlenW (lpString=".zip") returned 4 [0105.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".rar") returned 4 [0105.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".bz2") returned 4 [0105.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".7z") returned 3 [0105.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.087] lstrlenW (lpString=".dbf") returned 4 [0105.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.087] lstrlenW (lpString=".1cd") returned 4 [0105.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.087] lstrlenW (lpString=".jpg") returned 4 [0105.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".pdf") returned 4 [0105.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".xls") returned 4 [0105.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".xlsx") returned 5 [0105.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.088] lstrlenW (lpString=".ppt") returned 4 [0105.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.088] lstrlenW (lpString=".zip") returned 4 [0105.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.088] lstrlenW (lpString=".rar") returned 4 [0105.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString=".bz2") returned 4 [0105.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString=".7z") returned 3 [0105.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.088] lstrlenW (lpString=".dbf") returned 4 [0105.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.088] lstrlenW (lpString=".1cd") returned 4 [0105.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 63 [0105.088] lstrlenW (lpString=".jpg") returned 4 [0105.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.088] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") [0105.089] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=14840) returned 1 [0105.089] CloseHandle (hObject=0x1c8) returned 1 [0105.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x20 [0105.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.089] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.089] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.090] GetLastError () returned 0x0 [0105.090] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x39f8, lpOverlapped=0x0) returned 1 [0105.092] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3a00, lpOverlapped=0x0) returned 1 [0105.093] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.093] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.093] SetEndOfFile (hFile=0x19c) returned 1 [0105.094] CloseHandle (hObject=0x19c) returned 1 [0105.094] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.094] SetEndOfFile (hFile=0x1c8) returned 1 [0105.094] CloseHandle (hObject=0x1c8) returned 1 [0105.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 1 [0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.095] lstrlenW (lpString=".doc") returned 4 [0105.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.095] lstrlenW (lpString=".docx") returned 5 [0105.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.095] lstrlenW (lpString=".pdf") returned 4 [0105.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.095] lstrlenW (lpString=".xls") returned 4 [0105.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.095] lstrlenW (lpString=".xlsx") returned 5 [0105.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.095] lstrlenW (lpString=".ppt") returned 4 [0105.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.095] lstrlenW (lpString=".zip") returned 4 [0105.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.095] lstrlenW (lpString=".rar") returned 4 [0105.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".bz2") returned 4 [0105.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".7z") returned 3 [0105.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.096] lstrlenW (lpString=".dbf") returned 4 [0105.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.096] lstrlenW (lpString=".1cd") returned 4 [0105.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.096] lstrlenW (lpString=".jpg") returned 4 [0105.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".pdf") returned 4 [0105.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".xls") returned 4 [0105.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.096] lstrlenW (lpString=".xlsx") returned 5 [0105.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.096] lstrlenW (lpString=".ppt") returned 4 [0105.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.096] lstrlenW (lpString=".zip") returned 4 [0105.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.096] lstrlenW (lpString=".rar") returned 4 [0105.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".bz2") returned 4 [0105.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.096] lstrlenW (lpString=".7z") returned 3 [0105.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.096] lstrlenW (lpString=".dbf") returned 4 [0105.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.097] lstrlenW (lpString=".1cd") returned 4 [0105.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 63 [0105.097] lstrlenW (lpString=".jpg") returned 4 [0105.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.097] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") [0105.097] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7466) returned 1 [0105.097] CloseHandle (hObject=0x1c8) returned 1 [0105.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x20 [0105.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.098] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.098] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.098] GetLastError () returned 0x0 [0105.098] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1d2a, lpOverlapped=0x0) returned 1 [0105.147] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1d30, lpOverlapped=0x0) returned 1 [0105.191] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.191] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.191] SetEndOfFile (hFile=0x19c) returned 1 [0105.191] CloseHandle (hObject=0x19c) returned 1 [0105.191] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.191] SetEndOfFile (hFile=0x1c8) returned 1 [0105.192] CloseHandle (hObject=0x1c8) returned 1 [0105.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.227] lstrlenW (lpString=".doc") returned 4 [0105.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.227] lstrlenW (lpString=".docx") returned 5 [0105.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.227] lstrlenW (lpString=".pdf") returned 4 [0105.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString=".xls") returned 4 [0105.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.228] lstrlenW (lpString=".xlsx") returned 5 [0105.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.228] lstrlenW (lpString=".ppt") returned 4 [0105.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.228] lstrlenW (lpString=".zip") returned 4 [0105.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.228] lstrlenW (lpString=".rar") returned 4 [0105.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString=".bz2") returned 4 [0105.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString=".7z") returned 3 [0105.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.228] lstrlenW (lpString=".dbf") returned 4 [0105.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.228] lstrlenW (lpString=".1cd") returned 4 [0105.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.228] lstrlenW (lpString=".jpg") returned 4 [0105.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString=".pdf") returned 4 [0105.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString=".xls") returned 4 [0105.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.228] lstrlenW (lpString=".xlsx") returned 5 [0105.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.228] lstrlenW (lpString=".ppt") returned 4 [0105.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.229] lstrlenW (lpString=".zip") returned 4 [0105.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.229] lstrlenW (lpString=".rar") returned 4 [0105.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.229] lstrlenW (lpString=".bz2") returned 4 [0105.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.229] lstrlenW (lpString=".7z") returned 3 [0105.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.229] lstrlenW (lpString=".dbf") returned 4 [0105.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.229] lstrlenW (lpString=".1cd") returned 4 [0105.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 63 [0105.229] lstrlenW (lpString=".jpg") returned 4 [0105.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.229] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") [0106.024] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6248) returned 1 [0106.024] CloseHandle (hObject=0x1a0) returned 1 [0106.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 0x20 [0106.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.031] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.031] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.292] GetLastError () returned 0x0 [0106.292] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1868, lpOverlapped=0x0) returned 1 [0106.294] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0106.295] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.295] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.295] SetEndOfFile (hFile=0x1fc) returned 1 [0106.295] CloseHandle (hObject=0x1fc) returned 1 [0106.295] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.296] SetEndOfFile (hFile=0x1a0) returned 1 [0106.296] CloseHandle (hObject=0x1a0) returned 1 [0106.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 1 [0106.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.297] lstrlenW (lpString=".doc") returned 4 [0106.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.297] lstrlenW (lpString=".docx") returned 5 [0106.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.297] lstrlenW (lpString=".pdf") returned 4 [0106.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.297] lstrlenW (lpString=".xls") returned 4 [0106.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.297] lstrlenW (lpString=".xlsx") returned 5 [0106.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.297] lstrlenW (lpString=".ppt") returned 4 [0106.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.297] lstrlenW (lpString=".zip") returned 4 [0106.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.297] lstrlenW (lpString=".rar") returned 4 [0106.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.297] lstrlenW (lpString=".bz2") returned 4 [0106.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.297] lstrlenW (lpString=".7z") returned 3 [0106.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".dbf") returned 4 [0106.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".1cd") returned 4 [0106.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".jpg") returned 4 [0106.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString=".pdf") returned 4 [0106.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString=".xls") returned 4 [0106.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.298] lstrlenW (lpString=".xlsx") returned 5 [0106.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.298] lstrlenW (lpString=".ppt") returned 4 [0106.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".zip") returned 4 [0106.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.298] lstrlenW (lpString=".rar") returned 4 [0106.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString=".bz2") returned 4 [0106.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString=".7z") returned 3 [0106.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".dbf") returned 4 [0106.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.298] lstrlenW (lpString=".1cd") returned 4 [0106.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 63 [0106.299] lstrlenW (lpString=".jpg") returned 4 [0106.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.299] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") [0106.300] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31752) returned 1 [0106.300] CloseHandle (hObject=0x1a0) returned 1 [0106.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x20 [0106.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.300] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.300] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.301] GetLastError () returned 0x0 [0106.301] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7c08, lpOverlapped=0x0) returned 1 [0106.303] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7c10, lpOverlapped=0x0) returned 1 [0106.305] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.305] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.305] SetEndOfFile (hFile=0x1fc) returned 1 [0106.305] CloseHandle (hObject=0x1fc) returned 1 [0106.305] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.305] SetEndOfFile (hFile=0x1a0) returned 1 [0106.306] CloseHandle (hObject=0x1a0) returned 1 [0106.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 1 [0106.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.306] lstrlenW (lpString=".doc") returned 4 [0106.306] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.306] lstrlenW (lpString=".docx") returned 5 [0106.306] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.306] lstrlenW (lpString=".pdf") returned 4 [0106.306] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString=".xls") returned 4 [0106.307] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString=".xlsx") returned 5 [0106.307] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.307] lstrlenW (lpString=".ppt") returned 4 [0106.307] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.307] lstrlenW (lpString=".zip") returned 4 [0106.307] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString=".rar") returned 4 [0106.307] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString=".bz2") returned 4 [0106.307] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString=".7z") returned 3 [0106.307] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.307] lstrlenW (lpString=".dbf") returned 4 [0106.307] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.307] lstrlenW (lpString=".1cd") returned 4 [0106.307] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 63 [0106.307] lstrlenW (lpString=".jpg") returned 4 [0106.307] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.307] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") [0106.308] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7765) returned 1 [0106.308] CloseHandle (hObject=0x1a0) returned 1 [0106.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 0x20 [0106.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.308] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.308] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.309] GetLastError () returned 0x0 [0106.309] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1e55, lpOverlapped=0x0) returned 1 [0106.311] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0106.312] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.312] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.312] SetEndOfFile (hFile=0x1fc) returned 1 [0106.312] CloseHandle (hObject=0x1fc) returned 1 [0106.312] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.312] SetEndOfFile (hFile=0x1a0) returned 1 [0106.313] CloseHandle (hObject=0x1a0) returned 1 [0106.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 1 [0106.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.313] lstrlenW (lpString=".doc") returned 4 [0106.313] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.313] lstrlenW (lpString=".docx") returned 5 [0106.313] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0106.313] lstrlenW (lpString=".pdf") returned 4 [0106.314] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.314] lstrlenW (lpString=".xls") returned 4 [0106.314] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.314] lstrlenW (lpString=".xlsx") returned 5 [0106.314] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0106.314] lstrlenW (lpString=".ppt") returned 4 [0106.314] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.314] lstrlenW (lpString=".zip") returned 4 [0106.314] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.314] lstrlenW (lpString=".rar") returned 4 [0106.314] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.314] lstrlenW (lpString=".bz2") returned 4 [0106.314] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.314] lstrlenW (lpString=".7z") returned 3 [0106.314] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.314] lstrlenW (lpString=".dbf") returned 4 [0106.314] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.314] lstrlenW (lpString=".1cd") returned 4 [0106.314] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 63 [0106.314] lstrlenW (lpString=".jpg") returned 4 [0106.314] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.314] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") [0106.315] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31752) returned 1 [0106.315] CloseHandle (hObject=0x1a0) returned 1 [0106.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 0x20 [0106.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.315] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.315] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.316] GetLastError () returned 0x0 [0106.316] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7c08, lpOverlapped=0x0) returned 1 [0106.318] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7c10, lpOverlapped=0x0) returned 1 [0106.319] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.319] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.319] SetEndOfFile (hFile=0x1fc) returned 1 [0106.319] CloseHandle (hObject=0x1fc) returned 1 [0106.319] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.319] SetEndOfFile (hFile=0x1a0) returned 1 [0106.320] CloseHandle (hObject=0x1a0) returned 1 [0106.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 1 [0106.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString=".doc") returned 4 [0106.321] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".docx") returned 5 [0106.321] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.321] lstrlenW (lpString=".pdf") returned 4 [0106.321] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".xls") returned 4 [0106.321] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".xlsx") returned 5 [0106.321] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.321] lstrlenW (lpString=".ppt") returned 4 [0106.321] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString=".zip") returned 4 [0106.321] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".rar") returned 4 [0106.321] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".bz2") returned 4 [0106.321] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString=".7z") returned 3 [0106.321] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString=".dbf") returned 4 [0106.321] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString=".1cd") returned 4 [0106.321] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 63 [0106.321] lstrlenW (lpString=".jpg") returned 4 [0106.321] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.322] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") [0106.323] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32184) returned 1 [0106.323] CloseHandle (hObject=0x1a0) returned 1 [0106.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x20 [0106.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.323] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.323] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.324] GetLastError () returned 0x0 [0106.324] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.326] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.327] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.327] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.327] SetEndOfFile (hFile=0x1fc) returned 1 [0106.327] CloseHandle (hObject=0x1fc) returned 1 [0106.327] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.327] SetEndOfFile (hFile=0x1a0) returned 1 [0106.328] CloseHandle (hObject=0x1a0) returned 1 [0106.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 1 [0106.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString=".doc") returned 4 [0106.329] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".docx") returned 5 [0106.329] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.329] lstrlenW (lpString=".pdf") returned 4 [0106.329] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".xls") returned 4 [0106.329] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".xlsx") returned 5 [0106.329] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.329] lstrlenW (lpString=".ppt") returned 4 [0106.329] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString=".zip") returned 4 [0106.329] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".rar") returned 4 [0106.329] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".bz2") returned 4 [0106.329] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString=".7z") returned 3 [0106.329] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString=".dbf") returned 4 [0106.329] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString=".1cd") returned 4 [0106.329] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 63 [0106.329] lstrlenW (lpString=".jpg") returned 4 [0106.329] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.330] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") [0106.330] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31968) returned 1 [0106.330] CloseHandle (hObject=0x1a0) returned 1 [0106.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x20 [0106.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.330] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.330] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.331] GetLastError () returned 0x0 [0106.331] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.338] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.340] ReadFile (in: hFile=0x1a0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.340] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.340] SetEndOfFile (hFile=0x1fc) returned 1 [0106.348] CloseHandle (hObject=0x1fc) returned 1 [0106.348] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.348] SetEndOfFile (hFile=0x1a0) returned 1 [0106.355] CloseHandle (hObject=0x1a0) returned 1 [0106.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 1 [0106.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.378] lstrlenW (lpString=".doc") returned 4 [0106.378] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.378] lstrlenW (lpString=".docx") returned 5 [0106.378] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.378] lstrlenW (lpString=".pdf") returned 4 [0106.378] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.378] lstrlenW (lpString=".xls") returned 4 [0106.378] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.383] lstrlenW (lpString=".xlsx") returned 5 [0106.383] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.383] lstrlenW (lpString=".ppt") returned 4 [0106.383] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.383] lstrlenW (lpString=".zip") returned 4 [0106.383] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.383] lstrlenW (lpString=".rar") returned 4 [0106.384] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.384] lstrlenW (lpString=".bz2") returned 4 [0106.384] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.384] lstrlenW (lpString=".7z") returned 3 [0106.384] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.384] lstrlenW (lpString=".dbf") returned 4 [0106.384] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.384] lstrlenW (lpString=".1cd") returned 4 [0106.384] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 63 [0106.384] lstrlenW (lpString=".jpg") returned 4 [0106.384] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.384] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") [0106.613] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31968) returned 1 [0106.613] CloseHandle (hObject=0x1c8) returned 1 [0106.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x20 [0106.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.621] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.621] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.622] GetLastError () returned 0x0 [0106.622] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.624] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.625] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.625] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.625] SetEndOfFile (hFile=0x22c) returned 1 [0106.625] CloseHandle (hObject=0x22c) returned 1 [0106.625] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.625] SetEndOfFile (hFile=0x1c8) returned 1 [0106.626] CloseHandle (hObject=0x1c8) returned 1 [0106.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 1 [0106.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.627] lstrlenW (lpString=".doc") returned 4 [0106.627] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".docx") returned 5 [0106.627] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.627] lstrlenW (lpString=".pdf") returned 4 [0106.627] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".xls") returned 4 [0106.627] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".xlsx") returned 5 [0106.627] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.627] lstrlenW (lpString=".ppt") returned 4 [0106.627] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.627] lstrlenW (lpString=".zip") returned 4 [0106.627] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".rar") returned 4 [0106.627] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".bz2") returned 4 [0106.627] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString=".7z") returned 3 [0106.627] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.627] lstrlenW (lpString=".dbf") returned 4 [0106.627] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.627] lstrlenW (lpString=".1cd") returned 4 [0106.627] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 63 [0106.628] lstrlenW (lpString=".jpg") returned 4 [0106.628] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.628] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") [0106.628] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32184) returned 1 [0106.628] CloseHandle (hObject=0x1c8) returned 1 [0106.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 0x20 [0106.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.629] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.629] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.629] GetLastError () returned 0x0 [0106.629] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.632] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.633] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.633] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.633] SetEndOfFile (hFile=0x22c) returned 1 [0106.633] CloseHandle (hObject=0x22c) returned 1 [0106.633] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.634] SetEndOfFile (hFile=0x1c8) returned 1 [0106.634] CloseHandle (hObject=0x1c8) returned 1 [0106.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 1 [0106.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.635] lstrlenW (lpString=".doc") returned 4 [0106.635] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".docx") returned 5 [0106.635] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.635] lstrlenW (lpString=".pdf") returned 4 [0106.635] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".xls") returned 4 [0106.635] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".xlsx") returned 5 [0106.635] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.635] lstrlenW (lpString=".ppt") returned 4 [0106.635] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.635] lstrlenW (lpString=".zip") returned 4 [0106.635] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".rar") returned 4 [0106.635] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".bz2") returned 4 [0106.635] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.635] lstrlenW (lpString=".7z") returned 3 [0106.636] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.636] lstrlenW (lpString=".dbf") returned 4 [0106.636] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.636] lstrlenW (lpString=".1cd") returned 4 [0106.636] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 63 [0106.636] lstrlenW (lpString=".jpg") returned 4 [0106.636] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.636] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") [0106.636] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31968) returned 1 [0106.637] CloseHandle (hObject=0x1c8) returned 1 [0106.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x20 [0106.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.638] GetLastError () returned 0x0 [0106.638] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.640] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.641] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.641] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.641] SetEndOfFile (hFile=0x22c) returned 1 [0106.641] CloseHandle (hObject=0x22c) returned 1 [0106.641] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.641] SetEndOfFile (hFile=0x1c8) returned 1 [0106.642] CloseHandle (hObject=0x1c8) returned 1 [0106.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 1 [0106.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.643] lstrlenW (lpString=".doc") returned 4 [0106.643] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".docx") returned 5 [0106.643] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.643] lstrlenW (lpString=".pdf") returned 4 [0106.643] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".xls") returned 4 [0106.643] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".xlsx") returned 5 [0106.643] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.643] lstrlenW (lpString=".ppt") returned 4 [0106.643] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.643] lstrlenW (lpString=".zip") returned 4 [0106.643] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".rar") returned 4 [0106.643] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".bz2") returned 4 [0106.643] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.643] lstrlenW (lpString=".7z") returned 3 [0106.643] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.643] lstrlenW (lpString=".dbf") returned 4 [0106.644] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.644] lstrlenW (lpString=".1cd") returned 4 [0106.644] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 63 [0106.644] lstrlenW (lpString=".jpg") returned 4 [0106.644] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.644] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") [0106.644] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3541) returned 1 [0106.644] CloseHandle (hObject=0x1c8) returned 1 [0106.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x20 [0106.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.645] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.645] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.646] GetLastError () returned 0x0 [0106.646] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xdd5, lpOverlapped=0x0) returned 1 [0106.647] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xde0, lpOverlapped=0x0) returned 1 [0106.648] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.648] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.648] SetEndOfFile (hFile=0x22c) returned 1 [0106.648] CloseHandle (hObject=0x22c) returned 1 [0106.648] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.648] SetEndOfFile (hFile=0x1c8) returned 1 [0106.649] CloseHandle (hObject=0x1c8) returned 1 [0106.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 1 [0106.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString=".doc") returned 4 [0106.650] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.650] lstrlenW (lpString=".docx") returned 5 [0106.650] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0106.650] lstrlenW (lpString=".pdf") returned 4 [0106.650] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.650] lstrlenW (lpString=".xls") returned 4 [0106.650] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.650] lstrlenW (lpString=".xlsx") returned 5 [0106.650] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0106.650] lstrlenW (lpString=".ppt") returned 4 [0106.650] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString=".zip") returned 4 [0106.650] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.650] lstrlenW (lpString=".rar") returned 4 [0106.650] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.650] lstrlenW (lpString=".bz2") returned 4 [0106.650] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.650] lstrlenW (lpString=".7z") returned 3 [0106.650] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString=".dbf") returned 4 [0106.650] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString=".1cd") returned 4 [0106.650] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 63 [0106.650] lstrlenW (lpString=".jpg") returned 4 [0106.650] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.650] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") [0106.651] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=31968) returned 1 [0106.651] CloseHandle (hObject=0x1c8) returned 1 [0106.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x20 [0106.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.651] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.651] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.652] GetLastError () returned 0x0 [0106.652] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.985] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.986] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.986] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.986] SetEndOfFile (hFile=0x22c) returned 1 [0106.986] CloseHandle (hObject=0x22c) returned 1 [0106.986] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.986] SetEndOfFile (hFile=0x1c8) returned 1 [0106.987] CloseHandle (hObject=0x1c8) returned 1 [0106.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 1 [0106.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString=".doc") returned 4 [0106.988] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".docx") returned 5 [0106.988] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.988] lstrlenW (lpString=".pdf") returned 4 [0106.988] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".xls") returned 4 [0106.988] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".xlsx") returned 5 [0106.988] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.988] lstrlenW (lpString=".ppt") returned 4 [0106.988] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString=".zip") returned 4 [0106.988] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".rar") returned 4 [0106.988] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".bz2") returned 4 [0106.988] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString=".7z") returned 3 [0106.988] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString=".dbf") returned 4 [0106.988] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString=".1cd") returned 4 [0106.988] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 63 [0106.988] lstrlenW (lpString=".jpg") returned 4 [0106.988] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.989] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") [0106.989] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24187) returned 1 [0106.989] CloseHandle (hObject=0x1c8) returned 1 [0106.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 0x20 [0106.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.989] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.989] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.990] GetLastError () returned 0x0 [0106.990] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5e7b, lpOverlapped=0x0) returned 1 [0106.995] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5e80, lpOverlapped=0x0) returned 1 [0106.996] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.996] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.996] SetEndOfFile (hFile=0x22c) returned 1 [0106.996] CloseHandle (hObject=0x22c) returned 1 [0106.996] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.996] SetEndOfFile (hFile=0x1c8) returned 1 [0106.997] CloseHandle (hObject=0x1c8) returned 1 [0106.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 1 [0106.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.998] lstrlenW (lpString=".doc") returned 4 [0106.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.998] lstrlenW (lpString=".docx") returned 5 [0106.998] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0106.998] lstrlenW (lpString=".pdf") returned 4 [0106.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.998] lstrlenW (lpString=".xls") returned 4 [0106.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.998] lstrlenW (lpString=".xlsx") returned 5 [0106.998] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0106.998] lstrlenW (lpString=".ppt") returned 4 [0106.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.998] lstrlenW (lpString=".zip") returned 4 [0106.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.998] lstrlenW (lpString=".rar") returned 4 [0106.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.998] lstrlenW (lpString=".bz2") returned 4 [0106.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.998] lstrlenW (lpString=".7z") returned 3 [0106.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.998] lstrlenW (lpString=".dbf") returned 4 [0106.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.998] lstrlenW (lpString=".1cd") returned 4 [0106.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 63 [0106.999] lstrlenW (lpString=".jpg") returned 4 [0106.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.999] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") [0107.000] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32132) returned 1 [0107.000] CloseHandle (hObject=0x1c8) returned 1 [0107.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x20 [0107.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.000] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.000] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.001] GetLastError () returned 0x0 [0107.001] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7d84, lpOverlapped=0x0) returned 1 [0107.013] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7d90, lpOverlapped=0x0) returned 1 [0107.015] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.015] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.015] SetEndOfFile (hFile=0x22c) returned 1 [0107.015] CloseHandle (hObject=0x22c) returned 1 [0107.015] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.015] SetEndOfFile (hFile=0x1c8) returned 1 [0107.016] CloseHandle (hObject=0x1c8) returned 1 [0107.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 1 [0107.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.016] lstrlenW (lpString=".doc") returned 4 [0107.016] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.016] lstrlenW (lpString=".docx") returned 5 [0107.017] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.017] lstrlenW (lpString=".pdf") returned 4 [0107.017] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString=".xls") returned 4 [0107.017] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString=".xlsx") returned 5 [0107.017] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.017] lstrlenW (lpString=".ppt") returned 4 [0107.017] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.017] lstrlenW (lpString=".zip") returned 4 [0107.017] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString=".rar") returned 4 [0107.017] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString=".bz2") returned 4 [0107.017] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString=".7z") returned 3 [0107.017] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.017] lstrlenW (lpString=".dbf") returned 4 [0107.017] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.017] lstrlenW (lpString=".1cd") returned 4 [0107.017] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 63 [0107.017] lstrlenW (lpString=".jpg") returned 4 [0107.017] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.017] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") [0107.018] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=24720) returned 1 [0107.018] CloseHandle (hObject=0x1c8) returned 1 [0107.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 0x20 [0107.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.018] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.018] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.019] GetLastError () returned 0x0 [0107.019] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6090, lpOverlapped=0x0) returned 1 [0107.021] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x60a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x60a0, lpOverlapped=0x0) returned 1 [0107.022] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.022] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.023] SetEndOfFile (hFile=0x22c) returned 1 [0107.023] CloseHandle (hObject=0x22c) returned 1 [0107.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.023] SetEndOfFile (hFile=0x1c8) returned 1 [0107.024] CloseHandle (hObject=0x1c8) returned 1 [0107.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 1 [0107.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.024] lstrlenW (lpString=".doc") returned 4 [0107.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.024] lstrlenW (lpString=".docx") returned 5 [0107.024] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.024] lstrlenW (lpString=".pdf") returned 4 [0107.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.024] lstrlenW (lpString=".xls") returned 4 [0107.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.024] lstrlenW (lpString=".xlsx") returned 5 [0107.024] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.024] lstrlenW (lpString=".ppt") returned 4 [0107.024] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.024] lstrlenW (lpString=".zip") returned 4 [0107.025] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.025] lstrlenW (lpString=".rar") returned 4 [0107.025] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.025] lstrlenW (lpString=".bz2") returned 4 [0107.025] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.025] lstrlenW (lpString=".7z") returned 3 [0107.025] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.025] lstrlenW (lpString=".dbf") returned 4 [0107.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.025] lstrlenW (lpString=".1cd") returned 4 [0107.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 63 [0107.025] lstrlenW (lpString=".jpg") returned 4 [0107.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.025] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") [0107.026] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=32400) returned 1 [0107.026] CloseHandle (hObject=0x1c8) returned 1 [0107.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x20 [0107.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.026] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.026] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.027] GetLastError () returned 0x0 [0107.027] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x7e90, lpOverlapped=0x0) returned 1 [0107.194] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0107.215] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.215] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.215] SetEndOfFile (hFile=0x22c) returned 1 [0107.215] CloseHandle (hObject=0x22c) returned 1 [0107.215] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.215] SetEndOfFile (hFile=0x1c8) returned 1 [0107.216] CloseHandle (hObject=0x1c8) returned 1 [0107.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 1 [0107.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.216] lstrlenW (lpString=".doc") returned 4 [0107.216] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".docx") returned 5 [0107.217] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.217] lstrlenW (lpString=".pdf") returned 4 [0107.217] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".xls") returned 4 [0107.217] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".xlsx") returned 5 [0107.217] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.217] lstrlenW (lpString=".ppt") returned 4 [0107.217] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.217] lstrlenW (lpString=".zip") returned 4 [0107.217] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".rar") returned 4 [0107.217] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".bz2") returned 4 [0107.217] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString=".7z") returned 3 [0107.217] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.217] lstrlenW (lpString=".dbf") returned 4 [0107.217] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.217] lstrlenW (lpString=".1cd") returned 4 [0107.217] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 63 [0107.217] lstrlenW (lpString=".jpg") returned 4 [0107.217] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.217] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") [0107.218] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=198648) returned 1 [0107.218] CloseHandle (hObject=0x1c8) returned 1 [0107.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x20 [0107.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.218] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.218] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.219] GetLastError () returned 0x0 [0107.219] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x307f8, lpOverlapped=0x0) returned 1 [0107.224] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x30800, lpOverlapped=0x0) returned 1 [0107.227] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.227] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.227] SetEndOfFile (hFile=0x22c) returned 1 [0107.228] CloseHandle (hObject=0x22c) returned 1 [0107.228] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.228] SetEndOfFile (hFile=0x1c8) returned 1 [0107.230] CloseHandle (hObject=0x1c8) returned 1 [0107.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 1 [0107.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.230] lstrlenW (lpString=".doc") returned 4 [0107.230] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.230] lstrlenW (lpString=".docx") returned 5 [0107.230] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.230] lstrlenW (lpString=".pdf") returned 4 [0107.231] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString=".xls") returned 4 [0107.231] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString=".xlsx") returned 5 [0107.231] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.231] lstrlenW (lpString=".ppt") returned 4 [0107.231] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.231] lstrlenW (lpString=".zip") returned 4 [0107.231] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString=".rar") returned 4 [0107.231] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString=".bz2") returned 4 [0107.231] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString=".7z") returned 3 [0107.231] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.231] lstrlenW (lpString=".dbf") returned 4 [0107.231] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.231] lstrlenW (lpString=".1cd") returned 4 [0107.231] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 63 [0107.231] lstrlenW (lpString=".jpg") returned 4 [0107.231] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.231] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") [0107.232] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=41170) returned 1 [0107.232] CloseHandle (hObject=0x1c8) returned 1 [0107.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0107.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.233] GetLastError () returned 0x0 [0107.233] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa0d2, lpOverlapped=0x0) returned 1 [0107.235] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa0e0, lpOverlapped=0x0) returned 1 [0107.237] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.237] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.237] SetEndOfFile (hFile=0x22c) returned 1 [0107.237] CloseHandle (hObject=0x22c) returned 1 [0107.237] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.237] SetEndOfFile (hFile=0x1c8) returned 1 [0107.238] CloseHandle (hObject=0x1c8) returned 1 [0107.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 1 [0107.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.238] lstrlenW (lpString=".doc") returned 4 [0107.238] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.238] lstrlenW (lpString=".docx") returned 5 [0107.238] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0107.238] lstrlenW (lpString=".pdf") returned 4 [0107.238] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.239] lstrlenW (lpString=".xls") returned 4 [0107.239] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.239] lstrlenW (lpString=".xlsx") returned 5 [0107.239] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0107.239] lstrlenW (lpString=".ppt") returned 4 [0107.239] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.239] lstrlenW (lpString=".zip") returned 4 [0107.239] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.239] lstrlenW (lpString=".rar") returned 4 [0107.239] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.239] lstrlenW (lpString=".bz2") returned 4 [0107.239] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.239] lstrlenW (lpString=".7z") returned 3 [0107.239] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.239] lstrlenW (lpString=".dbf") returned 4 [0107.239] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.239] lstrlenW (lpString=".1cd") returned 4 [0107.239] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 63 [0107.239] lstrlenW (lpString=".jpg") returned 4 [0107.239] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.239] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") [0107.240] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=50647) returned 1 [0107.240] CloseHandle (hObject=0x1c8) returned 1 [0107.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0107.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.240] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.240] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.241] GetLastError () returned 0x0 [0107.241] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc5d7, lpOverlapped=0x0) returned 1 [0107.243] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc5e0, lpOverlapped=0x0) returned 1 [0107.248] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.248] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.248] SetEndOfFile (hFile=0x22c) returned 1 [0107.248] CloseHandle (hObject=0x22c) returned 1 [0107.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.248] SetEndOfFile (hFile=0x1c8) returned 1 [0107.249] CloseHandle (hObject=0x1c8) returned 1 [0107.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 1 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString=".doc") returned 4 [0107.250] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.250] lstrlenW (lpString=".docx") returned 5 [0107.250] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0107.250] lstrlenW (lpString=".pdf") returned 4 [0107.250] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.250] lstrlenW (lpString=".xls") returned 4 [0107.250] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.250] lstrlenW (lpString=".xlsx") returned 5 [0107.250] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0107.250] lstrlenW (lpString=".ppt") returned 4 [0107.250] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString=".zip") returned 4 [0107.250] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.250] lstrlenW (lpString=".rar") returned 4 [0107.250] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.250] lstrlenW (lpString=".bz2") returned 4 [0107.250] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.250] lstrlenW (lpString=".7z") returned 3 [0107.250] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString=".dbf") returned 4 [0107.250] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString=".1cd") returned 4 [0107.250] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 63 [0107.250] lstrlenW (lpString=".jpg") returned 4 [0107.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.251] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") [0107.251] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=62520) returned 1 [0107.251] CloseHandle (hObject=0x1c8) returned 1 [0107.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0107.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.251] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.252] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.252] GetLastError () returned 0x0 [0107.252] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf438, lpOverlapped=0x0) returned 1 [0107.256] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf440, lpOverlapped=0x0) returned 1 [0107.260] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.260] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.260] SetEndOfFile (hFile=0x22c) returned 1 [0107.260] CloseHandle (hObject=0x22c) returned 1 [0107.260] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.260] SetEndOfFile (hFile=0x1c8) returned 1 [0107.261] CloseHandle (hObject=0x1c8) returned 1 [0107.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 1 [0107.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.262] lstrlenW (lpString=".doc") returned 4 [0107.262] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.262] lstrlenW (lpString=".docx") returned 5 [0107.262] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0107.262] lstrlenW (lpString=".pdf") returned 4 [0107.262] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.262] lstrlenW (lpString=".xls") returned 4 [0107.262] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.262] lstrlenW (lpString=".xlsx") returned 5 [0107.262] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0107.262] lstrlenW (lpString=".ppt") returned 4 [0107.262] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.262] lstrlenW (lpString=".zip") returned 4 [0107.262] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.262] lstrlenW (lpString=".rar") returned 4 [0107.262] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.262] lstrlenW (lpString=".bz2") returned 4 [0107.262] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.262] lstrlenW (lpString=".7z") returned 3 [0107.262] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.263] lstrlenW (lpString=".dbf") returned 4 [0107.263] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.263] lstrlenW (lpString=".1cd") returned 4 [0107.263] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 63 [0107.263] lstrlenW (lpString=".jpg") returned 4 [0107.263] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.263] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") [0107.264] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12530) returned 1 [0107.264] CloseHandle (hObject=0x1c8) returned 1 [0107.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 0x20 [0107.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.264] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.264] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.265] GetLastError () returned 0x0 [0107.265] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x30f2, lpOverlapped=0x0) returned 1 [0107.268] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0107.269] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.269] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.270] SetEndOfFile (hFile=0x22c) returned 1 [0107.270] CloseHandle (hObject=0x22c) returned 1 [0107.270] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.270] SetEndOfFile (hFile=0x1c8) returned 1 [0107.271] CloseHandle (hObject=0x1c8) returned 1 [0107.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 1 [0107.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.271] lstrlenW (lpString=".doc") returned 4 [0107.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.271] lstrlenW (lpString=".docx") returned 5 [0107.271] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.271] lstrlenW (lpString=".pdf") returned 4 [0107.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.271] lstrlenW (lpString=".xls") returned 4 [0107.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.271] lstrlenW (lpString=".xlsx") returned 5 [0107.271] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.271] lstrlenW (lpString=".ppt") returned 4 [0107.271] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.271] lstrlenW (lpString=".zip") returned 4 [0107.271] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.271] lstrlenW (lpString=".rar") returned 4 [0107.271] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.272] lstrlenW (lpString=".bz2") returned 4 [0107.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.272] lstrlenW (lpString=".7z") returned 3 [0107.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.272] lstrlenW (lpString=".dbf") returned 4 [0107.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.272] lstrlenW (lpString=".1cd") returned 4 [0107.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 63 [0107.272] lstrlenW (lpString=".jpg") returned 4 [0107.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.272] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") [0107.273] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15429) returned 1 [0107.273] CloseHandle (hObject=0x1c8) returned 1 [0107.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 0x20 [0107.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.273] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.274] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.274] GetLastError () returned 0x0 [0107.274] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c45, lpOverlapped=0x0) returned 1 [0107.276] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3c50, lpOverlapped=0x0) returned 1 [0107.277] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.277] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.277] SetEndOfFile (hFile=0x22c) returned 1 [0107.280] CloseHandle (hObject=0x22c) returned 1 [0107.280] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.280] SetEndOfFile (hFile=0x1c8) returned 1 [0107.280] CloseHandle (hObject=0x1c8) returned 1 [0107.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.281] lstrlenW (lpString=".doc") returned 4 [0107.281] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.281] lstrlenW (lpString=".docx") returned 5 [0107.281] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0107.281] lstrlenW (lpString=".pdf") returned 4 [0107.281] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.281] lstrlenW (lpString=".xls") returned 4 [0107.281] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.281] lstrlenW (lpString=".xlsx") returned 5 [0107.281] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0107.281] lstrlenW (lpString=".ppt") returned 4 [0107.281] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.281] lstrlenW (lpString=".zip") returned 4 [0107.281] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.281] lstrlenW (lpString=".rar") returned 4 [0107.281] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.281] lstrlenW (lpString=".bz2") returned 4 [0107.281] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.282] lstrlenW (lpString=".7z") returned 3 [0107.282] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.282] lstrlenW (lpString=".dbf") returned 4 [0107.282] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.282] lstrlenW (lpString=".1cd") returned 4 [0107.282] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 63 [0107.282] lstrlenW (lpString=".jpg") returned 4 [0107.282] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.282] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") [0107.282] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15478) returned 1 [0107.282] CloseHandle (hObject=0x1c8) returned 1 [0107.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x20 [0107.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.283] GetLastError () returned 0x0 [0107.283] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c76, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3c80, lpOverlapped=0x0) returned 1 [0107.336] ReadFile (in: hFile=0x1c8, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.336] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.336] SetEndOfFile (hFile=0x22c) returned 1 [0107.342] CloseHandle (hObject=0x22c) returned 1 [0107.342] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.342] SetEndOfFile (hFile=0x1c8) returned 1 [0107.343] CloseHandle (hObject=0x1c8) returned 1 [0107.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 1 [0107.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.346] lstrlenW (lpString=".doc") returned 4 [0107.346] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString=".docx") returned 5 [0107.346] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.346] lstrlenW (lpString=".pdf") returned 4 [0107.346] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString=".xls") returned 4 [0107.346] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString=".xlsx") returned 5 [0107.346] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.346] lstrlenW (lpString=".ppt") returned 4 [0107.346] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.346] lstrlenW (lpString=".zip") returned 4 [0107.346] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString=".rar") returned 4 [0107.346] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.346] lstrlenW (lpString=".bz2") returned 4 [0107.347] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.347] lstrlenW (lpString=".7z") returned 3 [0107.347] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.347] lstrlenW (lpString=".dbf") returned 4 [0107.347] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.347] lstrlenW (lpString=".1cd") returned 4 [0107.347] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 63 [0107.347] lstrlenW (lpString=".jpg") returned 4 [0107.347] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.347] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") [0107.560] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12831) returned 1 [0107.560] CloseHandle (hObject=0x22c) returned 1 [0107.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0107.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.560] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.560] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0107.561] GetLastError () returned 0x0 [0107.561] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x321f, lpOverlapped=0x0) returned 1 [0107.913] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3220, lpOverlapped=0x0) returned 1 [0107.914] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.916] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.916] SetEndOfFile (hFile=0x1b8) returned 1 [0107.916] CloseHandle (hObject=0x1b8) returned 1 [0107.917] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.917] SetEndOfFile (hFile=0x22c) returned 1 [0107.918] CloseHandle (hObject=0x22c) returned 1 [0107.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 1 [0107.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.918] lstrlenW (lpString=".doc") returned 4 [0107.918] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.918] lstrlenW (lpString=".docx") returned 5 [0107.918] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0107.918] lstrlenW (lpString=".pdf") returned 4 [0107.918] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.918] lstrlenW (lpString=".xls") returned 4 [0107.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.918] lstrlenW (lpString=".xlsx") returned 5 [0107.919] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0107.919] lstrlenW (lpString=".ppt") returned 4 [0107.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.919] lstrlenW (lpString=".zip") returned 4 [0107.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.919] lstrlenW (lpString=".rar") returned 4 [0107.919] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.919] lstrlenW (lpString=".bz2") returned 4 [0107.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.919] lstrlenW (lpString=".7z") returned 3 [0107.919] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.919] lstrlenW (lpString=".dbf") returned 4 [0107.919] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.919] lstrlenW (lpString=".1cd") returned 4 [0107.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 63 [0107.919] lstrlenW (lpString=".jpg") returned 4 [0107.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.919] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") [0108.324] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3830) returned 1 [0108.324] CloseHandle (hObject=0x180) returned 1 [0108.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 0x20 [0108.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.324] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.324] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.326] GetLastError () returned 0x0 [0108.326] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xef6, lpOverlapped=0x0) returned 1 [0108.327] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf00, lpOverlapped=0x0) returned 1 [0108.328] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.328] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0108.328] SetEndOfFile (hFile=0x1c8) returned 1 [0108.328] CloseHandle (hObject=0x1c8) returned 1 [0108.328] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.328] SetEndOfFile (hFile=0x180) returned 1 [0108.329] CloseHandle (hObject=0x180) returned 1 [0108.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 1 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString=".doc") returned 4 [0108.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString=".docx") returned 5 [0108.330] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0108.330] lstrlenW (lpString=".pdf") returned 4 [0108.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString=".xls") returned 4 [0108.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.330] lstrlenW (lpString=".xlsx") returned 5 [0108.330] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0108.330] lstrlenW (lpString=".ppt") returned 4 [0108.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString=".zip") returned 4 [0108.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.330] lstrlenW (lpString=".rar") returned 4 [0108.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString=".bz2") returned 4 [0108.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString=".7z") returned 3 [0108.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString=".dbf") returned 4 [0108.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString=".1cd") returned 4 [0108.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 59 [0108.330] lstrlenW (lpString=".jpg") returned 4 [0108.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.331] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") [0108.331] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2834) returned 1 [0108.331] CloseHandle (hObject=0x180) returned 1 [0108.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 0x20 [0108.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.332] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.332] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.333] GetLastError () returned 0x0 [0108.333] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb12, lpOverlapped=0x0) returned 1 [0108.334] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0108.335] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.335] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0108.335] SetEndOfFile (hFile=0x1c8) returned 1 [0108.335] CloseHandle (hObject=0x1c8) returned 1 [0108.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.335] SetEndOfFile (hFile=0x180) returned 1 [0108.336] CloseHandle (hObject=0x180) returned 1 [0108.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 1 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString=".doc") returned 4 [0108.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString=".docx") returned 5 [0108.337] lstrcmpiW (lpString1=".docx", lpString2="Y.WMF") returned -1 [0108.337] lstrlenW (lpString=".pdf") returned 4 [0108.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString=".xls") returned 4 [0108.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.337] lstrlenW (lpString=".xlsx") returned 5 [0108.337] lstrcmpiW (lpString1=".xlsx", lpString2="Y.WMF") returned -1 [0108.337] lstrlenW (lpString=".ppt") returned 4 [0108.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString=".zip") returned 4 [0108.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.337] lstrlenW (lpString=".rar") returned 4 [0108.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString=".bz2") returned 4 [0108.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString=".7z") returned 3 [0108.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString=".dbf") returned 4 [0108.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString=".1cd") returned 4 [0108.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 61 [0108.337] lstrlenW (lpString=".jpg") returned 4 [0108.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.338] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") [0108.339] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1772) returned 1 [0108.339] CloseHandle (hObject=0x180) returned 1 [0108.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 0x20 [0108.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0108.340] GetLastError () returned 0x0 [0108.340] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6ec, lpOverlapped=0x0) returned 1 [0108.383] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0108.384] ReadFile (in: hFile=0x180, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.384] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.384] SetEndOfFile (hFile=0x1c8) returned 1 [0108.384] CloseHandle (hObject=0x1c8) returned 1 [0108.385] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.385] SetEndOfFile (hFile=0x180) returned 1 [0108.385] CloseHandle (hObject=0x180) returned 1 [0108.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 1 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.457] lstrlenW (lpString=".doc") returned 4 [0108.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".docx") returned 5 [0108.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.458] lstrlenW (lpString=".pdf") returned 4 [0108.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".xls") returned 4 [0108.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.458] lstrlenW (lpString=".xlsx") returned 5 [0108.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.458] lstrlenW (lpString=".ppt") returned 4 [0108.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.458] lstrlenW (lpString=".zip") returned 4 [0108.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.458] lstrlenW (lpString=".rar") returned 4 [0108.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".bz2") returned 4 [0108.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".7z") returned 3 [0108.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.458] lstrlenW (lpString=".dbf") returned 4 [0108.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.458] lstrlenW (lpString=".1cd") returned 4 [0108.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.458] lstrlenW (lpString=".jpg") returned 4 [0108.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".pdf") returned 4 [0108.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.458] lstrlenW (lpString=".xls") returned 4 [0108.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.459] lstrlenW (lpString=".xlsx") returned 5 [0108.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.459] lstrlenW (lpString=".ppt") returned 4 [0108.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.459] lstrlenW (lpString=".zip") returned 4 [0108.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.459] lstrlenW (lpString=".rar") returned 4 [0108.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.459] lstrlenW (lpString=".bz2") returned 4 [0108.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.459] lstrlenW (lpString=".7z") returned 3 [0108.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.459] lstrlenW (lpString=".dbf") returned 4 [0108.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.459] lstrlenW (lpString=".1cd") returned 4 [0108.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 63 [0108.459] lstrlenW (lpString=".jpg") returned 4 [0108.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.459] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") [0108.460] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1548) returned 1 [0108.460] CloseHandle (hObject=0x1f4) returned 1 [0108.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x20 [0108.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.461] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.461] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.462] GetLastError () returned 0x0 [0108.462] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x60c, lpOverlapped=0x0) returned 1 [0108.465] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x610, lpOverlapped=0x0) returned 1 [0108.466] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.466] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.466] SetEndOfFile (hFile=0x22c) returned 1 [0108.466] CloseHandle (hObject=0x22c) returned 1 [0108.466] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.466] SetEndOfFile (hFile=0x1f4) returned 1 [0108.467] CloseHandle (hObject=0x1f4) returned 1 [0108.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 1 [0108.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.467] lstrlenW (lpString=".doc") returned 4 [0108.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.467] lstrlenW (lpString=".docx") returned 5 [0108.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.467] lstrlenW (lpString=".pdf") returned 4 [0108.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString=".xls") returned 4 [0108.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.468] lstrlenW (lpString=".xlsx") returned 5 [0108.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.468] lstrlenW (lpString=".ppt") returned 4 [0108.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.468] lstrlenW (lpString=".zip") returned 4 [0108.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.468] lstrlenW (lpString=".rar") returned 4 [0108.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString=".bz2") returned 4 [0108.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString=".7z") returned 3 [0108.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.468] lstrlenW (lpString=".dbf") returned 4 [0108.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.468] lstrlenW (lpString=".1cd") returned 4 [0108.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.468] lstrlenW (lpString=".jpg") returned 4 [0108.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString=".pdf") returned 4 [0108.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.468] lstrlenW (lpString=".xls") returned 4 [0108.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.468] lstrlenW (lpString=".xlsx") returned 5 [0108.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.468] lstrlenW (lpString=".ppt") returned 4 [0108.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.469] lstrlenW (lpString=".zip") returned 4 [0108.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.469] lstrlenW (lpString=".rar") returned 4 [0108.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.469] lstrlenW (lpString=".bz2") returned 4 [0108.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.469] lstrlenW (lpString=".7z") returned 3 [0108.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.469] lstrlenW (lpString=".dbf") returned 4 [0108.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.469] lstrlenW (lpString=".1cd") returned 4 [0108.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 63 [0108.469] lstrlenW (lpString=".jpg") returned 4 [0108.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.469] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") [0108.504] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6916) returned 1 [0108.504] CloseHandle (hObject=0x1f4) returned 1 [0108.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x20 [0108.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.504] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.504] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.505] GetLastError () returned 0x0 [0108.505] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1b04, lpOverlapped=0x0) returned 1 [0108.507] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0108.508] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.508] WriteFile (in: hFile=0x22c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.508] SetEndOfFile (hFile=0x22c) returned 1 [0108.508] CloseHandle (hObject=0x22c) returned 1 [0108.508] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.508] SetEndOfFile (hFile=0x1f4) returned 1 [0108.600] CloseHandle (hObject=0x1f4) returned 1 [0108.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 1 [0108.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.601] lstrlenW (lpString=".doc") returned 4 [0108.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.601] lstrlenW (lpString=".docx") returned 5 [0108.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.601] lstrlenW (lpString=".pdf") returned 4 [0108.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.601] lstrlenW (lpString=".xls") returned 4 [0108.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.601] lstrlenW (lpString=".xlsx") returned 5 [0108.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.601] lstrlenW (lpString=".ppt") returned 4 [0108.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.601] lstrlenW (lpString=".zip") returned 4 [0108.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.601] lstrlenW (lpString=".rar") returned 4 [0108.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.601] lstrlenW (lpString=".bz2") returned 4 [0108.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString=".7z") returned 3 [0108.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.602] lstrlenW (lpString=".dbf") returned 4 [0108.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.602] lstrlenW (lpString=".1cd") returned 4 [0108.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.602] lstrlenW (lpString=".jpg") returned 4 [0108.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString=".pdf") returned 4 [0108.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString=".xls") returned 4 [0108.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.602] lstrlenW (lpString=".xlsx") returned 5 [0108.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.602] lstrlenW (lpString=".ppt") returned 4 [0108.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.602] lstrlenW (lpString=".zip") returned 4 [0108.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.603] lstrlenW (lpString=".rar") returned 4 [0108.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString=".bz2") returned 4 [0108.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString=".7z") returned 3 [0108.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.603] lstrlenW (lpString=".dbf") returned 4 [0108.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.603] lstrlenW (lpString=".1cd") returned 4 [0108.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 63 [0108.603] lstrlenW (lpString=".jpg") returned 4 [0108.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.603] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") [0108.604] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10252) returned 1 [0108.604] CloseHandle (hObject=0x1f4) returned 1 [0108.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 0x20 [0108.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.604] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.604] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.605] GetLastError () returned 0x0 [0108.605] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x280c, lpOverlapped=0x0) returned 1 [0108.668] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2810, lpOverlapped=0x0) returned 1 [0108.672] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.672] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.672] SetEndOfFile (hFile=0x158) returned 1 [0108.688] CloseHandle (hObject=0x158) returned 1 [0108.688] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.688] SetEndOfFile (hFile=0x1f4) returned 1 [0108.689] CloseHandle (hObject=0x1f4) returned 1 [0108.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 1 [0108.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.698] lstrlenW (lpString=".doc") returned 4 [0108.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString=".docx") returned 5 [0108.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.698] lstrlenW (lpString=".pdf") returned 4 [0108.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString=".xls") returned 4 [0108.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.698] lstrlenW (lpString=".xlsx") returned 5 [0108.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.698] lstrlenW (lpString=".ppt") returned 4 [0108.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.698] lstrlenW (lpString=".zip") returned 4 [0108.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.698] lstrlenW (lpString=".rar") returned 4 [0108.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString=".bz2") returned 4 [0108.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString=".7z") returned 3 [0108.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".dbf") returned 4 [0108.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".1cd") returned 4 [0108.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".jpg") returned 4 [0108.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".pdf") returned 4 [0108.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".xls") returned 4 [0108.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.699] lstrlenW (lpString=".xlsx") returned 5 [0108.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.699] lstrlenW (lpString=".ppt") returned 4 [0108.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".zip") returned 4 [0108.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.699] lstrlenW (lpString=".rar") returned 4 [0108.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".bz2") returned 4 [0108.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".7z") returned 3 [0108.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".dbf") returned 4 [0108.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.699] lstrlenW (lpString=".1cd") returned 4 [0108.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 63 [0108.700] lstrlenW (lpString=".jpg") returned 4 [0108.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.700] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") [0108.701] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=13890) returned 1 [0108.701] CloseHandle (hObject=0x1f4) returned 1 [0108.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 0x20 [0108.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.701] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.701] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.702] GetLastError () returned 0x0 [0108.702] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3642, lpOverlapped=0x0) returned 1 [0108.703] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3650, lpOverlapped=0x0) returned 1 [0108.704] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.704] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.704] SetEndOfFile (hFile=0x158) returned 1 [0108.705] CloseHandle (hObject=0x158) returned 1 [0108.705] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.705] SetEndOfFile (hFile=0x1f4) returned 1 [0108.706] CloseHandle (hObject=0x1f4) returned 1 [0108.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 1 [0108.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.706] lstrlenW (lpString=".doc") returned 4 [0108.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.706] lstrlenW (lpString=".docx") returned 5 [0108.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.706] lstrlenW (lpString=".pdf") returned 4 [0108.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.706] lstrlenW (lpString=".xls") returned 4 [0108.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.706] lstrlenW (lpString=".xlsx") returned 5 [0108.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.706] lstrlenW (lpString=".ppt") returned 4 [0108.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.706] lstrlenW (lpString=".zip") returned 4 [0108.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.706] lstrlenW (lpString=".rar") returned 4 [0108.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.706] lstrlenW (lpString=".bz2") returned 4 [0108.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.706] lstrlenW (lpString=".7z") returned 3 [0108.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".dbf") returned 4 [0108.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".1cd") returned 4 [0108.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".jpg") returned 4 [0108.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".pdf") returned 4 [0108.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".xls") returned 4 [0108.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.707] lstrlenW (lpString=".xlsx") returned 5 [0108.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.707] lstrlenW (lpString=".ppt") returned 4 [0108.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".zip") returned 4 [0108.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.707] lstrlenW (lpString=".rar") returned 4 [0108.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".bz2") returned 4 [0108.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".7z") returned 3 [0108.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".dbf") returned 4 [0108.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.707] lstrlenW (lpString=".1cd") returned 4 [0108.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 63 [0108.708] lstrlenW (lpString=".jpg") returned 4 [0108.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.708] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") [0108.708] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=18286) returned 1 [0108.708] CloseHandle (hObject=0x1f4) returned 1 [0108.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 0x20 [0108.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.709] GetLastError () returned 0x0 [0108.709] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x476e, lpOverlapped=0x0) returned 1 [0108.711] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4770, lpOverlapped=0x0) returned 1 [0108.712] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.712] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.712] SetEndOfFile (hFile=0x158) returned 1 [0108.712] CloseHandle (hObject=0x158) returned 1 [0108.712] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.712] SetEndOfFile (hFile=0x1f4) returned 1 [0108.713] CloseHandle (hObject=0x1f4) returned 1 [0108.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 1 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString=".doc") returned 4 [0108.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString=".docx") returned 5 [0108.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.714] lstrlenW (lpString=".pdf") returned 4 [0108.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString=".xls") returned 4 [0108.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.714] lstrlenW (lpString=".xlsx") returned 5 [0108.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.714] lstrlenW (lpString=".ppt") returned 4 [0108.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString=".zip") returned 4 [0108.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.714] lstrlenW (lpString=".rar") returned 4 [0108.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString=".bz2") returned 4 [0108.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString=".7z") returned 3 [0108.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString=".dbf") returned 4 [0108.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString=".1cd") returned 4 [0108.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.714] lstrlenW (lpString=".jpg") returned 4 [0108.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".pdf") returned 4 [0108.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".xls") returned 4 [0108.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.715] lstrlenW (lpString=".xlsx") returned 5 [0108.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.715] lstrlenW (lpString=".ppt") returned 4 [0108.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.715] lstrlenW (lpString=".zip") returned 4 [0108.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.715] lstrlenW (lpString=".rar") returned 4 [0108.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".bz2") returned 4 [0108.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".7z") returned 3 [0108.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.715] lstrlenW (lpString=".dbf") returned 4 [0108.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.715] lstrlenW (lpString=".1cd") returned 4 [0108.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 63 [0108.715] lstrlenW (lpString=".jpg") returned 4 [0108.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.715] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") [0108.716] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=55520) returned 1 [0108.716] CloseHandle (hObject=0x1f4) returned 1 [0108.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 0x20 [0108.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.716] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.716] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.717] GetLastError () returned 0x0 [0108.717] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd8e0, lpOverlapped=0x0) returned 1 [0108.731] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd8f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd8f0, lpOverlapped=0x0) returned 1 [0108.733] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.733] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.733] SetEndOfFile (hFile=0x158) returned 1 [0108.733] CloseHandle (hObject=0x158) returned 1 [0108.733] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.733] SetEndOfFile (hFile=0x1f4) returned 1 [0108.734] CloseHandle (hObject=0x1f4) returned 1 [0108.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.735] lstrlenW (lpString=".doc") returned 4 [0108.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.735] lstrlenW (lpString=".docx") returned 5 [0108.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.735] lstrlenW (lpString=".pdf") returned 4 [0108.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.735] lstrlenW (lpString=".xls") returned 4 [0108.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.735] lstrlenW (lpString=".xlsx") returned 5 [0108.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.735] lstrlenW (lpString=".ppt") returned 4 [0108.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.735] lstrlenW (lpString=".zip") returned 4 [0108.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.735] lstrlenW (lpString=".rar") returned 4 [0108.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.735] lstrlenW (lpString=".bz2") returned 4 [0108.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.735] lstrlenW (lpString=".7z") returned 3 [0108.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".dbf") returned 4 [0108.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".1cd") returned 4 [0108.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".jpg") returned 4 [0108.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString=".pdf") returned 4 [0108.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString=".xls") returned 4 [0108.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.736] lstrlenW (lpString=".xlsx") returned 5 [0108.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.736] lstrlenW (lpString=".ppt") returned 4 [0108.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".zip") returned 4 [0108.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.736] lstrlenW (lpString=".rar") returned 4 [0108.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString=".bz2") returned 4 [0108.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString=".7z") returned 3 [0108.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".dbf") returned 4 [0108.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.736] lstrlenW (lpString=".1cd") returned 4 [0108.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 63 [0108.737] lstrlenW (lpString=".jpg") returned 4 [0108.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.737] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") [0108.737] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=61002) returned 1 [0108.737] CloseHandle (hObject=0x1f4) returned 1 [0108.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 0x20 [0108.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.737] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.738] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.738] GetLastError () returned 0x0 [0108.738] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xee4a, lpOverlapped=0x0) returned 1 [0108.845] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee50, lpOverlapped=0x0) returned 1 [0108.846] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.846] WriteFile (in: hFile=0x158, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.846] SetEndOfFile (hFile=0x158) returned 1 [0108.846] CloseHandle (hObject=0x158) returned 1 [0108.847] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.847] SetEndOfFile (hFile=0x1f4) returned 1 [0108.848] CloseHandle (hObject=0x1f4) returned 1 [0108.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 1 [0108.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.848] lstrlenW (lpString=".doc") returned 4 [0108.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.848] lstrlenW (lpString=".docx") returned 5 [0108.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.848] lstrlenW (lpString=".pdf") returned 4 [0108.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.848] lstrlenW (lpString=".xls") returned 4 [0108.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.848] lstrlenW (lpString=".xlsx") returned 5 [0108.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.848] lstrlenW (lpString=".ppt") returned 4 [0108.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.849] lstrlenW (lpString=".zip") returned 4 [0108.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.849] lstrlenW (lpString=".rar") returned 4 [0108.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString=".bz2") returned 4 [0108.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString=".7z") returned 3 [0108.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.849] lstrlenW (lpString=".dbf") returned 4 [0108.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.849] lstrlenW (lpString=".1cd") returned 4 [0108.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.849] lstrlenW (lpString=".jpg") returned 4 [0108.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString=".pdf") returned 4 [0108.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString=".xls") returned 4 [0108.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.849] lstrlenW (lpString=".xlsx") returned 5 [0108.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.849] lstrlenW (lpString=".ppt") returned 4 [0108.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.849] lstrlenW (lpString=".zip") returned 4 [0108.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.849] lstrlenW (lpString=".rar") returned 4 [0108.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.849] lstrlenW (lpString=".bz2") returned 4 [0108.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.850] lstrlenW (lpString=".7z") returned 3 [0108.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.850] lstrlenW (lpString=".dbf") returned 4 [0108.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.850] lstrlenW (lpString=".1cd") returned 4 [0108.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 63 [0108.850] lstrlenW (lpString=".jpg") returned 4 [0108.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.850] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") [0109.106] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2168) returned 1 [0109.106] CloseHandle (hObject=0x1f4) returned 1 [0109.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf")) returned 0x20 [0109.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.106] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.106] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.107] GetLastError () returned 0x0 [0109.107] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x878, lpOverlapped=0x0) returned 1 [0109.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x880, lpOverlapped=0x0) returned 1 [0109.109] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.109] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.110] SetEndOfFile (hFile=0x1a0) returned 1 [0109.110] CloseHandle (hObject=0x1a0) returned 1 [0109.110] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.110] SetEndOfFile (hFile=0x1f4) returned 1 [0109.111] CloseHandle (hObject=0x1f4) returned 1 [0109.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf")) returned 1 [0109.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.111] lstrlenW (lpString=".doc") returned 4 [0109.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.111] lstrlenW (lpString=".docx") returned 5 [0109.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.111] lstrlenW (lpString=".pdf") returned 4 [0109.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.111] lstrlenW (lpString=".xls") returned 4 [0109.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.111] lstrlenW (lpString=".xlsx") returned 5 [0109.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.111] lstrlenW (lpString=".ppt") returned 4 [0109.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.111] lstrlenW (lpString=".zip") returned 4 [0109.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.111] lstrlenW (lpString=".rar") returned 4 [0109.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.111] lstrlenW (lpString=".bz2") returned 4 [0109.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString=".7z") returned 3 [0109.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.112] lstrlenW (lpString=".dbf") returned 4 [0109.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.112] lstrlenW (lpString=".1cd") returned 4 [0109.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.112] lstrlenW (lpString=".jpg") returned 4 [0109.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString=".pdf") returned 4 [0109.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString=".xls") returned 4 [0109.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.112] lstrlenW (lpString=".xlsx") returned 5 [0109.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.112] lstrlenW (lpString=".ppt") returned 4 [0109.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.112] lstrlenW (lpString=".zip") returned 4 [0109.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.112] lstrlenW (lpString=".rar") returned 4 [0109.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString=".bz2") returned 4 [0109.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.112] lstrlenW (lpString=".7z") returned 3 [0109.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.112] lstrlenW (lpString=".dbf") returned 4 [0109.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.113] lstrlenW (lpString=".1cd") returned 4 [0109.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 63 [0109.113] lstrlenW (lpString=".jpg") returned 4 [0109.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.113] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") [0109.113] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=23020) returned 1 [0109.113] CloseHandle (hObject=0x1f4) returned 1 [0109.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf")) returned 0x20 [0109.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.114] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.114] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.114] GetLastError () returned 0x0 [0109.114] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x59ec, lpOverlapped=0x0) returned 1 [0109.118] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x59f0, lpOverlapped=0x0) returned 1 [0109.119] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.119] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.119] SetEndOfFile (hFile=0x1a0) returned 1 [0109.119] CloseHandle (hObject=0x1a0) returned 1 [0109.119] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.119] SetEndOfFile (hFile=0x1f4) returned 1 [0109.120] CloseHandle (hObject=0x1f4) returned 1 [0109.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf")) returned 1 [0109.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.121] lstrlenW (lpString=".doc") returned 4 [0109.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString=".docx") returned 5 [0109.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.121] lstrlenW (lpString=".pdf") returned 4 [0109.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString=".xls") returned 4 [0109.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.121] lstrlenW (lpString=".xlsx") returned 5 [0109.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.121] lstrlenW (lpString=".ppt") returned 4 [0109.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.121] lstrlenW (lpString=".zip") returned 4 [0109.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.121] lstrlenW (lpString=".rar") returned 4 [0109.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString=".bz2") returned 4 [0109.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString=".7z") returned 3 [0109.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.121] lstrlenW (lpString=".dbf") returned 4 [0109.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.121] lstrlenW (lpString=".1cd") returned 4 [0109.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.121] lstrlenW (lpString=".jpg") returned 4 [0109.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString=".pdf") returned 4 [0109.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString=".xls") returned 4 [0109.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.122] lstrlenW (lpString=".xlsx") returned 5 [0109.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.122] lstrlenW (lpString=".ppt") returned 4 [0109.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.122] lstrlenW (lpString=".zip") returned 4 [0109.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.122] lstrlenW (lpString=".rar") returned 4 [0109.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString=".bz2") returned 4 [0109.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString=".7z") returned 3 [0109.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.122] lstrlenW (lpString=".dbf") returned 4 [0109.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.122] lstrlenW (lpString=".1cd") returned 4 [0109.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 63 [0109.122] lstrlenW (lpString=".jpg") returned 4 [0109.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.122] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") [0109.125] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2924) returned 1 [0109.125] CloseHandle (hObject=0x1f4) returned 1 [0109.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf")) returned 0x20 [0109.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.125] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.125] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.126] GetLastError () returned 0x0 [0109.126] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb6c, lpOverlapped=0x0) returned 1 [0109.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb70, lpOverlapped=0x0) returned 1 [0109.128] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.128] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.128] SetEndOfFile (hFile=0x1a0) returned 1 [0109.128] CloseHandle (hObject=0x1a0) returned 1 [0109.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.128] SetEndOfFile (hFile=0x1f4) returned 1 [0109.129] CloseHandle (hObject=0x1f4) returned 1 [0109.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf")) returned 1 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString=".doc") returned 4 [0109.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString=".docx") returned 5 [0109.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.130] lstrlenW (lpString=".pdf") returned 4 [0109.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString=".xls") returned 4 [0109.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.130] lstrlenW (lpString=".xlsx") returned 5 [0109.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.130] lstrlenW (lpString=".ppt") returned 4 [0109.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString=".zip") returned 4 [0109.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.130] lstrlenW (lpString=".rar") returned 4 [0109.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString=".bz2") returned 4 [0109.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString=".7z") returned 3 [0109.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString=".dbf") returned 4 [0109.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString=".1cd") returned 4 [0109.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.130] lstrlenW (lpString=".jpg") returned 4 [0109.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString=".pdf") returned 4 [0109.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString=".xls") returned 4 [0109.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.131] lstrlenW (lpString=".xlsx") returned 5 [0109.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.131] lstrlenW (lpString=".ppt") returned 4 [0109.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.131] lstrlenW (lpString=".zip") returned 4 [0109.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.131] lstrlenW (lpString=".rar") returned 4 [0109.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString=".bz2") returned 4 [0109.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString=".7z") returned 3 [0109.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.131] lstrlenW (lpString=".dbf") returned 4 [0109.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.131] lstrlenW (lpString=".1cd") returned 4 [0109.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 63 [0109.131] lstrlenW (lpString=".jpg") returned 4 [0109.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.131] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") [0109.132] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2760) returned 1 [0109.132] CloseHandle (hObject=0x1f4) returned 1 [0109.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf")) returned 0x20 [0109.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.133] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.146] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.147] GetLastError () returned 0x0 [0109.147] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xac8, lpOverlapped=0x0) returned 1 [0109.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0109.181] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.181] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.181] SetEndOfFile (hFile=0x1a0) returned 1 [0109.181] CloseHandle (hObject=0x1a0) returned 1 [0109.181] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.181] SetEndOfFile (hFile=0x1f4) returned 1 [0109.182] CloseHandle (hObject=0x1f4) returned 1 [0109.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf")) returned 1 [0109.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.182] lstrlenW (lpString=".doc") returned 4 [0109.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".docx") returned 5 [0109.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.183] lstrlenW (lpString=".pdf") returned 4 [0109.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".xls") returned 4 [0109.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.183] lstrlenW (lpString=".xlsx") returned 5 [0109.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.183] lstrlenW (lpString=".ppt") returned 4 [0109.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.183] lstrlenW (lpString=".zip") returned 4 [0109.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.183] lstrlenW (lpString=".rar") returned 4 [0109.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".bz2") returned 4 [0109.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".7z") returned 3 [0109.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.183] lstrlenW (lpString=".dbf") returned 4 [0109.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.183] lstrlenW (lpString=".1cd") returned 4 [0109.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.183] lstrlenW (lpString=".jpg") returned 4 [0109.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".pdf") returned 4 [0109.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.183] lstrlenW (lpString=".xls") returned 4 [0109.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.184] lstrlenW (lpString=".xlsx") returned 5 [0109.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.184] lstrlenW (lpString=".ppt") returned 4 [0109.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.184] lstrlenW (lpString=".zip") returned 4 [0109.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.184] lstrlenW (lpString=".rar") returned 4 [0109.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.184] lstrlenW (lpString=".bz2") returned 4 [0109.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.184] lstrlenW (lpString=".7z") returned 3 [0109.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.184] lstrlenW (lpString=".dbf") returned 4 [0109.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.184] lstrlenW (lpString=".1cd") returned 4 [0109.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 63 [0109.184] lstrlenW (lpString=".jpg") returned 4 [0109.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.184] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") [0109.185] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4032) returned 1 [0109.186] CloseHandle (hObject=0x1f4) returned 1 [0109.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf")) returned 0x20 [0109.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.186] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.186] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.187] GetLastError () returned 0x0 [0109.187] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0109.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0109.344] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.344] SetEndOfFile (hFile=0x1a0) returned 1 [0109.344] CloseHandle (hObject=0x1a0) returned 1 [0109.344] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.344] SetEndOfFile (hFile=0x1f4) returned 1 [0109.345] CloseHandle (hObject=0x1f4) returned 1 [0109.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf")) returned 1 [0109.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.360] lstrlenW (lpString=".doc") returned 4 [0109.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.360] lstrlenW (lpString=".docx") returned 5 [0109.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.360] lstrlenW (lpString=".pdf") returned 4 [0109.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.360] lstrlenW (lpString=".xls") returned 4 [0109.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.360] lstrlenW (lpString=".xlsx") returned 5 [0109.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.360] lstrlenW (lpString=".ppt") returned 4 [0109.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.360] lstrlenW (lpString=".zip") returned 4 [0109.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.360] lstrlenW (lpString=".rar") returned 4 [0109.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.360] lstrlenW (lpString=".bz2") returned 4 [0109.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.360] lstrlenW (lpString=".7z") returned 3 [0109.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".dbf") returned 4 [0109.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".1cd") returned 4 [0109.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".jpg") returned 4 [0109.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString=".pdf") returned 4 [0109.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString=".xls") returned 4 [0109.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.361] lstrlenW (lpString=".xlsx") returned 5 [0109.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.361] lstrlenW (lpString=".ppt") returned 4 [0109.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".zip") returned 4 [0109.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.361] lstrlenW (lpString=".rar") returned 4 [0109.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString=".bz2") returned 4 [0109.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString=".7z") returned 3 [0109.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".dbf") returned 4 [0109.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.361] lstrlenW (lpString=".1cd") returned 4 [0109.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 63 [0109.362] lstrlenW (lpString=".jpg") returned 4 [0109.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.362] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") [0109.939] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=25346) returned 1 [0109.939] CloseHandle (hObject=0x22c) returned 1 [0109.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf")) returned 0x20 [0109.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.942] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.943] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.569] GetLastError () returned 0x0 [0110.569] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x6302, lpOverlapped=0x0) returned 1 [0110.571] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x6310, lpOverlapped=0x0) returned 1 [0110.572] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.572] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.573] SetEndOfFile (hFile=0x19c) returned 1 [0110.573] CloseHandle (hObject=0x19c) returned 1 [0110.573] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.573] SetEndOfFile (hFile=0x22c) returned 1 [0110.574] CloseHandle (hObject=0x22c) returned 1 [0110.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf")) returned 1 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.574] lstrlenW (lpString=".doc") returned 4 [0110.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.574] lstrlenW (lpString=".docx") returned 5 [0110.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.574] lstrlenW (lpString=".pdf") returned 4 [0110.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.574] lstrlenW (lpString=".xls") returned 4 [0110.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.575] lstrlenW (lpString=".xlsx") returned 5 [0110.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.575] lstrlenW (lpString=".ppt") returned 4 [0110.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.575] lstrlenW (lpString=".zip") returned 4 [0110.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.575] lstrlenW (lpString=".rar") returned 4 [0110.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString=".bz2") returned 4 [0110.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString=".7z") returned 3 [0110.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.575] lstrlenW (lpString=".dbf") returned 4 [0110.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.575] lstrlenW (lpString=".1cd") returned 4 [0110.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.575] lstrlenW (lpString=".jpg") returned 4 [0110.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString=".pdf") returned 4 [0110.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString=".xls") returned 4 [0110.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.575] lstrlenW (lpString=".xlsx") returned 5 [0110.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.575] lstrlenW (lpString=".ppt") returned 4 [0110.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.575] lstrlenW (lpString=".zip") returned 4 [0110.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.576] lstrlenW (lpString=".rar") returned 4 [0110.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.576] lstrlenW (lpString=".bz2") returned 4 [0110.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.576] lstrlenW (lpString=".7z") returned 3 [0110.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.576] lstrlenW (lpString=".dbf") returned 4 [0110.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.576] lstrlenW (lpString=".1cd") returned 4 [0110.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 63 [0110.576] lstrlenW (lpString=".jpg") returned 4 [0110.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.576] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") [0110.577] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6496) returned 1 [0110.577] CloseHandle (hObject=0x22c) returned 1 [0110.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf")) returned 0x20 [0110.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0110.577] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.577] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.578] GetLastError () returned 0x0 [0110.578] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1960, lpOverlapped=0x0) returned 1 [0110.579] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1970, lpOverlapped=0x0) returned 1 [0110.580] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.580] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.580] SetEndOfFile (hFile=0x19c) returned 1 [0110.581] CloseHandle (hObject=0x19c) returned 1 [0110.581] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.581] SetEndOfFile (hFile=0x22c) returned 1 [0110.582] CloseHandle (hObject=0x22c) returned 1 [0110.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf")) returned 1 [0110.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.582] lstrlenW (lpString=".doc") returned 4 [0110.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.582] lstrlenW (lpString=".docx") returned 5 [0110.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.583] lstrlenW (lpString=".pdf") returned 4 [0110.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString=".xls") returned 4 [0110.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.583] lstrlenW (lpString=".xlsx") returned 5 [0110.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.583] lstrlenW (lpString=".ppt") returned 4 [0110.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.583] lstrlenW (lpString=".zip") returned 4 [0110.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.583] lstrlenW (lpString=".rar") returned 4 [0110.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString=".bz2") returned 4 [0110.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString=".7z") returned 3 [0110.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.583] lstrlenW (lpString=".dbf") returned 4 [0110.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.583] lstrlenW (lpString=".1cd") returned 4 [0110.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.583] lstrlenW (lpString=".jpg") returned 4 [0110.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.583] lstrlenW (lpString=".pdf") returned 4 [0110.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString=".xls") returned 4 [0110.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.584] lstrlenW (lpString=".xlsx") returned 5 [0110.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.584] lstrlenW (lpString=".ppt") returned 4 [0110.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.584] lstrlenW (lpString=".zip") returned 4 [0110.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.584] lstrlenW (lpString=".rar") returned 4 [0110.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString=".bz2") returned 4 [0110.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString=".7z") returned 3 [0110.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.584] lstrlenW (lpString=".dbf") returned 4 [0110.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.584] lstrlenW (lpString=".1cd") returned 4 [0110.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 63 [0110.584] lstrlenW (lpString=".jpg") returned 4 [0110.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.584] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") [0110.585] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5896) returned 1 [0110.585] CloseHandle (hObject=0x22c) returned 1 [0110.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf")) returned 0x20 [0110.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0110.585] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.585] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.586] GetLastError () returned 0x0 [0110.586] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1708, lpOverlapped=0x0) returned 1 [0110.631] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1710, lpOverlapped=0x0) returned 1 [0110.632] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.632] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.632] SetEndOfFile (hFile=0x19c) returned 1 [0110.632] CloseHandle (hObject=0x19c) returned 1 [0110.632] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.632] SetEndOfFile (hFile=0x22c) returned 1 [0110.633] CloseHandle (hObject=0x22c) returned 1 [0110.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf")) returned 1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString=".doc") returned 4 [0110.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString=".docx") returned 5 [0110.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.634] lstrlenW (lpString=".pdf") returned 4 [0110.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString=".xls") returned 4 [0110.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.634] lstrlenW (lpString=".xlsx") returned 5 [0110.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.634] lstrlenW (lpString=".ppt") returned 4 [0110.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString=".zip") returned 4 [0110.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.634] lstrlenW (lpString=".rar") returned 4 [0110.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString=".bz2") returned 4 [0110.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString=".7z") returned 3 [0110.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString=".dbf") returned 4 [0110.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString=".1cd") returned 4 [0110.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.634] lstrlenW (lpString=".jpg") returned 4 [0110.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.635] lstrlenW (lpString=".pdf") returned 4 [0110.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.635] lstrlenW (lpString=".xls") returned 4 [0110.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.635] lstrlenW (lpString=".xlsx") returned 5 [0110.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.635] lstrlenW (lpString=".ppt") returned 4 [0110.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.635] lstrlenW (lpString=".zip") returned 4 [0110.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.635] lstrlenW (lpString=".rar") returned 4 [0110.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.635] lstrlenW (lpString=".bz2") returned 4 [0110.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.636] lstrlenW (lpString=".7z") returned 3 [0110.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.636] lstrlenW (lpString=".dbf") returned 4 [0110.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.636] lstrlenW (lpString=".1cd") returned 4 [0110.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 63 [0110.636] lstrlenW (lpString=".jpg") returned 4 [0110.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.636] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") [0110.637] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4708) returned 1 [0110.637] CloseHandle (hObject=0x22c) returned 1 [0110.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf")) returned 0x20 [0110.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0110.638] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.638] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.639] GetLastError () returned 0x0 [0110.639] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1264, lpOverlapped=0x0) returned 1 [0110.680] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0110.682] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.682] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.683] SetEndOfFile (hFile=0x19c) returned 1 [0110.683] CloseHandle (hObject=0x19c) returned 1 [0110.683] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.683] SetEndOfFile (hFile=0x22c) returned 1 [0110.684] CloseHandle (hObject=0x22c) returned 1 [0110.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf")) returned 1 [0110.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.684] lstrlenW (lpString=".doc") returned 4 [0110.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.684] lstrlenW (lpString=".docx") returned 5 [0110.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.684] lstrlenW (lpString=".pdf") returned 4 [0110.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.684] lstrlenW (lpString=".xls") returned 4 [0110.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.684] lstrlenW (lpString=".xlsx") returned 5 [0110.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.685] lstrlenW (lpString=".ppt") returned 4 [0110.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.685] lstrlenW (lpString=".zip") returned 4 [0110.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.685] lstrlenW (lpString=".rar") returned 4 [0110.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString=".bz2") returned 4 [0110.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString=".7z") returned 3 [0110.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.685] lstrlenW (lpString=".dbf") returned 4 [0110.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.685] lstrlenW (lpString=".1cd") returned 4 [0110.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.685] lstrlenW (lpString=".jpg") returned 4 [0110.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString=".pdf") returned 4 [0110.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString=".xls") returned 4 [0110.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.685] lstrlenW (lpString=".xlsx") returned 5 [0110.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.685] lstrlenW (lpString=".ppt") returned 4 [0110.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.685] lstrlenW (lpString=".zip") returned 4 [0110.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.686] lstrlenW (lpString=".rar") returned 4 [0110.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.686] lstrlenW (lpString=".bz2") returned 4 [0110.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.686] lstrlenW (lpString=".7z") returned 3 [0110.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.686] lstrlenW (lpString=".dbf") returned 4 [0110.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.686] lstrlenW (lpString=".1cd") returned 4 [0110.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 63 [0110.686] lstrlenW (lpString=".jpg") returned 4 [0110.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.686] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") [0110.688] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7556) returned 1 [0110.688] CloseHandle (hObject=0x22c) returned 1 [0110.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf")) returned 0x20 [0110.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0110.688] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.688] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.689] GetLastError () returned 0x0 [0110.689] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1d84, lpOverlapped=0x0) returned 1 [0110.846] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0110.847] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.847] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.847] SetEndOfFile (hFile=0x19c) returned 1 [0110.935] CloseHandle (hObject=0x19c) returned 1 [0110.935] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.935] SetEndOfFile (hFile=0x22c) returned 1 [0110.936] CloseHandle (hObject=0x22c) returned 1 [0110.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf")) returned 1 [0111.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString=".doc") returned 4 [0111.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString=".docx") returned 5 [0111.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.040] lstrlenW (lpString=".pdf") returned 4 [0111.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString=".xls") returned 4 [0111.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.040] lstrlenW (lpString=".xlsx") returned 5 [0111.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.040] lstrlenW (lpString=".ppt") returned 4 [0111.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString=".zip") returned 4 [0111.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.040] lstrlenW (lpString=".rar") returned 4 [0111.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString=".bz2") returned 4 [0111.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString=".7z") returned 3 [0111.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString=".dbf") returned 4 [0111.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString=".1cd") returned 4 [0111.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.040] lstrlenW (lpString=".jpg") returned 4 [0111.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.040] lstrlenW (lpString=".pdf") returned 4 [0111.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString=".xls") returned 4 [0111.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.041] lstrlenW (lpString=".xlsx") returned 5 [0111.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.041] lstrlenW (lpString=".ppt") returned 4 [0111.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.041] lstrlenW (lpString=".zip") returned 4 [0111.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.041] lstrlenW (lpString=".rar") returned 4 [0111.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString=".bz2") returned 4 [0111.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString=".7z") returned 3 [0111.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.041] lstrlenW (lpString=".dbf") returned 4 [0111.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.041] lstrlenW (lpString=".1cd") returned 4 [0111.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 63 [0111.041] lstrlenW (lpString=".jpg") returned 4 [0111.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.041] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") [0111.042] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9128) returned 1 [0111.042] CloseHandle (hObject=0x210) returned 1 [0111.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf")) returned 0x20 [0111.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.042] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.042] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.043] GetLastError () returned 0x0 [0111.043] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x23a8, lpOverlapped=0x0) returned 1 [0111.045] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x23b0, lpOverlapped=0x0) returned 1 [0111.046] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.046] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.046] SetEndOfFile (hFile=0x1a0) returned 1 [0111.046] CloseHandle (hObject=0x1a0) returned 1 [0111.046] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.046] SetEndOfFile (hFile=0x210) returned 1 [0111.047] CloseHandle (hObject=0x210) returned 1 [0111.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf")) returned 1 [0111.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.047] lstrlenW (lpString=".doc") returned 4 [0111.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.047] lstrlenW (lpString=".docx") returned 5 [0111.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.047] lstrlenW (lpString=".pdf") returned 4 [0111.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.047] lstrlenW (lpString=".xls") returned 4 [0111.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.047] lstrlenW (lpString=".xlsx") returned 5 [0111.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.047] lstrlenW (lpString=".ppt") returned 4 [0111.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.048] lstrlenW (lpString=".zip") returned 4 [0111.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.048] lstrlenW (lpString=".rar") returned 4 [0111.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".bz2") returned 4 [0111.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".7z") returned 3 [0111.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.048] lstrlenW (lpString=".dbf") returned 4 [0111.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.048] lstrlenW (lpString=".1cd") returned 4 [0111.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.048] lstrlenW (lpString=".jpg") returned 4 [0111.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".pdf") returned 4 [0111.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".xls") returned 4 [0111.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.048] lstrlenW (lpString=".xlsx") returned 5 [0111.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.048] lstrlenW (lpString=".ppt") returned 4 [0111.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.048] lstrlenW (lpString=".zip") returned 4 [0111.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.048] lstrlenW (lpString=".rar") returned 4 [0111.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".bz2") returned 4 [0111.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.048] lstrlenW (lpString=".7z") returned 3 [0111.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.049] lstrlenW (lpString=".dbf") returned 4 [0111.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.049] lstrlenW (lpString=".1cd") returned 4 [0111.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 63 [0111.049] lstrlenW (lpString=".jpg") returned 4 [0111.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.049] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") [0111.049] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8214) returned 1 [0111.049] CloseHandle (hObject=0x210) returned 1 [0111.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf")) returned 0x20 [0111.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.050] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.050] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.050] GetLastError () returned 0x0 [0111.050] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2016, lpOverlapped=0x0) returned 1 [0111.060] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2020, lpOverlapped=0x0) returned 1 [0111.061] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.061] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.061] SetEndOfFile (hFile=0x1a0) returned 1 [0111.061] CloseHandle (hObject=0x1a0) returned 1 [0111.061] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.061] SetEndOfFile (hFile=0x210) returned 1 [0111.062] CloseHandle (hObject=0x210) returned 1 [0111.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf")) returned 1 [0111.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.062] lstrlenW (lpString=".doc") returned 4 [0111.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.062] lstrlenW (lpString=".docx") returned 5 [0111.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.062] lstrlenW (lpString=".pdf") returned 4 [0111.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString=".xls") returned 4 [0111.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.063] lstrlenW (lpString=".xlsx") returned 5 [0111.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.063] lstrlenW (lpString=".ppt") returned 4 [0111.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.063] lstrlenW (lpString=".zip") returned 4 [0111.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.063] lstrlenW (lpString=".rar") returned 4 [0111.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString=".bz2") returned 4 [0111.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString=".7z") returned 3 [0111.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.063] lstrlenW (lpString=".dbf") returned 4 [0111.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.063] lstrlenW (lpString=".1cd") returned 4 [0111.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.063] lstrlenW (lpString=".jpg") returned 4 [0111.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString=".pdf") returned 4 [0111.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString=".xls") returned 4 [0111.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.063] lstrlenW (lpString=".xlsx") returned 5 [0111.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.063] lstrlenW (lpString=".ppt") returned 4 [0111.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.064] lstrlenW (lpString=".zip") returned 4 [0111.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.064] lstrlenW (lpString=".rar") returned 4 [0111.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.064] lstrlenW (lpString=".bz2") returned 4 [0111.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.064] lstrlenW (lpString=".7z") returned 3 [0111.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.064] lstrlenW (lpString=".dbf") returned 4 [0111.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.064] lstrlenW (lpString=".1cd") returned 4 [0111.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 63 [0111.064] lstrlenW (lpString=".jpg") returned 4 [0111.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.064] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") [0111.065] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9836) returned 1 [0111.065] CloseHandle (hObject=0x210) returned 1 [0111.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf")) returned 0x20 [0111.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.065] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.065] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.066] GetLastError () returned 0x0 [0111.066] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x266c, lpOverlapped=0x0) returned 1 [0111.072] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2670, lpOverlapped=0x0) returned 1 [0111.073] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.073] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.073] SetEndOfFile (hFile=0x1a0) returned 1 [0111.074] CloseHandle (hObject=0x1a0) returned 1 [0111.074] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.074] SetEndOfFile (hFile=0x210) returned 1 [0111.074] CloseHandle (hObject=0x210) returned 1 [0111.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf")) returned 1 [0111.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.075] lstrlenW (lpString=".doc") returned 4 [0111.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.075] lstrlenW (lpString=".docx") returned 5 [0111.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.075] lstrlenW (lpString=".pdf") returned 4 [0111.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.075] lstrlenW (lpString=".xls") returned 4 [0111.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.075] lstrlenW (lpString=".xlsx") returned 5 [0111.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.076] lstrlenW (lpString=".ppt") returned 4 [0111.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.076] lstrlenW (lpString=".zip") returned 4 [0111.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.076] lstrlenW (lpString=".rar") returned 4 [0111.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString=".bz2") returned 4 [0111.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString=".7z") returned 3 [0111.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.076] lstrlenW (lpString=".dbf") returned 4 [0111.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.076] lstrlenW (lpString=".1cd") returned 4 [0111.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.076] lstrlenW (lpString=".jpg") returned 4 [0111.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString=".pdf") returned 4 [0111.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString=".xls") returned 4 [0111.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.076] lstrlenW (lpString=".xlsx") returned 5 [0111.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.076] lstrlenW (lpString=".ppt") returned 4 [0111.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.076] lstrlenW (lpString=".zip") returned 4 [0111.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.076] lstrlenW (lpString=".rar") returned 4 [0111.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.077] lstrlenW (lpString=".bz2") returned 4 [0111.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.077] lstrlenW (lpString=".7z") returned 3 [0111.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.077] lstrlenW (lpString=".dbf") returned 4 [0111.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.077] lstrlenW (lpString=".1cd") returned 4 [0111.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 63 [0111.077] lstrlenW (lpString=".jpg") returned 4 [0111.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.077] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") [0111.078] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=11308) returned 1 [0111.078] CloseHandle (hObject=0x210) returned 1 [0111.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf")) returned 0x20 [0111.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.078] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.078] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.079] GetLastError () returned 0x0 [0111.079] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2c2c, lpOverlapped=0x0) returned 1 [0111.081] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2c30, lpOverlapped=0x0) returned 1 [0111.082] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.082] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.082] SetEndOfFile (hFile=0x1a0) returned 1 [0111.082] CloseHandle (hObject=0x1a0) returned 1 [0111.082] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.082] SetEndOfFile (hFile=0x210) returned 1 [0111.083] CloseHandle (hObject=0x210) returned 1 [0111.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf")) returned 1 [0111.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.083] lstrlenW (lpString=".doc") returned 4 [0111.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.083] lstrlenW (lpString=".docx") returned 5 [0111.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.083] lstrlenW (lpString=".pdf") returned 4 [0111.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString=".xls") returned 4 [0111.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.084] lstrlenW (lpString=".xlsx") returned 5 [0111.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.084] lstrlenW (lpString=".ppt") returned 4 [0111.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.084] lstrlenW (lpString=".zip") returned 4 [0111.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.084] lstrlenW (lpString=".rar") returned 4 [0111.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString=".bz2") returned 4 [0111.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString=".7z") returned 3 [0111.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.084] lstrlenW (lpString=".dbf") returned 4 [0111.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.084] lstrlenW (lpString=".1cd") returned 4 [0111.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.084] lstrlenW (lpString=".jpg") returned 4 [0111.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString=".pdf") returned 4 [0111.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.084] lstrlenW (lpString=".xls") returned 4 [0111.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.084] lstrlenW (lpString=".xlsx") returned 5 [0111.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.084] lstrlenW (lpString=".ppt") returned 4 [0111.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.085] lstrlenW (lpString=".zip") returned 4 [0111.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.085] lstrlenW (lpString=".rar") returned 4 [0111.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.085] lstrlenW (lpString=".bz2") returned 4 [0111.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.085] lstrlenW (lpString=".7z") returned 3 [0111.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.085] lstrlenW (lpString=".dbf") returned 4 [0111.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.085] lstrlenW (lpString=".1cd") returned 4 [0111.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 63 [0111.085] lstrlenW (lpString=".jpg") returned 4 [0111.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.085] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") [0111.086] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12490) returned 1 [0111.086] CloseHandle (hObject=0x210) returned 1 [0111.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf")) returned 0x20 [0111.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.086] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.087] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.087] GetLastError () returned 0x0 [0111.087] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x30ca, lpOverlapped=0x0) returned 1 [0111.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0111.090] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.090] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.090] SetEndOfFile (hFile=0x1a0) returned 1 [0111.090] CloseHandle (hObject=0x1a0) returned 1 [0111.090] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.091] SetEndOfFile (hFile=0x210) returned 1 [0111.091] CloseHandle (hObject=0x210) returned 1 [0111.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf")) returned 1 [0111.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.092] lstrlenW (lpString=".doc") returned 4 [0111.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString=".docx") returned 5 [0111.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.092] lstrlenW (lpString=".pdf") returned 4 [0111.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString=".xls") returned 4 [0111.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.092] lstrlenW (lpString=".xlsx") returned 5 [0111.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.092] lstrlenW (lpString=".ppt") returned 4 [0111.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.092] lstrlenW (lpString=".zip") returned 4 [0111.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.092] lstrlenW (lpString=".rar") returned 4 [0111.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString=".bz2") returned 4 [0111.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString=".7z") returned 3 [0111.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.092] lstrlenW (lpString=".dbf") returned 4 [0111.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.092] lstrlenW (lpString=".1cd") returned 4 [0111.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.093] lstrlenW (lpString=".jpg") returned 4 [0111.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString=".pdf") returned 4 [0111.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString=".xls") returned 4 [0111.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.093] lstrlenW (lpString=".xlsx") returned 5 [0111.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.093] lstrlenW (lpString=".ppt") returned 4 [0111.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.093] lstrlenW (lpString=".zip") returned 4 [0111.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.093] lstrlenW (lpString=".rar") returned 4 [0111.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString=".bz2") returned 4 [0111.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString=".7z") returned 3 [0111.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.093] lstrlenW (lpString=".dbf") returned 4 [0111.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.093] lstrlenW (lpString=".1cd") returned 4 [0111.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 63 [0111.093] lstrlenW (lpString=".jpg") returned 4 [0111.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.093] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") [0111.094] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19532) returned 1 [0111.094] CloseHandle (hObject=0x210) returned 1 [0111.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf")) returned 0x20 [0111.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.094] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.094] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.095] GetLastError () returned 0x0 [0111.095] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4c4c, lpOverlapped=0x0) returned 1 [0111.142] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0111.143] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.143] WriteFile (in: hFile=0x1a0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.143] SetEndOfFile (hFile=0x1a0) returned 1 [0111.143] CloseHandle (hObject=0x1a0) returned 1 [0111.143] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.143] SetEndOfFile (hFile=0x210) returned 1 [0111.144] CloseHandle (hObject=0x210) returned 1 [0111.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf")) returned 1 [0111.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.235] lstrlenW (lpString=".doc") returned 4 [0111.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.235] lstrlenW (lpString=".docx") returned 5 [0111.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.235] lstrlenW (lpString=".pdf") returned 4 [0111.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString=".xls") returned 4 [0111.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.236] lstrlenW (lpString=".xlsx") returned 5 [0111.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.236] lstrlenW (lpString=".ppt") returned 4 [0111.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.236] lstrlenW (lpString=".zip") returned 4 [0111.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.236] lstrlenW (lpString=".rar") returned 4 [0111.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString=".bz2") returned 4 [0111.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString=".7z") returned 3 [0111.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.236] lstrlenW (lpString=".dbf") returned 4 [0111.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.236] lstrlenW (lpString=".1cd") returned 4 [0111.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.236] lstrlenW (lpString=".jpg") returned 4 [0111.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString=".pdf") returned 4 [0111.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.236] lstrlenW (lpString=".xls") returned 4 [0111.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.237] lstrlenW (lpString=".xlsx") returned 5 [0111.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.237] lstrlenW (lpString=".ppt") returned 4 [0111.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.237] lstrlenW (lpString=".zip") returned 4 [0111.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.237] lstrlenW (lpString=".rar") returned 4 [0111.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.237] lstrlenW (lpString=".bz2") returned 4 [0111.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.237] lstrlenW (lpString=".7z") returned 3 [0111.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.237] lstrlenW (lpString=".dbf") returned 4 [0111.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.237] lstrlenW (lpString=".1cd") returned 4 [0111.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 63 [0111.237] lstrlenW (lpString=".jpg") returned 4 [0111.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.237] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") [0111.248] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2664) returned 1 [0111.248] CloseHandle (hObject=0x15c) returned 1 [0111.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf")) returned 0x20 [0111.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0111.248] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.248] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0111.249] GetLastError () returned 0x0 [0111.249] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa68, lpOverlapped=0x0) returned 1 [0111.267] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0111.268] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.269] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.270] SetEndOfFile (hFile=0x1fc) returned 1 [0111.270] CloseHandle (hObject=0x1fc) returned 1 [0111.270] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.270] SetEndOfFile (hFile=0x15c) returned 1 [0111.271] CloseHandle (hObject=0x15c) returned 1 [0111.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf")) returned 1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.271] lstrlenW (lpString=".doc") returned 4 [0111.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.271] lstrlenW (lpString=".docx") returned 5 [0111.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.272] lstrlenW (lpString=".pdf") returned 4 [0111.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString=".xls") returned 4 [0111.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.272] lstrlenW (lpString=".xlsx") returned 5 [0111.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.272] lstrlenW (lpString=".ppt") returned 4 [0111.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.272] lstrlenW (lpString=".zip") returned 4 [0111.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.272] lstrlenW (lpString=".rar") returned 4 [0111.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString=".bz2") returned 4 [0111.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString=".7z") returned 3 [0111.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.272] lstrlenW (lpString=".dbf") returned 4 [0111.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.272] lstrlenW (lpString=".1cd") returned 4 [0111.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.272] lstrlenW (lpString=".jpg") returned 4 [0111.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.272] lstrlenW (lpString=".pdf") returned 4 [0111.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString=".xls") returned 4 [0111.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.273] lstrlenW (lpString=".xlsx") returned 5 [0111.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.273] lstrlenW (lpString=".ppt") returned 4 [0111.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.273] lstrlenW (lpString=".zip") returned 4 [0111.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.273] lstrlenW (lpString=".rar") returned 4 [0111.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString=".bz2") returned 4 [0111.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString=".7z") returned 3 [0111.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.273] lstrlenW (lpString=".dbf") returned 4 [0111.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.273] lstrlenW (lpString=".1cd") returned 4 [0111.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 63 [0111.273] lstrlenW (lpString=".jpg") returned 4 [0111.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.273] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") [0111.274] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1648) returned 1 [0111.274] CloseHandle (hObject=0x15c) returned 1 [0111.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf")) returned 0x20 [0111.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0111.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0111.275] GetLastError () returned 0x0 [0111.275] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x670, lpOverlapped=0x0) returned 1 [0111.277] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x680, lpOverlapped=0x0) returned 1 [0111.278] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.278] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.278] SetEndOfFile (hFile=0x1fc) returned 1 [0111.278] CloseHandle (hObject=0x1fc) returned 1 [0111.278] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.278] SetEndOfFile (hFile=0x15c) returned 1 [0111.279] CloseHandle (hObject=0x15c) returned 1 [0111.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf")) returned 1 [0111.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.280] lstrlenW (lpString=".doc") returned 4 [0111.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString=".docx") returned 5 [0111.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.280] lstrlenW (lpString=".pdf") returned 4 [0111.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString=".xls") returned 4 [0111.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.280] lstrlenW (lpString=".xlsx") returned 5 [0111.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.280] lstrlenW (lpString=".ppt") returned 4 [0111.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.280] lstrlenW (lpString=".zip") returned 4 [0111.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.280] lstrlenW (lpString=".rar") returned 4 [0111.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString=".bz2") returned 4 [0111.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString=".7z") returned 3 [0111.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.280] lstrlenW (lpString=".dbf") returned 4 [0111.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".1cd") returned 4 [0111.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".jpg") returned 4 [0111.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString=".pdf") returned 4 [0111.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString=".xls") returned 4 [0111.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.281] lstrlenW (lpString=".xlsx") returned 5 [0111.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.281] lstrlenW (lpString=".ppt") returned 4 [0111.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".zip") returned 4 [0111.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.281] lstrlenW (lpString=".rar") returned 4 [0111.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString=".bz2") returned 4 [0111.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString=".7z") returned 3 [0111.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".dbf") returned 4 [0111.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".1cd") returned 4 [0111.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 63 [0111.281] lstrlenW (lpString=".jpg") returned 4 [0111.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.282] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") [0111.282] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1460) returned 1 [0111.282] CloseHandle (hObject=0x15c) returned 1 [0111.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf")) returned 0x20 [0111.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0111.283] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.283] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0111.283] GetLastError () returned 0x0 [0111.283] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x5b4, lpOverlapped=0x0) returned 1 [0111.286] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0111.287] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.287] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.287] SetEndOfFile (hFile=0x1fc) returned 1 [0111.287] CloseHandle (hObject=0x1fc) returned 1 [0111.287] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.287] SetEndOfFile (hFile=0x15c) returned 1 [0111.288] CloseHandle (hObject=0x15c) returned 1 [0111.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf")) returned 1 [0111.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.289] lstrlenW (lpString=".doc") returned 4 [0111.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString=".docx") returned 5 [0111.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.289] lstrlenW (lpString=".pdf") returned 4 [0111.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString=".xls") returned 4 [0111.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.289] lstrlenW (lpString=".xlsx") returned 5 [0111.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.289] lstrlenW (lpString=".ppt") returned 4 [0111.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.289] lstrlenW (lpString=".zip") returned 4 [0111.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.289] lstrlenW (lpString=".rar") returned 4 [0111.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString=".bz2") returned 4 [0111.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString=".7z") returned 3 [0111.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.289] lstrlenW (lpString=".dbf") returned 4 [0111.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.289] lstrlenW (lpString=".1cd") returned 4 [0111.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.289] lstrlenW (lpString=".jpg") returned 4 [0111.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.289] lstrlenW (lpString=".pdf") returned 4 [0111.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString=".xls") returned 4 [0111.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.290] lstrlenW (lpString=".xlsx") returned 5 [0111.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.290] lstrlenW (lpString=".ppt") returned 4 [0111.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.290] lstrlenW (lpString=".zip") returned 4 [0111.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.290] lstrlenW (lpString=".rar") returned 4 [0111.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString=".bz2") returned 4 [0111.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString=".7z") returned 3 [0111.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.290] lstrlenW (lpString=".dbf") returned 4 [0111.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.290] lstrlenW (lpString=".1cd") returned 4 [0111.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 63 [0111.290] lstrlenW (lpString=".jpg") returned 4 [0111.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.290] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") [0111.291] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1284) returned 1 [0111.291] CloseHandle (hObject=0x15c) returned 1 [0111.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf")) returned 0x20 [0111.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0111.291] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.291] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0111.292] GetLastError () returned 0x0 [0111.292] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x504, lpOverlapped=0x0) returned 1 [0111.609] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x510, lpOverlapped=0x0) returned 1 [0111.610] ReadFile (in: hFile=0x15c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.610] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.610] SetEndOfFile (hFile=0x1fc) returned 1 [0111.610] CloseHandle (hObject=0x1fc) returned 1 [0111.610] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.610] SetEndOfFile (hFile=0x15c) returned 1 [0111.611] CloseHandle (hObject=0x15c) returned 1 [0111.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf")) returned 1 [0112.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.206] lstrlenW (lpString=".doc") returned 4 [0112.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".docx") returned 5 [0112.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.207] lstrlenW (lpString=".pdf") returned 4 [0112.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".xls") returned 4 [0112.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.207] lstrlenW (lpString=".xlsx") returned 5 [0112.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.207] lstrlenW (lpString=".ppt") returned 4 [0112.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.207] lstrlenW (lpString=".zip") returned 4 [0112.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.207] lstrlenW (lpString=".rar") returned 4 [0112.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".bz2") returned 4 [0112.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".7z") returned 3 [0112.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.207] lstrlenW (lpString=".dbf") returned 4 [0112.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.207] lstrlenW (lpString=".1cd") returned 4 [0112.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.207] lstrlenW (lpString=".jpg") returned 4 [0112.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".pdf") returned 4 [0112.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.207] lstrlenW (lpString=".xls") returned 4 [0112.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.207] lstrlenW (lpString=".xlsx") returned 5 [0112.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.208] lstrlenW (lpString=".ppt") returned 4 [0112.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.208] lstrlenW (lpString=".zip") returned 4 [0112.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.208] lstrlenW (lpString=".rar") returned 4 [0112.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.208] lstrlenW (lpString=".bz2") returned 4 [0112.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.208] lstrlenW (lpString=".7z") returned 3 [0112.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.208] lstrlenW (lpString=".dbf") returned 4 [0112.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.208] lstrlenW (lpString=".1cd") returned 4 [0112.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 63 [0112.208] lstrlenW (lpString=".jpg") returned 4 [0112.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.208] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") [0112.852] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=19322) returned 1 [0112.852] CloseHandle (hObject=0x210) returned 1 [0112.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf")) returned 0x20 [0112.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.853] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.853] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.854] GetLastError () returned 0x0 [0112.854] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4b7a, lpOverlapped=0x0) returned 1 [0112.861] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x4b80, lpOverlapped=0x0) returned 1 [0112.862] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.862] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.862] SetEndOfFile (hFile=0x19c) returned 1 [0112.862] CloseHandle (hObject=0x19c) returned 1 [0112.862] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.862] SetEndOfFile (hFile=0x210) returned 1 [0112.863] CloseHandle (hObject=0x210) returned 1 [0112.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf")) returned 1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString=".doc") returned 4 [0112.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString=".docx") returned 5 [0112.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.864] lstrlenW (lpString=".pdf") returned 4 [0112.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString=".xls") returned 4 [0112.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.864] lstrlenW (lpString=".xlsx") returned 5 [0112.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.864] lstrlenW (lpString=".ppt") returned 4 [0112.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString=".zip") returned 4 [0112.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.864] lstrlenW (lpString=".rar") returned 4 [0112.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString=".bz2") returned 4 [0112.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString=".7z") returned 3 [0112.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString=".dbf") returned 4 [0112.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString=".1cd") returned 4 [0112.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.864] lstrlenW (lpString=".jpg") returned 4 [0112.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString=".pdf") returned 4 [0112.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString=".xls") returned 4 [0112.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.865] lstrlenW (lpString=".xlsx") returned 5 [0112.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.865] lstrlenW (lpString=".ppt") returned 4 [0112.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.865] lstrlenW (lpString=".zip") returned 4 [0112.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.865] lstrlenW (lpString=".rar") returned 4 [0112.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString=".bz2") returned 4 [0112.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString=".7z") returned 3 [0112.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.865] lstrlenW (lpString=".dbf") returned 4 [0112.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.865] lstrlenW (lpString=".1cd") returned 4 [0112.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 63 [0112.865] lstrlenW (lpString=".jpg") returned 4 [0112.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.865] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") [0112.866] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2582) returned 1 [0112.866] CloseHandle (hObject=0x210) returned 1 [0112.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf")) returned 0x20 [0112.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.866] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.867] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.867] GetLastError () returned 0x0 [0112.867] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa16, lpOverlapped=0x0) returned 1 [0112.869] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa20, lpOverlapped=0x0) returned 1 [0112.870] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.870] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.870] SetEndOfFile (hFile=0x19c) returned 1 [0112.870] CloseHandle (hObject=0x19c) returned 1 [0112.870] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.870] SetEndOfFile (hFile=0x210) returned 1 [0112.871] CloseHandle (hObject=0x210) returned 1 [0112.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf")) returned 1 [0112.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.871] lstrlenW (lpString=".doc") returned 4 [0112.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString=".docx") returned 5 [0112.872] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0112.872] lstrlenW (lpString=".pdf") returned 4 [0112.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString=".xls") returned 4 [0112.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.872] lstrlenW (lpString=".xlsx") returned 5 [0112.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0112.872] lstrlenW (lpString=".ppt") returned 4 [0112.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.872] lstrlenW (lpString=".zip") returned 4 [0112.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.872] lstrlenW (lpString=".rar") returned 4 [0112.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString=".bz2") returned 4 [0112.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString=".7z") returned 3 [0112.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.872] lstrlenW (lpString=".dbf") returned 4 [0112.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.872] lstrlenW (lpString=".1cd") returned 4 [0112.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 62 [0112.872] lstrlenW (lpString=".jpg") returned 4 [0112.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.872] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") [0112.874] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1264) returned 1 [0112.874] CloseHandle (hObject=0x210) returned 1 [0112.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf")) returned 0x20 [0112.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.874] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.874] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.875] GetLastError () returned 0x0 [0112.875] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x4f0, lpOverlapped=0x0) returned 1 [0112.876] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x500, lpOverlapped=0x0) returned 1 [0112.877] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.878] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.878] SetEndOfFile (hFile=0x19c) returned 1 [0112.878] CloseHandle (hObject=0x19c) returned 1 [0112.878] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.878] SetEndOfFile (hFile=0x210) returned 1 [0112.879] CloseHandle (hObject=0x210) returned 1 [0112.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf")) returned 1 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.879] lstrlenW (lpString=".doc") returned 4 [0112.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.879] lstrlenW (lpString=".docx") returned 5 [0112.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.879] lstrlenW (lpString=".pdf") returned 4 [0112.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.879] lstrlenW (lpString=".xls") returned 4 [0112.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.879] lstrlenW (lpString=".xlsx") returned 5 [0112.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.879] lstrlenW (lpString=".ppt") returned 4 [0112.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.879] lstrlenW (lpString=".zip") returned 4 [0112.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.880] lstrlenW (lpString=".rar") returned 4 [0112.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".bz2") returned 4 [0112.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".7z") returned 3 [0112.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.880] lstrlenW (lpString=".dbf") returned 4 [0112.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.880] lstrlenW (lpString=".1cd") returned 4 [0112.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.880] lstrlenW (lpString=".jpg") returned 4 [0112.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".pdf") returned 4 [0112.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".xls") returned 4 [0112.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.880] lstrlenW (lpString=".xlsx") returned 5 [0112.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.880] lstrlenW (lpString=".ppt") returned 4 [0112.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.880] lstrlenW (lpString=".zip") returned 4 [0112.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.880] lstrlenW (lpString=".rar") returned 4 [0112.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".bz2") returned 4 [0112.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.880] lstrlenW (lpString=".7z") returned 3 [0112.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.881] lstrlenW (lpString=".dbf") returned 4 [0112.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.881] lstrlenW (lpString=".1cd") returned 4 [0112.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 63 [0112.881] lstrlenW (lpString=".jpg") returned 4 [0112.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.881] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") [0112.881] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6212) returned 1 [0112.882] CloseHandle (hObject=0x210) returned 1 [0112.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf")) returned 0x20 [0112.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.882] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.882] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.883] GetLastError () returned 0x0 [0112.883] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1844, lpOverlapped=0x0) returned 1 [0112.884] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0112.885] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.885] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.885] SetEndOfFile (hFile=0x19c) returned 1 [0112.885] CloseHandle (hObject=0x19c) returned 1 [0112.885] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.885] SetEndOfFile (hFile=0x210) returned 1 [0112.886] CloseHandle (hObject=0x210) returned 1 [0112.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf")) returned 1 [0112.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.887] lstrlenW (lpString=".doc") returned 4 [0112.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString=".docx") returned 5 [0112.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.887] lstrlenW (lpString=".pdf") returned 4 [0112.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString=".xls") returned 4 [0112.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.887] lstrlenW (lpString=".xlsx") returned 5 [0112.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.887] lstrlenW (lpString=".ppt") returned 4 [0112.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.887] lstrlenW (lpString=".zip") returned 4 [0112.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.887] lstrlenW (lpString=".rar") returned 4 [0112.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString=".bz2") returned 4 [0112.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString=".7z") returned 3 [0112.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.887] lstrlenW (lpString=".dbf") returned 4 [0112.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.887] lstrlenW (lpString=".1cd") returned 4 [0112.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.888] lstrlenW (lpString=".jpg") returned 4 [0112.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString=".pdf") returned 4 [0112.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString=".xls") returned 4 [0112.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.888] lstrlenW (lpString=".xlsx") returned 5 [0112.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.888] lstrlenW (lpString=".ppt") returned 4 [0112.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.888] lstrlenW (lpString=".zip") returned 4 [0112.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.888] lstrlenW (lpString=".rar") returned 4 [0112.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString=".bz2") returned 4 [0112.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString=".7z") returned 3 [0112.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.888] lstrlenW (lpString=".dbf") returned 4 [0112.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.888] lstrlenW (lpString=".1cd") returned 4 [0112.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 63 [0112.888] lstrlenW (lpString=".jpg") returned 4 [0112.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.888] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") [0112.890] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2076) returned 1 [0112.890] CloseHandle (hObject=0x210) returned 1 [0112.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf")) returned 0x20 [0112.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.890] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.890] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.891] GetLastError () returned 0x0 [0112.891] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x81c, lpOverlapped=0x0) returned 1 [0112.892] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x820, lpOverlapped=0x0) returned 1 [0112.893] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.893] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.893] SetEndOfFile (hFile=0x19c) returned 1 [0112.894] CloseHandle (hObject=0x19c) returned 1 [0112.894] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.894] SetEndOfFile (hFile=0x210) returned 1 [0112.894] CloseHandle (hObject=0x210) returned 1 [0112.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf")) returned 1 [0112.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.895] lstrlenW (lpString=".doc") returned 4 [0112.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.895] lstrlenW (lpString=".docx") returned 5 [0112.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.895] lstrlenW (lpString=".pdf") returned 4 [0112.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.895] lstrlenW (lpString=".xls") returned 4 [0112.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.895] lstrlenW (lpString=".xlsx") returned 5 [0112.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.895] lstrlenW (lpString=".ppt") returned 4 [0112.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.895] lstrlenW (lpString=".zip") returned 4 [0112.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.895] lstrlenW (lpString=".rar") returned 4 [0112.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.895] lstrlenW (lpString=".bz2") returned 4 [0112.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.895] lstrlenW (lpString=".7z") returned 3 [0112.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".dbf") returned 4 [0112.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".1cd") returned 4 [0112.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".jpg") returned 4 [0112.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString=".pdf") returned 4 [0112.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString=".xls") returned 4 [0112.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.896] lstrlenW (lpString=".xlsx") returned 5 [0112.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.896] lstrlenW (lpString=".ppt") returned 4 [0112.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".zip") returned 4 [0112.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.896] lstrlenW (lpString=".rar") returned 4 [0112.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString=".bz2") returned 4 [0112.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString=".7z") returned 3 [0112.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".dbf") returned 4 [0112.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.896] lstrlenW (lpString=".1cd") returned 4 [0112.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 63 [0112.897] lstrlenW (lpString=".jpg") returned 4 [0112.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.897] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") [0112.898] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5138) returned 1 [0112.898] CloseHandle (hObject=0x210) returned 1 [0112.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf")) returned 0x20 [0112.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.898] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.898] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.899] GetLastError () returned 0x0 [0112.899] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1412, lpOverlapped=0x0) returned 1 [0112.901] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1420, lpOverlapped=0x0) returned 1 [0112.902] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.902] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.902] SetEndOfFile (hFile=0x19c) returned 1 [0112.902] CloseHandle (hObject=0x19c) returned 1 [0112.903] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.903] SetEndOfFile (hFile=0x210) returned 1 [0112.903] CloseHandle (hObject=0x210) returned 1 [0112.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf")) returned 1 [0112.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.904] lstrlenW (lpString=".doc") returned 4 [0112.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.904] lstrlenW (lpString=".docx") returned 5 [0112.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.904] lstrlenW (lpString=".pdf") returned 4 [0112.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.904] lstrlenW (lpString=".xls") returned 4 [0112.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.904] lstrlenW (lpString=".xlsx") returned 5 [0112.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.904] lstrlenW (lpString=".ppt") returned 4 [0112.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.904] lstrlenW (lpString=".zip") returned 4 [0112.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.904] lstrlenW (lpString=".rar") returned 4 [0112.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.904] lstrlenW (lpString=".bz2") returned 4 [0112.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.904] lstrlenW (lpString=".7z") returned 3 [0112.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".dbf") returned 4 [0112.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".1cd") returned 4 [0112.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".jpg") returned 4 [0112.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString=".pdf") returned 4 [0112.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString=".xls") returned 4 [0112.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.905] lstrlenW (lpString=".xlsx") returned 5 [0112.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.905] lstrlenW (lpString=".ppt") returned 4 [0112.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".zip") returned 4 [0112.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.905] lstrlenW (lpString=".rar") returned 4 [0112.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString=".bz2") returned 4 [0112.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString=".7z") returned 3 [0112.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".dbf") returned 4 [0112.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.905] lstrlenW (lpString=".1cd") returned 4 [0112.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 63 [0112.906] lstrlenW (lpString=".jpg") returned 4 [0112.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.906] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") [0112.906] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1292) returned 1 [0112.906] CloseHandle (hObject=0x210) returned 1 [0112.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf")) returned 0x20 [0112.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.907] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.907] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.907] GetLastError () returned 0x0 [0112.907] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x50c, lpOverlapped=0x0) returned 1 [0112.909] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x510, lpOverlapped=0x0) returned 1 [0112.910] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.910] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.910] SetEndOfFile (hFile=0x19c) returned 1 [0112.910] CloseHandle (hObject=0x19c) returned 1 [0112.910] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.910] SetEndOfFile (hFile=0x210) returned 1 [0112.911] CloseHandle (hObject=0x210) returned 1 [0112.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf")) returned 1 [0112.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString=".doc") returned 4 [0112.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString=".docx") returned 5 [0112.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.912] lstrlenW (lpString=".pdf") returned 4 [0112.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString=".xls") returned 4 [0112.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.912] lstrlenW (lpString=".xlsx") returned 5 [0112.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.912] lstrlenW (lpString=".ppt") returned 4 [0112.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString=".zip") returned 4 [0112.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.912] lstrlenW (lpString=".rar") returned 4 [0112.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString=".bz2") returned 4 [0112.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString=".7z") returned 3 [0112.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString=".dbf") returned 4 [0112.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString=".1cd") returned 4 [0112.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.912] lstrlenW (lpString=".jpg") returned 4 [0112.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.912] lstrlenW (lpString=".pdf") returned 4 [0112.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString=".xls") returned 4 [0112.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.913] lstrlenW (lpString=".xlsx") returned 5 [0112.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.913] lstrlenW (lpString=".ppt") returned 4 [0112.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.913] lstrlenW (lpString=".zip") returned 4 [0112.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.913] lstrlenW (lpString=".rar") returned 4 [0112.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString=".bz2") returned 4 [0112.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString=".7z") returned 3 [0112.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.913] lstrlenW (lpString=".dbf") returned 4 [0112.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.913] lstrlenW (lpString=".1cd") returned 4 [0112.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 63 [0112.913] lstrlenW (lpString=".jpg") returned 4 [0112.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.913] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") [0112.914] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1912) returned 1 [0112.914] CloseHandle (hObject=0x210) returned 1 [0112.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf")) returned 0x20 [0112.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.914] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.914] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.915] GetLastError () returned 0x0 [0112.915] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x778, lpOverlapped=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x780, lpOverlapped=0x0) returned 1 [0112.917] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.917] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.917] SetEndOfFile (hFile=0x19c) returned 1 [0112.917] CloseHandle (hObject=0x19c) returned 1 [0112.917] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.918] SetEndOfFile (hFile=0x210) returned 1 [0112.918] CloseHandle (hObject=0x210) returned 1 [0112.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf")) returned 1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.919] lstrlenW (lpString=".doc") returned 4 [0112.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString=".docx") returned 5 [0112.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.919] lstrlenW (lpString=".pdf") returned 4 [0112.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString=".xls") returned 4 [0112.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.919] lstrlenW (lpString=".xlsx") returned 5 [0112.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.919] lstrlenW (lpString=".ppt") returned 4 [0112.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.919] lstrlenW (lpString=".zip") returned 4 [0112.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.919] lstrlenW (lpString=".rar") returned 4 [0112.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString=".bz2") returned 4 [0112.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString=".7z") returned 3 [0112.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.919] lstrlenW (lpString=".dbf") returned 4 [0112.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.919] lstrlenW (lpString=".1cd") returned 4 [0112.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.920] lstrlenW (lpString=".jpg") returned 4 [0112.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString=".pdf") returned 4 [0112.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString=".xls") returned 4 [0112.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.920] lstrlenW (lpString=".xlsx") returned 5 [0112.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.920] lstrlenW (lpString=".ppt") returned 4 [0112.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.920] lstrlenW (lpString=".zip") returned 4 [0112.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.920] lstrlenW (lpString=".rar") returned 4 [0112.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString=".bz2") returned 4 [0112.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString=".7z") returned 3 [0112.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.920] lstrlenW (lpString=".dbf") returned 4 [0112.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.920] lstrlenW (lpString=".1cd") returned 4 [0112.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 63 [0112.920] lstrlenW (lpString=".jpg") returned 4 [0112.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.920] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") [0112.921] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8340) returned 1 [0112.921] CloseHandle (hObject=0x210) returned 1 [0112.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf")) returned 0x20 [0112.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.921] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.921] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.922] GetLastError () returned 0x0 [0112.922] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2094, lpOverlapped=0x0) returned 1 [0112.924] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x20a0, lpOverlapped=0x0) returned 1 [0112.925] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.925] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.925] SetEndOfFile (hFile=0x19c) returned 1 [0112.925] CloseHandle (hObject=0x19c) returned 1 [0112.925] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.925] SetEndOfFile (hFile=0x210) returned 1 [0112.926] CloseHandle (hObject=0x210) returned 1 [0112.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf")) returned 1 [0112.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.926] lstrlenW (lpString=".doc") returned 4 [0112.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.926] lstrlenW (lpString=".docx") returned 5 [0112.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.926] lstrlenW (lpString=".pdf") returned 4 [0112.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.926] lstrlenW (lpString=".xls") returned 4 [0112.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.926] lstrlenW (lpString=".xlsx") returned 5 [0112.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.927] lstrlenW (lpString=".ppt") returned 4 [0112.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.927] lstrlenW (lpString=".zip") returned 4 [0112.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.927] lstrlenW (lpString=".rar") returned 4 [0112.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString=".bz2") returned 4 [0112.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString=".7z") returned 3 [0112.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.927] lstrlenW (lpString=".dbf") returned 4 [0112.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.927] lstrlenW (lpString=".1cd") returned 4 [0112.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.927] lstrlenW (lpString=".jpg") returned 4 [0112.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString=".pdf") returned 4 [0112.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString=".xls") returned 4 [0112.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.927] lstrlenW (lpString=".xlsx") returned 5 [0112.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.927] lstrlenW (lpString=".ppt") returned 4 [0112.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.927] lstrlenW (lpString=".zip") returned 4 [0112.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.927] lstrlenW (lpString=".rar") returned 4 [0112.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.928] lstrlenW (lpString=".bz2") returned 4 [0112.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.928] lstrlenW (lpString=".7z") returned 3 [0112.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.928] lstrlenW (lpString=".dbf") returned 4 [0112.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.928] lstrlenW (lpString=".1cd") returned 4 [0112.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 63 [0112.928] lstrlenW (lpString=".jpg") returned 4 [0112.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.928] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") [0112.928] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=12252) returned 1 [0112.929] CloseHandle (hObject=0x210) returned 1 [0112.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf")) returned 0x20 [0112.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0112.929] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.929] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.930] GetLastError () returned 0x0 [0112.930] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2fdc, lpOverlapped=0x0) returned 1 [0112.996] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2fe0, lpOverlapped=0x0) returned 1 [0112.997] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.997] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.997] SetEndOfFile (hFile=0x19c) returned 1 [0113.039] CloseHandle (hObject=0x19c) returned 1 [0113.039] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.040] SetEndOfFile (hFile=0x210) returned 1 [0113.040] CloseHandle (hObject=0x210) returned 1 [0113.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf")) returned 1 [0113.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.540] lstrlenW (lpString=".doc") returned 4 [0113.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.540] lstrlenW (lpString=".docx") returned 5 [0113.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.540] lstrlenW (lpString=".pdf") returned 4 [0113.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.540] lstrlenW (lpString=".xls") returned 4 [0113.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.540] lstrlenW (lpString=".xlsx") returned 5 [0113.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.540] lstrlenW (lpString=".ppt") returned 4 [0113.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.540] lstrlenW (lpString=".zip") returned 4 [0113.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.540] lstrlenW (lpString=".rar") returned 4 [0113.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.540] lstrlenW (lpString=".bz2") returned 4 [0113.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.540] lstrlenW (lpString=".7z") returned 3 [0113.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.541] lstrlenW (lpString=".dbf") returned 4 [0113.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.541] lstrlenW (lpString=".1cd") returned 4 [0113.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.541] lstrlenW (lpString=".jpg") returned 4 [0113.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString=".pdf") returned 4 [0113.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString=".xls") returned 4 [0113.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.541] lstrlenW (lpString=".xlsx") returned 5 [0113.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.541] lstrlenW (lpString=".ppt") returned 4 [0113.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.541] lstrlenW (lpString=".zip") returned 4 [0113.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.541] lstrlenW (lpString=".rar") returned 4 [0113.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString=".bz2") returned 4 [0113.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.541] lstrlenW (lpString=".7z") returned 3 [0113.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.541] lstrlenW (lpString=".dbf") returned 4 [0113.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.542] lstrlenW (lpString=".1cd") returned 4 [0113.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 63 [0113.542] lstrlenW (lpString=".jpg") returned 4 [0113.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.542] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") [0113.807] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3954) returned 1 [0113.807] CloseHandle (hObject=0x210) returned 1 [0113.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf")) returned 0x20 [0113.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.825] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.825] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.831] GetLastError () returned 0x0 [0113.833] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf72, lpOverlapped=0x0) returned 1 [0113.836] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0113.836] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.836] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.837] SetEndOfFile (hFile=0x180) returned 1 [0113.837] CloseHandle (hObject=0x180) returned 1 [0113.837] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.837] SetEndOfFile (hFile=0x19c) returned 1 [0113.838] CloseHandle (hObject=0x19c) returned 1 [0113.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf")) returned 1 [0113.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.838] lstrlenW (lpString=".doc") returned 4 [0113.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.838] lstrlenW (lpString=".docx") returned 5 [0113.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.838] lstrlenW (lpString=".pdf") returned 4 [0113.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.838] lstrlenW (lpString=".xls") returned 4 [0113.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.838] lstrlenW (lpString=".xlsx") returned 5 [0113.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.838] lstrlenW (lpString=".ppt") returned 4 [0113.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.838] lstrlenW (lpString=".zip") returned 4 [0113.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.838] lstrlenW (lpString=".rar") returned 4 [0113.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".bz2") returned 4 [0113.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".7z") returned 3 [0113.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.839] lstrlenW (lpString=".dbf") returned 4 [0113.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.839] lstrlenW (lpString=".1cd") returned 4 [0113.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.839] lstrlenW (lpString=".jpg") returned 4 [0113.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".pdf") returned 4 [0113.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".xls") returned 4 [0113.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.839] lstrlenW (lpString=".xlsx") returned 5 [0113.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.839] lstrlenW (lpString=".ppt") returned 4 [0113.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.839] lstrlenW (lpString=".zip") returned 4 [0113.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.839] lstrlenW (lpString=".rar") returned 4 [0113.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".bz2") returned 4 [0113.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.839] lstrlenW (lpString=".7z") returned 3 [0113.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.839] lstrlenW (lpString=".dbf") returned 4 [0113.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.840] lstrlenW (lpString=".1cd") returned 4 [0113.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 63 [0113.840] lstrlenW (lpString=".jpg") returned 4 [0113.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.840] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") [0113.840] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10090) returned 1 [0113.840] CloseHandle (hObject=0x19c) returned 1 [0113.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf")) returned 0x20 [0113.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.841] GetLastError () returned 0x0 [0113.841] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x276a, lpOverlapped=0x0) returned 1 [0113.843] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2770, lpOverlapped=0x0) returned 1 [0113.844] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.844] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.844] SetEndOfFile (hFile=0x180) returned 1 [0113.845] CloseHandle (hObject=0x180) returned 1 [0113.845] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.845] SetEndOfFile (hFile=0x19c) returned 1 [0113.846] CloseHandle (hObject=0x19c) returned 1 [0113.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf")) returned 1 [0113.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.846] lstrlenW (lpString=".doc") returned 4 [0113.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.846] lstrlenW (lpString=".docx") returned 5 [0113.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.846] lstrlenW (lpString=".pdf") returned 4 [0113.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.846] lstrlenW (lpString=".xls") returned 4 [0113.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.846] lstrlenW (lpString=".xlsx") returned 5 [0113.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.846] lstrlenW (lpString=".ppt") returned 4 [0113.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.846] lstrlenW (lpString=".zip") returned 4 [0113.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.846] lstrlenW (lpString=".rar") returned 4 [0113.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.846] lstrlenW (lpString=".bz2") returned 4 [0113.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString=".7z") returned 3 [0113.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.847] lstrlenW (lpString=".dbf") returned 4 [0113.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.847] lstrlenW (lpString=".1cd") returned 4 [0113.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.847] lstrlenW (lpString=".jpg") returned 4 [0113.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString=".pdf") returned 4 [0113.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString=".xls") returned 4 [0113.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.847] lstrlenW (lpString=".xlsx") returned 5 [0113.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.847] lstrlenW (lpString=".ppt") returned 4 [0113.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.847] lstrlenW (lpString=".zip") returned 4 [0113.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.847] lstrlenW (lpString=".rar") returned 4 [0113.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString=".bz2") returned 4 [0113.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString=".7z") returned 3 [0113.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.847] lstrlenW (lpString=".dbf") returned 4 [0113.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.848] lstrlenW (lpString=".1cd") returned 4 [0113.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 63 [0113.848] lstrlenW (lpString=".jpg") returned 4 [0113.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.848] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") [0113.848] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8844) returned 1 [0113.848] CloseHandle (hObject=0x19c) returned 1 [0113.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf")) returned 0x20 [0113.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.849] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.849] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.849] GetLastError () returned 0x0 [0113.849] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x228c, lpOverlapped=0x0) returned 1 [0113.851] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2290, lpOverlapped=0x0) returned 1 [0113.852] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.852] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.852] SetEndOfFile (hFile=0x180) returned 1 [0113.852] CloseHandle (hObject=0x180) returned 1 [0113.852] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.852] SetEndOfFile (hFile=0x19c) returned 1 [0113.853] CloseHandle (hObject=0x19c) returned 1 [0113.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf")) returned 1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString=".doc") returned 4 [0113.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString=".docx") returned 5 [0113.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.854] lstrlenW (lpString=".pdf") returned 4 [0113.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString=".xls") returned 4 [0113.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.854] lstrlenW (lpString=".xlsx") returned 5 [0113.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.854] lstrlenW (lpString=".ppt") returned 4 [0113.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString=".zip") returned 4 [0113.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.854] lstrlenW (lpString=".rar") returned 4 [0113.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString=".bz2") returned 4 [0113.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString=".7z") returned 3 [0113.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString=".dbf") returned 4 [0113.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString=".1cd") returned 4 [0113.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.854] lstrlenW (lpString=".jpg") returned 4 [0113.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString=".pdf") returned 4 [0113.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString=".xls") returned 4 [0113.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.855] lstrlenW (lpString=".xlsx") returned 5 [0113.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.855] lstrlenW (lpString=".ppt") returned 4 [0113.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.855] lstrlenW (lpString=".zip") returned 4 [0113.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.855] lstrlenW (lpString=".rar") returned 4 [0113.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString=".bz2") returned 4 [0113.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString=".7z") returned 3 [0113.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.855] lstrlenW (lpString=".dbf") returned 4 [0113.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.855] lstrlenW (lpString=".1cd") returned 4 [0113.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 63 [0113.855] lstrlenW (lpString=".jpg") returned 4 [0113.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.855] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") [0113.856] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2556) returned 1 [0113.856] CloseHandle (hObject=0x19c) returned 1 [0113.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf")) returned 0x20 [0113.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.856] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.856] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.857] GetLastError () returned 0x0 [0113.857] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0113.858] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0113.859] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.859] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.860] SetEndOfFile (hFile=0x180) returned 1 [0113.860] CloseHandle (hObject=0x180) returned 1 [0113.860] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.860] SetEndOfFile (hFile=0x19c) returned 1 [0113.861] CloseHandle (hObject=0x19c) returned 1 [0113.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf")) returned 1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.861] lstrlenW (lpString=".doc") returned 4 [0113.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".docx") returned 5 [0113.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.861] lstrlenW (lpString=".pdf") returned 4 [0113.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".xls") returned 4 [0113.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.861] lstrlenW (lpString=".xlsx") returned 5 [0113.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.861] lstrlenW (lpString=".ppt") returned 4 [0113.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.862] lstrlenW (lpString=".zip") returned 4 [0113.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.862] lstrlenW (lpString=".rar") returned 4 [0113.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".bz2") returned 4 [0113.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".7z") returned 3 [0113.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.862] lstrlenW (lpString=".dbf") returned 4 [0113.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.862] lstrlenW (lpString=".1cd") returned 4 [0113.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.862] lstrlenW (lpString=".jpg") returned 4 [0113.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".pdf") returned 4 [0113.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".xls") returned 4 [0113.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.862] lstrlenW (lpString=".xlsx") returned 5 [0113.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.862] lstrlenW (lpString=".ppt") returned 4 [0113.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.862] lstrlenW (lpString=".zip") returned 4 [0113.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.862] lstrlenW (lpString=".rar") returned 4 [0113.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".bz2") returned 4 [0113.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.862] lstrlenW (lpString=".7z") returned 3 [0113.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.863] lstrlenW (lpString=".dbf") returned 4 [0113.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.863] lstrlenW (lpString=".1cd") returned 4 [0113.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 63 [0113.863] lstrlenW (lpString=".jpg") returned 4 [0113.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.863] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") [0113.864] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9660) returned 1 [0113.864] CloseHandle (hObject=0x19c) returned 1 [0113.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf")) returned 0x20 [0113.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.864] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.864] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.865] GetLastError () returned 0x0 [0113.865] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x25bc, lpOverlapped=0x0) returned 1 [0113.940] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0113.941] ReadFile (in: hFile=0x19c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.941] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.941] SetEndOfFile (hFile=0x180) returned 1 [0113.941] CloseHandle (hObject=0x180) returned 1 [0113.942] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.942] SetEndOfFile (hFile=0x19c) returned 1 [0113.942] CloseHandle (hObject=0x19c) returned 1 [0113.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf")) returned 1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.943] lstrlenW (lpString=".doc") returned 4 [0113.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".docx") returned 5 [0113.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.943] lstrlenW (lpString=".pdf") returned 4 [0113.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".xls") returned 4 [0113.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.943] lstrlenW (lpString=".xlsx") returned 5 [0113.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.943] lstrlenW (lpString=".ppt") returned 4 [0113.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.943] lstrlenW (lpString=".zip") returned 4 [0113.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.943] lstrlenW (lpString=".rar") returned 4 [0113.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".bz2") returned 4 [0113.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".7z") returned 3 [0113.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.943] lstrlenW (lpString=".dbf") returned 4 [0113.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".1cd") returned 4 [0113.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".jpg") returned 4 [0113.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString=".pdf") returned 4 [0113.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString=".xls") returned 4 [0113.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.944] lstrlenW (lpString=".xlsx") returned 5 [0113.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.944] lstrlenW (lpString=".ppt") returned 4 [0113.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".zip") returned 4 [0113.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.944] lstrlenW (lpString=".rar") returned 4 [0113.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString=".bz2") returned 4 [0113.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString=".7z") returned 3 [0113.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".dbf") returned 4 [0113.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".1cd") returned 4 [0113.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 63 [0113.944] lstrlenW (lpString=".jpg") returned 4 [0113.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.945] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") [0114.022] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=740) returned 1 [0114.022] CloseHandle (hObject=0x210) returned 1 [0114.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0114.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.022] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.022] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.023] GetLastError () returned 0x0 [0114.023] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2e4, lpOverlapped=0x0) returned 1 [0114.025] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0114.025] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.026] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.026] SetEndOfFile (hFile=0x1c8) returned 1 [0114.026] CloseHandle (hObject=0x1c8) returned 1 [0114.026] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.026] SetEndOfFile (hFile=0x210) returned 1 [0114.027] CloseHandle (hObject=0x210) returned 1 [0114.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 1 [0114.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.027] lstrlenW (lpString=".doc") returned 4 [0114.027] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.027] lstrlenW (lpString=".docx") returned 5 [0114.027] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.027] lstrlenW (lpString=".pdf") returned 4 [0114.027] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.027] lstrlenW (lpString=".xls") returned 4 [0114.027] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.027] lstrlenW (lpString=".xlsx") returned 5 [0114.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.027] lstrlenW (lpString=".ppt") returned 4 [0114.027] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.027] lstrlenW (lpString=".zip") returned 4 [0114.027] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.027] lstrlenW (lpString=".rar") returned 4 [0114.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".bz2") returned 4 [0114.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.028] lstrlenW (lpString=".7z") returned 3 [0114.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.028] lstrlenW (lpString=".dbf") returned 4 [0114.028] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.028] lstrlenW (lpString=".1cd") returned 4 [0114.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.028] lstrlenW (lpString=".jpg") returned 4 [0114.028] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".pdf") returned 4 [0114.028] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".xls") returned 4 [0114.028] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".xlsx") returned 5 [0114.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.028] lstrlenW (lpString=".ppt") returned 4 [0114.028] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.028] lstrlenW (lpString=".zip") returned 4 [0114.028] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".rar") returned 4 [0114.028] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.028] lstrlenW (lpString=".bz2") returned 4 [0114.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.028] lstrlenW (lpString=".7z") returned 3 [0114.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.028] lstrlenW (lpString=".dbf") returned 4 [0114.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.029] lstrlenW (lpString=".1cd") returned 4 [0114.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 63 [0114.029] lstrlenW (lpString=".jpg") returned 4 [0114.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.029] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") [0114.029] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=462) returned 1 [0114.029] CloseHandle (hObject=0x210) returned 1 [0114.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif")) returned 0x20 [0114.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.030] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.030] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.031] GetLastError () returned 0x0 [0114.031] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ce, lpOverlapped=0x0) returned 1 [0114.032] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0114.033] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.033] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.033] SetEndOfFile (hFile=0x1c8) returned 1 [0114.033] CloseHandle (hObject=0x1c8) returned 1 [0114.033] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.034] SetEndOfFile (hFile=0x210) returned 1 [0114.034] CloseHandle (hObject=0x210) returned 1 [0114.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif")) returned 1 [0114.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.035] lstrlenW (lpString=".doc") returned 4 [0114.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.035] lstrlenW (lpString=".docx") returned 5 [0114.035] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.035] lstrlenW (lpString=".pdf") returned 4 [0114.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.035] lstrlenW (lpString=".xls") returned 4 [0114.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.035] lstrlenW (lpString=".xlsx") returned 5 [0114.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.035] lstrlenW (lpString=".ppt") returned 4 [0114.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.035] lstrlenW (lpString=".zip") returned 4 [0114.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.035] lstrlenW (lpString=".rar") returned 4 [0114.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.035] lstrlenW (lpString=".bz2") returned 4 [0114.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.035] lstrlenW (lpString=".7z") returned 3 [0114.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.035] lstrlenW (lpString=".dbf") returned 4 [0114.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.035] lstrlenW (lpString=".1cd") returned 4 [0114.036] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.036] lstrlenW (lpString=".jpg") returned 4 [0114.036] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString=".pdf") returned 4 [0114.036] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString=".xls") returned 4 [0114.036] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString=".xlsx") returned 5 [0114.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.036] lstrlenW (lpString=".ppt") returned 4 [0114.036] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.036] lstrlenW (lpString=".zip") returned 4 [0114.036] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString=".rar") returned 4 [0114.036] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.036] lstrlenW (lpString=".bz2") returned 4 [0114.036] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.036] lstrlenW (lpString=".7z") returned 3 [0114.036] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.036] lstrlenW (lpString=".dbf") returned 4 [0114.036] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.036] lstrlenW (lpString=".1cd") returned 4 [0114.036] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 63 [0114.036] lstrlenW (lpString=".jpg") returned 4 [0114.036] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.036] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") [0114.037] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4087) returned 1 [0114.037] CloseHandle (hObject=0x210) returned 1 [0114.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 0x20 [0114.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.037] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.037] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.038] GetLastError () returned 0x0 [0114.038] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xff7, lpOverlapped=0x0) returned 1 [0114.040] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1000, lpOverlapped=0x0) returned 1 [0114.040] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.040] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.041] SetEndOfFile (hFile=0x1c8) returned 1 [0114.041] CloseHandle (hObject=0x1c8) returned 1 [0114.041] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.041] SetEndOfFile (hFile=0x210) returned 1 [0114.042] CloseHandle (hObject=0x210) returned 1 [0114.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 1 [0114.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.042] lstrlenW (lpString=".doc") returned 4 [0114.042] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.042] lstrlenW (lpString=".docx") returned 5 [0114.042] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.042] lstrlenW (lpString=".pdf") returned 4 [0114.042] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.042] lstrlenW (lpString=".xls") returned 4 [0114.042] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.042] lstrlenW (lpString=".xlsx") returned 5 [0114.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.042] lstrlenW (lpString=".ppt") returned 4 [0114.042] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.043] lstrlenW (lpString=".zip") returned 4 [0114.043] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".rar") returned 4 [0114.043] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".bz2") returned 4 [0114.043] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.043] lstrlenW (lpString=".7z") returned 3 [0114.043] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.043] lstrlenW (lpString=".dbf") returned 4 [0114.043] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.043] lstrlenW (lpString=".1cd") returned 4 [0114.043] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.043] lstrlenW (lpString=".jpg") returned 4 [0114.043] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".pdf") returned 4 [0114.043] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".xls") returned 4 [0114.043] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".xlsx") returned 5 [0114.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.043] lstrlenW (lpString=".ppt") returned 4 [0114.043] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.043] lstrlenW (lpString=".zip") returned 4 [0114.043] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".rar") returned 4 [0114.043] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.043] lstrlenW (lpString=".bz2") returned 4 [0114.043] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.043] lstrlenW (lpString=".7z") returned 3 [0114.043] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.044] lstrlenW (lpString=".dbf") returned 4 [0114.044] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.044] lstrlenW (lpString=".1cd") returned 4 [0114.044] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 63 [0114.044] lstrlenW (lpString=".jpg") returned 4 [0114.044] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.044] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") [0114.044] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=427) returned 1 [0114.044] CloseHandle (hObject=0x210) returned 1 [0114.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 0x20 [0114.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.045] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.045] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.045] GetLastError () returned 0x0 [0114.046] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ab, lpOverlapped=0x0) returned 1 [0114.047] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1b0, lpOverlapped=0x0) returned 1 [0114.048] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.048] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.048] SetEndOfFile (hFile=0x1c8) returned 1 [0114.048] CloseHandle (hObject=0x1c8) returned 1 [0114.048] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.048] SetEndOfFile (hFile=0x210) returned 1 [0114.049] CloseHandle (hObject=0x210) returned 1 [0114.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 1 [0114.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.049] lstrlenW (lpString=".doc") returned 4 [0114.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.049] lstrlenW (lpString=".docx") returned 5 [0114.050] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.050] lstrlenW (lpString=".pdf") returned 4 [0114.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".xls") returned 4 [0114.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".xlsx") returned 5 [0114.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.050] lstrlenW (lpString=".ppt") returned 4 [0114.050] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.050] lstrlenW (lpString=".zip") returned 4 [0114.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".rar") returned 4 [0114.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".bz2") returned 4 [0114.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.050] lstrlenW (lpString=".7z") returned 3 [0114.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.050] lstrlenW (lpString=".dbf") returned 4 [0114.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.050] lstrlenW (lpString=".1cd") returned 4 [0114.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.050] lstrlenW (lpString=".jpg") returned 4 [0114.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".pdf") returned 4 [0114.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".xls") returned 4 [0114.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.050] lstrlenW (lpString=".xlsx") returned 5 [0114.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.051] lstrlenW (lpString=".ppt") returned 4 [0114.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.051] lstrlenW (lpString=".zip") returned 4 [0114.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.051] lstrlenW (lpString=".rar") returned 4 [0114.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.051] lstrlenW (lpString=".bz2") returned 4 [0114.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.051] lstrlenW (lpString=".7z") returned 3 [0114.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.051] lstrlenW (lpString=".dbf") returned 4 [0114.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.051] lstrlenW (lpString=".1cd") returned 4 [0114.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 63 [0114.051] lstrlenW (lpString=".jpg") returned 4 [0114.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.051] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") [0114.052] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=597) returned 1 [0114.052] CloseHandle (hObject=0x210) returned 1 [0114.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 0x20 [0114.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.052] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.052] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.053] GetLastError () returned 0x0 [0114.053] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x255, lpOverlapped=0x0) returned 1 [0114.054] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x260, lpOverlapped=0x0) returned 1 [0114.055] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.055] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.055] SetEndOfFile (hFile=0x1c8) returned 1 [0114.055] CloseHandle (hObject=0x1c8) returned 1 [0114.055] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.055] SetEndOfFile (hFile=0x210) returned 1 [0114.056] CloseHandle (hObject=0x210) returned 1 [0114.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 1 [0114.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.056] lstrlenW (lpString=".doc") returned 4 [0114.056] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.056] lstrlenW (lpString=".docx") returned 5 [0114.056] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.056] lstrlenW (lpString=".pdf") returned 4 [0114.056] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.056] lstrlenW (lpString=".xls") returned 4 [0114.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".xlsx") returned 5 [0114.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.057] lstrlenW (lpString=".ppt") returned 4 [0114.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.057] lstrlenW (lpString=".zip") returned 4 [0114.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".rar") returned 4 [0114.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".bz2") returned 4 [0114.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.057] lstrlenW (lpString=".7z") returned 3 [0114.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.057] lstrlenW (lpString=".dbf") returned 4 [0114.057] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.057] lstrlenW (lpString=".1cd") returned 4 [0114.057] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.057] lstrlenW (lpString=".jpg") returned 4 [0114.057] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".pdf") returned 4 [0114.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".xls") returned 4 [0114.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.057] lstrlenW (lpString=".xlsx") returned 5 [0114.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.057] lstrlenW (lpString=".ppt") returned 4 [0114.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.058] lstrlenW (lpString=".zip") returned 4 [0114.058] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.058] lstrlenW (lpString=".rar") returned 4 [0114.058] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.058] lstrlenW (lpString=".bz2") returned 4 [0114.058] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.058] lstrlenW (lpString=".7z") returned 3 [0114.058] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.058] lstrlenW (lpString=".dbf") returned 4 [0114.058] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.058] lstrlenW (lpString=".1cd") returned 4 [0114.058] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 63 [0114.058] lstrlenW (lpString=".jpg") returned 4 [0114.058] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.058] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") [0114.059] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=679) returned 1 [0114.059] CloseHandle (hObject=0x158) returned 1 [0114.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 0x20 [0114.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.060] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.060] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.060] GetLastError () returned 0x0 [0114.060] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2a7, lpOverlapped=0x0) returned 1 [0114.061] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0114.062] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.062] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.063] SetEndOfFile (hFile=0x210) returned 1 [0114.063] CloseHandle (hObject=0x210) returned 1 [0114.063] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.063] SetEndOfFile (hFile=0x158) returned 1 [0114.063] CloseHandle (hObject=0x158) returned 1 [0114.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 1 [0114.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.064] lstrlenW (lpString=".doc") returned 4 [0114.064] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.064] lstrlenW (lpString=".docx") returned 5 [0114.064] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.064] lstrlenW (lpString=".pdf") returned 4 [0114.064] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.064] lstrlenW (lpString=".xls") returned 4 [0114.064] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.064] lstrlenW (lpString=".xlsx") returned 5 [0114.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.064] lstrlenW (lpString=".ppt") returned 4 [0114.064] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.064] lstrlenW (lpString=".zip") returned 4 [0114.064] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.064] lstrlenW (lpString=".rar") returned 4 [0114.064] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.064] lstrlenW (lpString=".bz2") returned 4 [0114.064] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.065] lstrlenW (lpString=".7z") returned 3 [0114.065] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.065] lstrlenW (lpString=".dbf") returned 4 [0114.065] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.065] lstrlenW (lpString=".1cd") returned 4 [0114.065] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.065] lstrlenW (lpString=".jpg") returned 4 [0114.065] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString=".pdf") returned 4 [0114.065] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString=".xls") returned 4 [0114.065] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString=".xlsx") returned 5 [0114.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.065] lstrlenW (lpString=".ppt") returned 4 [0114.065] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.065] lstrlenW (lpString=".zip") returned 4 [0114.065] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString=".rar") returned 4 [0114.065] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.065] lstrlenW (lpString=".bz2") returned 4 [0114.065] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.065] lstrlenW (lpString=".7z") returned 3 [0114.065] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.065] lstrlenW (lpString=".dbf") returned 4 [0114.065] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.066] lstrlenW (lpString=".1cd") returned 4 [0114.066] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 63 [0114.066] lstrlenW (lpString=".jpg") returned 4 [0114.066] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.066] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") [0114.066] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=685) returned 1 [0114.066] CloseHandle (hObject=0x158) returned 1 [0114.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 0x20 [0114.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.067] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.067] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.067] GetLastError () returned 0x0 [0114.067] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2ad, lpOverlapped=0x0) returned 1 [0114.068] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0114.069] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.069] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.069] SetEndOfFile (hFile=0x210) returned 1 [0114.070] CloseHandle (hObject=0x210) returned 1 [0114.070] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.070] SetEndOfFile (hFile=0x158) returned 1 [0114.070] CloseHandle (hObject=0x158) returned 1 [0114.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.071] lstrlenW (lpString=".doc") returned 4 [0114.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.071] lstrlenW (lpString=".docx") returned 5 [0114.071] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.071] lstrlenW (lpString=".pdf") returned 4 [0114.071] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.071] lstrlenW (lpString=".xls") returned 4 [0114.071] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.071] lstrlenW (lpString=".xlsx") returned 5 [0114.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.071] lstrlenW (lpString=".ppt") returned 4 [0114.071] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.071] lstrlenW (lpString=".zip") returned 4 [0114.071] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.071] lstrlenW (lpString=".rar") returned 4 [0114.071] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.071] lstrlenW (lpString=".bz2") returned 4 [0114.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.071] lstrlenW (lpString=".7z") returned 3 [0114.071] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.071] lstrlenW (lpString=".dbf") returned 4 [0114.071] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".1cd") returned 4 [0114.072] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".jpg") returned 4 [0114.072] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString=".pdf") returned 4 [0114.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString=".xls") returned 4 [0114.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString=".xlsx") returned 5 [0114.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.072] lstrlenW (lpString=".ppt") returned 4 [0114.072] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".zip") returned 4 [0114.072] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString=".rar") returned 4 [0114.072] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.072] lstrlenW (lpString=".bz2") returned 4 [0114.072] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.072] lstrlenW (lpString=".7z") returned 3 [0114.072] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".dbf") returned 4 [0114.072] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".1cd") returned 4 [0114.072] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 63 [0114.072] lstrlenW (lpString=".jpg") returned 4 [0114.072] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.073] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") [0114.073] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=353) returned 1 [0114.073] CloseHandle (hObject=0x158) returned 1 [0114.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 0x20 [0114.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.074] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.074] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.074] GetLastError () returned 0x0 [0114.074] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x161, lpOverlapped=0x0) returned 1 [0114.075] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x170, lpOverlapped=0x0) returned 1 [0114.076] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.076] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.076] SetEndOfFile (hFile=0x210) returned 1 [0114.076] CloseHandle (hObject=0x210) returned 1 [0114.077] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.077] SetEndOfFile (hFile=0x158) returned 1 [0114.077] CloseHandle (hObject=0x158) returned 1 [0114.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.078] lstrlenW (lpString=".doc") returned 4 [0114.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.078] lstrlenW (lpString=".docx") returned 5 [0114.078] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.078] lstrlenW (lpString=".pdf") returned 4 [0114.078] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.078] lstrlenW (lpString=".xls") returned 4 [0114.078] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.078] lstrlenW (lpString=".xlsx") returned 5 [0114.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.078] lstrlenW (lpString=".ppt") returned 4 [0114.078] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.078] lstrlenW (lpString=".zip") returned 4 [0114.078] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.078] lstrlenW (lpString=".rar") returned 4 [0114.078] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.078] lstrlenW (lpString=".bz2") returned 4 [0114.078] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.078] lstrlenW (lpString=".7z") returned 3 [0114.078] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".dbf") returned 4 [0114.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".1cd") returned 4 [0114.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".jpg") returned 4 [0114.079] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString=".pdf") returned 4 [0114.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString=".xls") returned 4 [0114.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString=".xlsx") returned 5 [0114.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.079] lstrlenW (lpString=".ppt") returned 4 [0114.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".zip") returned 4 [0114.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString=".rar") returned 4 [0114.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.079] lstrlenW (lpString=".bz2") returned 4 [0114.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.079] lstrlenW (lpString=".7z") returned 3 [0114.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".dbf") returned 4 [0114.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.079] lstrlenW (lpString=".1cd") returned 4 [0114.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 63 [0114.080] lstrlenW (lpString=".jpg") returned 4 [0114.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.080] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") [0114.080] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=495) returned 1 [0114.080] CloseHandle (hObject=0x158) returned 1 [0114.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 0x20 [0114.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.081] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.081] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.082] GetLastError () returned 0x0 [0114.082] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x1ef, lpOverlapped=0x0) returned 1 [0114.082] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1f0, lpOverlapped=0x0) returned 1 [0114.083] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.083] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.084] SetEndOfFile (hFile=0x210) returned 1 [0114.084] CloseHandle (hObject=0x210) returned 1 [0114.084] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.084] SetEndOfFile (hFile=0x158) returned 1 [0114.085] CloseHandle (hObject=0x158) returned 1 [0114.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 1 [0114.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.085] lstrlenW (lpString=".doc") returned 4 [0114.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.085] lstrlenW (lpString=".docx") returned 5 [0114.085] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.085] lstrlenW (lpString=".pdf") returned 4 [0114.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.085] lstrlenW (lpString=".xls") returned 4 [0114.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.085] lstrlenW (lpString=".xlsx") returned 5 [0114.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.085] lstrlenW (lpString=".ppt") returned 4 [0114.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.085] lstrlenW (lpString=".zip") returned 4 [0114.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".rar") returned 4 [0114.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".bz2") returned 4 [0114.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.086] lstrlenW (lpString=".7z") returned 3 [0114.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.086] lstrlenW (lpString=".dbf") returned 4 [0114.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.086] lstrlenW (lpString=".1cd") returned 4 [0114.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.086] lstrlenW (lpString=".jpg") returned 4 [0114.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".pdf") returned 4 [0114.086] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".xls") returned 4 [0114.086] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".xlsx") returned 5 [0114.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.086] lstrlenW (lpString=".ppt") returned 4 [0114.086] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.086] lstrlenW (lpString=".zip") returned 4 [0114.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".rar") returned 4 [0114.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.086] lstrlenW (lpString=".bz2") returned 4 [0114.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.086] lstrlenW (lpString=".7z") returned 3 [0114.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.087] lstrlenW (lpString=".dbf") returned 4 [0114.087] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.087] lstrlenW (lpString=".1cd") returned 4 [0114.087] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 63 [0114.087] lstrlenW (lpString=".jpg") returned 4 [0114.087] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.087] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") [0114.087] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=894) returned 1 [0114.088] CloseHandle (hObject=0x158) returned 1 [0114.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 0x20 [0114.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.088] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.088] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.089] GetLastError () returned 0x0 [0114.089] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x37e, lpOverlapped=0x0) returned 1 [0114.240] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x380, lpOverlapped=0x0) returned 1 [0114.241] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.241] WriteFile (in: hFile=0x210, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.241] SetEndOfFile (hFile=0x210) returned 1 [0114.241] CloseHandle (hObject=0x210) returned 1 [0114.241] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.241] SetEndOfFile (hFile=0x158) returned 1 [0114.242] CloseHandle (hObject=0x158) returned 1 [0114.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 1 [0114.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.248] lstrlenW (lpString=".doc") returned 4 [0114.248] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.248] lstrlenW (lpString=".docx") returned 5 [0114.248] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.248] lstrlenW (lpString=".pdf") returned 4 [0114.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.248] lstrlenW (lpString=".xls") returned 4 [0114.249] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".xlsx") returned 5 [0114.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.249] lstrlenW (lpString=".ppt") returned 4 [0114.249] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.249] lstrlenW (lpString=".zip") returned 4 [0114.249] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".rar") returned 4 [0114.249] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".bz2") returned 4 [0114.249] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.249] lstrlenW (lpString=".7z") returned 3 [0114.249] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.249] lstrlenW (lpString=".dbf") returned 4 [0114.249] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.249] lstrlenW (lpString=".1cd") returned 4 [0114.249] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.249] lstrlenW (lpString=".jpg") returned 4 [0114.249] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".pdf") returned 4 [0114.249] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".xls") returned 4 [0114.249] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.249] lstrlenW (lpString=".xlsx") returned 5 [0114.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.250] lstrlenW (lpString=".ppt") returned 4 [0114.250] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.250] lstrlenW (lpString=".zip") returned 4 [0114.250] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.250] lstrlenW (lpString=".rar") returned 4 [0114.250] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.250] lstrlenW (lpString=".bz2") returned 4 [0114.250] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.250] lstrlenW (lpString=".7z") returned 3 [0114.250] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.250] lstrlenW (lpString=".dbf") returned 4 [0114.250] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.250] lstrlenW (lpString=".1cd") returned 4 [0114.250] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 63 [0114.250] lstrlenW (lpString=".jpg") returned 4 [0114.250] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.250] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") [0114.413] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=707) returned 1 [0114.413] CloseHandle (hObject=0x1f4) returned 1 [0114.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif")) returned 0x20 [0114.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0114.414] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.414] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.415] GetLastError () returned 0x0 [0114.415] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2c3, lpOverlapped=0x0) returned 1 [0114.474] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0114.475] ReadFile (in: hFile=0x1f4, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.475] WriteFile (in: hFile=0x1b8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.475] SetEndOfFile (hFile=0x1b8) returned 1 [0114.728] CloseHandle (hObject=0x1b8) returned 1 [0114.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.891] SetEndOfFile (hFile=0x1f4) returned 1 [0114.899] CloseHandle (hObject=0x1f4) returned 1 [0114.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif")) returned 1 [0114.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0114.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0114.995] lstrlenW (lpString=".doc") returned 4 [0114.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.003] lstrlenW (lpString=".docx") returned 5 [0115.018] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.018] lstrlenW (lpString=".pdf") returned 4 [0115.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.018] lstrlenW (lpString=".xls") returned 4 [0115.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.018] lstrlenW (lpString=".xlsx") returned 5 [0115.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.019] lstrlenW (lpString=".ppt") returned 4 [0115.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.019] lstrlenW (lpString=".zip") returned 4 [0115.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".rar") returned 4 [0115.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".bz2") returned 4 [0115.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.019] lstrlenW (lpString=".7z") returned 3 [0115.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.019] lstrlenW (lpString=".dbf") returned 4 [0115.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.019] lstrlenW (lpString=".1cd") returned 4 [0115.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.019] lstrlenW (lpString=".jpg") returned 4 [0115.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".pdf") returned 4 [0115.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".xls") returned 4 [0115.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".xlsx") returned 5 [0115.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.019] lstrlenW (lpString=".ppt") returned 4 [0115.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.019] lstrlenW (lpString=".zip") returned 4 [0115.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".rar") returned 4 [0115.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.019] lstrlenW (lpString=".bz2") returned 4 [0115.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.020] lstrlenW (lpString=".7z") returned 3 [0115.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.020] lstrlenW (lpString=".dbf") returned 4 [0115.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.020] lstrlenW (lpString=".1cd") returned 4 [0115.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 63 [0115.020] lstrlenW (lpString=".jpg") returned 4 [0115.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.020] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") [0115.020] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1900) returned 1 [0115.020] CloseHandle (hObject=0x22c) returned 1 [0115.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif")) returned 0x20 [0115.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.022] GetLastError () returned 0x0 [0115.022] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x76c, lpOverlapped=0x0) returned 1 [0115.023] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x770, lpOverlapped=0x0) returned 1 [0115.024] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.024] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.024] SetEndOfFile (hFile=0x1c0) returned 1 [0115.024] CloseHandle (hObject=0x1c0) returned 1 [0115.024] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.024] SetEndOfFile (hFile=0x22c) returned 1 [0115.025] CloseHandle (hObject=0x22c) returned 1 [0115.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif")) returned 1 [0115.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.025] lstrlenW (lpString=".doc") returned 4 [0115.025] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.025] lstrlenW (lpString=".docx") returned 5 [0115.025] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.025] lstrlenW (lpString=".pdf") returned 4 [0115.025] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.025] lstrlenW (lpString=".xls") returned 4 [0115.025] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".xlsx") returned 5 [0115.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.026] lstrlenW (lpString=".ppt") returned 4 [0115.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.026] lstrlenW (lpString=".zip") returned 4 [0115.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".rar") returned 4 [0115.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".bz2") returned 4 [0115.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.026] lstrlenW (lpString=".7z") returned 3 [0115.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.026] lstrlenW (lpString=".dbf") returned 4 [0115.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.026] lstrlenW (lpString=".1cd") returned 4 [0115.026] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.026] lstrlenW (lpString=".jpg") returned 4 [0115.026] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".pdf") returned 4 [0115.026] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".xls") returned 4 [0115.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString=".xlsx") returned 5 [0115.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.026] lstrlenW (lpString=".ppt") returned 4 [0115.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.026] lstrlenW (lpString=".zip") returned 4 [0115.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.027] lstrlenW (lpString=".rar") returned 4 [0115.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.027] lstrlenW (lpString=".bz2") returned 4 [0115.027] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.027] lstrlenW (lpString=".7z") returned 3 [0115.027] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.027] lstrlenW (lpString=".dbf") returned 4 [0115.027] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.027] lstrlenW (lpString=".1cd") returned 4 [0115.027] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 63 [0115.027] lstrlenW (lpString=".jpg") returned 4 [0115.027] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.027] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") [0115.028] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4817) returned 1 [0115.028] CloseHandle (hObject=0x22c) returned 1 [0115.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif")) returned 0x20 [0115.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.029] GetLastError () returned 0x0 [0115.029] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x12d1, lpOverlapped=0x0) returned 1 [0115.030] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x12e0, lpOverlapped=0x0) returned 1 [0115.031] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.031] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.031] SetEndOfFile (hFile=0x1c0) returned 1 [0115.031] CloseHandle (hObject=0x1c0) returned 1 [0115.031] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.031] SetEndOfFile (hFile=0x22c) returned 1 [0115.032] CloseHandle (hObject=0x22c) returned 1 [0115.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif")) returned 1 [0115.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.033] lstrlenW (lpString=".doc") returned 4 [0115.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.033] lstrlenW (lpString=".docx") returned 5 [0115.033] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.033] lstrlenW (lpString=".pdf") returned 4 [0115.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".xls") returned 4 [0115.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".xlsx") returned 5 [0115.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.033] lstrlenW (lpString=".ppt") returned 4 [0115.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.033] lstrlenW (lpString=".zip") returned 4 [0115.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".rar") returned 4 [0115.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".bz2") returned 4 [0115.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.033] lstrlenW (lpString=".7z") returned 3 [0115.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.033] lstrlenW (lpString=".dbf") returned 4 [0115.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.033] lstrlenW (lpString=".1cd") returned 4 [0115.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.033] lstrlenW (lpString=".jpg") returned 4 [0115.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".pdf") returned 4 [0115.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.033] lstrlenW (lpString=".xls") returned 4 [0115.034] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.034] lstrlenW (lpString=".xlsx") returned 5 [0115.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.034] lstrlenW (lpString=".ppt") returned 4 [0115.034] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.034] lstrlenW (lpString=".zip") returned 4 [0115.034] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.034] lstrlenW (lpString=".rar") returned 4 [0115.034] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.034] lstrlenW (lpString=".bz2") returned 4 [0115.034] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.034] lstrlenW (lpString=".7z") returned 3 [0115.034] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.034] lstrlenW (lpString=".dbf") returned 4 [0115.034] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.034] lstrlenW (lpString=".1cd") returned 4 [0115.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 63 [0115.034] lstrlenW (lpString=".jpg") returned 4 [0115.034] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.034] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") [0115.035] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4139) returned 1 [0115.035] CloseHandle (hObject=0x22c) returned 1 [0115.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif")) returned 0x20 [0115.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.036] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.036] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.036] GetLastError () returned 0x0 [0115.036] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x102b, lpOverlapped=0x0) returned 1 [0115.038] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1030, lpOverlapped=0x0) returned 1 [0115.039] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.039] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.039] SetEndOfFile (hFile=0x1c0) returned 1 [0115.039] CloseHandle (hObject=0x1c0) returned 1 [0115.039] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.039] SetEndOfFile (hFile=0x22c) returned 1 [0115.040] CloseHandle (hObject=0x22c) returned 1 [0115.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif")) returned 1 [0115.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.040] lstrlenW (lpString=".doc") returned 4 [0115.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.040] lstrlenW (lpString=".docx") returned 5 [0115.040] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.040] lstrlenW (lpString=".pdf") returned 4 [0115.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.040] lstrlenW (lpString=".xls") returned 4 [0115.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".xlsx") returned 5 [0115.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.041] lstrlenW (lpString=".ppt") returned 4 [0115.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.041] lstrlenW (lpString=".zip") returned 4 [0115.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".rar") returned 4 [0115.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".bz2") returned 4 [0115.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.041] lstrlenW (lpString=".7z") returned 3 [0115.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.041] lstrlenW (lpString=".dbf") returned 4 [0115.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.041] lstrlenW (lpString=".1cd") returned 4 [0115.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.041] lstrlenW (lpString=".jpg") returned 4 [0115.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".pdf") returned 4 [0115.041] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".xls") returned 4 [0115.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString=".xlsx") returned 5 [0115.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.041] lstrlenW (lpString=".ppt") returned 4 [0115.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.041] lstrlenW (lpString=".zip") returned 4 [0115.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.042] lstrlenW (lpString=".rar") returned 4 [0115.042] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.042] lstrlenW (lpString=".bz2") returned 4 [0115.042] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.042] lstrlenW (lpString=".7z") returned 3 [0115.042] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.042] lstrlenW (lpString=".dbf") returned 4 [0115.042] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.042] lstrlenW (lpString=".1cd") returned 4 [0115.042] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 63 [0115.042] lstrlenW (lpString=".jpg") returned 4 [0115.042] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.042] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") [0115.043] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2582) returned 1 [0115.043] CloseHandle (hObject=0x22c) returned 1 [0115.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf")) returned 0x20 [0115.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.043] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.044] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.044] GetLastError () returned 0x0 [0115.044] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xa16, lpOverlapped=0x0) returned 1 [0115.047] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa20, lpOverlapped=0x0) returned 1 [0115.048] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.048] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.048] SetEndOfFile (hFile=0x1c0) returned 1 [0115.048] CloseHandle (hObject=0x1c0) returned 1 [0115.048] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.048] SetEndOfFile (hFile=0x22c) returned 1 [0115.049] CloseHandle (hObject=0x22c) returned 1 [0115.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf")) returned 1 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.050] lstrlenW (lpString=".doc") returned 4 [0115.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString=".docx") returned 5 [0115.050] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.050] lstrlenW (lpString=".pdf") returned 4 [0115.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString=".xls") returned 4 [0115.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.050] lstrlenW (lpString=".xlsx") returned 5 [0115.050] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.050] lstrlenW (lpString=".ppt") returned 4 [0115.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.050] lstrlenW (lpString=".zip") returned 4 [0115.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.050] lstrlenW (lpString=".rar") returned 4 [0115.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString=".bz2") returned 4 [0115.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString=".7z") returned 3 [0115.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.050] lstrlenW (lpString=".dbf") returned 4 [0115.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.050] lstrlenW (lpString=".1cd") returned 4 [0115.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 61 [0115.051] lstrlenW (lpString=".jpg") returned 4 [0115.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.051] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") [0115.051] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2966) returned 1 [0115.051] CloseHandle (hObject=0x22c) returned 1 [0115.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf")) returned 0x20 [0115.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.051] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.052] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.052] GetLastError () returned 0x0 [0115.052] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xb96, lpOverlapped=0x0) returned 1 [0115.250] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0115.257] ReadFile (in: hFile=0x22c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.257] WriteFile (in: hFile=0x1c0, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.258] SetEndOfFile (hFile=0x1c0) returned 1 [0115.258] CloseHandle (hObject=0x1c0) returned 1 [0115.258] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.258] SetEndOfFile (hFile=0x22c) returned 1 [0115.258] CloseHandle (hObject=0x22c) returned 1 [0115.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf")) returned 1 [0115.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.259] lstrlenW (lpString=".doc") returned 4 [0115.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.259] lstrlenW (lpString=".docx") returned 5 [0115.259] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.259] lstrlenW (lpString=".pdf") returned 4 [0115.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.259] lstrlenW (lpString=".xls") returned 4 [0115.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.259] lstrlenW (lpString=".xlsx") returned 5 [0115.259] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.259] lstrlenW (lpString=".ppt") returned 4 [0115.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.259] lstrlenW (lpString=".zip") returned 4 [0115.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.260] lstrlenW (lpString=".rar") returned 4 [0115.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.260] lstrlenW (lpString=".bz2") returned 4 [0115.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.260] lstrlenW (lpString=".7z") returned 3 [0115.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.260] lstrlenW (lpString=".dbf") returned 4 [0115.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.260] lstrlenW (lpString=".1cd") returned 4 [0115.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 61 [0115.260] lstrlenW (lpString=".jpg") returned 4 [0115.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.260] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") [0115.366] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=908) returned 1 [0115.366] CloseHandle (hObject=0x210) returned 1 [0115.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 0x20 [0115.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.367] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.367] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.368] GetLastError () returned 0x0 [0115.368] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x38c, lpOverlapped=0x0) returned 1 [0115.372] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x390, lpOverlapped=0x0) returned 1 [0115.373] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.373] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.373] SetEndOfFile (hFile=0x1fc) returned 1 [0115.373] CloseHandle (hObject=0x1fc) returned 1 [0115.374] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.374] SetEndOfFile (hFile=0x210) returned 1 [0115.374] CloseHandle (hObject=0x210) returned 1 [0115.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 1 [0115.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.375] lstrlenW (lpString=".doc") returned 4 [0115.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.375] lstrlenW (lpString=".docx") returned 5 [0115.375] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.375] lstrlenW (lpString=".pdf") returned 4 [0115.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.375] lstrlenW (lpString=".xls") returned 4 [0115.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.375] lstrlenW (lpString=".xlsx") returned 5 [0115.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.375] lstrlenW (lpString=".ppt") returned 4 [0115.375] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.375] lstrlenW (lpString=".zip") returned 4 [0115.375] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.375] lstrlenW (lpString=".rar") returned 4 [0115.375] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.375] lstrlenW (lpString=".bz2") returned 4 [0115.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.376] lstrlenW (lpString=".7z") returned 3 [0115.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.376] lstrlenW (lpString=".dbf") returned 4 [0115.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.376] lstrlenW (lpString=".1cd") returned 4 [0115.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.376] lstrlenW (lpString=".jpg") returned 4 [0115.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString=".pdf") returned 4 [0115.376] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString=".xls") returned 4 [0115.376] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString=".xlsx") returned 5 [0115.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.376] lstrlenW (lpString=".ppt") returned 4 [0115.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.376] lstrlenW (lpString=".zip") returned 4 [0115.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString=".rar") returned 4 [0115.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.376] lstrlenW (lpString=".bz2") returned 4 [0115.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.376] lstrlenW (lpString=".7z") returned 3 [0115.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.376] lstrlenW (lpString=".dbf") returned 4 [0115.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.377] lstrlenW (lpString=".1cd") returned 4 [0115.377] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 76 [0115.377] lstrlenW (lpString=".jpg") returned 4 [0115.377] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.377] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") [0115.378] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2439) returned 1 [0115.378] CloseHandle (hObject=0x210) returned 1 [0115.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 0x20 [0115.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.379] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.379] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.380] GetLastError () returned 0x0 [0115.380] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x987, lpOverlapped=0x0) returned 1 [0115.381] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x990, lpOverlapped=0x0) returned 1 [0115.382] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.382] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.382] SetEndOfFile (hFile=0x1fc) returned 1 [0115.382] CloseHandle (hObject=0x1fc) returned 1 [0115.383] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.383] SetEndOfFile (hFile=0x210) returned 1 [0115.383] CloseHandle (hObject=0x210) returned 1 [0115.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.384] lstrlenW (lpString=".doc") returned 4 [0115.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.384] lstrlenW (lpString=".docx") returned 5 [0115.384] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.384] lstrlenW (lpString=".pdf") returned 4 [0115.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.384] lstrlenW (lpString=".xls") returned 4 [0115.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.384] lstrlenW (lpString=".xlsx") returned 5 [0115.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.384] lstrlenW (lpString=".ppt") returned 4 [0115.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.384] lstrlenW (lpString=".zip") returned 4 [0115.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.384] lstrlenW (lpString=".rar") returned 4 [0115.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.384] lstrlenW (lpString=".bz2") returned 4 [0115.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.384] lstrlenW (lpString=".7z") returned 3 [0115.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.384] lstrlenW (lpString=".dbf") returned 4 [0115.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.384] lstrlenW (lpString=".1cd") returned 4 [0115.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.385] lstrlenW (lpString=".jpg") returned 4 [0115.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString=".pdf") returned 4 [0115.385] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString=".xls") returned 4 [0115.385] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString=".xlsx") returned 5 [0115.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.385] lstrlenW (lpString=".ppt") returned 4 [0115.385] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.385] lstrlenW (lpString=".zip") returned 4 [0115.385] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString=".rar") returned 4 [0115.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.385] lstrlenW (lpString=".bz2") returned 4 [0115.385] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.385] lstrlenW (lpString=".7z") returned 3 [0115.385] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.385] lstrlenW (lpString=".dbf") returned 4 [0115.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.385] lstrlenW (lpString=".1cd") returned 4 [0115.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 76 [0115.385] lstrlenW (lpString=".jpg") returned 4 [0115.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.385] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") [0115.386] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=893) returned 1 [0115.386] CloseHandle (hObject=0x210) returned 1 [0115.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 0x20 [0115.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.386] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.387] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.387] GetLastError () returned 0x0 [0115.387] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x37d, lpOverlapped=0x0) returned 1 [0115.389] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x380, lpOverlapped=0x0) returned 1 [0115.390] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.390] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.390] SetEndOfFile (hFile=0x1fc) returned 1 [0115.390] CloseHandle (hObject=0x1fc) returned 1 [0115.390] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.390] SetEndOfFile (hFile=0x210) returned 1 [0115.391] CloseHandle (hObject=0x210) returned 1 [0115.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 1 [0115.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.391] lstrlenW (lpString=".doc") returned 4 [0115.391] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.391] lstrlenW (lpString=".docx") returned 5 [0115.391] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.391] lstrlenW (lpString=".pdf") returned 4 [0115.391] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.391] lstrlenW (lpString=".xls") returned 4 [0115.391] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.391] lstrlenW (lpString=".xlsx") returned 5 [0115.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.391] lstrlenW (lpString=".ppt") returned 4 [0115.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.392] lstrlenW (lpString=".zip") returned 4 [0115.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".rar") returned 4 [0115.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".bz2") returned 4 [0115.392] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.392] lstrlenW (lpString=".7z") returned 3 [0115.392] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.392] lstrlenW (lpString=".dbf") returned 4 [0115.392] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.392] lstrlenW (lpString=".1cd") returned 4 [0115.392] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.392] lstrlenW (lpString=".jpg") returned 4 [0115.392] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".pdf") returned 4 [0115.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".xls") returned 4 [0115.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".xlsx") returned 5 [0115.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.392] lstrlenW (lpString=".ppt") returned 4 [0115.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.392] lstrlenW (lpString=".zip") returned 4 [0115.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".rar") returned 4 [0115.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.392] lstrlenW (lpString=".bz2") returned 4 [0115.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.393] lstrlenW (lpString=".7z") returned 3 [0115.393] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.393] lstrlenW (lpString=".dbf") returned 4 [0115.393] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.393] lstrlenW (lpString=".1cd") returned 4 [0115.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 76 [0115.393] lstrlenW (lpString=".jpg") returned 4 [0115.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.393] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") [0115.394] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1302) returned 1 [0115.394] CloseHandle (hObject=0x210) returned 1 [0115.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 0x20 [0115.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.394] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.394] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.395] GetLastError () returned 0x0 [0115.395] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x516, lpOverlapped=0x0) returned 1 [0115.397] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x520, lpOverlapped=0x0) returned 1 [0115.398] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.398] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.398] SetEndOfFile (hFile=0x1fc) returned 1 [0115.398] CloseHandle (hObject=0x1fc) returned 1 [0115.398] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.398] SetEndOfFile (hFile=0x210) returned 1 [0115.399] CloseHandle (hObject=0x210) returned 1 [0115.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 1 [0115.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.399] lstrlenW (lpString=".doc") returned 4 [0115.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.399] lstrlenW (lpString=".docx") returned 5 [0115.399] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.399] lstrlenW (lpString=".pdf") returned 4 [0115.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.399] lstrlenW (lpString=".xls") returned 4 [0115.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".xlsx") returned 5 [0115.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.400] lstrlenW (lpString=".ppt") returned 4 [0115.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.400] lstrlenW (lpString=".zip") returned 4 [0115.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".rar") returned 4 [0115.400] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".bz2") returned 4 [0115.400] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.400] lstrlenW (lpString=".7z") returned 3 [0115.400] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.400] lstrlenW (lpString=".dbf") returned 4 [0115.400] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.400] lstrlenW (lpString=".1cd") returned 4 [0115.400] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.400] lstrlenW (lpString=".jpg") returned 4 [0115.400] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".pdf") returned 4 [0115.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".xls") returned 4 [0115.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString=".xlsx") returned 5 [0115.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.400] lstrlenW (lpString=".ppt") returned 4 [0115.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.400] lstrlenW (lpString=".zip") returned 4 [0115.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.401] lstrlenW (lpString=".rar") returned 4 [0115.401] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.401] lstrlenW (lpString=".bz2") returned 4 [0115.401] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.401] lstrlenW (lpString=".7z") returned 3 [0115.401] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.401] lstrlenW (lpString=".dbf") returned 4 [0115.401] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.401] lstrlenW (lpString=".1cd") returned 4 [0115.401] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 76 [0115.401] lstrlenW (lpString=".jpg") returned 4 [0115.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.401] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") [0115.402] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=765) returned 1 [0115.402] CloseHandle (hObject=0x210) returned 1 [0115.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 0x20 [0115.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.402] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.402] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.403] GetLastError () returned 0x0 [0115.403] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x2fd, lpOverlapped=0x0) returned 1 [0115.441] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x300, lpOverlapped=0x0) returned 1 [0115.442] ReadFile (in: hFile=0x210, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.442] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.442] SetEndOfFile (hFile=0x1fc) returned 1 [0115.446] CloseHandle (hObject=0x1fc) returned 1 [0115.447] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.447] SetEndOfFile (hFile=0x210) returned 1 [0115.480] CloseHandle (hObject=0x210) returned 1 [0115.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 1 [0115.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.480] lstrlenW (lpString=".doc") returned 4 [0115.481] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.481] lstrlenW (lpString=".docx") returned 5 [0115.481] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.481] lstrlenW (lpString=".pdf") returned 4 [0115.481] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".xls") returned 4 [0115.481] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".xlsx") returned 5 [0115.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.481] lstrlenW (lpString=".ppt") returned 4 [0115.481] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.481] lstrlenW (lpString=".zip") returned 4 [0115.481] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".rar") returned 4 [0115.481] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".bz2") returned 4 [0115.481] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.481] lstrlenW (lpString=".7z") returned 3 [0115.481] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.481] lstrlenW (lpString=".dbf") returned 4 [0115.481] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.481] lstrlenW (lpString=".1cd") returned 4 [0115.481] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.481] lstrlenW (lpString=".jpg") returned 4 [0115.481] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".pdf") returned 4 [0115.481] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.481] lstrlenW (lpString=".xls") returned 4 [0115.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.482] lstrlenW (lpString=".xlsx") returned 5 [0115.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.482] lstrlenW (lpString=".ppt") returned 4 [0115.482] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.482] lstrlenW (lpString=".zip") returned 4 [0115.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.482] lstrlenW (lpString=".rar") returned 4 [0115.482] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.482] lstrlenW (lpString=".bz2") returned 4 [0115.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.482] lstrlenW (lpString=".7z") returned 3 [0115.482] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.482] lstrlenW (lpString=".dbf") returned 4 [0115.482] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.482] lstrlenW (lpString=".1cd") returned 4 [0115.482] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 76 [0115.482] lstrlenW (lpString=".jpg") returned 4 [0115.482] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.482] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") [0115.891] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3012) returned 1 [0115.891] CloseHandle (hObject=0x1c0) returned 1 [0115.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 0x20 [0115.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.891] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.891] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.892] GetLastError () returned 0x0 [0115.892] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0115.943] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0115.945] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.945] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.945] SetEndOfFile (hFile=0x1c8) returned 1 [0115.945] CloseHandle (hObject=0x1c8) returned 1 [0115.945] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.945] SetEndOfFile (hFile=0x1c0) returned 1 [0115.946] CloseHandle (hObject=0x1c0) returned 1 [0115.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 1 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.946] lstrlenW (lpString=".doc") returned 4 [0115.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.946] lstrlenW (lpString=".docx") returned 5 [0115.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.946] lstrlenW (lpString=".pdf") returned 4 [0115.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.946] lstrlenW (lpString=".xls") returned 4 [0115.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".xlsx") returned 5 [0115.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.947] lstrlenW (lpString=".ppt") returned 4 [0115.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.947] lstrlenW (lpString=".zip") returned 4 [0115.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".rar") returned 4 [0115.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".bz2") returned 4 [0115.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.947] lstrlenW (lpString=".7z") returned 3 [0115.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.947] lstrlenW (lpString=".dbf") returned 4 [0115.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.947] lstrlenW (lpString=".1cd") returned 4 [0115.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.947] lstrlenW (lpString=".jpg") returned 4 [0115.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".pdf") returned 4 [0115.947] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".xls") returned 4 [0115.947] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".xlsx") returned 5 [0115.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.947] lstrlenW (lpString=".ppt") returned 4 [0115.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.947] lstrlenW (lpString=".zip") returned 4 [0115.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.947] lstrlenW (lpString=".rar") returned 4 [0115.948] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.948] lstrlenW (lpString=".bz2") returned 4 [0115.948] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.948] lstrlenW (lpString=".7z") returned 3 [0115.948] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.948] lstrlenW (lpString=".dbf") returned 4 [0115.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.948] lstrlenW (lpString=".1cd") returned 4 [0115.948] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 76 [0115.948] lstrlenW (lpString=".jpg") returned 4 [0115.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.948] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") [0115.949] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=88662) returned 1 [0115.949] CloseHandle (hObject=0x1c0) returned 1 [0115.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) returned 0x20 [0115.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.949] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.949] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.950] GetLastError () returned 0x0 [0115.950] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x15a56, lpOverlapped=0x0) returned 1 [0116.023] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x15a60, lpOverlapped=0x0) returned 1 [0116.025] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.025] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0116.025] SetEndOfFile (hFile=0x1c8) returned 1 [0116.025] CloseHandle (hObject=0x1c8) returned 1 [0116.025] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.025] SetEndOfFile (hFile=0x1c0) returned 1 [0116.026] CloseHandle (hObject=0x1c0) returned 1 [0116.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) returned 1 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.027] lstrlenW (lpString=".doc") returned 4 [0116.027] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".docx") returned 5 [0116.027] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.027] lstrlenW (lpString=".pdf") returned 4 [0116.027] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".xls") returned 4 [0116.027] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".xlsx") returned 5 [0116.027] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.027] lstrlenW (lpString=".ppt") returned 4 [0116.027] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.027] lstrlenW (lpString=".zip") returned 4 [0116.027] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".rar") returned 4 [0116.027] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".bz2") returned 4 [0116.027] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString=".7z") returned 3 [0116.027] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.027] lstrlenW (lpString=".dbf") returned 4 [0116.027] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.027] lstrlenW (lpString=".1cd") returned 4 [0116.027] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 68 [0116.028] lstrlenW (lpString=".jpg") returned 4 [0116.028] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.028] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") [0116.029] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=655107) returned 1 [0116.029] CloseHandle (hObject=0x1c0) returned 1 [0116.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) returned 0x20 [0116.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0116.029] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.029] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0116.030] GetLastError () returned 0x0 [0116.030] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x9ff03, lpOverlapped=0x0) returned 1 [0116.196] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x9ff10, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9ff10, lpOverlapped=0x0) returned 1 [0116.337] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.337] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0116.337] SetEndOfFile (hFile=0x1c8) returned 1 [0116.711] CloseHandle (hObject=0x1c8) returned 1 [0116.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.711] SetEndOfFile (hFile=0x1c0) returned 1 [0116.718] CloseHandle (hObject=0x1c0) returned 1 [0116.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) returned 1 [0116.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.718] lstrlenW (lpString=".doc") returned 4 [0116.718] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.718] lstrlenW (lpString=".docx") returned 5 [0116.718] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.718] lstrlenW (lpString=".pdf") returned 4 [0116.718] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.718] lstrlenW (lpString=".xls") returned 4 [0116.718] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.718] lstrlenW (lpString=".xlsx") returned 5 [0116.718] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.718] lstrlenW (lpString=".ppt") returned 4 [0116.718] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.726] lstrlenW (lpString=".zip") returned 4 [0116.726] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.726] lstrlenW (lpString=".rar") returned 4 [0116.726] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.726] lstrlenW (lpString=".bz2") returned 4 [0116.726] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.726] lstrlenW (lpString=".7z") returned 3 [0116.726] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.726] lstrlenW (lpString=".dbf") returned 4 [0116.726] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.727] lstrlenW (lpString=".1cd") returned 4 [0116.727] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 67 [0116.727] lstrlenW (lpString=".jpg") returned 4 [0116.727] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.727] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") [0116.727] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=349663) returned 1 [0116.727] CloseHandle (hObject=0x1c0) returned 1 [0116.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) returned 0x20 [0116.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0116.728] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.728] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0116.728] GetLastError () returned 0x0 [0116.728] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x555df, lpOverlapped=0x0) returned 1 [0117.193] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x555e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x555e0, lpOverlapped=0x0) returned 1 [0117.199] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.200] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.200] SetEndOfFile (hFile=0x1c8) returned 1 [0117.200] CloseHandle (hObject=0x1c8) returned 1 [0117.200] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.200] SetEndOfFile (hFile=0x1c0) returned 1 [0117.203] CloseHandle (hObject=0x1c0) returned 1 [0117.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) returned 1 [0117.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString=".doc") returned 4 [0117.204] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".docx") returned 5 [0117.204] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.204] lstrlenW (lpString=".pdf") returned 4 [0117.204] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".xls") returned 4 [0117.204] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".xlsx") returned 5 [0117.204] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.204] lstrlenW (lpString=".ppt") returned 4 [0117.204] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString=".zip") returned 4 [0117.204] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".rar") returned 4 [0117.204] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".bz2") returned 4 [0117.204] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString=".7z") returned 3 [0117.204] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString=".dbf") returned 4 [0117.204] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString=".1cd") returned 4 [0117.204] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 67 [0117.204] lstrlenW (lpString=".jpg") returned 4 [0117.204] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.204] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") [0117.205] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=55112) returned 1 [0117.205] CloseHandle (hObject=0x1c0) returned 1 [0117.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx")) returned 0x20 [0117.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0117.205] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.206] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0117.206] GetLastError () returned 0x0 [0117.206] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd748, lpOverlapped=0x0) returned 1 [0117.232] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd750, lpOverlapped=0x0) returned 1 [0117.234] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.234] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.234] SetEndOfFile (hFile=0x1c8) returned 1 [0117.234] CloseHandle (hObject=0x1c8) returned 1 [0117.234] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.234] SetEndOfFile (hFile=0x1c0) returned 1 [0117.235] CloseHandle (hObject=0x1c0) returned 1 [0117.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx")) returned 1 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString=".doc") returned 4 [0117.236] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".docx") returned 5 [0117.236] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.236] lstrlenW (lpString=".pdf") returned 4 [0117.236] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".xls") returned 4 [0117.236] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".xlsx") returned 5 [0117.236] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.236] lstrlenW (lpString=".ppt") returned 4 [0117.236] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString=".zip") returned 4 [0117.236] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".rar") returned 4 [0117.236] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".bz2") returned 4 [0117.236] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString=".7z") returned 3 [0117.236] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString=".dbf") returned 4 [0117.236] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString=".1cd") returned 4 [0117.236] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 67 [0117.236] lstrlenW (lpString=".jpg") returned 4 [0117.236] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.237] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") [0117.237] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=63508) returned 1 [0117.237] CloseHandle (hObject=0x1c0) returned 1 [0117.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx")) returned 0x20 [0117.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0117.238] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.238] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0117.321] GetLastError () returned 0x0 [0117.321] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xf814, lpOverlapped=0x0) returned 1 [0117.361] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf820, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf820, lpOverlapped=0x0) returned 1 [0117.363] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.363] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.363] SetEndOfFile (hFile=0x1c8) returned 1 [0117.363] CloseHandle (hObject=0x1c8) returned 1 [0117.363] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.363] SetEndOfFile (hFile=0x1c0) returned 1 [0117.364] CloseHandle (hObject=0x1c0) returned 1 [0117.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx")) returned 1 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString=".doc") returned 4 [0117.365] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".docx") returned 5 [0117.365] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.365] lstrlenW (lpString=".pdf") returned 4 [0117.365] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".xls") returned 4 [0117.365] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".xlsx") returned 5 [0117.365] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.365] lstrlenW (lpString=".ppt") returned 4 [0117.365] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString=".zip") returned 4 [0117.365] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".rar") returned 4 [0117.365] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".bz2") returned 4 [0117.365] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString=".7z") returned 3 [0117.365] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString=".dbf") returned 4 [0117.365] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString=".1cd") returned 4 [0117.365] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 65 [0117.365] lstrlenW (lpString=".jpg") returned 4 [0117.365] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.366] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") [0117.366] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=83623) returned 1 [0117.366] CloseHandle (hObject=0x1c0) returned 1 [0117.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx")) returned 0x20 [0117.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0117.367] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.367] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0117.367] GetLastError () returned 0x0 [0117.367] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x146a7, lpOverlapped=0x0) returned 1 [0117.379] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x146b0, lpOverlapped=0x0) returned 1 [0117.383] ReadFile (in: hFile=0x1c0, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.383] WriteFile (in: hFile=0x1c8, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.383] SetEndOfFile (hFile=0x1c8) returned 1 [0117.383] CloseHandle (hObject=0x1c8) returned 1 [0117.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.383] SetEndOfFile (hFile=0x1c0) returned 1 [0117.384] CloseHandle (hObject=0x1c0) returned 1 [0117.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx")) returned 1 [0117.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.385] lstrlenW (lpString=".doc") returned 4 [0117.385] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.385] lstrlenW (lpString=".docx") returned 5 [0117.385] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.385] lstrlenW (lpString=".pdf") returned 4 [0117.385] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.385] lstrlenW (lpString=".xls") returned 4 [0117.527] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString=".xlsx") returned 5 [0117.527] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.527] lstrlenW (lpString=".ppt") returned 4 [0117.527] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.527] lstrlenW (lpString=".zip") returned 4 [0117.527] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString=".rar") returned 4 [0117.527] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString=".bz2") returned 4 [0117.527] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString=".7z") returned 3 [0117.527] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.527] lstrlenW (lpString=".dbf") returned 4 [0117.527] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.528] lstrlenW (lpString=".1cd") returned 4 [0117.528] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 64 [0117.528] lstrlenW (lpString=".jpg") returned 4 [0117.528] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.528] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") [0117.528] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=53594) returned 1 [0117.528] CloseHandle (hObject=0x168) returned 1 [0117.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx")) returned 0x20 [0117.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0117.529] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.529] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.529] GetLastError () returned 0x0 [0117.530] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xd15a, lpOverlapped=0x0) returned 1 [0117.532] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd160, lpOverlapped=0x0) returned 1 [0117.535] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.535] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0117.535] SetEndOfFile (hFile=0x180) returned 1 [0117.535] CloseHandle (hObject=0x180) returned 1 [0117.535] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.535] SetEndOfFile (hFile=0x168) returned 1 [0117.536] CloseHandle (hObject=0x168) returned 1 [0117.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx")) returned 1 [0117.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.537] lstrlenW (lpString=".doc") returned 4 [0117.537] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".docx") returned 5 [0117.537] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.537] lstrlenW (lpString=".pdf") returned 4 [0117.537] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".xls") returned 4 [0117.537] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".xlsx") returned 5 [0117.537] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.537] lstrlenW (lpString=".ppt") returned 4 [0117.537] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.537] lstrlenW (lpString=".zip") returned 4 [0117.537] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".rar") returned 4 [0117.537] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".bz2") returned 4 [0117.537] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.537] lstrlenW (lpString=".7z") returned 3 [0117.538] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.538] lstrlenW (lpString=".dbf") returned 4 [0117.538] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.538] lstrlenW (lpString=".1cd") returned 4 [0117.538] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 69 [0117.538] lstrlenW (lpString=".jpg") returned 4 [0117.538] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.538] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") [0117.538] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=825294) returned 1 [0117.539] CloseHandle (hObject=0x168) returned 1 [0117.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx")) returned 0x20 [0117.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0117.539] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.539] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.540] GetLastError () returned 0x0 [0117.540] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0xc97ce, lpOverlapped=0x0) returned 1 [0117.560] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xc97d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc97d0, lpOverlapped=0x0) returned 1 [0117.851] ReadFile (in: hFile=0x168, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.851] WriteFile (in: hFile=0x180, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.851] SetEndOfFile (hFile=0x180) returned 1 [0117.852] CloseHandle (hObject=0x180) returned 1 [0117.852] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.852] SetEndOfFile (hFile=0x168) returned 1 [0117.859] CloseHandle (hObject=0x168) returned 1 [0117.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx")) returned 1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.859] lstrlenW (lpString=".doc") returned 4 [0117.859] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.859] lstrlenW (lpString=".docx") returned 5 [0117.860] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.860] lstrlenW (lpString=".pdf") returned 4 [0117.860] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString=".xls") returned 4 [0117.860] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString=".xlsx") returned 5 [0117.860] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.860] lstrlenW (lpString=".ppt") returned 4 [0117.860] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.860] lstrlenW (lpString=".zip") returned 4 [0117.860] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString=".rar") returned 4 [0117.860] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString=".bz2") returned 4 [0117.860] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString=".7z") returned 3 [0117.860] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.860] lstrlenW (lpString=".dbf") returned 4 [0117.860] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.860] lstrlenW (lpString=".1cd") returned 4 [0117.860] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 65 [0117.860] lstrlenW (lpString=".jpg") returned 4 [0117.860] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.860] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") [0118.211] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=961) returned 1 [0118.211] CloseHandle (hObject=0x16c) returned 1 [0118.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml")) returned 0x20 [0118.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.212] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.212] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.213] GetLastError () returned 0x0 [0118.213] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c1, lpOverlapped=0x0) returned 1 [0118.215] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.216] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.216] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0118.216] SetEndOfFile (hFile=0x19c) returned 1 [0118.216] CloseHandle (hObject=0x19c) returned 1 [0118.217] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.217] SetEndOfFile (hFile=0x16c) returned 1 [0118.217] CloseHandle (hObject=0x16c) returned 1 [0118.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml")) returned 1 [0118.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.218] lstrlenW (lpString=".doc") returned 4 [0118.218] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString=".docx") returned 5 [0118.218] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0118.218] lstrlenW (lpString=".pdf") returned 4 [0118.218] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString=".xls") returned 4 [0118.218] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString=".xlsx") returned 5 [0118.218] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0118.218] lstrlenW (lpString=".ppt") returned 4 [0118.218] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.218] lstrlenW (lpString=".zip") returned 4 [0118.218] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.218] lstrlenW (lpString=".rar") returned 4 [0118.218] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString=".bz2") returned 4 [0118.218] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString=".7z") returned 3 [0118.218] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.218] lstrlenW (lpString=".dbf") returned 4 [0118.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.218] lstrlenW (lpString=".1cd") returned 4 [0118.219] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 76 [0118.219] lstrlenW (lpString=".jpg") returned 4 [0118.219] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.219] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") [0118.219] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=927) returned 1 [0118.219] CloseHandle (hObject=0x16c) returned 1 [0118.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml")) returned 0x20 [0118.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.220] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.220] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.220] GetLastError () returned 0x0 [0118.220] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x39f, lpOverlapped=0x0) returned 1 [0118.222] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0118.223] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.223] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.223] SetEndOfFile (hFile=0x19c) returned 1 [0118.223] CloseHandle (hObject=0x19c) returned 1 [0118.223] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.223] SetEndOfFile (hFile=0x16c) returned 1 [0118.224] CloseHandle (hObject=0x16c) returned 1 [0118.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml")) returned 1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.224] lstrlenW (lpString=".doc") returned 4 [0118.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".docx") returned 5 [0118.224] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.224] lstrlenW (lpString=".pdf") returned 4 [0118.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".xls") returned 4 [0118.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".xlsx") returned 5 [0118.225] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.225] lstrlenW (lpString=".ppt") returned 4 [0118.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.225] lstrlenW (lpString=".zip") returned 4 [0118.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.225] lstrlenW (lpString=".rar") returned 4 [0118.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".bz2") returned 4 [0118.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".7z") returned 3 [0118.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.225] lstrlenW (lpString=".dbf") returned 4 [0118.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.225] lstrlenW (lpString=".1cd") returned 4 [0118.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 79 [0118.225] lstrlenW (lpString=".jpg") returned 4 [0118.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.225] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") [0118.226] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=960) returned 1 [0118.226] CloseHandle (hObject=0x16c) returned 1 [0118.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml")) returned 0x20 [0118.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.226] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.226] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.227] GetLastError () returned 0x0 [0118.227] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c0, lpOverlapped=0x0) returned 1 [0118.229] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.229] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.229] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0118.230] SetEndOfFile (hFile=0x19c) returned 1 [0118.230] CloseHandle (hObject=0x19c) returned 1 [0118.230] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.230] SetEndOfFile (hFile=0x16c) returned 1 [0118.231] CloseHandle (hObject=0x16c) returned 1 [0118.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml")) returned 1 [0118.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.231] lstrlenW (lpString=".doc") returned 4 [0118.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.231] lstrlenW (lpString=".docx") returned 5 [0118.231] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0118.231] lstrlenW (lpString=".pdf") returned 4 [0118.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.231] lstrlenW (lpString=".xls") returned 4 [0118.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.231] lstrlenW (lpString=".xlsx") returned 5 [0118.231] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0118.231] lstrlenW (lpString=".ppt") returned 4 [0118.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.231] lstrlenW (lpString=".zip") returned 4 [0118.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.231] lstrlenW (lpString=".rar") returned 4 [0118.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.231] lstrlenW (lpString=".bz2") returned 4 [0118.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.232] lstrlenW (lpString=".7z") returned 3 [0118.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.232] lstrlenW (lpString=".dbf") returned 4 [0118.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.232] lstrlenW (lpString=".1cd") returned 4 [0118.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 75 [0118.232] lstrlenW (lpString=".jpg") returned 4 [0118.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.232] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") [0118.233] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=926) returned 1 [0118.233] CloseHandle (hObject=0x16c) returned 1 [0118.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml")) returned 0x20 [0118.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.233] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.233] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.236] GetLastError () returned 0x0 [0118.236] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x39e, lpOverlapped=0x0) returned 1 [0118.238] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0118.238] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.239] SetEndOfFile (hFile=0x19c) returned 1 [0118.239] CloseHandle (hObject=0x19c) returned 1 [0118.239] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.239] SetEndOfFile (hFile=0x16c) returned 1 [0118.240] CloseHandle (hObject=0x16c) returned 1 [0118.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml")) returned 1 [0118.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.240] lstrlenW (lpString=".doc") returned 4 [0118.240] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.240] lstrlenW (lpString=".docx") returned 5 [0118.240] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0118.240] lstrlenW (lpString=".pdf") returned 4 [0118.240] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.240] lstrlenW (lpString=".xls") returned 4 [0118.240] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.240] lstrlenW (lpString=".xlsx") returned 5 [0118.240] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0118.240] lstrlenW (lpString=".ppt") returned 4 [0118.240] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.240] lstrlenW (lpString=".zip") returned 4 [0118.240] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.241] lstrlenW (lpString=".rar") returned 4 [0118.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.241] lstrlenW (lpString=".bz2") returned 4 [0118.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.241] lstrlenW (lpString=".7z") returned 3 [0118.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.241] lstrlenW (lpString=".dbf") returned 4 [0118.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.241] lstrlenW (lpString=".1cd") returned 4 [0118.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 77 [0118.241] lstrlenW (lpString=".jpg") returned 4 [0118.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.241] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") [0118.242] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=964) returned 1 [0118.242] CloseHandle (hObject=0x16c) returned 1 [0118.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml")) returned 0x20 [0118.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.242] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.243] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.243] GetLastError () returned 0x0 [0118.243] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.245] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.246] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.246] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.246] SetEndOfFile (hFile=0x19c) returned 1 [0118.246] CloseHandle (hObject=0x19c) returned 1 [0118.246] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.246] SetEndOfFile (hFile=0x16c) returned 1 [0118.247] CloseHandle (hObject=0x16c) returned 1 [0118.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml")) returned 1 [0118.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.247] lstrlenW (lpString=".doc") returned 4 [0118.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.247] lstrlenW (lpString=".docx") returned 5 [0118.248] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.248] lstrlenW (lpString=".pdf") returned 4 [0118.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString=".xls") returned 4 [0118.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString=".xlsx") returned 5 [0118.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.248] lstrlenW (lpString=".ppt") returned 4 [0118.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.248] lstrlenW (lpString=".zip") returned 4 [0118.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.248] lstrlenW (lpString=".rar") returned 4 [0118.248] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString=".bz2") returned 4 [0118.248] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString=".7z") returned 3 [0118.248] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.248] lstrlenW (lpString=".dbf") returned 4 [0118.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.248] lstrlenW (lpString=".1cd") returned 4 [0118.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 79 [0118.248] lstrlenW (lpString=".jpg") returned 4 [0118.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.248] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") [0118.249] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=964) returned 1 [0118.249] CloseHandle (hObject=0x16c) returned 1 [0118.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml")) returned 0x20 [0118.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.249] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.249] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.250] GetLastError () returned 0x0 [0118.250] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.251] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.252] ReadFile (in: hFile=0x16c, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.252] WriteFile (in: hFile=0x19c, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.252] SetEndOfFile (hFile=0x19c) returned 1 [0118.252] CloseHandle (hObject=0x19c) returned 1 [0118.253] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.253] SetEndOfFile (hFile=0x16c) returned 1 [0118.253] CloseHandle (hObject=0x16c) returned 1 [0118.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml")) returned 1 [0118.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.254] lstrlenW (lpString=".doc") returned 4 [0118.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString=".docx") returned 5 [0118.254] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.254] lstrlenW (lpString=".pdf") returned 4 [0118.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString=".xls") returned 4 [0118.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString=".xlsx") returned 5 [0118.254] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.254] lstrlenW (lpString=".ppt") returned 4 [0118.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.254] lstrlenW (lpString=".zip") returned 4 [0118.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.254] lstrlenW (lpString=".rar") returned 4 [0118.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString=".bz2") returned 4 [0118.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString=".7z") returned 3 [0118.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.254] lstrlenW (lpString=".dbf") returned 4 [0118.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.255] lstrlenW (lpString=".1cd") returned 4 [0118.255] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 79 [0118.255] lstrlenW (lpString=".jpg") returned 4 [0118.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.255] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") [0118.403] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=962) returned 1 [0118.403] CloseHandle (hObject=0x158) returned 1 [0118.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml")) returned 0x20 [0118.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0118.417] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.417] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0118.431] GetLastError () returned 0x0 [0118.431] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c2, lpOverlapped=0x0) returned 1 [0118.432] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.433] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.433] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.433] SetEndOfFile (hFile=0x1fc) returned 1 [0118.433] CloseHandle (hObject=0x1fc) returned 1 [0118.433] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.433] SetEndOfFile (hFile=0x158) returned 1 [0118.434] CloseHandle (hObject=0x158) returned 1 [0118.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml")) returned 1 [0118.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString=".doc") returned 4 [0118.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString=".docx") returned 5 [0118.435] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.435] lstrlenW (lpString=".pdf") returned 4 [0118.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString=".xls") returned 4 [0118.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString=".xlsx") returned 5 [0118.435] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.435] lstrlenW (lpString=".ppt") returned 4 [0118.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString=".zip") returned 4 [0118.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.435] lstrlenW (lpString=".rar") returned 4 [0118.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString=".bz2") returned 4 [0118.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString=".7z") returned 3 [0118.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString=".dbf") returned 4 [0118.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString=".1cd") returned 4 [0118.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 77 [0118.435] lstrlenW (lpString=".jpg") returned 4 [0118.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.436] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") [0118.437] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=961) returned 1 [0118.437] CloseHandle (hObject=0x158) returned 1 [0118.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml")) returned 0x20 [0118.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0118.437] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.437] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0118.438] GetLastError () returned 0x0 [0118.438] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c1, lpOverlapped=0x0) returned 1 [0118.439] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.440] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.440] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0118.440] SetEndOfFile (hFile=0x1fc) returned 1 [0118.441] CloseHandle (hObject=0x1fc) returned 1 [0118.441] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.441] SetEndOfFile (hFile=0x158) returned 1 [0118.441] CloseHandle (hObject=0x158) returned 1 [0118.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml")) returned 1 [0118.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.442] lstrlenW (lpString=".doc") returned 4 [0118.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString=".docx") returned 5 [0118.442] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0118.442] lstrlenW (lpString=".pdf") returned 4 [0118.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString=".xls") returned 4 [0118.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString=".xlsx") returned 5 [0118.442] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0118.442] lstrlenW (lpString=".ppt") returned 4 [0118.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.442] lstrlenW (lpString=".zip") returned 4 [0118.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.442] lstrlenW (lpString=".rar") returned 4 [0118.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString=".bz2") returned 4 [0118.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.442] lstrlenW (lpString=".7z") returned 3 [0118.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.443] lstrlenW (lpString=".dbf") returned 4 [0118.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.443] lstrlenW (lpString=".1cd") returned 4 [0118.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 76 [0118.443] lstrlenW (lpString=".jpg") returned 4 [0118.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.443] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") [0118.443] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=960) returned 1 [0118.443] CloseHandle (hObject=0x158) returned 1 [0118.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml")) returned 0x20 [0118.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0118.444] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.444] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0118.445] GetLastError () returned 0x0 [0118.445] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x3c0, lpOverlapped=0x0) returned 1 [0118.446] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.447] ReadFile (in: hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.447] WriteFile (in: hFile=0x1fc, lpBuffer=0x3910020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3910020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0118.447] SetEndOfFile (hFile=0x1fc) returned 1 [0118.448] CloseHandle (hObject=0x1fc) returned 1 [0118.448] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.448] SetEndOfFile (hFile=0x158) returned 1 [0118.448] CloseHandle (hObject=0x158) returned 1 [0118.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml")) returned 1 [0118.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.449] lstrlenW (lpString=".doc") returned 4 [0118.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString=".docx") returned 5 [0118.449] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0118.449] lstrlenW (lpString=".pdf") returned 4 [0118.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString=".xls") returned 4 [0118.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString=".xlsx") returned 5 [0118.449] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0118.449] lstrlenW (lpString=".ppt") returned 4 [0118.449] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.449] lstrlenW (lpString=".zip") returned 4 [0118.449] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.449] lstrlenW (lpString=".rar") returned 4 [0118.449] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString=".bz2") returned 4 [0118.449] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.449] lstrlenW (lpString=".7z") returned 3 [0118.449] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.449] lstrlenW (lpString=".dbf") returned 4 [0118.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.450] lstrlenW (lpString=".1cd") returned 4 [0118.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 75 [0118.450] lstrlenW (lpString=".jpg") returned 4 [0118.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.450] RtlInitUnicodeStringEx (DestinationString=0x2d2fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") [0118.450] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=966) returned 1 [0118.450] CloseHandle (hObject=0x158) returned 1 [0118.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml")) returned 0x20 [0118.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0118.451] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.451] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0118.451] GetLastError () returned 0x0 [0118.451] ReadFile (hFile=0x158, lpBuffer=0x3910020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0) Thread: id = 13 os_tid = 0x9d0 [0033.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3730270 [0033.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3740278 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411b0 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6416a0 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411c8 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3a20020 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411e0 [0033.719] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6411e0, Size=0x20) returned 0x629f70 [0033.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411e0 [0033.719] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6411e0, Size=0x20) returned 0x629f48 [0033.719] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.719] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.719] Wow64DisableWow64FsRedirection (in: OldValue=0x2e6ff58 | out: OldValue=0x2e6ff58*=0x0) returned 1 [0033.719] lstrlenW (lpString="kernel32.dll") returned 12 [0033.720] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.720] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.720] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.720] Sleep (dwMilliseconds=0x64) [0033.915] lstrcmpiW (lpString1=".ttf", lpString2=".zoh") returned -1 [0033.915] lstrlenW (lpString="cht_boot.ttf") returned 12 [0033.915] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.797] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3876772) returned 1 [0034.797] CloseHandle (hObject=0x170) returned 1 [0034.797] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0034.797] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.797] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0034.797] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.797] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.797] lstrlenW (lpString=".doc") returned 4 [0034.797] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.797] lstrlenW (lpString=".docx") returned 5 [0034.797] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.797] lstrlenW (lpString=".pdf") returned 4 [0034.798] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString=".xls") returned 4 [0034.798] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.798] lstrlenW (lpString=".xlsx") returned 5 [0034.798] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.798] lstrlenW (lpString=".ppt") returned 4 [0034.798] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString=".zip") returned 4 [0034.798] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.798] lstrlenW (lpString=".rar") returned 4 [0034.798] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString=".bz2") returned 4 [0034.798] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString=".7z") returned 3 [0034.798] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString=".dbf") returned 4 [0034.798] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString=".1cd") returned 4 [0034.798] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString=".jpg") returned 4 [0034.798] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.798] lstrlenW (lpString=".doc") returned 4 [0034.798] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString=".docx") returned 5 [0034.798] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.798] lstrlenW (lpString=".pdf") returned 4 [0034.798] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.798] lstrlenW (lpString=".xls") returned 4 [0034.799] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.799] lstrlenW (lpString=".xlsx") returned 5 [0034.799] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.799] lstrlenW (lpString=".ppt") returned 4 [0034.799] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.799] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.799] lstrlenW (lpString=".zip") returned 4 [0034.799] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.799] lstrlenW (lpString=".rar") returned 4 [0034.799] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.799] lstrlenW (lpString=".bz2") returned 4 [0034.800] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.800] lstrlenW (lpString=".7z") returned 3 [0034.800] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.800] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.800] lstrlenW (lpString=".dbf") returned 4 [0034.800] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.800] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.800] lstrlenW (lpString=".1cd") returned 4 [0034.800] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.800] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0034.800] lstrlenW (lpString=".jpg") returned 4 [0034.800] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.800] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0034.800] lstrlenW (lpString="PptLR.cab") returned 9 [0034.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.693] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=70361744) returned 1 [0035.693] CloseHandle (hObject=0x1a8) returned 1 [0035.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0035.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.693] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0035.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.694] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0035.694] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.694] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.222] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.222] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.250] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.250] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.250] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.284] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.284] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.664] SetEndOfFile (hFile=0x1a8) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0036.668] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.668] WriteFile (in: hFile=0x1a8, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.669] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.669] WriteFile (in: hFile=0x1a8, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.670] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.670] WriteFile (in: hFile=0x1a8, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.672] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.672] CloseHandle (hObject=0x1a8) returned 1 [0039.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0039.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.121] lstrlenW (lpString=".doc") returned 4 [0039.121] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString=".docx") returned 5 [0039.121] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.121] lstrlenW (lpString=".pdf") returned 4 [0039.121] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString=".xls") returned 4 [0039.121] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString=".xlsx") returned 5 [0039.121] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.121] lstrlenW (lpString=".ppt") returned 4 [0039.121] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.121] lstrlenW (lpString=".zip") returned 4 [0039.121] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString=".rar") returned 4 [0039.121] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString=".bz2") returned 4 [0039.121] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.121] lstrlenW (lpString=".7z") returned 3 [0039.121] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.121] lstrlenW (lpString=".dbf") returned 4 [0039.121] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString=".1cd") returned 4 [0039.122] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString=".jpg") returned 4 [0039.122] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString=".doc") returned 4 [0039.122] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString=".docx") returned 5 [0039.122] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.122] lstrlenW (lpString=".pdf") returned 4 [0039.122] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString=".xls") returned 4 [0039.122] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString=".xlsx") returned 5 [0039.122] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.122] lstrlenW (lpString=".ppt") returned 4 [0039.122] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString=".zip") returned 4 [0039.122] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString=".rar") returned 4 [0039.122] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString=".bz2") returned 4 [0039.122] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.122] lstrlenW (lpString=".7z") returned 3 [0039.122] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.122] lstrlenW (lpString=".dbf") returned 4 [0039.122] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.123] lstrlenW (lpString=".1cd") returned 4 [0039.123] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0039.123] lstrlenW (lpString=".jpg") returned 4 [0039.123] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.123] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0039.123] lstrlenW (lpString="WordLR.cab") returned 10 [0039.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.123] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=43806141) returned 1 [0039.123] CloseHandle (hObject=0x1a8) returned 1 [0039.123] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0039.123] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.123] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0039.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.124] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.124] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.124] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.129] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.129] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.144] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.144] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.144] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.160] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.161] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0039.549] SetEndOfFile (hFile=0x1a8) returned 1 [0039.549] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x40b8628 [0039.553] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.553] WriteFile (in: hFile=0x1a8, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.848] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.849] WriteFile (in: hFile=0x1a8, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.851] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.851] WriteFile (in: hFile=0x1a8, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.853] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40b8628 | out: hHeap=0x5c0000) returned 1 [0039.854] CloseHandle (hObject=0x1a8) returned 1 [0041.487] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0041.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.487] lstrlenW (lpString=".doc") returned 4 [0041.488] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString=".docx") returned 5 [0041.488] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.488] lstrlenW (lpString=".pdf") returned 4 [0041.488] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString=".xls") returned 4 [0041.488] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString=".xlsx") returned 5 [0041.488] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.488] lstrlenW (lpString=".ppt") returned 4 [0041.488] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString=".zip") returned 4 [0041.488] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString=".rar") returned 4 [0041.488] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString=".bz2") returned 4 [0041.488] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.488] lstrlenW (lpString=".7z") returned 3 [0041.488] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString=".dbf") returned 4 [0041.488] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString=".1cd") returned 4 [0041.488] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString=".jpg") returned 4 [0041.488] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.488] lstrlenW (lpString=".doc") returned 4 [0041.488] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString=".docx") returned 5 [0041.489] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.489] lstrlenW (lpString=".pdf") returned 4 [0041.489] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString=".xls") returned 4 [0041.489] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString=".xlsx") returned 5 [0041.489] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.489] lstrlenW (lpString=".ppt") returned 4 [0041.489] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.489] lstrlenW (lpString=".zip") returned 4 [0041.489] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString=".rar") returned 4 [0041.489] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString=".bz2") returned 4 [0041.489] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.489] lstrlenW (lpString=".7z") returned 3 [0041.489] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.489] lstrlenW (lpString=".dbf") returned 4 [0041.489] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.489] lstrlenW (lpString=".1cd") returned 4 [0041.489] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.489] lstrlenW (lpString=".jpg") returned 4 [0041.489] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.489] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0041.489] lstrlenW (lpString="Proofing.msi") returned 12 [0041.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0041.490] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=868864) returned 1 [0041.490] CloseHandle (hObject=0x1a8) returned 1 [0041.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0041.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0041.490] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.490] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.491] GetLastError () returned 0x0 [0041.491] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0041.511] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0041.761] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.761] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.761] SetEndOfFile (hFile=0x198) returned 1 [0041.761] CloseHandle (hObject=0x198) returned 1 [0041.768] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.768] SetEndOfFile (hFile=0x1a8) returned 1 [0041.776] CloseHandle (hObject=0x1a8) returned 1 [0041.776] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0041.776] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString=".doc") returned 4 [0041.777] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.777] lstrlenW (lpString=".docx") returned 5 [0041.777] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0041.777] lstrlenW (lpString=".pdf") returned 4 [0041.777] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.777] lstrlenW (lpString=".xls") returned 4 [0041.777] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.777] lstrlenW (lpString=".xlsx") returned 5 [0041.777] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0041.777] lstrlenW (lpString=".ppt") returned 4 [0041.777] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString=".zip") returned 4 [0041.777] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.777] lstrlenW (lpString=".rar") returned 4 [0041.777] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.777] lstrlenW (lpString=".bz2") returned 4 [0041.777] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.777] lstrlenW (lpString=".7z") returned 3 [0041.777] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString=".dbf") returned 4 [0041.777] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString=".1cd") returned 4 [0041.777] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.777] lstrlenW (lpString=".jpg") returned 4 [0041.778] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString=".doc") returned 4 [0041.778] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.778] lstrlenW (lpString=".docx") returned 5 [0041.778] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0041.778] lstrlenW (lpString=".pdf") returned 4 [0041.778] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.778] lstrlenW (lpString=".xls") returned 4 [0041.778] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.778] lstrlenW (lpString=".xlsx") returned 5 [0041.778] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0041.778] lstrlenW (lpString=".ppt") returned 4 [0041.778] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString=".zip") returned 4 [0041.778] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.778] lstrlenW (lpString=".rar") returned 4 [0041.778] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.778] lstrlenW (lpString=".bz2") returned 4 [0041.778] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.778] lstrlenW (lpString=".7z") returned 3 [0041.778] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString=".dbf") returned 4 [0041.778] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString=".1cd") returned 4 [0041.778] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0041.778] lstrlenW (lpString=".jpg") returned 4 [0041.779] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.779] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0041.779] lstrlenW (lpString="Office32MUI.msi") returned 15 [0041.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0041.779] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=873984) returned 1 [0041.779] CloseHandle (hObject=0x1a8) returned 1 [0041.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0041.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0041.780] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.780] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.780] GetLastError () returned 0x0 [0041.780] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0041.800] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0042.019] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.019] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0042.019] SetEndOfFile (hFile=0x198) returned 1 [0042.019] CloseHandle (hObject=0x198) returned 1 [0042.026] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.026] SetEndOfFile (hFile=0x1a8) returned 1 [0042.033] CloseHandle (hObject=0x1a8) returned 1 [0042.033] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0042.034] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0042.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.034] lstrlenW (lpString=".doc") returned 4 [0042.034] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.034] lstrlenW (lpString=".docx") returned 5 [0042.034] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.034] lstrlenW (lpString=".pdf") returned 4 [0042.034] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.034] lstrlenW (lpString=".xls") returned 4 [0042.034] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.034] lstrlenW (lpString=".xlsx") returned 5 [0042.034] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.034] lstrlenW (lpString=".ppt") returned 4 [0042.034] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.034] lstrlenW (lpString=".zip") returned 4 [0042.034] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.034] lstrlenW (lpString=".rar") returned 4 [0042.034] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.034] lstrlenW (lpString=".bz2") returned 4 [0042.034] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.034] lstrlenW (lpString=".7z") returned 3 [0042.034] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.034] lstrlenW (lpString=".dbf") returned 4 [0042.034] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString=".1cd") returned 4 [0042.035] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString=".jpg") returned 4 [0042.035] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString=".doc") returned 4 [0042.035] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString=".docx") returned 5 [0042.035] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.035] lstrlenW (lpString=".pdf") returned 4 [0042.035] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.035] lstrlenW (lpString=".xls") returned 4 [0042.035] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.035] lstrlenW (lpString=".xlsx") returned 5 [0042.035] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.035] lstrlenW (lpString=".ppt") returned 4 [0042.035] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString=".zip") returned 4 [0042.035] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.035] lstrlenW (lpString=".rar") returned 4 [0042.035] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.035] lstrlenW (lpString=".bz2") returned 4 [0042.035] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString=".7z") returned 3 [0042.035] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.035] lstrlenW (lpString=".dbf") returned 4 [0042.035] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.036] lstrlenW (lpString=".1cd") returned 4 [0042.036] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.036] lstrlenW (lpString=".jpg") returned 4 [0042.036] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.036] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0042.036] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0042.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.036] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2928955) returned 1 [0042.036] CloseHandle (hObject=0x1a8) returned 1 [0042.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0042.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.036] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0042.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.037] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.037] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.156] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.351] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.351] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.361] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.361] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.361] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.383] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.383] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.669] SetEndOfFile (hFile=0x1a8) returned 1 [0042.669] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4078620 [0042.673] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.673] WriteFile (in: hFile=0x1a8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.674] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.674] WriteFile (in: hFile=0x1a8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.679] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.682] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4078620 | out: hHeap=0x5c0000) returned 1 [0042.682] CloseHandle (hObject=0x1a8) returned 1 [0043.457] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0043.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString=".doc") returned 4 [0043.458] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString=".docx") returned 5 [0043.458] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.458] lstrlenW (lpString=".pdf") returned 4 [0043.458] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString=".xls") returned 4 [0043.458] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString=".xlsx") returned 5 [0043.458] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.458] lstrlenW (lpString=".ppt") returned 4 [0043.458] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString=".zip") returned 4 [0043.458] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString=".rar") returned 4 [0043.458] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString=".bz2") returned 4 [0043.458] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.458] lstrlenW (lpString=".7z") returned 3 [0043.458] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString=".dbf") returned 4 [0043.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString=".1cd") returned 4 [0043.458] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString=".jpg") returned 4 [0043.458] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.459] lstrlenW (lpString=".doc") returned 4 [0043.459] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString=".docx") returned 5 [0043.459] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.459] lstrlenW (lpString=".pdf") returned 4 [0043.459] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString=".xls") returned 4 [0043.459] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString=".xlsx") returned 5 [0043.459] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.459] lstrlenW (lpString=".ppt") returned 4 [0043.459] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.459] lstrlenW (lpString=".zip") returned 4 [0043.459] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString=".rar") returned 4 [0043.459] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString=".bz2") returned 4 [0043.459] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.459] lstrlenW (lpString=".7z") returned 3 [0043.459] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.459] lstrlenW (lpString=".dbf") returned 4 [0043.459] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.459] lstrlenW (lpString=".1cd") returned 4 [0043.459] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.459] lstrlenW (lpString=".jpg") returned 4 [0043.459] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.460] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0043.460] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0043.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.460] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3124224) returned 1 [0043.460] CloseHandle (hObject=0x1a8) returned 1 [0043.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0043.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.460] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0043.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.461] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.461] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.461] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.468] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.468] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.503] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.503] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.503] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.524] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.524] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0043.790] SetEndOfFile (hFile=0x1a8) returned 1 [0043.790] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0043.793] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.793] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.795] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.795] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.799] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.799] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.807] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0043.807] CloseHandle (hObject=0x1a8) returned 1 [0043.807] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0043.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.807] lstrlenW (lpString=".doc") returned 4 [0043.807] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.807] lstrlenW (lpString=".docx") returned 5 [0043.807] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.807] lstrlenW (lpString=".pdf") returned 4 [0043.807] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.807] lstrlenW (lpString=".xls") returned 4 [0043.807] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.807] lstrlenW (lpString=".xlsx") returned 5 [0043.807] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.807] lstrlenW (lpString=".ppt") returned 4 [0043.807] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.807] lstrlenW (lpString=".zip") returned 4 [0043.807] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString=".rar") returned 4 [0043.808] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString=".bz2") returned 4 [0043.808] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.808] lstrlenW (lpString=".7z") returned 3 [0043.808] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString=".dbf") returned 4 [0043.808] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString=".1cd") returned 4 [0043.808] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString=".jpg") returned 4 [0043.808] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString=".doc") returned 4 [0043.808] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.808] lstrlenW (lpString=".docx") returned 5 [0043.808] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.808] lstrlenW (lpString=".pdf") returned 4 [0043.808] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString=".xls") returned 4 [0043.808] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString=".xlsx") returned 5 [0043.808] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.808] lstrlenW (lpString=".ppt") returned 4 [0043.808] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.808] lstrlenW (lpString=".zip") returned 4 [0043.808] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.808] lstrlenW (lpString=".rar") returned 4 [0043.809] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.809] lstrlenW (lpString=".bz2") returned 4 [0043.809] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.809] lstrlenW (lpString=".7z") returned 3 [0043.809] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.809] lstrlenW (lpString=".dbf") returned 4 [0043.809] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.809] lstrlenW (lpString=".1cd") returned 4 [0043.809] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.809] lstrlenW (lpString=".jpg") returned 4 [0043.809] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.809] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0043.809] lstrlenW (lpString="VisioMUI.msi") returned 12 [0043.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.809] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2797568) returned 1 [0043.809] CloseHandle (hObject=0x1a8) returned 1 [0043.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0043.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.810] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0043.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.810] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.810] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.810] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.819] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.819] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.156] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.156] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.157] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.182] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.182] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.202] SetEndOfFile (hFile=0x1a8) returned 1 [0044.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0044.202] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.202] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.204] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.204] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.433] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.433] WriteFile (in: hFile=0x1a8, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0044.488] CloseHandle (hObject=0x1a8) returned 1 [0044.488] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0044.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.488] lstrlenW (lpString=".doc") returned 4 [0044.488] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.489] lstrlenW (lpString=".docx") returned 5 [0044.489] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.489] lstrlenW (lpString=".pdf") returned 4 [0044.489] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.489] lstrlenW (lpString=".xls") returned 4 [0044.489] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.489] lstrlenW (lpString=".xlsx") returned 5 [0044.489] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.489] lstrlenW (lpString=".ppt") returned 4 [0044.489] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString=".zip") returned 4 [0044.489] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.489] lstrlenW (lpString=".rar") returned 4 [0044.489] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.489] lstrlenW (lpString=".bz2") returned 4 [0044.489] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.489] lstrlenW (lpString=".7z") returned 3 [0044.489] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString=".dbf") returned 4 [0044.489] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString=".1cd") returned 4 [0044.489] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString=".jpg") returned 4 [0044.489] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.489] lstrlenW (lpString=".doc") returned 4 [0044.489] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.490] lstrlenW (lpString=".docx") returned 5 [0044.490] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.490] lstrlenW (lpString=".pdf") returned 4 [0044.490] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.490] lstrlenW (lpString=".xls") returned 4 [0044.490] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.490] lstrlenW (lpString=".xlsx") returned 5 [0044.490] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.490] lstrlenW (lpString=".ppt") returned 4 [0044.490] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.490] lstrlenW (lpString=".zip") returned 4 [0044.490] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.490] lstrlenW (lpString=".rar") returned 4 [0044.490] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.490] lstrlenW (lpString=".bz2") returned 4 [0044.490] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.490] lstrlenW (lpString=".7z") returned 3 [0044.490] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.490] lstrlenW (lpString=".dbf") returned 4 [0044.490] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.490] lstrlenW (lpString=".1cd") returned 4 [0044.490] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0044.490] lstrlenW (lpString=".jpg") returned 4 [0044.490] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.491] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0044.491] lstrlenW (lpString="OnoteLR.cab") returned 11 [0044.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.491] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=17456632) returned 1 [0044.491] CloseHandle (hObject=0x1a8) returned 1 [0044.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0044.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.491] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0044.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.587] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.587] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.587] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.631] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.631] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.641] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.642] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.642] ReadFile (in: hFile=0x1a8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.662] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.662] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0044.930] SetEndOfFile (hFile=0x1a8) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4128668 [0044.934] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x1a8, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.934] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.934] WriteFile (in: hFile=0x1a8, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.935] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.935] WriteFile (in: hFile=0x1a8, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.937] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4128668 | out: hHeap=0x5c0000) returned 1 [0044.937] CloseHandle (hObject=0x1a8) returned 1 [0044.937] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0044.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.938] lstrlenW (lpString=".doc") returned 4 [0044.938] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString=".docx") returned 5 [0044.938] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.938] lstrlenW (lpString=".pdf") returned 4 [0044.938] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString=".xls") returned 4 [0044.938] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString=".xlsx") returned 5 [0044.938] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.938] lstrlenW (lpString=".ppt") returned 4 [0044.938] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.938] lstrlenW (lpString=".zip") returned 4 [0044.938] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString=".rar") returned 4 [0044.938] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString=".bz2") returned 4 [0044.938] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.938] lstrlenW (lpString=".7z") returned 3 [0044.938] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.938] lstrlenW (lpString=".dbf") returned 4 [0044.938] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.938] lstrlenW (lpString=".1cd") returned 4 [0044.939] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString=".jpg") returned 4 [0044.939] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString=".doc") returned 4 [0044.939] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString=".docx") returned 5 [0044.939] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.939] lstrlenW (lpString=".pdf") returned 4 [0044.939] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString=".xls") returned 4 [0044.939] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString=".xlsx") returned 5 [0044.939] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.939] lstrlenW (lpString=".ppt") returned 4 [0044.939] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString=".zip") returned 4 [0044.939] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString=".rar") returned 4 [0044.939] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString=".bz2") returned 4 [0044.939] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.939] lstrlenW (lpString=".7z") returned 3 [0044.939] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString=".dbf") returned 4 [0044.939] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.939] lstrlenW (lpString=".1cd") returned 4 [0044.940] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.940] lstrlenW (lpString=".jpg") returned 4 [0044.940] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.940] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0044.940] lstrlenW (lpString="ProjLR.cab") returned 10 [0044.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.252] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=8265165) returned 1 [0045.260] CloseHandle (hObject=0x1f4) returned 1 [0045.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0045.264] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.264] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0045.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.290] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.290] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.290] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.293] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.293] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.299] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.299] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.299] ReadFile (in: hFile=0x1f4, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.469] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.470] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0045.492] SetEndOfFile (hFile=0x1f4) returned 1 [0045.492] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0045.552] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.553] WriteFile (in: hFile=0x1f4, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.555] WriteFile (in: hFile=0x1f4, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.558] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.558] WriteFile (in: hFile=0x1f4, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.560] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0045.560] CloseHandle (hObject=0x1f4) returned 1 [0045.560] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.560] lstrlenW (lpString=".doc") returned 4 [0045.560] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.560] lstrlenW (lpString=".docx") returned 5 [0045.560] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.560] lstrlenW (lpString=".pdf") returned 4 [0045.560] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.560] lstrlenW (lpString=".xls") returned 4 [0045.560] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.560] lstrlenW (lpString=".xlsx") returned 5 [0045.561] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.561] lstrlenW (lpString=".ppt") returned 4 [0045.561] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString=".zip") returned 4 [0045.561] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString=".rar") returned 4 [0045.561] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString=".bz2") returned 4 [0045.561] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.561] lstrlenW (lpString=".7z") returned 3 [0045.561] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString=".dbf") returned 4 [0045.561] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString=".1cd") returned 4 [0045.561] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString=".jpg") returned 4 [0045.561] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.561] lstrlenW (lpString=".doc") returned 4 [0045.561] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.561] lstrlenW (lpString=".docx") returned 5 [0045.561] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.561] lstrlenW (lpString=".pdf") returned 4 [0045.561] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString=".xls") returned 4 [0045.562] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString=".xlsx") returned 5 [0045.562] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.562] lstrlenW (lpString=".ppt") returned 4 [0045.562] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.562] lstrlenW (lpString=".zip") returned 4 [0045.562] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString=".rar") returned 4 [0045.562] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString=".bz2") returned 4 [0045.562] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.562] lstrlenW (lpString=".7z") returned 3 [0045.562] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.562] lstrlenW (lpString=".dbf") returned 4 [0045.562] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.562] lstrlenW (lpString=".1cd") returned 4 [0045.562] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0045.562] lstrlenW (lpString=".jpg") returned 4 [0045.562] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.562] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0045.562] lstrlenW (lpString="dwtrig20.exe") returned 12 [0045.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.563] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=519584) returned 1 [0045.563] CloseHandle (hObject=0x1f4) returned 1 [0045.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0045.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0045.563] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.563] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.504] GetLastError () returned 0x0 [0046.504] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0046.609] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0046.618] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.618] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.618] SetEndOfFile (hFile=0x1bc) returned 1 [0046.618] CloseHandle (hObject=0x1bc) returned 1 [0046.618] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.618] SetEndOfFile (hFile=0x1f4) returned 1 [0046.624] CloseHandle (hObject=0x1f4) returned 1 [0046.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0046.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.625] lstrlenW (lpString=".doc") returned 4 [0046.625] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.625] lstrlenW (lpString=".docx") returned 5 [0046.625] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.625] lstrlenW (lpString=".pdf") returned 4 [0046.625] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.625] lstrlenW (lpString=".xls") returned 4 [0046.625] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.625] lstrlenW (lpString=".xlsx") returned 5 [0046.625] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.625] lstrlenW (lpString=".ppt") returned 4 [0046.625] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.625] lstrlenW (lpString=".zip") returned 4 [0046.625] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.625] lstrlenW (lpString=".rar") returned 4 [0046.625] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.625] lstrlenW (lpString=".bz2") returned 4 [0046.625] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.625] lstrlenW (lpString=".7z") returned 3 [0046.625] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.625] lstrlenW (lpString=".dbf") returned 4 [0046.626] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.626] lstrlenW (lpString=".1cd") returned 4 [0046.626] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.626] lstrlenW (lpString=".jpg") returned 4 [0046.626] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.626] lstrlenW (lpString=".doc") returned 4 [0046.626] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.626] lstrlenW (lpString=".docx") returned 5 [0046.626] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.626] lstrlenW (lpString=".pdf") returned 4 [0046.626] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString=".xls") returned 4 [0046.626] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString=".xlsx") returned 5 [0046.626] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.626] lstrlenW (lpString=".ppt") returned 4 [0046.626] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.626] lstrlenW (lpString=".zip") returned 4 [0046.626] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString=".rar") returned 4 [0046.626] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.626] lstrlenW (lpString=".bz2") returned 4 [0046.626] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.626] lstrlenW (lpString=".7z") returned 3 [0046.626] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.627] lstrlenW (lpString=".dbf") returned 4 [0046.627] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.627] lstrlenW (lpString=".1cd") returned 4 [0046.627] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.627] lstrlenW (lpString=".jpg") returned 4 [0046.627] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.627] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0046.627] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0046.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.627] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=868864) returned 1 [0046.627] CloseHandle (hObject=0x1f4) returned 1 [0046.627] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0046.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.628] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.628] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.628] GetLastError () returned 0x0 [0046.628] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0046.779] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0046.798] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.798] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0046.798] SetEndOfFile (hFile=0x1bc) returned 1 [0046.798] CloseHandle (hObject=0x1bc) returned 1 [0046.798] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.799] SetEndOfFile (hFile=0x1f4) returned 1 [0046.806] CloseHandle (hObject=0x1f4) returned 1 [0046.806] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.806] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0046.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.806] lstrlenW (lpString=".doc") returned 4 [0046.806] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.806] lstrlenW (lpString=".docx") returned 5 [0046.806] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0046.806] lstrlenW (lpString=".pdf") returned 4 [0046.806] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.807] lstrlenW (lpString=".xls") returned 4 [0046.807] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.807] lstrlenW (lpString=".xlsx") returned 5 [0046.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0046.807] lstrlenW (lpString=".ppt") returned 4 [0046.807] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString=".zip") returned 4 [0046.807] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.807] lstrlenW (lpString=".rar") returned 4 [0046.807] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.807] lstrlenW (lpString=".bz2") returned 4 [0046.807] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.807] lstrlenW (lpString=".7z") returned 3 [0046.807] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString=".dbf") returned 4 [0046.807] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString=".1cd") returned 4 [0046.807] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString=".jpg") returned 4 [0046.807] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.807] lstrlenW (lpString=".doc") returned 4 [0046.807] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.807] lstrlenW (lpString=".docx") returned 5 [0046.807] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0046.808] lstrlenW (lpString=".pdf") returned 4 [0046.808] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.808] lstrlenW (lpString=".xls") returned 4 [0046.808] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.808] lstrlenW (lpString=".xlsx") returned 5 [0046.808] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0046.808] lstrlenW (lpString=".ppt") returned 4 [0046.808] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.808] lstrlenW (lpString=".zip") returned 4 [0046.808] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.808] lstrlenW (lpString=".rar") returned 4 [0046.808] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.808] lstrlenW (lpString=".bz2") returned 4 [0046.808] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.808] lstrlenW (lpString=".7z") returned 3 [0046.808] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.808] lstrlenW (lpString=".dbf") returned 4 [0046.808] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.808] lstrlenW (lpString=".1cd") returned 4 [0046.808] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0046.808] lstrlenW (lpString=".jpg") returned 4 [0046.808] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.808] lstrcmpiW (lpString1=".MST", lpString2=".zoh") returned -1 [0046.809] lstrlenW (lpString="ShellUI.MST") returned 11 [0046.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.809] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3584) returned 1 [0046.809] CloseHandle (hObject=0x1f4) returned 1 [0046.809] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0046.809] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0046.809] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.809] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.810] GetLastError () returned 0x0 [0046.810] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe00, lpOverlapped=0x0) returned 1 [0047.037] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0047.038] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.038] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.039] SetEndOfFile (hFile=0x1bc) returned 1 [0047.039] CloseHandle (hObject=0x1bc) returned 1 [0047.039] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.039] SetEndOfFile (hFile=0x1f4) returned 1 [0047.040] CloseHandle (hObject=0x1f4) returned 1 [0047.040] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0047.040] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0047.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.040] lstrlenW (lpString=".doc") returned 4 [0047.041] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0047.041] lstrlenW (lpString=".docx") returned 5 [0047.041] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0047.041] lstrlenW (lpString=".pdf") returned 4 [0047.041] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0047.041] lstrlenW (lpString=".xls") returned 4 [0047.041] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0047.041] lstrlenW (lpString=".xlsx") returned 5 [0047.041] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0047.041] lstrlenW (lpString=".ppt") returned 4 [0047.041] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0047.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.041] lstrlenW (lpString=".zip") returned 4 [0047.041] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0047.041] lstrlenW (lpString=".rar") returned 4 [0047.041] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0047.041] lstrlenW (lpString=".bz2") returned 4 [0047.041] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0047.041] lstrlenW (lpString=".7z") returned 3 [0047.041] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0047.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.041] lstrlenW (lpString=".dbf") returned 4 [0047.041] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0047.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.041] lstrlenW (lpString=".1cd") returned 4 [0047.041] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0047.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.041] lstrlenW (lpString=".jpg") returned 4 [0047.041] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0047.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.042] lstrlenW (lpString=".doc") returned 4 [0047.042] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0047.042] lstrlenW (lpString=".docx") returned 5 [0047.042] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0047.042] lstrlenW (lpString=".pdf") returned 4 [0047.042] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0047.042] lstrlenW (lpString=".xls") returned 4 [0047.042] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0047.042] lstrlenW (lpString=".xlsx") returned 5 [0047.042] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0047.042] lstrlenW (lpString=".ppt") returned 4 [0047.042] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0047.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.042] lstrlenW (lpString=".zip") returned 4 [0047.042] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0047.042] lstrlenW (lpString=".rar") returned 4 [0047.042] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0047.042] lstrlenW (lpString=".bz2") returned 4 [0047.042] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0047.042] lstrlenW (lpString=".7z") returned 3 [0047.042] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0047.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.042] lstrlenW (lpString=".dbf") returned 4 [0047.042] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0047.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.042] lstrlenW (lpString=".1cd") returned 4 [0047.043] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0047.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0047.043] lstrlenW (lpString=".jpg") returned 4 [0047.043] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0047.043] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0047.043] lstrlenW (lpString="Office32WW.msi") returned 14 [0047.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0047.043] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1992192) returned 1 [0047.043] CloseHandle (hObject=0x1f4) returned 1 [0047.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0047.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.043] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0047.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0047.044] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.044] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.044] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.229] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.245] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.601] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.601] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.601] ReadFile (in: hFile=0x1f4, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.182] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.182] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.207] SetEndOfFile (hFile=0x1f4) returned 1 [0048.207] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0048.211] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.211] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.212] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.212] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.215] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.308] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.311] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0048.311] CloseHandle (hObject=0x1f4) returned 1 [0048.311] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.311] lstrlenW (lpString=".doc") returned 4 [0048.311] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.311] lstrlenW (lpString=".docx") returned 5 [0048.311] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.311] lstrlenW (lpString=".pdf") returned 4 [0048.311] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.311] lstrlenW (lpString=".xls") returned 4 [0048.311] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.311] lstrlenW (lpString=".xlsx") returned 5 [0048.312] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.312] lstrlenW (lpString=".ppt") returned 4 [0048.312] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString=".zip") returned 4 [0048.312] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.312] lstrlenW (lpString=".rar") returned 4 [0048.312] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.312] lstrlenW (lpString=".bz2") returned 4 [0048.312] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.312] lstrlenW (lpString=".7z") returned 3 [0048.312] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString=".dbf") returned 4 [0048.312] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString=".1cd") returned 4 [0048.312] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString=".jpg") returned 4 [0048.312] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.312] lstrlenW (lpString=".doc") returned 4 [0048.312] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.312] lstrlenW (lpString=".docx") returned 5 [0048.312] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.312] lstrlenW (lpString=".pdf") returned 4 [0048.312] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.312] lstrlenW (lpString=".xls") returned 4 [0048.313] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.313] lstrlenW (lpString=".xlsx") returned 5 [0048.313] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.313] lstrlenW (lpString=".ppt") returned 4 [0048.313] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.313] lstrlenW (lpString=".zip") returned 4 [0048.313] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.313] lstrlenW (lpString=".rar") returned 4 [0048.313] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.313] lstrlenW (lpString=".bz2") returned 4 [0048.313] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.313] lstrlenW (lpString=".7z") returned 3 [0048.313] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.313] lstrlenW (lpString=".dbf") returned 4 [0048.313] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.313] lstrlenW (lpString=".1cd") returned 4 [0048.313] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.313] lstrlenW (lpString=".jpg") returned 4 [0048.313] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.313] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0048.313] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0048.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.314] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=27532288) returned 1 [0048.314] CloseHandle (hObject=0x1f4) returned 1 [0048.314] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0048.314] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.314] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0048.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.315] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.315] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.315] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.383] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.484] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.484] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.484] ReadFile (in: hFile=0x1f4, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.571] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.571] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.587] SetEndOfFile (hFile=0x1f4) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0048.847] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.847] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.848] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.848] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.852] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.852] WriteFile (in: hFile=0x1f4, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.854] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0048.857] CloseHandle (hObject=0x1f4) returned 1 [0049.085] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0049.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.086] lstrlenW (lpString=".doc") returned 4 [0049.086] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.086] lstrlenW (lpString=".docx") returned 5 [0049.086] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.086] lstrlenW (lpString=".pdf") returned 4 [0049.086] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.086] lstrlenW (lpString=".xls") returned 4 [0049.086] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.086] lstrlenW (lpString=".xlsx") returned 5 [0049.086] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.086] lstrlenW (lpString=".ppt") returned 4 [0049.086] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.086] lstrlenW (lpString=".zip") returned 4 [0049.086] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.086] lstrlenW (lpString=".rar") returned 4 [0049.086] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.086] lstrlenW (lpString=".bz2") returned 4 [0049.086] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.086] lstrlenW (lpString=".7z") returned 3 [0049.086] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.086] lstrlenW (lpString=".dbf") returned 4 [0049.086] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.086] lstrlenW (lpString=".1cd") returned 4 [0049.086] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.086] lstrlenW (lpString=".jpg") returned 4 [0049.086] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString=".doc") returned 4 [0049.087] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.087] lstrlenW (lpString=".docx") returned 5 [0049.087] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.087] lstrlenW (lpString=".pdf") returned 4 [0049.087] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.087] lstrlenW (lpString=".xls") returned 4 [0049.087] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.087] lstrlenW (lpString=".xlsx") returned 5 [0049.087] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.087] lstrlenW (lpString=".ppt") returned 4 [0049.087] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString=".zip") returned 4 [0049.087] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.087] lstrlenW (lpString=".rar") returned 4 [0049.087] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.087] lstrlenW (lpString=".bz2") returned 4 [0049.087] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.087] lstrlenW (lpString=".7z") returned 3 [0049.087] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString=".dbf") returned 4 [0049.087] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString=".1cd") returned 4 [0049.087] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.087] lstrlenW (lpString=".jpg") returned 4 [0049.087] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.088] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0049.088] lstrlenW (lpString="Office32WW.msi") returned 14 [0049.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.387] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1992192) returned 1 [0049.387] CloseHandle (hObject=0x198) returned 1 [0049.387] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0049.387] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.387] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0050.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0050.468] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.469] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.469] ReadFile (in: hFile=0x198, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.473] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.473] ReadFile (in: hFile=0x198, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.480] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.480] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.480] ReadFile (in: hFile=0x198, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.496] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.496] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0050.681] SetEndOfFile (hFile=0x198) returned 1 [0050.681] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0050.681] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.681] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.683] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.683] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.685] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.685] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.687] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0050.687] CloseHandle (hObject=0x198) returned 1 [0050.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.687] lstrlenW (lpString=".doc") returned 4 [0050.687] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.687] lstrlenW (lpString=".docx") returned 5 [0050.687] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.687] lstrlenW (lpString=".pdf") returned 4 [0050.687] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.687] lstrlenW (lpString=".xls") returned 4 [0050.687] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.687] lstrlenW (lpString=".xlsx") returned 5 [0050.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.687] lstrlenW (lpString=".ppt") returned 4 [0050.687] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.687] lstrlenW (lpString=".zip") returned 4 [0050.688] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString=".rar") returned 4 [0050.688] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString=".bz2") returned 4 [0050.688] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.688] lstrlenW (lpString=".7z") returned 3 [0050.688] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString=".dbf") returned 4 [0050.688] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString=".1cd") returned 4 [0050.688] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString=".jpg") returned 4 [0050.688] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString=".doc") returned 4 [0050.688] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.688] lstrlenW (lpString=".docx") returned 5 [0050.688] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0050.688] lstrlenW (lpString=".pdf") returned 4 [0050.688] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString=".xls") returned 4 [0050.688] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString=".xlsx") returned 5 [0050.688] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0050.688] lstrlenW (lpString=".ppt") returned 4 [0050.688] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.688] lstrlenW (lpString=".zip") returned 4 [0050.688] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.688] lstrlenW (lpString=".rar") returned 4 [0050.689] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.689] lstrlenW (lpString=".bz2") returned 4 [0050.689] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.689] lstrlenW (lpString=".7z") returned 3 [0050.689] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.689] lstrlenW (lpString=".dbf") returned 4 [0050.689] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.689] lstrlenW (lpString=".1cd") returned 4 [0050.689] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0050.689] lstrlenW (lpString=".jpg") returned 4 [0050.689] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.689] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0050.689] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0050.689] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0050.773] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=10798080) returned 1 [0050.773] CloseHandle (hObject=0x1bc) returned 1 [0050.773] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0050.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.774] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0050.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0050.774] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.774] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.774] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.854] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.854] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.898] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.898] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.898] ReadFile (in: hFile=0x1bc, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.011] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.011] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0051.035] SetEndOfFile (hFile=0x1bc) returned 1 [0051.035] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0051.036] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.036] WriteFile (in: hFile=0x1bc, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.041] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.041] WriteFile (in: hFile=0x1bc, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.043] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.043] WriteFile (in: hFile=0x1bc, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.329] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0051.331] CloseHandle (hObject=0x1bc) returned 1 [0051.331] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.331] lstrlenW (lpString=".doc") returned 4 [0051.331] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.331] lstrlenW (lpString=".docx") returned 5 [0051.331] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.331] lstrlenW (lpString=".pdf") returned 4 [0051.331] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.331] lstrlenW (lpString=".xls") returned 4 [0051.331] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.331] lstrlenW (lpString=".xlsx") returned 5 [0051.331] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.332] lstrlenW (lpString=".ppt") returned 4 [0051.332] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString=".zip") returned 4 [0051.332] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.332] lstrlenW (lpString=".rar") returned 4 [0051.332] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.332] lstrlenW (lpString=".bz2") returned 4 [0051.332] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.332] lstrlenW (lpString=".7z") returned 3 [0051.332] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString=".dbf") returned 4 [0051.332] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString=".1cd") returned 4 [0051.332] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString=".jpg") returned 4 [0051.332] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.332] lstrlenW (lpString=".doc") returned 4 [0051.332] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.332] lstrlenW (lpString=".docx") returned 5 [0051.332] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.332] lstrlenW (lpString=".pdf") returned 4 [0051.332] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.332] lstrlenW (lpString=".xls") returned 4 [0051.332] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.332] lstrlenW (lpString=".xlsx") returned 5 [0051.332] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.333] lstrlenW (lpString=".ppt") returned 4 [0051.333] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.333] lstrlenW (lpString=".zip") returned 4 [0051.333] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.333] lstrlenW (lpString=".rar") returned 4 [0051.333] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.333] lstrlenW (lpString=".bz2") returned 4 [0051.333] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.333] lstrlenW (lpString=".7z") returned 3 [0051.333] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.333] lstrlenW (lpString=".dbf") returned 4 [0051.333] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.333] lstrlenW (lpString=".1cd") returned 4 [0051.333] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.333] lstrlenW (lpString=".jpg") returned 4 [0051.333] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.333] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0051.333] lstrlenW (lpString="osetup.dll") returned 10 [0051.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.641] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7378792) returned 1 [0051.641] CloseHandle (hObject=0x160) returned 1 [0051.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0051.641] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0051.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.642] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.642] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.642] ReadFile (in: hFile=0x160, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.653] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.653] ReadFile (in: hFile=0x160, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.658] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.658] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.658] ReadFile (in: hFile=0x160, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.683] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.684] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0051.930] SetEndOfFile (hFile=0x160) returned 1 [0051.931] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0051.934] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.934] WriteFile (in: hFile=0x160, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.936] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.936] WriteFile (in: hFile=0x160, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.938] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.938] WriteFile (in: hFile=0x160, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.939] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0051.939] CloseHandle (hObject=0x160) returned 1 [0051.940] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.940] lstrlenW (lpString=".doc") returned 4 [0051.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString=".docx") returned 5 [0051.940] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0051.940] lstrlenW (lpString=".pdf") returned 4 [0051.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString=".xls") returned 4 [0051.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString=".xlsx") returned 5 [0051.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0051.940] lstrlenW (lpString=".ppt") returned 4 [0051.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.940] lstrlenW (lpString=".zip") returned 4 [0051.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString=".rar") returned 4 [0051.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.940] lstrlenW (lpString=".bz2") returned 4 [0051.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.941] lstrlenW (lpString=".7z") returned 3 [0051.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString=".dbf") returned 4 [0051.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString=".1cd") returned 4 [0051.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString=".jpg") returned 4 [0051.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString=".doc") returned 4 [0051.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString=".docx") returned 5 [0051.941] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0051.941] lstrlenW (lpString=".pdf") returned 4 [0051.941] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString=".xls") returned 4 [0051.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString=".xlsx") returned 5 [0051.941] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0051.941] lstrlenW (lpString=".ppt") returned 4 [0051.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.941] lstrlenW (lpString=".zip") returned 4 [0051.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString=".rar") returned 4 [0051.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.941] lstrlenW (lpString=".bz2") returned 4 [0051.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.941] lstrlenW (lpString=".7z") returned 3 [0051.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.942] lstrlenW (lpString=".dbf") returned 4 [0051.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.942] lstrlenW (lpString=".1cd") returned 4 [0051.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0051.942] lstrlenW (lpString=".jpg") returned 4 [0051.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.942] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0051.942] lstrlenW (lpString="VisiorWW.cab") returned 12 [0051.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.942] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=195011319) returned 1 [0051.942] CloseHandle (hObject=0x160) returned 1 [0051.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0051.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0051.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0051.943] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.943] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.943] ReadFile (in: hFile=0x160, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.949] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.949] ReadFile (in: hFile=0x160, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.953] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.953] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.953] ReadFile (in: hFile=0x160, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.969] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.969] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.193] SetEndOfFile (hFile=0x160) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0052.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.197] WriteFile (in: hFile=0x160, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.197] WriteFile (in: hFile=0x160, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.199] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.199] WriteFile (in: hFile=0x160, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0052.201] CloseHandle (hObject=0x160) returned 1 [0052.202] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0052.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.202] lstrlenW (lpString=".doc") returned 4 [0052.202] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString=".docx") returned 5 [0052.202] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.202] lstrlenW (lpString=".pdf") returned 4 [0052.202] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString=".xls") returned 4 [0052.202] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString=".xlsx") returned 5 [0052.202] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.202] lstrlenW (lpString=".ppt") returned 4 [0052.202] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.202] lstrlenW (lpString=".zip") returned 4 [0052.202] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString=".rar") returned 4 [0052.202] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.202] lstrlenW (lpString=".bz2") returned 4 [0052.202] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.202] lstrlenW (lpString=".7z") returned 3 [0052.202] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString=".dbf") returned 4 [0052.203] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString=".1cd") returned 4 [0052.203] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString=".jpg") returned 4 [0052.203] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString=".doc") returned 4 [0052.203] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString=".docx") returned 5 [0052.203] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.203] lstrlenW (lpString=".pdf") returned 4 [0052.203] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString=".xls") returned 4 [0052.203] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString=".xlsx") returned 5 [0052.203] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.203] lstrlenW (lpString=".ppt") returned 4 [0052.203] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.203] lstrlenW (lpString=".zip") returned 4 [0052.203] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString=".rar") returned 4 [0052.203] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.203] lstrlenW (lpString=".bz2") returned 4 [0052.203] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.203] lstrlenW (lpString=".7z") returned 3 [0052.203] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.204] lstrlenW (lpString=".dbf") returned 4 [0052.204] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.204] lstrlenW (lpString=".1cd") returned 4 [0052.204] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.204] lstrlenW (lpString=".jpg") returned 4 [0052.204] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.204] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0052.204] lstrlenW (lpString="DW20.EXE") returned 8 [0052.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.551] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=994184) returned 1 [0052.551] CloseHandle (hObject=0x218) returned 1 [0052.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0052.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.552] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.583] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.883] GetLastError () returned 0x0 [0052.883] ReadFile (in: hFile=0x218, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0052.905] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0052.921] ReadFile (in: hFile=0x218, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.921] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0052.921] SetEndOfFile (hFile=0x1f8) returned 1 [0052.921] CloseHandle (hObject=0x1f8) returned 1 [0052.921] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.921] SetEndOfFile (hFile=0x218) returned 1 [0053.181] CloseHandle (hObject=0x218) returned 1 [0053.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0053.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString=".doc") returned 4 [0053.183] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.183] lstrlenW (lpString=".docx") returned 5 [0053.183] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.183] lstrlenW (lpString=".pdf") returned 4 [0053.183] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.183] lstrlenW (lpString=".xls") returned 4 [0053.183] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.183] lstrlenW (lpString=".xlsx") returned 5 [0053.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.183] lstrlenW (lpString=".ppt") returned 4 [0053.183] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString=".zip") returned 4 [0053.183] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.183] lstrlenW (lpString=".rar") returned 4 [0053.183] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.183] lstrlenW (lpString=".bz2") returned 4 [0053.183] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.183] lstrlenW (lpString=".7z") returned 3 [0053.183] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString=".dbf") returned 4 [0053.183] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString=".1cd") returned 4 [0053.183] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.183] lstrlenW (lpString=".jpg") returned 4 [0053.184] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString=".doc") returned 4 [0053.184] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.184] lstrlenW (lpString=".docx") returned 5 [0053.184] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.184] lstrlenW (lpString=".pdf") returned 4 [0053.184] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString=".xls") returned 4 [0053.184] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString=".xlsx") returned 5 [0053.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.184] lstrlenW (lpString=".ppt") returned 4 [0053.184] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString=".zip") returned 4 [0053.184] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString=".rar") returned 4 [0053.184] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.184] lstrlenW (lpString=".bz2") returned 4 [0053.184] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.184] lstrlenW (lpString=".7z") returned 3 [0053.184] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString=".dbf") returned 4 [0053.184] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString=".1cd") returned 4 [0053.184] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.184] lstrlenW (lpString=".jpg") returned 4 [0053.185] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.185] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0053.185] lstrlenW (lpString="VISFILT.DLL") returned 11 [0053.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.091] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2124664) returned 1 [0054.091] CloseHandle (hObject=0x188) returned 1 [0054.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0054.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0054.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.093] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.093] ReadFile (in: hFile=0x188, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.096] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.096] ReadFile (in: hFile=0x188, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.101] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.101] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.101] ReadFile (in: hFile=0x188, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.125] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.126] WriteFile (in: hFile=0x188, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0054.184] SetEndOfFile (hFile=0x188) returned 1 [0054.185] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0054.189] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.189] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.508] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.508] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.510] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.511] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.512] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0054.512] CloseHandle (hObject=0x188) returned 1 [0054.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.512] lstrlenW (lpString=".doc") returned 4 [0054.512] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.512] lstrlenW (lpString=".docx") returned 5 [0054.513] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.513] lstrlenW (lpString=".pdf") returned 4 [0054.513] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString=".xls") returned 4 [0054.513] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString=".xlsx") returned 5 [0054.513] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.513] lstrlenW (lpString=".ppt") returned 4 [0054.513] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString=".zip") returned 4 [0054.513] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString=".rar") returned 4 [0054.513] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString=".bz2") returned 4 [0054.513] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.513] lstrlenW (lpString=".7z") returned 3 [0054.513] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString=".dbf") returned 4 [0054.513] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString=".1cd") returned 4 [0054.513] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString=".jpg") returned 4 [0054.513] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.513] lstrlenW (lpString=".doc") returned 4 [0054.513] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.513] lstrlenW (lpString=".docx") returned 5 [0054.514] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.514] lstrlenW (lpString=".pdf") returned 4 [0054.514] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.514] lstrlenW (lpString=".xls") returned 4 [0054.514] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.514] lstrlenW (lpString=".xlsx") returned 5 [0054.514] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.514] lstrlenW (lpString=".ppt") returned 4 [0054.514] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.514] lstrlenW (lpString=".zip") returned 4 [0054.514] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.514] lstrlenW (lpString=".rar") returned 4 [0054.514] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.514] lstrlenW (lpString=".bz2") returned 4 [0054.514] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.514] lstrlenW (lpString=".7z") returned 3 [0054.514] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.514] lstrlenW (lpString=".dbf") returned 4 [0054.514] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.514] lstrlenW (lpString=".1cd") returned 4 [0054.514] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0054.514] lstrlenW (lpString=".jpg") returned 4 [0054.514] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.514] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0054.514] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0054.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.515] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=712592) returned 1 [0054.515] CloseHandle (hObject=0x188) returned 1 [0054.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0054.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.516] GetLastError () returned 0x0 [0054.516] ReadFile (in: hFile=0x188, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0054.531] WriteFile (in: hFile=0x21c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0054.545] ReadFile (in: hFile=0x188, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.545] WriteFile (in: hFile=0x21c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.546] SetEndOfFile (hFile=0x21c) returned 1 [0054.546] CloseHandle (hObject=0x21c) returned 1 [0054.546] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.546] SetEndOfFile (hFile=0x188) returned 1 [0055.045] CloseHandle (hObject=0x188) returned 1 [0055.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.067] lstrlenW (lpString=".doc") returned 4 [0055.067] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.067] lstrlenW (lpString=".docx") returned 5 [0055.067] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.074] lstrlenW (lpString=".pdf") returned 4 [0055.074] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.074] lstrlenW (lpString=".xls") returned 4 [0055.074] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.074] lstrlenW (lpString=".xlsx") returned 5 [0055.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.074] lstrlenW (lpString=".ppt") returned 4 [0055.074] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.074] lstrlenW (lpString=".zip") returned 4 [0055.075] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.075] lstrlenW (lpString=".rar") returned 4 [0055.075] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.075] lstrlenW (lpString=".bz2") returned 4 [0055.075] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.079] lstrlenW (lpString=".7z") returned 3 [0055.079] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.079] lstrlenW (lpString=".dbf") returned 4 [0055.079] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.079] lstrlenW (lpString=".1cd") returned 4 [0055.079] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.079] lstrlenW (lpString=".jpg") returned 4 [0055.079] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.079] lstrlenW (lpString=".doc") returned 4 [0055.079] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.079] lstrlenW (lpString=".docx") returned 5 [0055.079] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.079] lstrlenW (lpString=".pdf") returned 4 [0055.079] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.079] lstrlenW (lpString=".xls") returned 4 [0055.079] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.079] lstrlenW (lpString=".xlsx") returned 5 [0055.079] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.079] lstrlenW (lpString=".ppt") returned 4 [0055.079] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.080] lstrlenW (lpString=".zip") returned 4 [0055.080] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.080] lstrlenW (lpString=".rar") returned 4 [0055.080] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.080] lstrlenW (lpString=".bz2") returned 4 [0055.080] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.080] lstrlenW (lpString=".7z") returned 3 [0055.080] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.080] lstrlenW (lpString=".dbf") returned 4 [0055.080] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.080] lstrlenW (lpString=".1cd") returned 4 [0055.080] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.080] lstrlenW (lpString=".jpg") returned 4 [0055.080] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.080] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0055.080] lstrlenW (lpString="PNG32.FLT") returned 9 [0055.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.080] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=302976) returned 1 [0055.080] CloseHandle (hObject=0x188) returned 1 [0055.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0055.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.081] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.081] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.720] GetLastError () returned 0x0 [0056.720] ReadFile (in: hFile=0x188, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0056.856] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0056.861] ReadFile (in: hFile=0x188, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.861] WriteFile (in: hFile=0x198, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.861] SetEndOfFile (hFile=0x198) returned 1 [0056.862] CloseHandle (hObject=0x198) returned 1 [0056.862] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.862] SetEndOfFile (hFile=0x188) returned 1 [0056.865] CloseHandle (hObject=0x188) returned 1 [0056.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0056.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.866] lstrlenW (lpString=".doc") returned 4 [0056.866] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.866] lstrlenW (lpString=".docx") returned 5 [0056.866] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.866] lstrlenW (lpString=".pdf") returned 4 [0056.866] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.866] lstrlenW (lpString=".xls") returned 4 [0056.866] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.866] lstrlenW (lpString=".xlsx") returned 5 [0056.866] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.866] lstrlenW (lpString=".ppt") returned 4 [0056.866] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.866] lstrlenW (lpString=".zip") returned 4 [0056.866] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.866] lstrlenW (lpString=".rar") returned 4 [0056.866] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.866] lstrlenW (lpString=".bz2") returned 4 [0056.866] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.866] lstrlenW (lpString=".7z") returned 3 [0056.866] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".dbf") returned 4 [0056.867] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".1cd") returned 4 [0056.867] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".jpg") returned 4 [0056.867] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".doc") returned 4 [0056.867] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.867] lstrlenW (lpString=".docx") returned 5 [0056.867] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.867] lstrlenW (lpString=".pdf") returned 4 [0056.867] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString=".xls") returned 4 [0056.867] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString=".xlsx") returned 5 [0056.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.867] lstrlenW (lpString=".ppt") returned 4 [0056.867] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".zip") returned 4 [0056.867] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString=".rar") returned 4 [0056.867] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.867] lstrlenW (lpString=".bz2") returned 4 [0056.867] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.867] lstrlenW (lpString=".7z") returned 3 [0056.867] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.867] lstrlenW (lpString=".dbf") returned 4 [0056.868] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.868] lstrlenW (lpString=".1cd") returned 4 [0056.868] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.868] lstrlenW (lpString=".jpg") returned 4 [0056.868] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.868] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0056.868] lstrlenW (lpString="msitss55.dll") returned 12 [0056.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.951] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=430080) returned 1 [0056.951] CloseHandle (hObject=0x1fc) returned 1 [0056.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0056.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0056.952] GetLastError () returned 0x0 [0056.952] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x69000, lpOverlapped=0x0) returned 1 [0057.038] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0057.045] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.045] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.045] SetEndOfFile (hFile=0x1bc) returned 1 [0057.046] CloseHandle (hObject=0x1bc) returned 1 [0057.046] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.046] SetEndOfFile (hFile=0x1fc) returned 1 [0057.049] CloseHandle (hObject=0x1fc) returned 1 [0057.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.050] lstrlenW (lpString=".doc") returned 4 [0057.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString=".docx") returned 5 [0057.050] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0057.050] lstrlenW (lpString=".pdf") returned 4 [0057.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString=".xls") returned 4 [0057.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString=".xlsx") returned 5 [0057.050] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0057.050] lstrlenW (lpString=".ppt") returned 4 [0057.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.050] lstrlenW (lpString=".zip") returned 4 [0057.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString=".rar") returned 4 [0057.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".bz2") returned 4 [0057.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.051] lstrlenW (lpString=".7z") returned 3 [0057.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString=".dbf") returned 4 [0057.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString=".1cd") returned 4 [0057.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString=".jpg") returned 4 [0057.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString=".doc") returned 4 [0057.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".docx") returned 5 [0057.051] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0057.051] lstrlenW (lpString=".pdf") returned 4 [0057.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".xls") returned 4 [0057.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".xlsx") returned 5 [0057.051] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0057.051] lstrlenW (lpString=".ppt") returned 4 [0057.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.051] lstrlenW (lpString=".zip") returned 4 [0057.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".rar") returned 4 [0057.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.051] lstrlenW (lpString=".bz2") returned 4 [0057.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.052] lstrlenW (lpString=".7z") returned 3 [0057.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.052] lstrlenW (lpString=".dbf") returned 4 [0057.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.052] lstrlenW (lpString=".1cd") returned 4 [0057.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.052] lstrlenW (lpString=".jpg") returned 4 [0057.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.052] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0057.052] lstrlenW (lpString="micaut.dll") returned 10 [0057.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.057] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1704448) returned 1 [0057.057] CloseHandle (hObject=0x1fc) returned 1 [0057.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0057.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.058] lstrlenW (lpString=".doc") returned 4 [0057.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString=".docx") returned 5 [0057.058] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.058] lstrlenW (lpString=".pdf") returned 4 [0057.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString=".xls") returned 4 [0057.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString=".xlsx") returned 5 [0057.058] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.058] lstrlenW (lpString=".ppt") returned 4 [0057.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.058] lstrlenW (lpString=".zip") returned 4 [0057.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString=".rar") returned 4 [0057.058] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.058] lstrlenW (lpString=".bz2") returned 4 [0057.058] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.058] lstrlenW (lpString=".7z") returned 3 [0057.058] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString=".dbf") returned 4 [0057.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString=".1cd") returned 4 [0057.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString=".jpg") returned 4 [0057.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString=".doc") returned 4 [0057.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".docx") returned 5 [0057.059] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.059] lstrlenW (lpString=".pdf") returned 4 [0057.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".xls") returned 4 [0057.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".xlsx") returned 5 [0057.059] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.059] lstrlenW (lpString=".ppt") returned 4 [0057.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.059] lstrlenW (lpString=".zip") returned 4 [0057.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".rar") returned 4 [0057.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".bz2") returned 4 [0057.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.059] lstrlenW (lpString=".7z") returned 3 [0057.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.060] lstrlenW (lpString=".dbf") returned 4 [0057.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.060] lstrlenW (lpString=".1cd") returned 4 [0057.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 61 [0057.060] lstrlenW (lpString=".jpg") returned 4 [0057.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.060] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0057.060] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0057.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.061] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=507904) returned 1 [0057.061] CloseHandle (hObject=0x1fc) returned 1 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.061] lstrlenW (lpString=".doc") returned 4 [0057.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.061] lstrlenW (lpString=".docx") returned 5 [0057.061] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0057.061] lstrlenW (lpString=".pdf") returned 4 [0057.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.061] lstrlenW (lpString=".xls") returned 4 [0057.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.061] lstrlenW (lpString=".xlsx") returned 5 [0057.061] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0057.061] lstrlenW (lpString=".ppt") returned 4 [0057.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".zip") returned 4 [0057.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString=".rar") returned 4 [0057.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString=".bz2") returned 4 [0057.062] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.062] lstrlenW (lpString=".7z") returned 3 [0057.062] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".dbf") returned 4 [0057.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".1cd") returned 4 [0057.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".jpg") returned 4 [0057.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".doc") returned 4 [0057.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString=".docx") returned 5 [0057.062] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0057.062] lstrlenW (lpString=".pdf") returned 4 [0057.062] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString=".xls") returned 4 [0057.062] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString=".xlsx") returned 5 [0057.062] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0057.062] lstrlenW (lpString=".ppt") returned 4 [0057.062] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.062] lstrlenW (lpString=".zip") returned 4 [0057.063] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.063] lstrlenW (lpString=".rar") returned 4 [0057.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.063] lstrlenW (lpString=".bz2") returned 4 [0057.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.063] lstrlenW (lpString=".7z") returned 3 [0057.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.063] lstrlenW (lpString=".dbf") returned 4 [0057.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.063] lstrlenW (lpString=".1cd") returned 4 [0057.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0057.063] lstrlenW (lpString=".jpg") returned 4 [0057.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.063] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0057.063] lstrlenW (lpString="mip.exe") returned 7 [0057.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.064] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1547264) returned 1 [0057.064] CloseHandle (hObject=0x1fc) returned 1 [0057.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0057.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.064] lstrlenW (lpString=".doc") returned 4 [0057.064] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.064] lstrlenW (lpString=".docx") returned 5 [0057.064] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0057.064] lstrlenW (lpString=".pdf") returned 4 [0057.064] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.064] lstrlenW (lpString=".xls") returned 4 [0057.064] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.064] lstrlenW (lpString=".xlsx") returned 5 [0057.064] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0057.064] lstrlenW (lpString=".ppt") returned 4 [0057.064] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.064] lstrlenW (lpString=".zip") returned 4 [0057.064] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.064] lstrlenW (lpString=".rar") returned 4 [0057.064] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.064] lstrlenW (lpString=".bz2") returned 4 [0057.064] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.065] lstrlenW (lpString=".7z") returned 3 [0057.065] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString=".dbf") returned 4 [0057.065] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString=".1cd") returned 4 [0057.065] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString=".jpg") returned 4 [0057.065] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString=".doc") returned 4 [0057.065] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.065] lstrlenW (lpString=".docx") returned 5 [0057.065] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0057.065] lstrlenW (lpString=".pdf") returned 4 [0057.065] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString=".xls") returned 4 [0057.065] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString=".xlsx") returned 5 [0057.065] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0057.065] lstrlenW (lpString=".ppt") returned 4 [0057.065] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.065] lstrlenW (lpString=".zip") returned 4 [0057.065] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString=".rar") returned 4 [0057.065] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.065] lstrlenW (lpString=".bz2") returned 4 [0057.066] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.066] lstrlenW (lpString=".7z") returned 3 [0057.066] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.066] lstrlenW (lpString=".dbf") returned 4 [0057.066] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.066] lstrlenW (lpString=".1cd") returned 4 [0057.066] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0057.066] lstrlenW (lpString=".jpg") returned 4 [0057.066] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.066] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0057.066] lstrlenW (lpString="mraut.dll") returned 9 [0057.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.066] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6331392) returned 1 [0057.066] CloseHandle (hObject=0x1fc) returned 1 [0057.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0057.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0057.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.067] lstrlenW (lpString=".doc") returned 4 [0057.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString=".docx") returned 5 [0057.067] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.067] lstrlenW (lpString=".pdf") returned 4 [0057.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString=".xls") returned 4 [0057.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString=".xlsx") returned 5 [0057.067] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.067] lstrlenW (lpString=".ppt") returned 4 [0057.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.067] lstrlenW (lpString=".zip") returned 4 [0057.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString=".rar") returned 4 [0057.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.067] lstrlenW (lpString=".bz2") returned 4 [0057.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.067] lstrlenW (lpString=".7z") returned 3 [0057.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.067] lstrlenW (lpString=".dbf") returned 4 [0057.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString=".1cd") returned 4 [0057.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString=".jpg") returned 4 [0057.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString=".doc") returned 4 [0057.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString=".docx") returned 5 [0057.068] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.068] lstrlenW (lpString=".pdf") returned 4 [0057.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString=".xls") returned 4 [0057.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString=".xlsx") returned 5 [0057.068] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.068] lstrlenW (lpString=".ppt") returned 4 [0057.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString=".zip") returned 4 [0057.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString=".rar") returned 4 [0057.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.068] lstrlenW (lpString=".bz2") returned 4 [0057.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.068] lstrlenW (lpString=".7z") returned 3 [0057.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.068] lstrlenW (lpString=".dbf") returned 4 [0057.069] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.069] lstrlenW (lpString=".1cd") returned 4 [0057.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0057.069] lstrlenW (lpString=".jpg") returned 4 [0057.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.069] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0057.069] lstrlenW (lpString="mshwgst.dll") returned 11 [0057.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.069] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=49664) returned 1 [0057.069] CloseHandle (hObject=0x1fc) returned 1 [0057.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0057.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.070] lstrlenW (lpString=".doc") returned 4 [0057.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString=".docx") returned 5 [0057.070] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.070] lstrlenW (lpString=".pdf") returned 4 [0057.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString=".xls") returned 4 [0057.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString=".xlsx") returned 5 [0057.070] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.070] lstrlenW (lpString=".ppt") returned 4 [0057.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.070] lstrlenW (lpString=".zip") returned 4 [0057.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString=".rar") returned 4 [0057.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.070] lstrlenW (lpString=".bz2") returned 4 [0057.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.070] lstrlenW (lpString=".7z") returned 3 [0057.071] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString=".dbf") returned 4 [0057.071] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString=".1cd") returned 4 [0057.071] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString=".jpg") returned 4 [0057.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString=".doc") returned 4 [0057.071] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString=".docx") returned 5 [0057.071] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0057.071] lstrlenW (lpString=".pdf") returned 4 [0057.071] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString=".xls") returned 4 [0057.071] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString=".xlsx") returned 5 [0057.071] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0057.071] lstrlenW (lpString=".ppt") returned 4 [0057.071] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.071] lstrlenW (lpString=".zip") returned 4 [0057.071] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString=".rar") returned 4 [0057.071] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.071] lstrlenW (lpString=".bz2") returned 4 [0057.071] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.071] lstrlenW (lpString=".7z") returned 3 [0057.071] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.072] lstrlenW (lpString=".dbf") returned 4 [0057.072] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.072] lstrlenW (lpString=".1cd") returned 4 [0057.072] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0057.072] lstrlenW (lpString=".jpg") returned 4 [0057.072] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.072] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0057.072] lstrlenW (lpString="mshwLatin.dll") returned 13 [0057.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.072] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1071616) returned 1 [0057.072] CloseHandle (hObject=0x1fc) returned 1 [0057.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0057.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0057.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0057.073] lstrlenW (lpString=".doc") returned 4 [0057.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString=".docx") returned 5 [0057.073] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0057.073] lstrlenW (lpString=".pdf") returned 4 [0057.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString=".xls") returned 4 [0057.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString=".xlsx") returned 5 [0057.073] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0057.073] lstrlenW (lpString=".ppt") returned 4 [0057.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0057.073] lstrlenW (lpString=".zip") returned 4 [0057.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString=".rar") returned 4 [0057.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.073] lstrlenW (lpString=".bz2") returned 4 [0057.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.073] lstrlenW (lpString=".7z") returned 3 [0057.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0057.073] lstrlenW (lpString=".dbf") returned 4 [0057.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.114] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3584) returned 1 [0057.114] CloseHandle (hObject=0x1fc) returned 1 [0057.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0057.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.371] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4096) returned 1 [0057.371] CloseHandle (hObject=0x16c) returned 1 [0057.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0057.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.372] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2528128) returned 1 [0057.372] CloseHandle (hObject=0x16c) returned 1 [0057.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0057.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0057.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0057.376] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.376] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.376] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.400] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.400] ReadFile (in: hFile=0x16c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.974] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.974] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.974] ReadFile (in: hFile=0x16c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.993] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.993] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.009] SetEndOfFile (hFile=0x16c) returned 1 [0058.314] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0058.315] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.315] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.316] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.316] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.322] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.325] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0058.325] CloseHandle (hObject=0x16c) returned 1 [0058.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.325] lstrlenW (lpString=".doc") returned 4 [0058.325] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.325] lstrlenW (lpString=".docx") returned 5 [0058.325] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.325] lstrlenW (lpString=".pdf") returned 4 [0058.325] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.325] lstrlenW (lpString=".xls") returned 4 [0058.325] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.325] lstrlenW (lpString=".xlsx") returned 5 [0058.326] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.326] lstrlenW (lpString=".ppt") returned 4 [0058.326] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString=".zip") returned 4 [0058.326] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString=".rar") returned 4 [0058.326] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString=".bz2") returned 4 [0058.326] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.326] lstrlenW (lpString=".7z") returned 3 [0058.326] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString=".dbf") returned 4 [0058.326] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString=".1cd") returned 4 [0058.326] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString=".jpg") returned 4 [0058.326] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.326] lstrlenW (lpString=".doc") returned 4 [0058.326] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString=".docx") returned 5 [0058.326] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.326] lstrlenW (lpString=".pdf") returned 4 [0058.326] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString=".xls") returned 4 [0058.326] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.326] lstrlenW (lpString=".xlsx") returned 5 [0058.327] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.327] lstrlenW (lpString=".ppt") returned 4 [0058.327] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.327] lstrlenW (lpString=".zip") returned 4 [0058.327] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.327] lstrlenW (lpString=".rar") returned 4 [0058.327] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.327] lstrlenW (lpString=".bz2") returned 4 [0058.327] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.327] lstrlenW (lpString=".7z") returned 3 [0058.327] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.327] lstrlenW (lpString=".dbf") returned 4 [0058.327] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.327] lstrlenW (lpString=".1cd") returned 4 [0058.327] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.327] lstrlenW (lpString=".jpg") returned 4 [0058.327] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.327] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0058.327] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0058.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0058.589] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=105344) returned 1 [0058.589] CloseHandle (hObject=0x16c) returned 1 [0058.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0058.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0058.589] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.590] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0058.783] GetLastError () returned 0x0 [0058.783] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0058.824] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0058.827] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.827] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0058.827] SetEndOfFile (hFile=0x158) returned 1 [0058.827] CloseHandle (hObject=0x158) returned 1 [0058.827] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.827] SetEndOfFile (hFile=0x16c) returned 1 [0058.828] CloseHandle (hObject=0x16c) returned 1 [0058.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.829] lstrlenW (lpString=".doc") returned 4 [0058.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString=".docx") returned 5 [0058.829] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0058.829] lstrlenW (lpString=".pdf") returned 4 [0058.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString=".xls") returned 4 [0058.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString=".xlsx") returned 5 [0058.829] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0058.829] lstrlenW (lpString=".ppt") returned 4 [0058.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.829] lstrlenW (lpString=".zip") returned 4 [0058.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString=".rar") returned 4 [0058.829] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.829] lstrlenW (lpString=".bz2") returned 4 [0058.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.830] lstrlenW (lpString=".7z") returned 3 [0058.830] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString=".dbf") returned 4 [0058.830] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString=".1cd") returned 4 [0058.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString=".jpg") returned 4 [0058.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString=".doc") returned 4 [0058.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString=".docx") returned 5 [0058.830] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0058.830] lstrlenW (lpString=".pdf") returned 4 [0058.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString=".xls") returned 4 [0058.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString=".xlsx") returned 5 [0058.830] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0058.830] lstrlenW (lpString=".ppt") returned 4 [0058.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.830] lstrlenW (lpString=".zip") returned 4 [0058.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString=".rar") returned 4 [0058.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.830] lstrlenW (lpString=".bz2") returned 4 [0058.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.831] lstrlenW (lpString=".7z") returned 3 [0058.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.831] lstrlenW (lpString=".dbf") returned 4 [0058.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.831] lstrlenW (lpString=".1cd") returned 4 [0058.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.831] lstrlenW (lpString=".jpg") returned 4 [0058.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.831] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.831] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0058.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0058.831] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15800) returned 1 [0058.831] CloseHandle (hObject=0x16c) returned 1 [0058.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0058.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0058.832] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.832] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0058.833] GetLastError () returned 0x0 [0058.833] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0058.835] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0058.836] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.836] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.836] SetEndOfFile (hFile=0x158) returned 1 [0058.836] CloseHandle (hObject=0x158) returned 1 [0058.837] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.837] SetEndOfFile (hFile=0x16c) returned 1 [0058.838] CloseHandle (hObject=0x16c) returned 1 [0058.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0058.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.838] lstrlenW (lpString=".doc") returned 4 [0058.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.838] lstrlenW (lpString=".docx") returned 5 [0058.838] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0058.838] lstrlenW (lpString=".pdf") returned 4 [0058.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString=".xls") returned 4 [0058.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString=".xlsx") returned 5 [0058.839] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0058.839] lstrlenW (lpString=".ppt") returned 4 [0058.839] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString=".zip") returned 4 [0058.839] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString=".rar") returned 4 [0058.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString=".bz2") returned 4 [0058.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.839] lstrlenW (lpString=".7z") returned 3 [0058.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString=".dbf") returned 4 [0058.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString=".1cd") returned 4 [0058.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString=".jpg") returned 4 [0058.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.839] lstrlenW (lpString=".doc") returned 4 [0058.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.839] lstrlenW (lpString=".docx") returned 5 [0058.839] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0058.839] lstrlenW (lpString=".pdf") returned 4 [0058.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.840] lstrlenW (lpString=".xls") returned 4 [0058.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.840] lstrlenW (lpString=".xlsx") returned 5 [0058.840] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0058.840] lstrlenW (lpString=".ppt") returned 4 [0058.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.840] lstrlenW (lpString=".zip") returned 4 [0058.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.840] lstrlenW (lpString=".rar") returned 4 [0058.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.840] lstrlenW (lpString=".bz2") returned 4 [0058.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.840] lstrlenW (lpString=".7z") returned 3 [0058.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.840] lstrlenW (lpString=".dbf") returned 4 [0058.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.840] lstrlenW (lpString=".1cd") returned 4 [0058.840] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.840] lstrlenW (lpString=".jpg") returned 4 [0058.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.840] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.840] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0058.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.466] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=537504) returned 1 [0059.466] CloseHandle (hObject=0x1f4) returned 1 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.467] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.467] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.467] GetLastError () returned 0x0 [0059.467] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x833a0, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0059.487] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.487] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.487] SetEndOfFile (hFile=0x1ec) returned 1 [0059.487] CloseHandle (hObject=0x1ec) returned 1 [0059.488] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.488] SetEndOfFile (hFile=0x1f4) returned 1 [0059.492] CloseHandle (hObject=0x1f4) returned 1 [0059.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.493] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0059.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.493] lstrlenW (lpString=".doc") returned 4 [0059.493] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.493] lstrlenW (lpString=".docx") returned 5 [0059.493] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0059.493] lstrlenW (lpString=".pdf") returned 4 [0059.493] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.493] lstrlenW (lpString=".xls") returned 4 [0059.493] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.493] lstrlenW (lpString=".xlsx") returned 5 [0059.493] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0059.493] lstrlenW (lpString=".ppt") returned 4 [0059.493] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.493] lstrlenW (lpString=".zip") returned 4 [0059.493] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString=".rar") returned 4 [0059.494] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString=".bz2") returned 4 [0059.494] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.494] lstrlenW (lpString=".7z") returned 3 [0059.494] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.494] lstrlenW (lpString=".dbf") returned 4 [0059.494] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.494] lstrlenW (lpString=".1cd") returned 4 [0059.494] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.494] lstrlenW (lpString=".jpg") returned 4 [0059.494] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.494] lstrlenW (lpString=".doc") returned 4 [0059.494] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString=".docx") returned 5 [0059.494] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0059.494] lstrlenW (lpString=".pdf") returned 4 [0059.494] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString=".xls") returned 4 [0059.494] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.494] lstrlenW (lpString=".xlsx") returned 5 [0059.494] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0059.494] lstrlenW (lpString=".ppt") returned 4 [0059.495] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.495] lstrlenW (lpString=".zip") returned 4 [0059.495] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.495] lstrlenW (lpString=".rar") returned 4 [0059.495] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.495] lstrlenW (lpString=".bz2") returned 4 [0059.495] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.495] lstrlenW (lpString=".7z") returned 3 [0059.495] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.495] lstrlenW (lpString=".dbf") returned 4 [0059.495] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.495] lstrlenW (lpString=".1cd") returned 4 [0059.495] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.495] lstrlenW (lpString=".jpg") returned 4 [0059.495] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.495] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.495] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0059.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.499] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=318368) returned 1 [0059.499] CloseHandle (hObject=0x1ec) returned 1 [0059.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0059.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.500] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.500] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.592] GetLastError () returned 0x0 [0060.602] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0060.625] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0060.631] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.631] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.631] SetEndOfFile (hFile=0x214) returned 1 [0060.631] CloseHandle (hObject=0x214) returned 1 [0060.632] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.632] SetEndOfFile (hFile=0x1ec) returned 1 [0060.635] CloseHandle (hObject=0x1ec) returned 1 [0060.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0060.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.635] lstrlenW (lpString=".doc") returned 4 [0060.635] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.635] lstrlenW (lpString=".docx") returned 5 [0060.635] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.636] lstrlenW (lpString=".pdf") returned 4 [0060.636] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString=".xls") returned 4 [0060.636] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString=".xlsx") returned 5 [0060.636] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.636] lstrlenW (lpString=".ppt") returned 4 [0060.636] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString=".zip") returned 4 [0060.636] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString=".rar") returned 4 [0060.636] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString=".bz2") returned 4 [0060.636] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.636] lstrlenW (lpString=".7z") returned 3 [0060.636] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString=".dbf") returned 4 [0060.636] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString=".1cd") returned 4 [0060.636] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString=".jpg") returned 4 [0060.636] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.636] lstrlenW (lpString=".doc") returned 4 [0060.636] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.636] lstrlenW (lpString=".docx") returned 5 [0060.636] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.636] lstrlenW (lpString=".pdf") returned 4 [0060.637] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.637] lstrlenW (lpString=".xls") returned 4 [0060.637] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.637] lstrlenW (lpString=".xlsx") returned 5 [0060.637] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.637] lstrlenW (lpString=".ppt") returned 4 [0060.637] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.637] lstrlenW (lpString=".zip") returned 4 [0060.637] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.637] lstrlenW (lpString=".rar") returned 4 [0060.637] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.637] lstrlenW (lpString=".bz2") returned 4 [0060.637] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.637] lstrlenW (lpString=".7z") returned 3 [0060.637] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.637] lstrlenW (lpString=".dbf") returned 4 [0060.637] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.637] lstrlenW (lpString=".1cd") returned 4 [0060.637] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.637] lstrlenW (lpString=".jpg") returned 4 [0060.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.637] lstrcmpiW (lpString1=".ODF", lpString2=".zoh") returned -1 [0060.637] lstrlenW (lpString="OFFICE.ODF") returned 10 [0060.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.638] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4297568) returned 1 [0060.638] CloseHandle (hObject=0x1ec) returned 1 [0060.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0060.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0060.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[restdoc@protonmail.com].zoh"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0060.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.639] lstrlenW (lpString=".doc") returned 4 [0060.639] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0060.639] lstrlenW (lpString=".docx") returned 5 [0060.639] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0060.640] lstrlenW (lpString=".pdf") returned 4 [0060.640] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0060.640] lstrlenW (lpString=".xls") returned 4 [0060.640] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0060.640] lstrlenW (lpString=".xlsx") returned 5 [0060.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0060.640] lstrlenW (lpString=".ppt") returned 4 [0060.640] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString=".zip") returned 4 [0060.640] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0060.640] lstrlenW (lpString=".rar") returned 4 [0060.640] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0060.640] lstrlenW (lpString=".bz2") returned 4 [0060.640] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0060.640] lstrlenW (lpString=".7z") returned 3 [0060.640] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString=".dbf") returned 4 [0060.640] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString=".1cd") returned 4 [0060.640] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString=".jpg") returned 4 [0060.640] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.640] lstrlenW (lpString=".doc") returned 4 [0060.640] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0060.640] lstrlenW (lpString=".docx") returned 5 [0060.640] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0060.640] lstrlenW (lpString=".pdf") returned 4 [0060.640] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0060.641] lstrlenW (lpString=".xls") returned 4 [0060.641] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0060.641] lstrlenW (lpString=".xlsx") returned 5 [0060.641] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0060.641] lstrlenW (lpString=".ppt") returned 4 [0060.641] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0060.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.641] lstrlenW (lpString=".zip") returned 4 [0060.641] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0060.641] lstrlenW (lpString=".rar") returned 4 [0060.641] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0060.641] lstrlenW (lpString=".bz2") returned 4 [0060.641] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0060.641] lstrlenW (lpString=".7z") returned 3 [0060.641] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0060.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.641] lstrlenW (lpString=".dbf") returned 4 [0060.641] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0060.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.641] lstrlenW (lpString=".1cd") returned 4 [0060.641] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0060.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.641] lstrlenW (lpString=".jpg") returned 4 [0060.641] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0060.641] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.641] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0060.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.642] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=518984) returned 1 [0060.642] CloseHandle (hObject=0x1ec) returned 1 [0060.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0060.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.642] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.642] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.643] GetLastError () returned 0x0 [0060.643] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0060.654] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0060.825] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.825] WriteFile (in: hFile=0x214, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.825] SetEndOfFile (hFile=0x214) returned 1 [0060.825] CloseHandle (hObject=0x214) returned 1 [0060.825] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.825] SetEndOfFile (hFile=0x1ec) returned 1 [0060.829] CloseHandle (hObject=0x1ec) returned 1 [0060.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.900] lstrlenW (lpString=".doc") returned 4 [0060.900] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString=".docx") returned 5 [0060.900] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.900] lstrlenW (lpString=".pdf") returned 4 [0060.900] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString=".xls") returned 4 [0060.900] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString=".xlsx") returned 5 [0060.900] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.900] lstrlenW (lpString=".ppt") returned 4 [0060.900] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.900] lstrlenW (lpString=".zip") returned 4 [0060.900] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString=".rar") returned 4 [0060.900] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.900] lstrlenW (lpString=".bz2") returned 4 [0060.900] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.900] lstrlenW (lpString=".7z") returned 3 [0060.900] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.900] lstrlenW (lpString=".dbf") returned 4 [0060.900] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.900] lstrlenW (lpString=".1cd") returned 4 [0060.900] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString=".jpg") returned 4 [0060.901] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString=".doc") returned 4 [0060.901] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString=".docx") returned 5 [0060.901] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.901] lstrlenW (lpString=".pdf") returned 4 [0060.901] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString=".xls") returned 4 [0060.901] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString=".xlsx") returned 5 [0060.901] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.901] lstrlenW (lpString=".ppt") returned 4 [0060.901] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString=".zip") returned 4 [0060.901] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString=".rar") returned 4 [0060.901] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.901] lstrlenW (lpString=".bz2") returned 4 [0060.901] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.901] lstrlenW (lpString=".7z") returned 3 [0060.901] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString=".dbf") returned 4 [0060.901] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.901] lstrlenW (lpString=".1cd") returned 4 [0060.901] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.902] lstrlenW (lpString=".jpg") returned 4 [0060.902] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.902] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0060.902] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0060.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.956] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=157024) returned 1 [0060.957] CloseHandle (hObject=0x1f4) returned 1 [0060.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0060.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.957] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.957] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.958] GetLastError () returned 0x0 [0060.958] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x26560, lpOverlapped=0x0) returned 1 [0060.962] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x26570, lpOverlapped=0x0) returned 1 [0060.965] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.965] SetEndOfFile (hFile=0x1c8) returned 1 [0060.965] CloseHandle (hObject=0x1c8) returned 1 [0060.966] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.966] SetEndOfFile (hFile=0x1f4) returned 1 [0060.967] CloseHandle (hObject=0x1f4) returned 1 [0060.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString=".doc") returned 4 [0060.968] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.968] lstrlenW (lpString=".docx") returned 5 [0060.968] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0060.968] lstrlenW (lpString=".pdf") returned 4 [0060.968] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.968] lstrlenW (lpString=".xls") returned 4 [0060.968] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.968] lstrlenW (lpString=".xlsx") returned 5 [0060.968] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0060.968] lstrlenW (lpString=".ppt") returned 4 [0060.968] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString=".zip") returned 4 [0060.968] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.968] lstrlenW (lpString=".rar") returned 4 [0060.968] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.968] lstrlenW (lpString=".bz2") returned 4 [0060.968] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.968] lstrlenW (lpString=".7z") returned 3 [0060.968] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString=".dbf") returned 4 [0060.968] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString=".1cd") returned 4 [0060.968] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.968] lstrlenW (lpString=".jpg") returned 4 [0060.969] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString=".doc") returned 4 [0060.969] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.969] lstrlenW (lpString=".docx") returned 5 [0060.969] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0060.969] lstrlenW (lpString=".pdf") returned 4 [0060.969] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString=".xls") returned 4 [0060.969] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString=".xlsx") returned 5 [0060.969] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0060.969] lstrlenW (lpString=".ppt") returned 4 [0060.969] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString=".zip") returned 4 [0060.969] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString=".rar") returned 4 [0060.969] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.969] lstrlenW (lpString=".bz2") returned 4 [0060.969] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.969] lstrlenW (lpString=".7z") returned 3 [0060.969] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString=".dbf") returned 4 [0060.969] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString=".1cd") returned 4 [0060.969] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.969] lstrlenW (lpString=".jpg") returned 4 [0060.970] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.970] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0060.970] lstrlenW (lpString="LICLUA.EXE") returned 10 [0060.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.970] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=204168) returned 1 [0060.970] CloseHandle (hObject=0x1f4) returned 1 [0060.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0060.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.971] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.971] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.971] GetLastError () returned 0x0 [0060.971] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x31d88, lpOverlapped=0x0) returned 1 [0060.976] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x31d90, lpOverlapped=0x0) returned 1 [0060.979] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.979] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.979] SetEndOfFile (hFile=0x1c8) returned 1 [0060.980] CloseHandle (hObject=0x1c8) returned 1 [0060.980] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.980] SetEndOfFile (hFile=0x1f4) returned 1 [0060.982] CloseHandle (hObject=0x1f4) returned 1 [0060.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0060.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.982] lstrlenW (lpString=".doc") returned 4 [0060.982] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.982] lstrlenW (lpString=".docx") returned 5 [0060.982] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0060.982] lstrlenW (lpString=".pdf") returned 4 [0060.982] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.982] lstrlenW (lpString=".xls") returned 4 [0060.982] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.982] lstrlenW (lpString=".xlsx") returned 5 [0060.982] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0060.982] lstrlenW (lpString=".ppt") returned 4 [0060.983] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString=".zip") returned 4 [0060.983] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString=".rar") returned 4 [0060.983] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString=".bz2") returned 4 [0060.983] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.983] lstrlenW (lpString=".7z") returned 3 [0060.983] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString=".dbf") returned 4 [0060.983] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString=".1cd") returned 4 [0060.983] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString=".jpg") returned 4 [0060.983] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.983] lstrlenW (lpString=".doc") returned 4 [0060.983] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.983] lstrlenW (lpString=".docx") returned 5 [0060.983] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0060.983] lstrlenW (lpString=".pdf") returned 4 [0060.983] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString=".xls") returned 4 [0060.983] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.983] lstrlenW (lpString=".xlsx") returned 5 [0060.983] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0060.983] lstrlenW (lpString=".ppt") returned 4 [0060.983] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.984] lstrlenW (lpString=".zip") returned 4 [0060.984] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.984] lstrlenW (lpString=".rar") returned 4 [0060.984] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.984] lstrlenW (lpString=".bz2") returned 4 [0060.984] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.984] lstrlenW (lpString=".7z") returned 3 [0060.984] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.984] lstrlenW (lpString=".dbf") returned 4 [0060.984] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.984] lstrlenW (lpString=".1cd") returned 4 [0060.984] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.984] lstrlenW (lpString=".jpg") returned 4 [0060.984] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.984] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.984] lstrlenW (lpString="MSO.DLL") returned 7 [0060.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.985] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=25417600) returned 1 [0060.985] CloseHandle (hObject=0x1f4) returned 1 [0060.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0060.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0061.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.748] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.748] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.748] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.848] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.848] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.911] ReadFile (in: hFile=0x1f4, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.965] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.965] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0062.085] SetEndOfFile (hFile=0x1f4) returned 1 [0062.085] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0062.085] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.086] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.087] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.090] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.090] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0062.092] CloseHandle (hObject=0x1f4) returned 1 [0062.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.092] lstrlenW (lpString=".doc") returned 4 [0062.092] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.092] lstrlenW (lpString=".docx") returned 5 [0062.092] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0062.092] lstrlenW (lpString=".pdf") returned 4 [0062.092] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.092] lstrlenW (lpString=".xls") returned 4 [0062.092] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString=".xlsx") returned 5 [0062.093] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0062.093] lstrlenW (lpString=".ppt") returned 4 [0062.093] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString=".zip") returned 4 [0062.093] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString=".rar") returned 4 [0062.093] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString=".bz2") returned 4 [0062.093] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.093] lstrlenW (lpString=".7z") returned 3 [0062.093] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString=".dbf") returned 4 [0062.093] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString=".1cd") returned 4 [0062.093] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString=".jpg") returned 4 [0062.093] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.093] lstrlenW (lpString=".doc") returned 4 [0062.093] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.093] lstrlenW (lpString=".docx") returned 5 [0062.093] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0062.094] lstrlenW (lpString=".pdf") returned 4 [0062.094] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.094] lstrlenW (lpString=".xls") returned 4 [0062.094] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.094] lstrlenW (lpString=".xlsx") returned 5 [0062.094] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0062.094] lstrlenW (lpString=".ppt") returned 4 [0062.094] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.094] lstrlenW (lpString=".zip") returned 4 [0062.094] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.094] lstrlenW (lpString=".rar") returned 4 [0062.094] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.094] lstrlenW (lpString=".bz2") returned 4 [0062.094] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.094] lstrlenW (lpString=".7z") returned 3 [0062.094] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.094] lstrlenW (lpString=".dbf") returned 4 [0062.094] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.094] lstrlenW (lpString=".1cd") returned 4 [0062.094] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0062.094] lstrlenW (lpString=".jpg") returned 4 [0062.094] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.094] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.094] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0062.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.095] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=705392) returned 1 [0062.095] CloseHandle (hObject=0x1f4) returned 1 [0062.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0062.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.096] GetLastError () returned 0x0 [0062.096] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xac370, lpOverlapped=0x0) returned 1 [0062.113] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xac380, lpOverlapped=0x0) returned 1 [0062.127] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.127] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.127] SetEndOfFile (hFile=0x158) returned 1 [0062.127] CloseHandle (hObject=0x158) returned 1 [0062.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.128] SetEndOfFile (hFile=0x1f4) returned 1 [0062.332] CloseHandle (hObject=0x1f4) returned 1 [0062.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString=".doc") returned 4 [0062.835] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString=".docx") returned 5 [0062.835] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0062.835] lstrlenW (lpString=".pdf") returned 4 [0062.835] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString=".xls") returned 4 [0062.835] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString=".xlsx") returned 5 [0062.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0062.835] lstrlenW (lpString=".ppt") returned 4 [0062.835] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString=".zip") returned 4 [0062.835] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString=".rar") returned 4 [0062.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.835] lstrlenW (lpString=".bz2") returned 4 [0062.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.835] lstrlenW (lpString=".7z") returned 3 [0062.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString=".dbf") returned 4 [0062.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString=".1cd") returned 4 [0062.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.835] lstrlenW (lpString=".jpg") returned 4 [0062.835] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.836] lstrlenW (lpString=".doc") returned 4 [0062.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString=".docx") returned 5 [0062.836] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0062.836] lstrlenW (lpString=".pdf") returned 4 [0062.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString=".xls") returned 4 [0062.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString=".xlsx") returned 5 [0062.836] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0062.836] lstrlenW (lpString=".ppt") returned 4 [0062.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.836] lstrlenW (lpString=".zip") returned 4 [0062.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString=".rar") returned 4 [0062.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.836] lstrlenW (lpString=".bz2") returned 4 [0062.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.836] lstrlenW (lpString=".7z") returned 3 [0062.836] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.836] lstrlenW (lpString=".dbf") returned 4 [0062.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.842] lstrlenW (lpString=".1cd") returned 4 [0062.845] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0062.845] lstrlenW (lpString=".jpg") returned 4 [0062.845] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.845] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0062.845] lstrlenW (lpString="ODeploy.exe") returned 11 [0062.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.870] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=571320) returned 1 [0062.870] CloseHandle (hObject=0x214) returned 1 [0062.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0062.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.870] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.870] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.870] GetLastError () returned 0x0 [0062.870] ReadFile (in: hFile=0x214, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x8b7b8, lpOverlapped=0x0) returned 1 [0062.884] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x8b7c0, lpOverlapped=0x0) returned 1 [0062.893] ReadFile (in: hFile=0x214, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.894] SetEndOfFile (hFile=0x1c8) returned 1 [0062.894] CloseHandle (hObject=0x1c8) returned 1 [0062.894] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.894] SetEndOfFile (hFile=0x214) returned 1 [0062.899] CloseHandle (hObject=0x214) returned 1 [0062.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.899] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0062.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.899] lstrlenW (lpString=".doc") returned 4 [0062.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.899] lstrlenW (lpString=".docx") returned 5 [0062.899] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0062.900] lstrlenW (lpString=".pdf") returned 4 [0062.900] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString=".xls") returned 4 [0062.900] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString=".xlsx") returned 5 [0062.900] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0062.900] lstrlenW (lpString=".ppt") returned 4 [0062.900] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString=".zip") returned 4 [0062.900] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString=".rar") returned 4 [0062.900] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString=".bz2") returned 4 [0062.900] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.900] lstrlenW (lpString=".7z") returned 3 [0062.900] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString=".dbf") returned 4 [0062.900] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString=".1cd") returned 4 [0062.900] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString=".jpg") returned 4 [0062.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.900] lstrlenW (lpString=".doc") returned 4 [0062.900] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.900] lstrlenW (lpString=".docx") returned 5 [0062.900] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0062.900] lstrlenW (lpString=".pdf") returned 4 [0062.901] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.901] lstrlenW (lpString=".xls") returned 4 [0062.901] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.901] lstrlenW (lpString=".xlsx") returned 5 [0062.901] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0062.901] lstrlenW (lpString=".ppt") returned 4 [0062.901] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.901] lstrlenW (lpString=".zip") returned 4 [0062.901] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.901] lstrlenW (lpString=".rar") returned 4 [0062.901] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.901] lstrlenW (lpString=".bz2") returned 4 [0062.901] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.901] lstrlenW (lpString=".7z") returned 3 [0062.901] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.901] lstrlenW (lpString=".dbf") returned 4 [0062.901] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.901] lstrlenW (lpString=".1cd") returned 4 [0062.901] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.901] lstrlenW (lpString=".jpg") returned 4 [0062.901] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.901] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0062.901] lstrlenW (lpString="promointl.dll") returned 13 [0062.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.434] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15760) returned 1 [0063.434] CloseHandle (hObject=0x22c) returned 1 [0063.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0063.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.456] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.456] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.457] GetLastError () returned 0x0 [0063.457] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0063.459] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0063.460] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.460] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0063.460] SetEndOfFile (hFile=0x190) returned 1 [0063.460] CloseHandle (hObject=0x190) returned 1 [0063.460] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.460] SetEndOfFile (hFile=0x22c) returned 1 [0063.461] CloseHandle (hObject=0x22c) returned 1 [0063.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.461] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0063.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString=".doc") returned 4 [0063.462] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString=".docx") returned 5 [0063.462] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0063.462] lstrlenW (lpString=".pdf") returned 4 [0063.462] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString=".xls") returned 4 [0063.462] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString=".xlsx") returned 5 [0063.462] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0063.462] lstrlenW (lpString=".ppt") returned 4 [0063.462] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString=".zip") returned 4 [0063.462] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString=".rar") returned 4 [0063.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString=".bz2") returned 4 [0063.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.462] lstrlenW (lpString=".7z") returned 3 [0063.462] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString=".dbf") returned 4 [0063.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString=".1cd") returned 4 [0063.462] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.462] lstrlenW (lpString=".jpg") returned 4 [0063.462] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString=".doc") returned 4 [0063.463] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString=".docx") returned 5 [0063.463] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0063.463] lstrlenW (lpString=".pdf") returned 4 [0063.463] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString=".xls") returned 4 [0063.463] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString=".xlsx") returned 5 [0063.463] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0063.463] lstrlenW (lpString=".ppt") returned 4 [0063.463] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString=".zip") returned 4 [0063.463] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString=".rar") returned 4 [0063.463] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.463] lstrlenW (lpString=".bz2") returned 4 [0063.463] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.463] lstrlenW (lpString=".7z") returned 3 [0063.463] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString=".dbf") returned 4 [0063.463] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString=".1cd") returned 4 [0063.463] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.463] lstrlenW (lpString=".jpg") returned 4 [0063.463] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.464] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0063.464] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0063.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.464] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15736) returned 1 [0063.464] CloseHandle (hObject=0x22c) returned 1 [0063.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0063.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.464] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.464] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.465] GetLastError () returned 0x0 [0063.465] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3d78, lpOverlapped=0x0) returned 1 [0063.469] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0063.470] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.470] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.470] SetEndOfFile (hFile=0x190) returned 1 [0063.470] CloseHandle (hObject=0x190) returned 1 [0063.470] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.470] SetEndOfFile (hFile=0x22c) returned 1 [0063.471] CloseHandle (hObject=0x22c) returned 1 [0063.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString=".doc") returned 4 [0063.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString=".docx") returned 5 [0063.472] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0063.472] lstrlenW (lpString=".pdf") returned 4 [0063.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString=".xls") returned 4 [0063.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString=".xlsx") returned 5 [0063.472] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0063.472] lstrlenW (lpString=".ppt") returned 4 [0063.472] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString=".zip") returned 4 [0063.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString=".rar") returned 4 [0063.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.472] lstrlenW (lpString=".bz2") returned 4 [0063.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.472] lstrlenW (lpString=".7z") returned 3 [0063.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString=".dbf") returned 4 [0063.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString=".1cd") returned 4 [0063.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.472] lstrlenW (lpString=".jpg") returned 4 [0063.473] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.473] lstrlenW (lpString=".doc") returned 4 [0063.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString=".docx") returned 5 [0063.473] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0063.473] lstrlenW (lpString=".pdf") returned 4 [0063.473] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString=".xls") returned 4 [0063.473] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString=".xlsx") returned 5 [0063.473] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0063.473] lstrlenW (lpString=".ppt") returned 4 [0063.473] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.473] lstrlenW (lpString=".zip") returned 4 [0063.473] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString=".rar") returned 4 [0063.473] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.473] lstrlenW (lpString=".bz2") returned 4 [0063.473] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.473] lstrlenW (lpString=".7z") returned 3 [0063.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.473] lstrlenW (lpString=".dbf") returned 4 [0063.473] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.473] lstrlenW (lpString=".1cd") returned 4 [0063.473] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.474] lstrlenW (lpString=".jpg") returned 4 [0063.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.474] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0063.474] lstrlenW (lpString="Setup.exe") returned 9 [0063.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.475] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1377144) returned 1 [0063.475] CloseHandle (hObject=0x22c) returned 1 [0063.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0063.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.475] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.475] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.475] GetLastError () returned 0x0 [0063.476] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.501] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.799] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x50388, lpOverlapped=0x0) returned 1 [0063.812] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x50390, lpOverlapped=0x0) returned 1 [0063.821] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.821] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.821] SetEndOfFile (hFile=0x190) returned 1 [0063.821] CloseHandle (hObject=0x190) returned 1 [0063.822] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.822] SetEndOfFile (hFile=0x22c) returned 1 [0063.825] CloseHandle (hObject=0x22c) returned 1 [0063.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.825] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString=".doc") returned 4 [0063.826] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.826] lstrlenW (lpString=".docx") returned 5 [0063.826] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0063.826] lstrlenW (lpString=".pdf") returned 4 [0063.826] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.826] lstrlenW (lpString=".xls") returned 4 [0063.826] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.826] lstrlenW (lpString=".xlsx") returned 5 [0063.826] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0063.826] lstrlenW (lpString=".ppt") returned 4 [0063.826] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString=".zip") returned 4 [0063.826] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.826] lstrlenW (lpString=".rar") returned 4 [0063.826] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.826] lstrlenW (lpString=".bz2") returned 4 [0063.826] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.826] lstrlenW (lpString=".7z") returned 3 [0063.826] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString=".dbf") returned 4 [0063.826] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString=".1cd") returned 4 [0063.826] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.826] lstrlenW (lpString=".jpg") returned 4 [0063.826] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString=".doc") returned 4 [0063.827] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.827] lstrlenW (lpString=".docx") returned 5 [0063.827] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0063.827] lstrlenW (lpString=".pdf") returned 4 [0063.827] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString=".xls") returned 4 [0063.827] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString=".xlsx") returned 5 [0063.827] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0063.827] lstrlenW (lpString=".ppt") returned 4 [0063.827] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString=".zip") returned 4 [0063.827] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString=".rar") returned 4 [0063.827] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.827] lstrlenW (lpString=".bz2") returned 4 [0063.827] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.827] lstrlenW (lpString=".7z") returned 3 [0063.827] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString=".dbf") returned 4 [0063.827] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString=".1cd") returned 4 [0063.827] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.827] lstrlenW (lpString=".jpg") returned 4 [0063.827] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.828] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.828] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0063.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.828] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=19848) returned 1 [0063.828] CloseHandle (hObject=0x22c) returned 1 [0063.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0063.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.829] GetLastError () returned 0x0 [0063.829] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4d88, lpOverlapped=0x0) returned 1 [0063.896] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4d90, lpOverlapped=0x0) returned 1 [0063.899] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.899] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.899] SetEndOfFile (hFile=0x190) returned 1 [0064.347] CloseHandle (hObject=0x190) returned 1 [0064.915] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.915] SetEndOfFile (hFile=0x22c) returned 1 [0064.929] CloseHandle (hObject=0x22c) returned 1 [0064.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0064.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.942] lstrlenW (lpString=".doc") returned 4 [0064.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString=".docx") returned 5 [0064.943] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0064.943] lstrlenW (lpString=".pdf") returned 4 [0064.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString=".xls") returned 4 [0064.943] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString=".xlsx") returned 5 [0064.943] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0064.943] lstrlenW (lpString=".ppt") returned 4 [0064.943] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.943] lstrlenW (lpString=".zip") returned 4 [0064.943] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString=".rar") returned 4 [0064.943] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString=".bz2") returned 4 [0064.943] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.943] lstrlenW (lpString=".7z") returned 3 [0064.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.943] lstrlenW (lpString=".dbf") returned 4 [0064.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.943] lstrlenW (lpString=".1cd") returned 4 [0064.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.943] lstrlenW (lpString=".jpg") returned 4 [0064.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.944] lstrlenW (lpString=".doc") returned 4 [0064.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString=".docx") returned 5 [0064.944] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0064.944] lstrlenW (lpString=".pdf") returned 4 [0064.944] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString=".xls") returned 4 [0064.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString=".xlsx") returned 5 [0064.944] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0064.944] lstrlenW (lpString=".ppt") returned 4 [0064.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.944] lstrlenW (lpString=".zip") returned 4 [0064.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString=".rar") returned 4 [0064.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.944] lstrlenW (lpString=".bz2") returned 4 [0064.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.944] lstrlenW (lpString=".7z") returned 3 [0064.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.944] lstrlenW (lpString=".dbf") returned 4 [0064.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.944] lstrlenW (lpString=".1cd") returned 4 [0064.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0064.944] lstrlenW (lpString=".jpg") returned 4 [0064.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.945] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0064.945] lstrlenW (lpString="RICHED20.DLL") returned 12 [0064.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.945] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1870696) returned 1 [0064.945] CloseHandle (hObject=0x22c) returned 1 [0064.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0064.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0064.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.947] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.947] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.947] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.950] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.950] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.954] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.954] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.955] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.969] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.969] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0065.139] SetEndOfFile (hFile=0x22c) returned 1 [0065.179] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0065.179] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.179] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.181] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.181] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.183] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.183] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0065.185] CloseHandle (hObject=0x22c) returned 1 [0065.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.185] lstrlenW (lpString=".doc") returned 4 [0065.185] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString=".docx") returned 5 [0065.185] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0065.185] lstrlenW (lpString=".pdf") returned 4 [0065.185] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString=".xls") returned 4 [0065.185] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString=".xlsx") returned 5 [0065.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0065.185] lstrlenW (lpString=".ppt") returned 4 [0065.185] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.185] lstrlenW (lpString=".zip") returned 4 [0065.185] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString=".rar") returned 4 [0065.185] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.185] lstrlenW (lpString=".bz2") returned 4 [0065.185] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.185] lstrlenW (lpString=".7z") returned 3 [0065.185] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.185] lstrlenW (lpString=".dbf") returned 4 [0065.186] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString=".1cd") returned 4 [0065.186] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString=".jpg") returned 4 [0065.186] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString=".doc") returned 4 [0065.186] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString=".docx") returned 5 [0065.186] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0065.186] lstrlenW (lpString=".pdf") returned 4 [0065.186] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString=".xls") returned 4 [0065.186] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString=".xlsx") returned 5 [0065.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0065.186] lstrlenW (lpString=".ppt") returned 4 [0065.186] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString=".zip") returned 4 [0065.186] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString=".rar") returned 4 [0065.186] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.186] lstrlenW (lpString=".bz2") returned 4 [0065.186] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.186] lstrlenW (lpString=".7z") returned 3 [0065.186] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.186] lstrlenW (lpString=".dbf") returned 4 [0065.186] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.187] lstrlenW (lpString=".1cd") returned 4 [0065.187] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0065.187] lstrlenW (lpString=".jpg") returned 4 [0065.187] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.187] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0065.187] lstrlenW (lpString="OSPPC.DLL") returned 9 [0065.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.188] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=148736) returned 1 [0065.188] CloseHandle (hObject=0x22c) returned 1 [0065.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0065.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.189] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.189] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0065.189] GetLastError () returned 0x0 [0065.189] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x24500, lpOverlapped=0x0) returned 1 [0065.193] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x24510, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x24510, lpOverlapped=0x0) returned 1 [0065.195] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.195] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.196] SetEndOfFile (hFile=0x190) returned 1 [0065.196] CloseHandle (hObject=0x190) returned 1 [0065.196] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.196] SetEndOfFile (hFile=0x22c) returned 1 [0065.197] CloseHandle (hObject=0x22c) returned 1 [0065.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1 [0065.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.198] lstrlenW (lpString=".doc") returned 4 [0065.198] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString=".docx") returned 5 [0065.198] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0065.198] lstrlenW (lpString=".pdf") returned 4 [0065.198] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString=".xls") returned 4 [0065.198] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString=".xlsx") returned 5 [0065.198] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0065.198] lstrlenW (lpString=".ppt") returned 4 [0065.198] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.198] lstrlenW (lpString=".zip") returned 4 [0065.198] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString=".rar") returned 4 [0065.198] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.198] lstrlenW (lpString=".bz2") returned 4 [0065.198] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.198] lstrlenW (lpString=".7z") returned 3 [0065.198] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.198] lstrlenW (lpString=".dbf") returned 4 [0065.198] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.198] lstrlenW (lpString=".1cd") returned 4 [0065.199] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString=".jpg") returned 4 [0065.199] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString=".doc") returned 4 [0065.199] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString=".docx") returned 5 [0065.199] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0065.199] lstrlenW (lpString=".pdf") returned 4 [0065.199] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString=".xls") returned 4 [0065.199] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString=".xlsx") returned 5 [0065.199] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0065.199] lstrlenW (lpString=".ppt") returned 4 [0065.199] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString=".zip") returned 4 [0065.199] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString=".rar") returned 4 [0065.199] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.199] lstrlenW (lpString=".bz2") returned 4 [0065.199] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.199] lstrlenW (lpString=".7z") returned 3 [0065.199] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString=".dbf") returned 4 [0065.199] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.199] lstrlenW (lpString=".1cd") returned 4 [0065.199] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0065.200] lstrlenW (lpString=".jpg") returned 4 [0065.200] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.200] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0065.200] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0065.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.200] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1828608) returned 1 [0065.200] CloseHandle (hObject=0x22c) returned 1 [0065.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0065.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0065.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.201] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0065.201] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.201] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.206] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.206] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.412] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0065.415] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.417] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.589] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.590] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0065.612] SetEndOfFile (hFile=0x22c) returned 1 [0065.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0065.612] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.612] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.613] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.613] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.615] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.616] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.618] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0065.618] CloseHandle (hObject=0x22c) returned 1 [0065.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.618] lstrlenW (lpString=".doc") returned 4 [0065.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString=".docx") returned 5 [0065.618] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0065.618] lstrlenW (lpString=".pdf") returned 4 [0065.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString=".xls") returned 4 [0065.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString=".xlsx") returned 5 [0065.618] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0065.618] lstrlenW (lpString=".ppt") returned 4 [0065.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.618] lstrlenW (lpString=".zip") returned 4 [0065.618] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString=".rar") returned 4 [0065.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.618] lstrlenW (lpString=".bz2") returned 4 [0065.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.619] lstrlenW (lpString=".7z") returned 3 [0065.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString=".dbf") returned 4 [0065.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString=".1cd") returned 4 [0065.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString=".jpg") returned 4 [0065.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString=".doc") returned 4 [0065.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString=".docx") returned 5 [0065.619] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0065.619] lstrlenW (lpString=".pdf") returned 4 [0065.619] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString=".xls") returned 4 [0065.619] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString=".xlsx") returned 5 [0065.619] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0065.619] lstrlenW (lpString=".ppt") returned 4 [0065.619] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.619] lstrlenW (lpString=".zip") returned 4 [0065.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString=".rar") returned 4 [0065.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.619] lstrlenW (lpString=".bz2") returned 4 [0065.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.619] lstrlenW (lpString=".7z") returned 3 [0065.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.620] lstrlenW (lpString=".dbf") returned 4 [0065.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.620] lstrlenW (lpString=".1cd") returned 4 [0065.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0065.620] lstrlenW (lpString=".jpg") returned 4 [0065.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.620] lstrcmpiW (lpString1=".xrm-ms", lpString2=".zoh") returned -1 [0065.620] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0065.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.621] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=11646) returned 1 [0065.621] CloseHandle (hObject=0x22c) returned 1 [0065.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0065.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.621] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.621] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0065.622] GetLastError () returned 0x0 [0065.622] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2d7e, lpOverlapped=0x0) returned 1 [0066.015] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0066.020] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.020] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x128, lpOverlapped=0x0) returned 1 [0066.021] SetEndOfFile (hFile=0x190) returned 1 [0066.021] CloseHandle (hObject=0x190) returned 1 [0066.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.021] SetEndOfFile (hFile=0x22c) returned 1 [0066.022] CloseHandle (hObject=0x22c) returned 1 [0066.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.022] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1 [0066.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.022] lstrlenW (lpString=".doc") returned 4 [0066.022] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0066.022] lstrlenW (lpString=".docx") returned 5 [0066.022] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0066.022] lstrlenW (lpString=".pdf") returned 4 [0066.022] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0066.022] lstrlenW (lpString=".xls") returned 4 [0066.022] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".xlsx") returned 5 [0066.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0066.023] lstrlenW (lpString=".ppt") returned 4 [0066.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString=".zip") returned 4 [0066.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".rar") returned 4 [0066.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".bz2") returned 4 [0066.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".7z") returned 3 [0066.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString=".dbf") returned 4 [0066.023] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString=".1cd") returned 4 [0066.023] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString=".jpg") returned 4 [0066.023] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.023] lstrlenW (lpString=".doc") returned 4 [0066.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".docx") returned 5 [0066.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0066.023] lstrlenW (lpString=".pdf") returned 4 [0066.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".xls") returned 4 [0066.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0066.023] lstrlenW (lpString=".xlsx") returned 5 [0066.024] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0066.024] lstrlenW (lpString=".ppt") returned 4 [0066.024] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.024] lstrlenW (lpString=".zip") returned 4 [0066.024] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString=".rar") returned 4 [0066.024] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString=".bz2") returned 4 [0066.024] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString=".7z") returned 3 [0066.024] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0066.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.024] lstrlenW (lpString=".dbf") returned 4 [0066.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.024] lstrlenW (lpString=".1cd") returned 4 [0066.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0066.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0066.024] lstrlenW (lpString=".jpg") returned 4 [0066.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0066.024] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0066.024] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0066.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.025] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2173696) returned 1 [0066.025] CloseHandle (hObject=0x22c) returned 1 [0066.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0066.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0066.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.026] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.026] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.026] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.030] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.030] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.038] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.038] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.038] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.060] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.060] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0066.107] SetEndOfFile (hFile=0x22c) returned 1 [0066.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0066.107] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.109] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.109] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.111] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.111] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.112] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0066.112] CloseHandle (hObject=0x22c) returned 1 [0066.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.113] lstrlenW (lpString=".doc") returned 4 [0066.113] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString=".docx") returned 5 [0066.113] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0066.113] lstrlenW (lpString=".pdf") returned 4 [0066.113] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString=".xls") returned 4 [0066.113] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString=".xlsx") returned 5 [0066.113] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0066.113] lstrlenW (lpString=".ppt") returned 4 [0066.113] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.113] lstrlenW (lpString=".zip") returned 4 [0066.113] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString=".rar") returned 4 [0066.113] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.113] lstrlenW (lpString=".bz2") returned 4 [0066.113] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.113] lstrlenW (lpString=".7z") returned 3 [0066.113] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.113] lstrlenW (lpString=".dbf") returned 4 [0066.113] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".1cd") returned 4 [0066.114] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".jpg") returned 4 [0066.114] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".doc") returned 4 [0066.114] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString=".docx") returned 5 [0066.114] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0066.114] lstrlenW (lpString=".pdf") returned 4 [0066.114] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString=".xls") returned 4 [0066.114] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString=".xlsx") returned 5 [0066.114] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0066.114] lstrlenW (lpString=".ppt") returned 4 [0066.114] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".zip") returned 4 [0066.114] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString=".rar") returned 4 [0066.114] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.114] lstrlenW (lpString=".bz2") returned 4 [0066.114] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.114] lstrlenW (lpString=".7z") returned 3 [0066.114] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".dbf") returned 4 [0066.114] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.114] lstrlenW (lpString=".1cd") returned 4 [0066.115] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0066.115] lstrlenW (lpString=".jpg") returned 4 [0066.115] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.115] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0066.115] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0066.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.115] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15712) returned 1 [0066.115] CloseHandle (hObject=0x22c) returned 1 [0066.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0066.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.116] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.116] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.116] GetLastError () returned 0x0 [0066.116] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3d60, lpOverlapped=0x0) returned 1 [0066.118] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3d70, lpOverlapped=0x0) returned 1 [0066.119] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.119] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0066.120] SetEndOfFile (hFile=0x190) returned 1 [0066.120] CloseHandle (hObject=0x190) returned 1 [0066.120] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.120] SetEndOfFile (hFile=0x22c) returned 1 [0066.121] CloseHandle (hObject=0x22c) returned 1 [0066.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1 [0066.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.121] lstrlenW (lpString=".doc") returned 4 [0066.121] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.121] lstrlenW (lpString=".docx") returned 5 [0066.121] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0066.121] lstrlenW (lpString=".pdf") returned 4 [0066.121] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.121] lstrlenW (lpString=".xls") returned 4 [0066.121] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.121] lstrlenW (lpString=".xlsx") returned 5 [0066.121] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0066.121] lstrlenW (lpString=".ppt") returned 4 [0066.121] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.121] lstrlenW (lpString=".zip") returned 4 [0066.121] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.121] lstrlenW (lpString=".rar") returned 4 [0066.121] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.121] lstrlenW (lpString=".bz2") returned 4 [0066.122] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.122] lstrlenW (lpString=".7z") returned 3 [0066.122] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString=".dbf") returned 4 [0066.122] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString=".1cd") returned 4 [0066.122] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString=".jpg") returned 4 [0066.122] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString=".doc") returned 4 [0066.122] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.122] lstrlenW (lpString=".docx") returned 5 [0066.122] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0066.122] lstrlenW (lpString=".pdf") returned 4 [0066.122] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.122] lstrlenW (lpString=".xls") returned 4 [0066.122] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.122] lstrlenW (lpString=".xlsx") returned 5 [0066.122] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0066.122] lstrlenW (lpString=".ppt") returned 4 [0066.122] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.122] lstrlenW (lpString=".zip") returned 4 [0066.122] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.122] lstrlenW (lpString=".rar") returned 4 [0066.122] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.123] lstrlenW (lpString=".bz2") returned 4 [0066.123] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.123] lstrlenW (lpString=".7z") returned 3 [0066.123] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.123] lstrlenW (lpString=".dbf") returned 4 [0066.123] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.123] lstrlenW (lpString=".1cd") returned 4 [0066.123] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0066.123] lstrlenW (lpString=".jpg") returned 4 [0066.123] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.123] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0066.123] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0066.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.124] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4925184) returned 1 [0066.124] CloseHandle (hObject=0x22c) returned 1 [0066.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0066.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0066.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.125] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.125] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.125] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.129] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.129] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.135] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.135] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.135] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.159] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.159] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0066.183] SetEndOfFile (hFile=0x22c) returned 1 [0066.183] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0066.184] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.184] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.185] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.185] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.281] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.281] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.283] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0066.283] CloseHandle (hObject=0x22c) returned 1 [0066.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.283] lstrlenW (lpString=".doc") returned 4 [0066.283] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.283] lstrlenW (lpString=".docx") returned 5 [0066.283] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0066.283] lstrlenW (lpString=".pdf") returned 4 [0066.283] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.283] lstrlenW (lpString=".xls") returned 4 [0066.283] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.283] lstrlenW (lpString=".xlsx") returned 5 [0066.283] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0066.283] lstrlenW (lpString=".ppt") returned 4 [0066.283] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.283] lstrlenW (lpString=".zip") returned 4 [0066.284] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString=".rar") returned 4 [0066.284] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString=".bz2") returned 4 [0066.284] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.284] lstrlenW (lpString=".7z") returned 3 [0066.284] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString=".dbf") returned 4 [0066.284] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString=".1cd") returned 4 [0066.284] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString=".jpg") returned 4 [0066.284] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString=".doc") returned 4 [0066.284] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.284] lstrlenW (lpString=".docx") returned 5 [0066.284] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0066.284] lstrlenW (lpString=".pdf") returned 4 [0066.284] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString=".xls") returned 4 [0066.284] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString=".xlsx") returned 5 [0066.284] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0066.284] lstrlenW (lpString=".ppt") returned 4 [0066.284] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.284] lstrlenW (lpString=".zip") returned 4 [0066.285] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.285] lstrlenW (lpString=".rar") returned 4 [0066.285] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.285] lstrlenW (lpString=".bz2") returned 4 [0066.285] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.285] lstrlenW (lpString=".7z") returned 3 [0066.285] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.285] lstrlenW (lpString=".dbf") returned 4 [0066.285] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.285] lstrlenW (lpString=".1cd") returned 4 [0066.285] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0066.285] lstrlenW (lpString=".jpg") returned 4 [0066.285] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.285] lstrcmpiW (lpString1=".LEX", lpString2=".zoh") returned -1 [0066.285] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0066.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.370] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=395651) returned 1 [0067.370] CloseHandle (hObject=0x1f4) returned 1 [0067.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0067.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.372] GetLastError () returned 0x0 [0067.372] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x60983, lpOverlapped=0x0) returned 1 [0067.380] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x60990, lpOverlapped=0x0) returned 1 [0067.387] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.387] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.387] SetEndOfFile (hFile=0x1ec) returned 1 [0067.387] CloseHandle (hObject=0x1ec) returned 1 [0067.387] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.388] SetEndOfFile (hFile=0x1f4) returned 1 [0067.391] CloseHandle (hObject=0x1f4) returned 1 [0067.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.391] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1 [0067.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.391] lstrlenW (lpString=".doc") returned 4 [0067.392] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0067.392] lstrlenW (lpString=".docx") returned 5 [0067.392] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0067.392] lstrlenW (lpString=".pdf") returned 4 [0067.392] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0067.392] lstrlenW (lpString=".xls") returned 4 [0067.392] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0067.392] lstrlenW (lpString=".xlsx") returned 5 [0067.392] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0067.392] lstrlenW (lpString=".ppt") returned 4 [0067.392] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0067.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.392] lstrlenW (lpString=".zip") returned 4 [0067.392] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0067.392] lstrlenW (lpString=".rar") returned 4 [0067.392] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0067.392] lstrlenW (lpString=".bz2") returned 4 [0067.392] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0067.392] lstrlenW (lpString=".7z") returned 3 [0067.392] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0067.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.392] lstrlenW (lpString=".dbf") returned 4 [0067.392] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0067.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.392] lstrlenW (lpString=".1cd") returned 4 [0067.392] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0067.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.392] lstrlenW (lpString=".jpg") returned 4 [0067.392] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0067.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString=".doc") returned 4 [0067.393] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0067.393] lstrlenW (lpString=".docx") returned 5 [0067.393] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0067.393] lstrlenW (lpString=".pdf") returned 4 [0067.393] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0067.393] lstrlenW (lpString=".xls") returned 4 [0067.393] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0067.393] lstrlenW (lpString=".xlsx") returned 5 [0067.393] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0067.393] lstrlenW (lpString=".ppt") returned 4 [0067.393] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0067.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString=".zip") returned 4 [0067.393] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0067.393] lstrlenW (lpString=".rar") returned 4 [0067.393] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0067.393] lstrlenW (lpString=".bz2") returned 4 [0067.393] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0067.393] lstrlenW (lpString=".7z") returned 3 [0067.393] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0067.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString=".dbf") returned 4 [0067.393] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0067.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString=".1cd") returned 4 [0067.393] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0067.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0067.393] lstrlenW (lpString=".jpg") returned 4 [0067.393] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0067.394] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.394] lstrlenW (lpString="FDATE.DLL") returned 9 [0067.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.394] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=98176) returned 1 [0067.394] CloseHandle (hObject=0x1f4) returned 1 [0067.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0067.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.395] GetLastError () returned 0x0 [0067.395] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x17f80, lpOverlapped=0x0) returned 1 [0067.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x17f90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x17f90, lpOverlapped=0x0) returned 1 [0067.400] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.400] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.400] SetEndOfFile (hFile=0x1ec) returned 1 [0067.400] CloseHandle (hObject=0x1ec) returned 1 [0067.400] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.401] SetEndOfFile (hFile=0x1f4) returned 1 [0067.402] CloseHandle (hObject=0x1f4) returned 1 [0067.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1 [0067.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.402] lstrlenW (lpString=".doc") returned 4 [0067.402] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.402] lstrlenW (lpString=".docx") returned 5 [0067.402] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0067.402] lstrlenW (lpString=".pdf") returned 4 [0067.402] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.402] lstrlenW (lpString=".xls") returned 4 [0067.402] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString=".xlsx") returned 5 [0067.403] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0067.403] lstrlenW (lpString=".ppt") returned 4 [0067.403] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString=".zip") returned 4 [0067.403] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString=".rar") returned 4 [0067.403] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString=".bz2") returned 4 [0067.403] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.403] lstrlenW (lpString=".7z") returned 3 [0067.403] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString=".dbf") returned 4 [0067.403] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString=".1cd") returned 4 [0067.403] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString=".jpg") returned 4 [0067.403] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.403] lstrlenW (lpString=".doc") returned 4 [0067.403] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.403] lstrlenW (lpString=".docx") returned 5 [0067.403] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0067.404] lstrlenW (lpString=".pdf") returned 4 [0067.404] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.404] lstrlenW (lpString=".xls") returned 4 [0067.404] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.404] lstrlenW (lpString=".xlsx") returned 5 [0067.404] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0067.404] lstrlenW (lpString=".ppt") returned 4 [0067.404] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.404] lstrlenW (lpString=".zip") returned 4 [0067.404] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.404] lstrlenW (lpString=".rar") returned 4 [0067.404] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.404] lstrlenW (lpString=".bz2") returned 4 [0067.404] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.404] lstrlenW (lpString=".7z") returned 3 [0067.404] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.404] lstrlenW (lpString=".dbf") returned 4 [0067.404] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.404] lstrlenW (lpString=".1cd") returned 4 [0067.404] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0067.404] lstrlenW (lpString=".jpg") returned 4 [0067.404] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.404] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.404] lstrlenW (lpString="FPERSON.DLL") returned 11 [0067.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.477] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=217984) returned 1 [0067.477] CloseHandle (hObject=0x158) returned 1 [0067.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0067.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.478] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.478] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.478] GetLastError () returned 0x0 [0067.478] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x35380, lpOverlapped=0x0) returned 1 [0067.484] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x35390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x35390, lpOverlapped=0x0) returned 1 [0067.488] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.488] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0067.488] SetEndOfFile (hFile=0x160) returned 1 [0067.488] CloseHandle (hObject=0x160) returned 1 [0067.488] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.488] SetEndOfFile (hFile=0x158) returned 1 [0067.490] CloseHandle (hObject=0x158) returned 1 [0067.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1 [0067.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.490] lstrlenW (lpString=".doc") returned 4 [0067.490] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.490] lstrlenW (lpString=".docx") returned 5 [0067.490] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0067.490] lstrlenW (lpString=".pdf") returned 4 [0067.490] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".xls") returned 4 [0067.491] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".xlsx") returned 5 [0067.491] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0067.491] lstrlenW (lpString=".ppt") returned 4 [0067.491] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString=".zip") returned 4 [0067.491] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".rar") returned 4 [0067.491] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".bz2") returned 4 [0067.491] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.491] lstrlenW (lpString=".7z") returned 3 [0067.491] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString=".dbf") returned 4 [0067.491] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString=".1cd") returned 4 [0067.491] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString=".jpg") returned 4 [0067.491] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.491] lstrlenW (lpString=".doc") returned 4 [0067.491] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".docx") returned 5 [0067.491] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0067.491] lstrlenW (lpString=".pdf") returned 4 [0067.491] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.491] lstrlenW (lpString=".xls") returned 4 [0067.491] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.492] lstrlenW (lpString=".xlsx") returned 5 [0067.492] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0067.492] lstrlenW (lpString=".ppt") returned 4 [0067.492] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.492] lstrlenW (lpString=".zip") returned 4 [0067.492] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.492] lstrlenW (lpString=".rar") returned 4 [0067.492] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.492] lstrlenW (lpString=".bz2") returned 4 [0067.492] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.492] lstrlenW (lpString=".7z") returned 3 [0067.492] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.492] lstrlenW (lpString=".dbf") returned 4 [0067.492] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.492] lstrlenW (lpString=".1cd") returned 4 [0067.492] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0067.492] lstrlenW (lpString=".jpg") returned 4 [0067.492] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.492] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.492] lstrlenW (lpString="IETAG.DLL") returned 9 [0067.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.494] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=234880) returned 1 [0067.494] CloseHandle (hObject=0x158) returned 1 [0067.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0067.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.494] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.494] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.495] GetLastError () returned 0x0 [0067.495] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x39580, lpOverlapped=0x0) returned 1 [0067.500] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x39590, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x39590, lpOverlapped=0x0) returned 1 [0067.505] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.505] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.505] SetEndOfFile (hFile=0x160) returned 1 [0067.505] CloseHandle (hObject=0x160) returned 1 [0067.505] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.505] SetEndOfFile (hFile=0x158) returned 1 [0067.507] CloseHandle (hObject=0x158) returned 1 [0067.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1 [0067.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.508] lstrlenW (lpString=".doc") returned 4 [0067.508] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString=".docx") returned 5 [0067.508] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0067.508] lstrlenW (lpString=".pdf") returned 4 [0067.508] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString=".xls") returned 4 [0067.508] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString=".xlsx") returned 5 [0067.508] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0067.508] lstrlenW (lpString=".ppt") returned 4 [0067.508] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.508] lstrlenW (lpString=".zip") returned 4 [0067.508] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString=".rar") returned 4 [0067.508] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.508] lstrlenW (lpString=".bz2") returned 4 [0067.508] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.508] lstrlenW (lpString=".7z") returned 3 [0067.508] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.508] lstrlenW (lpString=".dbf") returned 4 [0067.508] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString=".1cd") returned 4 [0067.509] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString=".jpg") returned 4 [0067.509] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString=".doc") returned 4 [0067.509] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString=".docx") returned 5 [0067.509] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0067.509] lstrlenW (lpString=".pdf") returned 4 [0067.509] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString=".xls") returned 4 [0067.509] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString=".xlsx") returned 5 [0067.509] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0067.509] lstrlenW (lpString=".ppt") returned 4 [0067.509] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString=".zip") returned 4 [0067.509] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString=".rar") returned 4 [0067.509] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.509] lstrlenW (lpString=".bz2") returned 4 [0067.509] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.509] lstrlenW (lpString=".7z") returned 3 [0067.509] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.509] lstrlenW (lpString=".dbf") returned 4 [0067.509] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.510] lstrlenW (lpString=".1cd") returned 4 [0067.510] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0067.510] lstrlenW (lpString=".jpg") returned 4 [0067.510] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.510] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.510] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0067.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.511] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=101248) returned 1 [0067.511] CloseHandle (hObject=0x158) returned 1 [0067.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0067.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.511] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.512] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.571] GetLastError () returned 0x0 [0067.571] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x18b80, lpOverlapped=0x0) returned 1 [0067.706] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x18b90, lpOverlapped=0x0) returned 1 [0067.716] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.717] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0067.726] SetEndOfFile (hFile=0x160) returned 1 [0067.726] CloseHandle (hObject=0x160) returned 1 [0067.726] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.726] SetEndOfFile (hFile=0x158) returned 1 [0067.730] CloseHandle (hObject=0x158) returned 1 [0067.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1 [0067.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.731] lstrlenW (lpString=".doc") returned 4 [0067.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString=".docx") returned 5 [0067.731] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.731] lstrlenW (lpString=".pdf") returned 4 [0067.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString=".xls") returned 4 [0067.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString=".xlsx") returned 5 [0067.731] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.731] lstrlenW (lpString=".ppt") returned 4 [0067.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.731] lstrlenW (lpString=".zip") returned 4 [0067.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString=".rar") returned 4 [0067.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.731] lstrlenW (lpString=".bz2") returned 4 [0067.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.731] lstrlenW (lpString=".7z") returned 3 [0067.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.731] lstrlenW (lpString=".dbf") returned 4 [0067.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.731] lstrlenW (lpString=".1cd") returned 4 [0067.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".jpg") returned 4 [0067.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".doc") returned 4 [0067.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString=".docx") returned 5 [0067.732] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.732] lstrlenW (lpString=".pdf") returned 4 [0067.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString=".xls") returned 4 [0067.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString=".xlsx") returned 5 [0067.732] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.732] lstrlenW (lpString=".ppt") returned 4 [0067.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".zip") returned 4 [0067.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString=".rar") returned 4 [0067.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.732] lstrlenW (lpString=".bz2") returned 4 [0067.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.732] lstrlenW (lpString=".7z") returned 3 [0067.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".dbf") returned 4 [0067.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".1cd") returned 4 [0067.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0067.732] lstrlenW (lpString=".jpg") returned 4 [0067.733] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.733] lstrcmpiW (lpString1=".CNV", lpString2=".zoh") returned -1 [0067.733] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0067.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.733] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=36712) returned 1 [0067.733] CloseHandle (hObject=0x158) returned 1 [0067.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0067.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.734] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.734] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.734] GetLastError () returned 0x0 [0067.734] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x8f68, lpOverlapped=0x0) returned 1 [0067.745] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x8f70, lpOverlapped=0x0) returned 1 [0067.747] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.747] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.747] SetEndOfFile (hFile=0x160) returned 1 [0067.761] CloseHandle (hObject=0x160) returned 1 [0067.777] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.777] SetEndOfFile (hFile=0x158) returned 1 [0067.782] CloseHandle (hObject=0x158) returned 1 [0067.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.782] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.783] lstrlenW (lpString=".doc") returned 4 [0067.783] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString=".docx") returned 5 [0067.783] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0067.783] lstrlenW (lpString=".pdf") returned 4 [0067.783] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString=".xls") returned 4 [0067.783] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString=".xlsx") returned 5 [0067.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0067.783] lstrlenW (lpString=".ppt") returned 4 [0067.783] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.783] lstrlenW (lpString=".zip") returned 4 [0067.783] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString=".rar") returned 4 [0067.783] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString=".bz2") returned 4 [0067.783] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0067.783] lstrlenW (lpString=".7z") returned 3 [0067.783] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.783] lstrlenW (lpString=".dbf") returned 4 [0067.783] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.783] lstrlenW (lpString=".1cd") returned 4 [0067.784] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.784] lstrlenW (lpString=".jpg") returned 4 [0067.784] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.784] lstrlenW (lpString=".doc") returned 4 [0067.784] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString=".docx") returned 5 [0067.784] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0067.784] lstrlenW (lpString=".pdf") returned 4 [0067.784] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString=".xls") returned 4 [0067.784] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString=".xlsx") returned 5 [0067.784] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0067.784] lstrlenW (lpString=".ppt") returned 4 [0067.784] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.784] lstrlenW (lpString=".zip") returned 4 [0067.784] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString=".rar") returned 4 [0067.784] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString=".bz2") returned 4 [0067.784] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0067.784] lstrlenW (lpString=".7z") returned 3 [0067.784] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.784] lstrlenW (lpString=".dbf") returned 4 [0067.784] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.785] lstrlenW (lpString=".1cd") returned 4 [0067.785] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0067.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0067.785] lstrlenW (lpString=".jpg") returned 4 [0067.785] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0067.785] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0067.785] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0067.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.797] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=58766) returned 1 [0067.797] CloseHandle (hObject=0x158) returned 1 [0067.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0067.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.798] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.798] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.798] GetLastError () returned 0x0 [0067.798] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe58e, lpOverlapped=0x0) returned 1 [0067.830] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0067.831] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.831] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.832] SetEndOfFile (hFile=0x1c8) returned 1 [0067.832] CloseHandle (hObject=0x1c8) returned 1 [0067.832] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.832] SetEndOfFile (hFile=0x158) returned 1 [0067.833] CloseHandle (hObject=0x158) returned 1 [0067.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1 [0067.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.833] lstrlenW (lpString=".doc") returned 4 [0067.833] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0067.833] lstrlenW (lpString=".docx") returned 5 [0067.833] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0067.833] lstrlenW (lpString=".pdf") returned 4 [0067.833] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0067.833] lstrlenW (lpString=".xls") returned 4 [0067.833] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString=".xlsx") returned 5 [0067.834] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0067.834] lstrlenW (lpString=".ppt") returned 4 [0067.834] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString=".zip") returned 4 [0067.834] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString=".rar") returned 4 [0067.834] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString=".bz2") returned 4 [0067.834] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0067.834] lstrlenW (lpString=".7z") returned 3 [0067.834] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString=".dbf") returned 4 [0067.834] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString=".1cd") returned 4 [0067.834] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString=".jpg") returned 4 [0067.834] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.834] lstrlenW (lpString=".doc") returned 4 [0067.834] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0067.834] lstrlenW (lpString=".docx") returned 5 [0067.834] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0067.834] lstrlenW (lpString=".pdf") returned 4 [0067.834] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0067.834] lstrlenW (lpString=".xls") returned 4 [0067.835] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0067.835] lstrlenW (lpString=".xlsx") returned 5 [0067.835] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0067.835] lstrlenW (lpString=".ppt") returned 4 [0067.835] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0067.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.835] lstrlenW (lpString=".zip") returned 4 [0067.835] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0067.835] lstrlenW (lpString=".rar") returned 4 [0067.835] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0067.835] lstrlenW (lpString=".bz2") returned 4 [0067.835] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0067.835] lstrlenW (lpString=".7z") returned 3 [0067.835] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0067.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.835] lstrlenW (lpString=".dbf") returned 4 [0067.835] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0067.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.835] lstrlenW (lpString=".1cd") returned 4 [0067.835] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0067.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0067.835] lstrlenW (lpString=".jpg") returned 4 [0067.835] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0067.835] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0067.835] lstrlenW (lpString="ARCTIC.INF") returned 10 [0067.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.836] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=513) returned 1 [0067.836] CloseHandle (hObject=0x158) returned 1 [0067.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0067.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0067.836] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.836] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.837] GetLastError () returned 0x0 [0067.837] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x201, lpOverlapped=0x0) returned 1 [0067.838] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x210, lpOverlapped=0x0) returned 1 [0067.838] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.838] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0067.839] SetEndOfFile (hFile=0x1c8) returned 1 [0067.839] CloseHandle (hObject=0x1c8) returned 1 [0067.839] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.839] SetEndOfFile (hFile=0x158) returned 1 [0068.409] CloseHandle (hObject=0x158) returned 1 [0068.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1 [0068.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.410] lstrlenW (lpString=".doc") returned 4 [0068.410] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.410] lstrlenW (lpString=".docx") returned 5 [0068.410] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0068.410] lstrlenW (lpString=".pdf") returned 4 [0068.410] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.410] lstrlenW (lpString=".xls") returned 4 [0068.410] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.410] lstrlenW (lpString=".xlsx") returned 5 [0068.410] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0068.410] lstrlenW (lpString=".ppt") returned 4 [0068.410] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.410] lstrlenW (lpString=".zip") returned 4 [0068.410] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.410] lstrlenW (lpString=".rar") returned 4 [0068.410] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.410] lstrlenW (lpString=".bz2") returned 4 [0068.410] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.410] lstrlenW (lpString=".7z") returned 3 [0068.410] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString=".dbf") returned 4 [0068.411] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString=".1cd") returned 4 [0068.411] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString=".jpg") returned 4 [0068.411] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString=".doc") returned 4 [0068.411] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.411] lstrlenW (lpString=".docx") returned 5 [0068.411] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0068.411] lstrlenW (lpString=".pdf") returned 4 [0068.411] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString=".xls") returned 4 [0068.411] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString=".xlsx") returned 5 [0068.411] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0068.411] lstrlenW (lpString=".ppt") returned 4 [0068.411] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.411] lstrlenW (lpString=".zip") returned 4 [0068.411] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString=".rar") returned 4 [0068.411] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.411] lstrlenW (lpString=".bz2") returned 4 [0068.411] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.411] lstrlenW (lpString=".7z") returned 3 [0068.411] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.412] lstrlenW (lpString=".dbf") returned 4 [0068.412] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.412] lstrlenW (lpString=".1cd") returned 4 [0068.412] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0068.412] lstrlenW (lpString=".jpg") returned 4 [0068.412] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.412] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.412] lstrlenW (lpString="CAPSULES.ELM") returned 12 [0068.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0068.413] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=57786) returned 1 [0068.413] CloseHandle (hObject=0x158) returned 1 [0068.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0068.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0068.414] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.414] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.415] GetLastError () returned 0x0 [0068.415] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe1ba, lpOverlapped=0x0) returned 1 [0068.749] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe1c0, lpOverlapped=0x0) returned 1 [0068.751] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.751] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.751] SetEndOfFile (hFile=0x1ec) returned 1 [0068.752] CloseHandle (hObject=0x1ec) returned 1 [0068.752] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.752] SetEndOfFile (hFile=0x158) returned 1 [0068.753] CloseHandle (hObject=0x158) returned 1 [0068.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 1 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString=".doc") returned 4 [0068.754] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.754] lstrlenW (lpString=".docx") returned 5 [0068.754] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.754] lstrlenW (lpString=".pdf") returned 4 [0068.754] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.754] lstrlenW (lpString=".xls") returned 4 [0068.754] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.754] lstrlenW (lpString=".xlsx") returned 5 [0068.754] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.754] lstrlenW (lpString=".ppt") returned 4 [0068.754] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString=".zip") returned 4 [0068.754] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.754] lstrlenW (lpString=".rar") returned 4 [0068.754] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.754] lstrlenW (lpString=".bz2") returned 4 [0068.754] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.754] lstrlenW (lpString=".7z") returned 3 [0068.754] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString=".dbf") returned 4 [0068.754] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString=".1cd") returned 4 [0068.754] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.754] lstrlenW (lpString=".jpg") returned 4 [0068.754] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString=".doc") returned 4 [0068.755] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.755] lstrlenW (lpString=".docx") returned 5 [0068.755] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.755] lstrlenW (lpString=".pdf") returned 4 [0068.755] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString=".xls") returned 4 [0068.755] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString=".xlsx") returned 5 [0068.755] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.755] lstrlenW (lpString=".ppt") returned 4 [0068.755] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString=".zip") returned 4 [0068.755] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString=".rar") returned 4 [0068.755] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.755] lstrlenW (lpString=".bz2") returned 4 [0068.755] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.755] lstrlenW (lpString=".7z") returned 3 [0068.755] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString=".dbf") returned 4 [0068.755] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString=".1cd") returned 4 [0068.755] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0068.755] lstrlenW (lpString=".jpg") returned 4 [0068.755] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.756] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.756] lstrlenW (lpString="DEEPBLUE.ELM") returned 12 [0068.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0068.756] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=71388) returned 1 [0068.756] CloseHandle (hObject=0x158) returned 1 [0068.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0068.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0068.757] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.757] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.757] GetLastError () returned 0x0 [0068.757] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x116dc, lpOverlapped=0x0) returned 1 [0068.799] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x116e0, lpOverlapped=0x0) returned 1 [0068.937] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.937] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.937] SetEndOfFile (hFile=0x1ec) returned 1 [0068.938] CloseHandle (hObject=0x1ec) returned 1 [0068.938] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.938] SetEndOfFile (hFile=0x158) returned 1 [0068.939] CloseHandle (hObject=0x158) returned 1 [0068.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 1 [0068.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.939] lstrlenW (lpString=".doc") returned 4 [0068.939] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.939] lstrlenW (lpString=".docx") returned 5 [0068.940] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0068.940] lstrlenW (lpString=".pdf") returned 4 [0068.940] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString=".xls") returned 4 [0068.940] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString=".xlsx") returned 5 [0068.940] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0068.940] lstrlenW (lpString=".ppt") returned 4 [0068.940] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.940] lstrlenW (lpString=".zip") returned 4 [0068.940] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString=".rar") returned 4 [0068.940] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString=".bz2") returned 4 [0068.940] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.940] lstrlenW (lpString=".7z") returned 3 [0068.940] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.940] lstrlenW (lpString=".dbf") returned 4 [0068.940] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.940] lstrlenW (lpString=".1cd") returned 4 [0068.940] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.940] lstrlenW (lpString=".jpg") returned 4 [0068.940] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.941] lstrlenW (lpString=".doc") returned 4 [0068.941] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.941] lstrlenW (lpString=".docx") returned 5 [0068.941] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0068.941] lstrlenW (lpString=".pdf") returned 4 [0068.941] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.941] lstrlenW (lpString=".xls") returned 4 [0068.941] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.941] lstrlenW (lpString=".xlsx") returned 5 [0068.941] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0068.941] lstrlenW (lpString=".ppt") returned 4 [0068.941] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.941] lstrlenW (lpString=".zip") returned 4 [0068.941] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.941] lstrlenW (lpString=".rar") returned 4 [0068.941] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.941] lstrlenW (lpString=".bz2") returned 4 [0068.941] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.941] lstrlenW (lpString=".7z") returned 3 [0068.941] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.941] lstrlenW (lpString=".dbf") returned 4 [0068.941] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.941] lstrlenW (lpString=".1cd") returned 4 [0068.941] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0068.941] lstrlenW (lpString=".jpg") returned 4 [0068.941] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.942] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") [0068.942] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=118577) returned 1 [0068.942] CloseHandle (hObject=0x158) returned 1 [0068.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0068.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0068.943] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.943] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.943] GetLastError () returned 0x0 [0068.943] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1cf31, lpOverlapped=0x0) returned 1 [0069.167] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1cf40, lpOverlapped=0x0) returned 1 [0069.170] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.170] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.170] SetEndOfFile (hFile=0x1ec) returned 1 [0069.170] CloseHandle (hObject=0x1ec) returned 1 [0069.170] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.170] SetEndOfFile (hFile=0x158) returned 1 [0069.172] CloseHandle (hObject=0x158) returned 1 [0069.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 1 [0069.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.172] lstrlenW (lpString=".doc") returned 4 [0069.172] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.172] lstrlenW (lpString=".docx") returned 5 [0069.172] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.172] lstrlenW (lpString=".pdf") returned 4 [0069.172] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.172] lstrlenW (lpString=".xls") returned 4 [0069.172] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.172] lstrlenW (lpString=".xlsx") returned 5 [0069.172] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.172] lstrlenW (lpString=".ppt") returned 4 [0069.172] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.172] lstrlenW (lpString=".zip") returned 4 [0069.172] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.172] lstrlenW (lpString=".rar") returned 4 [0069.172] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.172] lstrlenW (lpString=".bz2") returned 4 [0069.172] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.173] lstrlenW (lpString=".7z") returned 3 [0069.173] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.173] lstrlenW (lpString=".dbf") returned 4 [0069.173] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.173] lstrlenW (lpString=".1cd") returned 4 [0069.173] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0069.173] lstrlenW (lpString=".jpg") returned 4 [0069.173] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.173] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") [0069.173] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=103737) returned 1 [0069.173] CloseHandle (hObject=0x158) returned 1 [0069.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0069.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.174] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.174] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.174] GetLastError () returned 0x0 [0069.174] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x19539, lpOverlapped=0x0) returned 1 [0069.218] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x19540, lpOverlapped=0x0) returned 1 [0069.220] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.220] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.220] SetEndOfFile (hFile=0x1ec) returned 1 [0069.220] CloseHandle (hObject=0x1ec) returned 1 [0069.220] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.220] SetEndOfFile (hFile=0x158) returned 1 [0069.222] CloseHandle (hObject=0x158) returned 1 [0069.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.222] lstrlenW (lpString=".doc") returned 4 [0069.222] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.223] lstrlenW (lpString=".docx") returned 5 [0069.223] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0069.223] lstrlenW (lpString=".pdf") returned 4 [0069.223] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.223] lstrlenW (lpString=".xls") returned 4 [0069.223] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.223] lstrlenW (lpString=".xlsx") returned 5 [0069.223] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0069.223] lstrlenW (lpString=".ppt") returned 4 [0069.223] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.223] lstrlenW (lpString=".zip") returned 4 [0069.223] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.223] lstrlenW (lpString=".rar") returned 4 [0069.223] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.223] lstrlenW (lpString=".bz2") returned 4 [0069.223] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.223] lstrlenW (lpString=".7z") returned 3 [0069.223] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.223] lstrlenW (lpString=".dbf") returned 4 [0069.223] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.223] lstrlenW (lpString=".1cd") returned 4 [0069.223] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0069.223] lstrlenW (lpString=".jpg") returned 4 [0069.223] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.223] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") [0069.224] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=99561) returned 1 [0069.224] CloseHandle (hObject=0x158) returned 1 [0069.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0069.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.224] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.224] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.225] GetLastError () returned 0x0 [0069.225] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x184e9, lpOverlapped=0x0) returned 1 [0069.228] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x184f0, lpOverlapped=0x0) returned 1 [0069.230] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.230] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.230] SetEndOfFile (hFile=0x1ec) returned 1 [0069.231] CloseHandle (hObject=0x1ec) returned 1 [0069.231] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.231] SetEndOfFile (hFile=0x158) returned 1 [0069.232] CloseHandle (hObject=0x158) returned 1 [0069.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 1 [0069.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.232] lstrlenW (lpString=".doc") returned 4 [0069.232] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.232] lstrlenW (lpString=".docx") returned 5 [0069.232] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0069.232] lstrlenW (lpString=".pdf") returned 4 [0069.233] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.233] lstrlenW (lpString=".xls") returned 4 [0069.233] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.233] lstrlenW (lpString=".xlsx") returned 5 [0069.233] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0069.233] lstrlenW (lpString=".ppt") returned 4 [0069.233] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.233] lstrlenW (lpString=".zip") returned 4 [0069.233] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.233] lstrlenW (lpString=".rar") returned 4 [0069.233] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.233] lstrlenW (lpString=".bz2") returned 4 [0069.233] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.233] lstrlenW (lpString=".7z") returned 3 [0069.233] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.233] lstrlenW (lpString=".dbf") returned 4 [0069.233] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.233] lstrlenW (lpString=".1cd") returned 4 [0069.233] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0069.233] lstrlenW (lpString=".jpg") returned 4 [0069.233] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.233] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") [0069.234] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=549) returned 1 [0069.234] CloseHandle (hObject=0x158) returned 1 [0069.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20 [0069.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.234] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.235] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.235] GetLastError () returned 0x0 [0069.235] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x225, lpOverlapped=0x0) returned 1 [0069.236] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x230, lpOverlapped=0x0) returned 1 [0069.237] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.237] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.237] SetEndOfFile (hFile=0x1ec) returned 1 [0069.237] CloseHandle (hObject=0x1ec) returned 1 [0069.237] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.237] SetEndOfFile (hFile=0x158) returned 1 [0069.238] CloseHandle (hObject=0x158) returned 1 [0069.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 1 [0069.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.238] lstrlenW (lpString=".doc") returned 4 [0069.238] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.238] lstrlenW (lpString=".docx") returned 5 [0069.238] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0069.238] lstrlenW (lpString=".pdf") returned 4 [0069.238] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.239] lstrlenW (lpString=".xls") returned 4 [0069.239] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.239] lstrlenW (lpString=".xlsx") returned 5 [0069.239] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0069.239] lstrlenW (lpString=".ppt") returned 4 [0069.239] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.239] lstrlenW (lpString=".zip") returned 4 [0069.239] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.239] lstrlenW (lpString=".rar") returned 4 [0069.239] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.239] lstrlenW (lpString=".bz2") returned 4 [0069.239] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.239] lstrlenW (lpString=".7z") returned 3 [0069.239] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.239] lstrlenW (lpString=".dbf") returned 4 [0069.239] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.239] lstrlenW (lpString=".1cd") returned 4 [0069.239] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0069.239] lstrlenW (lpString=".jpg") returned 4 [0069.239] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.239] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") [0069.240] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=65885) returned 1 [0069.240] CloseHandle (hObject=0x158) returned 1 [0069.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0069.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.240] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.241] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.241] GetLastError () returned 0x0 [0069.241] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1015d, lpOverlapped=0x0) returned 1 [0069.244] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x10160, lpOverlapped=0x0) returned 1 [0069.245] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.246] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.246] SetEndOfFile (hFile=0x1ec) returned 1 [0069.246] CloseHandle (hObject=0x1ec) returned 1 [0069.246] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.246] SetEndOfFile (hFile=0x158) returned 1 [0069.247] CloseHandle (hObject=0x158) returned 1 [0069.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 1 [0069.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.247] lstrlenW (lpString=".doc") returned 4 [0069.247] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.247] lstrlenW (lpString=".docx") returned 5 [0069.247] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0069.247] lstrlenW (lpString=".pdf") returned 4 [0069.247] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.248] lstrlenW (lpString=".xls") returned 4 [0069.248] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.248] lstrlenW (lpString=".xlsx") returned 5 [0069.248] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0069.248] lstrlenW (lpString=".ppt") returned 4 [0069.248] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.248] lstrlenW (lpString=".zip") returned 4 [0069.248] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.248] lstrlenW (lpString=".rar") returned 4 [0069.248] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.248] lstrlenW (lpString=".bz2") returned 4 [0069.248] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.248] lstrlenW (lpString=".7z") returned 3 [0069.248] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.248] lstrlenW (lpString=".dbf") returned 4 [0069.248] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.248] lstrlenW (lpString=".1cd") returned 4 [0069.248] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0069.248] lstrlenW (lpString=".jpg") returned 4 [0069.248] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.248] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") [0069.249] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=462) returned 1 [0069.249] CloseHandle (hObject=0x158) returned 1 [0069.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20 [0069.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.249] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.249] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.250] GetLastError () returned 0x0 [0069.250] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1ce, lpOverlapped=0x0) returned 1 [0069.250] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0069.251] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.251] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.251] SetEndOfFile (hFile=0x1ec) returned 1 [0069.252] CloseHandle (hObject=0x1ec) returned 1 [0069.252] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.252] SetEndOfFile (hFile=0x158) returned 1 [0069.252] CloseHandle (hObject=0x158) returned 1 [0069.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 1 [0069.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.253] lstrlenW (lpString=".doc") returned 4 [0069.253] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.253] lstrlenW (lpString=".docx") returned 5 [0069.253] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0069.253] lstrlenW (lpString=".pdf") returned 4 [0069.253] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.253] lstrlenW (lpString=".xls") returned 4 [0069.253] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.253] lstrlenW (lpString=".xlsx") returned 5 [0069.253] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0069.253] lstrlenW (lpString=".ppt") returned 4 [0069.253] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.253] lstrlenW (lpString=".zip") returned 4 [0069.253] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.253] lstrlenW (lpString=".rar") returned 4 [0069.253] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.253] lstrlenW (lpString=".bz2") returned 4 [0069.253] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.253] lstrlenW (lpString=".7z") returned 3 [0069.253] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.254] lstrlenW (lpString=".dbf") returned 4 [0069.254] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.254] lstrlenW (lpString=".1cd") returned 4 [0069.254] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0069.254] lstrlenW (lpString=".jpg") returned 4 [0069.254] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.254] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") [0069.255] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=47666) returned 1 [0069.255] CloseHandle (hObject=0x158) returned 1 [0069.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0069.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.255] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.255] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.256] GetLastError () returned 0x0 [0069.256] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xba32, lpOverlapped=0x0) returned 1 [0069.258] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xba40, lpOverlapped=0x0) returned 1 [0069.261] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.261] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.261] SetEndOfFile (hFile=0x1ec) returned 1 [0069.262] CloseHandle (hObject=0x1ec) returned 1 [0069.262] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.262] SetEndOfFile (hFile=0x158) returned 1 [0069.263] CloseHandle (hObject=0x158) returned 1 [0069.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.263] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 1 [0069.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.263] lstrlenW (lpString=".doc") returned 4 [0069.263] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.263] lstrlenW (lpString=".docx") returned 5 [0069.263] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0069.263] lstrlenW (lpString=".pdf") returned 4 [0069.263] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.263] lstrlenW (lpString=".xls") returned 4 [0069.263] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.263] lstrlenW (lpString=".xlsx") returned 5 [0069.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0069.263] lstrlenW (lpString=".ppt") returned 4 [0069.263] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.263] lstrlenW (lpString=".zip") returned 4 [0069.263] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.263] lstrlenW (lpString=".rar") returned 4 [0069.264] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.264] lstrlenW (lpString=".bz2") returned 4 [0069.264] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.264] lstrlenW (lpString=".7z") returned 3 [0069.264] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.264] lstrlenW (lpString=".dbf") returned 4 [0069.264] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.264] lstrlenW (lpString=".1cd") returned 4 [0069.264] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0069.264] lstrlenW (lpString=".jpg") returned 4 [0069.264] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.264] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") [0069.264] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=499) returned 1 [0069.264] CloseHandle (hObject=0x158) returned 1 [0069.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0069.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.265] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.265] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.265] GetLastError () returned 0x0 [0069.265] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1f3, lpOverlapped=0x0) returned 1 [0069.266] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x200, lpOverlapped=0x0) returned 1 [0069.267] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.267] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.267] SetEndOfFile (hFile=0x1ec) returned 1 [0069.267] CloseHandle (hObject=0x1ec) returned 1 [0069.267] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.267] SetEndOfFile (hFile=0x158) returned 1 [0069.268] CloseHandle (hObject=0x158) returned 1 [0069.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 1 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString=".doc") returned 4 [0069.269] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.269] lstrlenW (lpString=".docx") returned 5 [0069.269] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0069.269] lstrlenW (lpString=".pdf") returned 4 [0069.269] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.269] lstrlenW (lpString=".xls") returned 4 [0069.269] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.269] lstrlenW (lpString=".xlsx") returned 5 [0069.269] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0069.269] lstrlenW (lpString=".ppt") returned 4 [0069.269] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString=".zip") returned 4 [0069.269] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.269] lstrlenW (lpString=".rar") returned 4 [0069.269] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.269] lstrlenW (lpString=".bz2") returned 4 [0069.269] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.269] lstrlenW (lpString=".7z") returned 3 [0069.269] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString=".dbf") returned 4 [0069.269] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString=".1cd") returned 4 [0069.269] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0069.269] lstrlenW (lpString=".jpg") returned 4 [0069.269] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.270] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") [0069.270] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=59203) returned 1 [0069.270] CloseHandle (hObject=0x158) returned 1 [0069.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0069.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.270] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.270] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.271] GetLastError () returned 0x0 [0069.271] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe743, lpOverlapped=0x0) returned 1 [0069.274] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe750, lpOverlapped=0x0) returned 1 [0069.276] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.276] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.276] SetEndOfFile (hFile=0x1ec) returned 1 [0069.276] CloseHandle (hObject=0x1ec) returned 1 [0069.276] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.276] SetEndOfFile (hFile=0x158) returned 1 [0069.277] CloseHandle (hObject=0x158) returned 1 [0069.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 1 [0069.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.278] lstrlenW (lpString=".doc") returned 4 [0069.278] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.278] lstrlenW (lpString=".docx") returned 5 [0069.278] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0069.278] lstrlenW (lpString=".pdf") returned 4 [0069.278] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.278] lstrlenW (lpString=".xls") returned 4 [0069.278] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.278] lstrlenW (lpString=".xlsx") returned 5 [0069.278] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0069.278] lstrlenW (lpString=".ppt") returned 4 [0069.278] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.278] lstrlenW (lpString=".zip") returned 4 [0069.278] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.278] lstrlenW (lpString=".rar") returned 4 [0069.278] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.278] lstrlenW (lpString=".bz2") returned 4 [0069.278] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.278] lstrlenW (lpString=".7z") returned 3 [0069.278] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.278] lstrlenW (lpString=".dbf") returned 4 [0069.278] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.278] lstrlenW (lpString=".1cd") returned 4 [0069.278] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0069.278] lstrlenW (lpString=".jpg") returned 4 [0069.278] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.278] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") [0069.279] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=533) returned 1 [0069.279] CloseHandle (hObject=0x158) returned 1 [0069.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20 [0069.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.280] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.280] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.280] GetLastError () returned 0x0 [0069.280] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x215, lpOverlapped=0x0) returned 1 [0069.281] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x220, lpOverlapped=0x0) returned 1 [0069.282] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.282] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.282] SetEndOfFile (hFile=0x1ec) returned 1 [0069.282] CloseHandle (hObject=0x1ec) returned 1 [0069.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.282] SetEndOfFile (hFile=0x158) returned 1 [0069.283] CloseHandle (hObject=0x158) returned 1 [0069.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 1 [0069.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.283] lstrlenW (lpString=".doc") returned 4 [0069.283] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.283] lstrlenW (lpString=".docx") returned 5 [0069.283] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0069.284] lstrlenW (lpString=".pdf") returned 4 [0069.284] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.284] lstrlenW (lpString=".xls") returned 4 [0069.284] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.284] lstrlenW (lpString=".xlsx") returned 5 [0069.284] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0069.284] lstrlenW (lpString=".ppt") returned 4 [0069.284] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.284] lstrlenW (lpString=".zip") returned 4 [0069.284] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.284] lstrlenW (lpString=".rar") returned 4 [0069.284] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.284] lstrlenW (lpString=".bz2") returned 4 [0069.284] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.284] lstrlenW (lpString=".7z") returned 3 [0069.284] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.284] lstrlenW (lpString=".dbf") returned 4 [0069.284] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.284] lstrlenW (lpString=".1cd") returned 4 [0069.284] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0069.284] lstrlenW (lpString=".jpg") returned 4 [0069.284] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.284] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") [0069.285] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=58092) returned 1 [0069.285] CloseHandle (hObject=0x158) returned 1 [0069.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20 [0069.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.285] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.285] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.286] GetLastError () returned 0x0 [0069.286] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe2ec, lpOverlapped=0x0) returned 1 [0069.330] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2f0, lpOverlapped=0x0) returned 1 [0069.332] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.332] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.332] SetEndOfFile (hFile=0x1ec) returned 1 [0069.332] CloseHandle (hObject=0x1ec) returned 1 [0069.332] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.332] SetEndOfFile (hFile=0x158) returned 1 [0069.333] CloseHandle (hObject=0x158) returned 1 [0069.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 1 [0069.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.334] lstrlenW (lpString=".doc") returned 4 [0069.334] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.334] lstrlenW (lpString=".docx") returned 5 [0069.334] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0069.334] lstrlenW (lpString=".pdf") returned 4 [0069.334] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.334] lstrlenW (lpString=".xls") returned 4 [0069.334] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.334] lstrlenW (lpString=".xlsx") returned 5 [0069.334] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0069.334] lstrlenW (lpString=".ppt") returned 4 [0069.334] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.334] lstrlenW (lpString=".zip") returned 4 [0069.334] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.334] lstrlenW (lpString=".rar") returned 4 [0069.334] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.334] lstrlenW (lpString=".bz2") returned 4 [0069.334] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.334] lstrlenW (lpString=".7z") returned 3 [0069.334] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.334] lstrlenW (lpString=".dbf") returned 4 [0069.334] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.334] lstrlenW (lpString=".1cd") returned 4 [0069.334] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0069.335] lstrlenW (lpString=".jpg") returned 4 [0069.335] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.335] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") [0069.335] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=53477) returned 1 [0069.335] CloseHandle (hObject=0x158) returned 1 [0069.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20 [0069.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.335] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.335] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.336] GetLastError () returned 0x0 [0069.336] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd0e5, lpOverlapped=0x0) returned 1 [0069.363] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd0f0, lpOverlapped=0x0) returned 1 [0069.364] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.364] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.364] SetEndOfFile (hFile=0x1ec) returned 1 [0069.365] CloseHandle (hObject=0x1ec) returned 1 [0069.365] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.365] SetEndOfFile (hFile=0x158) returned 1 [0069.366] CloseHandle (hObject=0x158) returned 1 [0069.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 1 [0069.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.366] lstrlenW (lpString=".doc") returned 4 [0069.366] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.366] lstrlenW (lpString=".docx") returned 5 [0069.366] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0069.366] lstrlenW (lpString=".pdf") returned 4 [0069.366] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.366] lstrlenW (lpString=".xls") returned 4 [0069.366] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.366] lstrlenW (lpString=".xlsx") returned 5 [0069.366] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0069.367] lstrlenW (lpString=".ppt") returned 4 [0069.367] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.367] lstrlenW (lpString=".zip") returned 4 [0069.367] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.367] lstrlenW (lpString=".rar") returned 4 [0069.367] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.367] lstrlenW (lpString=".bz2") returned 4 [0069.367] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.367] lstrlenW (lpString=".7z") returned 3 [0069.367] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.367] lstrlenW (lpString=".dbf") returned 4 [0069.367] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.367] lstrlenW (lpString=".1cd") returned 4 [0069.367] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0069.367] lstrlenW (lpString=".jpg") returned 4 [0069.367] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.367] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") [0069.368] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=48039) returned 1 [0069.368] CloseHandle (hObject=0x158) returned 1 [0069.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20 [0069.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.369] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.369] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.369] GetLastError () returned 0x0 [0069.369] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbba7, lpOverlapped=0x0) returned 1 [0069.374] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbbb0, lpOverlapped=0x0) returned 1 [0069.375] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.375] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.375] SetEndOfFile (hFile=0x1ec) returned 1 [0069.375] CloseHandle (hObject=0x1ec) returned 1 [0069.375] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.375] SetEndOfFile (hFile=0x158) returned 1 [0069.376] CloseHandle (hObject=0x158) returned 1 [0069.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.377] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 1 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.377] lstrlenW (lpString=".doc") returned 4 [0069.377] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.377] lstrlenW (lpString=".docx") returned 5 [0069.377] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1 [0069.377] lstrlenW (lpString=".pdf") returned 4 [0069.377] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.377] lstrlenW (lpString=".xls") returned 4 [0069.377] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.377] lstrlenW (lpString=".xlsx") returned 5 [0069.377] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1 [0069.377] lstrlenW (lpString=".ppt") returned 4 [0069.377] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.377] lstrlenW (lpString=".zip") returned 4 [0069.377] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.377] lstrlenW (lpString=".rar") returned 4 [0069.377] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.377] lstrlenW (lpString=".bz2") returned 4 [0069.377] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.377] lstrlenW (lpString=".7z") returned 3 [0069.377] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.377] lstrlenW (lpString=".dbf") returned 4 [0069.378] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.378] lstrlenW (lpString=".1cd") returned 4 [0069.378] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0069.378] lstrlenW (lpString=".jpg") returned 4 [0069.378] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.378] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") [0069.386] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=600) returned 1 [0069.386] CloseHandle (hObject=0x158) returned 1 [0069.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20 [0069.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.387] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.387] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.387] GetLastError () returned 0x0 [0069.387] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x258, lpOverlapped=0x0) returned 1 [0069.388] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x260, lpOverlapped=0x0) returned 1 [0069.389] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.389] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.389] SetEndOfFile (hFile=0x1ec) returned 1 [0069.390] CloseHandle (hObject=0x1ec) returned 1 [0069.390] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.390] SetEndOfFile (hFile=0x158) returned 1 [0069.390] CloseHandle (hObject=0x158) returned 1 [0069.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.391] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.391] lstrlenW (lpString=".doc") returned 4 [0069.391] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.391] lstrlenW (lpString=".docx") returned 5 [0069.391] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0069.391] lstrlenW (lpString=".pdf") returned 4 [0069.391] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.391] lstrlenW (lpString=".xls") returned 4 [0069.391] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.391] lstrlenW (lpString=".xlsx") returned 5 [0069.391] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0069.391] lstrlenW (lpString=".ppt") returned 4 [0069.391] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.391] lstrlenW (lpString=".zip") returned 4 [0069.391] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.391] lstrlenW (lpString=".rar") returned 4 [0069.391] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.391] lstrlenW (lpString=".bz2") returned 4 [0069.391] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.391] lstrlenW (lpString=".7z") returned 3 [0069.391] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.392] lstrlenW (lpString=".dbf") returned 4 [0069.392] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.392] lstrlenW (lpString=".1cd") returned 4 [0069.392] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0069.392] lstrlenW (lpString=".jpg") returned 4 [0069.392] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.392] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") [0069.392] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=586) returned 1 [0069.392] CloseHandle (hObject=0x158) returned 1 [0069.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20 [0069.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.392] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.393] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.393] GetLastError () returned 0x0 [0069.393] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x24a, lpOverlapped=0x0) returned 1 [0069.394] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x250, lpOverlapped=0x0) returned 1 [0069.395] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.395] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.395] SetEndOfFile (hFile=0x1ec) returned 1 [0069.396] CloseHandle (hObject=0x1ec) returned 1 [0069.396] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.396] SetEndOfFile (hFile=0x158) returned 1 [0069.396] CloseHandle (hObject=0x158) returned 1 [0069.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 1 [0069.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.397] lstrlenW (lpString=".doc") returned 4 [0069.397] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.397] lstrlenW (lpString=".docx") returned 5 [0069.397] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0069.397] lstrlenW (lpString=".pdf") returned 4 [0069.397] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.397] lstrlenW (lpString=".xls") returned 4 [0069.397] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.397] lstrlenW (lpString=".xlsx") returned 5 [0069.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0069.397] lstrlenW (lpString=".ppt") returned 4 [0069.397] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.397] lstrlenW (lpString=".zip") returned 4 [0069.397] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.397] lstrlenW (lpString=".rar") returned 4 [0069.397] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.397] lstrlenW (lpString=".bz2") returned 4 [0069.397] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.397] lstrlenW (lpString=".7z") returned 3 [0069.397] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.398] lstrlenW (lpString=".dbf") returned 4 [0069.398] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.398] lstrlenW (lpString=".1cd") returned 4 [0069.398] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0069.398] lstrlenW (lpString=".jpg") returned 4 [0069.398] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.398] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") [0069.398] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=45838) returned 1 [0069.398] CloseHandle (hObject=0x158) returned 1 [0069.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20 [0069.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.407] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.407] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.407] GetLastError () returned 0x0 [0069.407] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xb30e, lpOverlapped=0x0) returned 1 [0069.413] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xb310, lpOverlapped=0x0) returned 1 [0069.415] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.415] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.415] SetEndOfFile (hFile=0x1ec) returned 1 [0069.415] CloseHandle (hObject=0x1ec) returned 1 [0069.415] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.415] SetEndOfFile (hFile=0x158) returned 1 [0069.416] CloseHandle (hObject=0x158) returned 1 [0069.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 1 [0069.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.417] lstrlenW (lpString=".doc") returned 4 [0069.417] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.417] lstrlenW (lpString=".docx") returned 5 [0069.417] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1 [0069.417] lstrlenW (lpString=".pdf") returned 4 [0069.417] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.417] lstrlenW (lpString=".xls") returned 4 [0069.417] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.417] lstrlenW (lpString=".xlsx") returned 5 [0069.417] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1 [0069.417] lstrlenW (lpString=".ppt") returned 4 [0069.417] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.417] lstrlenW (lpString=".zip") returned 4 [0069.417] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.417] lstrlenW (lpString=".rar") returned 4 [0069.417] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.417] lstrlenW (lpString=".bz2") returned 4 [0069.417] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.417] lstrlenW (lpString=".7z") returned 3 [0069.417] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.417] lstrlenW (lpString=".dbf") returned 4 [0069.417] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.417] lstrlenW (lpString=".1cd") returned 4 [0069.417] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0069.418] lstrlenW (lpString=".jpg") returned 4 [0069.418] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.418] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") [0069.421] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=569) returned 1 [0069.421] CloseHandle (hObject=0x1c0) returned 1 [0069.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20 [0069.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.421] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.429] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.444] GetLastError () returned 0x0 [0069.444] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x239, lpOverlapped=0x0) returned 1 [0069.451] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x240, lpOverlapped=0x0) returned 1 [0069.452] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.452] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.452] SetEndOfFile (hFile=0x1f0) returned 1 [0069.453] CloseHandle (hObject=0x1f0) returned 1 [0069.453] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.453] SetEndOfFile (hFile=0x1c0) returned 1 [0069.453] CloseHandle (hObject=0x1c0) returned 1 [0069.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 1 [0069.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.454] lstrlenW (lpString=".doc") returned 4 [0069.454] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.454] lstrlenW (lpString=".docx") returned 5 [0069.454] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0069.454] lstrlenW (lpString=".pdf") returned 4 [0069.454] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.454] lstrlenW (lpString=".xls") returned 4 [0069.454] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.454] lstrlenW (lpString=".xlsx") returned 5 [0069.454] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0069.454] lstrlenW (lpString=".ppt") returned 4 [0069.454] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.454] lstrlenW (lpString=".zip") returned 4 [0069.454] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.454] lstrlenW (lpString=".rar") returned 4 [0069.454] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.454] lstrlenW (lpString=".bz2") returned 4 [0069.454] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.454] lstrlenW (lpString=".7z") returned 3 [0069.455] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.455] lstrlenW (lpString=".dbf") returned 4 [0069.455] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.455] lstrlenW (lpString=".1cd") returned 4 [0069.455] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0069.455] lstrlenW (lpString=".jpg") returned 4 [0069.455] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.455] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") [0069.456] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=103279) returned 1 [0069.456] CloseHandle (hObject=0x1c0) returned 1 [0069.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20 [0069.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.456] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.456] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.457] GetLastError () returned 0x0 [0069.457] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1936f, lpOverlapped=0x0) returned 1 [0069.460] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x19370, lpOverlapped=0x0) returned 1 [0069.462] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.462] SetEndOfFile (hFile=0x1f0) returned 1 [0069.462] CloseHandle (hObject=0x1f0) returned 1 [0069.462] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.462] SetEndOfFile (hFile=0x1c0) returned 1 [0069.464] CloseHandle (hObject=0x1c0) returned 1 [0069.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 1 [0069.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.464] lstrlenW (lpString=".doc") returned 4 [0069.464] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.464] lstrlenW (lpString=".docx") returned 5 [0069.464] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0069.464] lstrlenW (lpString=".pdf") returned 4 [0069.464] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.464] lstrlenW (lpString=".xls") returned 4 [0069.464] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.464] lstrlenW (lpString=".xlsx") returned 5 [0069.464] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0069.464] lstrlenW (lpString=".ppt") returned 4 [0069.464] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.464] lstrlenW (lpString=".zip") returned 4 [0069.464] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.464] lstrlenW (lpString=".rar") returned 4 [0069.464] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.465] lstrlenW (lpString=".bz2") returned 4 [0069.465] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.465] lstrlenW (lpString=".7z") returned 3 [0069.465] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.465] lstrlenW (lpString=".dbf") returned 4 [0069.465] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.465] lstrlenW (lpString=".1cd") returned 4 [0069.465] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0069.465] lstrlenW (lpString=".jpg") returned 4 [0069.465] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.465] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") [0069.465] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=456) returned 1 [0069.465] CloseHandle (hObject=0x1c0) returned 1 [0069.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20 [0069.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.466] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.466] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.466] GetLastError () returned 0x0 [0069.466] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1c8, lpOverlapped=0x0) returned 1 [0069.468] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0069.468] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.469] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.469] SetEndOfFile (hFile=0x1f0) returned 1 [0069.469] CloseHandle (hObject=0x1f0) returned 1 [0069.469] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.469] SetEndOfFile (hFile=0x1c0) returned 1 [0069.470] CloseHandle (hObject=0x1c0) returned 1 [0069.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 1 [0069.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.470] lstrlenW (lpString=".doc") returned 4 [0069.470] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.470] lstrlenW (lpString=".docx") returned 5 [0069.470] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0069.470] lstrlenW (lpString=".pdf") returned 4 [0069.470] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.470] lstrlenW (lpString=".xls") returned 4 [0069.470] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.470] lstrlenW (lpString=".xlsx") returned 5 [0069.470] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0069.470] lstrlenW (lpString=".ppt") returned 4 [0069.470] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.471] lstrlenW (lpString=".zip") returned 4 [0069.471] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.471] lstrlenW (lpString=".rar") returned 4 [0069.471] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.471] lstrlenW (lpString=".bz2") returned 4 [0069.471] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.471] lstrlenW (lpString=".7z") returned 3 [0069.471] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.471] lstrlenW (lpString=".dbf") returned 4 [0069.471] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.471] lstrlenW (lpString=".1cd") returned 4 [0069.471] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0069.471] lstrlenW (lpString=".jpg") returned 4 [0069.471] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.471] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") [0069.472] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=82237) returned 1 [0069.472] CloseHandle (hObject=0x1c0) returned 1 [0069.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20 [0069.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.472] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.472] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.473] GetLastError () returned 0x0 [0069.473] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1413d, lpOverlapped=0x0) returned 1 [0069.476] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x14140, lpOverlapped=0x0) returned 1 [0069.536] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.537] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0069.537] SetEndOfFile (hFile=0x1f0) returned 1 [0069.537] CloseHandle (hObject=0x1f0) returned 1 [0069.537] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.537] SetEndOfFile (hFile=0x1c0) returned 1 [0069.538] CloseHandle (hObject=0x1c0) returned 1 [0069.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.538] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 1 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString=".doc") returned 4 [0069.539] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.539] lstrlenW (lpString=".docx") returned 5 [0069.539] lstrcmpiW (lpString1=".docx", lpString2="Y.ELM") returned -1 [0069.539] lstrlenW (lpString=".pdf") returned 4 [0069.539] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.539] lstrlenW (lpString=".xls") returned 4 [0069.539] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.539] lstrlenW (lpString=".xlsx") returned 5 [0069.539] lstrcmpiW (lpString1=".xlsx", lpString2="Y.ELM") returned -1 [0069.539] lstrlenW (lpString=".ppt") returned 4 [0069.539] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString=".zip") returned 4 [0069.539] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.539] lstrlenW (lpString=".rar") returned 4 [0069.539] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.539] lstrlenW (lpString=".bz2") returned 4 [0069.539] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.539] lstrlenW (lpString=".7z") returned 3 [0069.539] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString=".dbf") returned 4 [0069.539] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString=".1cd") returned 4 [0069.539] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0069.539] lstrlenW (lpString=".jpg") returned 4 [0069.539] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.540] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") [0069.998] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=466) returned 1 [0069.998] CloseHandle (hObject=0x158) returned 1 [0069.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0069.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.005] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.005] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.005] GetLastError () returned 0x0 [0070.005] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1d2, lpOverlapped=0x0) returned 1 [0070.024] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0070.024] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.025] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0070.577] SetEndOfFile (hFile=0x1ec) returned 1 [0070.577] CloseHandle (hObject=0x1ec) returned 1 [0070.577] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.577] SetEndOfFile (hFile=0x1c0) returned 1 [0070.578] CloseHandle (hObject=0x1c0) returned 1 [0070.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 1 [0070.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString=".doc") returned 4 [0070.579] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0070.579] lstrlenW (lpString=".docx") returned 5 [0070.579] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0070.579] lstrlenW (lpString=".pdf") returned 4 [0070.579] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0070.579] lstrlenW (lpString=".xls") returned 4 [0070.579] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0070.579] lstrlenW (lpString=".xlsx") returned 5 [0070.579] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0070.579] lstrlenW (lpString=".ppt") returned 4 [0070.579] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0070.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString=".zip") returned 4 [0070.579] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0070.579] lstrlenW (lpString=".rar") returned 4 [0070.579] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0070.579] lstrlenW (lpString=".bz2") returned 4 [0070.579] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0070.579] lstrlenW (lpString=".7z") returned 3 [0070.579] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0070.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString=".dbf") returned 4 [0070.579] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0070.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString=".1cd") returned 4 [0070.579] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0070.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0070.579] lstrlenW (lpString=".jpg") returned 4 [0070.579] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0070.580] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") [0070.580] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=978206) returned 1 [0070.580] CloseHandle (hObject=0x1c0) returned 1 [0070.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0070.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.580] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.581] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.581] GetLastError () returned 0x0 [0070.581] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xeed1e, lpOverlapped=0x0) returned 1 [0070.601] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xeed20, lpOverlapped=0x0) returned 1 [0070.983] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.985] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.985] SetEndOfFile (hFile=0x1ec) returned 1 [0070.985] CloseHandle (hObject=0x1ec) returned 1 [0070.985] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.985] SetEndOfFile (hFile=0x1c0) returned 1 [0070.995] CloseHandle (hObject=0x1c0) returned 1 [0070.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.995] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 1 [0070.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.995] lstrlenW (lpString=".doc") returned 4 [0070.995] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0070.995] lstrlenW (lpString=".docx") returned 5 [0070.995] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0070.995] lstrlenW (lpString=".pdf") returned 4 [0070.996] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0070.996] lstrlenW (lpString=".xls") returned 4 [0070.996] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0070.996] lstrlenW (lpString=".xlsx") returned 5 [0070.996] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0070.996] lstrlenW (lpString=".ppt") returned 4 [0070.996] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.996] lstrlenW (lpString=".zip") returned 4 [0070.996] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0070.996] lstrlenW (lpString=".rar") returned 4 [0070.996] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0070.996] lstrlenW (lpString=".bz2") returned 4 [0070.996] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0070.996] lstrlenW (lpString=".7z") returned 3 [0070.996] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.996] lstrlenW (lpString=".dbf") returned 4 [0070.996] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.996] lstrlenW (lpString=".1cd") returned 4 [0070.996] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0070.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0070.996] lstrlenW (lpString=".jpg") returned 4 [0070.996] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0070.996] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") [0070.997] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1469358) returned 1 [0070.997] CloseHandle (hObject=0x1c0) returned 1 [0070.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20 [0070.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.997] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.997] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.998] GetLastError () returned 0x0 [0070.998] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0071.154] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0071.170] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x66bbe, lpOverlapped=0x0) returned 1 [0071.184] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x66bc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x66bc0, lpOverlapped=0x0) returned 1 [0071.397] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.398] SetEndOfFile (hFile=0x1ec) returned 1 [0071.400] CloseHandle (hObject=0x1ec) returned 1 [0071.400] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.400] SetEndOfFile (hFile=0x1c0) returned 1 [0071.404] CloseHandle (hObject=0x1c0) returned 1 [0071.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 1 [0071.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.404] lstrlenW (lpString=".doc") returned 4 [0071.404] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0071.404] lstrlenW (lpString=".docx") returned 5 [0071.404] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0071.404] lstrlenW (lpString=".pdf") returned 4 [0071.404] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0071.405] lstrlenW (lpString=".xls") returned 4 [0071.405] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0071.405] lstrlenW (lpString=".xlsx") returned 5 [0071.405] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0071.405] lstrlenW (lpString=".ppt") returned 4 [0071.405] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0071.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.405] lstrlenW (lpString=".zip") returned 4 [0071.405] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0071.405] lstrlenW (lpString=".rar") returned 4 [0071.405] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0071.405] lstrlenW (lpString=".bz2") returned 4 [0071.405] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0071.405] lstrlenW (lpString=".7z") returned 3 [0071.405] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0071.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.405] lstrlenW (lpString=".dbf") returned 4 [0071.405] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0071.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.405] lstrlenW (lpString=".1cd") returned 4 [0071.405] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0071.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0071.405] lstrlenW (lpString=".jpg") returned 4 [0071.405] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0071.405] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") [0071.406] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2120459) returned 1 [0071.406] CloseHandle (hObject=0x1c0) returned 1 [0071.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20 [0071.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0071.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.407] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.410] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.410] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.415] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.415] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.415] ReadFile (in: hFile=0x1c0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.439] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.439] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0071.458] SetEndOfFile (hFile=0x1c0) returned 1 [0071.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0071.459] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.459] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.460] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.460] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.462] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.462] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.463] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0071.463] CloseHandle (hObject=0x1c0) returned 1 [0071.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString=".doc") returned 4 [0071.464] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0071.464] lstrlenW (lpString=".docx") returned 5 [0071.464] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0071.464] lstrlenW (lpString=".pdf") returned 4 [0071.464] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0071.464] lstrlenW (lpString=".xls") returned 4 [0071.464] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0071.464] lstrlenW (lpString=".xlsx") returned 5 [0071.464] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0071.464] lstrlenW (lpString=".ppt") returned 4 [0071.464] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString=".zip") returned 4 [0071.464] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0071.464] lstrlenW (lpString=".rar") returned 4 [0071.464] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0071.464] lstrlenW (lpString=".bz2") returned 4 [0071.464] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0071.464] lstrlenW (lpString=".7z") returned 3 [0071.464] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString=".dbf") returned 4 [0071.464] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString=".1cd") returned 4 [0071.464] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0071.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0071.464] lstrlenW (lpString=".jpg") returned 4 [0071.464] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0071.465] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") [0071.465] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1536) returned 1 [0071.465] CloseHandle (hObject=0x1c0) returned 1 [0071.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20 [0071.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.465] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.465] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.466] GetLastError () returned 0x0 [0071.466] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x600, lpOverlapped=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x610, lpOverlapped=0x0) returned 1 [0071.473] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.473] SetEndOfFile (hFile=0x160) returned 1 [0071.473] CloseHandle (hObject=0x160) returned 1 [0071.473] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.473] SetEndOfFile (hFile=0x1c0) returned 1 [0071.474] CloseHandle (hObject=0x1c0) returned 1 [0071.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.475] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 1 [0071.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.475] lstrlenW (lpString=".doc") returned 4 [0071.475] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0071.475] lstrlenW (lpString=".docx") returned 5 [0071.475] lstrcmpiW (lpString1=".docx", lpString2="H.LEX") returned -1 [0071.475] lstrlenW (lpString=".pdf") returned 4 [0071.475] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0071.475] lstrlenW (lpString=".xls") returned 4 [0071.475] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0071.475] lstrlenW (lpString=".xlsx") returned 5 [0071.475] lstrcmpiW (lpString1=".xlsx", lpString2="H.LEX") returned -1 [0071.475] lstrlenW (lpString=".ppt") returned 4 [0071.475] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0071.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.475] lstrlenW (lpString=".zip") returned 4 [0071.475] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0071.475] lstrlenW (lpString=".rar") returned 4 [0071.475] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0071.475] lstrlenW (lpString=".bz2") returned 4 [0071.475] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0071.475] lstrlenW (lpString=".7z") returned 3 [0071.475] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0071.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.475] lstrlenW (lpString=".dbf") returned 4 [0071.475] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0071.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.476] lstrlenW (lpString=".1cd") returned 4 [0071.476] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0071.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0071.476] lstrlenW (lpString=".jpg") returned 4 [0071.476] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0071.476] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") [0071.477] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=178576) returned 1 [0071.477] CloseHandle (hObject=0x1c0) returned 1 [0071.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 0x20 [0071.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.477] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.477] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.477] GetLastError () returned 0x0 [0071.477] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2b990, lpOverlapped=0x0) returned 1 [0071.483] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2b9a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2b9a0, lpOverlapped=0x0) returned 1 [0071.486] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.486] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.486] SetEndOfFile (hFile=0x160) returned 1 [0071.486] CloseHandle (hObject=0x160) returned 1 [0071.487] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.487] SetEndOfFile (hFile=0x1c0) returned 1 [0071.488] CloseHandle (hObject=0x1c0) returned 1 [0071.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.489] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 1 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.489] lstrlenW (lpString=".doc") returned 4 [0071.489] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString=".docx") returned 5 [0071.489] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0071.489] lstrlenW (lpString=".pdf") returned 4 [0071.489] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString=".xls") returned 4 [0071.489] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString=".xlsx") returned 5 [0071.489] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0071.489] lstrlenW (lpString=".ppt") returned 4 [0071.489] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.489] lstrlenW (lpString=".zip") returned 4 [0071.489] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString=".rar") returned 4 [0071.489] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.489] lstrlenW (lpString=".bz2") returned 4 [0071.489] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.489] lstrlenW (lpString=".7z") returned 3 [0071.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.490] lstrlenW (lpString=".dbf") returned 4 [0071.490] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.490] lstrlenW (lpString=".1cd") returned 4 [0071.490] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 68 [0071.490] lstrlenW (lpString=".jpg") returned 4 [0071.490] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.490] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") [0071.516] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=266096) returned 1 [0071.516] CloseHandle (hObject=0x1c0) returned 1 [0071.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 0x20 [0071.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.516] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.516] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.517] GetLastError () returned 0x0 [0071.517] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x40f70, lpOverlapped=0x0) returned 1 [0071.527] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x40f80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x40f80, lpOverlapped=0x0) returned 1 [0071.532] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.532] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.532] SetEndOfFile (hFile=0x160) returned 1 [0071.533] CloseHandle (hObject=0x160) returned 1 [0071.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.533] SetEndOfFile (hFile=0x1c0) returned 1 [0071.535] CloseHandle (hObject=0x1c0) returned 1 [0071.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 1 [0071.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.536] lstrlenW (lpString=".doc") returned 4 [0071.536] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString=".docx") returned 5 [0071.536] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0071.536] lstrlenW (lpString=".pdf") returned 4 [0071.536] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString=".xls") returned 4 [0071.536] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString=".xlsx") returned 5 [0071.536] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0071.536] lstrlenW (lpString=".ppt") returned 4 [0071.536] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.536] lstrlenW (lpString=".zip") returned 4 [0071.536] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString=".rar") returned 4 [0071.536] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.536] lstrlenW (lpString=".bz2") returned 4 [0071.536] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.536] lstrlenW (lpString=".7z") returned 3 [0071.536] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.536] lstrlenW (lpString=".dbf") returned 4 [0071.536] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.536] lstrlenW (lpString=".1cd") returned 4 [0071.536] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 68 [0071.537] lstrlenW (lpString=".jpg") returned 4 [0071.537] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.538] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") [0071.569] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=70544) returned 1 [0071.569] CloseHandle (hObject=0x150) returned 1 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.569] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.569] GetLastError () returned 0x0 [0071.569] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x11390, lpOverlapped=0x0) returned 1 [0071.573] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x113a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x113a0, lpOverlapped=0x0) returned 1 [0071.575] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.575] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.575] SetEndOfFile (hFile=0x1ec) returned 1 [0071.575] CloseHandle (hObject=0x1ec) returned 1 [0071.575] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.575] SetEndOfFile (hFile=0x150) returned 1 [0071.576] CloseHandle (hObject=0x150) returned 1 [0071.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.576] lstrlenW (lpString=".doc") returned 4 [0071.576] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString=".docx") returned 5 [0071.577] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0071.577] lstrlenW (lpString=".pdf") returned 4 [0071.577] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString=".xls") returned 4 [0071.577] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString=".xlsx") returned 5 [0071.577] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0071.577] lstrlenW (lpString=".ppt") returned 4 [0071.577] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.577] lstrlenW (lpString=".zip") returned 4 [0071.577] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString=".rar") returned 4 [0071.577] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.577] lstrlenW (lpString=".bz2") returned 4 [0071.577] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.577] lstrlenW (lpString=".7z") returned 3 [0071.577] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.577] lstrlenW (lpString=".dbf") returned 4 [0071.577] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.577] lstrlenW (lpString=".1cd") returned 4 [0071.577] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0071.577] lstrlenW (lpString=".jpg") returned 4 [0071.577] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.577] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") [0071.578] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=221184) returned 1 [0071.578] CloseHandle (hObject=0x150) returned 1 [0071.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20 [0071.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.578] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.578] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.578] GetLastError () returned 0x0 [0071.578] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x36000, lpOverlapped=0x0) returned 1 [0071.583] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x36010, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x36010, lpOverlapped=0x0) returned 1 [0071.587] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.587] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.587] SetEndOfFile (hFile=0x1ec) returned 1 [0071.587] CloseHandle (hObject=0x1ec) returned 1 [0071.587] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.587] SetEndOfFile (hFile=0x150) returned 1 [0071.589] CloseHandle (hObject=0x150) returned 1 [0071.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 1 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.590] lstrlenW (lpString=".doc") returned 4 [0071.590] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString=".docx") returned 5 [0071.590] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0071.590] lstrlenW (lpString=".pdf") returned 4 [0071.590] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString=".xls") returned 4 [0071.590] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString=".xlsx") returned 5 [0071.590] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0071.590] lstrlenW (lpString=".ppt") returned 4 [0071.590] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.590] lstrlenW (lpString=".zip") returned 4 [0071.590] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString=".rar") returned 4 [0071.590] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.590] lstrlenW (lpString=".bz2") returned 4 [0071.590] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.590] lstrlenW (lpString=".7z") returned 3 [0071.590] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.590] lstrlenW (lpString=".dbf") returned 4 [0071.590] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.590] lstrlenW (lpString=".1cd") returned 4 [0071.590] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0071.591] lstrlenW (lpString=".jpg") returned 4 [0071.591] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.591] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") [0071.678] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=154960) returned 1 [0071.678] CloseHandle (hObject=0x180) returned 1 [0071.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20 [0071.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.679] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.679] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.679] GetLastError () returned 0x0 [0071.679] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x25d50, lpOverlapped=0x0) returned 1 [0071.683] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x25d60, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x25d60, lpOverlapped=0x0) returned 1 [0071.688] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.688] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.688] SetEndOfFile (hFile=0x150) returned 1 [0071.688] CloseHandle (hObject=0x150) returned 1 [0071.688] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.688] SetEndOfFile (hFile=0x180) returned 1 [0071.690] CloseHandle (hObject=0x180) returned 1 [0071.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 1 [0071.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.690] lstrlenW (lpString=".doc") returned 4 [0071.690] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.690] lstrlenW (lpString=".docx") returned 5 [0071.690] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0071.690] lstrlenW (lpString=".pdf") returned 4 [0071.690] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.690] lstrlenW (lpString=".xls") returned 4 [0071.690] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.691] lstrlenW (lpString=".xlsx") returned 5 [0071.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0071.691] lstrlenW (lpString=".ppt") returned 4 [0071.691] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.691] lstrlenW (lpString=".zip") returned 4 [0071.691] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.691] lstrlenW (lpString=".rar") returned 4 [0071.691] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.691] lstrlenW (lpString=".bz2") returned 4 [0071.691] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.691] lstrlenW (lpString=".7z") returned 3 [0071.691] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.691] lstrlenW (lpString=".dbf") returned 4 [0071.691] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.691] lstrlenW (lpString=".1cd") returned 4 [0071.691] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0071.691] lstrlenW (lpString=".jpg") returned 4 [0071.691] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.691] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") [0071.695] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=855376) returned 1 [0071.695] CloseHandle (hObject=0x150) returned 1 [0071.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0071.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.695] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.695] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.696] GetLastError () returned 0x0 [0071.696] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd0d50, lpOverlapped=0x0) returned 1 [0071.714] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd0d60, lpOverlapped=0x0) returned 1 [0071.846] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.846] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.847] SetEndOfFile (hFile=0x1ec) returned 1 [0071.847] CloseHandle (hObject=0x1ec) returned 1 [0071.847] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.847] SetEndOfFile (hFile=0x150) returned 1 [0071.854] CloseHandle (hObject=0x150) returned 1 [0071.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString=".doc") returned 4 [0071.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".docx") returned 5 [0071.855] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.855] lstrlenW (lpString=".pdf") returned 4 [0071.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".xls") returned 4 [0071.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".xlsx") returned 5 [0071.855] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.855] lstrlenW (lpString=".ppt") returned 4 [0071.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString=".zip") returned 4 [0071.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".rar") returned 4 [0071.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.855] lstrlenW (lpString=".bz2") returned 4 [0071.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString=".7z") returned 3 [0071.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString=".dbf") returned 4 [0071.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString=".1cd") returned 4 [0071.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 61 [0071.855] lstrlenW (lpString=".jpg") returned 4 [0071.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.856] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") [0071.856] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=665117) returned 1 [0071.856] CloseHandle (hObject=0x150) returned 1 [0071.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20 [0071.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.856] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.856] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.857] GetLastError () returned 0x0 [0071.857] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa261d, lpOverlapped=0x0) returned 1 [0071.888] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa2620, lpOverlapped=0x0) returned 1 [0071.963] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.963] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.963] SetEndOfFile (hFile=0x1ec) returned 1 [0071.963] CloseHandle (hObject=0x1ec) returned 1 [0071.963] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.963] SetEndOfFile (hFile=0x150) returned 1 [0071.969] CloseHandle (hObject=0x150) returned 1 [0071.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 1 [0071.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.969] lstrlenW (lpString=".doc") returned 4 [0071.969] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0071.969] lstrlenW (lpString=".docx") returned 5 [0071.969] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0071.969] lstrlenW (lpString=".pdf") returned 4 [0071.969] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0071.969] lstrlenW (lpString=".xls") returned 4 [0071.969] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0071.969] lstrlenW (lpString=".xlsx") returned 5 [0071.969] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0071.969] lstrlenW (lpString=".ppt") returned 4 [0071.969] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0071.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.969] lstrlenW (lpString=".zip") returned 4 [0071.969] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0071.970] lstrlenW (lpString=".rar") returned 4 [0071.970] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0071.970] lstrlenW (lpString=".bz2") returned 4 [0071.970] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0071.970] lstrlenW (lpString=".7z") returned 3 [0071.970] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0071.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.970] lstrlenW (lpString=".dbf") returned 4 [0071.970] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0071.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.970] lstrlenW (lpString=".1cd") returned 4 [0071.970] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0071.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 78 [0071.970] lstrlenW (lpString=".jpg") returned 4 [0071.970] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0071.970] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") [0071.970] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=326) returned 1 [0071.970] CloseHandle (hObject=0x150) returned 1 [0071.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20 [0071.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.971] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.971] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.971] GetLastError () returned 0x0 [0071.971] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x146, lpOverlapped=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x150, lpOverlapped=0x0) returned 1 [0071.973] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.973] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0071.973] SetEndOfFile (hFile=0x1ec) returned 1 [0071.973] CloseHandle (hObject=0x1ec) returned 1 [0071.973] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.973] SetEndOfFile (hFile=0x150) returned 1 [0071.974] CloseHandle (hObject=0x150) returned 1 [0071.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.974] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 1 [0071.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString=".doc") returned 4 [0071.975] lstrcmpiW (lpString1=".doc", lpString2=".FMP") returned -1 [0071.975] lstrlenW (lpString=".docx") returned 5 [0071.975] lstrcmpiW (lpString1=".docx", lpString2="D.FMP") returned -1 [0071.975] lstrlenW (lpString=".pdf") returned 4 [0071.975] lstrcmpiW (lpString1=".pdf", lpString2=".FMP") returned 1 [0071.975] lstrlenW (lpString=".xls") returned 4 [0071.975] lstrcmpiW (lpString1=".xls", lpString2=".FMP") returned 1 [0071.975] lstrlenW (lpString=".xlsx") returned 5 [0071.975] lstrcmpiW (lpString1=".xlsx", lpString2="D.FMP") returned -1 [0071.975] lstrlenW (lpString=".ppt") returned 4 [0071.975] lstrcmpiW (lpString1=".ppt", lpString2=".FMP") returned 1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString=".zip") returned 4 [0071.975] lstrcmpiW (lpString1=".zip", lpString2=".FMP") returned 1 [0071.975] lstrlenW (lpString=".rar") returned 4 [0071.975] lstrcmpiW (lpString1=".rar", lpString2=".FMP") returned 1 [0071.975] lstrlenW (lpString=".bz2") returned 4 [0071.975] lstrcmpiW (lpString1=".bz2", lpString2=".FMP") returned -1 [0071.975] lstrlenW (lpString=".7z") returned 3 [0071.975] lstrcmpiW (lpString1=".7z", lpString2="FMP") returned -1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString=".dbf") returned 4 [0071.975] lstrcmpiW (lpString1=".dbf", lpString2=".FMP") returned -1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString=".1cd") returned 4 [0071.975] lstrcmpiW (lpString1=".1cd", lpString2=".FMP") returned -1 [0071.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 74 [0071.975] lstrlenW (lpString=".jpg") returned 4 [0071.975] lstrcmpiW (lpString1=".jpg", lpString2=".FMP") returned 1 [0071.975] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") [0071.976] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=223699) returned 1 [0071.976] CloseHandle (hObject=0x150) returned 1 [0071.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20 [0071.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.976] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.976] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.977] GetLastError () returned 0x0 [0071.977] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x369d3, lpOverlapped=0x0) returned 1 [0072.012] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x369e0, lpOverlapped=0x0) returned 1 [0072.016] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.016] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.016] SetEndOfFile (hFile=0x1ec) returned 1 [0072.017] CloseHandle (hObject=0x1ec) returned 1 [0072.017] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.017] SetEndOfFile (hFile=0x150) returned 1 [0072.019] CloseHandle (hObject=0x150) returned 1 [0072.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.019] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 1 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.019] lstrlenW (lpString=".doc") returned 4 [0072.019] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.019] lstrlenW (lpString=".docx") returned 5 [0072.019] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.019] lstrlenW (lpString=".pdf") returned 4 [0072.019] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString=".xls") returned 4 [0072.020] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.020] lstrlenW (lpString=".xlsx") returned 5 [0072.020] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.020] lstrlenW (lpString=".ppt") returned 4 [0072.020] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.020] lstrlenW (lpString=".zip") returned 4 [0072.020] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.020] lstrlenW (lpString=".rar") returned 4 [0072.020] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString=".bz2") returned 4 [0072.020] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString=".7z") returned 3 [0072.020] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.020] lstrlenW (lpString=".dbf") returned 4 [0072.020] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.020] lstrlenW (lpString=".1cd") returned 4 [0072.020] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 77 [0072.020] lstrlenW (lpString=".jpg") returned 4 [0072.020] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.020] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") [0072.021] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=648211) returned 1 [0072.021] CloseHandle (hObject=0x150) returned 1 [0072.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20 [0072.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.021] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.021] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.022] GetLastError () returned 0x0 [0072.022] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9e413, lpOverlapped=0x0) returned 1 [0072.048] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9e420, lpOverlapped=0x0) returned 1 [0072.219] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.219] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.219] SetEndOfFile (hFile=0x1ec) returned 1 [0072.220] CloseHandle (hObject=0x1ec) returned 1 [0072.220] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.220] SetEndOfFile (hFile=0x150) returned 1 [0072.225] CloseHandle (hObject=0x150) returned 1 [0072.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 1 [0072.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.226] lstrlenW (lpString=".doc") returned 4 [0072.226] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.226] lstrlenW (lpString=".docx") returned 5 [0072.226] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.226] lstrlenW (lpString=".pdf") returned 4 [0072.226] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.226] lstrlenW (lpString=".xls") returned 4 [0072.226] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.226] lstrlenW (lpString=".xlsx") returned 5 [0072.226] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.226] lstrlenW (lpString=".ppt") returned 4 [0072.226] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.226] lstrlenW (lpString=".zip") returned 4 [0072.226] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.226] lstrlenW (lpString=".rar") returned 4 [0072.226] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.226] lstrlenW (lpString=".bz2") returned 4 [0072.227] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.227] lstrlenW (lpString=".7z") returned 3 [0072.227] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.227] lstrlenW (lpString=".dbf") returned 4 [0072.227] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.227] lstrlenW (lpString=".1cd") returned 4 [0072.227] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 77 [0072.227] lstrlenW (lpString=".jpg") returned 4 [0072.227] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.227] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") [0072.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=99672) returned 1 [0072.335] CloseHandle (hObject=0x180) returned 1 [0072.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0072.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.336] GetLastError () returned 0x0 [0072.336] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x18558, lpOverlapped=0x0) returned 1 [0072.339] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x18560, lpOverlapped=0x0) returned 1 [0072.342] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.342] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0072.342] SetEndOfFile (hFile=0x1fc) returned 1 [0072.342] CloseHandle (hObject=0x1fc) returned 1 [0072.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.342] SetEndOfFile (hFile=0x180) returned 1 [0072.343] CloseHandle (hObject=0x180) returned 1 [0072.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.343] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0072.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.344] lstrlenW (lpString=".doc") returned 4 [0072.344] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.344] lstrlenW (lpString=".docx") returned 5 [0072.344] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0072.344] lstrlenW (lpString=".pdf") returned 4 [0072.344] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.344] lstrlenW (lpString=".xls") returned 4 [0072.344] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.344] lstrlenW (lpString=".xlsx") returned 5 [0072.344] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0072.344] lstrlenW (lpString=".ppt") returned 4 [0072.344] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.344] lstrlenW (lpString=".zip") returned 4 [0072.344] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.344] lstrlenW (lpString=".rar") returned 4 [0072.344] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.344] lstrlenW (lpString=".bz2") returned 4 [0072.344] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.344] lstrlenW (lpString=".7z") returned 3 [0072.344] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.344] lstrlenW (lpString=".dbf") returned 4 [0072.344] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.344] lstrlenW (lpString=".1cd") returned 4 [0072.344] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0072.345] lstrlenW (lpString=".jpg") returned 4 [0072.345] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.345] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") [0072.345] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=47976) returned 1 [0072.346] CloseHandle (hObject=0x180) returned 1 [0072.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0072.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.346] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.346] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.346] GetLastError () returned 0x0 [0072.346] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb68, lpOverlapped=0x0) returned 1 [0072.349] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbb70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbb70, lpOverlapped=0x0) returned 1 [0072.350] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.350] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x102, lpOverlapped=0x0) returned 1 [0072.351] SetEndOfFile (hFile=0x1fc) returned 1 [0072.351] CloseHandle (hObject=0x1fc) returned 1 [0072.351] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.351] SetEndOfFile (hFile=0x180) returned 1 [0072.352] CloseHandle (hObject=0x180) returned 1 [0072.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.352] lstrlenW (lpString=".doc") returned 4 [0072.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".docx") returned 5 [0072.352] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0072.352] lstrlenW (lpString=".pdf") returned 4 [0072.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".xls") returned 4 [0072.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".xlsx") returned 5 [0072.352] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0072.352] lstrlenW (lpString=".ppt") returned 4 [0072.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.353] lstrlenW (lpString=".zip") returned 4 [0072.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".rar") returned 4 [0072.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".bz2") returned 4 [0072.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString=".7z") returned 3 [0072.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.353] lstrlenW (lpString=".dbf") returned 4 [0072.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.353] lstrlenW (lpString=".1cd") returned 4 [0072.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0072.353] lstrlenW (lpString=".jpg") returned 4 [0072.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.353] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") [0072.459] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=184648) returned 1 [0072.459] CloseHandle (hObject=0x180) returned 1 [0072.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0072.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.460] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.460] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.460] GetLastError () returned 0x0 [0072.460] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2d148, lpOverlapped=0x0) returned 1 [0072.466] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2d150, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2d150, lpOverlapped=0x0) returned 1 [0072.469] ReadFile (in: hFile=0x180, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.469] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.470] SetEndOfFile (hFile=0x1fc) returned 1 [0072.470] CloseHandle (hObject=0x1fc) returned 1 [0072.470] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.470] SetEndOfFile (hFile=0x180) returned 1 [0072.472] CloseHandle (hObject=0x180) returned 1 [0072.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0072.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.472] lstrlenW (lpString=".doc") returned 4 [0072.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString=".docx") returned 5 [0072.472] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0072.472] lstrlenW (lpString=".pdf") returned 4 [0072.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString=".xls") returned 4 [0072.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString=".xlsx") returned 5 [0072.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0072.472] lstrlenW (lpString=".ppt") returned 4 [0072.472] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.472] lstrlenW (lpString=".zip") returned 4 [0072.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString=".rar") returned 4 [0072.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.472] lstrlenW (lpString=".bz2") returned 4 [0072.473] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.473] lstrlenW (lpString=".7z") returned 3 [0072.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.473] lstrlenW (lpString=".dbf") returned 4 [0072.473] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.473] lstrlenW (lpString=".1cd") returned 4 [0072.473] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 62 [0072.473] lstrlenW (lpString=".jpg") returned 4 [0072.473] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.473] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") [0072.478] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=21840) returned 1 [0072.478] CloseHandle (hObject=0x154) returned 1 [0072.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0072.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0072.479] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.479] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0072.479] GetLastError () returned 0x0 [0072.479] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5550, lpOverlapped=0x0) returned 1 [0072.486] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5560, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5560, lpOverlapped=0x0) returned 1 [0072.487] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.487] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.487] SetEndOfFile (hFile=0x1c0) returned 1 [0072.488] CloseHandle (hObject=0x1c0) returned 1 [0072.490] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.490] SetEndOfFile (hFile=0x154) returned 1 [0072.491] CloseHandle (hObject=0x154) returned 1 [0072.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.491] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0072.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.491] lstrlenW (lpString=".doc") returned 4 [0072.491] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0072.491] lstrlenW (lpString=".docx") returned 5 [0072.491] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0072.492] lstrlenW (lpString=".pdf") returned 4 [0072.492] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString=".xls") returned 4 [0072.492] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0072.492] lstrlenW (lpString=".xlsx") returned 5 [0072.492] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0072.492] lstrlenW (lpString=".ppt") returned 4 [0072.492] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.492] lstrlenW (lpString=".zip") returned 4 [0072.492] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0072.492] lstrlenW (lpString=".rar") returned 4 [0072.492] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString=".bz2") returned 4 [0072.492] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString=".7z") returned 3 [0072.492] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0072.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.492] lstrlenW (lpString=".dbf") returned 4 [0072.492] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.492] lstrlenW (lpString=".1cd") returned 4 [0072.492] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0072.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 64 [0072.492] lstrlenW (lpString=".jpg") returned 4 [0072.492] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0072.492] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") [0072.493] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=44936) returned 1 [0072.493] CloseHandle (hObject=0x154) returned 1 [0072.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 0x20 [0072.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0072.493] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.493] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0072.494] GetLastError () returned 0x0 [0072.494] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xaf88, lpOverlapped=0x0) returned 1 [0072.503] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xaf90, lpOverlapped=0x0) returned 1 [0072.504] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.504] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.505] SetEndOfFile (hFile=0x1c0) returned 1 [0072.505] CloseHandle (hObject=0x1c0) returned 1 [0072.505] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.505] SetEndOfFile (hFile=0x154) returned 1 [0072.506] CloseHandle (hObject=0x154) returned 1 [0072.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 1 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.506] lstrlenW (lpString=".doc") returned 4 [0072.506] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.506] lstrlenW (lpString=".docx") returned 5 [0072.506] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0072.506] lstrlenW (lpString=".pdf") returned 4 [0072.506] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.506] lstrlenW (lpString=".xls") returned 4 [0072.506] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.506] lstrlenW (lpString=".xlsx") returned 5 [0072.507] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0072.507] lstrlenW (lpString=".ppt") returned 4 [0072.507] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.507] lstrlenW (lpString=".zip") returned 4 [0072.507] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.507] lstrlenW (lpString=".rar") returned 4 [0072.507] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.507] lstrlenW (lpString=".bz2") returned 4 [0072.507] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.507] lstrlenW (lpString=".7z") returned 3 [0072.507] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.507] lstrlenW (lpString=".dbf") returned 4 [0072.507] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.507] lstrlenW (lpString=".1cd") returned 4 [0072.507] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 68 [0072.507] lstrlenW (lpString=".jpg") returned 4 [0072.507] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.507] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") [0072.508] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1363344) returned 1 [0072.508] CloseHandle (hObject=0x154) returned 1 [0072.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20 [0072.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0072.508] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.508] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0072.514] GetLastError () returned 0x0 [0072.514] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0072.662] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0072.678] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4cda0, lpOverlapped=0x0) returned 1 [0073.142] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4cdb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4cdb0, lpOverlapped=0x0) returned 1 [0073.152] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.152] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.152] SetEndOfFile (hFile=0x1c0) returned 1 [0073.152] CloseHandle (hObject=0x1c0) returned 1 [0073.153] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.153] SetEndOfFile (hFile=0x154) returned 1 [0073.157] CloseHandle (hObject=0x154) returned 1 [0073.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 1 [0073.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.158] lstrlenW (lpString=".doc") returned 4 [0073.158] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString=".docx") returned 5 [0073.158] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0073.158] lstrlenW (lpString=".pdf") returned 4 [0073.158] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString=".xls") returned 4 [0073.158] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString=".xlsx") returned 5 [0073.158] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0073.158] lstrlenW (lpString=".ppt") returned 4 [0073.158] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.158] lstrlenW (lpString=".zip") returned 4 [0073.158] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString=".rar") returned 4 [0073.158] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.158] lstrlenW (lpString=".bz2") returned 4 [0073.158] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.158] lstrlenW (lpString=".7z") returned 3 [0073.158] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.158] lstrlenW (lpString=".dbf") returned 4 [0073.158] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.158] lstrlenW (lpString=".1cd") returned 4 [0073.158] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 85 [0073.159] lstrlenW (lpString=".jpg") returned 4 [0073.159] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.159] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") [0074.049] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=466944) returned 1 [0074.049] CloseHandle (hObject=0x150) returned 1 [0074.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0074.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.050] lstrlenW (lpString=".doc") returned 4 [0074.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString=".docx") returned 5 [0074.050] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0074.050] lstrlenW (lpString=".pdf") returned 4 [0074.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString=".xls") returned 4 [0074.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString=".xlsx") returned 5 [0074.050] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0074.050] lstrlenW (lpString=".ppt") returned 4 [0074.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.050] lstrlenW (lpString=".zip") returned 4 [0074.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString=".rar") returned 4 [0074.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.050] lstrlenW (lpString=".bz2") returned 4 [0074.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.051] lstrlenW (lpString=".7z") returned 3 [0074.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString=".dbf") returned 4 [0074.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString=".1cd") returned 4 [0074.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString=".jpg") returned 4 [0074.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString=".doc") returned 4 [0074.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString=".docx") returned 5 [0074.051] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0074.051] lstrlenW (lpString=".pdf") returned 4 [0074.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString=".xls") returned 4 [0074.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString=".xlsx") returned 5 [0074.051] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0074.051] lstrlenW (lpString=".ppt") returned 4 [0074.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.051] lstrlenW (lpString=".zip") returned 4 [0074.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString=".rar") returned 4 [0074.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.051] lstrlenW (lpString=".bz2") returned 4 [0074.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.052] lstrlenW (lpString=".7z") returned 3 [0074.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.052] lstrlenW (lpString=".dbf") returned 4 [0074.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.052] lstrlenW (lpString=".1cd") returned 4 [0074.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0074.052] lstrlenW (lpString=".jpg") returned 4 [0074.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.052] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15 [0074.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.145] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=17920) returned 1 [0074.145] CloseHandle (hObject=0x150) returned 1 [0074.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0074.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".doc") returned 4 [0074.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.146] lstrlenW (lpString=".docx") returned 5 [0074.146] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.146] lstrlenW (lpString=".pdf") returned 4 [0074.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.146] lstrlenW (lpString=".xls") returned 4 [0074.146] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.146] lstrlenW (lpString=".xlsx") returned 5 [0074.146] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.146] lstrlenW (lpString=".ppt") returned 4 [0074.146] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".zip") returned 4 [0074.146] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.146] lstrlenW (lpString=".rar") returned 4 [0074.146] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.146] lstrlenW (lpString=".bz2") returned 4 [0074.146] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.146] lstrlenW (lpString=".7z") returned 3 [0074.146] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".dbf") returned 4 [0074.146] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".1cd") returned 4 [0074.146] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".jpg") returned 4 [0074.146] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.146] lstrlenW (lpString=".doc") returned 4 [0074.147] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.147] lstrlenW (lpString=".docx") returned 5 [0074.147] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.147] lstrlenW (lpString=".pdf") returned 4 [0074.147] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.147] lstrlenW (lpString=".xls") returned 4 [0074.147] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.147] lstrlenW (lpString=".xlsx") returned 5 [0074.147] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.147] lstrlenW (lpString=".ppt") returned 4 [0074.147] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.147] lstrlenW (lpString=".zip") returned 4 [0074.147] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.147] lstrlenW (lpString=".rar") returned 4 [0074.147] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.147] lstrlenW (lpString=".bz2") returned 4 [0074.147] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.147] lstrlenW (lpString=".7z") returned 3 [0074.147] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.147] lstrlenW (lpString=".dbf") returned 4 [0074.147] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.147] lstrlenW (lpString=".1cd") returned 4 [0074.147] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0074.147] lstrlenW (lpString=".jpg") returned 4 [0074.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.147] lstrlenW (lpString="directshowtap.ax") returned 16 [0074.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.225] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=61440) returned 1 [0074.226] CloseHandle (hObject=0x1c0) returned 1 [0074.226] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20 [0074.226] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.226] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.226] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.226] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.226] lstrlenW (lpString=".doc") returned 4 [0074.226] lstrcmpiW (lpString1=".doc", lpString2="p.ax") returned -1 [0074.226] lstrlenW (lpString=".docx") returned 5 [0074.226] lstrcmpiW (lpString1=".docx", lpString2="ap.ax") returned -1 [0074.226] lstrlenW (lpString=".pdf") returned 4 [0074.226] lstrcmpiW (lpString1=".pdf", lpString2="p.ax") returned -1 [0074.226] lstrlenW (lpString=".xls") returned 4 [0074.226] lstrcmpiW (lpString1=".xls", lpString2="p.ax") returned -1 [0074.226] lstrlenW (lpString=".xlsx") returned 5 [0074.226] lstrcmpiW (lpString1=".xlsx", lpString2="ap.ax") returned -1 [0074.226] lstrlenW (lpString=".ppt") returned 4 [0074.226] lstrcmpiW (lpString1=".ppt", lpString2="p.ax") returned -1 [0074.226] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.226] lstrlenW (lpString=".zip") returned 4 [0074.226] lstrcmpiW (lpString1=".zip", lpString2="p.ax") returned -1 [0074.226] lstrlenW (lpString=".rar") returned 4 [0074.226] lstrcmpiW (lpString1=".rar", lpString2="p.ax") returned -1 [0074.227] lstrlenW (lpString=".bz2") returned 4 [0074.227] lstrcmpiW (lpString1=".bz2", lpString2="p.ax") returned -1 [0074.227] lstrlenW (lpString=".7z") returned 3 [0074.227] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.227] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.227] lstrlenW (lpString=".dbf") returned 4 [0074.227] lstrcmpiW (lpString1=".dbf", lpString2="p.ax") returned -1 [0074.227] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.227] lstrlenW (lpString=".1cd") returned 4 [0074.227] lstrcmpiW (lpString1=".1cd", lpString2="p.ax") returned -1 [0074.227] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 43 [0074.227] lstrlenW (lpString=".jpg") returned 4 [0074.227] lstrcmpiW (lpString1=".jpg", lpString2="p.ax") returned -1 [0074.227] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") [0074.316] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2048) returned 1 [0074.316] CloseHandle (hObject=0x22c) returned 1 [0074.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0074.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.316] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString=".doc") returned 4 [0074.317] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.317] lstrlenW (lpString=".docx") returned 5 [0074.317] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.317] lstrlenW (lpString=".pdf") returned 4 [0074.317] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.317] lstrlenW (lpString=".xls") returned 4 [0074.317] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.317] lstrlenW (lpString=".xlsx") returned 5 [0074.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.317] lstrlenW (lpString=".ppt") returned 4 [0074.317] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString=".zip") returned 4 [0074.317] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.317] lstrlenW (lpString=".rar") returned 4 [0074.317] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.317] lstrlenW (lpString=".bz2") returned 4 [0074.317] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.317] lstrlenW (lpString=".7z") returned 3 [0074.317] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString=".dbf") returned 4 [0074.317] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString=".1cd") returned 4 [0074.317] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.317] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0074.317] lstrlenW (lpString=".jpg") returned 4 [0074.317] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.318] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") [0074.318] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5120) returned 1 [0074.318] CloseHandle (hObject=0x22c) returned 1 [0074.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0074.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.318] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.318] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.318] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.318] lstrlenW (lpString=".doc") returned 4 [0074.318] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.318] lstrlenW (lpString=".docx") returned 5 [0074.319] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.319] lstrlenW (lpString=".pdf") returned 4 [0074.319] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.319] lstrlenW (lpString=".xls") returned 4 [0074.319] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.319] lstrlenW (lpString=".xlsx") returned 5 [0074.319] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.319] lstrlenW (lpString=".ppt") returned 4 [0074.319] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.319] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.319] lstrlenW (lpString=".zip") returned 4 [0074.319] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.319] lstrlenW (lpString=".rar") returned 4 [0074.319] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.319] lstrlenW (lpString=".bz2") returned 4 [0074.319] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.319] lstrlenW (lpString=".7z") returned 3 [0074.319] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.319] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.319] lstrlenW (lpString=".dbf") returned 4 [0074.319] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.319] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.319] lstrlenW (lpString=".1cd") returned 4 [0074.319] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.319] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0074.319] lstrlenW (lpString=".jpg") returned 4 [0074.319] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.319] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") [0074.320] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=11776) returned 1 [0074.320] CloseHandle (hObject=0x22c) returned 1 [0074.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui")) returned 0x20 [0074.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.320] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.320] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.320] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.320] lstrlenW (lpString=".doc") returned 4 [0074.320] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.320] lstrlenW (lpString=".docx") returned 5 [0074.320] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.320] lstrlenW (lpString=".pdf") returned 4 [0074.320] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.320] lstrlenW (lpString=".xls") returned 4 [0074.320] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.320] lstrlenW (lpString=".xlsx") returned 5 [0074.320] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.320] lstrlenW (lpString=".ppt") returned 4 [0074.320] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.321] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.321] lstrlenW (lpString=".zip") returned 4 [0074.321] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.321] lstrlenW (lpString=".rar") returned 4 [0074.321] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.321] lstrlenW (lpString=".bz2") returned 4 [0074.321] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.321] lstrlenW (lpString=".7z") returned 3 [0074.321] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.321] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.321] lstrlenW (lpString=".dbf") returned 4 [0074.321] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.321] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.321] lstrlenW (lpString=".1cd") returned 4 [0074.321] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.321] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 56 [0074.321] lstrlenW (lpString=".jpg") returned 4 [0074.321] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.321] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") [0074.321] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2048) returned 1 [0074.321] CloseHandle (hObject=0x22c) returned 1 [0074.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui")) returned 0x20 [0074.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.322] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.322] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.322] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.322] lstrlenW (lpString=".doc") returned 4 [0074.322] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.322] lstrlenW (lpString=".docx") returned 5 [0074.322] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.322] lstrlenW (lpString=".pdf") returned 4 [0074.322] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.322] lstrlenW (lpString=".xls") returned 4 [0074.322] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.322] lstrlenW (lpString=".xlsx") returned 5 [0074.322] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.322] lstrlenW (lpString=".ppt") returned 4 [0074.322] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.322] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.322] lstrlenW (lpString=".zip") returned 4 [0074.322] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.322] lstrlenW (lpString=".rar") returned 4 [0074.322] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.322] lstrlenW (lpString=".bz2") returned 4 [0074.323] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.323] lstrlenW (lpString=".7z") returned 3 [0074.323] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.323] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.323] lstrlenW (lpString=".dbf") returned 4 [0074.323] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.323] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.323] lstrlenW (lpString=".1cd") returned 4 [0074.323] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.323] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 62 [0074.323] lstrlenW (lpString=".jpg") returned 4 [0074.323] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.323] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") [0074.323] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2048) returned 1 [0074.323] CloseHandle (hObject=0x22c) returned 1 [0074.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui")) returned 0x20 [0074.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.324] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.324] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.324] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.324] lstrlenW (lpString=".doc") returned 4 [0074.324] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.324] lstrlenW (lpString=".docx") returned 5 [0074.324] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.324] lstrlenW (lpString=".pdf") returned 4 [0074.324] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.324] lstrlenW (lpString=".xls") returned 4 [0074.324] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.324] lstrlenW (lpString=".xlsx") returned 5 [0074.324] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.324] lstrlenW (lpString=".ppt") returned 4 [0074.324] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.324] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.324] lstrlenW (lpString=".zip") returned 4 [0074.324] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.324] lstrlenW (lpString=".rar") returned 4 [0074.324] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.324] lstrlenW (lpString=".bz2") returned 4 [0074.324] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.324] lstrlenW (lpString=".7z") returned 3 [0074.324] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.324] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.324] lstrlenW (lpString=".dbf") returned 4 [0074.324] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.324] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.325] lstrlenW (lpString=".1cd") returned 4 [0074.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.325] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 63 [0074.325] lstrlenW (lpString=".jpg") returned 4 [0074.325] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.325] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") [0074.326] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7168) returned 1 [0074.326] CloseHandle (hObject=0x22c) returned 1 [0074.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui")) returned 0x20 [0074.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.326] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.326] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.326] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.326] lstrlenW (lpString=".doc") returned 4 [0074.326] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.326] lstrlenW (lpString=".docx") returned 5 [0074.326] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.326] lstrlenW (lpString=".pdf") returned 4 [0074.326] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.326] lstrlenW (lpString=".xls") returned 4 [0074.326] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.326] lstrlenW (lpString=".xlsx") returned 5 [0074.326] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.326] lstrlenW (lpString=".ppt") returned 4 [0074.326] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.326] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.326] lstrlenW (lpString=".zip") returned 4 [0074.326] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.326] lstrlenW (lpString=".rar") returned 4 [0074.327] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.327] lstrlenW (lpString=".bz2") returned 4 [0074.327] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.327] lstrlenW (lpString=".7z") returned 3 [0074.327] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.327] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.327] lstrlenW (lpString=".dbf") returned 4 [0074.327] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.327] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.327] lstrlenW (lpString=".1cd") returned 4 [0074.327] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.327] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 61 [0074.327] lstrlenW (lpString=".jpg") returned 4 [0074.327] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.327] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") [0074.327] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=75776) returned 1 [0074.327] CloseHandle (hObject=0x22c) returned 1 [0074.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\fax fixtures.exe" (normalized: "c:\\program files\\internet explorer\\fax fixtures.exe")) returned 0x20 [0074.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\fax fixtures.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\fax fixtures.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.327] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\fax fixtures.exe" (normalized: "c:\\program files\\internet explorer\\fax fixtures.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString=".doc") returned 4 [0074.328] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0074.328] lstrlenW (lpString=".docx") returned 5 [0074.328] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0074.328] lstrlenW (lpString=".pdf") returned 4 [0074.328] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0074.328] lstrlenW (lpString=".xls") returned 4 [0074.328] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0074.328] lstrlenW (lpString=".xlsx") returned 5 [0074.328] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0074.328] lstrlenW (lpString=".ppt") returned 4 [0074.328] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString=".zip") returned 4 [0074.328] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0074.328] lstrlenW (lpString=".rar") returned 4 [0074.328] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0074.328] lstrlenW (lpString=".bz2") returned 4 [0074.328] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0074.328] lstrlenW (lpString=".7z") returned 3 [0074.328] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString=".dbf") returned 4 [0074.328] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString=".1cd") returned 4 [0074.328] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0074.328] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\fax fixtures.exe") returned 51 [0074.328] lstrlenW (lpString=".jpg") returned 4 [0074.328] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0074.329] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") [0074.329] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=52736) returned 1 [0074.329] CloseHandle (hObject=0x22c) returned 1 [0074.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0074.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.330] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.330] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.330] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.330] lstrlenW (lpString=".doc") returned 4 [0074.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString=".docx") returned 5 [0074.330] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0074.330] lstrlenW (lpString=".pdf") returned 4 [0074.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString=".xls") returned 4 [0074.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString=".xlsx") returned 5 [0074.330] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0074.330] lstrlenW (lpString=".ppt") returned 4 [0074.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.330] lstrlenW (lpString=".zip") returned 4 [0074.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString=".rar") returned 4 [0074.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.330] lstrlenW (lpString=".bz2") returned 4 [0074.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.330] lstrlenW (lpString=".7z") returned 3 [0074.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.330] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.330] lstrlenW (lpString=".dbf") returned 4 [0074.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.331] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.331] lstrlenW (lpString=".1cd") returned 4 [0074.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.331] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0074.331] lstrlenW (lpString=".jpg") returned 4 [0074.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.331] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") [0074.331] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2649) returned 1 [0074.331] CloseHandle (hObject=0x22c) returned 1 [0074.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc")) returned 0x20 [0074.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.331] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.331] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.331] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.332] lstrlenW (lpString=".doc") returned 4 [0074.332] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".docx") returned 5 [0074.332] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0074.332] lstrlenW (lpString=".pdf") returned 4 [0074.332] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".xls") returned 4 [0074.332] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".xlsx") returned 5 [0074.332] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0074.332] lstrlenW (lpString=".ppt") returned 4 [0074.332] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.332] lstrlenW (lpString=".zip") returned 4 [0074.332] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".rar") returned 4 [0074.332] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".bz2") returned 4 [0074.332] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString=".7z") returned 3 [0074.332] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0074.332] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.332] lstrlenW (lpString=".dbf") returned 4 [0074.332] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.332] lstrlenW (lpString=".1cd") returned 4 [0074.332] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0074.332] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 52 [0074.332] lstrlenW (lpString=".jpg") returned 4 [0074.332] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0074.332] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\iecompat.dll") [0074.333] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7680) returned 1 [0074.333] CloseHandle (hObject=0x22c) returned 1 [0074.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll")) returned 0x20 [0074.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.333] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.333] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.333] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.333] lstrlenW (lpString=".doc") returned 4 [0074.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.333] lstrlenW (lpString=".docx") returned 5 [0074.333] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0074.333] lstrlenW (lpString=".pdf") returned 4 [0074.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.333] lstrlenW (lpString=".xls") returned 4 [0074.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.333] lstrlenW (lpString=".xlsx") returned 5 [0074.333] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0074.333] lstrlenW (lpString=".ppt") returned 4 [0074.334] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.334] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.334] lstrlenW (lpString=".zip") returned 4 [0074.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.334] lstrlenW (lpString=".rar") returned 4 [0074.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.334] lstrlenW (lpString=".bz2") returned 4 [0074.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.334] lstrlenW (lpString=".7z") returned 3 [0074.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.334] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.334] lstrlenW (lpString=".dbf") returned 4 [0074.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.334] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.334] lstrlenW (lpString=".1cd") returned 4 [0074.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.334] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 47 [0074.334] lstrlenW (lpString=".jpg") returned 4 [0074.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.334] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") [0074.334] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1013248) returned 1 [0074.334] CloseHandle (hObject=0x22c) returned 1 [0074.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll")) returned 0x20 [0074.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.335] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.335] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.335] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.335] lstrlenW (lpString=".doc") returned 4 [0074.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString=".docx") returned 5 [0074.335] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0074.335] lstrlenW (lpString=".pdf") returned 4 [0074.335] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString=".xls") returned 4 [0074.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString=".xlsx") returned 5 [0074.335] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0074.335] lstrlenW (lpString=".ppt") returned 4 [0074.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.335] lstrlenW (lpString=".zip") returned 4 [0074.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString=".rar") returned 4 [0074.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.335] lstrlenW (lpString=".bz2") returned 4 [0074.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.335] lstrlenW (lpString=".7z") returned 3 [0074.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.335] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.335] lstrlenW (lpString=".dbf") returned 4 [0074.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.336] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.336] lstrlenW (lpString=".1cd") returned 4 [0074.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.336] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 47 [0074.336] lstrlenW (lpString=".jpg") returned 4 [0074.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.336] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") [0074.336] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=269824) returned 1 [0074.336] CloseHandle (hObject=0x22c) returned 1 [0074.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0074.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.336] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.336] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.336] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.337] lstrlenW (lpString=".doc") returned 4 [0074.337] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0074.337] lstrlenW (lpString=".docx") returned 5 [0074.337] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0074.337] lstrlenW (lpString=".pdf") returned 4 [0074.337] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0074.337] lstrlenW (lpString=".xls") returned 4 [0074.337] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0074.337] lstrlenW (lpString=".xlsx") returned 5 [0074.337] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0074.337] lstrlenW (lpString=".ppt") returned 4 [0074.337] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0074.337] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.337] lstrlenW (lpString=".zip") returned 4 [0074.337] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0074.337] lstrlenW (lpString=".rar") returned 4 [0074.337] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0074.337] lstrlenW (lpString=".bz2") returned 4 [0074.337] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0074.337] lstrlenW (lpString=".7z") returned 3 [0074.337] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0074.337] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.337] lstrlenW (lpString=".dbf") returned 4 [0074.337] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0074.337] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.337] lstrlenW (lpString=".1cd") returned 4 [0074.337] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0074.337] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0074.337] lstrlenW (lpString=".jpg") returned 4 [0074.337] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0074.337] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") [0074.338] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=115712) returned 1 [0074.338] CloseHandle (hObject=0x22c) returned 1 [0074.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0074.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.338] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.338] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0074.338] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0074.338] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\ieproxy.dll") [0074.338] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=451072) returned 1 [0074.338] CloseHandle (hObject=0x22c) returned 1 [0074.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")) returned 0x20 [0074.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.339] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.339] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\IEShims.dll") [0074.339] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=293376) returned 1 [0074.339] CloseHandle (hObject=0x22c) returned 1 [0074.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0074.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.339] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.339] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\iexplore.exe") [0074.340] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=695056) returned 1 [0074.340] CloseHandle (hObject=0x22c) returned 1 [0074.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0074.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.340] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.340] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\jsdbgui.dll") [0074.340] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=505344) returned 1 [0074.341] CloseHandle (hObject=0x22c) returned 1 [0074.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll")) returned 0x20 [0074.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.341] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.341] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll") [0074.341] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=144896) returned 1 [0074.341] CloseHandle (hObject=0x22c) returned 1 [0074.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll")) returned 0x20 [0074.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.342] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.342] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll") [0074.342] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=132096) returned 1 [0074.342] CloseHandle (hObject=0x22c) returned 1 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll")) returned 0x20 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.343] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.343] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll") [0074.343] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=287744) returned 1 [0074.343] CloseHandle (hObject=0x22c) returned 1 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll")) returned 0x20 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.343] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.344] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\msdbg2.dll") [0074.344] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=358904) returned 1 [0074.344] CloseHandle (hObject=0x22c) returned 1 [0074.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll")) returned 0x20 [0074.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.344] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.344] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\pdm.dll") [0074.345] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=537088) returned 1 [0074.345] CloseHandle (hObject=0x22c) returned 1 [0074.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll")) returned 0x20 [0074.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\pdm.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.345] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.345] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") [0074.346] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=460) returned 1 [0074.346] CloseHandle (hObject=0x22c) returned 1 [0074.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0074.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.347] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0074.347] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.347] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.347] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.347] GetLastError () returned 0x0 [0074.347] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1cc, lpOverlapped=0x0) returned 1 [0074.348] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0074.349] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.349] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.349] SetEndOfFile (hFile=0x1fc) returned 1 [0074.350] CloseHandle (hObject=0x1fc) returned 1 [0074.350] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.350] SetEndOfFile (hFile=0x22c) returned 1 [0074.350] CloseHandle (hObject=0x22c) returned 1 [0074.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.351] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0074.351] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.351] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.351] lstrlenW (lpString=".doc") returned 4 [0074.351] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0074.351] lstrlenW (lpString=".docx") returned 5 [0074.351] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0074.351] lstrlenW (lpString=".pdf") returned 4 [0074.351] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0074.351] lstrlenW (lpString=".xls") returned 4 [0074.351] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0074.351] lstrlenW (lpString=".xlsx") returned 5 [0074.351] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0074.351] lstrlenW (lpString=".ppt") returned 4 [0074.351] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0074.351] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.351] lstrlenW (lpString=".zip") returned 4 [0074.351] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0074.351] lstrlenW (lpString=".rar") returned 4 [0074.351] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0074.351] lstrlenW (lpString=".bz2") returned 4 [0074.351] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0074.351] lstrlenW (lpString=".7z") returned 3 [0074.351] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0074.352] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.352] lstrlenW (lpString=".dbf") returned 4 [0074.352] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0074.352] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.352] lstrlenW (lpString=".1cd") returned 4 [0074.352] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0074.352] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0074.352] lstrlenW (lpString=".jpg") returned 4 [0074.352] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0074.352] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") [0074.352] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=244736) returned 1 [0074.352] CloseHandle (hObject=0x22c) returned 1 [0074.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0074.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.352] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString=".doc") returned 4 [0074.353] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".docx") returned 5 [0074.353] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0074.353] lstrlenW (lpString=".pdf") returned 4 [0074.353] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".xls") returned 4 [0074.353] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".xlsx") returned 5 [0074.353] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0074.353] lstrlenW (lpString=".ppt") returned 4 [0074.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString=".zip") returned 4 [0074.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".rar") returned 4 [0074.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".bz2") returned 4 [0074.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.353] lstrlenW (lpString=".7z") returned 3 [0074.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString=".dbf") returned 4 [0074.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString=".1cd") returned 4 [0074.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.353] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0074.353] lstrlenW (lpString=".jpg") returned 4 [0074.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.354] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") [0074.355] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=44457320) returned 1 [0074.355] CloseHandle (hObject=0x22c) returned 1 [0074.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 0x20 [0074.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0074.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0074.356] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.356] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.356] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.480] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.480] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.538] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.538] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x2a25d68, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.538] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.601] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.601] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0074.619] SetEndOfFile (hFile=0x22c) returned 1 [0074.619] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0074.619] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.619] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.620] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xe21f22, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.620] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.621] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x2a25d68, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.621] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0074.623] CloseHandle (hObject=0x22c) returned 1 [0074.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.623] lstrlenW (lpString=".doc") returned 4 [0074.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".docx") returned 5 [0074.623] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0074.623] lstrlenW (lpString=".pdf") returned 4 [0074.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".xls") returned 4 [0074.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".xlsx") returned 5 [0074.623] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0074.623] lstrlenW (lpString=".ppt") returned 4 [0074.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.623] lstrlenW (lpString=".zip") returned 4 [0074.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".rar") returned 4 [0074.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".bz2") returned 4 [0074.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.624] lstrlenW (lpString=".7z") returned 3 [0074.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString=".dbf") returned 4 [0074.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString=".1cd") returned 4 [0074.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString=".jpg") returned 4 [0074.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString=".doc") returned 4 [0074.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString=".docx") returned 5 [0074.624] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0074.624] lstrlenW (lpString=".pdf") returned 4 [0074.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString=".xls") returned 4 [0074.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString=".xlsx") returned 5 [0074.624] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0074.624] lstrlenW (lpString=".ppt") returned 4 [0074.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.624] lstrlenW (lpString=".zip") returned 4 [0074.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString=".rar") returned 4 [0074.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.624] lstrlenW (lpString=".bz2") returned 4 [0074.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.624] lstrlenW (lpString=".7z") returned 3 [0074.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.625] lstrlenW (lpString=".dbf") returned 4 [0074.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.625] lstrlenW (lpString=".1cd") returned 4 [0074.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0074.625] lstrlenW (lpString=".jpg") returned 4 [0074.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.625] lstrlenW (lpString="msolui100.dll") returned 13 [0074.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.759] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=318488) returned 1 [0074.759] CloseHandle (hObject=0x154) returned 1 [0074.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20 [0074.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.759] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.759] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.760] GetLastError () returned 0x0 [0074.760] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4dc18, lpOverlapped=0x0) returned 1 [0075.111] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4dc20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4dc20, lpOverlapped=0x0) returned 1 [0075.119] ReadFile (in: hFile=0x154, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.119] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0075.120] SetEndOfFile (hFile=0x1ec) returned 1 [0075.120] CloseHandle (hObject=0x1ec) returned 1 [0075.120] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.120] SetEndOfFile (hFile=0x154) returned 1 [0075.123] CloseHandle (hObject=0x154) returned 1 [0075.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 1 [0075.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.124] lstrlenW (lpString=".doc") returned 4 [0075.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString=".docx") returned 5 [0075.124] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.124] lstrlenW (lpString=".pdf") returned 4 [0075.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString=".xls") returned 4 [0075.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString=".xlsx") returned 5 [0075.124] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.124] lstrlenW (lpString=".ppt") returned 4 [0075.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.124] lstrlenW (lpString=".zip") returned 4 [0075.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString=".rar") returned 4 [0075.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.124] lstrlenW (lpString=".bz2") returned 4 [0075.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.124] lstrlenW (lpString=".7z") returned 3 [0075.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.124] lstrlenW (lpString=".dbf") returned 4 [0075.124] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.125] lstrlenW (lpString=".1cd") returned 4 [0075.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.125] lstrlenW (lpString=".jpg") returned 4 [0075.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.125] lstrlenW (lpString=".doc") returned 4 [0075.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.125] lstrlenW (lpString=".docx") returned 5 [0075.125] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.125] lstrlenW (lpString=".pdf") returned 4 [0075.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.125] lstrlenW (lpString=".xls") returned 4 [0075.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.125] lstrlenW (lpString=".xlsx") returned 5 [0075.125] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.125] lstrlenW (lpString=".ppt") returned 4 [0075.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.125] lstrlenW (lpString=".zip") returned 4 [0075.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.126] lstrlenW (lpString=".rar") returned 4 [0075.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.126] lstrlenW (lpString=".bz2") returned 4 [0075.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.126] lstrlenW (lpString=".7z") returned 3 [0075.126] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.126] lstrlenW (lpString=".dbf") returned 4 [0075.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.126] lstrlenW (lpString=".1cd") returned 4 [0075.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 70 [0075.126] lstrlenW (lpString=".jpg") returned 4 [0075.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.126] lstrlenW (lpString="BABY_01.MID") returned 11 [0075.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.335] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7384) returned 1 [0075.335] CloseHandle (hObject=0x158) returned 1 [0075.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0075.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0075.337] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.337] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0075.712] GetLastError () returned 0x0 [0075.712] ReadFile (in: hFile=0x190, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0075.735] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0075.736] ReadFile (in: hFile=0x190, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.736] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.737] SetEndOfFile (hFile=0x1f0) returned 1 [0075.739] CloseHandle (hObject=0x1f0) returned 1 [0075.739] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.739] SetEndOfFile (hFile=0x190) returned 1 [0075.740] CloseHandle (hObject=0x190) returned 1 [0075.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0075.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString=".doc") returned 4 [0075.744] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.744] lstrlenW (lpString=".docx") returned 5 [0075.744] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.744] lstrlenW (lpString=".pdf") returned 4 [0075.744] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.744] lstrlenW (lpString=".xls") returned 4 [0075.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.744] lstrlenW (lpString=".xlsx") returned 5 [0075.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.744] lstrlenW (lpString=".ppt") returned 4 [0075.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString=".zip") returned 4 [0075.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.744] lstrlenW (lpString=".rar") returned 4 [0075.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.744] lstrlenW (lpString=".bz2") returned 4 [0075.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.744] lstrlenW (lpString=".7z") returned 3 [0075.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString=".dbf") returned 4 [0075.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString=".1cd") returned 4 [0075.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0075.744] lstrlenW (lpString=".jpg") returned 4 [0075.744] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.744] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") [0075.775] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7178) returned 1 [0075.775] CloseHandle (hObject=0x158) returned 1 [0075.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0075.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.776] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.776] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0075.776] GetLastError () returned 0x0 [0075.776] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0075.787] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0075.788] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.788] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.788] SetEndOfFile (hFile=0x160) returned 1 [0075.788] CloseHandle (hObject=0x160) returned 1 [0075.789] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.789] SetEndOfFile (hFile=0x158) returned 1 [0075.789] CloseHandle (hObject=0x158) returned 1 [0075.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.790] lstrlenW (lpString=".doc") returned 4 [0075.790] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.790] lstrlenW (lpString=".docx") returned 5 [0075.790] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.790] lstrlenW (lpString=".pdf") returned 4 [0075.790] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.790] lstrlenW (lpString=".xls") returned 4 [0075.790] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.790] lstrlenW (lpString=".xlsx") returned 5 [0075.790] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.790] lstrlenW (lpString=".ppt") returned 4 [0075.790] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.790] lstrlenW (lpString=".zip") returned 4 [0075.790] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.790] lstrlenW (lpString=".rar") returned 4 [0075.790] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.790] lstrlenW (lpString=".bz2") returned 4 [0075.790] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.790] lstrlenW (lpString=".7z") returned 3 [0075.790] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.790] lstrlenW (lpString=".dbf") returned 4 [0075.791] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.791] lstrlenW (lpString=".1cd") returned 4 [0075.791] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0075.791] lstrlenW (lpString=".jpg") returned 4 [0075.791] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.791] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") [0075.791] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=9797) returned 1 [0075.791] CloseHandle (hObject=0x158) returned 1 [0075.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0075.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.791] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.791] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0075.792] GetLastError () returned 0x0 [0075.792] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2645, lpOverlapped=0x0) returned 1 [0075.820] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0075.821] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.821] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.822] SetEndOfFile (hFile=0x160) returned 1 [0075.822] CloseHandle (hObject=0x160) returned 1 [0075.822] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.822] SetEndOfFile (hFile=0x158) returned 1 [0075.823] CloseHandle (hObject=0x158) returned 1 [0075.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0075.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.823] lstrlenW (lpString=".doc") returned 4 [0075.823] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.823] lstrlenW (lpString=".docx") returned 5 [0075.824] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.824] lstrlenW (lpString=".pdf") returned 4 [0075.824] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.824] lstrlenW (lpString=".xls") returned 4 [0075.824] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.824] lstrlenW (lpString=".xlsx") returned 5 [0075.824] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.824] lstrlenW (lpString=".ppt") returned 4 [0075.824] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.824] lstrlenW (lpString=".zip") returned 4 [0075.824] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.824] lstrlenW (lpString=".rar") returned 4 [0075.824] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.824] lstrlenW (lpString=".bz2") returned 4 [0075.824] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.824] lstrlenW (lpString=".7z") returned 3 [0075.824] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.824] lstrlenW (lpString=".dbf") returned 4 [0075.824] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.824] lstrlenW (lpString=".1cd") returned 4 [0075.824] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0075.824] lstrlenW (lpString=".jpg") returned 4 [0075.824] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.824] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") [0075.843] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6644) returned 1 [0075.843] CloseHandle (hObject=0x158) returned 1 [0075.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0075.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.844] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.844] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0075.844] GetLastError () returned 0x0 [0075.844] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0075.859] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0075.860] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.860] WriteFile (in: hFile=0x160, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.860] SetEndOfFile (hFile=0x160) returned 1 [0075.860] CloseHandle (hObject=0x160) returned 1 [0075.860] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.860] SetEndOfFile (hFile=0x158) returned 1 [0075.873] CloseHandle (hObject=0x158) returned 1 [0075.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0075.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.985] lstrlenW (lpString=".doc") returned 4 [0075.985] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.985] lstrlenW (lpString=".docx") returned 5 [0075.985] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.985] lstrlenW (lpString=".pdf") returned 4 [0075.985] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.985] lstrlenW (lpString=".xls") returned 4 [0075.985] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.985] lstrlenW (lpString=".xlsx") returned 5 [0075.985] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.985] lstrlenW (lpString=".ppt") returned 4 [0075.985] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.985] lstrlenW (lpString=".zip") returned 4 [0075.985] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.985] lstrlenW (lpString=".rar") returned 4 [0075.985] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.985] lstrlenW (lpString=".bz2") returned 4 [0075.985] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.985] lstrlenW (lpString=".7z") returned 3 [0075.985] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.985] lstrlenW (lpString=".dbf") returned 4 [0075.985] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.986] lstrlenW (lpString=".1cd") returned 4 [0075.986] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0075.986] lstrlenW (lpString=".jpg") returned 4 [0075.986] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.986] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") [0076.101] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6564) returned 1 [0076.101] CloseHandle (hObject=0x1fc) returned 1 [0076.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0076.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.123] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.123] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.124] GetLastError () returned 0x0 [0076.124] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x19a4, lpOverlapped=0x0) returned 1 [0076.125] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0076.126] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.126] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.126] SetEndOfFile (hFile=0x1c8) returned 1 [0076.126] CloseHandle (hObject=0x1c8) returned 1 [0076.127] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.127] SetEndOfFile (hFile=0x210) returned 1 [0076.127] CloseHandle (hObject=0x210) returned 1 [0076.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.128] lstrlenW (lpString=".doc") returned 4 [0076.128] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.128] lstrlenW (lpString=".docx") returned 5 [0076.128] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0076.128] lstrlenW (lpString=".pdf") returned 4 [0076.128] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.128] lstrlenW (lpString=".xls") returned 4 [0076.128] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.128] lstrlenW (lpString=".xlsx") returned 5 [0076.128] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0076.128] lstrlenW (lpString=".ppt") returned 4 [0076.128] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.128] lstrlenW (lpString=".zip") returned 4 [0076.128] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.128] lstrlenW (lpString=".rar") returned 4 [0076.128] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.128] lstrlenW (lpString=".bz2") returned 4 [0076.128] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.128] lstrlenW (lpString=".7z") returned 3 [0076.128] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.128] lstrlenW (lpString=".dbf") returned 4 [0076.128] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.129] lstrlenW (lpString=".1cd") returned 4 [0076.129] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0076.129] lstrlenW (lpString=".jpg") returned 4 [0076.129] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.129] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") [0076.129] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6700) returned 1 [0076.129] CloseHandle (hObject=0x210) returned 1 [0076.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0076.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.129] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.129] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.135] GetLastError () returned 0x0 [0076.135] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0076.136] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0076.137] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.137] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.137] SetEndOfFile (hFile=0x1c8) returned 1 [0076.137] CloseHandle (hObject=0x1c8) returned 1 [0076.137] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.137] SetEndOfFile (hFile=0x210) returned 1 [0076.138] CloseHandle (hObject=0x210) returned 1 [0076.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0076.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.139] lstrlenW (lpString=".doc") returned 4 [0076.153] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.153] lstrlenW (lpString=".docx") returned 5 [0076.153] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.153] lstrlenW (lpString=".pdf") returned 4 [0076.153] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.153] lstrlenW (lpString=".xls") returned 4 [0076.153] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.153] lstrlenW (lpString=".xlsx") returned 5 [0076.153] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.153] lstrlenW (lpString=".ppt") returned 4 [0076.153] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.153] lstrlenW (lpString=".zip") returned 4 [0076.153] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.153] lstrlenW (lpString=".rar") returned 4 [0076.153] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.154] lstrlenW (lpString=".bz2") returned 4 [0076.154] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.154] lstrlenW (lpString=".7z") returned 3 [0076.154] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.154] lstrlenW (lpString=".dbf") returned 4 [0076.154] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.154] lstrlenW (lpString=".1cd") returned 4 [0076.154] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0076.154] lstrlenW (lpString=".jpg") returned 4 [0076.154] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.154] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") [0076.154] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=8501) returned 1 [0076.154] CloseHandle (hObject=0x210) returned 1 [0076.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0076.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.155] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.155] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.155] GetLastError () returned 0x0 [0076.155] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2135, lpOverlapped=0x0) returned 1 [0076.183] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0076.184] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.184] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.184] SetEndOfFile (hFile=0x1c8) returned 1 [0076.184] CloseHandle (hObject=0x1c8) returned 1 [0076.184] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.184] SetEndOfFile (hFile=0x210) returned 1 [0076.185] CloseHandle (hObject=0x210) returned 1 [0076.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.186] lstrlenW (lpString=".doc") returned 4 [0076.186] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.186] lstrlenW (lpString=".docx") returned 5 [0076.186] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.186] lstrlenW (lpString=".pdf") returned 4 [0076.186] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.186] lstrlenW (lpString=".xls") returned 4 [0076.186] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.186] lstrlenW (lpString=".xlsx") returned 5 [0076.186] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.186] lstrlenW (lpString=".ppt") returned 4 [0076.186] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.186] lstrlenW (lpString=".zip") returned 4 [0076.186] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.186] lstrlenW (lpString=".rar") returned 4 [0076.186] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.186] lstrlenW (lpString=".bz2") returned 4 [0076.186] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.186] lstrlenW (lpString=".7z") returned 3 [0076.186] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.186] lstrlenW (lpString=".dbf") returned 4 [0076.186] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.186] lstrlenW (lpString=".1cd") returned 4 [0076.187] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0076.187] lstrlenW (lpString=".jpg") returned 4 [0076.187] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.187] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") [0076.187] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6915) returned 1 [0076.187] CloseHandle (hObject=0x210) returned 1 [0076.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0076.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.187] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.187] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.188] GetLastError () returned 0x0 [0076.188] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1b03, lpOverlapped=0x0) returned 1 [0076.228] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0076.229] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.229] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.229] SetEndOfFile (hFile=0x1c8) returned 1 [0076.229] CloseHandle (hObject=0x1c8) returned 1 [0076.229] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.230] SetEndOfFile (hFile=0x210) returned 1 [0076.230] CloseHandle (hObject=0x210) returned 1 [0076.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0076.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.231] lstrlenW (lpString=".doc") returned 4 [0076.231] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.231] lstrlenW (lpString=".docx") returned 5 [0076.231] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.231] lstrlenW (lpString=".pdf") returned 4 [0076.231] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.231] lstrlenW (lpString=".xls") returned 4 [0076.231] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.231] lstrlenW (lpString=".xlsx") returned 5 [0076.231] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.231] lstrlenW (lpString=".ppt") returned 4 [0076.231] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.231] lstrlenW (lpString=".zip") returned 4 [0076.231] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.231] lstrlenW (lpString=".rar") returned 4 [0076.231] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.231] lstrlenW (lpString=".bz2") returned 4 [0076.231] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.231] lstrlenW (lpString=".7z") returned 3 [0076.231] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.231] lstrlenW (lpString=".dbf") returned 4 [0076.231] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.232] lstrlenW (lpString=".1cd") returned 4 [0076.232] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0076.232] lstrlenW (lpString=".jpg") returned 4 [0076.232] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.232] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") [0076.277] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=218310) returned 1 [0076.277] CloseHandle (hObject=0x210) returned 1 [0076.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0076.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.278] GetLastError () returned 0x0 [0076.278] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0076.678] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0076.688] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.688] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.688] SetEndOfFile (hFile=0x1c8) returned 1 [0076.777] CloseHandle (hObject=0x1c8) returned 1 [0076.780] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.780] SetEndOfFile (hFile=0x210) returned 1 [0076.782] CloseHandle (hObject=0x210) returned 1 [0076.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0076.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.783] lstrlenW (lpString=".doc") returned 4 [0076.783] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".docx") returned 5 [0076.783] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.783] lstrlenW (lpString=".pdf") returned 4 [0076.783] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".xls") returned 4 [0076.783] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".xlsx") returned 5 [0076.783] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.783] lstrlenW (lpString=".ppt") returned 4 [0076.783] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.783] lstrlenW (lpString=".zip") returned 4 [0076.783] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".rar") returned 4 [0076.783] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".bz2") returned 4 [0076.783] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.783] lstrlenW (lpString=".7z") returned 3 [0076.783] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.783] lstrlenW (lpString=".dbf") returned 4 [0076.783] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.784] lstrlenW (lpString=".1cd") returned 4 [0076.784] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0076.784] lstrlenW (lpString=".jpg") returned 4 [0076.784] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.784] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") [0076.928] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=618119) returned 1 [0076.928] CloseHandle (hObject=0x158) returned 1 [0076.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0076.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.928] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.928] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.928] GetLastError () returned 0x0 [0076.928] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0077.014] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0077.024] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.024] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0077.024] SetEndOfFile (hFile=0x150) returned 1 [0077.028] CloseHandle (hObject=0x150) returned 1 [0077.028] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.028] SetEndOfFile (hFile=0x158) returned 1 [0077.208] CloseHandle (hObject=0x158) returned 1 [0077.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.209] lstrlenW (lpString=".doc") returned 4 [0077.209] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.209] lstrlenW (lpString=".docx") returned 5 [0077.209] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.209] lstrlenW (lpString=".pdf") returned 4 [0077.209] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.209] lstrlenW (lpString=".xls") returned 4 [0077.209] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.209] lstrlenW (lpString=".xlsx") returned 5 [0077.209] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.209] lstrlenW (lpString=".ppt") returned 4 [0077.209] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.209] lstrlenW (lpString=".zip") returned 4 [0077.210] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.210] lstrlenW (lpString=".rar") returned 4 [0077.210] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.210] lstrlenW (lpString=".bz2") returned 4 [0077.210] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.210] lstrlenW (lpString=".7z") returned 3 [0077.210] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.210] lstrlenW (lpString=".dbf") returned 4 [0077.210] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.210] lstrlenW (lpString=".1cd") returned 4 [0077.210] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0077.210] lstrlenW (lpString=".jpg") returned 4 [0077.210] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.210] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") [0077.211] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=18639) returned 1 [0077.211] CloseHandle (hObject=0x158) returned 1 [0077.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0077.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.212] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.212] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.212] GetLastError () returned 0x0 [0077.212] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x48cf, lpOverlapped=0x0) returned 1 [0077.214] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0077.215] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.215] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.216] SetEndOfFile (hFile=0x150) returned 1 [0077.216] CloseHandle (hObject=0x150) returned 1 [0077.216] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.216] SetEndOfFile (hFile=0x158) returned 1 [0077.217] CloseHandle (hObject=0x158) returned 1 [0077.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0077.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.217] lstrlenW (lpString=".doc") returned 4 [0077.217] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.217] lstrlenW (lpString=".docx") returned 5 [0077.217] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.217] lstrlenW (lpString=".pdf") returned 4 [0077.217] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.217] lstrlenW (lpString=".xls") returned 4 [0077.217] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.217] lstrlenW (lpString=".xlsx") returned 5 [0077.217] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.217] lstrlenW (lpString=".ppt") returned 4 [0077.217] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.218] lstrlenW (lpString=".zip") returned 4 [0077.218] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.218] lstrlenW (lpString=".rar") returned 4 [0077.218] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.218] lstrlenW (lpString=".bz2") returned 4 [0077.218] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.218] lstrlenW (lpString=".7z") returned 3 [0077.218] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.218] lstrlenW (lpString=".dbf") returned 4 [0077.218] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.218] lstrlenW (lpString=".1cd") returned 4 [0077.218] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0077.218] lstrlenW (lpString=".jpg") returned 4 [0077.218] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.218] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") [0077.219] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=350689) returned 1 [0077.219] CloseHandle (hObject=0x150) returned 1 [0077.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0077.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.219] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.220] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.220] GetLastError () returned 0x0 [0077.220] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x559e1, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0077.422] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0077.422] SetEndOfFile (hFile=0x1fc) returned 1 [0077.422] CloseHandle (hObject=0x1fc) returned 1 [0077.422] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.422] SetEndOfFile (hFile=0x150) returned 1 [0077.425] CloseHandle (hObject=0x150) returned 1 [0077.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0077.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.426] lstrlenW (lpString=".doc") returned 4 [0077.426] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".docx") returned 5 [0077.426] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.426] lstrlenW (lpString=".pdf") returned 4 [0077.426] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".xls") returned 4 [0077.426] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".xlsx") returned 5 [0077.426] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.426] lstrlenW (lpString=".ppt") returned 4 [0077.426] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.426] lstrlenW (lpString=".zip") returned 4 [0077.426] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".rar") returned 4 [0077.426] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".bz2") returned 4 [0077.426] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.426] lstrlenW (lpString=".7z") returned 3 [0077.426] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.427] lstrlenW (lpString=".dbf") returned 4 [0077.427] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.427] lstrlenW (lpString=".1cd") returned 4 [0077.427] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0077.427] lstrlenW (lpString=".jpg") returned 4 [0077.427] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.427] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") [0077.428] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=39546) returned 1 [0077.428] CloseHandle (hObject=0x150) returned 1 [0077.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0077.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.428] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.428] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.429] GetLastError () returned 0x0 [0077.429] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0077.437] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0077.438] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.438] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.439] SetEndOfFile (hFile=0x1fc) returned 1 [0077.439] CloseHandle (hObject=0x1fc) returned 1 [0077.439] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.439] SetEndOfFile (hFile=0x150) returned 1 [0077.440] CloseHandle (hObject=0x150) returned 1 [0077.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0077.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.564] lstrlenW (lpString=".doc") returned 4 [0077.564] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".docx") returned 5 [0077.564] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.564] lstrlenW (lpString=".pdf") returned 4 [0077.564] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".xls") returned 4 [0077.564] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".xlsx") returned 5 [0077.564] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.564] lstrlenW (lpString=".ppt") returned 4 [0077.564] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.564] lstrlenW (lpString=".zip") returned 4 [0077.564] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".rar") returned 4 [0077.564] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".bz2") returned 4 [0077.564] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.564] lstrlenW (lpString=".7z") returned 3 [0077.564] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.565] lstrlenW (lpString=".dbf") returned 4 [0077.565] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.565] lstrlenW (lpString=".1cd") returned 4 [0077.565] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0077.565] lstrlenW (lpString=".jpg") returned 4 [0077.565] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.565] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") [0077.594] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=43357) returned 1 [0077.594] CloseHandle (hObject=0x160) returned 1 [0077.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0077.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0077.598] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.598] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0077.616] GetLastError () returned 0x0 [0077.616] ReadFile (in: hFile=0x160, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa95d, lpOverlapped=0x0) returned 1 [0077.885] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa960, lpOverlapped=0x0) returned 1 [0077.917] ReadFile (in: hFile=0x160, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.917] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.917] SetEndOfFile (hFile=0x150) returned 1 [0077.918] CloseHandle (hObject=0x150) returned 1 [0077.918] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.918] SetEndOfFile (hFile=0x160) returned 1 [0077.919] CloseHandle (hObject=0x160) returned 1 [0077.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0077.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.919] lstrlenW (lpString=".doc") returned 4 [0077.919] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.919] lstrlenW (lpString=".docx") returned 5 [0077.919] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.919] lstrlenW (lpString=".pdf") returned 4 [0077.919] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.919] lstrlenW (lpString=".xls") returned 4 [0077.919] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.919] lstrlenW (lpString=".xlsx") returned 5 [0077.919] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.919] lstrlenW (lpString=".ppt") returned 4 [0077.919] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.920] lstrlenW (lpString=".zip") returned 4 [0077.920] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString=".rar") returned 4 [0077.920] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString=".bz2") returned 4 [0077.920] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString=".7z") returned 3 [0077.920] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.920] lstrlenW (lpString=".dbf") returned 4 [0077.920] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.920] lstrlenW (lpString=".1cd") returned 4 [0077.920] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0077.920] lstrlenW (lpString=".jpg") returned 4 [0077.920] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.920] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") [0078.133] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=228746) returned 1 [0078.134] CloseHandle (hObject=0x210) returned 1 [0078.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0078.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.134] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.134] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0078.134] GetLastError () returned 0x0 [0078.134] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0078.180] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0078.184] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.184] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0078.184] SetEndOfFile (hFile=0x16c) returned 1 [0078.184] CloseHandle (hObject=0x16c) returned 1 [0078.184] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.184] SetEndOfFile (hFile=0x210) returned 1 [0078.186] CloseHandle (hObject=0x210) returned 1 [0078.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0078.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.187] lstrlenW (lpString=".doc") returned 4 [0078.187] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".docx") returned 5 [0078.187] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0078.187] lstrlenW (lpString=".pdf") returned 4 [0078.187] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".xls") returned 4 [0078.187] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".xlsx") returned 5 [0078.187] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0078.187] lstrlenW (lpString=".ppt") returned 4 [0078.187] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.187] lstrlenW (lpString=".zip") returned 4 [0078.187] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".rar") returned 4 [0078.187] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".bz2") returned 4 [0078.187] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0078.187] lstrlenW (lpString=".7z") returned 3 [0078.187] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0078.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.188] lstrlenW (lpString=".dbf") returned 4 [0078.188] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0078.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.188] lstrlenW (lpString=".1cd") returned 4 [0078.188] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0078.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0078.188] lstrlenW (lpString=".jpg") returned 4 [0078.188] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0078.188] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") [0078.203] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=782121) returned 1 [0078.203] CloseHandle (hObject=0x210) returned 1 [0078.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0078.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.203] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.203] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0078.203] GetLastError () returned 0x0 [0078.204] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0078.267] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0078.438] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.438] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.438] SetEndOfFile (hFile=0x16c) returned 1 [0078.755] CloseHandle (hObject=0x16c) returned 1 [0078.755] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.755] SetEndOfFile (hFile=0x210) returned 1 [0078.762] CloseHandle (hObject=0x210) returned 1 [0078.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0079.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.180] lstrlenW (lpString=".doc") returned 4 [0079.180] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".docx") returned 5 [0079.180] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.180] lstrlenW (lpString=".pdf") returned 4 [0079.180] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".xls") returned 4 [0079.180] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".xlsx") returned 5 [0079.180] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.180] lstrlenW (lpString=".ppt") returned 4 [0079.180] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.180] lstrlenW (lpString=".zip") returned 4 [0079.180] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".rar") returned 4 [0079.180] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".bz2") returned 4 [0079.180] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString=".7z") returned 3 [0079.180] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.180] lstrlenW (lpString=".dbf") returned 4 [0079.180] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.180] lstrlenW (lpString=".1cd") returned 4 [0079.181] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0079.181] lstrlenW (lpString=".jpg") returned 4 [0079.181] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.181] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") [0079.216] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=41295) returned 1 [0079.216] CloseHandle (hObject=0x15c) returned 1 [0079.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0079.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.216] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.216] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.216] GetLastError () returned 0x0 [0079.217] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa14f, lpOverlapped=0x0) returned 1 [0079.302] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa150, lpOverlapped=0x0) returned 1 [0079.303] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.303] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.303] SetEndOfFile (hFile=0x180) returned 1 [0079.304] CloseHandle (hObject=0x180) returned 1 [0079.304] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.304] SetEndOfFile (hFile=0x15c) returned 1 [0079.305] CloseHandle (hObject=0x15c) returned 1 [0079.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0079.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.305] lstrlenW (lpString=".doc") returned 4 [0079.305] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.305] lstrlenW (lpString=".docx") returned 5 [0079.305] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.305] lstrlenW (lpString=".pdf") returned 4 [0079.305] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.305] lstrlenW (lpString=".xls") returned 4 [0079.305] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.305] lstrlenW (lpString=".xlsx") returned 5 [0079.305] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.306] lstrlenW (lpString=".ppt") returned 4 [0079.306] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.306] lstrlenW (lpString=".zip") returned 4 [0079.306] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString=".rar") returned 4 [0079.306] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString=".bz2") returned 4 [0079.306] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString=".7z") returned 3 [0079.306] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.306] lstrlenW (lpString=".dbf") returned 4 [0079.306] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.306] lstrlenW (lpString=".1cd") returned 4 [0079.306] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0079.306] lstrlenW (lpString=".jpg") returned 4 [0079.306] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.306] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") [0079.307] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15776) returned 1 [0079.308] CloseHandle (hObject=0x15c) returned 1 [0079.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0079.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.308] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.308] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.309] GetLastError () returned 0x0 [0079.309] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3da0, lpOverlapped=0x0) returned 1 [0079.368] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0079.370] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.370] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.370] SetEndOfFile (hFile=0x180) returned 1 [0079.370] CloseHandle (hObject=0x180) returned 1 [0079.370] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.370] SetEndOfFile (hFile=0x15c) returned 1 [0079.371] CloseHandle (hObject=0x15c) returned 1 [0079.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.371] lstrlenW (lpString=".doc") returned 4 [0079.371] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.371] lstrlenW (lpString=".docx") returned 5 [0079.371] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0079.371] lstrlenW (lpString=".pdf") returned 4 [0079.372] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.372] lstrlenW (lpString=".xls") returned 4 [0079.372] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.372] lstrlenW (lpString=".xlsx") returned 5 [0079.372] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0079.372] lstrlenW (lpString=".ppt") returned 4 [0079.372] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.372] lstrlenW (lpString=".zip") returned 4 [0079.372] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.372] lstrlenW (lpString=".rar") returned 4 [0079.372] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.372] lstrlenW (lpString=".bz2") returned 4 [0079.372] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.372] lstrlenW (lpString=".7z") returned 3 [0079.372] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.372] lstrlenW (lpString=".dbf") returned 4 [0079.372] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.372] lstrlenW (lpString=".1cd") returned 4 [0079.372] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0079.372] lstrlenW (lpString=".jpg") returned 4 [0079.372] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.372] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") [0079.377] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15256) returned 1 [0079.378] CloseHandle (hObject=0x15c) returned 1 [0079.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0079.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.378] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.378] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.379] GetLastError () returned 0x0 [0079.379] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3b98, lpOverlapped=0x0) returned 1 [0079.396] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3ba0, lpOverlapped=0x0) returned 1 [0079.397] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.397] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.397] SetEndOfFile (hFile=0x180) returned 1 [0079.398] CloseHandle (hObject=0x180) returned 1 [0079.398] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.398] SetEndOfFile (hFile=0x15c) returned 1 [0079.399] CloseHandle (hObject=0x15c) returned 1 [0079.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 1 [0079.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.399] lstrlenW (lpString=".doc") returned 4 [0079.399] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.399] lstrlenW (lpString=".docx") returned 5 [0079.399] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0079.399] lstrlenW (lpString=".pdf") returned 4 [0079.400] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.404] lstrlenW (lpString=".xls") returned 4 [0079.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.409] lstrlenW (lpString=".xlsx") returned 5 [0079.409] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0079.409] lstrlenW (lpString=".ppt") returned 4 [0079.409] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.409] lstrlenW (lpString=".zip") returned 4 [0079.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.409] lstrlenW (lpString=".rar") returned 4 [0079.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.410] lstrlenW (lpString=".bz2") returned 4 [0079.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.410] lstrlenW (lpString=".7z") returned 3 [0079.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.410] lstrlenW (lpString=".dbf") returned 4 [0079.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.410] lstrlenW (lpString=".1cd") returned 4 [0079.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0079.410] lstrlenW (lpString=".jpg") returned 4 [0079.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.410] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") [0079.410] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15776) returned 1 [0079.410] CloseHandle (hObject=0x15c) returned 1 [0079.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0079.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.411] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.411] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.689] GetLastError () returned 0x0 [0079.689] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3da0, lpOverlapped=0x0) returned 1 [0079.691] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0079.692] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.692] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.692] SetEndOfFile (hFile=0x22c) returned 1 [0079.692] CloseHandle (hObject=0x22c) returned 1 [0079.692] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.692] SetEndOfFile (hFile=0x15c) returned 1 [0079.693] CloseHandle (hObject=0x15c) returned 1 [0079.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 1 [0079.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.694] lstrlenW (lpString=".doc") returned 4 [0079.694] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString=".docx") returned 5 [0079.694] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0079.694] lstrlenW (lpString=".pdf") returned 4 [0079.694] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString=".xls") returned 4 [0079.694] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString=".xlsx") returned 5 [0079.694] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0079.694] lstrlenW (lpString=".ppt") returned 4 [0079.694] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.694] lstrlenW (lpString=".zip") returned 4 [0079.694] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString=".rar") returned 4 [0079.694] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.694] lstrlenW (lpString=".bz2") returned 4 [0079.694] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.694] lstrlenW (lpString=".7z") returned 3 [0079.694] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.694] lstrlenW (lpString=".dbf") returned 4 [0079.694] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.694] lstrlenW (lpString=".1cd") returned 4 [0079.694] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0079.694] lstrlenW (lpString=".jpg") returned 4 [0079.694] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.695] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") [0079.836] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=158600) returned 1 [0079.842] CloseHandle (hObject=0x210) returned 1 [0079.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0079.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.849] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.849] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.855] GetLastError () returned 0x0 [0079.855] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x26b88, lpOverlapped=0x0) returned 1 [0079.859] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x26b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x26b90, lpOverlapped=0x0) returned 1 [0079.862] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.862] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.862] SetEndOfFile (hFile=0x158) returned 1 [0079.862] CloseHandle (hObject=0x158) returned 1 [0079.862] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.862] SetEndOfFile (hFile=0x210) returned 1 [0079.864] CloseHandle (hObject=0x210) returned 1 [0079.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 1 [0079.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.864] lstrlenW (lpString=".doc") returned 4 [0079.864] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.864] lstrlenW (lpString=".docx") returned 5 [0079.864] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0079.864] lstrlenW (lpString=".pdf") returned 4 [0079.864] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.864] lstrlenW (lpString=".xls") returned 4 [0079.864] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.864] lstrlenW (lpString=".xlsx") returned 5 [0079.864] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0079.864] lstrlenW (lpString=".ppt") returned 4 [0079.864] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.864] lstrlenW (lpString=".zip") returned 4 [0079.864] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.865] lstrlenW (lpString=".rar") returned 4 [0079.865] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.865] lstrlenW (lpString=".bz2") returned 4 [0079.865] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.865] lstrlenW (lpString=".7z") returned 3 [0079.865] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.865] lstrlenW (lpString=".dbf") returned 4 [0079.865] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.865] lstrlenW (lpString=".1cd") returned 4 [0079.865] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0079.865] lstrlenW (lpString=".jpg") returned 4 [0079.865] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.865] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") [0079.866] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2144) returned 1 [0079.866] CloseHandle (hObject=0x210) returned 1 [0079.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0079.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.866] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.866] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.867] GetLastError () returned 0x0 [0079.867] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x860, lpOverlapped=0x0) returned 1 [0079.868] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x870, lpOverlapped=0x0) returned 1 [0079.869] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.869] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.869] SetEndOfFile (hFile=0x158) returned 1 [0079.870] CloseHandle (hObject=0x158) returned 1 [0079.870] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.870] SetEndOfFile (hFile=0x210) returned 1 [0079.870] CloseHandle (hObject=0x210) returned 1 [0079.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0079.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.871] lstrlenW (lpString=".doc") returned 4 [0079.871] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0079.871] lstrlenW (lpString=".docx") returned 5 [0079.871] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0079.871] lstrlenW (lpString=".pdf") returned 4 [0079.871] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0079.871] lstrlenW (lpString=".xls") returned 4 [0079.871] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0079.871] lstrlenW (lpString=".xlsx") returned 5 [0079.871] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0079.871] lstrlenW (lpString=".ppt") returned 4 [0079.871] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0079.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.871] lstrlenW (lpString=".zip") returned 4 [0079.871] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0079.871] lstrlenW (lpString=".rar") returned 4 [0079.871] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0079.871] lstrlenW (lpString=".bz2") returned 4 [0079.871] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0079.871] lstrlenW (lpString=".7z") returned 3 [0079.871] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0079.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.872] lstrlenW (lpString=".dbf") returned 4 [0079.872] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0079.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.872] lstrlenW (lpString=".1cd") returned 4 [0079.872] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0079.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0079.872] lstrlenW (lpString=".jpg") returned 4 [0079.872] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0079.872] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") [0079.872] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=12176) returned 1 [0079.872] CloseHandle (hObject=0x210) returned 1 [0079.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0079.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.873] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.873] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.873] GetLastError () returned 0x0 [0079.873] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2f90, lpOverlapped=0x0) returned 1 [0079.875] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2fa0, lpOverlapped=0x0) returned 1 [0079.876] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.876] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.876] SetEndOfFile (hFile=0x158) returned 1 [0079.876] CloseHandle (hObject=0x158) returned 1 [0079.876] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.876] SetEndOfFile (hFile=0x210) returned 1 [0079.877] CloseHandle (hObject=0x210) returned 1 [0079.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 1 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString=".doc") returned 4 [0079.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString=".docx") returned 5 [0079.878] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0079.878] lstrlenW (lpString=".pdf") returned 4 [0079.878] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString=".xls") returned 4 [0079.878] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString=".xlsx") returned 5 [0079.878] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0079.878] lstrlenW (lpString=".ppt") returned 4 [0079.878] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString=".zip") returned 4 [0079.878] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString=".rar") returned 4 [0079.878] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.878] lstrlenW (lpString=".bz2") returned 4 [0079.878] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.878] lstrlenW (lpString=".7z") returned 3 [0079.878] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString=".dbf") returned 4 [0079.878] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString=".1cd") returned 4 [0079.878] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0079.878] lstrlenW (lpString=".jpg") returned 4 [0079.878] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.879] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") [0079.879] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=19880) returned 1 [0079.879] CloseHandle (hObject=0x210) returned 1 [0079.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0079.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.879] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.879] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.880] GetLastError () returned 0x0 [0079.880] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4da8, lpOverlapped=0x0) returned 1 [0079.973] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4db0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4db0, lpOverlapped=0x0) returned 1 [0079.975] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.975] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.975] SetEndOfFile (hFile=0x158) returned 1 [0079.975] CloseHandle (hObject=0x158) returned 1 [0079.975] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.975] SetEndOfFile (hFile=0x210) returned 1 [0079.976] CloseHandle (hObject=0x210) returned 1 [0079.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 1 [0079.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.976] lstrlenW (lpString=".doc") returned 4 [0079.976] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.976] lstrlenW (lpString=".docx") returned 5 [0079.976] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0079.976] lstrlenW (lpString=".pdf") returned 4 [0079.977] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.977] lstrlenW (lpString=".xls") returned 4 [0079.977] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.977] lstrlenW (lpString=".xlsx") returned 5 [0079.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0079.977] lstrlenW (lpString=".ppt") returned 4 [0079.977] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.977] lstrlenW (lpString=".zip") returned 4 [0079.977] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.977] lstrlenW (lpString=".rar") returned 4 [0079.977] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.977] lstrlenW (lpString=".bz2") returned 4 [0079.977] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.977] lstrlenW (lpString=".7z") returned 3 [0079.977] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.977] lstrlenW (lpString=".dbf") returned 4 [0079.977] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.977] lstrlenW (lpString=".1cd") returned 4 [0079.977] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0079.977] lstrlenW (lpString=".jpg") returned 4 [0079.977] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.977] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") [0080.063] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=10632) returned 1 [0080.063] CloseHandle (hObject=0x150) returned 1 [0080.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20 [0080.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.063] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.063] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.064] GetLastError () returned 0x0 [0080.064] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2988, lpOverlapped=0x0) returned 1 [0080.066] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0080.067] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.067] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0080.067] SetEndOfFile (hFile=0x1c0) returned 1 [0080.068] CloseHandle (hObject=0x1c0) returned 1 [0080.068] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.068] SetEndOfFile (hFile=0x150) returned 1 [0080.068] CloseHandle (hObject=0x150) returned 1 [0080.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 1 [0080.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.069] lstrlenW (lpString=".doc") returned 4 [0080.069] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString=".docx") returned 5 [0080.069] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0080.069] lstrlenW (lpString=".pdf") returned 4 [0080.069] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString=".xls") returned 4 [0080.069] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString=".xlsx") returned 5 [0080.069] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0080.069] lstrlenW (lpString=".ppt") returned 4 [0080.069] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.069] lstrlenW (lpString=".zip") returned 4 [0080.069] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString=".rar") returned 4 [0080.069] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0080.069] lstrlenW (lpString=".bz2") returned 4 [0080.070] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0080.070] lstrlenW (lpString=".7z") returned 3 [0080.070] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.070] lstrlenW (lpString=".dbf") returned 4 [0080.070] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0080.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.070] lstrlenW (lpString=".1cd") returned 4 [0080.070] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0080.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0080.070] lstrlenW (lpString=".jpg") returned 4 [0080.070] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0080.070] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") [0080.071] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=64872) returned 1 [0080.071] CloseHandle (hObject=0x150) returned 1 [0080.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0080.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.071] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.072] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.072] GetLastError () returned 0x0 [0080.072] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xfd68, lpOverlapped=0x0) returned 1 [0080.075] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfd70, lpOverlapped=0x0) returned 1 [0080.076] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.076] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.077] SetEndOfFile (hFile=0x1c0) returned 1 [0080.077] CloseHandle (hObject=0x1c0) returned 1 [0080.077] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.077] SetEndOfFile (hFile=0x150) returned 1 [0080.078] CloseHandle (hObject=0x150) returned 1 [0080.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1 [0080.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.078] lstrlenW (lpString=".doc") returned 4 [0080.078] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0080.078] lstrlenW (lpString=".docx") returned 5 [0080.078] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0080.078] lstrlenW (lpString=".pdf") returned 4 [0080.079] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString=".xls") returned 4 [0080.079] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0080.079] lstrlenW (lpString=".xlsx") returned 5 [0080.079] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0080.079] lstrlenW (lpString=".ppt") returned 4 [0080.079] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.079] lstrlenW (lpString=".zip") returned 4 [0080.079] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0080.079] lstrlenW (lpString=".rar") returned 4 [0080.079] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString=".bz2") returned 4 [0080.079] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString=".7z") returned 3 [0080.079] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0080.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.079] lstrlenW (lpString=".dbf") returned 4 [0080.079] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.079] lstrlenW (lpString=".1cd") returned 4 [0080.079] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0080.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0080.079] lstrlenW (lpString=".jpg") returned 4 [0080.079] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0080.079] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") [0080.080] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=38752) returned 1 [0080.080] CloseHandle (hObject=0x150) returned 1 [0080.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0080.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.081] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.081] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.890] GetLastError () returned 0x0 [0080.890] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9760, lpOverlapped=0x0) returned 1 [0080.892] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9770, lpOverlapped=0x0) returned 1 [0080.893] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.893] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0080.893] SetEndOfFile (hFile=0x22c) returned 1 [0080.894] CloseHandle (hObject=0x22c) returned 1 [0080.894] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.894] SetEndOfFile (hFile=0x150) returned 1 [0080.895] CloseHandle (hObject=0x150) returned 1 [0080.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1 [0080.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.896] lstrlenW (lpString=".doc") returned 4 [0080.896] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString=".docx") returned 5 [0080.896] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0080.896] lstrlenW (lpString=".pdf") returned 4 [0080.896] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString=".xls") returned 4 [0080.896] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0080.896] lstrlenW (lpString=".xlsx") returned 5 [0080.896] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0080.896] lstrlenW (lpString=".ppt") returned 4 [0080.896] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.896] lstrlenW (lpString=".zip") returned 4 [0080.896] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0080.896] lstrlenW (lpString=".rar") returned 4 [0080.896] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString=".bz2") returned 4 [0080.896] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString=".7z") returned 3 [0080.896] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0080.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.896] lstrlenW (lpString=".dbf") returned 4 [0080.896] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.896] lstrlenW (lpString=".1cd") returned 4 [0080.896] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0080.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0080.896] lstrlenW (lpString=".jpg") returned 4 [0080.897] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0080.897] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") [0080.898] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=19840) returned 1 [0080.898] CloseHandle (hObject=0x150) returned 1 [0080.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20 [0080.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.898] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.898] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.901] GetLastError () returned 0x0 [0080.901] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4d80, lpOverlapped=0x0) returned 1 [0080.905] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4d90, lpOverlapped=0x0) returned 1 [0080.907] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.907] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0080.907] SetEndOfFile (hFile=0x22c) returned 1 [0080.907] CloseHandle (hObject=0x22c) returned 1 [0080.907] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.907] SetEndOfFile (hFile=0x150) returned 1 [0080.908] CloseHandle (hObject=0x150) returned 1 [0080.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 1 [0080.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.909] lstrlenW (lpString=".doc") returned 4 [0080.909] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString=".docx") returned 5 [0080.909] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0080.909] lstrlenW (lpString=".pdf") returned 4 [0080.909] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString=".xls") returned 4 [0080.909] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString=".xlsx") returned 5 [0080.909] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0080.909] lstrlenW (lpString=".ppt") returned 4 [0080.909] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.909] lstrlenW (lpString=".zip") returned 4 [0080.909] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString=".rar") returned 4 [0080.909] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0080.909] lstrlenW (lpString=".bz2") returned 4 [0080.909] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0080.909] lstrlenW (lpString=".7z") returned 3 [0080.909] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.909] lstrlenW (lpString=".dbf") returned 4 [0080.909] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0080.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.910] lstrlenW (lpString=".1cd") returned 4 [0080.910] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0080.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0080.910] lstrlenW (lpString=".jpg") returned 4 [0080.910] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0080.910] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") [0080.910] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=24456) returned 1 [0080.910] CloseHandle (hObject=0x150) returned 1 [0080.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20 [0080.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.911] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.911] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.911] GetLastError () returned 0x0 [0080.911] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5f88, lpOverlapped=0x0) returned 1 [0080.914] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5f90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5f90, lpOverlapped=0x0) returned 1 [0080.915] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.915] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0080.915] SetEndOfFile (hFile=0x22c) returned 1 [0080.916] CloseHandle (hObject=0x22c) returned 1 [0080.916] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.916] SetEndOfFile (hFile=0x150) returned 1 [0080.917] CloseHandle (hObject=0x150) returned 1 [0080.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 1 [0080.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.917] lstrlenW (lpString=".doc") returned 4 [0080.917] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.917] lstrlenW (lpString=".docx") returned 5 [0080.917] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0080.917] lstrlenW (lpString=".pdf") returned 4 [0080.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.917] lstrlenW (lpString=".xls") returned 4 [0080.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.917] lstrlenW (lpString=".xlsx") returned 5 [0080.917] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0080.917] lstrlenW (lpString=".ppt") returned 4 [0080.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.917] lstrlenW (lpString=".zip") returned 4 [0080.918] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.918] lstrlenW (lpString=".rar") returned 4 [0080.918] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.918] lstrlenW (lpString=".bz2") returned 4 [0080.918] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.918] lstrlenW (lpString=".7z") returned 3 [0080.918] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.918] lstrlenW (lpString=".dbf") returned 4 [0080.918] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.918] lstrlenW (lpString=".1cd") returned 4 [0080.918] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0080.918] lstrlenW (lpString=".jpg") returned 4 [0080.918] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.918] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") [0080.919] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=17288) returned 1 [0080.919] CloseHandle (hObject=0x150) returned 1 [0080.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20 [0080.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.920] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.920] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.920] GetLastError () returned 0x0 [0080.920] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4388, lpOverlapped=0x0) returned 1 [0080.922] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4390, lpOverlapped=0x0) returned 1 [0080.924] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.924] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.924] SetEndOfFile (hFile=0x22c) returned 1 [0080.924] CloseHandle (hObject=0x22c) returned 1 [0080.924] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.924] SetEndOfFile (hFile=0x150) returned 1 [0080.925] CloseHandle (hObject=0x150) returned 1 [0080.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 1 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.926] lstrlenW (lpString=".doc") returned 4 [0080.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString=".docx") returned 5 [0080.926] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0080.926] lstrlenW (lpString=".pdf") returned 4 [0080.926] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString=".xls") returned 4 [0080.926] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString=".xlsx") returned 5 [0080.926] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0080.926] lstrlenW (lpString=".ppt") returned 4 [0080.926] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.926] lstrlenW (lpString=".zip") returned 4 [0080.926] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString=".rar") returned 4 [0080.926] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0080.926] lstrlenW (lpString=".bz2") returned 4 [0080.926] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0080.926] lstrlenW (lpString=".7z") returned 3 [0080.926] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.926] lstrlenW (lpString=".dbf") returned 4 [0080.926] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.926] lstrlenW (lpString=".1cd") returned 4 [0080.926] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0080.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0080.927] lstrlenW (lpString=".jpg") returned 4 [0080.927] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0080.927] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") [0080.927] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=13696) returned 1 [0080.927] CloseHandle (hObject=0x150) returned 1 [0080.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0080.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0080.928] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.928] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.929] GetLastError () returned 0x0 [0080.929] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3580, lpOverlapped=0x0) returned 1 [0080.931] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0080.932] ReadFile (in: hFile=0x150, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.932] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0080.932] SetEndOfFile (hFile=0x22c) returned 1 [0080.932] CloseHandle (hObject=0x22c) returned 1 [0080.932] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.932] SetEndOfFile (hFile=0x150) returned 1 [0080.933] CloseHandle (hObject=0x150) returned 1 [0080.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString=".doc") returned 4 [0080.934] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".docx") returned 5 [0080.934] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0080.934] lstrlenW (lpString=".pdf") returned 4 [0080.934] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".xls") returned 4 [0080.934] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".xlsx") returned 5 [0080.934] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0080.934] lstrlenW (lpString=".ppt") returned 4 [0080.934] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString=".zip") returned 4 [0080.934] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".rar") returned 4 [0080.934] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".bz2") returned 4 [0080.934] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString=".7z") returned 3 [0080.934] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString=".dbf") returned 4 [0080.934] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString=".1cd") returned 4 [0080.934] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0080.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.934] lstrlenW (lpString=".jpg") returned 4 [0080.935] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".docx") returned 5 [0080.935] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0080.935] lstrlenW (lpString=".pdf") returned 4 [0080.935] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".xls") returned 4 [0080.935] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".xlsx") returned 5 [0080.935] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0080.935] lstrlenW (lpString=".ppt") returned 4 [0080.935] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.935] lstrlenW (lpString=".zip") returned 4 [0080.935] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".rar") returned 4 [0080.935] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".bz2") returned 4 [0080.935] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString=".7z") returned 3 [0080.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0080.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.935] lstrlenW (lpString=".dbf") returned 4 [0080.935] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.935] lstrlenW (lpString=".1cd") returned 4 [0080.935] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0080.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0080.935] lstrlenW (lpString=".jpg") returned 4 [0080.935] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0080.935] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") [0081.017] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1699) returned 1 [0081.017] CloseHandle (hObject=0x1f0) returned 1 [0081.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0081.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0081.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.018] GetLastError () returned 0x0 [0081.018] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6a3, lpOverlapped=0x0) returned 1 [0081.035] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0081.036] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.036] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0081.036] SetEndOfFile (hFile=0x1fc) returned 1 [0081.037] CloseHandle (hObject=0x1fc) returned 1 [0081.037] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.037] SetEndOfFile (hFile=0x1f0) returned 1 [0081.038] CloseHandle (hObject=0x1f0) returned 1 [0081.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1 [0081.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.038] lstrlenW (lpString=".doc") returned 4 [0081.038] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0081.038] lstrlenW (lpString=".docx") returned 5 [0081.038] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0081.038] lstrlenW (lpString=".pdf") returned 4 [0081.038] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0081.038] lstrlenW (lpString=".xls") returned 4 [0081.038] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0081.038] lstrlenW (lpString=".xlsx") returned 5 [0081.038] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0081.038] lstrlenW (lpString=".ppt") returned 4 [0081.038] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0081.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.038] lstrlenW (lpString=".zip") returned 4 [0081.038] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0081.038] lstrlenW (lpString=".rar") returned 4 [0081.039] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0081.039] lstrlenW (lpString=".bz2") returned 4 [0081.039] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0081.039] lstrlenW (lpString=".7z") returned 3 [0081.039] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0081.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.039] lstrlenW (lpString=".dbf") returned 4 [0081.039] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0081.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.039] lstrlenW (lpString=".1cd") returned 4 [0081.039] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0081.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0081.039] lstrlenW (lpString=".jpg") returned 4 [0081.039] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0081.039] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") [0081.039] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=205) returned 1 [0081.039] CloseHandle (hObject=0x1f0) returned 1 [0081.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0081.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0081.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.041] GetLastError () returned 0x0 [0081.041] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xcd, lpOverlapped=0x0) returned 1 [0081.042] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0081.043] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.043] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0081.043] SetEndOfFile (hFile=0x1fc) returned 1 [0081.043] CloseHandle (hObject=0x1fc) returned 1 [0081.043] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.043] SetEndOfFile (hFile=0x1f0) returned 1 [0081.044] CloseHandle (hObject=0x1f0) returned 1 [0081.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1 [0081.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.044] lstrlenW (lpString=".doc") returned 4 [0081.044] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0081.044] lstrlenW (lpString=".docx") returned 5 [0081.044] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0081.044] lstrlenW (lpString=".pdf") returned 4 [0081.044] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0081.044] lstrlenW (lpString=".xls") returned 4 [0081.044] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0081.045] lstrlenW (lpString=".xlsx") returned 5 [0081.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0081.045] lstrlenW (lpString=".ppt") returned 4 [0081.045] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0081.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.045] lstrlenW (lpString=".zip") returned 4 [0081.045] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0081.045] lstrlenW (lpString=".rar") returned 4 [0081.045] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0081.045] lstrlenW (lpString=".bz2") returned 4 [0081.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0081.045] lstrlenW (lpString=".7z") returned 3 [0081.045] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0081.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.045] lstrlenW (lpString=".dbf") returned 4 [0081.045] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0081.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.045] lstrlenW (lpString=".1cd") returned 4 [0081.045] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0081.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0081.045] lstrlenW (lpString=".jpg") returned 4 [0081.045] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0081.045] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") [0081.046] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0081.046] CloseHandle (hObject=0x1f0) returned 1 [0081.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0081.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0081.046] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.046] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.047] GetLastError () returned 0x0 [0081.047] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0081.048] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0081.049] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.049] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0081.049] SetEndOfFile (hFile=0x1fc) returned 1 [0081.049] CloseHandle (hObject=0x1fc) returned 1 [0081.049] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.049] SetEndOfFile (hFile=0x1f0) returned 1 [0081.050] CloseHandle (hObject=0x1f0) returned 1 [0081.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1 [0081.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.050] lstrlenW (lpString=".doc") returned 4 [0081.050] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0081.050] lstrlenW (lpString=".docx") returned 5 [0081.050] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0081.050] lstrlenW (lpString=".pdf") returned 4 [0081.050] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0081.050] lstrlenW (lpString=".xls") returned 4 [0081.050] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0081.050] lstrlenW (lpString=".xlsx") returned 5 [0081.050] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0081.050] lstrlenW (lpString=".ppt") returned 4 [0081.050] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0081.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.051] lstrlenW (lpString=".zip") returned 4 [0081.051] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0081.051] lstrlenW (lpString=".rar") returned 4 [0081.051] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0081.051] lstrlenW (lpString=".bz2") returned 4 [0081.051] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0081.051] lstrlenW (lpString=".7z") returned 3 [0081.051] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0081.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.051] lstrlenW (lpString=".dbf") returned 4 [0081.051] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0081.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.051] lstrlenW (lpString=".1cd") returned 4 [0081.051] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0081.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0081.051] lstrlenW (lpString=".jpg") returned 4 [0081.051] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0081.051] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") [0081.052] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0081.052] CloseHandle (hObject=0x1f0) returned 1 [0081.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0081.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0081.052] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.052] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.053] GetLastError () returned 0x0 [0081.053] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0081.054] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0081.055] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.055] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0081.055] SetEndOfFile (hFile=0x1fc) returned 1 [0081.055] CloseHandle (hObject=0x1fc) returned 1 [0081.055] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.055] SetEndOfFile (hFile=0x1f0) returned 1 [0081.056] CloseHandle (hObject=0x1f0) returned 1 [0081.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1 [0081.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.056] lstrlenW (lpString=".doc") returned 4 [0081.056] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0081.056] lstrlenW (lpString=".docx") returned 5 [0081.056] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0081.056] lstrlenW (lpString=".pdf") returned 4 [0081.056] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0081.056] lstrlenW (lpString=".xls") returned 4 [0081.056] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0081.056] lstrlenW (lpString=".xlsx") returned 5 [0081.056] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0081.056] lstrlenW (lpString=".ppt") returned 4 [0081.057] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0081.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.057] lstrlenW (lpString=".zip") returned 4 [0081.057] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0081.057] lstrlenW (lpString=".rar") returned 4 [0081.057] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0081.057] lstrlenW (lpString=".bz2") returned 4 [0081.057] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0081.057] lstrlenW (lpString=".7z") returned 3 [0081.057] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0081.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.057] lstrlenW (lpString=".dbf") returned 4 [0081.057] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0081.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.057] lstrlenW (lpString=".1cd") returned 4 [0081.057] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0081.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0081.057] lstrlenW (lpString=".jpg") returned 4 [0081.057] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0081.057] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") [0082.387] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=12160) returned 1 [0082.387] CloseHandle (hObject=0x15c) returned 1 [0082.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20 [0082.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.388] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.388] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.332] GetLastError () returned 0x0 [0083.332] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2f80, lpOverlapped=0x0) returned 1 [0083.333] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2f90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2f90, lpOverlapped=0x0) returned 1 [0083.334] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.334] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.335] SetEndOfFile (hFile=0x1f0) returned 1 [0083.335] CloseHandle (hObject=0x1f0) returned 1 [0083.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.335] SetEndOfFile (hFile=0x15c) returned 1 [0083.336] CloseHandle (hObject=0x15c) returned 1 [0083.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.336] lstrlenW (lpString=".doc") returned 4 [0083.336] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0083.336] lstrlenW (lpString=".docx") returned 5 [0083.336] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0083.336] lstrlenW (lpString=".pdf") returned 4 [0083.336] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0083.336] lstrlenW (lpString=".xls") returned 4 [0083.336] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0083.336] lstrlenW (lpString=".xlsx") returned 5 [0083.337] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0083.337] lstrlenW (lpString=".ppt") returned 4 [0083.337] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.337] lstrlenW (lpString=".zip") returned 4 [0083.337] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0083.337] lstrlenW (lpString=".rar") returned 4 [0083.337] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0083.337] lstrlenW (lpString=".bz2") returned 4 [0083.337] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0083.337] lstrlenW (lpString=".7z") returned 3 [0083.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.337] lstrlenW (lpString=".dbf") returned 4 [0083.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.337] lstrlenW (lpString=".1cd") returned 4 [0083.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0083.337] lstrlenW (lpString=".jpg") returned 4 [0083.337] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0083.337] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") [0083.338] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=666) returned 1 [0083.338] CloseHandle (hObject=0x15c) returned 1 [0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.338] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.338] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.339] GetLastError () returned 0x0 [0083.339] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x29a, lpOverlapped=0x0) returned 1 [0083.340] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0083.341] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.341] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x100, lpOverlapped=0x0) returned 1 [0083.342] SetEndOfFile (hFile=0x1f0) returned 1 [0083.342] CloseHandle (hObject=0x1f0) returned 1 [0083.342] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.342] SetEndOfFile (hFile=0x15c) returned 1 [0083.343] CloseHandle (hObject=0x15c) returned 1 [0083.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1 [0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.343] lstrlenW (lpString=".doc") returned 4 [0083.343] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0083.343] lstrlenW (lpString=".docx") returned 5 [0083.343] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0083.343] lstrlenW (lpString=".pdf") returned 4 [0083.343] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0083.343] lstrlenW (lpString=".xls") returned 4 [0083.343] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0083.343] lstrlenW (lpString=".xlsx") returned 5 [0083.343] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0083.343] lstrlenW (lpString=".ppt") returned 4 [0083.343] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0083.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.343] lstrlenW (lpString=".zip") returned 4 [0083.343] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0083.343] lstrlenW (lpString=".rar") returned 4 [0083.343] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0083.343] lstrlenW (lpString=".bz2") returned 4 [0083.344] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0083.344] lstrlenW (lpString=".7z") returned 3 [0083.344] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.344] lstrlenW (lpString=".dbf") returned 4 [0083.344] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.344] lstrlenW (lpString=".1cd") returned 4 [0083.344] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0083.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0083.344] lstrlenW (lpString=".jpg") returned 4 [0083.344] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0083.344] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") [0083.345] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=214) returned 1 [0083.345] CloseHandle (hObject=0x15c) returned 1 [0083.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0083.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.345] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.345] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.346] GetLastError () returned 0x0 [0083.346] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd6, lpOverlapped=0x0) returned 1 [0083.347] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0083.348] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.348] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x100, lpOverlapped=0x0) returned 1 [0083.348] SetEndOfFile (hFile=0x1f0) returned 1 [0083.348] CloseHandle (hObject=0x1f0) returned 1 [0083.348] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.348] SetEndOfFile (hFile=0x15c) returned 1 [0083.349] CloseHandle (hObject=0x15c) returned 1 [0083.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1 [0083.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString=".doc") returned 4 [0083.350] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0083.350] lstrlenW (lpString=".docx") returned 5 [0083.350] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0083.350] lstrlenW (lpString=".pdf") returned 4 [0083.350] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0083.350] lstrlenW (lpString=".xls") returned 4 [0083.350] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0083.350] lstrlenW (lpString=".xlsx") returned 5 [0083.350] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0083.350] lstrlenW (lpString=".ppt") returned 4 [0083.350] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0083.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString=".zip") returned 4 [0083.350] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0083.350] lstrlenW (lpString=".rar") returned 4 [0083.350] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0083.350] lstrlenW (lpString=".bz2") returned 4 [0083.350] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0083.350] lstrlenW (lpString=".7z") returned 3 [0083.350] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0083.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString=".dbf") returned 4 [0083.350] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0083.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString=".1cd") returned 4 [0083.350] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0083.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0083.350] lstrlenW (lpString=".jpg") returned 4 [0083.350] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0083.351] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") [0083.351] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0083.351] CloseHandle (hObject=0x15c) returned 1 [0083.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0083.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.351] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.351] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.352] GetLastError () returned 0x0 [0083.352] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0083.353] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0083.354] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.354] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x104, lpOverlapped=0x0) returned 1 [0083.354] SetEndOfFile (hFile=0x1f0) returned 1 [0083.354] CloseHandle (hObject=0x1f0) returned 1 [0083.354] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.354] SetEndOfFile (hFile=0x15c) returned 1 [0083.355] CloseHandle (hObject=0x15c) returned 1 [0083.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.355] lstrlenW (lpString=".doc") returned 4 [0083.355] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0083.356] lstrlenW (lpString=".docx") returned 5 [0083.356] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0083.356] lstrlenW (lpString=".pdf") returned 4 [0083.356] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0083.356] lstrlenW (lpString=".xls") returned 4 [0083.356] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0083.356] lstrlenW (lpString=".xlsx") returned 5 [0083.356] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0083.356] lstrlenW (lpString=".ppt") returned 4 [0083.356] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.356] lstrlenW (lpString=".zip") returned 4 [0083.356] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0083.356] lstrlenW (lpString=".rar") returned 4 [0083.356] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0083.356] lstrlenW (lpString=".bz2") returned 4 [0083.356] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0083.356] lstrlenW (lpString=".7z") returned 3 [0083.356] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.356] lstrlenW (lpString=".dbf") returned 4 [0083.356] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.356] lstrlenW (lpString=".1cd") returned 4 [0083.356] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0083.356] lstrlenW (lpString=".jpg") returned 4 [0083.356] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0083.356] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") [0083.357] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0083.357] CloseHandle (hObject=0x15c) returned 1 [0083.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0083.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.357] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.357] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.358] GetLastError () returned 0x0 [0083.358] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0083.359] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0083.360] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.360] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x104, lpOverlapped=0x0) returned 1 [0083.360] SetEndOfFile (hFile=0x1f0) returned 1 [0083.360] CloseHandle (hObject=0x1f0) returned 1 [0083.360] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.360] SetEndOfFile (hFile=0x15c) returned 1 [0083.361] CloseHandle (hObject=0x15c) returned 1 [0083.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1 [0083.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.361] lstrlenW (lpString=".doc") returned 4 [0083.361] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0083.361] lstrlenW (lpString=".docx") returned 5 [0083.361] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0083.361] lstrlenW (lpString=".pdf") returned 4 [0083.361] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0083.361] lstrlenW (lpString=".xls") returned 4 [0083.361] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0083.361] lstrlenW (lpString=".xlsx") returned 5 [0083.361] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0083.362] lstrlenW (lpString=".ppt") returned 4 [0083.362] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.362] lstrlenW (lpString=".zip") returned 4 [0083.362] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0083.362] lstrlenW (lpString=".rar") returned 4 [0083.362] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0083.362] lstrlenW (lpString=".bz2") returned 4 [0083.362] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0083.362] lstrlenW (lpString=".7z") returned 3 [0083.362] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.362] lstrlenW (lpString=".dbf") returned 4 [0083.362] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.362] lstrlenW (lpString=".1cd") returned 4 [0083.362] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0083.362] lstrlenW (lpString=".jpg") returned 4 [0083.362] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0083.362] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") [0083.363] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=636) returned 1 [0083.363] CloseHandle (hObject=0x15c) returned 1 [0083.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20 [0083.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.364] GetLastError () returned 0x0 [0083.364] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x27c, lpOverlapped=0x0) returned 1 [0083.394] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x280, lpOverlapped=0x0) returned 1 [0083.395] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.395] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0083.395] SetEndOfFile (hFile=0x1f0) returned 1 [0083.395] CloseHandle (hObject=0x1f0) returned 1 [0083.395] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.395] SetEndOfFile (hFile=0x15c) returned 1 [0083.396] CloseHandle (hObject=0x15c) returned 1 [0083.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1 [0083.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.396] lstrlenW (lpString=".doc") returned 4 [0083.396] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0083.396] lstrlenW (lpString=".docx") returned 5 [0083.396] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0083.396] lstrlenW (lpString=".pdf") returned 4 [0083.396] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0083.396] lstrlenW (lpString=".xls") returned 4 [0083.396] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0083.396] lstrlenW (lpString=".xlsx") returned 5 [0083.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0083.397] lstrlenW (lpString=".ppt") returned 4 [0083.397] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.397] lstrlenW (lpString=".zip") returned 4 [0083.397] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0083.397] lstrlenW (lpString=".rar") returned 4 [0083.397] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0083.397] lstrlenW (lpString=".bz2") returned 4 [0083.397] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0083.397] lstrlenW (lpString=".7z") returned 3 [0083.397] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.397] lstrlenW (lpString=".dbf") returned 4 [0083.397] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.397] lstrlenW (lpString=".1cd") returned 4 [0083.397] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0083.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0083.397] lstrlenW (lpString=".jpg") returned 4 [0083.397] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0083.397] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") [0083.398] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=208) returned 1 [0083.398] CloseHandle (hObject=0x15c) returned 1 [0083.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20 [0083.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.398] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.398] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.399] GetLastError () returned 0x0 [0083.399] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd0, lpOverlapped=0x0) returned 1 [0083.400] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0083.401] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.401] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0083.401] SetEndOfFile (hFile=0x1f0) returned 1 [0083.401] CloseHandle (hObject=0x1f0) returned 1 [0083.401] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.401] SetEndOfFile (hFile=0x15c) returned 1 [0083.402] CloseHandle (hObject=0x15c) returned 1 [0083.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1 [0083.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.403] lstrlenW (lpString=".doc") returned 4 [0083.403] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0083.403] lstrlenW (lpString=".docx") returned 5 [0083.403] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0083.403] lstrlenW (lpString=".pdf") returned 4 [0083.403] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0083.403] lstrlenW (lpString=".xls") returned 4 [0083.403] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0083.403] lstrlenW (lpString=".xlsx") returned 5 [0083.403] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0083.403] lstrlenW (lpString=".ppt") returned 4 [0083.403] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0083.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.403] lstrlenW (lpString=".zip") returned 4 [0083.403] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0083.403] lstrlenW (lpString=".rar") returned 4 [0083.403] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0083.403] lstrlenW (lpString=".bz2") returned 4 [0083.403] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0083.403] lstrlenW (lpString=".7z") returned 3 [0083.403] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0083.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.403] lstrlenW (lpString=".dbf") returned 4 [0083.403] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0083.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.403] lstrlenW (lpString=".1cd") returned 4 [0083.403] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0083.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0083.403] lstrlenW (lpString=".jpg") returned 4 [0083.403] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0083.403] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") [0083.404] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0083.404] CloseHandle (hObject=0x15c) returned 1 [0083.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20 [0083.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.404] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.404] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.405] GetLastError () returned 0x0 [0083.405] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0083.406] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0083.407] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.407] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0083.407] SetEndOfFile (hFile=0x1f0) returned 1 [0083.407] CloseHandle (hObject=0x1f0) returned 1 [0083.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.407] SetEndOfFile (hFile=0x15c) returned 1 [0083.408] CloseHandle (hObject=0x15c) returned 1 [0083.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1 [0083.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.408] lstrlenW (lpString=".doc") returned 4 [0083.408] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0083.408] lstrlenW (lpString=".docx") returned 5 [0083.409] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0083.409] lstrlenW (lpString=".pdf") returned 4 [0083.409] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0083.409] lstrlenW (lpString=".xls") returned 4 [0083.409] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0083.409] lstrlenW (lpString=".xlsx") returned 5 [0083.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0083.409] lstrlenW (lpString=".ppt") returned 4 [0083.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0083.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.409] lstrlenW (lpString=".zip") returned 4 [0083.409] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0083.409] lstrlenW (lpString=".rar") returned 4 [0083.409] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0083.409] lstrlenW (lpString=".bz2") returned 4 [0083.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0083.409] lstrlenW (lpString=".7z") returned 3 [0083.409] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0083.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.409] lstrlenW (lpString=".dbf") returned 4 [0083.409] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0083.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.409] lstrlenW (lpString=".1cd") returned 4 [0083.409] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0083.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0083.409] lstrlenW (lpString=".jpg") returned 4 [0083.409] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0083.409] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") [0083.410] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0083.410] CloseHandle (hObject=0x15c) returned 1 [0083.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20 [0083.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.410] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.410] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.411] GetLastError () returned 0x0 [0083.411] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0083.412] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0083.413] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.413] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0083.413] SetEndOfFile (hFile=0x1f0) returned 1 [0083.413] CloseHandle (hObject=0x1f0) returned 1 [0083.413] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.413] SetEndOfFile (hFile=0x15c) returned 1 [0083.414] CloseHandle (hObject=0x15c) returned 1 [0083.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1 [0083.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.414] lstrlenW (lpString=".doc") returned 4 [0083.414] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0083.414] lstrlenW (lpString=".docx") returned 5 [0083.415] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0083.415] lstrlenW (lpString=".pdf") returned 4 [0083.415] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0083.415] lstrlenW (lpString=".xls") returned 4 [0083.415] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0083.415] lstrlenW (lpString=".xlsx") returned 5 [0083.415] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0083.415] lstrlenW (lpString=".ppt") returned 4 [0083.415] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0083.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.415] lstrlenW (lpString=".zip") returned 4 [0083.415] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0083.415] lstrlenW (lpString=".rar") returned 4 [0083.415] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0083.415] lstrlenW (lpString=".bz2") returned 4 [0083.415] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0083.415] lstrlenW (lpString=".7z") returned 3 [0083.415] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0083.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.415] lstrlenW (lpString=".dbf") returned 4 [0083.415] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0083.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.415] lstrlenW (lpString=".1cd") returned 4 [0083.415] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0083.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0083.415] lstrlenW (lpString=".jpg") returned 4 [0083.415] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0083.415] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") [0083.416] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1899) returned 1 [0083.417] CloseHandle (hObject=0x15c) returned 1 [0083.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20 [0083.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.417] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.417] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.417] GetLastError () returned 0x0 [0083.418] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x76b, lpOverlapped=0x0) returned 1 [0083.419] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x770, lpOverlapped=0x0) returned 1 [0083.420] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.420] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.420] SetEndOfFile (hFile=0x1f0) returned 1 [0083.420] CloseHandle (hObject=0x1f0) returned 1 [0083.420] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.420] SetEndOfFile (hFile=0x15c) returned 1 [0083.421] CloseHandle (hObject=0x15c) returned 1 [0083.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1 [0083.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.421] lstrlenW (lpString=".doc") returned 4 [0083.421] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0083.421] lstrlenW (lpString=".docx") returned 5 [0083.421] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0083.422] lstrlenW (lpString=".pdf") returned 4 [0083.422] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString=".xls") returned 4 [0083.422] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0083.422] lstrlenW (lpString=".xlsx") returned 5 [0083.422] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0083.422] lstrlenW (lpString=".ppt") returned 4 [0083.422] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.422] lstrlenW (lpString=".zip") returned 4 [0083.422] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0083.422] lstrlenW (lpString=".rar") returned 4 [0083.422] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString=".bz2") returned 4 [0083.422] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString=".7z") returned 3 [0083.422] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0083.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.422] lstrlenW (lpString=".dbf") returned 4 [0083.422] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.422] lstrlenW (lpString=".1cd") returned 4 [0083.422] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0083.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0083.422] lstrlenW (lpString=".jpg") returned 4 [0083.422] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0083.422] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") [0083.423] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=818) returned 1 [0083.423] CloseHandle (hObject=0x15c) returned 1 [0083.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20 [0083.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.423] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.423] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0083.424] GetLastError () returned 0x0 [0083.424] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x332, lpOverlapped=0x0) returned 1 [0083.426] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x340, lpOverlapped=0x0) returned 1 [0083.426] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.426] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.427] SetEndOfFile (hFile=0x1f0) returned 1 [0083.427] CloseHandle (hObject=0x1f0) returned 1 [0083.427] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.427] SetEndOfFile (hFile=0x15c) returned 1 [0083.428] CloseHandle (hObject=0x15c) returned 1 [0083.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.428] lstrlenW (lpString=".doc") returned 4 [0083.428] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0083.428] lstrlenW (lpString=".docx") returned 5 [0083.428] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0083.428] lstrlenW (lpString=".pdf") returned 4 [0083.428] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0083.428] lstrlenW (lpString=".xls") returned 4 [0083.428] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0083.428] lstrlenW (lpString=".xlsx") returned 5 [0083.428] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0083.428] lstrlenW (lpString=".ppt") returned 4 [0083.428] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.428] lstrlenW (lpString=".zip") returned 4 [0083.428] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0083.428] lstrlenW (lpString=".rar") returned 4 [0083.428] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0083.429] lstrlenW (lpString=".bz2") returned 4 [0083.429] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0083.429] lstrlenW (lpString=".7z") returned 3 [0083.429] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0083.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.429] lstrlenW (lpString=".dbf") returned 4 [0083.429] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0083.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.429] lstrlenW (lpString=".1cd") returned 4 [0083.429] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0083.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0083.429] lstrlenW (lpString=".jpg") returned 4 [0083.429] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0083.429] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") [0083.429] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2270608) returned 1 [0083.430] CloseHandle (hObject=0x15c) returned 1 [0083.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20 [0083.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0083.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0083.431] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0083.431] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.431] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.607] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xb8c85, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.607] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.613] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0083.613] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x1ea590, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.613] ReadFile (in: hFile=0x15c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.636] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.636] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0083.691] SetEndOfFile (hFile=0x15c) returned 1 [0083.816] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0083.861] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.861] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.863] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xb8c85, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.863] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.865] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x1ea590, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.865] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.866] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0083.866] CloseHandle (hObject=0x15c) returned 1 [0083.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.866] lstrlenW (lpString=".doc") returned 4 [0083.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0083.866] lstrlenW (lpString=".docx") returned 5 [0083.866] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0083.866] lstrlenW (lpString=".pdf") returned 4 [0083.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0083.866] lstrlenW (lpString=".xls") returned 4 [0083.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0083.867] lstrlenW (lpString=".xlsx") returned 5 [0083.867] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0083.867] lstrlenW (lpString=".ppt") returned 4 [0083.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.867] lstrlenW (lpString=".zip") returned 4 [0083.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0083.867] lstrlenW (lpString=".rar") returned 4 [0083.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0083.867] lstrlenW (lpString=".bz2") returned 4 [0083.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0083.867] lstrlenW (lpString=".7z") returned 3 [0083.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.867] lstrlenW (lpString=".dbf") returned 4 [0083.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.867] lstrlenW (lpString=".1cd") returned 4 [0083.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0083.867] lstrlenW (lpString=".jpg") returned 4 [0083.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0083.867] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") [0084.307] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=108416) returned 1 [0084.307] CloseHandle (hObject=0x1c8) returned 1 [0084.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20 [0084.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0084.338] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.338] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0084.664] GetLastError () returned 0x0 [0084.664] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0084.972] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0085.003] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.003] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0085.003] SetEndOfFile (hFile=0x15c) returned 1 [0085.003] CloseHandle (hObject=0x15c) returned 1 [0085.003] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.003] SetEndOfFile (hFile=0x1c8) returned 1 [0085.005] CloseHandle (hObject=0x1c8) returned 1 [0085.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1 [0085.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.005] lstrlenW (lpString=".doc") returned 4 [0085.005] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0085.005] lstrlenW (lpString=".docx") returned 5 [0085.005] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0085.005] lstrlenW (lpString=".pdf") returned 4 [0085.005] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0085.005] lstrlenW (lpString=".xls") returned 4 [0085.005] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0085.005] lstrlenW (lpString=".xlsx") returned 5 [0085.005] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0085.005] lstrlenW (lpString=".ppt") returned 4 [0085.006] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.006] lstrlenW (lpString=".zip") returned 4 [0085.006] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".rar") returned 4 [0085.006] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".bz2") returned 4 [0085.006] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".7z") returned 3 [0085.006] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0085.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.006] lstrlenW (lpString=".dbf") returned 4 [0085.006] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.006] lstrlenW (lpString=".1cd") returned 4 [0085.006] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.006] lstrlenW (lpString=".jpg") returned 4 [0085.006] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".docx") returned 5 [0085.006] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0085.006] lstrlenW (lpString=".pdf") returned 4 [0085.006] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".xls") returned 4 [0085.006] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString=".xlsx") returned 5 [0085.006] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0085.006] lstrlenW (lpString=".ppt") returned 4 [0085.006] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0085.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.007] lstrlenW (lpString=".zip") returned 4 [0085.007] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0085.007] lstrlenW (lpString=".rar") returned 4 [0085.007] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0085.007] lstrlenW (lpString=".bz2") returned 4 [0085.007] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0085.007] lstrlenW (lpString=".7z") returned 3 [0085.007] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0085.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.007] lstrlenW (lpString=".dbf") returned 4 [0085.007] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0085.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.007] lstrlenW (lpString=".1cd") returned 4 [0085.007] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0085.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0085.007] lstrlenW (lpString=".jpg") returned 4 [0085.007] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0085.007] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") [0085.008] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=10745972) returned 1 [0085.008] CloseHandle (hObject=0x1c8) returned 1 [0085.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20 [0085.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0085.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.009] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0085.009] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.009] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.020] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x36a826, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.020] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.063] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.063] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x9ff874, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.063] ReadFile (in: hFile=0x1c8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.140] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.146] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0085.181] SetEndOfFile (hFile=0x1c8) returned 1 [0085.181] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0085.185] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.186] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x36a826, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.186] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.196] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x9ff874, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.196] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0085.198] CloseHandle (hObject=0x1c8) returned 1 [0085.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.198] lstrlenW (lpString=".doc") returned 4 [0085.198] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.198] lstrlenW (lpString=".docx") returned 5 [0085.198] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0085.198] lstrlenW (lpString=".pdf") returned 4 [0085.198] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.198] lstrlenW (lpString=".xls") returned 4 [0085.198] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.198] lstrlenW (lpString=".xlsx") returned 5 [0085.198] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0085.198] lstrlenW (lpString=".ppt") returned 4 [0085.198] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.199] lstrlenW (lpString=".zip") returned 4 [0085.199] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.199] lstrlenW (lpString=".rar") returned 4 [0085.199] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.199] lstrlenW (lpString=".bz2") returned 4 [0085.199] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.199] lstrlenW (lpString=".7z") returned 3 [0085.199] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.199] lstrlenW (lpString=".dbf") returned 4 [0085.199] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.199] lstrlenW (lpString=".1cd") returned 4 [0085.199] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0085.199] lstrlenW (lpString=".jpg") returned 4 [0085.199] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.199] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") [0085.200] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=208) returned 1 [0085.200] CloseHandle (hObject=0x1c8) returned 1 [0085.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20 [0085.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.200] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.201] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.201] GetLastError () returned 0x0 [0085.202] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd0, lpOverlapped=0x0) returned 1 [0085.361] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0085.362] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.362] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0085.362] SetEndOfFile (hFile=0x1fc) returned 1 [0085.362] CloseHandle (hObject=0x1fc) returned 1 [0085.362] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.362] SetEndOfFile (hFile=0x1c8) returned 1 [0085.366] CloseHandle (hObject=0x1c8) returned 1 [0085.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.367] lstrlenW (lpString=".doc") returned 4 [0085.367] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0085.367] lstrlenW (lpString=".docx") returned 5 [0085.367] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0085.367] lstrlenW (lpString=".pdf") returned 4 [0085.367] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0085.367] lstrlenW (lpString=".xls") returned 4 [0085.367] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0085.367] lstrlenW (lpString=".xlsx") returned 5 [0085.367] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0085.367] lstrlenW (lpString=".ppt") returned 4 [0085.367] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.367] lstrlenW (lpString=".zip") returned 4 [0085.367] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0085.367] lstrlenW (lpString=".rar") returned 4 [0085.367] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0085.367] lstrlenW (lpString=".bz2") returned 4 [0085.367] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0085.367] lstrlenW (lpString=".7z") returned 3 [0085.367] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.367] lstrlenW (lpString=".dbf") returned 4 [0085.368] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0085.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.368] lstrlenW (lpString=".1cd") returned 4 [0085.368] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0085.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0085.368] lstrlenW (lpString=".jpg") returned 4 [0085.368] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0085.368] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") [0085.369] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=205) returned 1 [0085.369] CloseHandle (hObject=0x1c8) returned 1 [0085.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20 [0085.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.369] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.369] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.370] GetLastError () returned 0x0 [0085.370] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xcd, lpOverlapped=0x0) returned 1 [0085.372] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0085.373] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.373] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0085.373] SetEndOfFile (hFile=0x1fc) returned 1 [0085.373] CloseHandle (hObject=0x1fc) returned 1 [0085.373] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.373] SetEndOfFile (hFile=0x1c8) returned 1 [0085.374] CloseHandle (hObject=0x1c8) returned 1 [0085.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1 [0085.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.375] lstrlenW (lpString=".doc") returned 4 [0085.375] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0085.375] lstrlenW (lpString=".docx") returned 5 [0085.375] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0085.375] lstrlenW (lpString=".pdf") returned 4 [0085.375] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0085.375] lstrlenW (lpString=".xls") returned 4 [0085.375] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0085.375] lstrlenW (lpString=".xlsx") returned 5 [0085.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0085.376] lstrlenW (lpString=".ppt") returned 4 [0085.376] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0085.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.376] lstrlenW (lpString=".zip") returned 4 [0085.376] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0085.376] lstrlenW (lpString=".rar") returned 4 [0085.376] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0085.376] lstrlenW (lpString=".bz2") returned 4 [0085.376] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0085.376] lstrlenW (lpString=".7z") returned 3 [0085.376] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0085.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.376] lstrlenW (lpString=".dbf") returned 4 [0085.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0085.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.376] lstrlenW (lpString=".1cd") returned 4 [0085.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0085.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0085.376] lstrlenW (lpString=".jpg") returned 4 [0085.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0085.376] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") [0085.377] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0085.377] CloseHandle (hObject=0x1c8) returned 1 [0085.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20 [0085.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.377] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.378] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.378] GetLastError () returned 0x0 [0085.378] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0085.380] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.380] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.380] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0085.381] SetEndOfFile (hFile=0x1fc) returned 1 [0085.381] CloseHandle (hObject=0x1fc) returned 1 [0085.381] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.381] SetEndOfFile (hFile=0x1c8) returned 1 [0085.381] CloseHandle (hObject=0x1c8) returned 1 [0085.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1 [0085.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.382] lstrlenW (lpString=".doc") returned 4 [0085.382] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.382] lstrlenW (lpString=".docx") returned 5 [0085.382] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.382] lstrlenW (lpString=".pdf") returned 4 [0085.382] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.382] lstrlenW (lpString=".xls") returned 4 [0085.382] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.382] lstrlenW (lpString=".xlsx") returned 5 [0085.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.382] lstrlenW (lpString=".ppt") returned 4 [0085.382] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.382] lstrlenW (lpString=".zip") returned 4 [0085.382] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.382] lstrlenW (lpString=".rar") returned 4 [0085.382] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.382] lstrlenW (lpString=".bz2") returned 4 [0085.382] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.383] lstrlenW (lpString=".7z") returned 3 [0085.383] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.383] lstrlenW (lpString=".dbf") returned 4 [0085.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.383] lstrlenW (lpString=".1cd") returned 4 [0085.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0085.383] lstrlenW (lpString=".jpg") returned 4 [0085.383] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.383] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") [0085.383] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0085.383] CloseHandle (hObject=0x1c8) returned 1 [0085.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20 [0085.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.384] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.384] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.384] GetLastError () returned 0x0 [0085.384] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0085.385] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.386] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.386] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0085.386] SetEndOfFile (hFile=0x1fc) returned 1 [0085.387] CloseHandle (hObject=0x1fc) returned 1 [0085.387] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.387] SetEndOfFile (hFile=0x1c8) returned 1 [0085.387] CloseHandle (hObject=0x1c8) returned 1 [0085.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1 [0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.388] lstrlenW (lpString=".doc") returned 4 [0085.388] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.388] lstrlenW (lpString=".docx") returned 5 [0085.388] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.388] lstrlenW (lpString=".pdf") returned 4 [0085.388] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.388] lstrlenW (lpString=".xls") returned 4 [0085.388] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.388] lstrlenW (lpString=".xlsx") returned 5 [0085.388] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.388] lstrlenW (lpString=".ppt") returned 4 [0085.388] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.388] lstrlenW (lpString=".zip") returned 4 [0085.388] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.388] lstrlenW (lpString=".rar") returned 4 [0085.388] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.388] lstrlenW (lpString=".bz2") returned 4 [0085.388] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.388] lstrlenW (lpString=".7z") returned 3 [0085.388] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.389] lstrlenW (lpString=".dbf") returned 4 [0085.389] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.389] lstrlenW (lpString=".1cd") returned 4 [0085.389] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0085.389] lstrlenW (lpString=".jpg") returned 4 [0085.389] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.389] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") [0085.389] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4750792) returned 1 [0085.389] CloseHandle (hObject=0x1c8) returned 1 [0085.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20 [0085.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0085.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0085.391] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0085.391] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.391] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.433] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1829ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.434] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.442] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.442] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x447dc8, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.442] ReadFile (in: hFile=0x1c8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.462] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.462] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0085.628] SetEndOfFile (hFile=0x1c8) returned 1 [0085.761] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0085.765] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.765] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.767] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1829ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.767] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.769] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x447dc8, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.769] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.771] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0085.771] CloseHandle (hObject=0x1c8) returned 1 [0085.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.771] lstrlenW (lpString=".doc") returned 4 [0085.771] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.771] lstrlenW (lpString=".docx") returned 5 [0085.771] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0085.771] lstrlenW (lpString=".pdf") returned 4 [0085.771] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.771] lstrlenW (lpString=".xls") returned 4 [0085.771] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.771] lstrlenW (lpString=".xlsx") returned 5 [0085.771] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0085.771] lstrlenW (lpString=".ppt") returned 4 [0085.771] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.771] lstrlenW (lpString=".zip") returned 4 [0085.771] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.771] lstrlenW (lpString=".rar") returned 4 [0085.771] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.771] lstrlenW (lpString=".bz2") returned 4 [0085.771] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.771] lstrlenW (lpString=".7z") returned 3 [0085.771] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.772] lstrlenW (lpString=".dbf") returned 4 [0085.772] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.772] lstrlenW (lpString=".1cd") returned 4 [0085.772] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0085.772] lstrlenW (lpString=".jpg") returned 4 [0085.772] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.772] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") [0085.786] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=621) returned 1 [0085.786] CloseHandle (hObject=0x1f0) returned 1 [0085.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20 [0085.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.787] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.787] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.788] GetLastError () returned 0x0 [0085.788] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x26d, lpOverlapped=0x0) returned 1 [0085.790] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x270, lpOverlapped=0x0) returned 1 [0085.791] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.792] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0085.792] SetEndOfFile (hFile=0x210) returned 1 [0085.792] CloseHandle (hObject=0x210) returned 1 [0085.792] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.792] SetEndOfFile (hFile=0x1f0) returned 1 [0085.793] CloseHandle (hObject=0x1f0) returned 1 [0085.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.793] lstrlenW (lpString=".doc") returned 4 [0085.793] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.793] lstrlenW (lpString=".docx") returned 5 [0085.793] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.793] lstrlenW (lpString=".pdf") returned 4 [0085.793] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.793] lstrlenW (lpString=".xls") returned 4 [0085.793] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.793] lstrlenW (lpString=".xlsx") returned 5 [0085.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.793] lstrlenW (lpString=".ppt") returned 4 [0085.793] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.794] lstrlenW (lpString=".zip") returned 4 [0085.794] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.794] lstrlenW (lpString=".rar") returned 4 [0085.794] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.794] lstrlenW (lpString=".bz2") returned 4 [0085.794] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.794] lstrlenW (lpString=".7z") returned 3 [0085.794] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.794] lstrlenW (lpString=".dbf") returned 4 [0085.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.794] lstrlenW (lpString=".1cd") returned 4 [0085.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0085.794] lstrlenW (lpString=".jpg") returned 4 [0085.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.794] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") [0085.795] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0085.795] CloseHandle (hObject=0x1f0) returned 1 [0085.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20 [0085.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.795] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.795] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.796] GetLastError () returned 0x0 [0085.796] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0085.797] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.798] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0085.798] SetEndOfFile (hFile=0x210) returned 1 [0085.798] CloseHandle (hObject=0x210) returned 1 [0085.798] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.798] SetEndOfFile (hFile=0x1f0) returned 1 [0085.799] CloseHandle (hObject=0x1f0) returned 1 [0085.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1 [0085.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.799] lstrlenW (lpString=".doc") returned 4 [0085.799] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.799] lstrlenW (lpString=".docx") returned 5 [0085.799] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.799] lstrlenW (lpString=".pdf") returned 4 [0085.799] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.799] lstrlenW (lpString=".xls") returned 4 [0085.799] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.799] lstrlenW (lpString=".xlsx") returned 5 [0085.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.800] lstrlenW (lpString=".ppt") returned 4 [0085.800] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.800] lstrlenW (lpString=".zip") returned 4 [0085.800] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.800] lstrlenW (lpString=".rar") returned 4 [0085.800] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.800] lstrlenW (lpString=".bz2") returned 4 [0085.800] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.800] lstrlenW (lpString=".7z") returned 3 [0085.800] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.800] lstrlenW (lpString=".dbf") returned 4 [0085.800] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.800] lstrlenW (lpString=".1cd") returned 4 [0085.800] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0085.800] lstrlenW (lpString=".jpg") returned 4 [0085.800] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.800] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") [0085.801] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=89432) returned 1 [0085.801] CloseHandle (hObject=0x1f0) returned 1 [0085.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20 [0085.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.801] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.801] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.802] GetLastError () returned 0x0 [0085.802] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x15d58, lpOverlapped=0x0) returned 1 [0085.805] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x15d60, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x15d60, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.807] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0085.807] SetEndOfFile (hFile=0x210) returned 1 [0085.807] CloseHandle (hObject=0x210) returned 1 [0085.807] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.807] SetEndOfFile (hFile=0x1f0) returned 1 [0085.808] CloseHandle (hObject=0x1f0) returned 1 [0085.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 1 [0085.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.809] lstrlenW (lpString=".doc") returned 4 [0085.809] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0085.809] lstrlenW (lpString=".docx") returned 5 [0085.809] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0085.809] lstrlenW (lpString=".pdf") returned 4 [0085.809] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0085.809] lstrlenW (lpString=".xls") returned 4 [0085.809] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0085.809] lstrlenW (lpString=".xlsx") returned 5 [0085.809] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0085.809] lstrlenW (lpString=".ppt") returned 4 [0085.809] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0085.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.809] lstrlenW (lpString=".zip") returned 4 [0085.810] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0085.810] lstrlenW (lpString=".rar") returned 4 [0085.810] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0085.810] lstrlenW (lpString=".bz2") returned 4 [0085.810] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0085.810] lstrlenW (lpString=".7z") returned 3 [0085.810] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0085.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.810] lstrlenW (lpString=".dbf") returned 4 [0085.810] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0085.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.810] lstrlenW (lpString=".1cd") returned 4 [0085.810] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0085.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0085.810] lstrlenW (lpString=".jpg") returned 4 [0085.810] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0085.810] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") [0085.811] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=389716) returned 1 [0085.811] CloseHandle (hObject=0x1f0) returned 1 [0085.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 0x20 [0085.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.811] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.811] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.812] GetLastError () returned 0x0 [0085.812] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5f254, lpOverlapped=0x0) returned 1 [0085.823] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5f260, lpOverlapped=0x0) returned 1 [0085.831] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.831] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0085.831] SetEndOfFile (hFile=0x210) returned 1 [0085.832] CloseHandle (hObject=0x210) returned 1 [0085.832] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.832] SetEndOfFile (hFile=0x1f0) returned 1 [0085.836] CloseHandle (hObject=0x1f0) returned 1 [0085.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1 [0085.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.837] lstrlenW (lpString=".doc") returned 4 [0085.837] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.837] lstrlenW (lpString=".docx") returned 5 [0085.837] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0085.837] lstrlenW (lpString=".pdf") returned 4 [0085.837] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.837] lstrlenW (lpString=".xls") returned 4 [0085.837] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.837] lstrlenW (lpString=".xlsx") returned 5 [0085.837] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0085.837] lstrlenW (lpString=".ppt") returned 4 [0085.837] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.837] lstrlenW (lpString=".zip") returned 4 [0085.837] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.837] lstrlenW (lpString=".rar") returned 4 [0085.837] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.837] lstrlenW (lpString=".bz2") returned 4 [0085.838] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.838] lstrlenW (lpString=".7z") returned 3 [0085.838] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.838] lstrlenW (lpString=".dbf") returned 4 [0085.838] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.838] lstrlenW (lpString=".1cd") returned 4 [0085.838] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0085.838] lstrlenW (lpString=".jpg") returned 4 [0085.838] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.838] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") [0085.839] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=626) returned 1 [0085.839] CloseHandle (hObject=0x1f0) returned 1 [0085.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20 [0085.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.839] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.839] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.840] GetLastError () returned 0x0 [0085.840] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x272, lpOverlapped=0x0) returned 1 [0085.842] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x280, lpOverlapped=0x0) returned 1 [0085.843] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.843] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0085.843] SetEndOfFile (hFile=0x210) returned 1 [0085.843] CloseHandle (hObject=0x210) returned 1 [0085.844] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.844] SetEndOfFile (hFile=0x1f0) returned 1 [0085.845] CloseHandle (hObject=0x1f0) returned 1 [0085.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1 [0085.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.845] lstrlenW (lpString=".doc") returned 4 [0085.845] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.845] lstrlenW (lpString=".docx") returned 5 [0085.845] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.845] lstrlenW (lpString=".pdf") returned 4 [0085.845] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.845] lstrlenW (lpString=".xls") returned 4 [0085.845] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.845] lstrlenW (lpString=".xlsx") returned 5 [0085.846] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.846] lstrlenW (lpString=".ppt") returned 4 [0085.846] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.846] lstrlenW (lpString=".zip") returned 4 [0085.846] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.846] lstrlenW (lpString=".rar") returned 4 [0085.846] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.846] lstrlenW (lpString=".bz2") returned 4 [0085.846] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.846] lstrlenW (lpString=".7z") returned 3 [0085.846] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.846] lstrlenW (lpString=".dbf") returned 4 [0085.846] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.846] lstrlenW (lpString=".1cd") returned 4 [0085.846] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0085.846] lstrlenW (lpString=".jpg") returned 4 [0085.846] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.846] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") [0085.847] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=206) returned 1 [0085.847] CloseHandle (hObject=0x1f0) returned 1 [0085.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20 [0085.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.848] GetLastError () returned 0x0 [0085.848] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xce, lpOverlapped=0x0) returned 1 [0085.850] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0085.851] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.851] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0085.851] SetEndOfFile (hFile=0x210) returned 1 [0085.851] CloseHandle (hObject=0x210) returned 1 [0085.851] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.851] SetEndOfFile (hFile=0x1f0) returned 1 [0085.852] CloseHandle (hObject=0x1f0) returned 1 [0085.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1 [0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.853] lstrlenW (lpString=".doc") returned 4 [0085.853] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0085.853] lstrlenW (lpString=".docx") returned 5 [0085.853] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0085.853] lstrlenW (lpString=".pdf") returned 4 [0085.853] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0085.853] lstrlenW (lpString=".xls") returned 4 [0085.853] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0085.853] lstrlenW (lpString=".xlsx") returned 5 [0085.853] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0085.853] lstrlenW (lpString=".ppt") returned 4 [0085.853] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.853] lstrlenW (lpString=".zip") returned 4 [0085.853] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0085.853] lstrlenW (lpString=".rar") returned 4 [0085.853] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0085.853] lstrlenW (lpString=".bz2") returned 4 [0085.853] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0085.853] lstrlenW (lpString=".7z") returned 3 [0085.853] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0085.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.853] lstrlenW (lpString=".dbf") returned 4 [0085.854] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.854] lstrlenW (lpString=".1cd") returned 4 [0085.854] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0085.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0085.854] lstrlenW (lpString=".jpg") returned 4 [0085.854] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0085.854] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") [0085.854] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0085.855] CloseHandle (hObject=0x1f0) returned 1 [0085.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20 [0085.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.855] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.855] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.856] GetLastError () returned 0x0 [0085.856] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0085.857] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.858] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.858] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0085.858] SetEndOfFile (hFile=0x210) returned 1 [0085.859] CloseHandle (hObject=0x210) returned 1 [0085.859] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.859] SetEndOfFile (hFile=0x1f0) returned 1 [0085.860] CloseHandle (hObject=0x1f0) returned 1 [0085.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1 [0085.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.860] lstrlenW (lpString=".doc") returned 4 [0085.860] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.860] lstrlenW (lpString=".docx") returned 5 [0085.860] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.860] lstrlenW (lpString=".pdf") returned 4 [0085.860] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.861] lstrlenW (lpString=".xls") returned 4 [0085.861] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.861] lstrlenW (lpString=".xlsx") returned 5 [0085.861] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.861] lstrlenW (lpString=".ppt") returned 4 [0085.861] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.861] lstrlenW (lpString=".zip") returned 4 [0085.861] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.861] lstrlenW (lpString=".rar") returned 4 [0085.861] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.861] lstrlenW (lpString=".bz2") returned 4 [0085.861] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.861] lstrlenW (lpString=".7z") returned 3 [0085.861] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.861] lstrlenW (lpString=".dbf") returned 4 [0085.861] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.861] lstrlenW (lpString=".1cd") returned 4 [0085.861] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0085.861] lstrlenW (lpString=".jpg") returned 4 [0085.861] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.862] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") [0085.862] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0085.862] CloseHandle (hObject=0x1f0) returned 1 [0085.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20 [0085.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.863] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.863] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.863] GetLastError () returned 0x0 [0085.863] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0085.865] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.866] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.866] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0085.866] SetEndOfFile (hFile=0x210) returned 1 [0085.866] CloseHandle (hObject=0x210) returned 1 [0085.866] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.866] SetEndOfFile (hFile=0x1f0) returned 1 [0085.867] CloseHandle (hObject=0x1f0) returned 1 [0085.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1 [0085.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.868] lstrlenW (lpString=".doc") returned 4 [0085.868] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.868] lstrlenW (lpString=".docx") returned 5 [0085.868] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.868] lstrlenW (lpString=".pdf") returned 4 [0085.868] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.868] lstrlenW (lpString=".xls") returned 4 [0085.868] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.868] lstrlenW (lpString=".xlsx") returned 5 [0085.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.868] lstrlenW (lpString=".ppt") returned 4 [0085.868] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.868] lstrlenW (lpString=".zip") returned 4 [0085.869] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.869] lstrlenW (lpString=".rar") returned 4 [0085.869] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.869] lstrlenW (lpString=".bz2") returned 4 [0085.869] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.869] lstrlenW (lpString=".7z") returned 3 [0085.869] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.869] lstrlenW (lpString=".dbf") returned 4 [0085.869] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.869] lstrlenW (lpString=".1cd") returned 4 [0085.869] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0085.869] lstrlenW (lpString=".jpg") returned 4 [0085.869] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.869] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") [0085.871] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1844) returned 1 [0085.871] CloseHandle (hObject=0x1f0) returned 1 [0085.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20 [0085.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.871] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.871] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.872] GetLastError () returned 0x0 [0085.872] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x734, lpOverlapped=0x0) returned 1 [0085.874] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x740, lpOverlapped=0x0) returned 1 [0085.875] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.875] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.875] SetEndOfFile (hFile=0x210) returned 1 [0085.875] CloseHandle (hObject=0x210) returned 1 [0085.875] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.875] SetEndOfFile (hFile=0x1f0) returned 1 [0085.876] CloseHandle (hObject=0x1f0) returned 1 [0085.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1 [0085.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.877] lstrlenW (lpString=".doc") returned 4 [0085.877] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0085.877] lstrlenW (lpString=".docx") returned 5 [0085.877] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0085.877] lstrlenW (lpString=".pdf") returned 4 [0085.877] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0085.877] lstrlenW (lpString=".xls") returned 4 [0085.877] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0085.877] lstrlenW (lpString=".xlsx") returned 5 [0085.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0085.877] lstrlenW (lpString=".ppt") returned 4 [0085.877] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0085.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.877] lstrlenW (lpString=".zip") returned 4 [0085.878] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0085.878] lstrlenW (lpString=".rar") returned 4 [0085.878] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0085.878] lstrlenW (lpString=".bz2") returned 4 [0085.878] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0085.878] lstrlenW (lpString=".7z") returned 3 [0085.878] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0085.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.878] lstrlenW (lpString=".dbf") returned 4 [0085.878] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0085.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.878] lstrlenW (lpString=".1cd") returned 4 [0085.878] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0085.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0085.878] lstrlenW (lpString=".jpg") returned 4 [0085.878] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0085.878] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") [0085.879] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2150) returned 1 [0085.879] CloseHandle (hObject=0x1f0) returned 1 [0085.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20 [0085.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.879] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.879] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.880] GetLastError () returned 0x0 [0085.880] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x866, lpOverlapped=0x0) returned 1 [0085.882] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x870, lpOverlapped=0x0) returned 1 [0085.883] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.883] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.883] SetEndOfFile (hFile=0x210) returned 1 [0085.883] CloseHandle (hObject=0x210) returned 1 [0085.884] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.884] SetEndOfFile (hFile=0x1f0) returned 1 [0085.885] CloseHandle (hObject=0x1f0) returned 1 [0085.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1 [0085.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.885] lstrlenW (lpString=".doc") returned 4 [0085.885] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0085.885] lstrlenW (lpString=".docx") returned 5 [0085.885] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0085.885] lstrlenW (lpString=".pdf") returned 4 [0085.885] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0085.885] lstrlenW (lpString=".xls") returned 4 [0085.886] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0085.886] lstrlenW (lpString=".xlsx") returned 5 [0085.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0085.886] lstrlenW (lpString=".ppt") returned 4 [0085.886] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.886] lstrlenW (lpString=".zip") returned 4 [0085.886] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0085.886] lstrlenW (lpString=".rar") returned 4 [0085.886] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0085.886] lstrlenW (lpString=".bz2") returned 4 [0085.886] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0085.886] lstrlenW (lpString=".7z") returned 3 [0085.886] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.886] lstrlenW (lpString=".dbf") returned 4 [0085.886] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.886] lstrlenW (lpString=".1cd") returned 4 [0085.886] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0085.886] lstrlenW (lpString=".jpg") returned 4 [0085.886] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0085.886] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") [0085.887] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3246) returned 1 [0085.887] CloseHandle (hObject=0x1f0) returned 1 [0085.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20 [0085.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.888] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.888] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.888] GetLastError () returned 0x0 [0085.888] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xcae, lpOverlapped=0x0) returned 1 [0085.991] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xcb0, lpOverlapped=0x0) returned 1 [0085.992] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.992] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.992] SetEndOfFile (hFile=0x210) returned 1 [0085.996] CloseHandle (hObject=0x210) returned 1 [0085.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.996] SetEndOfFile (hFile=0x1f0) returned 1 [0085.996] CloseHandle (hObject=0x1f0) returned 1 [0085.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1 [0086.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.012] lstrlenW (lpString=".doc") returned 4 [0086.012] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0086.012] lstrlenW (lpString=".docx") returned 5 [0086.012] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0086.012] lstrlenW (lpString=".pdf") returned 4 [0086.012] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0086.012] lstrlenW (lpString=".xls") returned 4 [0086.012] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0086.012] lstrlenW (lpString=".xlsx") returned 5 [0086.012] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0086.012] lstrlenW (lpString=".ppt") returned 4 [0086.012] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0086.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.045] lstrlenW (lpString=".zip") returned 4 [0086.046] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0086.046] lstrlenW (lpString=".rar") returned 4 [0086.046] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0086.046] lstrlenW (lpString=".bz2") returned 4 [0086.046] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0086.046] lstrlenW (lpString=".7z") returned 3 [0086.046] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.046] lstrlenW (lpString=".dbf") returned 4 [0086.046] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.046] lstrlenW (lpString=".1cd") returned 4 [0086.046] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0086.046] lstrlenW (lpString=".jpg") returned 4 [0086.046] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0086.046] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") [0086.047] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0086.047] CloseHandle (hObject=0x210) returned 1 [0086.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20 [0086.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.047] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.047] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.048] GetLastError () returned 0x0 [0086.048] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0086.049] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0086.050] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.050] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0086.050] SetEndOfFile (hFile=0x22c) returned 1 [0086.050] CloseHandle (hObject=0x22c) returned 1 [0086.050] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.050] SetEndOfFile (hFile=0x210) returned 1 [0086.051] CloseHandle (hObject=0x210) returned 1 [0086.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1 [0086.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.051] lstrlenW (lpString=".doc") returned 4 [0086.051] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0086.051] lstrlenW (lpString=".docx") returned 5 [0086.051] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0086.051] lstrlenW (lpString=".pdf") returned 4 [0086.051] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0086.051] lstrlenW (lpString=".xls") returned 4 [0086.051] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0086.051] lstrlenW (lpString=".xlsx") returned 5 [0086.051] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0086.051] lstrlenW (lpString=".ppt") returned 4 [0086.052] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0086.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.052] lstrlenW (lpString=".zip") returned 4 [0086.052] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0086.052] lstrlenW (lpString=".rar") returned 4 [0086.052] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0086.052] lstrlenW (lpString=".bz2") returned 4 [0086.052] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0086.052] lstrlenW (lpString=".7z") returned 3 [0086.052] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0086.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.052] lstrlenW (lpString=".dbf") returned 4 [0086.052] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0086.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.052] lstrlenW (lpString=".1cd") returned 4 [0086.052] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0086.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0086.052] lstrlenW (lpString=".jpg") returned 4 [0086.052] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0086.052] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") [0086.053] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=401792) returned 1 [0086.053] CloseHandle (hObject=0x210) returned 1 [0086.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20 [0086.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0086.054] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.054] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0086.054] GetLastError () returned 0x0 [0086.054] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x62180, lpOverlapped=0x0) returned 1 [0086.063] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x62190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x62190, lpOverlapped=0x0) returned 1 [0086.069] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.069] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0086.070] SetEndOfFile (hFile=0x22c) returned 1 [0086.070] CloseHandle (hObject=0x22c) returned 1 [0086.070] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.070] SetEndOfFile (hFile=0x210) returned 1 [0086.073] CloseHandle (hObject=0x210) returned 1 [0086.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 1 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.074] lstrlenW (lpString=".doc") returned 4 [0086.074] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString=".docx") returned 5 [0086.074] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0086.074] lstrlenW (lpString=".pdf") returned 4 [0086.074] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString=".xls") returned 4 [0086.074] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString=".xlsx") returned 5 [0086.074] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0086.074] lstrlenW (lpString=".ppt") returned 4 [0086.074] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.074] lstrlenW (lpString=".zip") returned 4 [0086.074] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString=".rar") returned 4 [0086.074] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0086.074] lstrlenW (lpString=".bz2") returned 4 [0086.074] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0086.074] lstrlenW (lpString=".7z") returned 3 [0086.074] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.074] lstrlenW (lpString=".dbf") returned 4 [0086.074] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.074] lstrlenW (lpString=".1cd") returned 4 [0086.074] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0086.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0086.075] lstrlenW (lpString=".jpg") returned 4 [0086.075] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0086.075] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") [0086.402] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=24960) returned 1 [0086.402] CloseHandle (hObject=0x1c8) returned 1 [0086.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 0x20 [0086.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0086.403] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.403] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.404] GetLastError () returned 0x0 [0086.404] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6180, lpOverlapped=0x0) returned 1 [0086.406] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0086.407] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.407] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0086.407] SetEndOfFile (hFile=0x158) returned 1 [0086.407] CloseHandle (hObject=0x158) returned 1 [0086.407] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.407] SetEndOfFile (hFile=0x1c8) returned 1 [0086.408] CloseHandle (hObject=0x1c8) returned 1 [0086.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString=".doc") returned 4 [0086.409] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".docx") returned 5 [0086.409] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0086.409] lstrlenW (lpString=".pdf") returned 4 [0086.409] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".xls") returned 4 [0086.409] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".xlsx") returned 5 [0086.409] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0086.409] lstrlenW (lpString=".ppt") returned 4 [0086.409] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString=".zip") returned 4 [0086.409] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".rar") returned 4 [0086.409] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".bz2") returned 4 [0086.409] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString=".7z") returned 3 [0086.409] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString=".dbf") returned 4 [0086.409] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString=".1cd") returned 4 [0086.409] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0086.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.409] lstrlenW (lpString=".jpg") returned 4 [0086.409] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".docx") returned 5 [0086.410] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0086.410] lstrlenW (lpString=".pdf") returned 4 [0086.410] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".xls") returned 4 [0086.410] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".xlsx") returned 5 [0086.410] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0086.410] lstrlenW (lpString=".ppt") returned 4 [0086.410] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.410] lstrlenW (lpString=".zip") returned 4 [0086.410] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".rar") returned 4 [0086.410] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".bz2") returned 4 [0086.410] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString=".7z") returned 3 [0086.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0086.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.410] lstrlenW (lpString=".dbf") returned 4 [0086.410] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.410] lstrlenW (lpString=".1cd") returned 4 [0086.410] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0086.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0086.410] lstrlenW (lpString=".jpg") returned 4 [0086.410] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0086.410] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") [0086.411] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1750992) returned 1 [0086.411] CloseHandle (hObject=0x1c8) returned 1 [0086.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0x20 [0086.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0086.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0086.412] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0086.413] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.413] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.416] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x8e7f0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.416] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.421] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0086.421] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x16b7d0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.421] ReadFile (in: hFile=0x1c8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.437] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.437] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0086.931] SetEndOfFile (hFile=0x1c8) returned 1 [0087.167] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0087.167] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.168] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.198] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x8e7f0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.198] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.200] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x16b7d0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.200] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.202] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0087.202] CloseHandle (hObject=0x1c8) returned 1 [0087.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString=".doc") returned 4 [0087.203] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0087.203] lstrlenW (lpString=".docx") returned 5 [0087.203] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0087.203] lstrlenW (lpString=".pdf") returned 4 [0087.203] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0087.203] lstrlenW (lpString=".xls") returned 4 [0087.203] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0087.203] lstrlenW (lpString=".xlsx") returned 5 [0087.203] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0087.203] lstrlenW (lpString=".ppt") returned 4 [0087.203] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString=".zip") returned 4 [0087.203] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0087.203] lstrlenW (lpString=".rar") returned 4 [0087.203] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0087.203] lstrlenW (lpString=".bz2") returned 4 [0087.203] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0087.203] lstrlenW (lpString=".7z") returned 3 [0087.203] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString=".dbf") returned 4 [0087.203] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString=".1cd") returned 4 [0087.203] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0087.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0087.203] lstrlenW (lpString=".jpg") returned 4 [0087.204] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0087.204] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") [0087.204] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15232) returned 1 [0087.204] CloseHandle (hObject=0x1c8) returned 1 [0087.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 0x20 [0087.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0087.205] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.205] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0087.206] GetLastError () returned 0x0 [0087.206] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3b80, lpOverlapped=0x0) returned 1 [0087.208] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3b90, lpOverlapped=0x0) returned 1 [0087.209] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.209] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0087.209] SetEndOfFile (hFile=0x16c) returned 1 [0087.209] CloseHandle (hObject=0x16c) returned 1 [0087.209] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.209] SetEndOfFile (hFile=0x1c8) returned 1 [0087.210] CloseHandle (hObject=0x1c8) returned 1 [0087.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1 [0087.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString=".doc") returned 4 [0087.211] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".docx") returned 5 [0087.211] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0087.211] lstrlenW (lpString=".pdf") returned 4 [0087.211] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".xls") returned 4 [0087.211] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".xlsx") returned 5 [0087.211] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0087.211] lstrlenW (lpString=".ppt") returned 4 [0087.211] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString=".zip") returned 4 [0087.211] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".rar") returned 4 [0087.211] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".bz2") returned 4 [0087.211] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".7z") returned 3 [0087.211] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0087.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString=".dbf") returned 4 [0087.211] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString=".1cd") returned 4 [0087.211] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.211] lstrlenW (lpString=".jpg") returned 4 [0087.211] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0087.211] lstrlenW (lpString=".docx") returned 5 [0087.212] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0087.212] lstrlenW (lpString=".pdf") returned 4 [0087.212] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString=".xls") returned 4 [0087.212] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString=".xlsx") returned 5 [0087.212] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0087.212] lstrlenW (lpString=".ppt") returned 4 [0087.212] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.212] lstrlenW (lpString=".zip") returned 4 [0087.212] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString=".rar") returned 4 [0087.212] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString=".bz2") returned 4 [0087.212] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString=".7z") returned 3 [0087.212] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0087.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.212] lstrlenW (lpString=".dbf") returned 4 [0087.212] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.212] lstrlenW (lpString=".1cd") returned 4 [0087.212] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0087.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0087.212] lstrlenW (lpString=".jpg") returned 4 [0087.212] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0087.212] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") [0087.213] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114560) returned 1 [0087.213] CloseHandle (hObject=0x1c8) returned 1 [0087.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20 [0087.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0087.213] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.213] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0087.216] GetLastError () returned 0x0 [0087.216] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0087.357] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.360] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0087.360] SetEndOfFile (hFile=0x16c) returned 1 [0087.379] CloseHandle (hObject=0x16c) returned 1 [0087.380] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.380] SetEndOfFile (hFile=0x1c8) returned 1 [0087.381] CloseHandle (hObject=0x1c8) returned 1 [0087.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString=".doc") returned 4 [0087.458] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".docx") returned 5 [0087.458] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0087.458] lstrlenW (lpString=".pdf") returned 4 [0087.458] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".xls") returned 4 [0087.458] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".xlsx") returned 5 [0087.458] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0087.458] lstrlenW (lpString=".ppt") returned 4 [0087.458] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString=".zip") returned 4 [0087.458] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".rar") returned 4 [0087.458] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".bz2") returned 4 [0087.458] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString=".7z") returned 3 [0087.458] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString=".dbf") returned 4 [0087.458] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString=".1cd") returned 4 [0087.458] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0087.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.458] lstrlenW (lpString=".jpg") returned 4 [0087.458] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".docx") returned 5 [0087.459] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0087.459] lstrlenW (lpString=".pdf") returned 4 [0087.459] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".xls") returned 4 [0087.459] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".xlsx") returned 5 [0087.459] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0087.459] lstrlenW (lpString=".ppt") returned 4 [0087.459] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.459] lstrlenW (lpString=".zip") returned 4 [0087.459] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".rar") returned 4 [0087.459] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".bz2") returned 4 [0087.459] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString=".7z") returned 3 [0087.459] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0087.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.459] lstrlenW (lpString=".dbf") returned 4 [0087.459] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.459] lstrlenW (lpString=".1cd") returned 4 [0087.459] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0087.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0087.459] lstrlenW (lpString=".jpg") returned 4 [0087.459] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0087.459] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") [0088.577] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6573424) returned 1 [0088.577] CloseHandle (hObject=0x158) returned 1 [0088.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20 [0088.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0088.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.578] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0088.578] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.578] ReadFile (in: hFile=0x158, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.581] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x216f25, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.581] ReadFile (in: hFile=0x158, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.590] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0088.590] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x604d70, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.590] ReadFile (in: hFile=0x158, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.607] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.608] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0088.804] SetEndOfFile (hFile=0x158) returned 1 [0088.804] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0088.804] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.804] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.805] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x216f25, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.805] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.816] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x604d70, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.816] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.820] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0088.820] CloseHandle (hObject=0x158) returned 1 [0088.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.821] lstrlenW (lpString=".doc") returned 4 [0088.821] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString=".docx") returned 5 [0088.821] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0088.821] lstrlenW (lpString=".pdf") returned 4 [0088.821] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString=".xls") returned 4 [0088.821] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString=".xlsx") returned 5 [0088.821] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0088.821] lstrlenW (lpString=".ppt") returned 4 [0088.821] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.821] lstrlenW (lpString=".zip") returned 4 [0088.821] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString=".rar") returned 4 [0088.821] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.821] lstrlenW (lpString=".bz2") returned 4 [0088.821] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.821] lstrlenW (lpString=".7z") returned 3 [0088.821] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.822] lstrlenW (lpString=".dbf") returned 4 [0088.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.822] lstrlenW (lpString=".1cd") returned 4 [0088.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0088.822] lstrlenW (lpString=".jpg") returned 4 [0088.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.822] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") [0089.205] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3384192) returned 1 [0089.205] CloseHandle (hObject=0x158) returned 1 [0089.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20 [0089.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0089.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0089.206] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0089.206] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.206] ReadFile (in: hFile=0x158, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.244] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x113680, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.244] ReadFile (in: hFile=0x158, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.289] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0089.289] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2fa380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.289] ReadFile (in: hFile=0x158, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.308] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.308] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0089.320] SetEndOfFile (hFile=0x158) returned 1 [0089.320] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0089.320] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.320] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.549] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x113680, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.549] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.553] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2fa380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.554] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.558] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0089.561] CloseHandle (hObject=0x158) returned 1 [0089.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.562] lstrlenW (lpString=".doc") returned 4 [0089.562] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString=".docx") returned 5 [0089.562] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0089.562] lstrlenW (lpString=".pdf") returned 4 [0089.562] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString=".xls") returned 4 [0089.562] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString=".xlsx") returned 5 [0089.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0089.562] lstrlenW (lpString=".ppt") returned 4 [0089.562] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.562] lstrlenW (lpString=".zip") returned 4 [0089.562] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString=".rar") returned 4 [0089.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0089.562] lstrlenW (lpString=".bz2") returned 4 [0089.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0089.562] lstrlenW (lpString=".7z") returned 3 [0089.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.563] lstrlenW (lpString=".dbf") returned 4 [0089.563] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.563] lstrlenW (lpString=".1cd") returned 4 [0089.563] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0089.563] lstrlenW (lpString=".jpg") returned 4 [0089.563] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0089.563] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") [0089.564] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=139648) returned 1 [0089.564] CloseHandle (hObject=0x158) returned 1 [0089.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20 [0089.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0089.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0089.565] GetLastError () returned 0x0 [0089.565] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x22180, lpOverlapped=0x0) returned 1 [0089.587] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x22190, lpOverlapped=0x0) returned 1 [0089.589] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.589] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0089.589] SetEndOfFile (hFile=0x22c) returned 1 [0089.589] CloseHandle (hObject=0x22c) returned 1 [0089.590] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.590] SetEndOfFile (hFile=0x158) returned 1 [0089.591] CloseHandle (hObject=0x158) returned 1 [0089.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1 [0089.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.667] lstrlenW (lpString=".doc") returned 4 [0089.667] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0089.667] lstrlenW (lpString=".docx") returned 5 [0089.667] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.667] lstrlenW (lpString=".pdf") returned 4 [0089.667] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.667] lstrlenW (lpString=".xls") returned 4 [0089.667] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.667] lstrlenW (lpString=".xlsx") returned 5 [0089.667] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.667] lstrlenW (lpString=".ppt") returned 4 [0089.667] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.668] lstrlenW (lpString=".zip") returned 4 [0089.668] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".rar") returned 4 [0089.668] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".bz2") returned 4 [0089.668] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".7z") returned 3 [0089.668] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.668] lstrlenW (lpString=".dbf") returned 4 [0089.668] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.668] lstrlenW (lpString=".1cd") returned 4 [0089.668] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.668] lstrlenW (lpString=".jpg") returned 4 [0089.668] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".docx") returned 5 [0089.668] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.668] lstrlenW (lpString=".pdf") returned 4 [0089.668] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".xls") returned 4 [0089.668] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString=".xlsx") returned 5 [0089.668] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.668] lstrlenW (lpString=".ppt") returned 4 [0089.668] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.668] lstrlenW (lpString=".zip") returned 4 [0089.668] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.669] lstrlenW (lpString=".rar") returned 4 [0089.669] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.669] lstrlenW (lpString=".bz2") returned 4 [0089.669] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.669] lstrlenW (lpString=".7z") returned 3 [0089.669] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.669] lstrlenW (lpString=".dbf") returned 4 [0089.669] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.669] lstrlenW (lpString=".1cd") returned 4 [0089.669] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0089.669] lstrlenW (lpString=".jpg") returned 4 [0089.669] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.669] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") [0090.269] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=269184) returned 1 [0090.269] CloseHandle (hObject=0x1c0) returned 1 [0090.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20 [0090.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.285] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.285] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.345] GetLastError () returned 0x0 [0090.346] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x41b80, lpOverlapped=0x0) returned 1 [0090.364] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x41b90, lpOverlapped=0x0) returned 1 [0090.369] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.369] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0090.370] SetEndOfFile (hFile=0x150) returned 1 [0090.370] CloseHandle (hObject=0x150) returned 1 [0090.370] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.370] SetEndOfFile (hFile=0x22c) returned 1 [0090.373] CloseHandle (hObject=0x22c) returned 1 [0090.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1 [0090.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.373] lstrlenW (lpString=".doc") returned 4 [0090.373] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0090.373] lstrlenW (lpString=".docx") returned 5 [0090.373] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.373] lstrlenW (lpString=".pdf") returned 4 [0090.373] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.373] lstrlenW (lpString=".xls") returned 4 [0090.373] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.373] lstrlenW (lpString=".xlsx") returned 5 [0090.373] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.373] lstrlenW (lpString=".ppt") returned 4 [0090.373] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.374] lstrlenW (lpString=".zip") returned 4 [0090.374] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".rar") returned 4 [0090.374] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".bz2") returned 4 [0090.374] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".7z") returned 3 [0090.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.374] lstrlenW (lpString=".dbf") returned 4 [0090.374] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.374] lstrlenW (lpString=".1cd") returned 4 [0090.374] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.374] lstrlenW (lpString=".jpg") returned 4 [0090.374] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".docx") returned 5 [0090.374] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.374] lstrlenW (lpString=".pdf") returned 4 [0090.374] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".xls") returned 4 [0090.374] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString=".xlsx") returned 5 [0090.374] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.374] lstrlenW (lpString=".ppt") returned 4 [0090.374] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.374] lstrlenW (lpString=".zip") returned 4 [0090.374] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.375] lstrlenW (lpString=".rar") returned 4 [0090.375] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.375] lstrlenW (lpString=".bz2") returned 4 [0090.375] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.375] lstrlenW (lpString=".7z") returned 3 [0090.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.375] lstrlenW (lpString=".dbf") returned 4 [0090.375] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.375] lstrlenW (lpString=".1cd") returned 4 [0090.375] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0090.375] lstrlenW (lpString=".jpg") returned 4 [0090.375] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.375] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") [0090.376] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=9088) returned 1 [0090.376] CloseHandle (hObject=0x22c) returned 1 [0090.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 0x20 [0090.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.376] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.377] GetLastError () returned 0x0 [0090.377] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2380, lpOverlapped=0x0) returned 1 [0090.379] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2390, lpOverlapped=0x0) returned 1 [0090.380] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.380] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.380] SetEndOfFile (hFile=0x150) returned 1 [0090.380] CloseHandle (hObject=0x150) returned 1 [0090.380] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.380] SetEndOfFile (hFile=0x22c) returned 1 [0090.381] CloseHandle (hObject=0x22c) returned 1 [0090.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 1 [0090.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.381] lstrlenW (lpString=".doc") returned 4 [0090.381] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.381] lstrlenW (lpString=".docx") returned 5 [0090.382] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0090.382] lstrlenW (lpString=".pdf") returned 4 [0090.382] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.382] lstrlenW (lpString=".xls") returned 4 [0090.382] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.382] lstrlenW (lpString=".xlsx") returned 5 [0090.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0090.382] lstrlenW (lpString=".ppt") returned 4 [0090.382] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.382] lstrlenW (lpString=".zip") returned 4 [0090.382] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.382] lstrlenW (lpString=".rar") returned 4 [0090.382] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.382] lstrlenW (lpString=".bz2") returned 4 [0090.382] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.382] lstrlenW (lpString=".7z") returned 3 [0090.382] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.382] lstrlenW (lpString=".dbf") returned 4 [0090.382] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.382] lstrlenW (lpString=".1cd") returned 4 [0090.382] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0090.382] lstrlenW (lpString=".jpg") returned 4 [0090.382] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.382] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") [0090.384] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=38768) returned 1 [0090.384] CloseHandle (hObject=0x22c) returned 1 [0090.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 0x20 [0090.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.384] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.384] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.385] GetLastError () returned 0x0 [0090.385] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9770, lpOverlapped=0x0) returned 1 [0090.387] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0090.389] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.389] WriteFile (in: hFile=0x150, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.389] SetEndOfFile (hFile=0x150) returned 1 [0090.389] CloseHandle (hObject=0x150) returned 1 [0090.389] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.389] SetEndOfFile (hFile=0x22c) returned 1 [0090.390] CloseHandle (hObject=0x22c) returned 1 [0090.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString=".doc") returned 4 [0090.391] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString=".docx") returned 5 [0090.391] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0090.391] lstrlenW (lpString=".pdf") returned 4 [0090.391] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString=".xls") returned 4 [0090.391] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.391] lstrlenW (lpString=".xlsx") returned 5 [0090.391] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0090.391] lstrlenW (lpString=".ppt") returned 4 [0090.391] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString=".zip") returned 4 [0090.391] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.391] lstrlenW (lpString=".rar") returned 4 [0090.391] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString=".bz2") returned 4 [0090.391] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString=".7z") returned 3 [0090.391] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString=".dbf") returned 4 [0090.391] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString=".1cd") returned 4 [0090.391] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0090.391] lstrlenW (lpString=".jpg") returned 4 [0090.391] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.392] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") [0090.494] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=320928) returned 1 [0090.494] CloseHandle (hObject=0x1c8) returned 1 [0090.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20 [0090.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.494] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.494] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.495] GetLastError () returned 0x0 [0090.495] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4e5a0, lpOverlapped=0x0) returned 1 [0090.503] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4e5b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4e5b0, lpOverlapped=0x0) returned 1 [0090.509] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.509] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x100, lpOverlapped=0x0) returned 1 [0090.509] SetEndOfFile (hFile=0x158) returned 1 [0090.509] CloseHandle (hObject=0x158) returned 1 [0090.509] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.510] SetEndOfFile (hFile=0x1c8) returned 1 [0090.513] CloseHandle (hObject=0x1c8) returned 1 [0090.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 1 [0090.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.513] lstrlenW (lpString=".doc") returned 4 [0090.513] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.513] lstrlenW (lpString=".docx") returned 5 [0090.513] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0090.513] lstrlenW (lpString=".pdf") returned 4 [0090.513] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.513] lstrlenW (lpString=".xls") returned 4 [0090.513] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.513] lstrlenW (lpString=".xlsx") returned 5 [0090.513] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0090.513] lstrlenW (lpString=".ppt") returned 4 [0090.513] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.514] lstrlenW (lpString=".zip") returned 4 [0090.514] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.514] lstrlenW (lpString=".rar") returned 4 [0090.514] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.514] lstrlenW (lpString=".bz2") returned 4 [0090.514] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.514] lstrlenW (lpString=".7z") returned 3 [0090.514] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.514] lstrlenW (lpString=".dbf") returned 4 [0090.514] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.514] lstrlenW (lpString=".1cd") returned 4 [0090.514] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0090.514] lstrlenW (lpString=".jpg") returned 4 [0090.514] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.514] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") [0090.515] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=281448) returned 1 [0090.516] CloseHandle (hObject=0x16c) returned 1 [0090.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 0x20 [0090.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.516] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.516] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.517] GetLastError () returned 0x0 [0090.517] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x44b68, lpOverlapped=0x0) returned 1 [0090.524] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x44b70, lpOverlapped=0x0) returned 1 [0090.530] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.530] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.530] SetEndOfFile (hFile=0x1c8) returned 1 [0090.530] CloseHandle (hObject=0x1c8) returned 1 [0090.530] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.530] SetEndOfFile (hFile=0x16c) returned 1 [0090.534] CloseHandle (hObject=0x16c) returned 1 [0090.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1 [0090.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.534] lstrlenW (lpString=".doc") returned 4 [0090.534] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.534] lstrlenW (lpString=".docx") returned 5 [0090.534] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0090.534] lstrlenW (lpString=".pdf") returned 4 [0090.534] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.534] lstrlenW (lpString=".xls") returned 4 [0090.534] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.534] lstrlenW (lpString=".xlsx") returned 5 [0090.534] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0090.534] lstrlenW (lpString=".ppt") returned 4 [0090.534] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.535] lstrlenW (lpString=".zip") returned 4 [0090.535] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.535] lstrlenW (lpString=".rar") returned 4 [0090.535] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.535] lstrlenW (lpString=".bz2") returned 4 [0090.535] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.535] lstrlenW (lpString=".7z") returned 3 [0090.535] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.535] lstrlenW (lpString=".dbf") returned 4 [0090.535] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.535] lstrlenW (lpString=".1cd") returned 4 [0090.535] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0090.535] lstrlenW (lpString=".jpg") returned 4 [0090.535] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.535] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") [0090.694] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=392584) returned 1 [0090.694] CloseHandle (hObject=0x1c0) returned 1 [0090.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20 [0090.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.694] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.694] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.700] GetLastError () returned 0x0 [0090.700] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0090.781] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5fd90, lpOverlapped=0x0) returned 1 [0090.788] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.788] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0090.788] SetEndOfFile (hFile=0x22c) returned 1 [0090.788] CloseHandle (hObject=0x22c) returned 1 [0090.788] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.788] SetEndOfFile (hFile=0x1c0) returned 1 [0090.792] CloseHandle (hObject=0x1c0) returned 1 [0090.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1 [0090.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.793] lstrlenW (lpString=".doc") returned 4 [0090.793] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString=".docx") returned 5 [0090.793] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0090.793] lstrlenW (lpString=".pdf") returned 4 [0090.793] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString=".xls") returned 4 [0090.793] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.793] lstrlenW (lpString=".xlsx") returned 5 [0090.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0090.793] lstrlenW (lpString=".ppt") returned 4 [0090.793] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.793] lstrlenW (lpString=".zip") returned 4 [0090.793] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.793] lstrlenW (lpString=".rar") returned 4 [0090.793] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString=".bz2") returned 4 [0090.793] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString=".7z") returned 3 [0090.793] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.793] lstrlenW (lpString=".dbf") returned 4 [0090.793] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.793] lstrlenW (lpString=".1cd") returned 4 [0090.793] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0090.793] lstrlenW (lpString=".jpg") returned 4 [0090.793] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.793] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") [0090.794] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=209) returned 1 [0090.794] CloseHandle (hObject=0x1c0) returned 1 [0090.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 0x20 [0090.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.795] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.795] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.798] GetLastError () returned 0x0 [0090.798] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd1, lpOverlapped=0x0) returned 1 [0090.799] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0090.799] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.800] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0090.800] SetEndOfFile (hFile=0x22c) returned 1 [0090.800] CloseHandle (hObject=0x22c) returned 1 [0090.800] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.800] SetEndOfFile (hFile=0x1c0) returned 1 [0090.801] CloseHandle (hObject=0x1c0) returned 1 [0090.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1 [0090.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.801] lstrlenW (lpString=".doc") returned 4 [0090.801] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0090.801] lstrlenW (lpString=".docx") returned 5 [0090.801] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0090.801] lstrlenW (lpString=".pdf") returned 4 [0090.801] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0090.801] lstrlenW (lpString=".xls") returned 4 [0090.801] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0090.801] lstrlenW (lpString=".xlsx") returned 5 [0090.801] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0090.801] lstrlenW (lpString=".ppt") returned 4 [0090.801] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0090.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.801] lstrlenW (lpString=".zip") returned 4 [0090.801] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0090.802] lstrlenW (lpString=".rar") returned 4 [0090.802] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0090.802] lstrlenW (lpString=".bz2") returned 4 [0090.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0090.802] lstrlenW (lpString=".7z") returned 3 [0090.802] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.802] lstrlenW (lpString=".dbf") returned 4 [0090.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.802] lstrlenW (lpString=".1cd") returned 4 [0090.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0090.802] lstrlenW (lpString=".jpg") returned 4 [0090.802] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0090.802] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") [0090.803] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0090.803] CloseHandle (hObject=0x1c0) returned 1 [0090.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20 [0090.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.803] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.803] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.804] GetLastError () returned 0x0 [0090.804] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0090.805] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.805] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.805] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0090.806] SetEndOfFile (hFile=0x22c) returned 1 [0090.806] CloseHandle (hObject=0x22c) returned 1 [0090.806] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.806] SetEndOfFile (hFile=0x1c0) returned 1 [0090.807] CloseHandle (hObject=0x1c0) returned 1 [0090.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.807] lstrlenW (lpString=".doc") returned 4 [0090.807] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.807] lstrlenW (lpString=".docx") returned 5 [0090.807] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.807] lstrlenW (lpString=".pdf") returned 4 [0090.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.807] lstrlenW (lpString=".xls") returned 4 [0090.807] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.807] lstrlenW (lpString=".xlsx") returned 5 [0090.807] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.807] lstrlenW (lpString=".ppt") returned 4 [0090.807] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.807] lstrlenW (lpString=".zip") returned 4 [0090.807] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.807] lstrlenW (lpString=".rar") returned 4 [0090.807] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.808] lstrlenW (lpString=".bz2") returned 4 [0090.808] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.808] lstrlenW (lpString=".7z") returned 3 [0090.808] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.808] lstrlenW (lpString=".dbf") returned 4 [0090.808] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.808] lstrlenW (lpString=".1cd") returned 4 [0090.808] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0090.808] lstrlenW (lpString=".jpg") returned 4 [0090.808] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.808] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") [0090.808] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0090.809] CloseHandle (hObject=0x1c0) returned 1 [0090.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20 [0090.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.809] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.809] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.810] GetLastError () returned 0x0 [0090.810] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0090.823] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.825] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.825] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0090.825] SetEndOfFile (hFile=0x22c) returned 1 [0090.825] CloseHandle (hObject=0x22c) returned 1 [0090.825] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.825] SetEndOfFile (hFile=0x1c0) returned 1 [0090.826] CloseHandle (hObject=0x1c0) returned 1 [0090.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1 [0090.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.826] lstrlenW (lpString=".doc") returned 4 [0090.826] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.826] lstrlenW (lpString=".docx") returned 5 [0090.826] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.826] lstrlenW (lpString=".pdf") returned 4 [0090.826] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.826] lstrlenW (lpString=".xls") returned 4 [0090.826] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.826] lstrlenW (lpString=".xlsx") returned 5 [0090.826] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.826] lstrlenW (lpString=".ppt") returned 4 [0090.826] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.827] lstrlenW (lpString=".zip") returned 4 [0090.827] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.827] lstrlenW (lpString=".rar") returned 4 [0090.827] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.827] lstrlenW (lpString=".bz2") returned 4 [0090.827] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.827] lstrlenW (lpString=".7z") returned 3 [0090.827] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.827] lstrlenW (lpString=".dbf") returned 4 [0090.827] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.827] lstrlenW (lpString=".1cd") returned 4 [0090.827] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0090.827] lstrlenW (lpString=".jpg") returned 4 [0090.827] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.827] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") [0090.828] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=879814) returned 1 [0090.828] CloseHandle (hObject=0x1c0) returned 1 [0090.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 0x20 [0090.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.828] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.828] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.829] GetLastError () returned 0x0 [0090.829] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0090.878] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd6cd0, lpOverlapped=0x0) returned 1 [0090.893] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.893] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0090.894] SetEndOfFile (hFile=0x22c) returned 1 [0090.894] CloseHandle (hObject=0x22c) returned 1 [0090.894] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.894] SetEndOfFile (hFile=0x1c0) returned 1 [0091.022] CloseHandle (hObject=0x1c0) returned 1 [0091.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1 [0091.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.022] lstrlenW (lpString=".doc") returned 4 [0091.022] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.022] lstrlenW (lpString=".docx") returned 5 [0091.022] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0091.022] lstrlenW (lpString=".pdf") returned 4 [0091.022] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.022] lstrlenW (lpString=".xls") returned 4 [0091.022] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.022] lstrlenW (lpString=".xlsx") returned 5 [0091.022] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0091.023] lstrlenW (lpString=".ppt") returned 4 [0091.023] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.023] lstrlenW (lpString=".zip") returned 4 [0091.023] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.023] lstrlenW (lpString=".rar") returned 4 [0091.023] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.023] lstrlenW (lpString=".bz2") returned 4 [0091.023] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.023] lstrlenW (lpString=".7z") returned 3 [0091.023] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.023] lstrlenW (lpString=".dbf") returned 4 [0091.023] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.023] lstrlenW (lpString=".1cd") returned 4 [0091.023] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0091.023] lstrlenW (lpString=".jpg") returned 4 [0091.023] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.023] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") [0091.024] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0091.024] CloseHandle (hObject=0x1c0) returned 1 [0091.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20 [0091.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.024] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.024] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.025] GetLastError () returned 0x0 [0091.025] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.027] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0091.027] SetEndOfFile (hFile=0x1f0) returned 1 [0091.027] CloseHandle (hObject=0x1f0) returned 1 [0091.027] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.027] SetEndOfFile (hFile=0x1c0) returned 1 [0091.028] CloseHandle (hObject=0x1c0) returned 1 [0091.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1 [0091.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.028] lstrlenW (lpString=".doc") returned 4 [0091.028] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.028] lstrlenW (lpString=".docx") returned 5 [0091.028] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.028] lstrlenW (lpString=".pdf") returned 4 [0091.028] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.028] lstrlenW (lpString=".xls") returned 4 [0091.028] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.028] lstrlenW (lpString=".xlsx") returned 5 [0091.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.029] lstrlenW (lpString=".ppt") returned 4 [0091.029] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.029] lstrlenW (lpString=".zip") returned 4 [0091.029] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.029] lstrlenW (lpString=".rar") returned 4 [0091.029] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.029] lstrlenW (lpString=".bz2") returned 4 [0091.029] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.029] lstrlenW (lpString=".7z") returned 3 [0091.029] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.029] lstrlenW (lpString=".dbf") returned 4 [0091.029] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.029] lstrlenW (lpString=".1cd") returned 4 [0091.029] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0091.029] lstrlenW (lpString=".jpg") returned 4 [0091.029] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.029] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") [0091.030] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2287488) returned 1 [0091.030] CloseHandle (hObject=0x1c0) returned 1 [0091.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20 [0091.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0091.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.031] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0091.031] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.031] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.034] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xba280, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.034] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.040] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.040] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1ee780, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.040] ReadFile (in: hFile=0x1c0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.063] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.063] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0091.206] SetEndOfFile (hFile=0x1c0) returned 1 [0091.206] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0091.206] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.206] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.208] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xba280, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.208] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.210] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1ee780, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.210] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.211] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0091.211] CloseHandle (hObject=0x1c0) returned 1 [0091.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.212] lstrlenW (lpString=".doc") returned 4 [0091.212] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.212] lstrlenW (lpString=".docx") returned 5 [0091.212] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0091.212] lstrlenW (lpString=".pdf") returned 4 [0091.212] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.212] lstrlenW (lpString=".xls") returned 4 [0091.212] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.212] lstrlenW (lpString=".xlsx") returned 5 [0091.212] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0091.212] lstrlenW (lpString=".ppt") returned 4 [0091.212] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.212] lstrlenW (lpString=".zip") returned 4 [0091.212] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.212] lstrlenW (lpString=".rar") returned 4 [0091.212] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.212] lstrlenW (lpString=".bz2") returned 4 [0091.212] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.212] lstrlenW (lpString=".7z") returned 3 [0091.212] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.212] lstrlenW (lpString=".dbf") returned 4 [0091.213] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.213] lstrlenW (lpString=".1cd") returned 4 [0091.213] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0091.213] lstrlenW (lpString=".jpg") returned 4 [0091.213] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.213] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") [0091.214] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0091.214] CloseHandle (hObject=0x1c0) returned 1 [0091.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20 [0091.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.214] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.214] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.215] GetLastError () returned 0x0 [0091.215] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0091.216] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.217] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.217] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.217] SetEndOfFile (hFile=0x1c8) returned 1 [0091.217] CloseHandle (hObject=0x1c8) returned 1 [0091.217] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.217] SetEndOfFile (hFile=0x1c0) returned 1 [0091.218] CloseHandle (hObject=0x1c0) returned 1 [0091.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString=".doc") returned 4 [0091.219] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.219] lstrlenW (lpString=".docx") returned 5 [0091.219] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.219] lstrlenW (lpString=".pdf") returned 4 [0091.219] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.219] lstrlenW (lpString=".xls") returned 4 [0091.219] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.219] lstrlenW (lpString=".xlsx") returned 5 [0091.219] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.219] lstrlenW (lpString=".ppt") returned 4 [0091.219] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString=".zip") returned 4 [0091.219] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.219] lstrlenW (lpString=".rar") returned 4 [0091.219] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.219] lstrlenW (lpString=".bz2") returned 4 [0091.219] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.219] lstrlenW (lpString=".7z") returned 3 [0091.219] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString=".dbf") returned 4 [0091.219] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString=".1cd") returned 4 [0091.219] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0091.219] lstrlenW (lpString=".jpg") returned 4 [0091.219] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.220] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") [0091.220] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0091.220] CloseHandle (hObject=0x1c0) returned 1 [0091.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20 [0091.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.221] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.221] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.222] GetLastError () returned 0x0 [0091.222] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0091.223] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.223] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.224] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.224] SetEndOfFile (hFile=0x1c8) returned 1 [0091.224] CloseHandle (hObject=0x1c8) returned 1 [0091.224] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.224] SetEndOfFile (hFile=0x1c0) returned 1 [0091.225] CloseHandle (hObject=0x1c0) returned 1 [0091.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.225] lstrlenW (lpString=".doc") returned 4 [0091.225] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.225] lstrlenW (lpString=".docx") returned 5 [0091.225] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.225] lstrlenW (lpString=".pdf") returned 4 [0091.225] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.225] lstrlenW (lpString=".xls") returned 4 [0091.225] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.226] lstrlenW (lpString=".xlsx") returned 5 [0091.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.226] lstrlenW (lpString=".ppt") returned 4 [0091.226] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.226] lstrlenW (lpString=".zip") returned 4 [0091.226] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.226] lstrlenW (lpString=".rar") returned 4 [0091.226] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.226] lstrlenW (lpString=".bz2") returned 4 [0091.226] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.226] lstrlenW (lpString=".7z") returned 3 [0091.226] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.226] lstrlenW (lpString=".dbf") returned 4 [0091.226] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.226] lstrlenW (lpString=".1cd") returned 4 [0091.226] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0091.226] lstrlenW (lpString=".jpg") returned 4 [0091.226] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.226] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") [0091.227] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=50544) returned 1 [0091.227] CloseHandle (hObject=0x1c0) returned 1 [0091.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20 [0091.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.227] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.227] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.228] GetLastError () returned 0x0 [0091.228] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xc570, lpOverlapped=0x0) returned 1 [0091.399] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0091.400] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.400] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.400] SetEndOfFile (hFile=0x1c8) returned 1 [0091.400] CloseHandle (hObject=0x1c8) returned 1 [0091.400] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.401] SetEndOfFile (hFile=0x1c0) returned 1 [0091.402] CloseHandle (hObject=0x1c0) returned 1 [0091.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1 [0091.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.402] lstrlenW (lpString=".doc") returned 4 [0091.402] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0091.402] lstrlenW (lpString=".docx") returned 5 [0091.402] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0091.402] lstrlenW (lpString=".pdf") returned 4 [0091.402] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0091.402] lstrlenW (lpString=".xls") returned 4 [0091.402] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0091.402] lstrlenW (lpString=".xlsx") returned 5 [0091.402] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0091.402] lstrlenW (lpString=".ppt") returned 4 [0091.402] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0091.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.402] lstrlenW (lpString=".zip") returned 4 [0091.402] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0091.402] lstrlenW (lpString=".rar") returned 4 [0091.402] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0091.402] lstrlenW (lpString=".bz2") returned 4 [0091.403] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0091.403] lstrlenW (lpString=".7z") returned 3 [0091.403] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.403] lstrlenW (lpString=".dbf") returned 4 [0091.403] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.403] lstrlenW (lpString=".1cd") returned 4 [0091.403] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0091.403] lstrlenW (lpString=".jpg") returned 4 [0091.403] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0091.403] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") [0091.404] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=211) returned 1 [0091.404] CloseHandle (hObject=0x1c0) returned 1 [0091.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 0x20 [0091.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0091.404] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.404] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.405] GetLastError () returned 0x0 [0091.405] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd3, lpOverlapped=0x0) returned 1 [0091.406] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0091.407] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.407] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.407] SetEndOfFile (hFile=0x1c8) returned 1 [0091.407] CloseHandle (hObject=0x1c8) returned 1 [0091.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.407] SetEndOfFile (hFile=0x1c0) returned 1 [0091.408] CloseHandle (hObject=0x1c0) returned 1 [0091.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1 [0091.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.408] lstrlenW (lpString=".doc") returned 4 [0091.408] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0091.408] lstrlenW (lpString=".docx") returned 5 [0091.408] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0091.408] lstrlenW (lpString=".pdf") returned 4 [0091.408] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0091.408] lstrlenW (lpString=".xls") returned 4 [0091.408] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0091.408] lstrlenW (lpString=".xlsx") returned 5 [0091.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0091.409] lstrlenW (lpString=".ppt") returned 4 [0091.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0091.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.409] lstrlenW (lpString=".zip") returned 4 [0091.409] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0091.409] lstrlenW (lpString=".rar") returned 4 [0091.409] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0091.409] lstrlenW (lpString=".bz2") returned 4 [0091.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0091.409] lstrlenW (lpString=".7z") returned 3 [0091.409] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0091.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.409] lstrlenW (lpString=".dbf") returned 4 [0091.409] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0091.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.409] lstrlenW (lpString=".1cd") returned 4 [0091.409] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0091.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0091.409] lstrlenW (lpString=".jpg") returned 4 [0091.409] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0091.409] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") [0091.423] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114) returned 1 [0091.423] CloseHandle (hObject=0x1fc) returned 1 [0091.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0091.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0091.424] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.424] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.424] GetLastError () returned 0x0 [0091.424] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x72, lpOverlapped=0x0) returned 1 [0091.427] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.428] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.428] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0091.428] SetEndOfFile (hFile=0x190) returned 1 [0091.428] CloseHandle (hObject=0x190) returned 1 [0091.428] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.428] SetEndOfFile (hFile=0x1fc) returned 1 [0091.429] CloseHandle (hObject=0x1fc) returned 1 [0091.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1 [0091.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.429] lstrlenW (lpString=".doc") returned 4 [0091.429] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.429] lstrlenW (lpString=".docx") returned 5 [0091.429] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.429] lstrlenW (lpString=".pdf") returned 4 [0091.429] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.429] lstrlenW (lpString=".xls") returned 4 [0091.429] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.429] lstrlenW (lpString=".xlsx") returned 5 [0091.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.429] lstrlenW (lpString=".ppt") returned 4 [0091.430] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.430] lstrlenW (lpString=".zip") returned 4 [0091.430] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.430] lstrlenW (lpString=".rar") returned 4 [0091.430] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.430] lstrlenW (lpString=".bz2") returned 4 [0091.430] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.430] lstrlenW (lpString=".7z") returned 3 [0091.430] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.430] lstrlenW (lpString=".dbf") returned 4 [0091.430] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.430] lstrlenW (lpString=".1cd") returned 4 [0091.430] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0091.430] lstrlenW (lpString=".jpg") returned 4 [0091.430] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.430] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") [0091.431] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=113) returned 1 [0091.431] CloseHandle (hObject=0x1fc) returned 1 [0091.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0091.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0091.432] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.432] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.432] GetLastError () returned 0x0 [0091.432] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x71, lpOverlapped=0x0) returned 1 [0091.434] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.434] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.434] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0091.435] SetEndOfFile (hFile=0x190) returned 1 [0091.435] CloseHandle (hObject=0x190) returned 1 [0091.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.435] SetEndOfFile (hFile=0x1fc) returned 1 [0091.436] CloseHandle (hObject=0x1fc) returned 1 [0091.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1 [0091.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.436] lstrlenW (lpString=".doc") returned 4 [0091.436] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.436] lstrlenW (lpString=".docx") returned 5 [0091.436] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.436] lstrlenW (lpString=".pdf") returned 4 [0091.436] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.436] lstrlenW (lpString=".xls") returned 4 [0091.436] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.436] lstrlenW (lpString=".xlsx") returned 5 [0091.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.436] lstrlenW (lpString=".ppt") returned 4 [0091.436] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.436] lstrlenW (lpString=".zip") returned 4 [0091.436] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.436] lstrlenW (lpString=".rar") returned 4 [0091.437] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.437] lstrlenW (lpString=".bz2") returned 4 [0091.437] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.437] lstrlenW (lpString=".7z") returned 3 [0091.437] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.437] lstrlenW (lpString=".dbf") returned 4 [0091.437] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.437] lstrlenW (lpString=".1cd") returned 4 [0091.437] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0091.437] lstrlenW (lpString=".jpg") returned 4 [0091.437] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.437] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") [0091.438] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1475590) returned 1 [0091.438] CloseHandle (hObject=0x1fc) returned 1 [0091.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 0x20 [0091.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0091.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.439] GetLastError () returned 0x0 [0091.439] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0091.464] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0091.481] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x68416, lpOverlapped=0x0) returned 1 [0091.627] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x68420, lpOverlapped=0x0) returned 1 [0091.637] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x190, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0091.637] SetEndOfFile (hFile=0x190) returned 1 [0091.637] CloseHandle (hObject=0x190) returned 1 [0091.637] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.637] SetEndOfFile (hFile=0x1fc) returned 1 [0091.641] CloseHandle (hObject=0x1fc) returned 1 [0091.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1 [0091.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.641] lstrlenW (lpString=".doc") returned 4 [0091.641] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.641] lstrlenW (lpString=".docx") returned 5 [0091.641] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0091.641] lstrlenW (lpString=".pdf") returned 4 [0091.641] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.641] lstrlenW (lpString=".xls") returned 4 [0091.641] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.641] lstrlenW (lpString=".xlsx") returned 5 [0091.642] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0091.642] lstrlenW (lpString=".ppt") returned 4 [0091.642] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.642] lstrlenW (lpString=".zip") returned 4 [0091.642] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.642] lstrlenW (lpString=".rar") returned 4 [0091.642] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.642] lstrlenW (lpString=".bz2") returned 4 [0091.642] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.642] lstrlenW (lpString=".7z") returned 3 [0091.642] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.642] lstrlenW (lpString=".dbf") returned 4 [0091.642] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.642] lstrlenW (lpString=".1cd") returned 4 [0091.642] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0091.642] lstrlenW (lpString=".jpg") returned 4 [0091.642] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.642] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") [0092.280] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=631) returned 1 [0092.280] CloseHandle (hObject=0x1c0) returned 1 [0092.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 0x20 [0092.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.280] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.280] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.281] GetLastError () returned 0x0 [0092.281] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x277, lpOverlapped=0x0) returned 1 [0092.282] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x280, lpOverlapped=0x0) returned 1 [0092.283] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.283] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0092.283] SetEndOfFile (hFile=0x1c8) returned 1 [0092.283] CloseHandle (hObject=0x1c8) returned 1 [0092.284] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.284] SetEndOfFile (hFile=0x1c0) returned 1 [0092.284] CloseHandle (hObject=0x1c0) returned 1 [0092.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1 [0092.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.285] lstrlenW (lpString=".doc") returned 4 [0092.285] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0092.285] lstrlenW (lpString=".docx") returned 5 [0092.285] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0092.285] lstrlenW (lpString=".pdf") returned 4 [0092.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0092.285] lstrlenW (lpString=".xls") returned 4 [0092.285] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0092.285] lstrlenW (lpString=".xlsx") returned 5 [0092.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0092.285] lstrlenW (lpString=".ppt") returned 4 [0092.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0092.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.285] lstrlenW (lpString=".zip") returned 4 [0092.285] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0092.286] lstrlenW (lpString=".rar") returned 4 [0092.286] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0092.286] lstrlenW (lpString=".bz2") returned 4 [0092.286] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0092.286] lstrlenW (lpString=".7z") returned 3 [0092.286] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.286] lstrlenW (lpString=".dbf") returned 4 [0092.286] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.286] lstrlenW (lpString=".1cd") returned 4 [0092.286] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0092.286] lstrlenW (lpString=".jpg") returned 4 [0092.286] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0092.286] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") [0092.287] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=99200) returned 1 [0092.287] CloseHandle (hObject=0x1c0) returned 1 [0092.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 0x20 [0092.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.287] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.287] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.288] GetLastError () returned 0x0 [0092.288] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x18380, lpOverlapped=0x0) returned 1 [0092.290] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x18390, lpOverlapped=0x0) returned 1 [0092.293] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.293] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0092.293] SetEndOfFile (hFile=0x1c8) returned 1 [0092.293] CloseHandle (hObject=0x1c8) returned 1 [0092.293] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.293] SetEndOfFile (hFile=0x1c0) returned 1 [0092.294] CloseHandle (hObject=0x1c0) returned 1 [0092.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.295] lstrlenW (lpString=".doc") returned 4 [0092.295] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".docx") returned 5 [0092.295] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.295] lstrlenW (lpString=".pdf") returned 4 [0092.295] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".xls") returned 4 [0092.295] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".xlsx") returned 5 [0092.295] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.295] lstrlenW (lpString=".ppt") returned 4 [0092.295] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.295] lstrlenW (lpString=".zip") returned 4 [0092.295] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".rar") returned 4 [0092.295] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".bz2") returned 4 [0092.295] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString=".7z") returned 3 [0092.295] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.295] lstrlenW (lpString=".dbf") returned 4 [0092.295] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.295] lstrlenW (lpString=".1cd") returned 4 [0092.295] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.296] lstrlenW (lpString=".jpg") returned 4 [0092.296] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".docx") returned 5 [0092.296] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.296] lstrlenW (lpString=".pdf") returned 4 [0092.296] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".xls") returned 4 [0092.296] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".xlsx") returned 5 [0092.296] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.296] lstrlenW (lpString=".ppt") returned 4 [0092.296] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.296] lstrlenW (lpString=".zip") returned 4 [0092.296] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".rar") returned 4 [0092.296] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".bz2") returned 4 [0092.296] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString=".7z") returned 3 [0092.296] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.296] lstrlenW (lpString=".dbf") returned 4 [0092.296] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.296] lstrlenW (lpString=".1cd") returned 4 [0092.296] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0092.296] lstrlenW (lpString=".jpg") returned 4 [0092.296] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.296] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") [0092.298] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=383872) returned 1 [0092.298] CloseHandle (hObject=0x1c0) returned 1 [0092.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20 [0092.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.298] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.298] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.299] GetLastError () returned 0x0 [0092.299] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5db80, lpOverlapped=0x0) returned 1 [0092.311] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5db90, lpOverlapped=0x0) returned 1 [0092.317] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.317] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0092.317] SetEndOfFile (hFile=0x1c8) returned 1 [0092.317] CloseHandle (hObject=0x1c8) returned 1 [0092.317] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.317] SetEndOfFile (hFile=0x1c0) returned 1 [0092.321] CloseHandle (hObject=0x1c0) returned 1 [0092.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1 [0092.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.321] lstrlenW (lpString=".doc") returned 4 [0092.321] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0092.321] lstrlenW (lpString=".docx") returned 5 [0092.321] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.322] lstrlenW (lpString=".pdf") returned 4 [0092.322] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".xls") returned 4 [0092.322] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".xlsx") returned 5 [0092.322] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.322] lstrlenW (lpString=".ppt") returned 4 [0092.322] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.322] lstrlenW (lpString=".zip") returned 4 [0092.322] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".rar") returned 4 [0092.322] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".bz2") returned 4 [0092.322] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".7z") returned 3 [0092.322] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.322] lstrlenW (lpString=".dbf") returned 4 [0092.322] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.322] lstrlenW (lpString=".1cd") returned 4 [0092.322] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.322] lstrlenW (lpString=".jpg") returned 4 [0092.322] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.322] lstrlenW (lpString=".docx") returned 5 [0092.322] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.322] lstrlenW (lpString=".pdf") returned 4 [0092.322] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString=".xls") returned 4 [0092.323] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString=".xlsx") returned 5 [0092.323] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.323] lstrlenW (lpString=".ppt") returned 4 [0092.323] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.323] lstrlenW (lpString=".zip") returned 4 [0092.323] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString=".rar") returned 4 [0092.323] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString=".bz2") returned 4 [0092.323] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString=".7z") returned 3 [0092.323] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.323] lstrlenW (lpString=".dbf") returned 4 [0092.323] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.323] lstrlenW (lpString=".1cd") returned 4 [0092.323] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0092.323] lstrlenW (lpString=".jpg") returned 4 [0092.323] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.323] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") [0092.324] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=37760) returned 1 [0092.324] CloseHandle (hObject=0x1c0) returned 1 [0092.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20 [0092.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.324] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.324] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.325] GetLastError () returned 0x0 [0092.325] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9380, lpOverlapped=0x0) returned 1 [0092.519] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0092.521] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.521] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0092.521] SetEndOfFile (hFile=0x1c8) returned 1 [0092.584] CloseHandle (hObject=0x1c8) returned 1 [0092.584] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.584] SetEndOfFile (hFile=0x1c0) returned 1 [0092.585] CloseHandle (hObject=0x1c0) returned 1 [0092.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 1 [0092.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.692] lstrlenW (lpString=".doc") returned 4 [0092.692] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString=".docx") returned 5 [0092.692] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0092.692] lstrlenW (lpString=".pdf") returned 4 [0092.692] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString=".xls") returned 4 [0092.692] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString=".xlsx") returned 5 [0092.692] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0092.692] lstrlenW (lpString=".ppt") returned 4 [0092.692] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.692] lstrlenW (lpString=".zip") returned 4 [0092.692] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString=".rar") returned 4 [0092.692] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.692] lstrlenW (lpString=".bz2") returned 4 [0092.692] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.692] lstrlenW (lpString=".7z") returned 3 [0092.692] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.692] lstrlenW (lpString=".dbf") returned 4 [0092.692] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.693] lstrlenW (lpString=".1cd") returned 4 [0092.693] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0092.693] lstrlenW (lpString=".jpg") returned 4 [0092.693] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.693] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") [0092.738] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=552368) returned 1 [0092.738] CloseHandle (hObject=0x1c8) returned 1 [0092.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 0x20 [0092.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.739] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.739] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.739] GetLastError () returned 0x0 [0092.739] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x86db0, lpOverlapped=0x0) returned 1 [0092.764] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x86dc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x86dc0, lpOverlapped=0x0) returned 1 [0092.775] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.775] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.775] SetEndOfFile (hFile=0x210) returned 1 [0092.775] CloseHandle (hObject=0x210) returned 1 [0092.775] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.775] SetEndOfFile (hFile=0x1c8) returned 1 [0092.780] CloseHandle (hObject=0x1c8) returned 1 [0092.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 1 [0092.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.780] lstrlenW (lpString=".doc") returned 4 [0092.780] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.780] lstrlenW (lpString=".docx") returned 5 [0092.781] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0092.781] lstrlenW (lpString=".pdf") returned 4 [0092.781] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.781] lstrlenW (lpString=".xls") returned 4 [0092.781] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.781] lstrlenW (lpString=".xlsx") returned 5 [0092.781] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0092.781] lstrlenW (lpString=".ppt") returned 4 [0092.781] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.781] lstrlenW (lpString=".zip") returned 4 [0092.781] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.781] lstrlenW (lpString=".rar") returned 4 [0092.781] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.781] lstrlenW (lpString=".bz2") returned 4 [0092.781] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.781] lstrlenW (lpString=".7z") returned 3 [0092.781] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.781] lstrlenW (lpString=".dbf") returned 4 [0092.781] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.781] lstrlenW (lpString=".1cd") returned 4 [0092.781] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0092.781] lstrlenW (lpString=".jpg") returned 4 [0092.781] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.781] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") [0092.887] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6250496) returned 1 [0092.887] CloseHandle (hObject=0x1c0) returned 1 [0092.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0092.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0092.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.987] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0092.987] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.987] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.019] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1fcaaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0093.019] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.030] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0093.030] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x5b6000, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0093.030] ReadFile (in: hFile=0x1c0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.046] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.046] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0093.296] SetEndOfFile (hFile=0x1c0) returned 1 [0093.296] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0093.296] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0093.296] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1fcaaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0093.298] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.302] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x5b6000, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0093.302] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.304] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0093.304] CloseHandle (hObject=0x1c0) returned 1 [0093.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString=".doc") returned 4 [0093.305] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".docx") returned 5 [0093.305] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0093.305] lstrlenW (lpString=".pdf") returned 4 [0093.305] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".xls") returned 4 [0093.305] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".xlsx") returned 5 [0093.305] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0093.305] lstrlenW (lpString=".ppt") returned 4 [0093.305] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString=".zip") returned 4 [0093.305] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".rar") returned 4 [0093.305] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".bz2") returned 4 [0093.305] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString=".7z") returned 3 [0093.305] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString=".dbf") returned 4 [0093.305] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString=".1cd") returned 4 [0093.305] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0093.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0093.305] lstrlenW (lpString=".jpg") returned 4 [0093.306] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0093.306] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") [0093.813] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=778) returned 1 [0093.813] CloseHandle (hObject=0x158) returned 1 [0093.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 0x20 [0093.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.814] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.814] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.814] GetLastError () returned 0x0 [0093.814] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x30a, lpOverlapped=0x0) returned 1 [0093.816] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x310, lpOverlapped=0x0) returned 1 [0093.817] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.817] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0093.817] SetEndOfFile (hFile=0x1fc) returned 1 [0093.817] CloseHandle (hObject=0x1fc) returned 1 [0093.817] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.817] SetEndOfFile (hFile=0x158) returned 1 [0093.818] CloseHandle (hObject=0x158) returned 1 [0093.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString=".doc") returned 4 [0093.819] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0093.819] lstrlenW (lpString=".docx") returned 5 [0093.819] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0093.819] lstrlenW (lpString=".pdf") returned 4 [0093.819] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0093.819] lstrlenW (lpString=".xls") returned 4 [0093.819] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0093.819] lstrlenW (lpString=".xlsx") returned 5 [0093.819] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0093.819] lstrlenW (lpString=".ppt") returned 4 [0093.819] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString=".zip") returned 4 [0093.819] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0093.819] lstrlenW (lpString=".rar") returned 4 [0093.819] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0093.819] lstrlenW (lpString=".bz2") returned 4 [0093.819] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0093.819] lstrlenW (lpString=".7z") returned 3 [0093.819] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString=".dbf") returned 4 [0093.819] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString=".1cd") returned 4 [0093.819] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0093.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0093.819] lstrlenW (lpString=".jpg") returned 4 [0093.819] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0093.820] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") [0093.821] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1571704) returned 1 [0093.821] CloseHandle (hObject=0x158) returned 1 [0093.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 0x20 [0093.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.821] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.821] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.822] GetLastError () returned 0x0 [0093.822] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0093.846] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0094.062] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x7fb88, lpOverlapped=0x0) returned 1 [0094.076] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x7fb90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7fb90, lpOverlapped=0x0) returned 1 [0094.087] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.087] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0094.087] SetEndOfFile (hFile=0x1fc) returned 1 [0094.218] CloseHandle (hObject=0x1fc) returned 1 [0094.218] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.247] SetEndOfFile (hFile=0x158) returned 1 [0094.253] CloseHandle (hObject=0x158) returned 1 [0094.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 1 [0094.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.253] lstrlenW (lpString=".doc") returned 4 [0094.253] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.253] lstrlenW (lpString=".docx") returned 5 [0094.253] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0094.254] lstrlenW (lpString=".pdf") returned 4 [0094.254] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.254] lstrlenW (lpString=".xls") returned 4 [0094.254] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.254] lstrlenW (lpString=".xlsx") returned 5 [0094.254] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0094.254] lstrlenW (lpString=".ppt") returned 4 [0094.254] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.254] lstrlenW (lpString=".zip") returned 4 [0094.254] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.254] lstrlenW (lpString=".rar") returned 4 [0094.254] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.254] lstrlenW (lpString=".bz2") returned 4 [0094.254] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.254] lstrlenW (lpString=".7z") returned 3 [0094.254] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.254] lstrlenW (lpString=".dbf") returned 4 [0094.254] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.254] lstrlenW (lpString=".1cd") returned 4 [0094.254] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0094.254] lstrlenW (lpString=".jpg") returned 4 [0094.254] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.254] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") [0094.255] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2242968) returned 1 [0094.255] CloseHandle (hObject=0x158) returned 1 [0094.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0x20 [0094.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0094.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.257] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0094.257] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.257] ReadFile (in: hFile=0x158, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.260] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb6888, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.260] ReadFile (in: hFile=0x158, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.265] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.265] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e3998, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.265] ReadFile (in: hFile=0x158, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.289] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.289] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0116, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0116, lpOverlapped=0x0) returned 1 [0094.377] SetEndOfFile (hFile=0x158) returned 1 [0094.377] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0094.377] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.377] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.379] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb6888, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.379] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.381] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e3998, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.381] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.382] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0094.382] CloseHandle (hObject=0x158) returned 1 [0094.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.383] lstrlenW (lpString=".doc") returned 4 [0094.383] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString=".docx") returned 5 [0094.383] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0094.383] lstrlenW (lpString=".pdf") returned 4 [0094.383] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString=".xls") returned 4 [0094.383] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString=".xlsx") returned 5 [0094.383] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0094.383] lstrlenW (lpString=".ppt") returned 4 [0094.383] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.383] lstrlenW (lpString=".zip") returned 4 [0094.383] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString=".rar") returned 4 [0094.383] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.383] lstrlenW (lpString=".bz2") returned 4 [0094.383] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.383] lstrlenW (lpString=".7z") returned 3 [0094.383] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.383] lstrlenW (lpString=".dbf") returned 4 [0094.383] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.383] lstrlenW (lpString=".1cd") returned 4 [0094.383] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0094.384] lstrlenW (lpString=".jpg") returned 4 [0094.384] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.384] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") [0094.385] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=39776) returned 1 [0094.385] CloseHandle (hObject=0x158) returned 1 [0094.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 0x20 [0094.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0094.385] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.385] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.386] GetLastError () returned 0x0 [0094.386] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9b60, lpOverlapped=0x0) returned 1 [0094.391] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9b70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9b70, lpOverlapped=0x0) returned 1 [0094.393] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.393] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0094.393] SetEndOfFile (hFile=0x1ec) returned 1 [0094.393] CloseHandle (hObject=0x1ec) returned 1 [0094.393] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.393] SetEndOfFile (hFile=0x158) returned 1 [0094.394] CloseHandle (hObject=0x158) returned 1 [0094.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 1 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.395] lstrlenW (lpString=".doc") returned 4 [0094.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString=".docx") returned 5 [0094.395] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0094.395] lstrlenW (lpString=".pdf") returned 4 [0094.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString=".xls") returned 4 [0094.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString=".xlsx") returned 5 [0094.395] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0094.395] lstrlenW (lpString=".ppt") returned 4 [0094.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.395] lstrlenW (lpString=".zip") returned 4 [0094.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString=".rar") returned 4 [0094.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.395] lstrlenW (lpString=".bz2") returned 4 [0094.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.395] lstrlenW (lpString=".7z") returned 3 [0094.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.395] lstrlenW (lpString=".dbf") returned 4 [0094.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.395] lstrlenW (lpString=".1cd") returned 4 [0094.395] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0094.396] lstrlenW (lpString=".jpg") returned 4 [0094.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.396] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") [0094.420] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=26758) returned 1 [0094.420] CloseHandle (hObject=0x1ec) returned 1 [0094.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 0x20 [0094.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.430] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.430] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.431] GetLastError () returned 0x0 [0094.431] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6886, lpOverlapped=0x0) returned 1 [0094.477] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6890, lpOverlapped=0x0) returned 1 [0094.478] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.478] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0094.478] SetEndOfFile (hFile=0x210) returned 1 [0094.479] CloseHandle (hObject=0x210) returned 1 [0094.479] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.479] SetEndOfFile (hFile=0x1ec) returned 1 [0094.480] CloseHandle (hObject=0x1ec) returned 1 [0094.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1 [0094.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.480] lstrlenW (lpString=".doc") returned 4 [0094.480] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0094.480] lstrlenW (lpString=".docx") returned 5 [0094.480] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0094.480] lstrlenW (lpString=".pdf") returned 4 [0094.480] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0094.480] lstrlenW (lpString=".xls") returned 4 [0094.480] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0094.480] lstrlenW (lpString=".xlsx") returned 5 [0094.480] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0094.480] lstrlenW (lpString=".ppt") returned 4 [0094.480] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0094.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.480] lstrlenW (lpString=".zip") returned 4 [0094.480] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0094.481] lstrlenW (lpString=".rar") returned 4 [0094.481] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0094.481] lstrlenW (lpString=".bz2") returned 4 [0094.481] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0094.481] lstrlenW (lpString=".7z") returned 3 [0094.481] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0094.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.481] lstrlenW (lpString=".dbf") returned 4 [0094.481] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0094.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.481] lstrlenW (lpString=".1cd") returned 4 [0094.481] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0094.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0094.481] lstrlenW (lpString=".jpg") returned 4 [0094.481] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0094.481] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") [0094.482] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=613760) returned 1 [0094.482] CloseHandle (hObject=0x1ec) returned 1 [0094.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 0x20 [0094.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.482] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.482] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0094.483] GetLastError () returned 0x0 [0094.483] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x95d80, lpOverlapped=0x0) returned 1 [0094.740] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x95d90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x95d90, lpOverlapped=0x0) returned 1 [0094.751] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.751] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0094.751] SetEndOfFile (hFile=0x210) returned 1 [0094.751] CloseHandle (hObject=0x210) returned 1 [0094.751] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.751] SetEndOfFile (hFile=0x1ec) returned 1 [0094.757] CloseHandle (hObject=0x1ec) returned 1 [0094.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 1 [0094.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.757] lstrlenW (lpString=".doc") returned 4 [0094.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.757] lstrlenW (lpString=".docx") returned 5 [0094.757] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0094.757] lstrlenW (lpString=".pdf") returned 4 [0094.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.757] lstrlenW (lpString=".xls") returned 4 [0094.757] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.757] lstrlenW (lpString=".xlsx") returned 5 [0094.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0094.757] lstrlenW (lpString=".ppt") returned 4 [0094.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.757] lstrlenW (lpString=".zip") returned 4 [0094.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.757] lstrlenW (lpString=".rar") returned 4 [0094.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.758] lstrlenW (lpString=".bz2") returned 4 [0094.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.758] lstrlenW (lpString=".7z") returned 3 [0094.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.758] lstrlenW (lpString=".dbf") returned 4 [0094.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.758] lstrlenW (lpString=".1cd") returned 4 [0094.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0094.758] lstrlenW (lpString=".jpg") returned 4 [0094.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.758] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") [0095.168] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15788) returned 1 [0095.168] CloseHandle (hObject=0x19c) returned 1 [0095.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0095.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.169] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.169] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.169] GetLastError () returned 0x0 [0095.169] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3dac, lpOverlapped=0x0) returned 1 [0095.171] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0095.172] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.172] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.173] SetEndOfFile (hFile=0x1c8) returned 1 [0095.173] CloseHandle (hObject=0x1c8) returned 1 [0095.173] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.173] SetEndOfFile (hFile=0x19c) returned 1 [0095.174] CloseHandle (hObject=0x19c) returned 1 [0095.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.174] lstrlenW (lpString=".doc") returned 4 [0095.174] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.174] lstrlenW (lpString=".docx") returned 5 [0095.174] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0095.174] lstrlenW (lpString=".pdf") returned 4 [0095.174] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.174] lstrlenW (lpString=".xls") returned 4 [0095.174] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.174] lstrlenW (lpString=".xlsx") returned 5 [0095.174] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0095.174] lstrlenW (lpString=".ppt") returned 4 [0095.174] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.174] lstrlenW (lpString=".zip") returned 4 [0095.174] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.174] lstrlenW (lpString=".rar") returned 4 [0095.175] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.175] lstrlenW (lpString=".bz2") returned 4 [0095.175] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.175] lstrlenW (lpString=".7z") returned 3 [0095.175] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.175] lstrlenW (lpString=".dbf") returned 4 [0095.175] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.175] lstrlenW (lpString=".1cd") returned 4 [0095.175] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0095.175] lstrlenW (lpString=".jpg") returned 4 [0095.175] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.175] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") [0095.175] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=186776) returned 1 [0095.176] CloseHandle (hObject=0x19c) returned 1 [0095.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 0x20 [0095.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.176] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.176] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.176] GetLastError () returned 0x0 [0095.176] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2d998, lpOverlapped=0x0) returned 1 [0095.181] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2d9a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2d9a0, lpOverlapped=0x0) returned 1 [0095.185] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.185] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.185] SetEndOfFile (hFile=0x1c8) returned 1 [0095.185] CloseHandle (hObject=0x1c8) returned 1 [0095.185] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.185] SetEndOfFile (hFile=0x19c) returned 1 [0095.187] CloseHandle (hObject=0x19c) returned 1 [0095.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 1 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString=".doc") returned 4 [0095.188] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString=".docx") returned 5 [0095.188] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0095.188] lstrlenW (lpString=".pdf") returned 4 [0095.188] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString=".xls") returned 4 [0095.188] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString=".xlsx") returned 5 [0095.188] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0095.188] lstrlenW (lpString=".ppt") returned 4 [0095.188] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString=".zip") returned 4 [0095.188] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString=".rar") returned 4 [0095.188] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.188] lstrlenW (lpString=".bz2") returned 4 [0095.188] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.188] lstrlenW (lpString=".7z") returned 3 [0095.188] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString=".dbf") returned 4 [0095.188] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString=".1cd") returned 4 [0095.188] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0095.188] lstrlenW (lpString=".jpg") returned 4 [0095.188] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.188] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") [0095.190] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=947072) returned 1 [0095.190] CloseHandle (hObject=0x19c) returned 1 [0095.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 0x20 [0095.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.190] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.190] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.191] GetLastError () returned 0x0 [0095.191] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe7380, lpOverlapped=0x0) returned 1 [0095.211] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe7390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe7390, lpOverlapped=0x0) returned 1 [0095.241] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.242] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.242] SetEndOfFile (hFile=0x1c8) returned 1 [0095.417] CloseHandle (hObject=0x1c8) returned 1 [0095.417] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.417] SetEndOfFile (hFile=0x19c) returned 1 [0095.424] CloseHandle (hObject=0x19c) returned 1 [0095.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 1 [0095.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.490] lstrlenW (lpString=".doc") returned 4 [0095.490] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.491] lstrlenW (lpString=".docx") returned 5 [0095.491] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0095.491] lstrlenW (lpString=".pdf") returned 4 [0095.491] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.491] lstrlenW (lpString=".xls") returned 4 [0095.491] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.491] lstrlenW (lpString=".xlsx") returned 5 [0095.520] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0095.520] lstrlenW (lpString=".ppt") returned 4 [0095.520] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.520] lstrlenW (lpString=".zip") returned 4 [0095.520] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.520] lstrlenW (lpString=".rar") returned 4 [0095.520] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.520] lstrlenW (lpString=".bz2") returned 4 [0095.520] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.520] lstrlenW (lpString=".7z") returned 3 [0095.520] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.520] lstrlenW (lpString=".dbf") returned 4 [0095.520] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.520] lstrlenW (lpString=".1cd") returned 4 [0095.521] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0095.521] lstrlenW (lpString=".jpg") returned 4 [0095.521] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.521] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") [0095.522] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=53128) returned 1 [0095.522] CloseHandle (hObject=0x16c) returned 1 [0095.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 0x20 [0095.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.522] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.522] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.523] GetLastError () returned 0x0 [0095.523] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xcf88, lpOverlapped=0x0) returned 1 [0095.525] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xcf90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xcf90, lpOverlapped=0x0) returned 1 [0095.527] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.527] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.527] SetEndOfFile (hFile=0x1c0) returned 1 [0095.527] CloseHandle (hObject=0x1c0) returned 1 [0095.527] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.527] SetEndOfFile (hFile=0x16c) returned 1 [0095.528] CloseHandle (hObject=0x16c) returned 1 [0095.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 1 [0095.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.529] lstrlenW (lpString=".doc") returned 4 [0095.529] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString=".docx") returned 5 [0095.529] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0095.529] lstrlenW (lpString=".pdf") returned 4 [0095.529] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString=".xls") returned 4 [0095.529] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString=".xlsx") returned 5 [0095.529] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0095.529] lstrlenW (lpString=".ppt") returned 4 [0095.529] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.529] lstrlenW (lpString=".zip") returned 4 [0095.529] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString=".rar") returned 4 [0095.529] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.529] lstrlenW (lpString=".bz2") returned 4 [0095.529] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.529] lstrlenW (lpString=".7z") returned 3 [0095.529] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.529] lstrlenW (lpString=".dbf") returned 4 [0095.529] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.530] lstrlenW (lpString=".1cd") returned 4 [0095.530] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0095.530] lstrlenW (lpString=".jpg") returned 4 [0095.530] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.530] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") [0095.531] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=183160) returned 1 [0095.531] CloseHandle (hObject=0x16c) returned 1 [0095.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 0x20 [0095.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.531] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.531] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.532] GetLastError () returned 0x0 [0095.532] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2cb78, lpOverlapped=0x0) returned 1 [0095.537] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2cb80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2cb80, lpOverlapped=0x0) returned 1 [0095.543] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.543] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.543] SetEndOfFile (hFile=0x1c0) returned 1 [0095.543] CloseHandle (hObject=0x1c0) returned 1 [0095.543] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.543] SetEndOfFile (hFile=0x16c) returned 1 [0095.545] CloseHandle (hObject=0x16c) returned 1 [0095.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 1 [0095.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.721] lstrlenW (lpString=".doc") returned 4 [0095.721] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.721] lstrlenW (lpString=".docx") returned 5 [0095.721] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0095.721] lstrlenW (lpString=".pdf") returned 4 [0095.721] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.721] lstrlenW (lpString=".xls") returned 4 [0095.721] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.721] lstrlenW (lpString=".xlsx") returned 5 [0095.721] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0095.721] lstrlenW (lpString=".ppt") returned 4 [0095.721] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.721] lstrlenW (lpString=".zip") returned 4 [0095.721] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.722] lstrlenW (lpString=".rar") returned 4 [0095.722] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.722] lstrlenW (lpString=".bz2") returned 4 [0095.722] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.722] lstrlenW (lpString=".7z") returned 3 [0095.722] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.722] lstrlenW (lpString=".dbf") returned 4 [0095.722] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.722] lstrlenW (lpString=".1cd") returned 4 [0095.722] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0095.722] lstrlenW (lpString=".jpg") returned 4 [0095.722] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.722] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") [0095.731] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=13744) returned 1 [0095.731] CloseHandle (hObject=0x1f4) returned 1 [0095.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0095.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.731] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.732] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.733] GetLastError () returned 0x0 [0095.733] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x35b0, lpOverlapped=0x0) returned 1 [0095.827] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0095.828] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.828] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.828] SetEndOfFile (hFile=0x1c0) returned 1 [0095.829] CloseHandle (hObject=0x1c0) returned 1 [0095.829] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.829] SetEndOfFile (hFile=0x1f4) returned 1 [0095.830] CloseHandle (hObject=0x1f4) returned 1 [0095.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1 [0095.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.830] lstrlenW (lpString=".doc") returned 4 [0095.830] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.830] lstrlenW (lpString=".docx") returned 5 [0095.830] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.830] lstrlenW (lpString=".pdf") returned 4 [0095.830] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.830] lstrlenW (lpString=".xls") returned 4 [0095.830] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.830] lstrlenW (lpString=".xlsx") returned 5 [0095.830] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.830] lstrlenW (lpString=".ppt") returned 4 [0095.830] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.830] lstrlenW (lpString=".zip") returned 4 [0095.830] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.830] lstrlenW (lpString=".rar") returned 4 [0095.830] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.830] lstrlenW (lpString=".bz2") returned 4 [0095.831] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.831] lstrlenW (lpString=".7z") returned 3 [0095.831] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.831] lstrlenW (lpString=".dbf") returned 4 [0095.831] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.831] lstrlenW (lpString=".1cd") returned 4 [0095.831] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0095.831] lstrlenW (lpString=".jpg") returned 4 [0095.831] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.831] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") [0095.832] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=9648) returned 1 [0095.832] CloseHandle (hObject=0x1f4) returned 1 [0095.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0095.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.833] GetLastError () returned 0x0 [0095.833] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x25b0, lpOverlapped=0x0) returned 1 [0095.850] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0095.851] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.851] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.851] SetEndOfFile (hFile=0x1c0) returned 1 [0095.855] CloseHandle (hObject=0x1c0) returned 1 [0096.005] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.005] SetEndOfFile (hFile=0x1f4) returned 1 [0096.006] CloseHandle (hObject=0x1f4) returned 1 [0096.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1 [0096.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.006] lstrlenW (lpString=".doc") returned 4 [0096.006] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.006] lstrlenW (lpString=".docx") returned 5 [0096.006] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0096.006] lstrlenW (lpString=".pdf") returned 4 [0096.006] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.006] lstrlenW (lpString=".xls") returned 4 [0096.006] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.006] lstrlenW (lpString=".xlsx") returned 5 [0096.006] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0096.006] lstrlenW (lpString=".ppt") returned 4 [0096.006] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.006] lstrlenW (lpString=".zip") returned 4 [0096.007] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.007] lstrlenW (lpString=".rar") returned 4 [0096.007] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.007] lstrlenW (lpString=".bz2") returned 4 [0096.007] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.007] lstrlenW (lpString=".7z") returned 3 [0096.007] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.007] lstrlenW (lpString=".dbf") returned 4 [0096.007] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.007] lstrlenW (lpString=".1cd") returned 4 [0096.007] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0096.007] lstrlenW (lpString=".jpg") returned 4 [0096.007] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.007] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") [0096.158] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=63864) returned 1 [0096.158] CloseHandle (hObject=0x1f4) returned 1 [0096.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0096.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.159] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.159] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.171] GetLastError () returned 0x0 [0096.171] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xf978, lpOverlapped=0x0) returned 1 [0096.186] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0096.189] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.189] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0096.189] SetEndOfFile (hFile=0x19c) returned 1 [0096.189] CloseHandle (hObject=0x19c) returned 1 [0096.189] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.189] SetEndOfFile (hFile=0x1f4) returned 1 [0096.191] CloseHandle (hObject=0x1f4) returned 1 [0096.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.191] lstrlenW (lpString=".doc") returned 4 [0096.191] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.191] lstrlenW (lpString=".docx") returned 5 [0096.191] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0096.191] lstrlenW (lpString=".pdf") returned 4 [0096.191] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.191] lstrlenW (lpString=".xls") returned 4 [0096.191] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.191] lstrlenW (lpString=".xlsx") returned 5 [0096.191] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0096.191] lstrlenW (lpString=".ppt") returned 4 [0096.191] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.192] lstrlenW (lpString=".zip") returned 4 [0096.192] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.192] lstrlenW (lpString=".rar") returned 4 [0096.192] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.192] lstrlenW (lpString=".bz2") returned 4 [0096.192] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.192] lstrlenW (lpString=".7z") returned 3 [0096.192] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.192] lstrlenW (lpString=".dbf") returned 4 [0096.192] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.192] lstrlenW (lpString=".1cd") returned 4 [0096.192] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0096.192] lstrlenW (lpString=".jpg") returned 4 [0096.192] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.192] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") [0096.193] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=766384) returned 1 [0096.193] CloseHandle (hObject=0x1f4) returned 1 [0096.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 0x20 [0096.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.194] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.194] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.195] GetLastError () returned 0x0 [0096.195] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb1b0, lpOverlapped=0x0) returned 1 [0096.459] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbb1c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbb1c0, lpOverlapped=0x0) returned 1 [0096.481] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.481] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0096.481] SetEndOfFile (hFile=0x19c) returned 1 [0096.481] CloseHandle (hObject=0x19c) returned 1 [0096.482] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.482] SetEndOfFile (hFile=0x1f4) returned 1 [0096.488] CloseHandle (hObject=0x1f4) returned 1 [0096.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 1 [0096.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.488] lstrlenW (lpString=".doc") returned 4 [0096.488] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.488] lstrlenW (lpString=".docx") returned 5 [0096.488] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0096.488] lstrlenW (lpString=".pdf") returned 4 [0096.488] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.488] lstrlenW (lpString=".xls") returned 4 [0096.488] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.488] lstrlenW (lpString=".xlsx") returned 5 [0096.488] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0096.488] lstrlenW (lpString=".ppt") returned 4 [0096.488] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.488] lstrlenW (lpString=".zip") returned 4 [0096.489] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.489] lstrlenW (lpString=".rar") returned 4 [0096.489] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.489] lstrlenW (lpString=".bz2") returned 4 [0096.489] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.489] lstrlenW (lpString=".7z") returned 3 [0096.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.489] lstrlenW (lpString=".dbf") returned 4 [0096.489] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.489] lstrlenW (lpString=".1cd") returned 4 [0096.489] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0096.489] lstrlenW (lpString=".jpg") returned 4 [0096.489] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.489] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") [0096.490] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1369952) returned 1 [0096.490] CloseHandle (hObject=0x1f4) returned 1 [0096.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 0x20 [0096.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.490] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.491] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.491] GetLastError () returned 0x0 [0096.491] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0096.735] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0096.752] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0096.897] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0096.906] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.906] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.906] SetEndOfFile (hFile=0x19c) returned 1 [0096.906] CloseHandle (hObject=0x19c) returned 1 [0096.906] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.906] SetEndOfFile (hFile=0x1f4) returned 1 [0096.909] CloseHandle (hObject=0x1f4) returned 1 [0096.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.001] lstrlenW (lpString=".doc") returned 4 [0097.001] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString=".docx") returned 5 [0097.001] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0097.001] lstrlenW (lpString=".pdf") returned 4 [0097.001] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString=".xls") returned 4 [0097.001] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString=".xlsx") returned 5 [0097.001] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0097.001] lstrlenW (lpString=".ppt") returned 4 [0097.001] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.001] lstrlenW (lpString=".zip") returned 4 [0097.001] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString=".rar") returned 4 [0097.001] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.001] lstrlenW (lpString=".bz2") returned 4 [0097.001] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.001] lstrlenW (lpString=".7z") returned 3 [0097.001] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.002] lstrlenW (lpString=".dbf") returned 4 [0097.002] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.002] lstrlenW (lpString=".1cd") returned 4 [0097.002] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0097.002] lstrlenW (lpString=".jpg") returned 4 [0097.002] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.002] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") [0097.002] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=311852) returned 1 [0097.002] CloseHandle (hObject=0x22c) returned 1 [0097.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 0x20 [0097.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0097.003] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.003] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0097.104] GetLastError () returned 0x0 [0097.104] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4c22c, lpOverlapped=0x0) returned 1 [0097.270] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4c230, lpOverlapped=0x0) returned 1 [0097.278] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.278] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.278] SetEndOfFile (hFile=0x158) returned 1 [0097.278] CloseHandle (hObject=0x158) returned 1 [0097.278] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.278] SetEndOfFile (hFile=0x22c) returned 1 [0097.281] CloseHandle (hObject=0x22c) returned 1 [0097.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1 [0097.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.420] lstrlenW (lpString=".doc") returned 4 [0097.420] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0097.420] lstrlenW (lpString=".docx") returned 5 [0097.420] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0097.420] lstrlenW (lpString=".pdf") returned 4 [0097.420] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0097.420] lstrlenW (lpString=".xls") returned 4 [0097.420] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0097.420] lstrlenW (lpString=".xlsx") returned 5 [0097.420] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0097.420] lstrlenW (lpString=".ppt") returned 4 [0097.420] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0097.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.420] lstrlenW (lpString=".zip") returned 4 [0097.420] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0097.420] lstrlenW (lpString=".rar") returned 4 [0097.420] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0097.420] lstrlenW (lpString=".bz2") returned 4 [0097.420] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0097.420] lstrlenW (lpString=".7z") returned 3 [0097.420] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.421] lstrlenW (lpString=".dbf") returned 4 [0097.421] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.421] lstrlenW (lpString=".1cd") returned 4 [0097.421] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0097.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0097.421] lstrlenW (lpString=".jpg") returned 4 [0097.421] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0097.421] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") [0097.456] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=239488) returned 1 [0097.456] CloseHandle (hObject=0x1a0) returned 1 [0097.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 0x20 [0097.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.465] GetLastError () returned 0x0 [0097.465] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3a780, lpOverlapped=0x0) returned 1 [0097.471] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3a790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3a790, lpOverlapped=0x0) returned 1 [0097.476] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.476] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0097.476] SetEndOfFile (hFile=0x180) returned 1 [0097.477] CloseHandle (hObject=0x180) returned 1 [0097.477] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.477] SetEndOfFile (hFile=0x1a0) returned 1 [0097.479] CloseHandle (hObject=0x1a0) returned 1 [0097.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 1 [0097.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.479] lstrlenW (lpString=".doc") returned 4 [0097.479] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.479] lstrlenW (lpString=".docx") returned 5 [0097.479] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0097.479] lstrlenW (lpString=".pdf") returned 4 [0097.479] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.479] lstrlenW (lpString=".xls") returned 4 [0097.479] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.479] lstrlenW (lpString=".xlsx") returned 5 [0097.480] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0097.480] lstrlenW (lpString=".ppt") returned 4 [0097.480] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.480] lstrlenW (lpString=".zip") returned 4 [0097.480] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.480] lstrlenW (lpString=".rar") returned 4 [0097.480] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.480] lstrlenW (lpString=".bz2") returned 4 [0097.480] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.480] lstrlenW (lpString=".7z") returned 3 [0097.480] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.480] lstrlenW (lpString=".dbf") returned 4 [0097.480] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.480] lstrlenW (lpString=".1cd") returned 4 [0097.480] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0097.480] lstrlenW (lpString=".jpg") returned 4 [0097.480] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.480] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") [0097.482] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0097.482] CloseHandle (hObject=0x1a0) returned 1 [0097.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 0x20 [0097.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.482] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.482] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.483] GetLastError () returned 0x0 [0097.483] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0097.484] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0097.485] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.485] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.485] SetEndOfFile (hFile=0x180) returned 1 [0097.485] CloseHandle (hObject=0x180) returned 1 [0097.485] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.486] SetEndOfFile (hFile=0x1a0) returned 1 [0097.486] CloseHandle (hObject=0x1a0) returned 1 [0097.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1 [0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.487] lstrlenW (lpString=".doc") returned 4 [0097.487] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0097.487] lstrlenW (lpString=".docx") returned 5 [0097.487] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0097.487] lstrlenW (lpString=".pdf") returned 4 [0097.487] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0097.487] lstrlenW (lpString=".xls") returned 4 [0097.487] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0097.487] lstrlenW (lpString=".xlsx") returned 5 [0097.487] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0097.487] lstrlenW (lpString=".ppt") returned 4 [0097.487] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.487] lstrlenW (lpString=".zip") returned 4 [0097.487] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0097.487] lstrlenW (lpString=".rar") returned 4 [0097.487] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0097.487] lstrlenW (lpString=".bz2") returned 4 [0097.487] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0097.487] lstrlenW (lpString=".7z") returned 3 [0097.487] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.487] lstrlenW (lpString=".dbf") returned 4 [0097.487] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0097.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.487] lstrlenW (lpString=".1cd") returned 4 [0097.487] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0097.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0097.488] lstrlenW (lpString=".jpg") returned 4 [0097.488] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0097.488] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") [0097.488] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0097.488] CloseHandle (hObject=0x1a0) returned 1 [0097.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 0x20 [0097.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.489] GetLastError () returned 0x0 [0097.489] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0097.490] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0097.491] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.491] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.491] SetEndOfFile (hFile=0x180) returned 1 [0097.492] CloseHandle (hObject=0x180) returned 1 [0097.492] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.492] SetEndOfFile (hFile=0x1a0) returned 1 [0097.492] CloseHandle (hObject=0x1a0) returned 1 [0097.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.493] lstrlenW (lpString=".doc") returned 4 [0097.493] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0097.493] lstrlenW (lpString=".docx") returned 5 [0097.493] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0097.493] lstrlenW (lpString=".pdf") returned 4 [0097.493] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0097.493] lstrlenW (lpString=".xls") returned 4 [0097.493] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0097.493] lstrlenW (lpString=".xlsx") returned 5 [0097.493] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0097.493] lstrlenW (lpString=".ppt") returned 4 [0097.493] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.493] lstrlenW (lpString=".zip") returned 4 [0097.493] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0097.493] lstrlenW (lpString=".rar") returned 4 [0097.493] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0097.493] lstrlenW (lpString=".bz2") returned 4 [0097.493] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0097.493] lstrlenW (lpString=".7z") returned 3 [0097.493] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.493] lstrlenW (lpString=".dbf") returned 4 [0097.493] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.494] lstrlenW (lpString=".1cd") returned 4 [0097.494] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0097.494] lstrlenW (lpString=".jpg") returned 4 [0097.494] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0097.494] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") [0097.494] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=968) returned 1 [0097.494] CloseHandle (hObject=0x1a0) returned 1 [0097.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0097.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.495] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.495] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.495] GetLastError () returned 0x0 [0097.495] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3c8, lpOverlapped=0x0) returned 1 [0097.497] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0097.498] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.498] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.498] SetEndOfFile (hFile=0x180) returned 1 [0097.498] CloseHandle (hObject=0x180) returned 1 [0097.498] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.498] SetEndOfFile (hFile=0x1a0) returned 1 [0097.499] CloseHandle (hObject=0x1a0) returned 1 [0097.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1 [0097.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.499] lstrlenW (lpString=".doc") returned 4 [0097.499] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0097.499] lstrlenW (lpString=".docx") returned 5 [0097.499] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0097.499] lstrlenW (lpString=".pdf") returned 4 [0097.499] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0097.499] lstrlenW (lpString=".xls") returned 4 [0097.500] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0097.500] lstrlenW (lpString=".xlsx") returned 5 [0097.500] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0097.500] lstrlenW (lpString=".ppt") returned 4 [0097.500] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0097.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.500] lstrlenW (lpString=".zip") returned 4 [0097.500] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0097.500] lstrlenW (lpString=".rar") returned 4 [0097.500] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0097.500] lstrlenW (lpString=".bz2") returned 4 [0097.500] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0097.500] lstrlenW (lpString=".7z") returned 3 [0097.500] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0097.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.500] lstrlenW (lpString=".dbf") returned 4 [0097.500] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0097.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.500] lstrlenW (lpString=".1cd") returned 4 [0097.500] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0097.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0097.500] lstrlenW (lpString=".jpg") returned 4 [0097.500] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0097.500] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") [0097.501] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=789) returned 1 [0097.501] CloseHandle (hObject=0x1a0) returned 1 [0097.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0097.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0097.501] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.501] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0097.502] GetLastError () returned 0x0 [0097.502] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x315, lpOverlapped=0x0) returned 1 [0097.795] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x320, lpOverlapped=0x0) returned 1 [0097.897] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.897] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0097.897] SetEndOfFile (hFile=0x180) returned 1 [0097.995] CloseHandle (hObject=0x180) returned 1 [0097.995] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.995] SetEndOfFile (hFile=0x1a0) returned 1 [0097.998] CloseHandle (hObject=0x1a0) returned 1 [0097.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 1 [0097.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0097.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0097.999] lstrlenW (lpString=".doc") returned 4 [0097.999] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString=".docx") returned 5 [0097.999] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0097.999] lstrlenW (lpString=".pdf") returned 4 [0097.999] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString=".xls") returned 4 [0097.999] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString=".xlsx") returned 5 [0097.999] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0097.999] lstrlenW (lpString=".ppt") returned 4 [0097.999] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0097.999] lstrlenW (lpString=".zip") returned 4 [0097.999] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString=".rar") returned 4 [0097.999] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString=".bz2") returned 4 [0097.999] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0097.999] lstrlenW (lpString=".7z") returned 3 [0097.999] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0097.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0097.999] lstrlenW (lpString=".dbf") returned 4 [0097.999] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0097.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0097.999] lstrlenW (lpString=".1cd") returned 4 [0098.000] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0098.000] lstrlenW (lpString=".jpg") returned 4 [0098.000] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.000] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") [0098.001] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.001] CloseHandle (hObject=0x1a0) returned 1 [0098.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20 [0098.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.001] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.001] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.002] GetLastError () returned 0x0 [0098.002] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.013] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.015] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.015] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.015] SetEndOfFile (hFile=0x180) returned 1 [0098.017] CloseHandle (hObject=0x180) returned 1 [0098.017] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.023] SetEndOfFile (hFile=0x1a0) returned 1 [0098.030] CloseHandle (hObject=0x1a0) returned 1 [0098.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1 [0098.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.037] lstrlenW (lpString=".doc") returned 4 [0098.037] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.037] lstrlenW (lpString=".docx") returned 5 [0098.037] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0098.037] lstrlenW (lpString=".pdf") returned 4 [0098.037] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.037] lstrlenW (lpString=".xls") returned 4 [0098.037] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.037] lstrlenW (lpString=".xlsx") returned 5 [0098.037] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0098.037] lstrlenW (lpString=".ppt") returned 4 [0098.037] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.037] lstrlenW (lpString=".zip") returned 4 [0098.037] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.038] lstrlenW (lpString=".rar") returned 4 [0098.038] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.038] lstrlenW (lpString=".bz2") returned 4 [0098.038] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.038] lstrlenW (lpString=".7z") returned 3 [0098.038] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.038] lstrlenW (lpString=".dbf") returned 4 [0098.038] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.038] lstrlenW (lpString=".1cd") returned 4 [0098.038] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0098.038] lstrlenW (lpString=".jpg") returned 4 [0098.038] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.038] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") [0098.040] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=805) returned 1 [0098.040] CloseHandle (hObject=0x1a0) returned 1 [0098.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0098.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.040] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.040] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.041] GetLastError () returned 0x0 [0098.041] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x325, lpOverlapped=0x0) returned 1 [0098.042] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x330, lpOverlapped=0x0) returned 1 [0098.043] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.043] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.043] SetEndOfFile (hFile=0x180) returned 1 [0098.043] CloseHandle (hObject=0x180) returned 1 [0098.043] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.043] SetEndOfFile (hFile=0x1a0) returned 1 [0098.044] CloseHandle (hObject=0x1a0) returned 1 [0098.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.045] lstrlenW (lpString=".doc") returned 4 [0098.045] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString=".docx") returned 5 [0098.045] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.045] lstrlenW (lpString=".pdf") returned 4 [0098.045] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString=".xls") returned 4 [0098.045] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString=".xlsx") returned 5 [0098.045] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.045] lstrlenW (lpString=".ppt") returned 4 [0098.045] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.045] lstrlenW (lpString=".zip") returned 4 [0098.045] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString=".rar") returned 4 [0098.045] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString=".bz2") returned 4 [0098.045] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.045] lstrlenW (lpString=".7z") returned 3 [0098.045] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.045] lstrlenW (lpString=".dbf") returned 4 [0098.045] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.045] lstrlenW (lpString=".1cd") returned 4 [0098.045] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0098.046] lstrlenW (lpString=".jpg") returned 4 [0098.046] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.046] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") [0098.046] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.046] CloseHandle (hObject=0x1a0) returned 1 [0098.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 0x20 [0098.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.046] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.046] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.047] GetLastError () returned 0x0 [0098.047] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.049] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.050] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.050] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.050] SetEndOfFile (hFile=0x180) returned 1 [0098.050] CloseHandle (hObject=0x180) returned 1 [0098.050] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.050] SetEndOfFile (hFile=0x1a0) returned 1 [0098.051] CloseHandle (hObject=0x1a0) returned 1 [0098.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 1 [0098.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.051] lstrlenW (lpString=".doc") returned 4 [0098.051] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.051] lstrlenW (lpString=".docx") returned 5 [0098.051] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.051] lstrlenW (lpString=".pdf") returned 4 [0098.051] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.051] lstrlenW (lpString=".xls") returned 4 [0098.051] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.051] lstrlenW (lpString=".xlsx") returned 5 [0098.051] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.051] lstrlenW (lpString=".ppt") returned 4 [0098.052] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.052] lstrlenW (lpString=".zip") returned 4 [0098.052] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.052] lstrlenW (lpString=".rar") returned 4 [0098.052] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.052] lstrlenW (lpString=".bz2") returned 4 [0098.052] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.052] lstrlenW (lpString=".7z") returned 3 [0098.052] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.052] lstrlenW (lpString=".dbf") returned 4 [0098.052] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.052] lstrlenW (lpString=".1cd") returned 4 [0098.052] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0098.052] lstrlenW (lpString=".jpg") returned 4 [0098.052] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.052] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") [0098.053] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0098.053] CloseHandle (hObject=0x1a0) returned 1 [0098.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 0x20 [0098.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.053] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.053] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.054] GetLastError () returned 0x0 [0098.054] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.055] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.056] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.056] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.056] SetEndOfFile (hFile=0x180) returned 1 [0098.056] CloseHandle (hObject=0x180) returned 1 [0098.056] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.056] SetEndOfFile (hFile=0x1a0) returned 1 [0098.057] CloseHandle (hObject=0x1a0) returned 1 [0098.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 1 [0098.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.058] lstrlenW (lpString=".doc") returned 4 [0098.058] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.058] lstrlenW (lpString=".docx") returned 5 [0098.058] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.058] lstrlenW (lpString=".pdf") returned 4 [0098.058] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.058] lstrlenW (lpString=".xls") returned 4 [0098.058] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.058] lstrlenW (lpString=".xlsx") returned 5 [0098.058] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.058] lstrlenW (lpString=".ppt") returned 4 [0098.058] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.058] lstrlenW (lpString=".zip") returned 4 [0098.058] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.058] lstrlenW (lpString=".rar") returned 4 [0098.058] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.058] lstrlenW (lpString=".bz2") returned 4 [0098.058] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.058] lstrlenW (lpString=".7z") returned 3 [0098.058] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.058] lstrlenW (lpString=".dbf") returned 4 [0098.058] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.058] lstrlenW (lpString=".1cd") returned 4 [0098.059] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0098.059] lstrlenW (lpString=".jpg") returned 4 [0098.059] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.059] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") [0098.059] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=765) returned 1 [0098.059] CloseHandle (hObject=0x1a0) returned 1 [0098.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20 [0098.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.060] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.060] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.060] GetLastError () returned 0x0 [0098.060] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x2fd, lpOverlapped=0x0) returned 1 [0098.206] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x300, lpOverlapped=0x0) returned 1 [0098.206] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.207] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0098.207] SetEndOfFile (hFile=0x180) returned 1 [0098.207] CloseHandle (hObject=0x180) returned 1 [0098.207] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.207] SetEndOfFile (hFile=0x1a0) returned 1 [0098.208] CloseHandle (hObject=0x1a0) returned 1 [0098.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 1 [0098.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.217] lstrlenW (lpString=".doc") returned 4 [0098.217] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.217] lstrlenW (lpString=".docx") returned 5 [0098.217] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0098.217] lstrlenW (lpString=".pdf") returned 4 [0098.217] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.217] lstrlenW (lpString=".xls") returned 4 [0098.217] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.217] lstrlenW (lpString=".xlsx") returned 5 [0098.217] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0098.217] lstrlenW (lpString=".ppt") returned 4 [0098.218] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.218] lstrlenW (lpString=".zip") returned 4 [0098.218] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.218] lstrlenW (lpString=".rar") returned 4 [0098.218] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.218] lstrlenW (lpString=".bz2") returned 4 [0098.218] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.218] lstrlenW (lpString=".7z") returned 3 [0098.218] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.218] lstrlenW (lpString=".dbf") returned 4 [0098.218] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.218] lstrlenW (lpString=".1cd") returned 4 [0098.218] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0098.218] lstrlenW (lpString=".jpg") returned 4 [0098.218] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.218] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") [0098.381] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0098.381] CloseHandle (hObject=0x210) returned 1 [0098.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 0x20 [0098.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.394] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.394] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.407] GetLastError () returned 0x0 [0098.407] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.427] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.428] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.428] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.428] SetEndOfFile (hFile=0x158) returned 1 [0098.428] CloseHandle (hObject=0x158) returned 1 [0098.428] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.428] SetEndOfFile (hFile=0x1c0) returned 1 [0098.429] CloseHandle (hObject=0x1c0) returned 1 [0098.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 1 [0098.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString=".doc") returned 4 [0098.430] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.430] lstrlenW (lpString=".docx") returned 5 [0098.430] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.430] lstrlenW (lpString=".pdf") returned 4 [0098.430] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.430] lstrlenW (lpString=".xls") returned 4 [0098.430] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.430] lstrlenW (lpString=".xlsx") returned 5 [0098.430] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.430] lstrlenW (lpString=".ppt") returned 4 [0098.430] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString=".zip") returned 4 [0098.430] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.430] lstrlenW (lpString=".rar") returned 4 [0098.430] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.430] lstrlenW (lpString=".bz2") returned 4 [0098.430] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.430] lstrlenW (lpString=".7z") returned 3 [0098.430] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString=".dbf") returned 4 [0098.430] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString=".1cd") returned 4 [0098.430] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0098.430] lstrlenW (lpString=".jpg") returned 4 [0098.430] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.430] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") [0098.431] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0098.431] CloseHandle (hObject=0x1c0) returned 1 [0098.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 0x20 [0098.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.432] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.432] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.432] GetLastError () returned 0x0 [0098.432] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.434] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.435] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.435] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.435] SetEndOfFile (hFile=0x158) returned 1 [0098.435] CloseHandle (hObject=0x158) returned 1 [0098.435] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.435] SetEndOfFile (hFile=0x1c0) returned 1 [0098.436] CloseHandle (hObject=0x1c0) returned 1 [0098.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 1 [0098.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.436] lstrlenW (lpString=".doc") returned 4 [0098.436] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.436] lstrlenW (lpString=".docx") returned 5 [0098.436] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.436] lstrlenW (lpString=".pdf") returned 4 [0098.436] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.436] lstrlenW (lpString=".xls") returned 4 [0098.436] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.436] lstrlenW (lpString=".xlsx") returned 5 [0098.436] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.436] lstrlenW (lpString=".ppt") returned 4 [0098.436] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.436] lstrlenW (lpString=".zip") returned 4 [0098.437] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.437] lstrlenW (lpString=".rar") returned 4 [0098.437] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.437] lstrlenW (lpString=".bz2") returned 4 [0098.437] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.437] lstrlenW (lpString=".7z") returned 3 [0098.437] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.437] lstrlenW (lpString=".dbf") returned 4 [0098.437] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.437] lstrlenW (lpString=".1cd") returned 4 [0098.437] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0098.437] lstrlenW (lpString=".jpg") returned 4 [0098.437] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.437] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") [0098.437] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=828) returned 1 [0098.438] CloseHandle (hObject=0x1c0) returned 1 [0098.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 0x20 [0098.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.438] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.438] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.438] GetLastError () returned 0x0 [0098.438] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x33c, lpOverlapped=0x0) returned 1 [0098.440] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x340, lpOverlapped=0x0) returned 1 [0098.441] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.441] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.441] SetEndOfFile (hFile=0x158) returned 1 [0098.441] CloseHandle (hObject=0x158) returned 1 [0098.441] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.441] SetEndOfFile (hFile=0x1c0) returned 1 [0098.442] CloseHandle (hObject=0x1c0) returned 1 [0098.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 1 [0098.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.442] lstrlenW (lpString=".doc") returned 4 [0098.442] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.442] lstrlenW (lpString=".docx") returned 5 [0098.442] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0098.442] lstrlenW (lpString=".pdf") returned 4 [0098.442] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.442] lstrlenW (lpString=".xls") returned 4 [0098.442] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.442] lstrlenW (lpString=".xlsx") returned 5 [0098.442] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0098.443] lstrlenW (lpString=".ppt") returned 4 [0098.443] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.443] lstrlenW (lpString=".zip") returned 4 [0098.443] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.443] lstrlenW (lpString=".rar") returned 4 [0098.443] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.443] lstrlenW (lpString=".bz2") returned 4 [0098.443] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.443] lstrlenW (lpString=".7z") returned 3 [0098.443] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.443] lstrlenW (lpString=".dbf") returned 4 [0098.443] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.443] lstrlenW (lpString=".1cd") returned 4 [0098.443] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0098.443] lstrlenW (lpString=".jpg") returned 4 [0098.443] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.443] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") [0098.444] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=777) returned 1 [0098.444] CloseHandle (hObject=0x1c0) returned 1 [0098.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 0x20 [0098.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.444] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.444] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.445] GetLastError () returned 0x0 [0098.445] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x309, lpOverlapped=0x0) returned 1 [0098.446] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.447] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.447] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.447] SetEndOfFile (hFile=0x158) returned 1 [0098.447] CloseHandle (hObject=0x158) returned 1 [0098.447] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.447] SetEndOfFile (hFile=0x1c0) returned 1 [0098.448] CloseHandle (hObject=0x1c0) returned 1 [0098.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 1 [0098.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString=".doc") returned 4 [0098.449] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString=".docx") returned 5 [0098.449] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.449] lstrlenW (lpString=".pdf") returned 4 [0098.449] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString=".xls") returned 4 [0098.449] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString=".xlsx") returned 5 [0098.449] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.449] lstrlenW (lpString=".ppt") returned 4 [0098.449] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString=".zip") returned 4 [0098.449] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString=".rar") returned 4 [0098.449] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString=".bz2") returned 4 [0098.449] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.449] lstrlenW (lpString=".7z") returned 3 [0098.449] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString=".dbf") returned 4 [0098.449] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString=".1cd") returned 4 [0098.449] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0098.449] lstrlenW (lpString=".jpg") returned 4 [0098.449] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.450] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") [0098.451] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=777) returned 1 [0098.451] CloseHandle (hObject=0x1c0) returned 1 [0098.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 0x20 [0098.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.451] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.451] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.451] GetLastError () returned 0x0 [0098.452] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x309, lpOverlapped=0x0) returned 1 [0098.485] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.486] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.486] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.486] SetEndOfFile (hFile=0x158) returned 1 [0098.486] CloseHandle (hObject=0x158) returned 1 [0098.486] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.486] SetEndOfFile (hFile=0x1c0) returned 1 [0098.487] CloseHandle (hObject=0x1c0) returned 1 [0098.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 1 [0098.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.499] lstrlenW (lpString=".doc") returned 4 [0098.499] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.499] lstrlenW (lpString=".docx") returned 5 [0098.499] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.499] lstrlenW (lpString=".pdf") returned 4 [0098.499] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.499] lstrlenW (lpString=".xls") returned 4 [0098.499] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.499] lstrlenW (lpString=".xlsx") returned 5 [0098.499] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.499] lstrlenW (lpString=".ppt") returned 4 [0098.499] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.499] lstrlenW (lpString=".zip") returned 4 [0098.500] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.500] lstrlenW (lpString=".rar") returned 4 [0098.500] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.500] lstrlenW (lpString=".bz2") returned 4 [0098.500] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.500] lstrlenW (lpString=".7z") returned 3 [0098.500] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.500] lstrlenW (lpString=".dbf") returned 4 [0098.500] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.500] lstrlenW (lpString=".1cd") returned 4 [0098.500] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0098.500] lstrlenW (lpString=".jpg") returned 4 [0098.500] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.500] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") [0098.519] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=808) returned 1 [0098.519] CloseHandle (hObject=0x1c0) returned 1 [0098.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 0x20 [0098.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.533] GetLastError () returned 0x0 [0098.533] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x328, lpOverlapped=0x0) returned 1 [0098.542] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x330, lpOverlapped=0x0) returned 1 [0098.546] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.546] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.547] SetEndOfFile (hFile=0x158) returned 1 [0098.547] CloseHandle (hObject=0x158) returned 1 [0098.547] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.547] SetEndOfFile (hFile=0x1c0) returned 1 [0098.548] CloseHandle (hObject=0x1c0) returned 1 [0098.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 1 [0098.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.548] lstrlenW (lpString=".doc") returned 4 [0098.548] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.548] lstrlenW (lpString=".docx") returned 5 [0098.548] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.548] lstrlenW (lpString=".pdf") returned 4 [0098.548] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.548] lstrlenW (lpString=".xls") returned 4 [0098.548] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.548] lstrlenW (lpString=".xlsx") returned 5 [0098.548] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.548] lstrlenW (lpString=".ppt") returned 4 [0098.548] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.548] lstrlenW (lpString=".zip") returned 4 [0098.548] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.548] lstrlenW (lpString=".rar") returned 4 [0098.549] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.549] lstrlenW (lpString=".bz2") returned 4 [0098.549] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.549] lstrlenW (lpString=".7z") returned 3 [0098.549] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.549] lstrlenW (lpString=".dbf") returned 4 [0098.549] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.549] lstrlenW (lpString=".1cd") returned 4 [0098.549] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0098.549] lstrlenW (lpString=".jpg") returned 4 [0098.549] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.549] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") [0098.550] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.550] CloseHandle (hObject=0x1c0) returned 1 [0098.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 0x20 [0098.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.550] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.550] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.551] GetLastError () returned 0x0 [0098.551] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.561] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.562] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.562] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.562] SetEndOfFile (hFile=0x158) returned 1 [0098.562] CloseHandle (hObject=0x158) returned 1 [0098.563] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.563] SetEndOfFile (hFile=0x1c0) returned 1 [0098.563] CloseHandle (hObject=0x1c0) returned 1 [0098.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 1 [0098.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.571] lstrlenW (lpString=".doc") returned 4 [0098.571] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.572] lstrlenW (lpString=".docx") returned 5 [0098.572] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.572] lstrlenW (lpString=".pdf") returned 4 [0098.572] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.572] lstrlenW (lpString=".xls") returned 4 [0098.572] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.572] lstrlenW (lpString=".xlsx") returned 5 [0098.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.572] lstrlenW (lpString=".ppt") returned 4 [0098.572] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.572] lstrlenW (lpString=".zip") returned 4 [0098.572] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.572] lstrlenW (lpString=".rar") returned 4 [0098.572] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.572] lstrlenW (lpString=".bz2") returned 4 [0098.572] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.572] lstrlenW (lpString=".7z") returned 3 [0098.572] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.572] lstrlenW (lpString=".dbf") returned 4 [0098.572] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.572] lstrlenW (lpString=".1cd") returned 4 [0098.572] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0098.572] lstrlenW (lpString=".jpg") returned 4 [0098.572] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.572] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") [0098.573] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=826) returned 1 [0098.573] CloseHandle (hObject=0x1c0) returned 1 [0098.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 0x20 [0098.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.573] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.573] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.574] GetLastError () returned 0x0 [0098.574] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x33a, lpOverlapped=0x0) returned 1 [0098.583] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x340, lpOverlapped=0x0) returned 1 [0098.583] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.583] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.584] SetEndOfFile (hFile=0x158) returned 1 [0098.584] CloseHandle (hObject=0x158) returned 1 [0098.584] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.584] SetEndOfFile (hFile=0x1c0) returned 1 [0098.585] CloseHandle (hObject=0x1c0) returned 1 [0098.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 1 [0098.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.585] lstrlenW (lpString=".doc") returned 4 [0098.585] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.585] lstrlenW (lpString=".docx") returned 5 [0098.585] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0098.585] lstrlenW (lpString=".pdf") returned 4 [0098.585] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.585] lstrlenW (lpString=".xls") returned 4 [0098.585] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.585] lstrlenW (lpString=".xlsx") returned 5 [0098.585] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0098.585] lstrlenW (lpString=".ppt") returned 4 [0098.585] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.585] lstrlenW (lpString=".zip") returned 4 [0098.585] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.585] lstrlenW (lpString=".rar") returned 4 [0098.585] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.586] lstrlenW (lpString=".bz2") returned 4 [0098.586] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.586] lstrlenW (lpString=".7z") returned 3 [0098.586] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.586] lstrlenW (lpString=".dbf") returned 4 [0098.586] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.586] lstrlenW (lpString=".1cd") returned 4 [0098.586] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0098.586] lstrlenW (lpString=".jpg") returned 4 [0098.586] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.586] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") [0098.586] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=781) returned 1 [0098.587] CloseHandle (hObject=0x1c0) returned 1 [0098.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 0x20 [0098.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.587] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.587] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.588] GetLastError () returned 0x0 [0098.588] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x30d, lpOverlapped=0x0) returned 1 [0098.589] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.590] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.590] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.590] SetEndOfFile (hFile=0x158) returned 1 [0098.590] CloseHandle (hObject=0x158) returned 1 [0098.590] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.590] SetEndOfFile (hFile=0x1c0) returned 1 [0098.591] CloseHandle (hObject=0x1c0) returned 1 [0098.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 1 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString=".doc") returned 4 [0098.592] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString=".docx") returned 5 [0098.592] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0098.592] lstrlenW (lpString=".pdf") returned 4 [0098.592] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString=".xls") returned 4 [0098.592] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString=".xlsx") returned 5 [0098.592] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0098.592] lstrlenW (lpString=".ppt") returned 4 [0098.592] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString=".zip") returned 4 [0098.592] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString=".rar") returned 4 [0098.592] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString=".bz2") returned 4 [0098.592] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.592] lstrlenW (lpString=".7z") returned 3 [0098.592] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString=".dbf") returned 4 [0098.592] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString=".1cd") returned 4 [0098.592] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0098.592] lstrlenW (lpString=".jpg") returned 4 [0098.592] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.592] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") [0098.593] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.593] CloseHandle (hObject=0x1c0) returned 1 [0098.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 0x20 [0098.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.593] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.593] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.594] GetLastError () returned 0x0 [0098.594] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.595] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.596] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.596] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.596] SetEndOfFile (hFile=0x158) returned 1 [0098.596] CloseHandle (hObject=0x158) returned 1 [0098.596] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.597] SetEndOfFile (hFile=0x1c0) returned 1 [0098.597] CloseHandle (hObject=0x1c0) returned 1 [0098.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 1 [0098.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.598] lstrlenW (lpString=".doc") returned 4 [0098.598] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.598] lstrlenW (lpString=".docx") returned 5 [0098.598] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.598] lstrlenW (lpString=".pdf") returned 4 [0098.598] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.598] lstrlenW (lpString=".xls") returned 4 [0098.598] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.598] lstrlenW (lpString=".xlsx") returned 5 [0098.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.598] lstrlenW (lpString=".ppt") returned 4 [0098.598] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.598] lstrlenW (lpString=".zip") returned 4 [0098.598] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.598] lstrlenW (lpString=".rar") returned 4 [0098.598] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.598] lstrlenW (lpString=".bz2") returned 4 [0098.598] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.598] lstrlenW (lpString=".7z") returned 3 [0098.598] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.598] lstrlenW (lpString=".dbf") returned 4 [0098.598] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.598] lstrlenW (lpString=".1cd") returned 4 [0098.598] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0098.599] lstrlenW (lpString=".jpg") returned 4 [0098.599] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.599] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") [0098.790] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0098.790] CloseHandle (hObject=0x1a0) returned 1 [0098.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 0x20 [0098.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.790] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.790] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.791] GetLastError () returned 0x0 [0098.791] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.793] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.794] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.794] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.794] SetEndOfFile (hFile=0x180) returned 1 [0098.794] CloseHandle (hObject=0x180) returned 1 [0098.794] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.794] SetEndOfFile (hFile=0x1a0) returned 1 [0098.795] CloseHandle (hObject=0x1a0) returned 1 [0098.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 1 [0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.795] lstrlenW (lpString=".doc") returned 4 [0098.795] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.795] lstrlenW (lpString=".docx") returned 5 [0098.795] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.795] lstrlenW (lpString=".pdf") returned 4 [0098.795] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.795] lstrlenW (lpString=".xls") returned 4 [0098.795] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.795] lstrlenW (lpString=".xlsx") returned 5 [0098.796] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.796] lstrlenW (lpString=".ppt") returned 4 [0098.796] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.796] lstrlenW (lpString=".zip") returned 4 [0098.796] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.796] lstrlenW (lpString=".rar") returned 4 [0098.796] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.796] lstrlenW (lpString=".bz2") returned 4 [0098.796] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.796] lstrlenW (lpString=".7z") returned 3 [0098.796] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.796] lstrlenW (lpString=".dbf") returned 4 [0098.796] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.796] lstrlenW (lpString=".1cd") returned 4 [0098.796] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0098.796] lstrlenW (lpString=".jpg") returned 4 [0098.796] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.796] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") [0098.797] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=788) returned 1 [0098.797] CloseHandle (hObject=0x1a0) returned 1 [0098.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 0x20 [0098.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.798] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.798] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.798] GetLastError () returned 0x0 [0098.798] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x314, lpOverlapped=0x0) returned 1 [0098.800] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x320, lpOverlapped=0x0) returned 1 [0098.801] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.801] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.801] SetEndOfFile (hFile=0x180) returned 1 [0098.801] CloseHandle (hObject=0x180) returned 1 [0098.801] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.801] SetEndOfFile (hFile=0x1a0) returned 1 [0098.802] CloseHandle (hObject=0x1a0) returned 1 [0098.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 1 [0098.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.802] lstrlenW (lpString=".doc") returned 4 [0098.802] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.802] lstrlenW (lpString=".docx") returned 5 [0098.802] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0098.802] lstrlenW (lpString=".pdf") returned 4 [0098.802] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.802] lstrlenW (lpString=".xls") returned 4 [0098.802] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.802] lstrlenW (lpString=".xlsx") returned 5 [0098.802] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0098.802] lstrlenW (lpString=".ppt") returned 4 [0098.803] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.803] lstrlenW (lpString=".zip") returned 4 [0098.803] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.803] lstrlenW (lpString=".rar") returned 4 [0098.803] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.803] lstrlenW (lpString=".bz2") returned 4 [0098.803] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.803] lstrlenW (lpString=".7z") returned 3 [0098.803] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.803] lstrlenW (lpString=".dbf") returned 4 [0098.803] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.803] lstrlenW (lpString=".1cd") returned 4 [0098.803] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0098.803] lstrlenW (lpString=".jpg") returned 4 [0098.803] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.803] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") [0098.804] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.804] CloseHandle (hObject=0x1a0) returned 1 [0098.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 0x20 [0098.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.805] GetLastError () returned 0x0 [0098.805] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.809] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.810] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.810] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.810] SetEndOfFile (hFile=0x180) returned 1 [0098.810] CloseHandle (hObject=0x180) returned 1 [0098.810] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.810] SetEndOfFile (hFile=0x1a0) returned 1 [0098.811] CloseHandle (hObject=0x1a0) returned 1 [0098.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 1 [0098.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.811] lstrlenW (lpString=".doc") returned 4 [0098.811] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.811] lstrlenW (lpString=".docx") returned 5 [0098.811] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.811] lstrlenW (lpString=".pdf") returned 4 [0098.812] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.812] lstrlenW (lpString=".xls") returned 4 [0098.812] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.812] lstrlenW (lpString=".xlsx") returned 5 [0098.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.812] lstrlenW (lpString=".ppt") returned 4 [0098.812] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.812] lstrlenW (lpString=".zip") returned 4 [0098.812] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.812] lstrlenW (lpString=".rar") returned 4 [0098.812] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.812] lstrlenW (lpString=".bz2") returned 4 [0098.812] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.812] lstrlenW (lpString=".7z") returned 3 [0098.812] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.812] lstrlenW (lpString=".dbf") returned 4 [0098.812] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.812] lstrlenW (lpString=".1cd") returned 4 [0098.812] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0098.812] lstrlenW (lpString=".jpg") returned 4 [0098.812] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.812] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") [0098.813] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0098.813] CloseHandle (hObject=0x1a0) returned 1 [0098.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 0x20 [0098.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.813] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.813] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.814] GetLastError () returned 0x0 [0098.814] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.815] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.816] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.816] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.816] SetEndOfFile (hFile=0x180) returned 1 [0098.817] CloseHandle (hObject=0x180) returned 1 [0098.817] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.817] SetEndOfFile (hFile=0x1a0) returned 1 [0098.817] CloseHandle (hObject=0x1a0) returned 1 [0098.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 1 [0098.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.818] lstrlenW (lpString=".doc") returned 4 [0098.818] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.818] lstrlenW (lpString=".docx") returned 5 [0098.818] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.818] lstrlenW (lpString=".pdf") returned 4 [0098.818] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.818] lstrlenW (lpString=".xls") returned 4 [0098.818] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.818] lstrlenW (lpString=".xlsx") returned 5 [0098.818] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.818] lstrlenW (lpString=".ppt") returned 4 [0098.818] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.818] lstrlenW (lpString=".zip") returned 4 [0098.818] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.818] lstrlenW (lpString=".rar") returned 4 [0098.818] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.818] lstrlenW (lpString=".bz2") returned 4 [0098.818] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.818] lstrlenW (lpString=".7z") returned 3 [0098.818] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.818] lstrlenW (lpString=".dbf") returned 4 [0098.818] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.819] lstrlenW (lpString=".1cd") returned 4 [0098.819] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0098.819] lstrlenW (lpString=".jpg") returned 4 [0098.819] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.819] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") [0098.819] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0098.819] CloseHandle (hObject=0x1a0) returned 1 [0098.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 0x20 [0098.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0098.820] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.820] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.820] GetLastError () returned 0x0 [0098.820] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.822] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.823] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.823] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.823] SetEndOfFile (hFile=0x180) returned 1 [0098.823] CloseHandle (hObject=0x180) returned 1 [0098.823] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.823] SetEndOfFile (hFile=0x1a0) returned 1 [0098.824] CloseHandle (hObject=0x1a0) returned 1 [0098.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 1 [0098.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.824] lstrlenW (lpString=".doc") returned 4 [0098.824] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.824] lstrlenW (lpString=".docx") returned 5 [0098.824] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.824] lstrlenW (lpString=".pdf") returned 4 [0098.824] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.824] lstrlenW (lpString=".xls") returned 4 [0098.824] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.824] lstrlenW (lpString=".xlsx") returned 5 [0098.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.825] lstrlenW (lpString=".ppt") returned 4 [0098.825] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.825] lstrlenW (lpString=".zip") returned 4 [0098.825] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.825] lstrlenW (lpString=".rar") returned 4 [0098.825] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.825] lstrlenW (lpString=".bz2") returned 4 [0098.825] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.825] lstrlenW (lpString=".7z") returned 3 [0098.825] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.825] lstrlenW (lpString=".dbf") returned 4 [0098.825] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.825] lstrlenW (lpString=".1cd") returned 4 [0098.825] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0098.825] lstrlenW (lpString=".jpg") returned 4 [0098.825] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.825] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") [0099.032] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2998) returned 1 [0099.032] CloseHandle (hObject=0x158) returned 1 [0099.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 0x20 [0099.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.052] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.052] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.053] GetLastError () returned 0x0 [0099.053] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.054] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.055] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.055] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.055] SetEndOfFile (hFile=0x1c0) returned 1 [0099.057] CloseHandle (hObject=0x1c0) returned 1 [0099.057] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.057] SetEndOfFile (hFile=0x158) returned 1 [0099.058] CloseHandle (hObject=0x158) returned 1 [0099.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 1 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString=".doc") returned 4 [0099.059] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.059] lstrlenW (lpString=".docx") returned 5 [0099.059] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.059] lstrlenW (lpString=".pdf") returned 4 [0099.059] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.059] lstrlenW (lpString=".xls") returned 4 [0099.059] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.059] lstrlenW (lpString=".xlsx") returned 5 [0099.059] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.059] lstrlenW (lpString=".ppt") returned 4 [0099.059] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString=".zip") returned 4 [0099.059] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.059] lstrlenW (lpString=".rar") returned 4 [0099.059] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.059] lstrlenW (lpString=".bz2") returned 4 [0099.059] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.059] lstrlenW (lpString=".7z") returned 3 [0099.059] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString=".dbf") returned 4 [0099.059] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString=".1cd") returned 4 [0099.059] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0099.059] lstrlenW (lpString=".jpg") returned 4 [0099.059] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.060] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") [0099.060] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1199) returned 1 [0099.060] CloseHandle (hObject=0x158) returned 1 [0099.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 0x20 [0099.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.060] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.060] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.061] GetLastError () returned 0x0 [0099.061] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4af, lpOverlapped=0x0) returned 1 [0099.062] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0099.063] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.063] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.063] SetEndOfFile (hFile=0x1c0) returned 1 [0099.063] CloseHandle (hObject=0x1c0) returned 1 [0099.064] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.064] SetEndOfFile (hFile=0x158) returned 1 [0099.064] CloseHandle (hObject=0x158) returned 1 [0099.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 1 [0099.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.065] lstrlenW (lpString=".doc") returned 4 [0099.065] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString=".docx") returned 5 [0099.065] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0099.065] lstrlenW (lpString=".pdf") returned 4 [0099.065] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString=".xls") returned 4 [0099.065] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString=".xlsx") returned 5 [0099.065] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0099.065] lstrlenW (lpString=".ppt") returned 4 [0099.065] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.065] lstrlenW (lpString=".zip") returned 4 [0099.065] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString=".rar") returned 4 [0099.065] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString=".bz2") returned 4 [0099.065] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.065] lstrlenW (lpString=".7z") returned 3 [0099.065] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.065] lstrlenW (lpString=".dbf") returned 4 [0099.065] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.065] lstrlenW (lpString=".1cd") returned 4 [0099.065] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0099.066] lstrlenW (lpString=".jpg") returned 4 [0099.066] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.066] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") [0099.066] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=835) returned 1 [0099.066] CloseHandle (hObject=0x158) returned 1 [0099.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 0x20 [0099.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.066] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.067] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.067] GetLastError () returned 0x0 [0099.067] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x343, lpOverlapped=0x0) returned 1 [0099.071] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x350, lpOverlapped=0x0) returned 1 [0099.072] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.072] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.072] SetEndOfFile (hFile=0x1c0) returned 1 [0099.072] CloseHandle (hObject=0x1c0) returned 1 [0099.072] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.072] SetEndOfFile (hFile=0x158) returned 1 [0099.073] CloseHandle (hObject=0x158) returned 1 [0099.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 1 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString=".doc") returned 4 [0099.074] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString=".docx") returned 5 [0099.074] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0099.074] lstrlenW (lpString=".pdf") returned 4 [0099.074] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString=".xls") returned 4 [0099.074] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString=".xlsx") returned 5 [0099.074] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0099.074] lstrlenW (lpString=".ppt") returned 4 [0099.074] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString=".zip") returned 4 [0099.074] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString=".rar") returned 4 [0099.074] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString=".bz2") returned 4 [0099.074] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.074] lstrlenW (lpString=".7z") returned 3 [0099.074] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString=".dbf") returned 4 [0099.074] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString=".1cd") returned 4 [0099.074] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0099.074] lstrlenW (lpString=".jpg") returned 4 [0099.074] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.075] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") [0099.085] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=833) returned 1 [0099.085] CloseHandle (hObject=0x158) returned 1 [0099.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 0x20 [0099.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.085] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.085] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.086] GetLastError () returned 0x0 [0099.086] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x341, lpOverlapped=0x0) returned 1 [0099.097] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x350, lpOverlapped=0x0) returned 1 [0099.098] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.098] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.099] SetEndOfFile (hFile=0x1c0) returned 1 [0099.099] CloseHandle (hObject=0x1c0) returned 1 [0099.099] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.099] SetEndOfFile (hFile=0x158) returned 1 [0099.100] CloseHandle (hObject=0x158) returned 1 [0099.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 1 [0099.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.100] lstrlenW (lpString=".doc") returned 4 [0099.100] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.100] lstrlenW (lpString=".docx") returned 5 [0099.100] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0099.100] lstrlenW (lpString=".pdf") returned 4 [0099.100] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.100] lstrlenW (lpString=".xls") returned 4 [0099.100] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.100] lstrlenW (lpString=".xlsx") returned 5 [0099.100] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0099.100] lstrlenW (lpString=".ppt") returned 4 [0099.100] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.100] lstrlenW (lpString=".zip") returned 4 [0099.101] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.101] lstrlenW (lpString=".rar") returned 4 [0099.101] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.101] lstrlenW (lpString=".bz2") returned 4 [0099.101] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.101] lstrlenW (lpString=".7z") returned 3 [0099.101] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.101] lstrlenW (lpString=".dbf") returned 4 [0099.101] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.101] lstrlenW (lpString=".1cd") returned 4 [0099.101] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0099.101] lstrlenW (lpString=".jpg") returned 4 [0099.101] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.101] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") [0099.102] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=840) returned 1 [0099.102] CloseHandle (hObject=0x158) returned 1 [0099.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 0x20 [0099.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.102] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.102] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.103] GetLastError () returned 0x0 [0099.103] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x348, lpOverlapped=0x0) returned 1 [0099.113] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x350, lpOverlapped=0x0) returned 1 [0099.115] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.115] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.115] SetEndOfFile (hFile=0x1c0) returned 1 [0099.115] CloseHandle (hObject=0x1c0) returned 1 [0099.115] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.115] SetEndOfFile (hFile=0x158) returned 1 [0099.116] CloseHandle (hObject=0x158) returned 1 [0099.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 1 [0099.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.116] lstrlenW (lpString=".doc") returned 4 [0099.116] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.116] lstrlenW (lpString=".docx") returned 5 [0099.116] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0099.116] lstrlenW (lpString=".pdf") returned 4 [0099.116] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.116] lstrlenW (lpString=".xls") returned 4 [0099.116] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.116] lstrlenW (lpString=".xlsx") returned 5 [0099.116] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0099.116] lstrlenW (lpString=".ppt") returned 4 [0099.116] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.116] lstrlenW (lpString=".zip") returned 4 [0099.116] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.116] lstrlenW (lpString=".rar") returned 4 [0099.117] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.117] lstrlenW (lpString=".bz2") returned 4 [0099.117] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.117] lstrlenW (lpString=".7z") returned 3 [0099.117] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.117] lstrlenW (lpString=".dbf") returned 4 [0099.117] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.117] lstrlenW (lpString=".1cd") returned 4 [0099.117] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0099.117] lstrlenW (lpString=".jpg") returned 4 [0099.117] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.117] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") [0099.172] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=664) returned 1 [0099.172] CloseHandle (hObject=0x1c0) returned 1 [0099.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 0x20 [0099.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.173] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.173] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.174] GetLastError () returned 0x0 [0099.174] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x298, lpOverlapped=0x0) returned 1 [0099.175] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0099.176] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.176] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.176] SetEndOfFile (hFile=0x1fc) returned 1 [0099.176] CloseHandle (hObject=0x1fc) returned 1 [0099.176] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.176] SetEndOfFile (hFile=0x1c0) returned 1 [0099.177] CloseHandle (hObject=0x1c0) returned 1 [0099.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 1 [0099.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.177] lstrlenW (lpString=".doc") returned 4 [0099.177] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.177] lstrlenW (lpString=".docx") returned 5 [0099.177] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0099.177] lstrlenW (lpString=".pdf") returned 4 [0099.177] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.177] lstrlenW (lpString=".xls") returned 4 [0099.177] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.177] lstrlenW (lpString=".xlsx") returned 5 [0099.177] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0099.177] lstrlenW (lpString=".ppt") returned 4 [0099.177] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.178] lstrlenW (lpString=".zip") returned 4 [0099.178] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.178] lstrlenW (lpString=".rar") returned 4 [0099.178] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.178] lstrlenW (lpString=".bz2") returned 4 [0099.178] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.178] lstrlenW (lpString=".7z") returned 3 [0099.178] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.178] lstrlenW (lpString=".dbf") returned 4 [0099.178] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.178] lstrlenW (lpString=".1cd") returned 4 [0099.178] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0099.178] lstrlenW (lpString=".jpg") returned 4 [0099.178] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.178] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") [0099.211] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=664) returned 1 [0099.211] CloseHandle (hObject=0x1c0) returned 1 [0099.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 0x20 [0099.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.212] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.212] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.212] GetLastError () returned 0x0 [0099.212] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x298, lpOverlapped=0x0) returned 1 [0099.213] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0099.214] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.214] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0099.214] SetEndOfFile (hFile=0x1fc) returned 1 [0099.215] CloseHandle (hObject=0x1fc) returned 1 [0099.215] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.215] SetEndOfFile (hFile=0x1c0) returned 1 [0099.215] CloseHandle (hObject=0x1c0) returned 1 [0099.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 1 [0099.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.216] lstrlenW (lpString=".doc") returned 4 [0099.216] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString=".docx") returned 5 [0099.216] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0099.216] lstrlenW (lpString=".pdf") returned 4 [0099.216] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString=".xls") returned 4 [0099.216] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString=".xlsx") returned 5 [0099.216] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0099.216] lstrlenW (lpString=".ppt") returned 4 [0099.216] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.216] lstrlenW (lpString=".zip") returned 4 [0099.216] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString=".rar") returned 4 [0099.216] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.216] lstrlenW (lpString=".bz2") returned 4 [0099.216] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.216] lstrlenW (lpString=".7z") returned 3 [0099.216] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.216] lstrlenW (lpString=".dbf") returned 4 [0099.217] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.217] lstrlenW (lpString=".1cd") returned 4 [0099.217] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0099.217] lstrlenW (lpString=".jpg") returned 4 [0099.217] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.217] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") [0099.217] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2238) returned 1 [0099.217] CloseHandle (hObject=0x1c0) returned 1 [0099.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 0x20 [0099.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.218] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.218] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.218] GetLastError () returned 0x0 [0099.218] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x8be, lpOverlapped=0x0) returned 1 [0099.222] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0099.222] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.222] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0099.223] SetEndOfFile (hFile=0x1fc) returned 1 [0099.223] CloseHandle (hObject=0x1fc) returned 1 [0099.223] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.223] SetEndOfFile (hFile=0x1c0) returned 1 [0099.224] CloseHandle (hObject=0x1c0) returned 1 [0099.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 1 [0099.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.224] lstrlenW (lpString=".doc") returned 4 [0099.224] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.224] lstrlenW (lpString=".docx") returned 5 [0099.224] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.224] lstrlenW (lpString=".pdf") returned 4 [0099.224] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.224] lstrlenW (lpString=".xls") returned 4 [0099.224] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.224] lstrlenW (lpString=".xlsx") returned 5 [0099.224] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.224] lstrlenW (lpString=".ppt") returned 4 [0099.224] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.224] lstrlenW (lpString=".zip") returned 4 [0099.224] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.224] lstrlenW (lpString=".rar") returned 4 [0099.224] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.224] lstrlenW (lpString=".bz2") returned 4 [0099.225] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.225] lstrlenW (lpString=".7z") returned 3 [0099.225] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.225] lstrlenW (lpString=".dbf") returned 4 [0099.225] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.225] lstrlenW (lpString=".1cd") returned 4 [0099.225] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0099.225] lstrlenW (lpString=".jpg") returned 4 [0099.225] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.225] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") [0099.226] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=768) returned 1 [0099.226] CloseHandle (hObject=0x1c0) returned 1 [0099.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 0x20 [0099.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.226] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.226] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.227] GetLastError () returned 0x0 [0099.227] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x300, lpOverlapped=0x0) returned 1 [0099.229] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x310, lpOverlapped=0x0) returned 1 [0099.229] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.230] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0099.230] SetEndOfFile (hFile=0x1fc) returned 1 [0099.230] CloseHandle (hObject=0x1fc) returned 1 [0099.230] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.230] SetEndOfFile (hFile=0x1c0) returned 1 [0099.231] CloseHandle (hObject=0x1c0) returned 1 [0099.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 1 [0099.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.231] lstrlenW (lpString=".doc") returned 4 [0099.231] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.231] lstrlenW (lpString=".docx") returned 5 [0099.231] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0099.231] lstrlenW (lpString=".pdf") returned 4 [0099.231] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.231] lstrlenW (lpString=".xls") returned 4 [0099.231] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.231] lstrlenW (lpString=".xlsx") returned 5 [0099.231] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0099.231] lstrlenW (lpString=".ppt") returned 4 [0099.231] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.231] lstrlenW (lpString=".zip") returned 4 [0099.231] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.231] lstrlenW (lpString=".rar") returned 4 [0099.232] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.232] lstrlenW (lpString=".bz2") returned 4 [0099.232] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.232] lstrlenW (lpString=".7z") returned 3 [0099.232] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.232] lstrlenW (lpString=".dbf") returned 4 [0099.232] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.232] lstrlenW (lpString=".1cd") returned 4 [0099.232] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0099.232] lstrlenW (lpString=".jpg") returned 4 [0099.232] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.232] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") [0099.232] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=804) returned 1 [0099.233] CloseHandle (hObject=0x1c0) returned 1 [0099.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 0x20 [0099.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.233] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.233] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.233] GetLastError () returned 0x0 [0099.233] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x324, lpOverlapped=0x0) returned 1 [0099.235] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x330, lpOverlapped=0x0) returned 1 [0099.236] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.236] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.236] SetEndOfFile (hFile=0x1fc) returned 1 [0099.236] CloseHandle (hObject=0x1fc) returned 1 [0099.236] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.236] SetEndOfFile (hFile=0x1c0) returned 1 [0099.237] CloseHandle (hObject=0x1c0) returned 1 [0099.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.237] lstrlenW (lpString=".doc") returned 4 [0099.237] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.237] lstrlenW (lpString=".docx") returned 5 [0099.237] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0099.237] lstrlenW (lpString=".pdf") returned 4 [0099.237] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.237] lstrlenW (lpString=".xls") returned 4 [0099.238] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.238] lstrlenW (lpString=".xlsx") returned 5 [0099.238] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0099.238] lstrlenW (lpString=".ppt") returned 4 [0099.238] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.238] lstrlenW (lpString=".zip") returned 4 [0099.238] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.238] lstrlenW (lpString=".rar") returned 4 [0099.238] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.238] lstrlenW (lpString=".bz2") returned 4 [0099.238] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.238] lstrlenW (lpString=".7z") returned 3 [0099.238] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.238] lstrlenW (lpString=".dbf") returned 4 [0099.238] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.238] lstrlenW (lpString=".1cd") returned 4 [0099.238] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0099.238] lstrlenW (lpString=".jpg") returned 4 [0099.238] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.238] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") [0099.239] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1078) returned 1 [0099.239] CloseHandle (hObject=0x1c0) returned 1 [0099.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 0x20 [0099.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.239] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.239] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.240] GetLastError () returned 0x0 [0099.240] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x436, lpOverlapped=0x0) returned 1 [0099.276] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.277] ReadFile (in: hFile=0x1c0, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.277] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.277] SetEndOfFile (hFile=0x1fc) returned 1 [0099.422] CloseHandle (hObject=0x1fc) returned 1 [0099.422] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.422] SetEndOfFile (hFile=0x1c0) returned 1 [0099.423] CloseHandle (hObject=0x1c0) returned 1 [0099.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.574] lstrlenW (lpString=".doc") returned 4 [0099.574] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.574] lstrlenW (lpString=".docx") returned 5 [0099.574] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.574] lstrlenW (lpString=".pdf") returned 4 [0099.574] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.575] lstrlenW (lpString=".xls") returned 4 [0099.575] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.575] lstrlenW (lpString=".xlsx") returned 5 [0099.575] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.575] lstrlenW (lpString=".ppt") returned 4 [0099.575] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.575] lstrlenW (lpString=".zip") returned 4 [0099.575] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.575] lstrlenW (lpString=".rar") returned 4 [0099.575] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.575] lstrlenW (lpString=".bz2") returned 4 [0099.575] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.575] lstrlenW (lpString=".7z") returned 3 [0099.575] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.575] lstrlenW (lpString=".dbf") returned 4 [0099.575] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.575] lstrlenW (lpString=".1cd") returned 4 [0099.575] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0099.575] lstrlenW (lpString=".jpg") returned 4 [0099.575] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.575] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") [0099.711] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2780032) returned 1 [0099.711] CloseHandle (hObject=0x15c) returned 1 [0099.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll")) returned 0x20 [0099.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0099.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.713] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0099.713] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.713] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.718] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe23d5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.718] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.728] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0099.728] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x266b80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.728] ReadFile (in: hFile=0x15c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.744] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.744] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0099.775] SetEndOfFile (hFile=0x15c) returned 1 [0099.831] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0099.831] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.831] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.833] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe23d5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.833] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.838] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x266b80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.838] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0099.840] CloseHandle (hObject=0x15c) returned 1 [0099.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString=".doc") returned 4 [0099.841] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString=".docx") returned 5 [0099.841] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0099.841] lstrlenW (lpString=".pdf") returned 4 [0099.841] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString=".xls") returned 4 [0099.841] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString=".xlsx") returned 5 [0099.841] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0099.841] lstrlenW (lpString=".ppt") returned 4 [0099.841] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString=".zip") returned 4 [0099.841] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString=".rar") returned 4 [0099.841] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.841] lstrlenW (lpString=".bz2") returned 4 [0099.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.841] lstrlenW (lpString=".7z") returned 3 [0099.841] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString=".dbf") returned 4 [0099.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString=".1cd") returned 4 [0099.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0099.841] lstrlenW (lpString=".jpg") returned 4 [0099.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.842] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") [0099.993] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6437760) returned 1 [0099.993] CloseHandle (hObject=0x16c) returned 1 [0099.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe")) returned 0x20 [0100.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0100.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.039] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0100.039] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0100.047] ReadFile (in: hFile=0x16c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.102] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x20be80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0100.102] ReadFile (in: hFile=0x16c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0100.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x5e3b80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0100.110] ReadFile (in: hFile=0x16c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.308] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.308] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0100.320] SetEndOfFile (hFile=0x16c) returned 1 [0100.383] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0100.383] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0100.388] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.425] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x20be80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0100.425] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.477] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x5e3b80, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0100.477] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.482] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0100.482] CloseHandle (hObject=0x16c) returned 1 [0100.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.483] lstrlenW (lpString=".doc") returned 4 [0100.483] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0100.483] lstrlenW (lpString=".docx") returned 5 [0100.483] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0100.483] lstrlenW (lpString=".pdf") returned 4 [0100.483] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0100.483] lstrlenW (lpString=".xls") returned 4 [0100.483] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0100.483] lstrlenW (lpString=".xlsx") returned 5 [0100.483] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0100.483] lstrlenW (lpString=".ppt") returned 4 [0100.483] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0100.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.483] lstrlenW (lpString=".zip") returned 4 [0100.483] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0100.483] lstrlenW (lpString=".rar") returned 4 [0100.483] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0100.483] lstrlenW (lpString=".bz2") returned 4 [0100.483] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0100.483] lstrlenW (lpString=".7z") returned 3 [0100.483] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0100.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.483] lstrlenW (lpString=".dbf") returned 4 [0100.483] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0100.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.484] lstrlenW (lpString=".1cd") returned 4 [0100.484] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0100.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0100.484] lstrlenW (lpString=".jpg") returned 4 [0100.484] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0100.484] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") [0100.618] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=318) returned 1 [0100.618] CloseHandle (hObject=0x158) returned 1 [0100.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico")) returned 0x20 [0100.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.618] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.618] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.653] GetLastError () returned 0x0 [0100.653] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.654] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.655] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.655] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.655] SetEndOfFile (hFile=0x16c) returned 1 [0100.655] CloseHandle (hObject=0x16c) returned 1 [0100.655] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.655] SetEndOfFile (hFile=0x158) returned 1 [0100.656] CloseHandle (hObject=0x158) returned 1 [0100.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico")) returned 1 [0100.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.656] lstrlenW (lpString=".doc") returned 4 [0100.656] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.656] lstrlenW (lpString=".docx") returned 5 [0100.656] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0100.656] lstrlenW (lpString=".pdf") returned 4 [0100.656] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.656] lstrlenW (lpString=".xls") returned 4 [0100.656] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.657] lstrlenW (lpString=".xlsx") returned 5 [0100.657] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0100.657] lstrlenW (lpString=".ppt") returned 4 [0100.657] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.657] lstrlenW (lpString=".zip") returned 4 [0100.657] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.657] lstrlenW (lpString=".rar") returned 4 [0100.657] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.657] lstrlenW (lpString=".bz2") returned 4 [0100.657] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.657] lstrlenW (lpString=".7z") returned 3 [0100.657] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.657] lstrlenW (lpString=".dbf") returned 4 [0100.657] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.657] lstrlenW (lpString=".1cd") returned 4 [0100.657] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0100.657] lstrlenW (lpString=".jpg") returned 4 [0100.657] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.657] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") [0100.658] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=318) returned 1 [0100.658] CloseHandle (hObject=0x158) returned 1 [0100.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico")) returned 0x20 [0100.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.658] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.658] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.705] GetLastError () returned 0x0 [0100.705] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.719] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.720] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.720] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.720] SetEndOfFile (hFile=0x1fc) returned 1 [0100.720] CloseHandle (hObject=0x1fc) returned 1 [0100.720] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.721] SetEndOfFile (hFile=0x158) returned 1 [0100.721] CloseHandle (hObject=0x158) returned 1 [0100.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico")) returned 1 [0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.722] lstrlenW (lpString=".doc") returned 4 [0100.722] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.722] lstrlenW (lpString=".docx") returned 5 [0100.722] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0100.722] lstrlenW (lpString=".pdf") returned 4 [0100.722] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.722] lstrlenW (lpString=".xls") returned 4 [0100.722] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.722] lstrlenW (lpString=".xlsx") returned 5 [0100.722] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0100.722] lstrlenW (lpString=".ppt") returned 4 [0100.722] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.722] lstrlenW (lpString=".zip") returned 4 [0100.722] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.722] lstrlenW (lpString=".rar") returned 4 [0100.722] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.722] lstrlenW (lpString=".bz2") returned 4 [0100.722] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.722] lstrlenW (lpString=".7z") returned 3 [0100.722] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.722] lstrlenW (lpString=".dbf") returned 4 [0100.722] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.722] lstrlenW (lpString=".1cd") returned 4 [0100.722] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0100.723] lstrlenW (lpString=".jpg") returned 4 [0100.723] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.723] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") [0101.131] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1718) returned 1 [0101.131] CloseHandle (hObject=0x1c0) returned 1 [0101.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico")) returned 0x20 [0101.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.164] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.164] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.193] GetLastError () returned 0x0 [0101.194] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6b6, lpOverlapped=0x0) returned 1 [0101.270] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0101.272] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.272] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x100, lpOverlapped=0x0) returned 1 [0101.272] SetEndOfFile (hFile=0x210) returned 1 [0101.272] CloseHandle (hObject=0x210) returned 1 [0101.272] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.272] SetEndOfFile (hFile=0x15c) returned 1 [0101.273] CloseHandle (hObject=0x15c) returned 1 [0101.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico")) returned 1 [0101.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.273] lstrlenW (lpString=".doc") returned 4 [0101.274] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.274] lstrlenW (lpString=".docx") returned 5 [0101.274] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0101.274] lstrlenW (lpString=".pdf") returned 4 [0101.274] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.274] lstrlenW (lpString=".xls") returned 4 [0101.274] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.274] lstrlenW (lpString=".xlsx") returned 5 [0101.274] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0101.274] lstrlenW (lpString=".ppt") returned 4 [0101.274] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.274] lstrlenW (lpString=".zip") returned 4 [0101.274] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.274] lstrlenW (lpString=".rar") returned 4 [0101.274] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.274] lstrlenW (lpString=".bz2") returned 4 [0101.274] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.274] lstrlenW (lpString=".7z") returned 3 [0101.274] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.274] lstrlenW (lpString=".dbf") returned 4 [0101.274] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.274] lstrlenW (lpString=".1cd") returned 4 [0101.274] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0101.274] lstrlenW (lpString=".jpg") returned 4 [0101.274] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.274] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") [0101.276] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=242528) returned 1 [0101.276] CloseHandle (hObject=0x15c) returned 1 [0101.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll")) returned 0x20 [0101.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.276] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.276] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.278] GetLastError () returned 0x0 [0101.278] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3b360, lpOverlapped=0x0) returned 1 [0101.337] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3b370, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3b370, lpOverlapped=0x0) returned 1 [0101.342] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.342] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0101.342] SetEndOfFile (hFile=0x210) returned 1 [0101.342] CloseHandle (hObject=0x210) returned 1 [0101.342] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.342] SetEndOfFile (hFile=0x15c) returned 1 [0101.345] CloseHandle (hObject=0x15c) returned 1 [0101.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll")) returned 1 [0101.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.345] lstrlenW (lpString=".doc") returned 4 [0101.345] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.345] lstrlenW (lpString=".docx") returned 5 [0101.345] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0101.345] lstrlenW (lpString=".pdf") returned 4 [0101.345] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.345] lstrlenW (lpString=".xls") returned 4 [0101.346] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.346] lstrlenW (lpString=".xlsx") returned 5 [0101.346] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0101.346] lstrlenW (lpString=".ppt") returned 4 [0101.346] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.346] lstrlenW (lpString=".zip") returned 4 [0101.346] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.346] lstrlenW (lpString=".rar") returned 4 [0101.346] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.346] lstrlenW (lpString=".bz2") returned 4 [0101.346] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.346] lstrlenW (lpString=".7z") returned 3 [0101.346] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.346] lstrlenW (lpString=".dbf") returned 4 [0101.346] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.346] lstrlenW (lpString=".1cd") returned 4 [0101.346] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0101.346] lstrlenW (lpString=".jpg") returned 4 [0101.346] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.346] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") [0101.348] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=725928) returned 1 [0101.348] CloseHandle (hObject=0x15c) returned 1 [0101.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe")) returned 0x20 [0101.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.349] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.349] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.350] GetLastError () returned 0x0 [0101.350] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xb13a8, lpOverlapped=0x0) returned 1 [0101.403] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xb13b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xb13b0, lpOverlapped=0x0) returned 1 [0101.418] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.418] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0101.418] SetEndOfFile (hFile=0x210) returned 1 [0101.418] CloseHandle (hObject=0x210) returned 1 [0101.418] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.418] SetEndOfFile (hFile=0x15c) returned 1 [0101.424] CloseHandle (hObject=0x15c) returned 1 [0101.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe")) returned 1 [0101.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.425] lstrlenW (lpString=".doc") returned 4 [0101.425] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0101.425] lstrlenW (lpString=".docx") returned 5 [0101.425] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0101.425] lstrlenW (lpString=".pdf") returned 4 [0101.425] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0101.425] lstrlenW (lpString=".xls") returned 4 [0101.425] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0101.425] lstrlenW (lpString=".xlsx") returned 5 [0101.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0101.425] lstrlenW (lpString=".ppt") returned 4 [0101.425] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0101.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.425] lstrlenW (lpString=".zip") returned 4 [0101.425] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0101.425] lstrlenW (lpString=".rar") returned 4 [0101.425] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0101.425] lstrlenW (lpString=".bz2") returned 4 [0101.425] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0101.425] lstrlenW (lpString=".7z") returned 3 [0101.425] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0101.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.426] lstrlenW (lpString=".dbf") returned 4 [0101.426] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0101.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.426] lstrlenW (lpString=".1cd") returned 4 [0101.426] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0101.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0101.426] lstrlenW (lpString=".jpg") returned 4 [0101.426] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0101.426] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") [0101.516] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=680336) returned 1 [0101.516] CloseHandle (hObject=0x15c) returned 1 [0101.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll")) returned 0x20 [0101.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.516] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.516] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.735] GetLastError () returned 0x0 [0101.735] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa6190, lpOverlapped=0x0) returned 1 [0101.751] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa61a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa61a0, lpOverlapped=0x0) returned 1 [0101.762] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.762] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.762] SetEndOfFile (hFile=0x1a0) returned 1 [0101.762] CloseHandle (hObject=0x1a0) returned 1 [0101.762] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.762] SetEndOfFile (hFile=0x15c) returned 1 [0101.832] CloseHandle (hObject=0x15c) returned 1 [0101.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll")) returned 1 [0101.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString=".doc") returned 4 [0101.835] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString=".docx") returned 5 [0101.835] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0101.835] lstrlenW (lpString=".pdf") returned 4 [0101.835] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString=".xls") returned 4 [0101.835] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString=".xlsx") returned 5 [0101.835] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0101.835] lstrlenW (lpString=".ppt") returned 4 [0101.835] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString=".zip") returned 4 [0101.835] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString=".rar") returned 4 [0101.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.835] lstrlenW (lpString=".bz2") returned 4 [0101.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.835] lstrlenW (lpString=".7z") returned 3 [0101.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString=".dbf") returned 4 [0101.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString=".1cd") returned 4 [0101.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 55 [0101.835] lstrlenW (lpString=".jpg") returned 4 [0101.835] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.835] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") [0101.837] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=46960) returned 1 [0101.837] CloseHandle (hObject=0x15c) returned 1 [0101.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll")) returned 0x20 [0101.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.837] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.838] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.839] GetLastError () returned 0x0 [0101.839] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xb770, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xb780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xb780, lpOverlapped=0x0) returned 1 [0101.843] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x10e, lpOverlapped=0x0) returned 1 [0101.843] SetEndOfFile (hFile=0x180) returned 1 [0101.843] CloseHandle (hObject=0x180) returned 1 [0101.843] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.843] SetEndOfFile (hFile=0x15c) returned 1 [0101.844] CloseHandle (hObject=0x15c) returned 1 [0101.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll")) returned 1 [0101.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.844] lstrlenW (lpString=".doc") returned 4 [0101.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".docx") returned 5 [0101.845] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0101.845] lstrlenW (lpString=".pdf") returned 4 [0101.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".xls") returned 4 [0101.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".xlsx") returned 5 [0101.845] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0101.845] lstrlenW (lpString=".ppt") returned 4 [0101.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.845] lstrlenW (lpString=".zip") returned 4 [0101.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".rar") returned 4 [0101.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".bz2") returned 4 [0101.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.845] lstrlenW (lpString=".7z") returned 3 [0101.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.845] lstrlenW (lpString=".dbf") returned 4 [0101.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.845] lstrlenW (lpString=".1cd") returned 4 [0101.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 106 [0101.845] lstrlenW (lpString=".jpg") returned 4 [0101.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.845] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") [0101.846] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=55152) returned 1 [0101.846] CloseHandle (hObject=0x15c) returned 1 [0101.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll")) returned 0x20 [0101.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.846] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.846] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.851] GetLastError () returned 0x0 [0101.851] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd770, lpOverlapped=0x0) returned 1 [0101.854] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd780, lpOverlapped=0x0) returned 1 [0101.856] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.856] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x10e, lpOverlapped=0x0) returned 1 [0101.856] SetEndOfFile (hFile=0x180) returned 1 [0101.856] CloseHandle (hObject=0x180) returned 1 [0101.856] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.856] SetEndOfFile (hFile=0x15c) returned 1 [0101.857] CloseHandle (hObject=0x15c) returned 1 [0101.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll")) returned 1 [0101.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.857] lstrlenW (lpString=".doc") returned 4 [0101.857] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.857] lstrlenW (lpString=".docx") returned 5 [0101.857] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0101.858] lstrlenW (lpString=".pdf") returned 4 [0101.858] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.858] lstrlenW (lpString=".xls") returned 4 [0101.858] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.858] lstrlenW (lpString=".xlsx") returned 5 [0101.858] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0101.858] lstrlenW (lpString=".ppt") returned 4 [0101.858] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.858] lstrlenW (lpString=".zip") returned 4 [0101.858] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.858] lstrlenW (lpString=".rar") returned 4 [0101.858] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.858] lstrlenW (lpString=".bz2") returned 4 [0101.858] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.858] lstrlenW (lpString=".7z") returned 3 [0101.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.858] lstrlenW (lpString=".dbf") returned 4 [0101.858] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.858] lstrlenW (lpString=".1cd") returned 4 [0101.858] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 97 [0101.858] lstrlenW (lpString=".jpg") returned 4 [0101.858] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.858] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") [0101.860] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=59248) returned 1 [0101.860] CloseHandle (hObject=0x15c) returned 1 [0101.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll")) returned 0x20 [0101.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.860] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.860] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.861] GetLastError () returned 0x0 [0101.861] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe770, lpOverlapped=0x0) returned 1 [0101.864] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe780, lpOverlapped=0x0) returned 1 [0101.865] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.865] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x10e, lpOverlapped=0x0) returned 1 [0101.865] SetEndOfFile (hFile=0x180) returned 1 [0101.865] CloseHandle (hObject=0x180) returned 1 [0101.866] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.866] SetEndOfFile (hFile=0x15c) returned 1 [0101.867] CloseHandle (hObject=0x15c) returned 1 [0101.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll")) returned 1 [0101.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.867] lstrlenW (lpString=".doc") returned 4 [0101.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString=".docx") returned 5 [0101.867] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0101.867] lstrlenW (lpString=".pdf") returned 4 [0101.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString=".xls") returned 4 [0101.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString=".xlsx") returned 5 [0101.867] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0101.867] lstrlenW (lpString=".ppt") returned 4 [0101.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.867] lstrlenW (lpString=".zip") returned 4 [0101.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString=".rar") returned 4 [0101.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.868] lstrlenW (lpString=".bz2") returned 4 [0101.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.868] lstrlenW (lpString=".7z") returned 3 [0101.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.868] lstrlenW (lpString=".dbf") returned 4 [0101.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.868] lstrlenW (lpString=".1cd") returned 4 [0101.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 83 [0101.868] lstrlenW (lpString=".jpg") returned 4 [0101.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.868] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") [0101.869] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=506744) returned 1 [0101.870] CloseHandle (hObject=0x15c) returned 1 [0101.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll")) returned 0x20 [0101.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.870] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.871] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.871] GetLastError () returned 0x0 [0101.871] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x7bb78, lpOverlapped=0x0) returned 1 [0101.958] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x7bb80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7bb80, lpOverlapped=0x0) returned 1 [0101.968] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.968] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.968] SetEndOfFile (hFile=0x180) returned 1 [0101.968] CloseHandle (hObject=0x180) returned 1 [0101.968] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.968] SetEndOfFile (hFile=0x15c) returned 1 [0101.972] CloseHandle (hObject=0x15c) returned 1 [0101.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll")) returned 1 [0101.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.973] lstrlenW (lpString=".doc") returned 4 [0101.973] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString=".docx") returned 5 [0101.973] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0101.973] lstrlenW (lpString=".pdf") returned 4 [0101.973] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString=".xls") returned 4 [0101.973] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString=".xlsx") returned 5 [0101.973] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0101.973] lstrlenW (lpString=".ppt") returned 4 [0101.973] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.973] lstrlenW (lpString=".zip") returned 4 [0101.973] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString=".rar") returned 4 [0101.973] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.973] lstrlenW (lpString=".bz2") returned 4 [0101.973] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.973] lstrlenW (lpString=".7z") returned 3 [0101.973] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.973] lstrlenW (lpString=".dbf") returned 4 [0101.973] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.974] lstrlenW (lpString=".1cd") returned 4 [0101.974] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 55 [0101.974] lstrlenW (lpString=".jpg") returned 4 [0101.974] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.974] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") [0101.975] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=95104) returned 1 [0101.975] CloseHandle (hObject=0x15c) returned 1 [0101.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll")) returned 0x20 [0101.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0101.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.977] GetLastError () returned 0x0 [0101.977] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x17380, lpOverlapped=0x0) returned 1 [0102.011] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x17390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x17390, lpOverlapped=0x0) returned 1 [0102.013] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.014] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.014] SetEndOfFile (hFile=0x180) returned 1 [0102.014] CloseHandle (hObject=0x180) returned 1 [0102.014] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.014] SetEndOfFile (hFile=0x15c) returned 1 [0102.015] CloseHandle (hObject=0x15c) returned 1 [0102.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll")) returned 1 [0102.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.024] lstrlenW (lpString=".doc") returned 4 [0102.024] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.024] lstrlenW (lpString=".docx") returned 5 [0102.024] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0102.024] lstrlenW (lpString=".pdf") returned 4 [0102.024] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.025] lstrlenW (lpString=".xls") returned 4 [0102.025] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.025] lstrlenW (lpString=".xlsx") returned 5 [0102.025] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0102.025] lstrlenW (lpString=".ppt") returned 4 [0102.025] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.025] lstrlenW (lpString=".zip") returned 4 [0102.025] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.025] lstrlenW (lpString=".rar") returned 4 [0102.025] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.025] lstrlenW (lpString=".bz2") returned 4 [0102.025] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.025] lstrlenW (lpString=".7z") returned 3 [0102.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.025] lstrlenW (lpString=".dbf") returned 4 [0102.025] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.025] lstrlenW (lpString=".1cd") returned 4 [0102.025] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 55 [0102.025] lstrlenW (lpString=".jpg") returned 4 [0102.025] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.025] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") [0102.027] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=235912) returned 1 [0102.027] CloseHandle (hObject=0x15c) returned 1 [0102.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll")) returned 0x20 [0102.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.028] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.028] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.029] GetLastError () returned 0x0 [0102.029] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x39988, lpOverlapped=0x0) returned 1 [0102.035] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x39990, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x39990, lpOverlapped=0x0) returned 1 [0102.039] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.039] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0102.039] SetEndOfFile (hFile=0x180) returned 1 [0102.039] CloseHandle (hObject=0x180) returned 1 [0102.039] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.039] SetEndOfFile (hFile=0x15c) returned 1 [0102.041] CloseHandle (hObject=0x15c) returned 1 [0102.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll")) returned 1 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString=".doc") returned 4 [0102.042] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString=".docx") returned 5 [0102.042] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0102.042] lstrlenW (lpString=".pdf") returned 4 [0102.042] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString=".xls") returned 4 [0102.042] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString=".xlsx") returned 5 [0102.042] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0102.042] lstrlenW (lpString=".ppt") returned 4 [0102.042] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString=".zip") returned 4 [0102.042] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString=".rar") returned 4 [0102.042] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.042] lstrlenW (lpString=".bz2") returned 4 [0102.042] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.042] lstrlenW (lpString=".7z") returned 3 [0102.042] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString=".dbf") returned 4 [0102.042] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString=".1cd") returned 4 [0102.042] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 52 [0102.042] lstrlenW (lpString=".jpg") returned 4 [0102.043] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.043] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") [0102.043] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=348576) returned 1 [0102.043] CloseHandle (hObject=0x15c) returned 1 [0102.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl")) returned 0x20 [0102.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.044] GetLastError () returned 0x0 [0102.045] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x551a0, lpOverlapped=0x0) returned 1 [0102.053] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x551b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x551b0, lpOverlapped=0x0) returned 1 [0102.061] ReadFile (in: hFile=0x15c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0102.061] SetEndOfFile (hFile=0x180) returned 1 [0102.113] CloseHandle (hObject=0x180) returned 1 [0102.113] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.113] SetEndOfFile (hFile=0x15c) returned 1 [0102.117] CloseHandle (hObject=0x15c) returned 1 [0102.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl")) returned 1 [0102.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.216] lstrlenW (lpString=".doc") returned 4 [0102.216] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.216] lstrlenW (lpString=".docx") returned 5 [0102.216] lstrcmpiW (lpString1=".docx", lpString2="S.PDL") returned -1 [0102.216] lstrlenW (lpString=".pdf") returned 4 [0102.216] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.216] lstrlenW (lpString=".xls") returned 4 [0102.216] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.216] lstrlenW (lpString=".xlsx") returned 5 [0102.216] lstrcmpiW (lpString1=".xlsx", lpString2="S.PDL") returned -1 [0102.216] lstrlenW (lpString=".ppt") returned 4 [0102.216] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.216] lstrlenW (lpString=".zip") returned 4 [0102.216] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.216] lstrlenW (lpString=".rar") returned 4 [0102.217] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.217] lstrlenW (lpString=".bz2") returned 4 [0102.217] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.217] lstrlenW (lpString=".7z") returned 3 [0102.217] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.217] lstrlenW (lpString=".dbf") returned 4 [0102.217] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.217] lstrlenW (lpString=".1cd") returned 4 [0102.217] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 52 [0102.217] lstrlenW (lpString=".jpg") returned 4 [0102.217] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.217] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") [0102.523] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=93616) returned 1 [0102.523] CloseHandle (hObject=0x1f4) returned 1 [0102.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl")) returned 0x20 [0102.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0102.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0102.525] GetLastError () returned 0x0 [0102.525] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x16db0, lpOverlapped=0x0) returned 1 [0102.529] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x16dc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x16dc0, lpOverlapped=0x0) returned 1 [0102.531] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.531] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.531] SetEndOfFile (hFile=0x1b8) returned 1 [0102.531] CloseHandle (hObject=0x1b8) returned 1 [0102.531] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.531] SetEndOfFile (hFile=0x1f4) returned 1 [0102.533] CloseHandle (hObject=0x1f4) returned 1 [0102.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl")) returned 1 [0102.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.533] lstrlenW (lpString=".doc") returned 4 [0102.533] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.533] lstrlenW (lpString=".docx") returned 5 [0102.533] lstrcmpiW (lpString1=".docx", lpString2="C.PDL") returned -1 [0102.533] lstrlenW (lpString=".pdf") returned 4 [0102.533] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.533] lstrlenW (lpString=".xls") returned 4 [0102.533] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.533] lstrlenW (lpString=".xlsx") returned 5 [0102.533] lstrcmpiW (lpString1=".xlsx", lpString2="C.PDL") returned -1 [0102.534] lstrlenW (lpString=".ppt") returned 4 [0102.534] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.534] lstrlenW (lpString=".zip") returned 4 [0102.534] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.534] lstrlenW (lpString=".rar") returned 4 [0102.534] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.534] lstrlenW (lpString=".bz2") returned 4 [0102.534] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.534] lstrlenW (lpString=".7z") returned 3 [0102.538] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.538] lstrlenW (lpString=".dbf") returned 4 [0102.538] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.538] lstrlenW (lpString=".1cd") returned 4 [0102.538] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 55 [0102.539] lstrlenW (lpString=".jpg") returned 4 [0102.539] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.539] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") [0102.540] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=697712) returned 1 [0102.540] CloseHandle (hObject=0x1f4) returned 1 [0102.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll")) returned 0x20 [0102.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0102.540] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.540] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0102.542] GetLastError () returned 0x0 [0102.542] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xaa570, lpOverlapped=0x0) returned 1 [0102.558] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xaa580, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xaa580, lpOverlapped=0x0) returned 1 [0102.886] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.886] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0102.886] SetEndOfFile (hFile=0x1b8) returned 1 [0102.886] CloseHandle (hObject=0x1b8) returned 1 [0102.886] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.886] SetEndOfFile (hFile=0x1f4) returned 1 [0102.892] CloseHandle (hObject=0x1f4) returned 1 [0102.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll")) returned 1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.893] lstrlenW (lpString=".doc") returned 4 [0102.893] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.893] lstrlenW (lpString=".docx") returned 5 [0102.893] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0102.893] lstrlenW (lpString=".pdf") returned 4 [0102.893] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.893] lstrlenW (lpString=".xls") returned 4 [0102.893] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.893] lstrlenW (lpString=".xlsx") returned 5 [0102.893] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0102.893] lstrlenW (lpString=".ppt") returned 4 [0102.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.893] lstrlenW (lpString=".zip") returned 4 [0102.893] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.893] lstrlenW (lpString=".rar") returned 4 [0102.893] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.894] lstrlenW (lpString=".bz2") returned 4 [0102.894] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.894] lstrlenW (lpString=".7z") returned 3 [0102.894] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.894] lstrlenW (lpString=".dbf") returned 4 [0102.894] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.894] lstrlenW (lpString=".1cd") returned 4 [0102.894] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 51 [0102.894] lstrlenW (lpString=".jpg") returned 4 [0102.894] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.894] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") [0103.001] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=291792) returned 1 [0103.001] CloseHandle (hObject=0x158) returned 1 [0103.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll")) returned 0x20 [0103.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.001] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.001] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.005] GetLastError () returned 0x0 [0103.005] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x473d0, lpOverlapped=0x0) returned 1 [0103.035] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x473e0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x473e0, lpOverlapped=0x0) returned 1 [0103.041] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.041] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.041] SetEndOfFile (hFile=0x16c) returned 1 [0103.041] CloseHandle (hObject=0x16c) returned 1 [0103.041] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.041] SetEndOfFile (hFile=0x158) returned 1 [0103.044] CloseHandle (hObject=0x158) returned 1 [0103.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll")) returned 1 [0103.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.044] lstrlenW (lpString=".doc") returned 4 [0103.044] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.044] lstrlenW (lpString=".docx") returned 5 [0103.044] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0103.044] lstrlenW (lpString=".pdf") returned 4 [0103.045] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.045] lstrlenW (lpString=".xls") returned 4 [0103.045] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.045] lstrlenW (lpString=".xlsx") returned 5 [0103.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0103.045] lstrlenW (lpString=".ppt") returned 4 [0103.045] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.045] lstrlenW (lpString=".zip") returned 4 [0103.045] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.045] lstrlenW (lpString=".rar") returned 4 [0103.045] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.045] lstrlenW (lpString=".bz2") returned 4 [0103.045] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.045] lstrlenW (lpString=".7z") returned 3 [0103.045] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.045] lstrlenW (lpString=".dbf") returned 4 [0103.045] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.045] lstrlenW (lpString=".1cd") returned 4 [0103.045] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 56 [0103.045] lstrlenW (lpString=".jpg") returned 4 [0103.045] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.045] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") [0103.046] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=567168) returned 1 [0103.046] CloseHandle (hObject=0x158) returned 1 [0103.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll")) returned 0x20 [0103.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.046] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.046] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.047] GetLastError () returned 0x0 [0103.047] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x8a780, lpOverlapped=0x0) returned 1 [0103.183] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x8a790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x8a790, lpOverlapped=0x0) returned 1 [0103.193] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.193] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x136, lpOverlapped=0x0) returned 1 [0103.193] SetEndOfFile (hFile=0x16c) returned 1 [0103.193] CloseHandle (hObject=0x16c) returned 1 [0103.193] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.193] SetEndOfFile (hFile=0x158) returned 1 [0103.198] CloseHandle (hObject=0x158) returned 1 [0103.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll")) returned 1 [0103.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.199] lstrlenW (lpString=".doc") returned 4 [0103.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.199] lstrlenW (lpString=".docx") returned 5 [0103.199] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0103.199] lstrlenW (lpString=".pdf") returned 4 [0103.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.199] lstrlenW (lpString=".xls") returned 4 [0103.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.199] lstrlenW (lpString=".xlsx") returned 5 [0103.199] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0103.199] lstrlenW (lpString=".ppt") returned 4 [0103.199] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.199] lstrlenW (lpString=".zip") returned 4 [0103.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.200] lstrlenW (lpString=".rar") returned 4 [0103.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.200] lstrlenW (lpString=".bz2") returned 4 [0103.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.200] lstrlenW (lpString=".7z") returned 3 [0103.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.200] lstrlenW (lpString=".dbf") returned 4 [0103.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.200] lstrlenW (lpString=".1cd") returned 4 [0103.200] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 92 [0103.200] lstrlenW (lpString=".jpg") returned 4 [0103.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.200] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") [0103.201] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=956288) returned 1 [0103.201] CloseHandle (hObject=0x158) returned 1 [0103.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll")) returned 0x20 [0103.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.202] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.202] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.203] GetLastError () returned 0x0 [0103.203] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe9780, lpOverlapped=0x0) returned 1 [0103.391] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe9790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe9790, lpOverlapped=0x0) returned 1 [0103.406] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.406] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x116, lpOverlapped=0x0) returned 1 [0103.406] SetEndOfFile (hFile=0x16c) returned 1 [0103.406] CloseHandle (hObject=0x16c) returned 1 [0103.406] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.407] SetEndOfFile (hFile=0x158) returned 1 [0103.414] CloseHandle (hObject=0x158) returned 1 [0103.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll")) returned 1 [0103.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.415] lstrlenW (lpString=".doc") returned 4 [0103.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString=".docx") returned 5 [0103.415] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0103.415] lstrlenW (lpString=".pdf") returned 4 [0103.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString=".xls") returned 4 [0103.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString=".xlsx") returned 5 [0103.415] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0103.415] lstrlenW (lpString=".ppt") returned 4 [0103.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.415] lstrlenW (lpString=".zip") returned 4 [0103.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString=".rar") returned 4 [0103.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.415] lstrlenW (lpString=".bz2") returned 4 [0103.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.415] lstrlenW (lpString=".7z") returned 3 [0103.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.416] lstrlenW (lpString=".dbf") returned 4 [0103.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.416] lstrlenW (lpString=".1cd") returned 4 [0103.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 76 [0103.416] lstrlenW (lpString=".jpg") returned 4 [0103.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.416] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") [0103.417] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=87936) returned 1 [0103.417] CloseHandle (hObject=0x158) returned 1 [0103.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll")) returned 0x20 [0103.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.417] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.418] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.419] GetLastError () returned 0x0 [0103.419] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x15780, lpOverlapped=0x0) returned 1 [0103.457] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x15790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x15790, lpOverlapped=0x0) returned 1 [0103.459] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.459] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x126, lpOverlapped=0x0) returned 1 [0103.459] SetEndOfFile (hFile=0x16c) returned 1 [0103.461] CloseHandle (hObject=0x16c) returned 1 [0103.461] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.461] SetEndOfFile (hFile=0x158) returned 1 [0103.463] CloseHandle (hObject=0x158) returned 1 [0103.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll")) returned 1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.463] lstrlenW (lpString=".doc") returned 4 [0103.463] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.463] lstrlenW (lpString=".docx") returned 5 [0103.463] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0103.463] lstrlenW (lpString=".pdf") returned 4 [0103.463] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.463] lstrlenW (lpString=".xls") returned 4 [0103.463] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.463] lstrlenW (lpString=".xlsx") returned 5 [0103.463] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0103.463] lstrlenW (lpString=".ppt") returned 4 [0103.463] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.463] lstrlenW (lpString=".zip") returned 4 [0103.464] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.464] lstrlenW (lpString=".rar") returned 4 [0103.464] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.464] lstrlenW (lpString=".bz2") returned 4 [0103.464] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.464] lstrlenW (lpString=".7z") returned 3 [0103.464] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.464] lstrlenW (lpString=".dbf") returned 4 [0103.464] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.464] lstrlenW (lpString=".1cd") returned 4 [0103.464] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 84 [0103.464] lstrlenW (lpString=".jpg") returned 4 [0103.464] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.464] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") [0103.465] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=513920) returned 1 [0103.465] CloseHandle (hObject=0x158) returned 1 [0103.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll")) returned 0x20 [0103.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0103.466] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.466] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.467] GetLastError () returned 0x0 [0103.467] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x7d780, lpOverlapped=0x0) returned 1 [0103.508] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x7d790, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7d790, lpOverlapped=0x0) returned 1 [0103.516] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.516] WriteFile (in: hFile=0x16c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x14a, lpOverlapped=0x0) returned 1 [0103.516] SetEndOfFile (hFile=0x16c) returned 1 [0103.516] CloseHandle (hObject=0x16c) returned 1 [0103.517] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.517] SetEndOfFile (hFile=0x158) returned 1 [0103.521] CloseHandle (hObject=0x158) returned 1 [0103.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll")) returned 1 [0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.722] lstrlenW (lpString=".doc") returned 4 [0103.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString=".docx") returned 5 [0103.722] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0103.722] lstrlenW (lpString=".pdf") returned 4 [0103.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString=".xls") returned 4 [0103.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString=".xlsx") returned 5 [0103.722] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0103.722] lstrlenW (lpString=".ppt") returned 4 [0103.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.722] lstrlenW (lpString=".zip") returned 4 [0103.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString=".rar") returned 4 [0103.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.722] lstrlenW (lpString=".bz2") returned 4 [0103.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.722] lstrlenW (lpString=".7z") returned 3 [0103.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.722] lstrlenW (lpString=".dbf") returned 4 [0103.722] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.722] lstrlenW (lpString=".1cd") returned 4 [0103.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 102 [0103.723] lstrlenW (lpString=".jpg") returned 4 [0103.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.723] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") [0103.846] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=571232) returned 1 [0103.846] CloseHandle (hObject=0x210) returned 1 [0103.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe")) returned 0x20 [0103.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0103.849] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.849] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0103.850] GetLastError () returned 0x0 [0103.850] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x8b760, lpOverlapped=0x0) returned 1 [0103.862] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x8b770, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x8b770, lpOverlapped=0x0) returned 1 [0103.872] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.872] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0103.872] SetEndOfFile (hFile=0x22c) returned 1 [0103.872] CloseHandle (hObject=0x22c) returned 1 [0103.872] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.872] SetEndOfFile (hFile=0x210) returned 1 [0103.877] CloseHandle (hObject=0x210) returned 1 [0103.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe")) returned 1 [0103.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.878] lstrlenW (lpString=".doc") returned 4 [0103.878] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0103.878] lstrlenW (lpString=".docx") returned 5 [0103.878] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0103.878] lstrlenW (lpString=".pdf") returned 4 [0103.878] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0103.878] lstrlenW (lpString=".xls") returned 4 [0103.878] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0103.878] lstrlenW (lpString=".xlsx") returned 5 [0103.878] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0103.878] lstrlenW (lpString=".ppt") returned 4 [0103.878] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0103.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.878] lstrlenW (lpString=".zip") returned 4 [0103.878] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0103.878] lstrlenW (lpString=".rar") returned 4 [0103.878] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0103.878] lstrlenW (lpString=".bz2") returned 4 [0103.878] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0103.878] lstrlenW (lpString=".7z") returned 3 [0103.878] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0103.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.878] lstrlenW (lpString=".dbf") returned 4 [0103.879] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0103.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.879] lstrlenW (lpString=".1cd") returned 4 [0103.879] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0103.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 51 [0103.879] lstrlenW (lpString=".jpg") returned 4 [0103.879] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0103.879] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") [0103.880] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=632720) returned 1 [0103.880] CloseHandle (hObject=0x210) returned 1 [0103.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll")) returned 0x20 [0103.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0103.880] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.880] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0103.881] GetLastError () returned 0x0 [0103.881] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9a790, lpOverlapped=0x0) returned 1 [0103.906] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9a7a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9a7a0, lpOverlapped=0x0) returned 1 [0104.040] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.040] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0104.040] SetEndOfFile (hFile=0x22c) returned 1 [0104.040] CloseHandle (hObject=0x22c) returned 1 [0104.041] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.041] SetEndOfFile (hFile=0x210) returned 1 [0104.049] CloseHandle (hObject=0x210) returned 1 [0104.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll")) returned 1 [0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.050] lstrlenW (lpString=".doc") returned 4 [0104.050] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString=".docx") returned 5 [0104.050] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0104.050] lstrlenW (lpString=".pdf") returned 4 [0104.050] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString=".xls") returned 4 [0104.050] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString=".xlsx") returned 5 [0104.050] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0104.050] lstrlenW (lpString=".ppt") returned 4 [0104.050] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.050] lstrlenW (lpString=".zip") returned 4 [0104.050] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString=".rar") returned 4 [0104.050] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.050] lstrlenW (lpString=".bz2") returned 4 [0104.050] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.050] lstrlenW (lpString=".7z") returned 3 [0104.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.050] lstrlenW (lpString=".dbf") returned 4 [0104.050] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.051] lstrlenW (lpString=".1cd") returned 4 [0104.051] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 53 [0104.051] lstrlenW (lpString=".jpg") returned 4 [0104.051] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.051] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") [0104.052] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1382) returned 1 [0104.052] CloseHandle (hObject=0x210) returned 1 [0104.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest")) returned 0x20 [0104.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.053] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.053] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.054] GetLastError () returned 0x0 [0104.054] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x566, lpOverlapped=0x0) returned 1 [0104.056] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x570, lpOverlapped=0x0) returned 1 [0104.060] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.060] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0104.060] SetEndOfFile (hFile=0x22c) returned 1 [0104.061] CloseHandle (hObject=0x22c) returned 1 [0104.061] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.061] SetEndOfFile (hFile=0x210) returned 1 [0104.087] CloseHandle (hObject=0x210) returned 1 [0104.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest")) returned 1 [0104.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.216] lstrlenW (lpString=".doc") returned 4 [0104.216] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".docx") returned 5 [0104.216] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0104.216] lstrlenW (lpString=".pdf") returned 4 [0104.216] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".xls") returned 4 [0104.216] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".xlsx") returned 5 [0104.216] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0104.216] lstrlenW (lpString=".ppt") returned 4 [0104.216] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.216] lstrlenW (lpString=".zip") returned 4 [0104.216] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".rar") returned 4 [0104.216] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".bz2") returned 4 [0104.216] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0104.216] lstrlenW (lpString=".7z") returned 3 [0104.217] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0104.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.217] lstrlenW (lpString=".dbf") returned 4 [0104.217] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0104.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.217] lstrlenW (lpString=".1cd") returned 4 [0104.217] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0104.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 64 [0104.217] lstrlenW (lpString=".jpg") returned 4 [0104.217] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0104.217] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") [0104.424] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=82312) returned 1 [0104.424] CloseHandle (hObject=0x1f4) returned 1 [0104.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll")) returned 0x20 [0104.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0104.424] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.424] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.425] GetLastError () returned 0x0 [0104.425] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x14188, lpOverlapped=0x0) returned 1 [0104.433] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x14190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x14190, lpOverlapped=0x0) returned 1 [0104.435] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.436] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.436] SetEndOfFile (hFile=0x1b8) returned 1 [0104.436] CloseHandle (hObject=0x1b8) returned 1 [0104.436] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.436] SetEndOfFile (hFile=0x1f4) returned 1 [0104.437] CloseHandle (hObject=0x1f4) returned 1 [0104.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll")) returned 1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.438] lstrlenW (lpString=".doc") returned 4 [0104.438] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString=".docx") returned 5 [0104.438] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0104.438] lstrlenW (lpString=".pdf") returned 4 [0104.438] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString=".xls") returned 4 [0104.438] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString=".xlsx") returned 5 [0104.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0104.438] lstrlenW (lpString=".ppt") returned 4 [0104.438] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.438] lstrlenW (lpString=".zip") returned 4 [0104.438] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString=".rar") returned 4 [0104.438] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.438] lstrlenW (lpString=".bz2") returned 4 [0104.438] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.438] lstrlenW (lpString=".7z") returned 3 [0104.439] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.439] lstrlenW (lpString=".dbf") returned 4 [0104.439] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.439] lstrlenW (lpString=".1cd") returned 4 [0104.439] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 55 [0104.439] lstrlenW (lpString=".jpg") returned 4 [0104.439] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.439] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") [0104.469] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=480152) returned 1 [0104.469] CloseHandle (hObject=0x158) returned 1 [0104.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll")) returned 0x20 [0104.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.469] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.469] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.470] GetLastError () returned 0x0 [0104.470] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x75398, lpOverlapped=0x0) returned 1 [0104.481] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x753a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x753a0, lpOverlapped=0x0) returned 1 [0104.491] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.491] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.491] SetEndOfFile (hFile=0x1b8) returned 1 [0104.491] CloseHandle (hObject=0x1b8) returned 1 [0104.491] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.491] SetEndOfFile (hFile=0x158) returned 1 [0104.495] CloseHandle (hObject=0x158) returned 1 [0104.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll")) returned 1 [0104.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.496] lstrlenW (lpString=".doc") returned 4 [0104.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString=".docx") returned 5 [0104.496] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0104.496] lstrlenW (lpString=".pdf") returned 4 [0104.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString=".xls") returned 4 [0104.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString=".xlsx") returned 5 [0104.496] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0104.496] lstrlenW (lpString=".ppt") returned 4 [0104.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.496] lstrlenW (lpString=".zip") returned 4 [0104.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString=".rar") returned 4 [0104.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.496] lstrlenW (lpString=".bz2") returned 4 [0104.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.496] lstrlenW (lpString=".7z") returned 3 [0104.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.496] lstrlenW (lpString=".dbf") returned 4 [0104.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.497] lstrlenW (lpString=".1cd") returned 4 [0104.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 55 [0104.497] lstrlenW (lpString=".jpg") returned 4 [0104.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.497] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") [0104.498] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3072) returned 1 [0104.498] CloseHandle (hObject=0x158) returned 1 [0104.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub")) returned 0x20 [0104.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.498] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.498] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.594] GetLastError () returned 0x0 [0104.594] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xc00, lpOverlapped=0x0) returned 1 [0104.608] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0104.609] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.609] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0104.609] SetEndOfFile (hFile=0x1b8) returned 1 [0104.609] CloseHandle (hObject=0x1b8) returned 1 [0104.609] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.609] SetEndOfFile (hFile=0x158) returned 1 [0104.610] CloseHandle (hObject=0x158) returned 1 [0104.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub")) returned 1 [0104.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.611] lstrlenW (lpString=".doc") returned 4 [0104.611] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.611] lstrlenW (lpString=".docx") returned 5 [0104.611] lstrcmpiW (lpString1=".docx", lpString2="s.dub") returned -1 [0104.611] lstrlenW (lpString=".pdf") returned 4 [0104.611] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.611] lstrlenW (lpString=".xls") returned 4 [0104.611] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.611] lstrlenW (lpString=".xlsx") returned 5 [0104.611] lstrcmpiW (lpString1=".xlsx", lpString2="s.dub") returned -1 [0104.611] lstrlenW (lpString=".ppt") returned 4 [0104.611] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.611] lstrlenW (lpString=".zip") returned 4 [0104.611] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.611] lstrlenW (lpString=".rar") returned 4 [0104.611] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.611] lstrlenW (lpString=".bz2") returned 4 [0104.611] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.611] lstrlenW (lpString=".7z") returned 3 [0104.611] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.611] lstrlenW (lpString=".dbf") returned 4 [0104.611] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.611] lstrlenW (lpString=".1cd") returned 4 [0104.611] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 59 [0104.611] lstrlenW (lpString=".jpg") returned 4 [0104.611] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.612] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") [0104.612] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1305074) returned 1 [0104.612] CloseHandle (hObject=0x158) returned 1 [0104.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic")) returned 0x20 [0104.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.613] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.613] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.613] GetLastError () returned 0x0 [0104.613] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0104.642] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0104.906] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3ea02, lpOverlapped=0x0) returned 1 [0104.918] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3ea10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3ea10, lpOverlapped=0x0) returned 1 [0104.925] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.925] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0104.926] SetEndOfFile (hFile=0x1b8) returned 1 [0104.926] CloseHandle (hObject=0x1b8) returned 1 [0104.926] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.926] SetEndOfFile (hFile=0x158) returned 1 [0104.928] CloseHandle (hObject=0x158) returned 1 [0104.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic")) returned 1 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString=".doc") returned 4 [0105.019] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0105.019] lstrlenW (lpString=".docx") returned 5 [0105.019] lstrcmpiW (lpString1=".docx", lpString2="s.kic") returned -1 [0105.019] lstrlenW (lpString=".pdf") returned 4 [0105.019] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0105.019] lstrlenW (lpString=".xls") returned 4 [0105.019] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0105.019] lstrlenW (lpString=".xlsx") returned 5 [0105.019] lstrcmpiW (lpString1=".xlsx", lpString2="s.kic") returned -1 [0105.019] lstrlenW (lpString=".ppt") returned 4 [0105.019] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString=".zip") returned 4 [0105.019] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0105.019] lstrlenW (lpString=".rar") returned 4 [0105.019] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0105.019] lstrlenW (lpString=".bz2") returned 4 [0105.019] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0105.019] lstrlenW (lpString=".7z") returned 3 [0105.019] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString=".dbf") returned 4 [0105.019] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString=".1cd") returned 4 [0105.019] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0105.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 54 [0105.019] lstrlenW (lpString=".jpg") returned 4 [0105.020] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0105.020] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") [0105.328] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=530824) returned 1 [0105.328] CloseHandle (hObject=0x19c) returned 1 [0105.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll")) returned 0x20 [0105.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.328] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.328] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.329] GetLastError () returned 0x0 [0105.329] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x81988, lpOverlapped=0x0) returned 1 [0105.345] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x81990, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x81990, lpOverlapped=0x0) returned 1 [0105.357] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.357] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0105.357] SetEndOfFile (hFile=0x158) returned 1 [0105.357] CloseHandle (hObject=0x158) returned 1 [0105.357] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.357] SetEndOfFile (hFile=0x19c) returned 1 [0105.363] CloseHandle (hObject=0x19c) returned 1 [0105.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll")) returned 1 [0105.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.364] lstrlenW (lpString=".doc") returned 4 [0105.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString=".docx") returned 5 [0105.364] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0105.364] lstrlenW (lpString=".pdf") returned 4 [0105.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString=".xls") returned 4 [0105.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString=".xlsx") returned 5 [0105.364] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0105.364] lstrlenW (lpString=".ppt") returned 4 [0105.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.364] lstrlenW (lpString=".zip") returned 4 [0105.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString=".rar") returned 4 [0105.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0105.364] lstrlenW (lpString=".bz2") returned 4 [0105.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0105.364] lstrlenW (lpString=".7z") returned 3 [0105.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0105.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.365] lstrlenW (lpString=".dbf") returned 4 [0105.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0105.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.365] lstrlenW (lpString=".1cd") returned 4 [0105.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0105.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 54 [0105.365] lstrlenW (lpString=".jpg") returned 4 [0105.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0105.365] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") [0105.366] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3638) returned 1 [0105.366] CloseHandle (hObject=0x19c) returned 1 [0105.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico")) returned 0x20 [0105.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.366] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.367] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.368] GetLastError () returned 0x0 [0105.368] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe36, lpOverlapped=0x0) returned 1 [0105.597] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0105.598] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.598] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0105.599] SetEndOfFile (hFile=0x158) returned 1 [0105.599] CloseHandle (hObject=0x158) returned 1 [0105.599] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.599] SetEndOfFile (hFile=0x19c) returned 1 [0105.599] CloseHandle (hObject=0x19c) returned 1 [0105.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico")) returned 1 [0105.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.600] lstrlenW (lpString=".doc") returned 4 [0105.600] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0105.600] lstrlenW (lpString=".docx") returned 5 [0105.600] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0105.600] lstrlenW (lpString=".pdf") returned 4 [0105.601] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0105.601] lstrlenW (lpString=".xls") returned 4 [0105.601] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0105.601] lstrlenW (lpString=".xlsx") returned 5 [0105.601] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0105.601] lstrlenW (lpString=".ppt") returned 4 [0105.601] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.601] lstrlenW (lpString=".zip") returned 4 [0105.601] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0105.601] lstrlenW (lpString=".rar") returned 4 [0105.601] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0105.601] lstrlenW (lpString=".bz2") returned 4 [0105.601] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0105.601] lstrlenW (lpString=".7z") returned 3 [0105.601] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.601] lstrlenW (lpString=".dbf") returned 4 [0105.601] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.601] lstrlenW (lpString=".1cd") returned 4 [0105.601] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 50 [0105.601] lstrlenW (lpString=".jpg") returned 4 [0105.601] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0105.601] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") [0105.603] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=436112) returned 1 [0105.603] CloseHandle (hObject=0x19c) returned 1 [0105.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll")) returned 0x20 [0105.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.603] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.603] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.604] GetLastError () returned 0x0 [0105.604] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6a790, lpOverlapped=0x0) returned 1 [0105.614] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6a7a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6a7a0, lpOverlapped=0x0) returned 1 [0105.624] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.624] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0105.624] SetEndOfFile (hFile=0x158) returned 1 [0105.624] CloseHandle (hObject=0x158) returned 1 [0105.624] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.624] SetEndOfFile (hFile=0x19c) returned 1 [0105.628] CloseHandle (hObject=0x19c) returned 1 [0105.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll")) returned 1 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.629] lstrlenW (lpString=".doc") returned 4 [0105.629] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString=".docx") returned 5 [0105.629] lstrcmpiW (lpString1=".docx", lpString2="U.DLL") returned -1 [0105.629] lstrlenW (lpString=".pdf") returned 4 [0105.629] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString=".xls") returned 4 [0105.629] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString=".xlsx") returned 5 [0105.629] lstrcmpiW (lpString1=".xlsx", lpString2="U.DLL") returned -1 [0105.629] lstrlenW (lpString=".ppt") returned 4 [0105.629] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.629] lstrlenW (lpString=".zip") returned 4 [0105.629] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString=".rar") returned 4 [0105.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.629] lstrlenW (lpString=".bz2") returned 4 [0105.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.629] lstrlenW (lpString=".7z") returned 3 [0105.629] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.629] lstrlenW (lpString=".dbf") returned 4 [0105.629] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.629] lstrlenW (lpString=".1cd") returned 4 [0105.630] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 53 [0105.630] lstrlenW (lpString=".jpg") returned 4 [0105.630] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.630] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") [0105.631] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=17808) returned 1 [0105.631] CloseHandle (hObject=0x19c) returned 1 [0105.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll")) returned 0x20 [0105.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.631] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.631] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0105.632] GetLastError () returned 0x0 [0105.632] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4590, lpOverlapped=0x0) returned 1 [0105.985] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x45a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x45a0, lpOverlapped=0x0) returned 1 [0106.006] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.006] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x102, lpOverlapped=0x0) returned 1 [0106.006] SetEndOfFile (hFile=0x158) returned 1 [0106.074] CloseHandle (hObject=0x158) returned 1 [0106.074] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.074] SetEndOfFile (hFile=0x19c) returned 1 [0106.086] CloseHandle (hObject=0x19c) returned 1 [0106.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll")) returned 1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.096] lstrlenW (lpString=".doc") returned 4 [0106.096] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.096] lstrlenW (lpString=".docx") returned 5 [0106.096] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0106.096] lstrlenW (lpString=".pdf") returned 4 [0106.096] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.096] lstrlenW (lpString=".xls") returned 4 [0106.096] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.096] lstrlenW (lpString=".xlsx") returned 5 [0106.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0106.106] lstrlenW (lpString=".ppt") returned 4 [0106.106] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.115] lstrlenW (lpString=".zip") returned 4 [0106.115] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.154] lstrlenW (lpString=".rar") returned 4 [0106.154] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.155] lstrlenW (lpString=".bz2") returned 4 [0106.155] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.155] lstrlenW (lpString=".7z") returned 3 [0106.155] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.155] lstrlenW (lpString=".dbf") returned 4 [0106.155] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.155] lstrlenW (lpString=".1cd") returned 4 [0106.155] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 66 [0106.155] lstrlenW (lpString=".jpg") returned 4 [0106.155] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.155] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") [0106.156] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=489848) returned 1 [0106.156] CloseHandle (hObject=0x19c) returned 1 [0106.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe")) returned 0x20 [0106.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.157] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.157] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.158] GetLastError () returned 0x0 [0106.158] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x77978, lpOverlapped=0x0) returned 1 [0106.169] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x77980, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x77980, lpOverlapped=0x0) returned 1 [0106.179] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.179] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0106.179] SetEndOfFile (hFile=0x158) returned 1 [0106.179] CloseHandle (hObject=0x158) returned 1 [0106.179] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.179] SetEndOfFile (hFile=0x19c) returned 1 [0106.183] CloseHandle (hObject=0x19c) returned 1 [0106.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe")) returned 1 [0106.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.184] lstrlenW (lpString=".doc") returned 4 [0106.184] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.184] lstrlenW (lpString=".docx") returned 5 [0106.184] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0106.184] lstrlenW (lpString=".pdf") returned 4 [0106.184] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.184] lstrlenW (lpString=".xls") returned 4 [0106.184] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.184] lstrlenW (lpString=".xlsx") returned 5 [0106.184] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0106.184] lstrlenW (lpString=".ppt") returned 4 [0106.184] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.184] lstrlenW (lpString=".zip") returned 4 [0106.184] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.184] lstrlenW (lpString=".rar") returned 4 [0106.184] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.184] lstrlenW (lpString=".bz2") returned 4 [0106.184] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.184] lstrlenW (lpString=".7z") returned 3 [0106.184] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.184] lstrlenW (lpString=".dbf") returned 4 [0106.184] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.271] lstrlenW (lpString=".1cd") returned 4 [0106.271] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 52 [0106.271] lstrlenW (lpString=".jpg") returned 4 [0106.271] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.271] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") [0106.386] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=402824) returned 1 [0106.386] CloseHandle (hObject=0x19c) returned 1 [0106.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb")) returned 0x20 [0106.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.386] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.386] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.387] GetLastError () returned 0x0 [0106.387] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x62588, lpOverlapped=0x0) returned 1 [0106.396] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x62590, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x62590, lpOverlapped=0x0) returned 1 [0106.403] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.403] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0106.403] SetEndOfFile (hFile=0x158) returned 1 [0106.403] CloseHandle (hObject=0x158) returned 1 [0106.403] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.403] SetEndOfFile (hFile=0x19c) returned 1 [0106.407] CloseHandle (hObject=0x19c) returned 1 [0106.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb")) returned 1 [0106.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.407] lstrlenW (lpString=".doc") returned 4 [0106.407] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0106.407] lstrlenW (lpString=".docx") returned 5 [0106.407] lstrcmpiW (lpString1=".docx", lpString2="T.OLB") returned -1 [0106.407] lstrlenW (lpString=".pdf") returned 4 [0106.407] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0106.407] lstrlenW (lpString=".xls") returned 4 [0106.407] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0106.407] lstrlenW (lpString=".xlsx") returned 5 [0106.408] lstrcmpiW (lpString1=".xlsx", lpString2="T.OLB") returned -1 [0106.408] lstrlenW (lpString=".ppt") returned 4 [0106.408] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0106.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.408] lstrlenW (lpString=".zip") returned 4 [0106.408] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0106.408] lstrlenW (lpString=".rar") returned 4 [0106.408] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0106.408] lstrlenW (lpString=".bz2") returned 4 [0106.408] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0106.408] lstrlenW (lpString=".7z") returned 3 [0106.408] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0106.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.408] lstrlenW (lpString=".dbf") returned 4 [0106.408] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0106.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.408] lstrlenW (lpString=".1cd") returned 4 [0106.408] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0106.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 52 [0106.408] lstrlenW (lpString=".jpg") returned 4 [0106.408] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0106.408] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") [0106.409] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=321376) returned 1 [0106.409] CloseHandle (hObject=0x19c) returned 1 [0106.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll")) returned 0x20 [0106.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.410] GetLastError () returned 0x0 [0106.410] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4e760, lpOverlapped=0x0) returned 1 [0106.418] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4e770, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4e770, lpOverlapped=0x0) returned 1 [0106.425] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.425] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.426] SetEndOfFile (hFile=0x158) returned 1 [0106.426] CloseHandle (hObject=0x158) returned 1 [0106.426] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.426] SetEndOfFile (hFile=0x19c) returned 1 [0106.429] CloseHandle (hObject=0x19c) returned 1 [0106.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll")) returned 1 [0106.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.429] lstrlenW (lpString=".doc") returned 4 [0106.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.429] lstrlenW (lpString=".docx") returned 5 [0106.429] lstrcmpiW (lpString1=".docx", lpString2="7.dll") returned -1 [0106.430] lstrlenW (lpString=".pdf") returned 4 [0106.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.430] lstrlenW (lpString=".xls") returned 4 [0106.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.430] lstrlenW (lpString=".xlsx") returned 5 [0106.430] lstrcmpiW (lpString1=".xlsx", lpString2="7.dll") returned -1 [0106.430] lstrlenW (lpString=".ppt") returned 4 [0106.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.430] lstrlenW (lpString=".zip") returned 4 [0106.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.430] lstrlenW (lpString=".rar") returned 4 [0106.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.430] lstrlenW (lpString=".bz2") returned 4 [0106.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.430] lstrlenW (lpString=".7z") returned 3 [0106.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.430] lstrlenW (lpString=".dbf") returned 4 [0106.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.430] lstrlenW (lpString=".1cd") returned 4 [0106.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 55 [0106.430] lstrlenW (lpString=".jpg") returned 4 [0106.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.430] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") [0106.431] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1663920) returned 1 [0106.431] CloseHandle (hObject=0x19c) returned 1 [0106.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll")) returned 0x20 [0106.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0106.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.432] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0106.432] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0106.432] ReadFile (in: hFile=0x19c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.685] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x87690, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0106.685] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.691] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0106.691] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1563b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0106.691] ReadFile (in: hFile=0x19c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.707] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.707] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0107.089] SetEndOfFile (hFile=0x19c) returned 1 [0107.089] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0107.089] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.089] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.090] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x87690, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.090] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.093] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1563b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.093] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.095] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0107.095] CloseHandle (hObject=0x19c) returned 1 [0107.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.095] lstrlenW (lpString=".doc") returned 4 [0107.095] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString=".docx") returned 5 [0107.095] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0107.095] lstrlenW (lpString=".pdf") returned 4 [0107.095] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString=".xls") returned 4 [0107.095] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString=".xlsx") returned 5 [0107.095] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0107.095] lstrlenW (lpString=".ppt") returned 4 [0107.095] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.095] lstrlenW (lpString=".zip") returned 4 [0107.095] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString=".rar") returned 4 [0107.095] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.095] lstrlenW (lpString=".bz2") returned 4 [0107.095] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.095] lstrlenW (lpString=".7z") returned 3 [0107.096] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.096] lstrlenW (lpString=".dbf") returned 4 [0107.096] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.096] lstrlenW (lpString=".1cd") returned 4 [0107.096] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 54 [0107.096] lstrlenW (lpString=".jpg") returned 4 [0107.096] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.096] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") [0107.348] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5430) returned 1 [0107.348] CloseHandle (hObject=0x1c8) returned 1 [0107.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico")) returned 0x20 [0107.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.348] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.348] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.349] GetLastError () returned 0x0 [0107.349] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1536, lpOverlapped=0x0) returned 1 [0107.351] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1540, lpOverlapped=0x0) returned 1 [0107.352] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.352] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0107.352] SetEndOfFile (hFile=0x22c) returned 1 [0107.352] CloseHandle (hObject=0x22c) returned 1 [0107.352] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.352] SetEndOfFile (hFile=0x1c8) returned 1 [0107.353] CloseHandle (hObject=0x1c8) returned 1 [0107.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico")) returned 1 [0107.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.353] lstrlenW (lpString=".doc") returned 4 [0107.353] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0107.353] lstrlenW (lpString=".docx") returned 5 [0107.353] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0107.353] lstrlenW (lpString=".pdf") returned 4 [0107.354] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0107.354] lstrlenW (lpString=".xls") returned 4 [0107.354] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0107.354] lstrlenW (lpString=".xlsx") returned 5 [0107.354] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0107.354] lstrlenW (lpString=".ppt") returned 4 [0107.354] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0107.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.354] lstrlenW (lpString=".zip") returned 4 [0107.354] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0107.354] lstrlenW (lpString=".rar") returned 4 [0107.354] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0107.354] lstrlenW (lpString=".bz2") returned 4 [0107.354] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0107.354] lstrlenW (lpString=".7z") returned 3 [0107.354] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0107.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.354] lstrlenW (lpString=".dbf") returned 4 [0107.354] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0107.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.354] lstrlenW (lpString=".1cd") returned 4 [0107.354] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0107.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 51 [0107.354] lstrlenW (lpString=".jpg") returned 4 [0107.354] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0107.354] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") [0107.355] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=109440) returned 1 [0107.355] CloseHandle (hObject=0x1c8) returned 1 [0107.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe")) returned 0x20 [0107.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.355] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.355] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.356] GetLastError () returned 0x0 [0107.356] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1ab80, lpOverlapped=0x0) returned 1 [0107.360] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1ab90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1ab90, lpOverlapped=0x0) returned 1 [0107.362] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.362] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0107.362] SetEndOfFile (hFile=0x22c) returned 1 [0107.362] CloseHandle (hObject=0x22c) returned 1 [0107.362] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.362] SetEndOfFile (hFile=0x1c8) returned 1 [0107.364] CloseHandle (hObject=0x1c8) returned 1 [0107.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe")) returned 1 [0107.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.364] lstrlenW (lpString=".doc") returned 4 [0107.364] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0107.364] lstrlenW (lpString=".docx") returned 5 [0107.364] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0107.364] lstrlenW (lpString=".pdf") returned 4 [0107.364] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0107.364] lstrlenW (lpString=".xls") returned 4 [0107.364] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0107.364] lstrlenW (lpString=".xlsx") returned 5 [0107.364] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0107.364] lstrlenW (lpString=".ppt") returned 4 [0107.364] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.365] lstrlenW (lpString=".zip") returned 4 [0107.365] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0107.365] lstrlenW (lpString=".rar") returned 4 [0107.365] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0107.365] lstrlenW (lpString=".bz2") returned 4 [0107.365] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0107.365] lstrlenW (lpString=".7z") returned 3 [0107.365] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.365] lstrlenW (lpString=".dbf") returned 4 [0107.365] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.365] lstrlenW (lpString=".1cd") returned 4 [0107.365] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 64 [0107.365] lstrlenW (lpString=".jpg") returned 4 [0107.365] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0107.365] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") [0107.366] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=156032) returned 1 [0107.366] CloseHandle (hObject=0x1c8) returned 1 [0107.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll")) returned 0x20 [0107.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.367] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.367] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.367] GetLastError () returned 0x0 [0107.367] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x26180, lpOverlapped=0x0) returned 1 [0107.372] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x26190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x26190, lpOverlapped=0x0) returned 1 [0107.374] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.374] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0107.374] SetEndOfFile (hFile=0x22c) returned 1 [0107.375] CloseHandle (hObject=0x22c) returned 1 [0107.375] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.375] SetEndOfFile (hFile=0x1c8) returned 1 [0107.376] CloseHandle (hObject=0x1c8) returned 1 [0107.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll")) returned 1 [0107.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.377] lstrlenW (lpString=".doc") returned 4 [0107.377] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString=".docx") returned 5 [0107.377] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0107.377] lstrlenW (lpString=".pdf") returned 4 [0107.377] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString=".xls") returned 4 [0107.377] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString=".xlsx") returned 5 [0107.377] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0107.377] lstrlenW (lpString=".ppt") returned 4 [0107.377] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.377] lstrlenW (lpString=".zip") returned 4 [0107.377] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString=".rar") returned 4 [0107.377] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.377] lstrlenW (lpString=".bz2") returned 4 [0107.377] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.377] lstrlenW (lpString=".7z") returned 3 [0107.377] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.377] lstrlenW (lpString=".dbf") returned 4 [0107.377] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.377] lstrlenW (lpString=".1cd") returned 4 [0107.377] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 54 [0107.378] lstrlenW (lpString=".jpg") returned 4 [0107.378] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.378] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") [0107.379] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7851440) returned 1 [0107.379] CloseHandle (hObject=0x1c8) returned 1 [0107.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll")) returned 0x20 [0107.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.380] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0107.380] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.380] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.383] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x27ef3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.383] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.389] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.389] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x73cdb0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.389] ReadFile (in: hFile=0x1c8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.411] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.411] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0107.429] SetEndOfFile (hFile=0x1c8) returned 1 [0107.429] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0107.429] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.429] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.431] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x27ef3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.431] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.819] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x73cdb0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.820] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.826] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0107.827] CloseHandle (hObject=0x1c8) returned 1 [0107.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.827] lstrlenW (lpString=".doc") returned 4 [0107.827] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.827] lstrlenW (lpString=".docx") returned 5 [0107.827] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0107.827] lstrlenW (lpString=".pdf") returned 4 [0107.827] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.827] lstrlenW (lpString=".xls") returned 4 [0107.827] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.827] lstrlenW (lpString=".xlsx") returned 5 [0107.827] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0107.828] lstrlenW (lpString=".ppt") returned 4 [0107.828] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.828] lstrlenW (lpString=".zip") returned 4 [0107.828] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.828] lstrlenW (lpString=".rar") returned 4 [0107.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.828] lstrlenW (lpString=".bz2") returned 4 [0107.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.828] lstrlenW (lpString=".7z") returned 3 [0107.828] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.828] lstrlenW (lpString=".dbf") returned 4 [0107.828] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.828] lstrlenW (lpString=".1cd") returned 4 [0107.828] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 58 [0107.828] lstrlenW (lpString=".jpg") returned 4 [0107.828] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.828] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") [0107.830] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5674928) returned 1 [0107.830] CloseHandle (hObject=0x1c8) returned 1 [0107.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll")) returned 0x20 [0107.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0107.832] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0107.832] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.832] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.896] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1cdd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.896] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.939] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.939] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x5297b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.939] ReadFile (in: hFile=0x1c8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.960] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.960] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0108.271] SetEndOfFile (hFile=0x1c8) returned 1 [0108.272] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0108.272] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.272] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.273] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1cdd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.273] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.279] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x5297b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.279] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.282] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0108.282] CloseHandle (hObject=0x1c8) returned 1 [0108.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.282] lstrlenW (lpString=".doc") returned 4 [0108.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0108.282] lstrlenW (lpString=".docx") returned 5 [0108.282] lstrcmpiW (lpString1=".docx", lpString2="C.dll") returned -1 [0108.282] lstrlenW (lpString=".pdf") returned 4 [0108.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0108.282] lstrlenW (lpString=".xls") returned 4 [0108.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0108.282] lstrlenW (lpString=".xlsx") returned 5 [0108.282] lstrcmpiW (lpString1=".xlsx", lpString2="C.dll") returned -1 [0108.282] lstrlenW (lpString=".ppt") returned 4 [0108.282] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0108.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.283] lstrlenW (lpString=".zip") returned 4 [0108.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString=".rar") returned 4 [0108.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString=".bz2") returned 4 [0108.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0108.283] lstrlenW (lpString=".7z") returned 3 [0108.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0108.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.283] lstrlenW (lpString=".dbf") returned 4 [0108.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0108.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.283] lstrlenW (lpString=".1cd") returned 4 [0108.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0108.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.283] lstrlenW (lpString=".jpg") returned 4 [0108.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0108.283] @NlsCompareInvariantNoCase@16 () [0108.283] lstrlenW (lpString=".docx") returned 5 [0108.283] lstrcmpiW (lpString1=".docx", lpString2="C.dll") returned -1 [0108.283] lstrlenW (lpString=".pdf") returned 4 [0108.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString=".xls") returned 4 [0108.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString=".xlsx") returned 5 [0108.283] lstrcmpiW (lpString1=".xlsx", lpString2="C.dll") returned -1 [0108.283] lstrlenW (lpString=".ppt") returned 4 [0108.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.283] lstrlenW (lpString=".zip") returned 4 [0108.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0108.283] lstrlenW (lpString=".rar") returned 4 [0108.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0108.284] lstrlenW (lpString=".bz2") returned 4 [0108.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0108.284] lstrlenW (lpString=".7z") returned 3 [0108.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0108.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.284] lstrlenW (lpString=".dbf") returned 4 [0108.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0108.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.284] lstrlenW (lpString=".1cd") returned 4 [0108.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0108.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 60 [0108.284] lstrlenW (lpString=".jpg") returned 4 [0108.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0108.284] @NlsCompareInvariantNoCase@16 () [0108.284] lstrlenW (lpString="OART.DLL") returned 8 [0108.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.874] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=30323048) returned 1 [0108.874] CloseHandle (hObject=0x158) returned 1 [0108.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll")) returned 0x20 [0108.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0108.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.876] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0108.876] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0108.876] ReadFile (in: hFile=0x158, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.881] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x9a3b22, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0108.881] ReadFile (in: hFile=0x158, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.898] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0108.898] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1cab168, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0108.898] ReadFile (in: hFile=0x158, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.928] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.928] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc00fc, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc00fc, lpOverlapped=0x0) returned 1 [0109.081] SetEndOfFile (hFile=0x158) returned 1 [0109.081] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f70048 [0109.085] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.085] WriteFile (in: hFile=0x158, lpBuffer=0x3f70048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.086] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x9a3b22, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.086] WriteFile (in: hFile=0x158, lpBuffer=0x3f70048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.087] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1cab168, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.087] WriteFile (in: hFile=0x158, lpBuffer=0x3f70048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f70048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.089] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0109.089] CloseHandle (hObject=0x158) returned 1 [0109.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.091] lstrlenW (lpString=".doc") returned 4 [0109.091] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString=".docx") returned 5 [0109.091] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0109.091] lstrlenW (lpString=".pdf") returned 4 [0109.091] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString=".xls") returned 4 [0109.091] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString=".xlsx") returned 5 [0109.091] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0109.091] lstrlenW (lpString=".ppt") returned 4 [0109.091] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.091] lstrlenW (lpString=".zip") returned 4 [0109.091] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString=".rar") returned 4 [0109.091] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.091] lstrlenW (lpString=".bz2") returned 4 [0109.091] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.091] lstrlenW (lpString=".7z") returned 3 [0109.091] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.091] lstrlenW (lpString=".dbf") returned 4 [0109.091] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.092] lstrlenW (lpString=".1cd") returned 4 [0109.092] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 51 [0109.092] lstrlenW (lpString=".jpg") returned 4 [0109.092] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.092] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") [0109.093] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=637744) returned 1 [0109.093] CloseHandle (hObject=0x158) returned 1 [0109.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll")) returned 0x20 [0109.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.093] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.093] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.094] GetLastError () returned 0x0 [0109.094] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x9bb30, lpOverlapped=0x0) returned 1 [0109.161] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x9bb40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9bb40, lpOverlapped=0x0) returned 1 [0109.173] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.173] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.174] SetEndOfFile (hFile=0x1c8) returned 1 [0109.174] CloseHandle (hObject=0x1c8) returned 1 [0109.174] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.174] SetEndOfFile (hFile=0x158) returned 1 [0109.179] CloseHandle (hObject=0x158) returned 1 [0109.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll")) returned 1 [0109.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.355] lstrlenW (lpString=".doc") returned 4 [0109.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString=".docx") returned 5 [0109.355] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0109.355] lstrlenW (lpString=".pdf") returned 4 [0109.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString=".xls") returned 4 [0109.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString=".xlsx") returned 5 [0109.355] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0109.355] lstrlenW (lpString=".ppt") returned 4 [0109.355] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.355] lstrlenW (lpString=".zip") returned 4 [0109.355] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString=".rar") returned 4 [0109.355] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.355] lstrlenW (lpString=".bz2") returned 4 [0109.355] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.355] lstrlenW (lpString=".7z") returned 3 [0109.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.356] lstrlenW (lpString=".dbf") returned 4 [0109.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.356] lstrlenW (lpString=".1cd") returned 4 [0109.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 55 [0109.356] lstrlenW (lpString=".jpg") returned 4 [0109.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.356] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") [0109.387] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=299368) returned 1 [0109.387] CloseHandle (hObject=0x22c) returned 1 [0109.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe")) returned 0x20 [0109.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.388] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.388] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.389] GetLastError () returned 0x0 [0109.389] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x49168, lpOverlapped=0x0) returned 1 [0109.403] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x49170, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x49170, lpOverlapped=0x0) returned 1 [0109.410] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.410] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0109.410] SetEndOfFile (hFile=0x180) returned 1 [0109.410] CloseHandle (hObject=0x180) returned 1 [0109.411] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.411] SetEndOfFile (hFile=0x22c) returned 1 [0109.414] CloseHandle (hObject=0x22c) returned 1 [0109.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe")) returned 1 [0109.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.414] lstrlenW (lpString=".doc") returned 4 [0109.414] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0109.414] lstrlenW (lpString=".docx") returned 5 [0109.414] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0109.414] lstrlenW (lpString=".pdf") returned 4 [0109.414] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0109.414] lstrlenW (lpString=".xls") returned 4 [0109.415] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0109.415] lstrlenW (lpString=".xlsx") returned 5 [0109.415] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0109.415] lstrlenW (lpString=".ppt") returned 4 [0109.415] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.415] lstrlenW (lpString=".zip") returned 4 [0109.415] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0109.415] lstrlenW (lpString=".rar") returned 4 [0109.415] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0109.415] lstrlenW (lpString=".bz2") returned 4 [0109.415] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0109.415] lstrlenW (lpString=".7z") returned 3 [0109.415] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.415] lstrlenW (lpString=".dbf") returned 4 [0109.415] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.415] lstrlenW (lpString=".1cd") returned 4 [0109.415] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 50 [0109.415] lstrlenW (lpString=".jpg") returned 4 [0109.415] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0109.415] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") [0109.417] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=259456) returned 1 [0109.417] CloseHandle (hObject=0x22c) returned 1 [0109.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll")) returned 0x20 [0109.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.417] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.417] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.418] GetLastError () returned 0x0 [0109.418] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3f580, lpOverlapped=0x0) returned 1 [0109.480] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3f590, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3f590, lpOverlapped=0x0) returned 1 [0109.485] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.485] WriteFile (in: hFile=0x180, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.486] SetEndOfFile (hFile=0x180) returned 1 [0109.486] CloseHandle (hObject=0x180) returned 1 [0109.486] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.486] SetEndOfFile (hFile=0x22c) returned 1 [0109.488] CloseHandle (hObject=0x22c) returned 1 [0109.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll")) returned 1 [0109.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.488] lstrlenW (lpString=".doc") returned 4 [0109.488] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.488] lstrlenW (lpString=".docx") returned 5 [0109.488] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0109.489] lstrlenW (lpString=".pdf") returned 4 [0109.489] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.489] lstrlenW (lpString=".xls") returned 4 [0109.489] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.489] lstrlenW (lpString=".xlsx") returned 5 [0109.489] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0109.489] lstrlenW (lpString=".ppt") returned 4 [0109.489] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.489] lstrlenW (lpString=".zip") returned 4 [0109.489] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.489] lstrlenW (lpString=".rar") returned 4 [0109.489] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.489] lstrlenW (lpString=".bz2") returned 4 [0109.489] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.489] lstrlenW (lpString=".7z") returned 3 [0109.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.489] lstrlenW (lpString=".dbf") returned 4 [0109.489] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.489] lstrlenW (lpString=".1cd") returned 4 [0109.489] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 55 [0109.489] lstrlenW (lpString=".jpg") returned 4 [0109.489] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.489] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") [0109.662] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1104256) returned 1 [0109.662] CloseHandle (hObject=0x1b8) returned 1 [0109.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll")) returned 0x20 [0109.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.663] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.663] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.664] GetLastError () returned 0x0 [0109.664] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0109.796] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0109.821] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xd990, lpOverlapped=0x0) returned 1 [0109.840] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xd9a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd9a0, lpOverlapped=0x0) returned 1 [0109.851] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.851] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0109.852] SetEndOfFile (hFile=0x210) returned 1 [0109.858] CloseHandle (hObject=0x210) returned 1 [0109.858] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.858] SetEndOfFile (hFile=0x1b8) returned 1 [0109.860] CloseHandle (hObject=0x1b8) returned 1 [0109.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll")) returned 1 [0109.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.882] lstrlenW (lpString=".doc") returned 4 [0109.882] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.882] lstrlenW (lpString=".docx") returned 5 [0109.882] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0109.882] lstrlenW (lpString=".pdf") returned 4 [0109.882] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.882] lstrlenW (lpString=".xls") returned 4 [0109.882] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.882] lstrlenW (lpString=".xlsx") returned 5 [0109.882] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0109.882] lstrlenW (lpString=".ppt") returned 4 [0109.883] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.883] lstrlenW (lpString=".zip") returned 4 [0109.883] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.883] lstrlenW (lpString=".rar") returned 4 [0109.883] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.883] lstrlenW (lpString=".bz2") returned 4 [0109.883] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.883] lstrlenW (lpString=".7z") returned 3 [0109.883] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.883] lstrlenW (lpString=".dbf") returned 4 [0109.883] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.883] lstrlenW (lpString=".1cd") returned 4 [0109.883] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 54 [0109.883] lstrlenW (lpString=".jpg") returned 4 [0109.883] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.883] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") [0109.884] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=594832) returned 1 [0109.885] CloseHandle (hObject=0x1b8) returned 1 [0109.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll")) returned 0x20 [0109.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.885] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.885] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0109.886] GetLastError () returned 0x0 [0109.886] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x91390, lpOverlapped=0x0) returned 1 [0110.172] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x913a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x913a0, lpOverlapped=0x0) returned 1 [0110.184] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.184] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x102, lpOverlapped=0x0) returned 1 [0110.184] SetEndOfFile (hFile=0x210) returned 1 [0110.184] CloseHandle (hObject=0x210) returned 1 [0110.184] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.184] SetEndOfFile (hFile=0x1b8) returned 1 [0110.190] CloseHandle (hObject=0x1b8) returned 1 [0110.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll")) returned 1 [0110.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.190] lstrlenW (lpString=".doc") returned 4 [0110.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.190] lstrlenW (lpString=".docx") returned 5 [0110.190] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.190] lstrlenW (lpString=".pdf") returned 4 [0110.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.190] lstrlenW (lpString=".xls") returned 4 [0110.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.190] lstrlenW (lpString=".xlsx") returned 5 [0110.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.190] lstrlenW (lpString=".ppt") returned 4 [0110.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.190] lstrlenW (lpString=".zip") returned 4 [0110.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.191] lstrlenW (lpString=".rar") returned 4 [0110.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.191] lstrlenW (lpString=".bz2") returned 4 [0110.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.191] lstrlenW (lpString=".7z") returned 3 [0110.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.191] lstrlenW (lpString=".dbf") returned 4 [0110.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.191] lstrlenW (lpString=".1cd") returned 4 [0110.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 66 [0110.191] lstrlenW (lpString=".jpg") returned 4 [0110.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.191] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") [0110.277] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=114568) returned 1 [0110.277] CloseHandle (hObject=0x1b8) returned 1 [0110.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll")) returned 0x20 [0110.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.277] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.277] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.278] GetLastError () returned 0x0 [0110.278] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1bf88, lpOverlapped=0x0) returned 1 [0110.281] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0110.306] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.306] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x102, lpOverlapped=0x0) returned 1 [0110.306] SetEndOfFile (hFile=0x210) returned 1 [0110.306] CloseHandle (hObject=0x210) returned 1 [0110.306] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.307] SetEndOfFile (hFile=0x1b8) returned 1 [0110.308] CloseHandle (hObject=0x1b8) returned 1 [0110.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll")) returned 1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString=".doc") returned 4 [0110.513] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString=".docx") returned 5 [0110.513] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0110.513] lstrlenW (lpString=".pdf") returned 4 [0110.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString=".xls") returned 4 [0110.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString=".xlsx") returned 5 [0110.513] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0110.513] lstrlenW (lpString=".ppt") returned 4 [0110.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString=".zip") returned 4 [0110.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString=".rar") returned 4 [0110.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.513] lstrlenW (lpString=".bz2") returned 4 [0110.513] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.513] lstrlenW (lpString=".7z") returned 3 [0110.513] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString=".dbf") returned 4 [0110.513] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString=".1cd") returned 4 [0110.513] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 74 [0110.513] lstrlenW (lpString=".jpg") returned 4 [0110.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.513] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") [0110.514] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=79264) returned 1 [0110.514] CloseHandle (hObject=0x210) returned 1 [0110.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll")) returned 0x20 [0110.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.514] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.515] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.515] GetLastError () returned 0x0 [0110.515] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x135a0, lpOverlapped=0x0) returned 1 [0110.532] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x135b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x135b0, lpOverlapped=0x0) returned 1 [0110.534] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.534] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0110.535] SetEndOfFile (hFile=0x1a0) returned 1 [0110.535] CloseHandle (hObject=0x1a0) returned 1 [0110.535] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.535] SetEndOfFile (hFile=0x210) returned 1 [0110.539] CloseHandle (hObject=0x210) returned 1 [0110.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll")) returned 1 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString=".doc") returned 4 [0110.540] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString=".docx") returned 5 [0110.540] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0110.540] lstrlenW (lpString=".pdf") returned 4 [0110.540] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString=".xls") returned 4 [0110.540] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString=".xlsx") returned 5 [0110.540] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0110.540] lstrlenW (lpString=".ppt") returned 4 [0110.540] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString=".zip") returned 4 [0110.540] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString=".rar") returned 4 [0110.540] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.540] lstrlenW (lpString=".bz2") returned 4 [0110.540] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.540] lstrlenW (lpString=".7z") returned 3 [0110.540] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString=".dbf") returned 4 [0110.540] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString=".1cd") returned 4 [0110.540] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 58 [0110.540] lstrlenW (lpString=".jpg") returned 4 [0110.540] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.541] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") [0110.542] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=688512) returned 1 [0110.542] CloseHandle (hObject=0x210) returned 1 [0110.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll")) returned 0x20 [0110.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0110.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.543] GetLastError () returned 0x0 [0110.543] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa8180, lpOverlapped=0x0) returned 1 [0110.703] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa8190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa8190, lpOverlapped=0x0) returned 1 [0110.715] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.715] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0110.715] SetEndOfFile (hFile=0x1a0) returned 1 [0110.716] CloseHandle (hObject=0x1a0) returned 1 [0110.716] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.716] SetEndOfFile (hFile=0x210) returned 1 [0110.721] CloseHandle (hObject=0x210) returned 1 [0110.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll")) returned 1 [0110.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.933] lstrlenW (lpString=".doc") returned 4 [0110.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.933] lstrlenW (lpString=".docx") returned 5 [0110.933] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0110.933] lstrlenW (lpString=".pdf") returned 4 [0110.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.933] lstrlenW (lpString=".xls") returned 4 [0110.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.933] lstrlenW (lpString=".xlsx") returned 5 [0110.933] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0110.933] lstrlenW (lpString=".ppt") returned 4 [0110.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.933] lstrlenW (lpString=".zip") returned 4 [0110.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.933] lstrlenW (lpString=".rar") returned 4 [0110.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.934] lstrlenW (lpString=".bz2") returned 4 [0110.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.934] lstrlenW (lpString=".7z") returned 3 [0110.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.934] lstrlenW (lpString=".dbf") returned 4 [0110.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.934] lstrlenW (lpString=".1cd") returned 4 [0110.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 57 [0110.934] lstrlenW (lpString=".jpg") returned 4 [0110.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.934] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") [0111.241] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=715656) returned 1 [0111.241] CloseHandle (hObject=0x22c) returned 1 [0111.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll")) returned 0x20 [0111.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.242] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.242] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.243] GetLastError () returned 0x0 [0111.243] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xaeb88, lpOverlapped=0x0) returned 1 [0111.332] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xaeb90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xaeb90, lpOverlapped=0x0) returned 1 [0111.346] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.346] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.346] SetEndOfFile (hFile=0x19c) returned 1 [0111.346] CloseHandle (hObject=0x19c) returned 1 [0111.347] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.347] SetEndOfFile (hFile=0x22c) returned 1 [0111.353] CloseHandle (hObject=0x22c) returned 1 [0111.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll")) returned 1 [0111.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.353] lstrlenW (lpString=".doc") returned 4 [0111.353] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.353] lstrlenW (lpString=".docx") returned 5 [0111.353] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0111.353] lstrlenW (lpString=".pdf") returned 4 [0111.353] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.353] lstrlenW (lpString=".xls") returned 4 [0111.353] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.354] lstrlenW (lpString=".xlsx") returned 5 [0111.354] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0111.354] lstrlenW (lpString=".ppt") returned 4 [0111.354] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.354] lstrlenW (lpString=".zip") returned 4 [0111.354] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.354] lstrlenW (lpString=".rar") returned 4 [0111.354] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.354] lstrlenW (lpString=".bz2") returned 4 [0111.354] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.354] lstrlenW (lpString=".7z") returned 3 [0111.354] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.354] lstrlenW (lpString=".dbf") returned 4 [0111.354] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.354] lstrlenW (lpString=".1cd") returned 4 [0111.354] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 55 [0111.354] lstrlenW (lpString=".jpg") returned 4 [0111.354] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.354] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") [0111.355] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=702784) returned 1 [0111.355] CloseHandle (hObject=0x22c) returned 1 [0111.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll")) returned 0x20 [0111.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.356] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.356] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.357] GetLastError () returned 0x0 [0111.357] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xab940, lpOverlapped=0x0) returned 1 [0111.442] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xab950, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xab950, lpOverlapped=0x0) returned 1 [0111.456] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.456] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.456] SetEndOfFile (hFile=0x19c) returned 1 [0111.457] CloseHandle (hObject=0x19c) returned 1 [0111.457] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.457] SetEndOfFile (hFile=0x22c) returned 1 [0111.463] CloseHandle (hObject=0x22c) returned 1 [0111.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll")) returned 1 [0111.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.463] lstrlenW (lpString=".doc") returned 4 [0111.463] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.463] lstrlenW (lpString=".docx") returned 5 [0111.463] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0111.463] lstrlenW (lpString=".pdf") returned 4 [0111.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.463] lstrlenW (lpString=".xls") returned 4 [0111.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.463] lstrlenW (lpString=".xlsx") returned 5 [0111.463] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0111.463] lstrlenW (lpString=".ppt") returned 4 [0111.464] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.464] lstrlenW (lpString=".zip") returned 4 [0111.464] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.464] lstrlenW (lpString=".rar") returned 4 [0111.464] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.464] lstrlenW (lpString=".bz2") returned 4 [0111.464] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.464] lstrlenW (lpString=".7z") returned 3 [0111.464] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.464] lstrlenW (lpString=".dbf") returned 4 [0111.464] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.464] lstrlenW (lpString=".1cd") returned 4 [0111.464] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 55 [0111.464] lstrlenW (lpString=".jpg") returned 4 [0111.464] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.464] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") [0111.465] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1206) returned 1 [0111.466] CloseHandle (hObject=0x22c) returned 1 [0111.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest")) returned 0x20 [0111.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.466] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.466] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.467] GetLastError () returned 0x0 [0111.467] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x4b6, lpOverlapped=0x0) returned 1 [0111.635] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0111.636] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.636] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0111.637] SetEndOfFile (hFile=0x19c) returned 1 [0111.637] CloseHandle (hObject=0x19c) returned 1 [0111.637] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.637] SetEndOfFile (hFile=0x22c) returned 1 [0111.638] CloseHandle (hObject=0x22c) returned 1 [0111.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest")) returned 1 [0111.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.638] lstrlenW (lpString=".doc") returned 4 [0111.638] lstrcmpiW (lpString1=".doc", lpString2="FEST") returned -1 [0111.638] lstrlenW (lpString=".docx") returned 5 [0111.638] lstrcmpiW (lpString1=".docx", lpString2="IFEST") returned -1 [0111.638] lstrlenW (lpString=".pdf") returned 4 [0111.638] lstrcmpiW (lpString1=".pdf", lpString2="FEST") returned -1 [0111.638] lstrlenW (lpString=".xls") returned 4 [0111.638] lstrcmpiW (lpString1=".xls", lpString2="FEST") returned -1 [0111.638] lstrlenW (lpString=".xlsx") returned 5 [0111.638] lstrcmpiW (lpString1=".xlsx", lpString2="IFEST") returned -1 [0111.638] lstrlenW (lpString=".ppt") returned 4 [0111.638] lstrcmpiW (lpString1=".ppt", lpString2="FEST") returned -1 [0111.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.638] lstrlenW (lpString=".zip") returned 4 [0111.638] lstrcmpiW (lpString1=".zip", lpString2="FEST") returned -1 [0111.639] lstrlenW (lpString=".rar") returned 4 [0111.639] lstrcmpiW (lpString1=".rar", lpString2="FEST") returned -1 [0111.639] lstrlenW (lpString=".bz2") returned 4 [0111.639] lstrcmpiW (lpString1=".bz2", lpString2="FEST") returned -1 [0111.639] lstrlenW (lpString=".7z") returned 3 [0111.639] lstrcmpiW (lpString1=".7z", lpString2="EST") returned -1 [0111.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.639] lstrlenW (lpString=".dbf") returned 4 [0111.639] lstrcmpiW (lpString1=".dbf", lpString2="FEST") returned -1 [0111.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.639] lstrlenW (lpString=".1cd") returned 4 [0111.639] lstrcmpiW (lpString1=".1cd", lpString2="FEST") returned -1 [0111.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 63 [0111.639] lstrlenW (lpString=".jpg") returned 4 [0111.639] lstrcmpiW (lpString1=".jpg", lpString2="FEST") returned -1 [0111.639] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") [0111.640] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=58712) returned 1 [0111.640] CloseHandle (hObject=0x22c) returned 1 [0111.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll")) returned 0x20 [0111.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.641] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.641] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.642] GetLastError () returned 0x0 [0111.642] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe558, lpOverlapped=0x0) returned 1 [0111.645] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe560, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe560, lpOverlapped=0x0) returned 1 [0111.647] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.647] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0111.647] SetEndOfFile (hFile=0x19c) returned 1 [0111.647] CloseHandle (hObject=0x19c) returned 1 [0111.647] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.647] SetEndOfFile (hFile=0x22c) returned 1 [0111.650] CloseHandle (hObject=0x22c) returned 1 [0111.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll")) returned 1 [0111.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.651] lstrlenW (lpString=".doc") returned 4 [0111.651] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString=".docx") returned 5 [0111.651] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0111.651] lstrlenW (lpString=".pdf") returned 4 [0111.651] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString=".xls") returned 4 [0111.651] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString=".xlsx") returned 5 [0111.651] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0111.651] lstrlenW (lpString=".ppt") returned 4 [0111.651] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.651] lstrlenW (lpString=".zip") returned 4 [0111.651] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString=".rar") returned 4 [0111.651] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.651] lstrlenW (lpString=".bz2") returned 4 [0111.651] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.652] lstrlenW (lpString=".7z") returned 3 [0111.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.652] lstrlenW (lpString=".dbf") returned 4 [0111.652] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.652] lstrlenW (lpString=".1cd") returned 4 [0111.652] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 54 [0111.652] lstrlenW (lpString=".jpg") returned 4 [0111.652] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.652] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") [0111.653] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=71536) returned 1 [0111.653] CloseHandle (hObject=0x22c) returned 1 [0111.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll")) returned 0x20 [0111.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.654] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.654] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.655] GetLastError () returned 0x0 [0111.655] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x11770, lpOverlapped=0x0) returned 1 [0111.659] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x11780, lpOverlapped=0x0) returned 1 [0111.661] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.661] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0111.661] SetEndOfFile (hFile=0x19c) returned 1 [0111.661] CloseHandle (hObject=0x19c) returned 1 [0111.661] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.661] SetEndOfFile (hFile=0x22c) returned 1 [0111.662] CloseHandle (hObject=0x22c) returned 1 [0111.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll")) returned 1 [0111.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString=".doc") returned 4 [0111.663] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString=".docx") returned 5 [0111.663] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0111.663] lstrlenW (lpString=".pdf") returned 4 [0111.663] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString=".xls") returned 4 [0111.663] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString=".xlsx") returned 5 [0111.663] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0111.663] lstrlenW (lpString=".ppt") returned 4 [0111.663] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString=".zip") returned 4 [0111.663] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString=".rar") returned 4 [0111.663] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.663] lstrlenW (lpString=".bz2") returned 4 [0111.663] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.663] lstrlenW (lpString=".7z") returned 3 [0111.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString=".dbf") returned 4 [0111.663] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString=".1cd") returned 4 [0111.663] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 54 [0111.663] lstrlenW (lpString=".jpg") returned 4 [0111.663] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.663] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") [0111.665] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=480672) returned 1 [0111.665] CloseHandle (hObject=0x22c) returned 1 [0111.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll")) returned 0x20 [0111.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.665] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.665] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.666] GetLastError () returned 0x0 [0111.666] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x755a0, lpOverlapped=0x0) returned 1 [0111.677] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x755b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x755b0, lpOverlapped=0x0) returned 1 [0111.686] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.686] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0111.686] SetEndOfFile (hFile=0x19c) returned 1 [0111.686] CloseHandle (hObject=0x19c) returned 1 [0111.687] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.687] SetEndOfFile (hFile=0x22c) returned 1 [0111.690] CloseHandle (hObject=0x22c) returned 1 [0111.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll")) returned 1 [0111.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.691] lstrlenW (lpString=".doc") returned 4 [0111.691] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.691] lstrlenW (lpString=".docx") returned 5 [0111.691] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0111.691] lstrlenW (lpString=".pdf") returned 4 [0111.691] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.691] lstrlenW (lpString=".xls") returned 4 [0111.691] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.691] lstrlenW (lpString=".xlsx") returned 5 [0111.691] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0111.691] lstrlenW (lpString=".ppt") returned 4 [0111.691] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.691] lstrlenW (lpString=".zip") returned 4 [0111.691] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.691] lstrlenW (lpString=".rar") returned 4 [0111.692] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.692] lstrlenW (lpString=".bz2") returned 4 [0111.692] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.692] lstrlenW (lpString=".7z") returned 3 [0111.692] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.692] lstrlenW (lpString=".dbf") returned 4 [0111.692] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.692] lstrlenW (lpString=".1cd") returned 4 [0111.692] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 54 [0111.692] lstrlenW (lpString=".jpg") returned 4 [0111.692] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.692] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") [0111.693] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=970096) returned 1 [0111.693] CloseHandle (hObject=0x22c) returned 1 [0111.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll")) returned 0x20 [0111.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.693] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.693] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.694] GetLastError () returned 0x0 [0111.694] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xecd70, lpOverlapped=0x0) returned 1 [0112.087] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xecd80, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xecd80, lpOverlapped=0x0) returned 1 [0112.106] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.106] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0112.106] SetEndOfFile (hFile=0x19c) returned 1 [0112.106] CloseHandle (hObject=0x19c) returned 1 [0112.106] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.106] SetEndOfFile (hFile=0x22c) returned 1 [0112.241] CloseHandle (hObject=0x22c) returned 1 [0112.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll")) returned 1 [0112.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.242] lstrlenW (lpString=".doc") returned 4 [0112.242] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString=".docx") returned 5 [0112.242] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0112.242] lstrlenW (lpString=".pdf") returned 4 [0112.242] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString=".xls") returned 4 [0112.242] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString=".xlsx") returned 5 [0112.242] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0112.242] lstrlenW (lpString=".ppt") returned 4 [0112.242] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.242] lstrlenW (lpString=".zip") returned 4 [0112.242] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString=".rar") returned 4 [0112.242] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.242] lstrlenW (lpString=".bz2") returned 4 [0112.242] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.242] lstrlenW (lpString=".7z") returned 3 [0112.242] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.243] lstrlenW (lpString=".dbf") returned 4 [0112.243] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.243] lstrlenW (lpString=".1cd") returned 4 [0112.243] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 49 [0112.243] lstrlenW (lpString=".jpg") returned 4 [0112.243] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.243] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") [0112.244] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3792736) returned 1 [0112.244] CloseHandle (hObject=0x22c) returned 1 [0112.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe")) returned 0x20 [0112.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0112.246] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0112.246] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.246] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.269] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x134a75, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.269] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.351] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.351] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x35df60, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.351] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.377] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.377] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0112.494] SetEndOfFile (hFile=0x22c) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0112.494] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.494] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.495] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x134a75, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.495] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.499] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x35df60, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.499] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.501] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0112.501] CloseHandle (hObject=0x22c) returned 1 [0112.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.502] lstrlenW (lpString=".doc") returned 4 [0112.502] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.502] lstrlenW (lpString=".docx") returned 5 [0112.502] lstrcmpiW (lpString1=".docx", lpString2="O.EXE") returned -1 [0112.502] lstrlenW (lpString=".pdf") returned 4 [0112.502] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.502] lstrlenW (lpString=".xls") returned 4 [0112.502] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.502] lstrlenW (lpString=".xlsx") returned 5 [0112.502] lstrcmpiW (lpString1=".xlsx", lpString2="O.EXE") returned -1 [0112.502] lstrlenW (lpString=".ppt") returned 4 [0112.502] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.502] lstrlenW (lpString=".zip") returned 4 [0112.503] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.503] lstrlenW (lpString=".rar") returned 4 [0112.503] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.503] lstrlenW (lpString=".bz2") returned 4 [0112.503] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.503] lstrlenW (lpString=".7z") returned 3 [0112.503] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.503] lstrlenW (lpString=".dbf") returned 4 [0112.503] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.504] lstrlenW (lpString=".1cd") returned 4 [0112.504] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 53 [0112.504] lstrlenW (lpString=".jpg") returned 4 [0112.504] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.504] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") [0112.505] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3788603) returned 1 [0112.505] CloseHandle (hObject=0x22c) returned 1 [0112.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex")) returned 0x20 [0112.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0112.507] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0112.507] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.507] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.511] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x134513, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.511] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.521] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.521] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x35cf3b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.521] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.662] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.662] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.683] SetEndOfFile (hFile=0x22c) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0112.688] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.688] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.689] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x134513, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.689] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.693] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x35cf3b, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.693] WriteFile (in: hFile=0x22c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.695] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0112.695] CloseHandle (hObject=0x22c) returned 1 [0112.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.696] lstrlenW (lpString=".doc") returned 4 [0112.696] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0112.696] lstrlenW (lpString=".docx") returned 5 [0112.696] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0112.696] lstrlenW (lpString=".pdf") returned 4 [0112.696] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0112.696] lstrlenW (lpString=".xls") returned 4 [0112.696] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0112.696] lstrlenW (lpString=".xlsx") returned 5 [0112.696] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0112.696] lstrlenW (lpString=".ppt") returned 4 [0112.696] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0112.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.696] lstrlenW (lpString=".zip") returned 4 [0112.696] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0112.696] lstrlenW (lpString=".rar") returned 4 [0112.696] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0112.696] lstrlenW (lpString=".bz2") returned 4 [0112.696] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0112.696] lstrlenW (lpString=".7z") returned 3 [0112.696] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0112.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.696] lstrlenW (lpString=".dbf") returned 4 [0112.696] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0112.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.697] lstrlenW (lpString=".1cd") returned 4 [0112.697] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0112.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 60 [0112.697] lstrlenW (lpString=".jpg") returned 4 [0112.697] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0112.697] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") [0112.698] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=25) returned 1 [0112.698] CloseHandle (hObject=0x22c) returned 1 [0112.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex")) returned 0x20 [0112.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0112.699] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.699] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0112.700] GetLastError () returned 0x0 [0112.700] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x19, lpOverlapped=0x0) returned 1 [0112.787] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x20, lpOverlapped=0x0) returned 1 [0112.787] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.787] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.788] SetEndOfFile (hFile=0x19c) returned 1 [0112.819] CloseHandle (hObject=0x19c) returned 1 [0112.819] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.819] SetEndOfFile (hFile=0x22c) returned 1 [0112.846] CloseHandle (hObject=0x22c) returned 1 [0112.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex")) returned 1 [0112.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.846] lstrlenW (lpString=".doc") returned 4 [0112.846] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0112.846] lstrlenW (lpString=".docx") returned 5 [0112.846] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0112.846] lstrlenW (lpString=".pdf") returned 4 [0112.846] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0112.846] lstrlenW (lpString=".xls") returned 4 [0112.846] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0112.846] lstrlenW (lpString=".xlsx") returned 5 [0112.846] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0112.847] lstrlenW (lpString=".ppt") returned 4 [0112.847] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0112.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.847] lstrlenW (lpString=".zip") returned 4 [0112.847] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0112.847] lstrlenW (lpString=".rar") returned 4 [0112.847] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0112.847] lstrlenW (lpString=".bz2") returned 4 [0112.847] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0112.847] lstrlenW (lpString=".7z") returned 3 [0112.847] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0112.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.847] lstrlenW (lpString=".dbf") returned 4 [0112.847] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0112.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.847] lstrlenW (lpString=".1cd") returned 4 [0112.847] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0112.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 60 [0112.847] lstrlenW (lpString=".jpg") returned 4 [0112.847] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0112.847] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") [0112.848] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=223624) returned 1 [0112.848] CloseHandle (hObject=0x22c) returned 1 [0112.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll")) returned 0x20 [0112.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0112.848] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.848] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.091] GetLastError () returned 0x0 [0113.244] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x36988, lpOverlapped=0x0) returned 1 [0113.252] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x36990, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x36990, lpOverlapped=0x0) returned 1 [0113.256] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.257] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.257] SetEndOfFile (hFile=0x1c0) returned 1 [0113.257] CloseHandle (hObject=0x1c0) returned 1 [0113.257] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.257] SetEndOfFile (hFile=0x22c) returned 1 [0113.259] CloseHandle (hObject=0x22c) returned 1 [0113.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll")) returned 1 [0113.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.259] lstrlenW (lpString=".doc") returned 4 [0113.259] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0113.259] lstrlenW (lpString=".docx") returned 5 [0113.259] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0113.259] lstrlenW (lpString=".pdf") returned 4 [0113.259] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0113.260] lstrlenW (lpString=".xls") returned 4 [0113.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0113.260] lstrlenW (lpString=".xlsx") returned 5 [0113.260] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0113.260] lstrlenW (lpString=".ppt") returned 4 [0113.260] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0113.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.260] lstrlenW (lpString=".zip") returned 4 [0113.260] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0113.260] lstrlenW (lpString=".rar") returned 4 [0113.260] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0113.260] lstrlenW (lpString=".bz2") returned 4 [0113.260] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0113.260] lstrlenW (lpString=".7z") returned 3 [0113.260] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0113.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.260] lstrlenW (lpString=".dbf") returned 4 [0113.260] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0113.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.260] lstrlenW (lpString=".1cd") returned 4 [0113.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0113.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 60 [0113.260] lstrlenW (lpString=".jpg") returned 4 [0113.260] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0113.260] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") [0113.270] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2024320) returned 1 [0113.270] CloseHandle (hObject=0x22c) returned 1 [0113.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll")) returned 0x20 [0113.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0113.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0113.271] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0113.271] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.272] ReadFile (in: hFile=0x22c, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.282] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.282] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.291] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0113.291] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.291] ReadFile (in: hFile=0x22c, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.327] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.327] WriteFile (in: hFile=0x22c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0113.548] SetEndOfFile (hFile=0x22c) returned 1 [0113.882] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0113.882] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.882] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.907] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.907] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.909] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.911] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0113.911] CloseHandle (hObject=0x22c) returned 1 [0113.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.911] lstrlenW (lpString=".doc") returned 4 [0113.911] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0113.911] lstrlenW (lpString=".docx") returned 5 [0113.911] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0113.911] lstrlenW (lpString=".pdf") returned 4 [0113.911] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0113.911] lstrlenW (lpString=".xls") returned 4 [0113.911] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0113.911] lstrlenW (lpString=".xlsx") returned 5 [0113.911] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0113.911] lstrlenW (lpString=".ppt") returned 4 [0113.911] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.912] lstrlenW (lpString=".zip") returned 4 [0113.912] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0113.912] lstrlenW (lpString=".rar") returned 4 [0113.912] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0113.912] lstrlenW (lpString=".bz2") returned 4 [0113.912] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0113.912] lstrlenW (lpString=".7z") returned 3 [0113.912] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.912] lstrlenW (lpString=".dbf") returned 4 [0113.912] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.912] lstrlenW (lpString=".1cd") returned 4 [0113.912] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 60 [0113.912] lstrlenW (lpString=".jpg") returned 4 [0113.912] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0113.912] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") [0114.251] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=16) returned 1 [0114.251] CloseHandle (hObject=0x158) returned 1 [0114.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub")) returned 0x20 [0114.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.252] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.252] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.253] GetLastError () returned 0x0 [0114.253] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x10, lpOverlapped=0x0) returned 1 [0114.254] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x20, lpOverlapped=0x0) returned 1 [0114.255] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.255] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.255] SetEndOfFile (hFile=0x210) returned 1 [0114.255] CloseHandle (hObject=0x210) returned 1 [0114.255] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.255] SetEndOfFile (hFile=0x158) returned 1 [0114.256] CloseHandle (hObject=0x158) returned 1 [0114.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub")) returned 1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.256] lstrlenW (lpString=".doc") returned 4 [0114.256] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0114.256] lstrlenW (lpString=".docx") returned 5 [0114.256] lstrcmpiW (lpString1=".docx", lpString2="R.dub") returned -1 [0114.256] lstrlenW (lpString=".pdf") returned 4 [0114.256] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0114.256] lstrlenW (lpString=".xls") returned 4 [0114.257] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0114.257] lstrlenW (lpString=".xlsx") returned 5 [0114.257] lstrcmpiW (lpString1=".xlsx", lpString2="R.dub") returned -1 [0114.257] lstrlenW (lpString=".ppt") returned 4 [0114.257] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0114.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.257] lstrlenW (lpString=".zip") returned 4 [0114.257] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0114.257] lstrlenW (lpString=".rar") returned 4 [0114.257] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0114.257] lstrlenW (lpString=".bz2") returned 4 [0114.257] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0114.257] lstrlenW (lpString=".7z") returned 3 [0114.257] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0114.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.257] lstrlenW (lpString=".dbf") returned 4 [0114.257] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0114.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.257] lstrlenW (lpString=".1cd") returned 4 [0114.257] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0114.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 60 [0114.257] lstrlenW (lpString=".jpg") returned 4 [0114.257] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0114.257] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") [0114.258] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=454528) returned 1 [0114.258] CloseHandle (hObject=0x158) returned 1 [0114.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll")) returned 0x20 [0114.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.258] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.258] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.259] GetLastError () returned 0x0 [0114.259] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x6ef80, lpOverlapped=0x0) returned 1 [0114.270] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x6ef90, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6ef90, lpOverlapped=0x0) returned 1 [0114.278] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.278] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.278] SetEndOfFile (hFile=0x210) returned 1 [0114.278] CloseHandle (hObject=0x210) returned 1 [0114.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.278] SetEndOfFile (hFile=0x158) returned 1 [0114.282] CloseHandle (hObject=0x158) returned 1 [0114.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll")) returned 1 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString=".doc") returned 4 [0114.283] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString=".docx") returned 5 [0114.283] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0114.283] lstrlenW (lpString=".pdf") returned 4 [0114.283] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString=".xls") returned 4 [0114.283] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString=".xlsx") returned 5 [0114.283] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0114.283] lstrlenW (lpString=".ppt") returned 4 [0114.283] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString=".zip") returned 4 [0114.283] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString=".rar") returned 4 [0114.283] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.283] lstrlenW (lpString=".bz2") returned 4 [0114.283] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.283] lstrlenW (lpString=".7z") returned 3 [0114.283] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString=".dbf") returned 4 [0114.283] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString=".1cd") returned 4 [0114.283] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 60 [0114.283] lstrlenW (lpString=".jpg") returned 4 [0114.283] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.284] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") [0114.285] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5977088) returned 1 [0114.285] CloseHandle (hObject=0x158) returned 1 [0114.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex")) returned 0x20 [0114.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0114.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.286] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0114.286] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.286] ReadFile (in: hFile=0x158, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.420] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e66aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x158, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.488] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.488] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x573400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.489] ReadFile (in: hFile=0x158, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.515] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.515] WriteFile (in: hFile=0x158, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0114.632] SetEndOfFile (hFile=0x158) returned 1 [0114.632] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0114.632] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.632] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.633] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1e66aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.633] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.639] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x573400, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.639] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.641] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0114.641] CloseHandle (hObject=0x158) returned 1 [0114.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.641] lstrlenW (lpString=".doc") returned 4 [0114.641] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0114.641] lstrlenW (lpString=".docx") returned 5 [0114.641] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0114.641] lstrlenW (lpString=".pdf") returned 4 [0114.641] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0114.641] lstrlenW (lpString=".xls") returned 4 [0114.641] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0114.641] lstrlenW (lpString=".xlsx") returned 5 [0114.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0114.641] lstrlenW (lpString=".ppt") returned 4 [0114.641] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0114.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.641] lstrlenW (lpString=".zip") returned 4 [0114.641] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0114.641] lstrlenW (lpString=".rar") returned 4 [0114.641] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0114.641] lstrlenW (lpString=".bz2") returned 4 [0114.642] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0114.642] lstrlenW (lpString=".7z") returned 3 [0114.642] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0114.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.642] lstrlenW (lpString=".dbf") returned 4 [0114.642] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0114.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.642] lstrlenW (lpString=".1cd") returned 4 [0114.642] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0114.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 60 [0114.642] lstrlenW (lpString=".jpg") returned 4 [0114.642] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0114.642] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") [0114.643] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=426856) returned 1 [0114.643] CloseHandle (hObject=0x158) returned 1 [0114.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll")) returned 0x20 [0114.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.643] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.643] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0114.644] GetLastError () returned 0x0 [0114.644] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x68368, lpOverlapped=0x0) returned 1 [0114.654] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x68370, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x68370, lpOverlapped=0x0) returned 1 [0114.663] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.663] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.663] SetEndOfFile (hFile=0x15c) returned 1 [0114.663] CloseHandle (hObject=0x15c) returned 1 [0114.663] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.663] SetEndOfFile (hFile=0x158) returned 1 [0114.667] CloseHandle (hObject=0x158) returned 1 [0114.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll")) returned 1 [0114.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.667] lstrlenW (lpString=".doc") returned 4 [0114.667] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.667] lstrlenW (lpString=".docx") returned 5 [0114.667] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0114.667] lstrlenW (lpString=".pdf") returned 4 [0114.667] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.667] lstrlenW (lpString=".xls") returned 4 [0114.667] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.668] lstrlenW (lpString=".xlsx") returned 5 [0114.668] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0114.668] lstrlenW (lpString=".ppt") returned 4 [0114.668] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.668] lstrlenW (lpString=".zip") returned 4 [0114.668] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.668] lstrlenW (lpString=".rar") returned 4 [0114.668] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.668] lstrlenW (lpString=".bz2") returned 4 [0114.668] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.668] lstrlenW (lpString=".7z") returned 3 [0114.668] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.668] lstrlenW (lpString=".dbf") returned 4 [0114.668] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.668] lstrlenW (lpString=".1cd") returned 4 [0114.668] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 55 [0114.668] lstrlenW (lpString=".jpg") returned 4 [0114.668] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.668] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") [0114.669] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=909696) returned 1 [0114.669] CloseHandle (hObject=0x158) returned 1 [0114.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll")) returned 0x20 [0114.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.669] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.669] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0114.670] GetLastError () returned 0x0 [0114.670] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xde180, lpOverlapped=0x0) returned 1 [0114.750] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xde190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xde190, lpOverlapped=0x0) returned 1 [0114.908] ReadFile (in: hFile=0x158, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.908] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0114.909] SetEndOfFile (hFile=0x15c) returned 1 [0114.909] CloseHandle (hObject=0x15c) returned 1 [0114.909] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.909] SetEndOfFile (hFile=0x158) returned 1 [0114.916] CloseHandle (hObject=0x158) returned 1 [0114.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll")) returned 1 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString=".doc") returned 4 [0114.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString=".docx") returned 5 [0114.917] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0114.917] lstrlenW (lpString=".pdf") returned 4 [0114.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString=".xls") returned 4 [0114.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString=".xlsx") returned 5 [0114.917] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0114.917] lstrlenW (lpString=".ppt") returned 4 [0114.917] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString=".zip") returned 4 [0114.917] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString=".rar") returned 4 [0114.917] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.917] lstrlenW (lpString=".bz2") returned 4 [0114.917] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.917] lstrlenW (lpString=".7z") returned 3 [0114.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString=".dbf") returned 4 [0114.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString=".1cd") returned 4 [0114.917] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 52 [0114.917] lstrlenW (lpString=".jpg") returned 4 [0114.917] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.918] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") [0115.248] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=59050) returned 1 [0115.248] CloseHandle (hObject=0x1c8) returned 1 [0115.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr")) returned 0x20 [0115.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.249] GetLastError () returned 0x0 [0115.249] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xe6aa, lpOverlapped=0x0) returned 1 [0115.252] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe6b0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe6b0, lpOverlapped=0x0) returned 1 [0115.253] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.253] WriteFile (in: hFile=0x15c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.253] SetEndOfFile (hFile=0x15c) returned 1 [0115.254] CloseHandle (hObject=0x15c) returned 1 [0115.254] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.254] SetEndOfFile (hFile=0x1c8) returned 1 [0115.255] CloseHandle (hObject=0x1c8) returned 1 [0115.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr")) returned 1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.255] lstrlenW (lpString=".doc") returned 4 [0115.255] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0115.255] lstrlenW (lpString=".docx") returned 5 [0115.255] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0115.255] lstrlenW (lpString=".pdf") returned 4 [0115.255] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0115.255] lstrlenW (lpString=".xls") returned 4 [0115.255] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0115.255] lstrlenW (lpString=".xlsx") returned 5 [0115.255] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0115.255] lstrlenW (lpString=".ppt") returned 4 [0115.255] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0115.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.256] lstrlenW (lpString=".zip") returned 4 [0115.256] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0115.256] lstrlenW (lpString=".rar") returned 4 [0115.256] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0115.256] lstrlenW (lpString=".bz2") returned 4 [0115.256] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0115.256] lstrlenW (lpString=".7z") returned 3 [0115.256] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0115.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.256] lstrlenW (lpString=".dbf") returned 4 [0115.256] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0115.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.256] lstrlenW (lpString=".1cd") returned 4 [0115.256] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0115.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 59 [0115.256] lstrlenW (lpString=".jpg") returned 4 [0115.256] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0115.256] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") [0115.362] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7354) returned 1 [0115.362] CloseHandle (hObject=0x1b8) returned 1 [0115.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc")) returned 0x20 [0115.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.362] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.362] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.509] GetLastError () returned 0x0 [0115.509] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1cba, lpOverlapped=0x0) returned 1 [0115.510] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0115.512] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.512] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.512] SetEndOfFile (hFile=0x1c8) returned 1 [0115.512] CloseHandle (hObject=0x1c8) returned 1 [0115.512] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.512] SetEndOfFile (hFile=0x1b8) returned 1 [0115.513] CloseHandle (hObject=0x1b8) returned 1 [0115.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc")) returned 1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.516] lstrlenW (lpString=".doc") returned 4 [0115.516] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.516] lstrlenW (lpString=".docx") returned 5 [0115.516] lstrcmpiW (lpString1=".docx", lpString2="X.POC") returned -1 [0115.516] lstrlenW (lpString=".pdf") returned 4 [0115.516] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.516] lstrlenW (lpString=".xls") returned 4 [0115.516] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.516] lstrlenW (lpString=".xlsx") returned 5 [0115.516] lstrcmpiW (lpString1=".xlsx", lpString2="X.POC") returned -1 [0115.516] lstrlenW (lpString=".ppt") returned 4 [0115.516] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.516] lstrlenW (lpString=".zip") returned 4 [0115.516] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.516] lstrlenW (lpString=".rar") returned 4 [0115.516] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.516] lstrlenW (lpString=".bz2") returned 4 [0115.516] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.516] lstrlenW (lpString=".7z") returned 3 [0115.516] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.517] lstrlenW (lpString=".dbf") returned 4 [0115.517] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.517] lstrlenW (lpString=".1cd") returned 4 [0115.517] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 61 [0115.517] lstrlenW (lpString=".jpg") returned 4 [0115.517] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.517] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") [0115.518] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=259084) returned 1 [0115.518] CloseHandle (hObject=0x1b8) returned 1 [0115.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv")) returned 0x20 [0115.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.518] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.518] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.519] GetLastError () returned 0x0 [0115.519] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x3f40c, lpOverlapped=0x0) returned 1 [0115.526] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x3f410, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3f410, lpOverlapped=0x0) returned 1 [0115.531] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.531] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.531] SetEndOfFile (hFile=0x1c8) returned 1 [0115.531] CloseHandle (hObject=0x1c8) returned 1 [0115.531] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.531] SetEndOfFile (hFile=0x1b8) returned 1 [0115.533] CloseHandle (hObject=0x1b8) returned 1 [0115.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv")) returned 1 [0115.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.534] lstrlenW (lpString=".doc") returned 4 [0115.534] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.534] lstrlenW (lpString=".docx") returned 5 [0115.534] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0115.534] lstrlenW (lpString=".pdf") returned 4 [0115.534] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.534] lstrlenW (lpString=".xls") returned 4 [0115.534] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.534] lstrlenW (lpString=".xlsx") returned 5 [0115.534] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0115.534] lstrlenW (lpString=".ppt") returned 4 [0115.534] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.534] lstrlenW (lpString=".zip") returned 4 [0115.534] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.534] lstrlenW (lpString=".rar") returned 4 [0115.534] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.534] lstrlenW (lpString=".bz2") returned 4 [0115.534] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.534] lstrlenW (lpString=".7z") returned 3 [0115.534] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.534] lstrlenW (lpString=".dbf") returned 4 [0115.534] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.534] lstrlenW (lpString=".1cd") returned 4 [0115.535] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 61 [0115.535] lstrlenW (lpString=".jpg") returned 4 [0115.535] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.535] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") [0115.535] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1801918) returned 1 [0115.535] CloseHandle (hObject=0x1b8) returned 1 [0115.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv")) returned 0x20 [0115.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0115.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.537] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0115.537] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0115.537] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.540] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x92a3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0115.540] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.546] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0115.546] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x177ebe, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0115.546] ReadFile (in: hFile=0x1b8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.561] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.561] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0115.587] SetEndOfFile (hFile=0x1b8) returned 1 [0115.587] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0115.587] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0115.587] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0115.589] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x92a3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0115.589] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0115.591] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x177ebe, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0115.591] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0115.844] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0115.844] CloseHandle (hObject=0x1b8) returned 1 [0115.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.894] lstrlenW (lpString=".doc") returned 4 [0115.894] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.894] lstrlenW (lpString=".docx") returned 5 [0115.894] lstrcmpiW (lpString1=".docx", lpString2="M.DPV") returned -1 [0115.894] lstrlenW (lpString=".pdf") returned 4 [0115.894] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.894] lstrlenW (lpString=".xls") returned 4 [0115.894] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.894] lstrlenW (lpString=".xlsx") returned 5 [0115.894] lstrcmpiW (lpString1=".xlsx", lpString2="M.DPV") returned -1 [0115.894] lstrlenW (lpString=".ppt") returned 4 [0115.895] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.895] lstrlenW (lpString=".zip") returned 4 [0115.895] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.895] lstrlenW (lpString=".rar") returned 4 [0115.895] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.895] lstrlenW (lpString=".bz2") returned 4 [0115.895] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.895] lstrlenW (lpString=".7z") returned 3 [0115.895] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.895] lstrlenW (lpString=".dbf") returned 4 [0115.895] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.895] lstrlenW (lpString=".1cd") returned 4 [0115.895] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 61 [0115.895] lstrlenW (lpString=".jpg") returned 4 [0115.895] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.895] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") [0115.896] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2598) returned 1 [0115.896] CloseHandle (hObject=0x210) returned 1 [0115.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc")) returned 0x20 [0115.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0115.896] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.896] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.897] GetLastError () returned 0x0 [0115.897] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xa26, lpOverlapped=0x0) returned 1 [0115.998] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0115.999] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.999] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.999] SetEndOfFile (hFile=0x1fc) returned 1 [0115.999] CloseHandle (hObject=0x1fc) returned 1 [0115.999] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.999] SetEndOfFile (hFile=0x210) returned 1 [0116.000] CloseHandle (hObject=0x210) returned 1 [0116.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc")) returned 1 [0116.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.000] lstrlenW (lpString=".doc") returned 4 [0116.000] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.000] lstrlenW (lpString=".docx") returned 5 [0116.000] lstrcmpiW (lpString1=".docx", lpString2="S.POC") returned -1 [0116.000] lstrlenW (lpString=".pdf") returned 4 [0116.000] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.000] lstrlenW (lpString=".xls") returned 4 [0116.000] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.000] lstrlenW (lpString=".xlsx") returned 5 [0116.001] lstrcmpiW (lpString1=".xlsx", lpString2="S.POC") returned -1 [0116.001] lstrlenW (lpString=".ppt") returned 4 [0116.001] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.001] lstrlenW (lpString=".zip") returned 4 [0116.001] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.001] lstrlenW (lpString=".rar") returned 4 [0116.001] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.001] lstrlenW (lpString=".bz2") returned 4 [0116.001] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.001] lstrlenW (lpString=".7z") returned 3 [0116.001] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.001] lstrlenW (lpString=".dbf") returned 4 [0116.001] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.001] lstrlenW (lpString=".1cd") returned 4 [0116.001] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 62 [0116.001] lstrlenW (lpString=".jpg") returned 4 [0116.001] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.001] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") [0116.058] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=76842) returned 1 [0116.058] CloseHandle (hObject=0x210) returned 1 [0116.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc")) returned 0x20 [0116.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.069] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.069] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.173] GetLastError () returned 0x0 [0116.177] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x12c2a, lpOverlapped=0x0) returned 1 [0116.212] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x12c30, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x12c30, lpOverlapped=0x0) returned 1 [0116.214] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.214] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.214] SetEndOfFile (hFile=0x1fc) returned 1 [0116.214] CloseHandle (hObject=0x1fc) returned 1 [0116.214] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.214] SetEndOfFile (hFile=0x210) returned 1 [0116.216] CloseHandle (hObject=0x210) returned 1 [0116.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc")) returned 1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString=".doc") returned 4 [0116.217] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.217] lstrlenW (lpString=".docx") returned 5 [0116.217] lstrcmpiW (lpString1=".docx", lpString2="1.POC") returned -1 [0116.217] lstrlenW (lpString=".pdf") returned 4 [0116.217] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.217] lstrlenW (lpString=".xls") returned 4 [0116.217] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.217] lstrlenW (lpString=".xlsx") returned 5 [0116.217] lstrcmpiW (lpString1=".xlsx", lpString2="1.POC") returned -1 [0116.217] lstrlenW (lpString=".ppt") returned 4 [0116.217] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString=".zip") returned 4 [0116.217] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.217] lstrlenW (lpString=".rar") returned 4 [0116.217] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.217] lstrlenW (lpString=".bz2") returned 4 [0116.217] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.217] lstrlenW (lpString=".7z") returned 3 [0116.217] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString=".dbf") returned 4 [0116.217] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString=".1cd") returned 4 [0116.217] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 62 [0116.217] lstrlenW (lpString=".jpg") returned 4 [0116.218] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.218] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") [0116.219] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1732002) returned 1 [0116.219] CloseHandle (hObject=0x210) returned 1 [0116.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc")) returned 0x20 [0116.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0116.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.220] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0x0) returned 1 [0116.220] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0116.220] ReadFile (in: hFile=0x210, lpBuffer=0x3a20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a20058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.223] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8cf36, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0116.223] ReadFile (in: hFile=0x210, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.231] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0116.231] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x166da2, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc2c | out: lpNewFilePointer=0x0) returned 1 [0116.231] ReadFile (in: hFile=0x210, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2e6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.430] WriteFile (in: hFile=0x210, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0116.454] SetEndOfFile (hFile=0x210) returned 1 [0116.454] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0116.454] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0116.454] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8cf36, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0116.456] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.458] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x166da2, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fc7c | out: lpNewFilePointer=0x0) returned 1 [0116.458] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e6fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2e6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.460] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0116.460] CloseHandle (hObject=0x210) returned 1 [0116.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.460] lstrlenW (lpString=".doc") returned 4 [0116.460] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.460] lstrlenW (lpString=".docx") returned 5 [0116.460] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0116.460] lstrlenW (lpString=".pdf") returned 4 [0116.460] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.460] lstrlenW (lpString=".xls") returned 4 [0116.460] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.460] lstrlenW (lpString=".xlsx") returned 5 [0116.461] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0116.461] lstrlenW (lpString=".ppt") returned 4 [0116.461] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.461] lstrlenW (lpString=".zip") returned 4 [0116.461] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.461] lstrlenW (lpString=".rar") returned 4 [0116.461] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.461] lstrlenW (lpString=".bz2") returned 4 [0116.461] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.461] lstrlenW (lpString=".7z") returned 3 [0116.461] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.461] lstrlenW (lpString=".dbf") returned 4 [0116.461] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.461] lstrlenW (lpString=".1cd") returned 4 [0116.461] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 62 [0116.461] lstrlenW (lpString=".jpg") returned 4 [0116.461] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.461] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") [0116.502] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=21436) returned 1 [0116.502] CloseHandle (hObject=0x210) returned 1 [0116.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc")) returned 0x20 [0116.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.544] GetLastError () returned 0x0 [0116.544] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x53bc, lpOverlapped=0x0) returned 1 [0116.555] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x53c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x53c0, lpOverlapped=0x0) returned 1 [0116.556] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.556] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.556] SetEndOfFile (hFile=0x19c) returned 1 [0116.556] CloseHandle (hObject=0x19c) returned 1 [0116.556] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.556] SetEndOfFile (hFile=0x210) returned 1 [0116.557] CloseHandle (hObject=0x210) returned 1 [0116.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc")) returned 1 [0116.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.557] lstrlenW (lpString=".doc") returned 4 [0116.557] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.558] lstrlenW (lpString=".docx") returned 5 [0116.558] lstrcmpiW (lpString1=".docx", lpString2="P.POC") returned -1 [0116.558] lstrlenW (lpString=".pdf") returned 4 [0116.558] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.558] lstrlenW (lpString=".xls") returned 4 [0116.558] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.558] lstrlenW (lpString=".xlsx") returned 5 [0116.558] lstrcmpiW (lpString1=".xlsx", lpString2="P.POC") returned -1 [0116.558] lstrlenW (lpString=".ppt") returned 4 [0116.558] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.558] lstrlenW (lpString=".zip") returned 4 [0116.558] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.558] lstrlenW (lpString=".rar") returned 4 [0116.558] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.558] lstrlenW (lpString=".bz2") returned 4 [0116.558] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.558] lstrlenW (lpString=".7z") returned 3 [0116.558] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.558] lstrlenW (lpString=".dbf") returned 4 [0116.558] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.558] lstrlenW (lpString=".1cd") returned 4 [0116.558] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 62 [0116.558] lstrlenW (lpString=".jpg") returned 4 [0116.559] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.559] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") [0116.560] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=50834) returned 1 [0116.560] CloseHandle (hObject=0x210) returned 1 [0116.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc")) returned 0x20 [0116.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.560] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.560] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.561] GetLastError () returned 0x0 [0116.561] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0xc692, lpOverlapped=0x0) returned 1 [0116.570] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0116.572] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.572] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.572] SetEndOfFile (hFile=0x19c) returned 1 [0116.572] CloseHandle (hObject=0x19c) returned 1 [0116.572] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.572] SetEndOfFile (hFile=0x210) returned 1 [0116.573] CloseHandle (hObject=0x210) returned 1 [0116.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc")) returned 1 [0116.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.574] lstrlenW (lpString=".doc") returned 4 [0116.574] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.574] lstrlenW (lpString=".docx") returned 5 [0116.574] lstrcmpiW (lpString1=".docx", lpString2="N.POC") returned -1 [0116.574] lstrlenW (lpString=".pdf") returned 4 [0116.574] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.574] lstrlenW (lpString=".xls") returned 4 [0116.575] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.575] lstrlenW (lpString=".xlsx") returned 5 [0116.575] lstrcmpiW (lpString1=".xlsx", lpString2="N.POC") returned -1 [0116.575] lstrlenW (lpString=".ppt") returned 4 [0116.575] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.575] lstrlenW (lpString=".zip") returned 4 [0116.575] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.575] lstrlenW (lpString=".rar") returned 4 [0116.575] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.575] lstrlenW (lpString=".bz2") returned 4 [0116.575] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.575] lstrlenW (lpString=".7z") returned 3 [0116.575] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.575] lstrlenW (lpString=".dbf") returned 4 [0116.575] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.575] lstrlenW (lpString=".1cd") returned 4 [0116.575] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 60 [0116.575] lstrlenW (lpString=".jpg") returned 4 [0116.575] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.575] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") [0116.576] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4608) returned 1 [0116.576] CloseHandle (hObject=0x210) returned 1 [0116.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv")) returned 0x20 [0116.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.576] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.576] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.577] GetLastError () returned 0x0 [0116.577] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x1200, lpOverlapped=0x0) returned 1 [0116.586] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0116.587] ReadFile (in: hFile=0x210, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.587] WriteFile (in: hFile=0x19c, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.587] SetEndOfFile (hFile=0x19c) returned 1 [0116.587] CloseHandle (hObject=0x19c) returned 1 [0116.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.587] SetEndOfFile (hFile=0x210) returned 1 [0116.588] CloseHandle (hObject=0x210) returned 1 [0116.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv")) returned 1 [0116.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.591] lstrlenW (lpString=".doc") returned 4 [0116.591] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.591] lstrlenW (lpString=".docx") returned 5 [0116.591] lstrcmpiW (lpString1=".docx", lpString2="X.DPV") returned -1 [0116.591] lstrlenW (lpString=".pdf") returned 4 [0116.591] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.591] lstrlenW (lpString=".xls") returned 4 [0116.591] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.591] lstrlenW (lpString=".xlsx") returned 5 [0116.591] lstrcmpiW (lpString1=".xlsx", lpString2="X.DPV") returned -1 [0116.591] lstrlenW (lpString=".ppt") returned 4 [0116.591] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.592] lstrlenW (lpString=".zip") returned 4 [0116.592] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.592] lstrlenW (lpString=".rar") returned 4 [0116.592] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.592] lstrlenW (lpString=".bz2") returned 4 [0116.592] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.592] lstrlenW (lpString=".7z") returned 3 [0116.592] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.592] lstrlenW (lpString=".dbf") returned 4 [0116.592] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.592] lstrlenW (lpString=".1cd") returned 4 [0116.592] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 62 [0116.592] lstrlenW (lpString=".jpg") returned 4 [0116.592] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.592] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") [0116.768] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=21097) returned 1 [0116.768] CloseHandle (hObject=0x168) returned 1 [0116.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv")) returned 0x20 [0116.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0116.768] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.768] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0116.773] GetLastError () returned 0x0 [0116.773] ReadFile (in: hFile=0x168, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x5269, lpOverlapped=0x0) returned 1 [0117.177] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0117.178] ReadFile (in: hFile=0x168, lpBuffer=0x3a20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.178] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a20020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.178] SetEndOfFile (hFile=0x1a0) returned 1 [0117.412] CloseHandle (hObject=0x1a0) returned 1 [0117.412] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.414] SetEndOfFile (hFile=0x168) returned 1 [0117.425] CloseHandle (hObject=0x168) returned 1 [0117.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv")) returned 1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.846] lstrlenW (lpString=".doc") returned 4 [0117.846] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.846] lstrlenW (lpString=".docx") returned 5 [0117.846] lstrcmpiW (lpString1=".docx", lpString2="T.DPV") returned -1 [0117.846] lstrlenW (lpString=".pdf") returned 4 [0117.846] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.846] lstrlenW (lpString=".xls") returned 4 [0117.846] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.846] lstrlenW (lpString=".xlsx") returned 5 [0117.846] lstrcmpiW (lpString1=".xlsx", lpString2="T.DPV") returned -1 [0117.846] lstrlenW (lpString=".ppt") returned 4 [0117.847] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.847] lstrlenW (lpString=".zip") returned 4 [0117.847] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.847] lstrlenW (lpString=".rar") returned 4 [0117.847] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.847] lstrlenW (lpString=".bz2") returned 4 [0117.847] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.847] lstrlenW (lpString=".7z") returned 3 [0117.847] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.847] lstrlenW (lpString=".dbf") returned 4 [0117.847] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.847] lstrlenW (lpString=".1cd") returned 4 [0117.847] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 62 [0117.847] lstrlenW (lpString=".jpg") returned 4 [0117.847] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.847] RtlInitUnicodeStringEx (DestinationString=0x2e6fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC") Thread: id = 14 os_tid = 0x9d4 [0033.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3750280 [0033.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3760288 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411e0 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6416b0 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6411f8 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3b30020 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641210 [0033.721] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641210, Size=0x20) returned 0x629f48 [0033.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641210 [0033.721] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641210, Size=0x20) returned 0x629f70 [0033.721] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.721] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.721] Wow64DisableWow64FsRedirection (in: OldValue=0x2faff58 | out: OldValue=0x2faff58*=0x0) returned 1 [0033.721] lstrlenW (lpString="kernel32.dll") returned 12 [0033.721] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.721] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.721] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.722] Sleep (dwMilliseconds=0x64) [0033.916] lstrcmpiW (lpString1=".BAK", lpString2=".zoh") returned -1 [0033.916] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.916] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.123] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8192) returned 1 [0034.123] CloseHandle (hObject=0x168) returned 1 [0034.123] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0034.123] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\bootsect.bak.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.123] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0034.124] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.124] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.124] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.124] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\bootsect.bak.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.124] GetLastError () returned 0x0 [0034.124] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2000, lpOverlapped=0x0) returned 1 [0034.146] WriteFile (in: hFile=0x178, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2010, lpOverlapped=0x0) returned 1 [0034.147] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0034.147] WriteFile (in: hFile=0x178, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.147] SetEndOfFile (hFile=0x178) returned 1 [0034.148] CloseHandle (hObject=0x178) returned 1 [0034.148] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.148] SetEndOfFile (hFile=0x168) returned 1 [0034.149] CloseHandle (hObject=0x168) returned 1 [0034.149] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x27) returned 1 [0034.150] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0034.150] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.150] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.150] lstrlenW (lpString=".doc") returned 4 [0034.150] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".docx") returned 5 [0034.150] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.150] lstrlenW (lpString=".pdf") returned 4 [0034.150] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".xls") returned 4 [0034.150] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".xlsx") returned 5 [0034.150] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.150] lstrlenW (lpString=".ppt") returned 4 [0034.150] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.150] lstrlenW (lpString=".zip") returned 4 [0034.150] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".rar") returned 4 [0034.150] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".bz2") returned 4 [0034.150] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.150] lstrlenW (lpString=".7z") returned 3 [0034.150] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.150] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.150] lstrlenW (lpString=".dbf") returned 4 [0034.151] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString=".1cd") returned 4 [0034.151] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString=".jpg") returned 4 [0034.151] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString=".doc") returned 4 [0034.151] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".docx") returned 5 [0034.151] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.151] lstrlenW (lpString=".pdf") returned 4 [0034.151] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".xls") returned 4 [0034.151] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".xlsx") returned 5 [0034.151] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.151] lstrlenW (lpString=".ppt") returned 4 [0034.151] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString=".zip") returned 4 [0034.151] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".rar") returned 4 [0034.151] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".bz2") returned 4 [0034.151] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.151] lstrlenW (lpString=".7z") returned 3 [0034.151] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.151] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.151] lstrlenW (lpString=".dbf") returned 4 [0034.151] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.152] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.152] lstrlenW (lpString=".1cd") returned 4 [0034.152] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.152] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.152] lstrlenW (lpString=".jpg") returned 4 [0034.152] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.152] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.152] lstrlenW (lpString="Setup.xml") returned 9 [0034.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.152] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2424) returned 1 [0034.152] CloseHandle (hObject=0x168) returned 1 [0034.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.152] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.153] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.638] GetLastError () returned 0x0 [0034.638] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x978, lpOverlapped=0x0) returned 1 [0034.657] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x980, lpOverlapped=0x0) returned 1 [0034.657] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0034.658] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.658] SetEndOfFile (hFile=0x1a4) returned 1 [0034.658] CloseHandle (hObject=0x1a4) returned 1 [0034.659] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.659] SetEndOfFile (hFile=0x168) returned 1 [0034.660] CloseHandle (hObject=0x168) returned 1 [0034.660] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.660] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString=".doc") returned 4 [0034.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".docx") returned 5 [0034.660] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.660] lstrlenW (lpString=".pdf") returned 4 [0034.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".xls") returned 4 [0034.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".xlsx") returned 5 [0034.660] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.660] lstrlenW (lpString=".ppt") returned 4 [0034.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString=".zip") returned 4 [0034.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.661] lstrlenW (lpString=".rar") returned 4 [0034.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString=".bz2") returned 4 [0034.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString=".7z") returned 3 [0034.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString=".dbf") returned 4 [0034.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString=".1cd") returned 4 [0034.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString=".jpg") returned 4 [0034.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.661] lstrlenW (lpString=".doc") returned 4 [0034.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString=".docx") returned 5 [0034.661] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.661] lstrlenW (lpString=".pdf") returned 4 [0034.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString=".xls") returned 4 [0034.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.661] lstrlenW (lpString=".xlsx") returned 5 [0034.661] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.661] lstrlenW (lpString=".ppt") returned 4 [0034.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.662] lstrlenW (lpString=".zip") returned 4 [0034.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.662] lstrlenW (lpString=".rar") returned 4 [0034.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.662] lstrlenW (lpString=".bz2") returned 4 [0034.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.662] lstrlenW (lpString=".7z") returned 3 [0034.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.662] lstrlenW (lpString=".dbf") returned 4 [0034.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.662] lstrlenW (lpString=".1cd") returned 4 [0034.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.662] lstrlenW (lpString=".jpg") returned 4 [0034.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.662] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.662] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0034.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.663] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1606) returned 1 [0034.663] CloseHandle (hObject=0x168) returned 1 [0034.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0034.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0034.663] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.663] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0034.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.664] GetLastError () returned 0x0 [0034.664] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x646, lpOverlapped=0x0) returned 1 [0035.445] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x650, lpOverlapped=0x0) returned 1 [0035.446] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0035.446] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.446] SetEndOfFile (hFile=0x1a4) returned 1 [0035.446] CloseHandle (hObject=0x1a4) returned 1 [0035.447] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.447] SetEndOfFile (hFile=0x168) returned 1 [0035.448] CloseHandle (hObject=0x168) returned 1 [0035.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.448] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0035.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString=".doc") returned 4 [0035.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString=".docx") returned 5 [0035.450] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.450] lstrlenW (lpString=".pdf") returned 4 [0035.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString=".xls") returned 4 [0035.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString=".xlsx") returned 5 [0035.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.450] lstrlenW (lpString=".ppt") returned 4 [0035.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString=".zip") returned 4 [0035.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.450] lstrlenW (lpString=".rar") returned 4 [0035.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString=".bz2") returned 4 [0035.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString=".7z") returned 3 [0035.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString=".dbf") returned 4 [0035.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString=".1cd") returned 4 [0035.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString=".jpg") returned 4 [0035.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.451] lstrlenW (lpString=".doc") returned 4 [0035.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString=".docx") returned 5 [0035.451] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.451] lstrlenW (lpString=".pdf") returned 4 [0035.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString=".xls") returned 4 [0035.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString=".xlsx") returned 5 [0035.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.451] lstrlenW (lpString=".ppt") returned 4 [0035.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.451] lstrlenW (lpString=".zip") returned 4 [0035.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.451] lstrlenW (lpString=".rar") returned 4 [0035.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString=".bz2") returned 4 [0035.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString=".7z") returned 3 [0035.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.451] lstrlenW (lpString=".dbf") returned 4 [0035.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.451] lstrlenW (lpString=".1cd") returned 4 [0035.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0035.451] lstrlenW (lpString=".jpg") returned 4 [0035.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.452] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.452] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0035.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.453] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=913) returned 1 [0035.453] CloseHandle (hObject=0x168) returned 1 [0035.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0035.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.453] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.453] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.454] GetLastError () returned 0x0 [0035.454] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x391, lpOverlapped=0x0) returned 1 [0035.464] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0035.465] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0035.465] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.465] SetEndOfFile (hFile=0x1a4) returned 1 [0035.465] CloseHandle (hObject=0x1a4) returned 1 [0035.466] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.466] SetEndOfFile (hFile=0x168) returned 1 [0035.467] CloseHandle (hObject=0x168) returned 1 [0035.467] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.467] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0035.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.467] lstrlenW (lpString=".doc") returned 4 [0035.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.467] lstrlenW (lpString=".docx") returned 5 [0035.467] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.467] lstrlenW (lpString=".pdf") returned 4 [0035.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.467] lstrlenW (lpString=".xls") returned 4 [0035.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.467] lstrlenW (lpString=".xlsx") returned 5 [0035.467] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.467] lstrlenW (lpString=".ppt") returned 4 [0035.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.467] lstrlenW (lpString=".zip") returned 4 [0035.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.468] lstrlenW (lpString=".rar") returned 4 [0035.468] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString=".bz2") returned 4 [0035.468] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString=".7z") returned 3 [0035.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString=".dbf") returned 4 [0035.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString=".1cd") returned 4 [0035.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString=".jpg") returned 4 [0035.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString=".doc") returned 4 [0035.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString=".docx") returned 5 [0035.468] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.468] lstrlenW (lpString=".pdf") returned 4 [0035.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString=".xls") returned 4 [0035.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString=".xlsx") returned 5 [0035.468] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.468] lstrlenW (lpString=".ppt") returned 4 [0035.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.468] lstrlenW (lpString=".zip") returned 4 [0035.468] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.468] lstrlenW (lpString=".rar") returned 4 [0035.468] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.469] lstrlenW (lpString=".bz2") returned 4 [0035.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.469] lstrlenW (lpString=".7z") returned 3 [0035.469] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.469] lstrlenW (lpString=".dbf") returned 4 [0035.469] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.469] lstrlenW (lpString=".1cd") returned 4 [0035.469] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.469] lstrlenW (lpString=".jpg") returned 4 [0035.469] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.469] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.469] lstrlenW (lpString="Setup.xml") returned 9 [0035.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.481] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1452) returned 1 [0035.481] CloseHandle (hObject=0x168) returned 1 [0035.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.481] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.481] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.481] GetLastError () returned 0x0 [0035.481] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.500] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.502] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0035.502] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.502] SetEndOfFile (hFile=0x1a4) returned 1 [0035.502] CloseHandle (hObject=0x1a4) returned 1 [0035.502] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.502] SetEndOfFile (hFile=0x168) returned 1 [0035.503] CloseHandle (hObject=0x168) returned 1 [0035.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.503] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.504] lstrlenW (lpString=".doc") returned 4 [0035.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString=".docx") returned 5 [0035.504] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.504] lstrlenW (lpString=".pdf") returned 4 [0035.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString=".xls") returned 4 [0035.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString=".xlsx") returned 5 [0035.504] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.504] lstrlenW (lpString=".ppt") returned 4 [0035.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.504] lstrlenW (lpString=".zip") returned 4 [0035.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.504] lstrlenW (lpString=".rar") returned 4 [0035.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString=".bz2") returned 4 [0035.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.504] lstrlenW (lpString=".7z") returned 3 [0035.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".dbf") returned 4 [0035.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".1cd") returned 4 [0035.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".jpg") returned 4 [0035.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".doc") returned 4 [0035.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString=".docx") returned 5 [0035.505] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.505] lstrlenW (lpString=".pdf") returned 4 [0035.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString=".xls") returned 4 [0035.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString=".xlsx") returned 5 [0035.505] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.505] lstrlenW (lpString=".ppt") returned 4 [0035.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".zip") returned 4 [0035.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.505] lstrlenW (lpString=".rar") returned 4 [0035.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString=".bz2") returned 4 [0035.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.505] lstrlenW (lpString=".7z") returned 3 [0035.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.505] lstrlenW (lpString=".dbf") returned 4 [0035.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.506] lstrlenW (lpString=".1cd") returned 4 [0035.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.506] lstrlenW (lpString=".jpg") returned 4 [0035.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.506] lstrcmpiW (lpString1=".chm", lpString2=".zoh") returned -1 [0035.506] lstrlenW (lpString="pss10r.chm") returned 10 [0035.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0035.844] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27195) returned 1 [0035.844] CloseHandle (hObject=0x1b0) returned 1 [0035.844] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0035.844] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0035.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0035.845] GetLastError () returned 0x0 [0035.845] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0036.166] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0036.167] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0036.167] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0036.167] SetEndOfFile (hFile=0x1b4) returned 1 [0036.167] CloseHandle (hObject=0x1b4) returned 1 [0036.168] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.168] SetEndOfFile (hFile=0x1b0) returned 1 [0036.169] CloseHandle (hObject=0x1b0) returned 1 [0036.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.169] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.170] lstrlenW (lpString=".doc") returned 4 [0036.170] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString=".docx") returned 5 [0036.170] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0036.170] lstrlenW (lpString=".pdf") returned 4 [0036.170] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString=".xls") returned 4 [0036.170] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString=".xlsx") returned 5 [0036.170] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0036.170] lstrlenW (lpString=".ppt") returned 4 [0036.170] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.170] lstrlenW (lpString=".zip") returned 4 [0036.170] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString=".rar") returned 4 [0036.170] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString=".bz2") returned 4 [0036.170] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0036.170] lstrlenW (lpString=".7z") returned 3 [0036.170] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.170] lstrlenW (lpString=".dbf") returned 4 [0036.170] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.170] lstrlenW (lpString=".1cd") returned 4 [0036.170] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0036.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.171] lstrlenW (lpString=".jpg") returned 4 [0036.171] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.171] lstrlenW (lpString=".doc") returned 4 [0036.171] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString=".docx") returned 5 [0036.171] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0036.171] lstrlenW (lpString=".pdf") returned 4 [0036.171] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString=".xls") returned 4 [0036.171] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString=".xlsx") returned 5 [0036.171] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0036.171] lstrlenW (lpString=".ppt") returned 4 [0036.171] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.171] lstrlenW (lpString=".zip") returned 4 [0036.171] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString=".rar") returned 4 [0036.171] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString=".bz2") returned 4 [0036.171] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0036.171] lstrlenW (lpString=".7z") returned 3 [0036.171] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0036.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.171] lstrlenW (lpString=".dbf") returned 4 [0036.171] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0036.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.172] lstrlenW (lpString=".1cd") returned 4 [0036.172] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0036.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.172] lstrlenW (lpString=".jpg") returned 4 [0036.172] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0036.172] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.172] lstrlenW (lpString="Setup.xml") returned 9 [0036.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.580] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31094) returned 1 [0036.580] CloseHandle (hObject=0x1a4) returned 1 [0036.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.589] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.589] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0036.599] GetLastError () returned 0x0 [0036.599] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7976, lpOverlapped=0x0) returned 1 [0036.618] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7980, lpOverlapped=0x0) returned 1 [0036.620] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0036.620] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.620] SetEndOfFile (hFile=0x170) returned 1 [0036.620] CloseHandle (hObject=0x170) returned 1 [0036.621] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.621] SetEndOfFile (hFile=0x1a4) returned 1 [0036.622] CloseHandle (hObject=0x1a4) returned 1 [0036.622] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.622] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.623] lstrlenW (lpString=".doc") returned 4 [0036.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString=".docx") returned 5 [0036.623] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.623] lstrlenW (lpString=".pdf") returned 4 [0036.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString=".xls") returned 4 [0036.623] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString=".xlsx") returned 5 [0036.623] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.623] lstrlenW (lpString=".ppt") returned 4 [0036.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.623] lstrlenW (lpString=".zip") returned 4 [0036.623] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.623] lstrlenW (lpString=".rar") returned 4 [0036.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString=".bz2") returned 4 [0036.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString=".7z") returned 3 [0036.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.623] lstrlenW (lpString=".dbf") returned 4 [0036.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.623] lstrlenW (lpString=".1cd") returned 4 [0036.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.624] lstrlenW (lpString=".jpg") returned 4 [0036.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.624] lstrlenW (lpString=".doc") returned 4 [0036.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString=".docx") returned 5 [0036.624] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.624] lstrlenW (lpString=".pdf") returned 4 [0036.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString=".xls") returned 4 [0036.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString=".xlsx") returned 5 [0036.624] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.624] lstrlenW (lpString=".ppt") returned 4 [0036.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.624] lstrlenW (lpString=".zip") returned 4 [0036.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.624] lstrlenW (lpString=".rar") returned 4 [0036.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString=".bz2") returned 4 [0036.624] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.624] lstrlenW (lpString=".7z") returned 3 [0036.624] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.624] lstrlenW (lpString=".dbf") returned 4 [0036.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.625] lstrlenW (lpString=".1cd") returned 4 [0036.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.625] lstrlenW (lpString=".jpg") returned 4 [0036.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.625] lstrcmpiW (lpString1=".JPG", lpString2=".zoh") returned -1 [0036.625] lstrlenW (lpString="MS.JPG") returned 6 [0036.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.626] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1061) returned 1 [0036.626] CloseHandle (hObject=0x1a4) returned 1 [0036.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0036.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.626] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.626] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0036.626] GetLastError () returned 0x0 [0036.626] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x425, lpOverlapped=0x0) returned 1 [0036.628] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x430, lpOverlapped=0x0) returned 1 [0036.629] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0036.629] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.629] SetEndOfFile (hFile=0x170) returned 1 [0036.629] CloseHandle (hObject=0x170) returned 1 [0036.630] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.630] SetEndOfFile (hFile=0x1a4) returned 1 [0036.631] CloseHandle (hObject=0x1a4) returned 1 [0036.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0036.631] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0036.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.631] lstrlenW (lpString=".doc") returned 4 [0036.631] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.631] lstrlenW (lpString=".docx") returned 5 [0036.631] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.631] lstrlenW (lpString=".pdf") returned 4 [0036.631] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.631] lstrlenW (lpString=".xls") returned 4 [0036.631] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.632] lstrlenW (lpString=".xlsx") returned 5 [0036.632] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.632] lstrlenW (lpString=".ppt") returned 4 [0036.632] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString=".zip") returned 4 [0036.632] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.632] lstrlenW (lpString=".rar") returned 4 [0036.632] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.632] lstrlenW (lpString=".bz2") returned 4 [0036.632] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.632] lstrlenW (lpString=".7z") returned 3 [0036.632] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString=".dbf") returned 4 [0036.632] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString=".1cd") returned 4 [0036.632] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString=".jpg") returned 4 [0036.632] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.632] lstrlenW (lpString=".doc") returned 4 [0036.632] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.632] lstrlenW (lpString=".docx") returned 5 [0036.632] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.632] lstrlenW (lpString=".pdf") returned 4 [0036.632] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.632] lstrlenW (lpString=".xls") returned 4 [0036.633] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.633] lstrlenW (lpString=".xlsx") returned 5 [0036.633] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.633] lstrlenW (lpString=".ppt") returned 4 [0036.633] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.633] lstrlenW (lpString=".zip") returned 4 [0036.633] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.633] lstrlenW (lpString=".rar") returned 4 [0036.633] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.633] lstrlenW (lpString=".bz2") returned 4 [0036.633] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.633] lstrlenW (lpString=".7z") returned 3 [0036.633] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.633] lstrlenW (lpString=".dbf") returned 4 [0036.633] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.633] lstrlenW (lpString=".1cd") returned 4 [0036.633] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.633] lstrlenW (lpString=".jpg") returned 4 [0036.633] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.634] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0036.634] lstrlenW (lpString="MS.PNG") returned 6 [0036.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.634] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1682) returned 1 [0036.634] CloseHandle (hObject=0x1a4) returned 1 [0036.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0036.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.635] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.635] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0036.636] GetLastError () returned 0x0 [0036.636] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x692, lpOverlapped=0x0) returned 1 [0036.637] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0036.638] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0036.638] WriteFile (in: hFile=0x170, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.638] SetEndOfFile (hFile=0x170) returned 1 [0036.638] CloseHandle (hObject=0x170) returned 1 [0036.639] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.639] SetEndOfFile (hFile=0x1a4) returned 1 [0036.640] CloseHandle (hObject=0x1a4) returned 1 [0036.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0036.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.641] lstrlenW (lpString=".doc") returned 4 [0036.641] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.641] lstrlenW (lpString=".docx") returned 5 [0036.641] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.641] lstrlenW (lpString=".pdf") returned 4 [0036.641] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.641] lstrlenW (lpString=".xls") returned 4 [0036.641] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.641] lstrlenW (lpString=".xlsx") returned 5 [0036.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.641] lstrlenW (lpString=".ppt") returned 4 [0036.641] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.641] lstrlenW (lpString=".zip") returned 4 [0036.641] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.641] lstrlenW (lpString=".rar") returned 4 [0036.641] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.641] lstrlenW (lpString=".bz2") returned 4 [0036.641] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.641] lstrlenW (lpString=".7z") returned 3 [0036.641] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString=".dbf") returned 4 [0036.642] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString=".1cd") returned 4 [0036.642] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString=".jpg") returned 4 [0036.642] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString=".doc") returned 4 [0036.642] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString=".docx") returned 5 [0036.642] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.642] lstrlenW (lpString=".pdf") returned 4 [0036.642] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString=".xls") returned 4 [0036.642] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.642] lstrlenW (lpString=".xlsx") returned 5 [0036.642] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.642] lstrlenW (lpString=".ppt") returned 4 [0036.642] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.642] lstrlenW (lpString=".zip") returned 4 [0036.642] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.642] lstrlenW (lpString=".rar") returned 4 [0036.642] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.642] lstrlenW (lpString=".bz2") returned 4 [0036.642] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.642] lstrlenW (lpString=".7z") returned 3 [0036.642] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.643] lstrlenW (lpString=".dbf") returned 4 [0036.643] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.643] lstrlenW (lpString=".1cd") returned 4 [0036.643] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.643] lstrlenW (lpString=".jpg") returned 4 [0036.643] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.643] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.643] lstrlenW (lpString="Alphabet.xml") returned 12 [0036.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.644] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=791686) returned 1 [0036.644] CloseHandle (hObject=0x1a4) returned 1 [0036.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0036.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.644] lstrlenW (lpString=".doc") returned 4 [0036.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.644] lstrlenW (lpString=".docx") returned 5 [0036.644] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.644] lstrlenW (lpString=".pdf") returned 4 [0036.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.644] lstrlenW (lpString=".xls") returned 4 [0036.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString=".xlsx") returned 5 [0036.645] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.645] lstrlenW (lpString=".ppt") returned 4 [0036.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString=".zip") returned 4 [0036.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.645] lstrlenW (lpString=".rar") returned 4 [0036.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString=".bz2") returned 4 [0036.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString=".7z") returned 3 [0036.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString=".dbf") returned 4 [0036.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString=".1cd") returned 4 [0036.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString=".jpg") returned 4 [0036.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.645] lstrlenW (lpString=".doc") returned 4 [0036.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString=".docx") returned 5 [0036.645] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.645] lstrlenW (lpString=".pdf") returned 4 [0036.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.645] lstrlenW (lpString=".xls") returned 4 [0036.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString=".xlsx") returned 5 [0036.646] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.646] lstrlenW (lpString=".ppt") returned 4 [0036.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.646] lstrlenW (lpString=".zip") returned 4 [0036.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.646] lstrlenW (lpString=".rar") returned 4 [0036.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString=".bz2") returned 4 [0036.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString=".7z") returned 3 [0036.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.646] lstrlenW (lpString=".dbf") returned 4 [0036.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.646] lstrlenW (lpString=".1cd") returned 4 [0036.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.646] lstrlenW (lpString=".jpg") returned 4 [0036.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.646] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0036.646] lstrlenW (lpString="Content.xml") returned 11 [0036.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.647] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27045) returned 1 [0036.647] CloseHandle (hObject=0x1a4) returned 1 [0036.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0036.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.647] lstrlenW (lpString=".doc") returned 4 [0036.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".docx") returned 5 [0036.647] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.647] lstrlenW (lpString=".pdf") returned 4 [0036.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".xls") returned 4 [0036.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".xlsx") returned 5 [0036.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.647] lstrlenW (lpString=".ppt") returned 4 [0036.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString=".zip") returned 4 [0036.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.648] lstrlenW (lpString=".rar") returned 4 [0036.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".bz2") returned 4 [0036.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".7z") returned 3 [0036.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString=".dbf") returned 4 [0036.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString=".1cd") returned 4 [0036.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString=".jpg") returned 4 [0036.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.648] lstrlenW (lpString=".doc") returned 4 [0036.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".docx") returned 5 [0036.648] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.648] lstrlenW (lpString=".pdf") returned 4 [0036.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".xls") returned 4 [0036.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".xlsx") returned 5 [0036.648] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.648] lstrlenW (lpString=".ppt") returned 4 [0036.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.649] lstrlenW (lpString=".zip") returned 4 [0036.649] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.649] lstrlenW (lpString=".rar") returned 4 [0036.649] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString=".bz2") returned 4 [0036.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString=".7z") returned 3 [0036.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.649] lstrlenW (lpString=".dbf") returned 4 [0036.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.649] lstrlenW (lpString=".1cd") returned 4 [0036.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.649] lstrlenW (lpString=".jpg") returned 4 [0036.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.649] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0036.649] lstrlenW (lpString="boxed-correct.avi") returned 17 [0036.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.685] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=89600) returned 1 [0037.685] CloseHandle (hObject=0x188) returned 1 [0037.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0037.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString=".doc") returned 4 [0037.686] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".docx") returned 5 [0037.686] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.686] lstrlenW (lpString=".pdf") returned 4 [0037.686] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".xls") returned 4 [0037.686] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".xlsx") returned 5 [0037.686] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.686] lstrlenW (lpString=".ppt") returned 4 [0037.686] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString=".zip") returned 4 [0037.686] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".rar") returned 4 [0037.686] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".bz2") returned 4 [0037.686] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString=".7z") returned 3 [0037.686] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString=".dbf") returned 4 [0037.686] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString=".1cd") returned 4 [0037.686] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.686] lstrlenW (lpString=".jpg") returned 4 [0037.686] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString=".doc") returned 4 [0037.687] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".docx") returned 5 [0037.687] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.687] lstrlenW (lpString=".pdf") returned 4 [0037.687] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".xls") returned 4 [0037.687] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".xlsx") returned 5 [0037.687] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.687] lstrlenW (lpString=".ppt") returned 4 [0037.687] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString=".zip") returned 4 [0037.687] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".rar") returned 4 [0037.687] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".bz2") returned 4 [0037.687] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString=".7z") returned 3 [0037.687] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString=".dbf") returned 4 [0037.687] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString=".1cd") returned 4 [0037.687] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.687] lstrlenW (lpString=".jpg") returned 4 [0037.687] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.688] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.688] lstrlenW (lpString="symbase.xml") returned 11 [0037.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0038.112] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2764) returned 1 [0038.112] CloseHandle (hObject=0x16c) returned 1 [0038.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0038.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.113] lstrlenW (lpString=".doc") returned 4 [0038.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".docx") returned 5 [0038.113] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0038.113] lstrlenW (lpString=".pdf") returned 4 [0038.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".xls") returned 4 [0038.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".xlsx") returned 5 [0038.113] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0038.113] lstrlenW (lpString=".ppt") returned 4 [0038.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.113] lstrlenW (lpString=".zip") returned 4 [0038.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.113] lstrlenW (lpString=".rar") returned 4 [0038.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".bz2") returned 4 [0038.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".7z") returned 3 [0038.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.113] lstrlenW (lpString=".dbf") returned 4 [0038.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.113] lstrlenW (lpString=".1cd") returned 4 [0038.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString=".jpg") returned 4 [0038.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString=".doc") returned 4 [0038.114] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".docx") returned 5 [0038.114] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0038.114] lstrlenW (lpString=".pdf") returned 4 [0038.114] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".xls") returned 4 [0038.114] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".xlsx") returned 5 [0038.114] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0038.114] lstrlenW (lpString=".ppt") returned 4 [0038.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString=".zip") returned 4 [0038.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.114] lstrlenW (lpString=".rar") returned 4 [0038.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".bz2") returned 4 [0038.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".7z") returned 3 [0038.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString=".dbf") returned 4 [0038.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.114] lstrlenW (lpString=".1cd") returned 4 [0038.115] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0038.115] lstrlenW (lpString=".jpg") returned 4 [0038.115] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.115] lstrcmpiW (lpString1=".dat", lpString2=".zoh") returned -1 [0038.115] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0038.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0038.115] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=46624) returned 1 [0038.115] CloseHandle (hObject=0x16c) returned 1 [0038.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0038.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString=".doc") returned 4 [0038.116] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString=".docx") returned 5 [0038.116] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.116] lstrlenW (lpString=".pdf") returned 4 [0038.116] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString=".xls") returned 4 [0038.116] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString=".xlsx") returned 5 [0038.116] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.116] lstrlenW (lpString=".ppt") returned 4 [0038.116] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString=".zip") returned 4 [0038.116] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString=".rar") returned 4 [0038.116] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString=".bz2") returned 4 [0038.116] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.116] lstrlenW (lpString=".7z") returned 3 [0038.116] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString=".dbf") returned 4 [0038.116] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString=".1cd") returned 4 [0038.116] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.116] lstrlenW (lpString=".jpg") returned 4 [0038.116] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString=".doc") returned 4 [0038.117] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString=".docx") returned 5 [0038.117] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.117] lstrlenW (lpString=".pdf") returned 4 [0038.117] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString=".xls") returned 4 [0038.117] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString=".xlsx") returned 5 [0038.117] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.117] lstrlenW (lpString=".ppt") returned 4 [0038.117] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString=".zip") returned 4 [0038.117] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString=".rar") returned 4 [0038.117] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString=".bz2") returned 4 [0038.117] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.117] lstrlenW (lpString=".7z") returned 3 [0038.117] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString=".dbf") returned 4 [0038.117] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString=".1cd") returned 4 [0038.117] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.117] lstrlenW (lpString=".jpg") returned 4 [0038.117] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.118] lstrcmpiW (lpString1=".dat", lpString2=".zoh") returned -1 [0038.118] lstrlenW (lpString="hwrenalm.dat") returned 12 [0038.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.633] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=747280) returned 1 [0039.633] CloseHandle (hObject=0x1c8) returned 1 [0039.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0039.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString=".doc") returned 4 [0039.634] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString=".docx") returned 5 [0039.634] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0039.634] lstrlenW (lpString=".pdf") returned 4 [0039.634] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString=".xls") returned 4 [0039.634] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString=".xlsx") returned 5 [0039.634] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0039.634] lstrlenW (lpString=".ppt") returned 4 [0039.634] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString=".zip") returned 4 [0039.634] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString=".rar") returned 4 [0039.634] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString=".bz2") returned 4 [0039.634] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.634] lstrlenW (lpString=".7z") returned 3 [0039.634] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString=".dbf") returned 4 [0039.634] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString=".1cd") returned 4 [0039.634] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.634] lstrlenW (lpString=".jpg") returned 4 [0039.634] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.635] lstrlenW (lpString=".doc") returned 4 [0039.635] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString=".docx") returned 5 [0039.635] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0039.635] lstrlenW (lpString=".pdf") returned 4 [0039.635] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString=".xls") returned 4 [0039.635] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString=".xlsx") returned 5 [0039.635] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0039.635] lstrlenW (lpString=".ppt") returned 4 [0039.635] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.635] lstrlenW (lpString=".zip") returned 4 [0039.635] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString=".rar") returned 4 [0039.635] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString=".bz2") returned 4 [0039.635] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.635] lstrlenW (lpString=".7z") returned 3 [0039.635] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.635] lstrlenW (lpString=".dbf") returned 4 [0039.635] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.636] lstrlenW (lpString=".1cd") returned 4 [0039.636] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0039.636] lstrlenW (lpString=".jpg") returned 4 [0039.636] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.636] lstrcmpiW (lpString1=".HTM", lpString2=".zoh") returned -1 [0039.636] lstrlenW (lpString="README.HTM") returned 10 [0039.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.954] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1941) returned 1 [0039.955] CloseHandle (hObject=0x1cc) returned 1 [0039.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0039.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.960] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0039.960] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0039.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.994] GetLastError () returned 0x0 [0039.994] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x795, lpOverlapped=0x0) returned 1 [0039.998] WriteFile (in: hFile=0x1d0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0039.999] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0039.999] WriteFile (in: hFile=0x1d0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.999] SetEndOfFile (hFile=0x1d0) returned 1 [0039.999] CloseHandle (hObject=0x1d0) returned 1 [0040.000] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.000] SetEndOfFile (hFile=0x1cc) returned 1 [0040.001] CloseHandle (hObject=0x1cc) returned 1 [0040.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.001] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0040.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.001] lstrlenW (lpString=".doc") returned 4 [0040.001] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.001] lstrlenW (lpString=".docx") returned 5 [0040.001] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0040.001] lstrlenW (lpString=".pdf") returned 4 [0040.001] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.001] lstrlenW (lpString=".xls") returned 4 [0040.001] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.001] lstrlenW (lpString=".xlsx") returned 5 [0040.001] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0040.001] lstrlenW (lpString=".ppt") returned 4 [0040.001] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.001] lstrlenW (lpString=".zip") returned 4 [0040.001] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString=".rar") returned 4 [0040.002] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString=".bz2") returned 4 [0040.002] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.002] lstrlenW (lpString=".7z") returned 3 [0040.002] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString=".dbf") returned 4 [0040.002] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString=".1cd") returned 4 [0040.002] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString=".jpg") returned 4 [0040.002] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString=".doc") returned 4 [0040.002] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.002] lstrlenW (lpString=".docx") returned 5 [0040.002] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0040.002] lstrlenW (lpString=".pdf") returned 4 [0040.002] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString=".xls") returned 4 [0040.002] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString=".xlsx") returned 5 [0040.002] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0040.002] lstrlenW (lpString=".ppt") returned 4 [0040.002] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.002] lstrlenW (lpString=".zip") returned 4 [0040.002] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.002] lstrlenW (lpString=".rar") returned 4 [0040.003] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.003] lstrlenW (lpString=".bz2") returned 4 [0040.003] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.003] lstrlenW (lpString=".7z") returned 3 [0040.003] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.003] lstrlenW (lpString=".dbf") returned 4 [0040.003] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.003] lstrlenW (lpString=".1cd") returned 4 [0040.003] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.003] lstrlenW (lpString=".jpg") returned 4 [0040.003] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.003] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.003] lstrlenW (lpString="SETUP.XML") returned 9 [0040.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.559] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1852) returned 1 [0040.559] CloseHandle (hObject=0x1bc) returned 1 [0040.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0040.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.559] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.559] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.575] GetLastError () returned 0x0 [0040.575] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x73c, lpOverlapped=0x0) returned 1 [0040.727] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x740, lpOverlapped=0x0) returned 1 [0040.728] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0040.728] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.728] SetEndOfFile (hFile=0x1c8) returned 1 [0040.728] CloseHandle (hObject=0x1c8) returned 1 [0040.729] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.729] SetEndOfFile (hFile=0x1bc) returned 1 [0040.730] CloseHandle (hObject=0x1bc) returned 1 [0040.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.730] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString=".doc") returned 4 [0040.731] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString=".docx") returned 5 [0040.731] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.731] lstrlenW (lpString=".pdf") returned 4 [0040.731] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString=".xls") returned 4 [0040.731] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString=".xlsx") returned 5 [0040.731] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.731] lstrlenW (lpString=".ppt") returned 4 [0040.731] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString=".zip") returned 4 [0040.731] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.731] lstrlenW (lpString=".rar") returned 4 [0040.731] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString=".bz2") returned 4 [0040.731] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString=".7z") returned 3 [0040.731] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString=".dbf") returned 4 [0040.731] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString=".1cd") returned 4 [0040.731] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.731] lstrlenW (lpString=".jpg") returned 4 [0040.731] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString=".doc") returned 4 [0040.732] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".docx") returned 5 [0040.732] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.732] lstrlenW (lpString=".pdf") returned 4 [0040.732] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".xls") returned 4 [0040.732] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".xlsx") returned 5 [0040.732] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.732] lstrlenW (lpString=".ppt") returned 4 [0040.732] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString=".zip") returned 4 [0040.732] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.732] lstrlenW (lpString=".rar") returned 4 [0040.732] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".bz2") returned 4 [0040.732] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString=".7z") returned 3 [0040.732] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString=".dbf") returned 4 [0040.732] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString=".1cd") returned 4 [0040.732] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0040.732] lstrlenW (lpString=".jpg") returned 4 [0040.732] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.733] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0040.733] lstrlenW (lpString="SETUP.CHM") returned 9 [0040.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.762] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=67190) returned 1 [0040.762] CloseHandle (hObject=0x1f4) returned 1 [0040.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0040.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.763] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.763] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.763] GetLastError () returned 0x0 [0040.763] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x10676, lpOverlapped=0x0) returned 1 [0040.765] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x10680, lpOverlapped=0x0) returned 1 [0040.767] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0040.767] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.767] SetEndOfFile (hFile=0x1bc) returned 1 [0040.768] CloseHandle (hObject=0x1bc) returned 1 [0040.769] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.769] SetEndOfFile (hFile=0x1f4) returned 1 [0040.770] CloseHandle (hObject=0x1f4) returned 1 [0040.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0040.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.770] lstrlenW (lpString=".doc") returned 4 [0040.771] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString=".docx") returned 5 [0040.771] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.771] lstrlenW (lpString=".pdf") returned 4 [0040.771] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString=".xls") returned 4 [0040.771] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString=".xlsx") returned 5 [0040.771] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.771] lstrlenW (lpString=".ppt") returned 4 [0040.771] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString=".zip") returned 4 [0040.771] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString=".rar") returned 4 [0040.771] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString=".bz2") returned 4 [0040.771] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.771] lstrlenW (lpString=".7z") returned 3 [0040.771] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString=".dbf") returned 4 [0040.771] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString=".1cd") returned 4 [0040.771] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString=".jpg") returned 4 [0040.771] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.771] lstrlenW (lpString=".doc") returned 4 [0040.771] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString=".docx") returned 5 [0040.772] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.772] lstrlenW (lpString=".pdf") returned 4 [0040.772] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString=".xls") returned 4 [0040.772] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString=".xlsx") returned 5 [0040.772] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.772] lstrlenW (lpString=".ppt") returned 4 [0040.772] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.772] lstrlenW (lpString=".zip") returned 4 [0040.772] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString=".rar") returned 4 [0040.772] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString=".bz2") returned 4 [0040.772] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.772] lstrlenW (lpString=".7z") returned 3 [0040.772] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.772] lstrlenW (lpString=".dbf") returned 4 [0040.772] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.772] lstrlenW (lpString=".1cd") returned 4 [0040.772] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.772] lstrlenW (lpString=".jpg") returned 4 [0040.772] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.772] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.773] lstrlenW (lpString="SETUP.XML") returned 9 [0040.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.773] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9352) returned 1 [0040.773] CloseHandle (hObject=0x1f4) returned 1 [0040.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0040.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.773] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.773] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.773] GetLastError () returned 0x0 [0040.774] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2488, lpOverlapped=0x0) returned 1 [0040.993] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2490, lpOverlapped=0x0) returned 1 [0041.117] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0041.117] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.117] SetEndOfFile (hFile=0x1bc) returned 1 [0041.117] CloseHandle (hObject=0x1bc) returned 1 [0041.118] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.118] SetEndOfFile (hFile=0x1f4) returned 1 [0041.119] CloseHandle (hObject=0x1f4) returned 1 [0041.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0041.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.119] lstrlenW (lpString=".doc") returned 4 [0041.119] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.119] lstrlenW (lpString=".docx") returned 5 [0041.119] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.119] lstrlenW (lpString=".pdf") returned 4 [0041.119] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.119] lstrlenW (lpString=".xls") returned 4 [0041.119] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.119] lstrlenW (lpString=".xlsx") returned 5 [0041.119] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.119] lstrlenW (lpString=".ppt") returned 4 [0041.120] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString=".zip") returned 4 [0041.120] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.120] lstrlenW (lpString=".rar") returned 4 [0041.120] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString=".bz2") returned 4 [0041.120] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString=".7z") returned 3 [0041.120] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString=".dbf") returned 4 [0041.120] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString=".1cd") returned 4 [0041.120] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString=".jpg") returned 4 [0041.120] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.120] lstrlenW (lpString=".doc") returned 4 [0041.120] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString=".docx") returned 5 [0041.120] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.120] lstrlenW (lpString=".pdf") returned 4 [0041.120] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString=".xls") returned 4 [0041.120] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.120] lstrlenW (lpString=".xlsx") returned 5 [0041.120] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.120] lstrlenW (lpString=".ppt") returned 4 [0041.120] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.121] lstrlenW (lpString=".zip") returned 4 [0041.121] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.121] lstrlenW (lpString=".rar") returned 4 [0041.121] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.121] lstrlenW (lpString=".bz2") returned 4 [0041.121] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.121] lstrlenW (lpString=".7z") returned 3 [0041.121] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.121] lstrlenW (lpString=".dbf") returned 4 [0041.121] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.121] lstrlenW (lpString=".1cd") returned 4 [0041.121] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0041.121] lstrlenW (lpString=".jpg") returned 4 [0041.121] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.121] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.121] lstrlenW (lpString="Office32WW.XML") returned 14 [0041.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.122] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4274) returned 1 [0041.122] CloseHandle (hObject=0x1f4) returned 1 [0041.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0041.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0041.122] GetLastError () returned 0x0 [0041.122] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x10b2, lpOverlapped=0x0) returned 1 [0041.251] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0041.252] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0041.252] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.252] SetEndOfFile (hFile=0x1bc) returned 1 [0041.252] CloseHandle (hObject=0x1bc) returned 1 [0041.253] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.253] SetEndOfFile (hFile=0x1f4) returned 1 [0041.253] CloseHandle (hObject=0x1f4) returned 1 [0041.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0041.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.254] lstrlenW (lpString=".doc") returned 4 [0041.254] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString=".docx") returned 5 [0041.254] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.254] lstrlenW (lpString=".pdf") returned 4 [0041.254] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString=".xls") returned 4 [0041.254] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString=".xlsx") returned 5 [0041.254] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.254] lstrlenW (lpString=".ppt") returned 4 [0041.254] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.254] lstrlenW (lpString=".zip") returned 4 [0041.254] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.254] lstrlenW (lpString=".rar") returned 4 [0041.254] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString=".bz2") returned 4 [0041.254] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.254] lstrlenW (lpString=".7z") returned 3 [0041.255] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString=".dbf") returned 4 [0041.255] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString=".1cd") returned 4 [0041.255] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString=".jpg") returned 4 [0041.255] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString=".doc") returned 4 [0041.255] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString=".docx") returned 5 [0041.255] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.255] lstrlenW (lpString=".pdf") returned 4 [0041.255] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString=".xls") returned 4 [0041.255] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString=".xlsx") returned 5 [0041.255] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.255] lstrlenW (lpString=".ppt") returned 4 [0041.255] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.255] lstrlenW (lpString=".zip") returned 4 [0041.255] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.255] lstrlenW (lpString=".rar") returned 4 [0041.255] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString=".bz2") returned 4 [0041.255] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.255] lstrlenW (lpString=".7z") returned 3 [0041.255] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.256] lstrlenW (lpString=".dbf") returned 4 [0041.256] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.256] lstrlenW (lpString=".1cd") returned 4 [0041.256] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0041.256] lstrlenW (lpString=".jpg") returned 4 [0041.256] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.256] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.256] lstrlenW (lpString="SETUP.XML") returned 9 [0041.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.966] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4207) returned 1 [0041.980] CloseHandle (hObject=0x204) returned 1 [0041.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0041.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.983] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.983] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.004] GetLastError () returned 0x0 [0042.004] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x106f, lpOverlapped=0x0) returned 1 [0042.158] WriteFile (in: hFile=0x208, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1070, lpOverlapped=0x0) returned 1 [0042.159] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.159] WriteFile (in: hFile=0x208, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.159] SetEndOfFile (hFile=0x208) returned 1 [0042.159] CloseHandle (hObject=0x208) returned 1 [0042.160] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.160] SetEndOfFile (hFile=0x204) returned 1 [0042.161] CloseHandle (hObject=0x204) returned 1 [0042.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.161] lstrlenW (lpString=".doc") returned 4 [0042.161] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".docx") returned 5 [0042.161] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.161] lstrlenW (lpString=".pdf") returned 4 [0042.161] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xls") returned 4 [0042.161] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xlsx") returned 5 [0042.161] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.161] lstrlenW (lpString=".ppt") returned 4 [0042.162] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString=".zip") returned 4 [0042.162] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.162] lstrlenW (lpString=".rar") returned 4 [0042.162] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".bz2") returned 4 [0042.162] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".7z") returned 3 [0042.162] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString=".dbf") returned 4 [0042.162] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString=".1cd") returned 4 [0042.162] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString=".jpg") returned 4 [0042.162] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.162] lstrlenW (lpString=".doc") returned 4 [0042.162] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".docx") returned 5 [0042.162] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.162] lstrlenW (lpString=".pdf") returned 4 [0042.162] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".xls") returned 4 [0042.162] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".xlsx") returned 5 [0042.162] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.162] lstrlenW (lpString=".ppt") returned 4 [0042.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.163] lstrlenW (lpString=".zip") returned 4 [0042.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.163] lstrlenW (lpString=".rar") returned 4 [0042.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.163] lstrlenW (lpString=".bz2") returned 4 [0042.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.163] lstrlenW (lpString=".7z") returned 3 [0042.163] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.163] lstrlenW (lpString=".dbf") returned 4 [0042.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.163] lstrlenW (lpString=".1cd") returned 4 [0042.163] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0042.163] lstrlenW (lpString=".jpg") returned 4 [0042.163] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.163] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.163] lstrlenW (lpString="SETUP.XML") returned 9 [0042.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0042.236] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5884) returned 1 [0042.236] CloseHandle (hObject=0x1c8) returned 1 [0042.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0042.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0042.260] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.260] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0042.364] GetLastError () returned 0x0 [0042.364] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x16fc, lpOverlapped=0x0) returned 1 [0042.396] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1700, lpOverlapped=0x0) returned 1 [0042.397] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.398] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.398] SetEndOfFile (hFile=0x1c8) returned 1 [0042.398] CloseHandle (hObject=0x1c8) returned 1 [0042.399] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.399] SetEndOfFile (hFile=0x1c4) returned 1 [0042.399] CloseHandle (hObject=0x1c4) returned 1 [0042.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0042.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.400] lstrlenW (lpString=".doc") returned 4 [0042.400] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.400] lstrlenW (lpString=".docx") returned 5 [0042.400] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.400] lstrlenW (lpString=".pdf") returned 4 [0042.400] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.400] lstrlenW (lpString=".xls") returned 4 [0042.400] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.400] lstrlenW (lpString=".xlsx") returned 5 [0042.401] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.401] lstrlenW (lpString=".ppt") returned 4 [0042.401] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString=".zip") returned 4 [0042.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.401] lstrlenW (lpString=".rar") returned 4 [0042.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString=".bz2") returned 4 [0042.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString=".7z") returned 3 [0042.401] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString=".dbf") returned 4 [0042.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString=".1cd") returned 4 [0042.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString=".jpg") returned 4 [0042.401] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.401] lstrlenW (lpString=".doc") returned 4 [0042.401] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString=".docx") returned 5 [0042.401] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.401] lstrlenW (lpString=".pdf") returned 4 [0042.401] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString=".xls") returned 4 [0042.401] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.401] lstrlenW (lpString=".xlsx") returned 5 [0042.401] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.402] lstrlenW (lpString=".ppt") returned 4 [0042.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.402] lstrlenW (lpString=".zip") returned 4 [0042.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.402] lstrlenW (lpString=".rar") returned 4 [0042.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.402] lstrlenW (lpString=".bz2") returned 4 [0042.402] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.402] lstrlenW (lpString=".7z") returned 3 [0042.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.402] lstrlenW (lpString=".dbf") returned 4 [0042.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.402] lstrlenW (lpString=".1cd") returned 4 [0042.402] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0042.402] lstrlenW (lpString=".jpg") returned 4 [0042.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.402] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.402] lstrlenW (lpString="SETUP.XML") returned 9 [0042.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.416] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20577) returned 1 [0042.416] CloseHandle (hObject=0x1f0) returned 1 [0042.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0042.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.434] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.434] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.436] GetLastError () returned 0x0 [0042.436] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5061, lpOverlapped=0x0) returned 1 [0042.438] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5070, lpOverlapped=0x0) returned 1 [0042.439] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.439] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.439] SetEndOfFile (hFile=0x16c) returned 1 [0042.439] CloseHandle (hObject=0x16c) returned 1 [0042.440] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.440] SetEndOfFile (hFile=0x188) returned 1 [0042.441] CloseHandle (hObject=0x188) returned 1 [0042.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0042.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.442] lstrlenW (lpString=".doc") returned 4 [0042.442] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString=".docx") returned 5 [0042.442] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.442] lstrlenW (lpString=".pdf") returned 4 [0042.442] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString=".xls") returned 4 [0042.442] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString=".xlsx") returned 5 [0042.442] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.442] lstrlenW (lpString=".ppt") returned 4 [0042.442] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.442] lstrlenW (lpString=".zip") returned 4 [0042.442] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.442] lstrlenW (lpString=".rar") returned 4 [0042.442] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString=".bz2") returned 4 [0042.442] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.442] lstrlenW (lpString=".7z") returned 3 [0042.442] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.443] lstrlenW (lpString=".dbf") returned 4 [0042.443] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.444] lstrlenW (lpString=".1cd") returned 4 [0042.444] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.444] lstrlenW (lpString=".jpg") returned 4 [0042.444] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.444] lstrlenW (lpString=".doc") returned 4 [0042.444] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.444] lstrlenW (lpString=".docx") returned 5 [0042.444] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.444] lstrlenW (lpString=".pdf") returned 4 [0042.444] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.444] lstrlenW (lpString=".xls") returned 4 [0042.444] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.444] lstrlenW (lpString=".xlsx") returned 5 [0042.444] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.444] lstrlenW (lpString=".ppt") returned 4 [0042.444] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.445] lstrlenW (lpString=".zip") returned 4 [0042.445] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.445] lstrlenW (lpString=".rar") returned 4 [0042.445] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.445] lstrlenW (lpString=".bz2") returned 4 [0042.445] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.445] lstrlenW (lpString=".7z") returned 3 [0042.445] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.445] lstrlenW (lpString=".dbf") returned 4 [0042.445] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.445] lstrlenW (lpString=".1cd") returned 4 [0042.445] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.445] lstrlenW (lpString=".jpg") returned 4 [0042.445] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.445] lstrcmpiW (lpString1=".HTM", lpString2=".zoh") returned -1 [0042.445] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0042.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.446] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11463) returned 1 [0042.446] CloseHandle (hObject=0x188) returned 1 [0042.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0042.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.446] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.446] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.753] GetLastError () returned 0x0 [0042.753] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0042.754] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0042.755] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.755] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.755] SetEndOfFile (hFile=0x200) returned 1 [0042.756] CloseHandle (hObject=0x200) returned 1 [0042.756] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.756] SetEndOfFile (hFile=0x188) returned 1 [0042.757] CloseHandle (hObject=0x188) returned 1 [0042.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.757] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString=".doc") returned 4 [0042.758] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.758] lstrlenW (lpString=".docx") returned 5 [0042.758] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0042.758] lstrlenW (lpString=".pdf") returned 4 [0042.758] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.758] lstrlenW (lpString=".xls") returned 4 [0042.758] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.758] lstrlenW (lpString=".xlsx") returned 5 [0042.758] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0042.758] lstrlenW (lpString=".ppt") returned 4 [0042.758] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString=".zip") returned 4 [0042.758] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.758] lstrlenW (lpString=".rar") returned 4 [0042.758] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.758] lstrlenW (lpString=".bz2") returned 4 [0042.758] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.758] lstrlenW (lpString=".7z") returned 3 [0042.758] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString=".dbf") returned 4 [0042.758] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString=".1cd") returned 4 [0042.758] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.758] lstrlenW (lpString=".jpg") returned 4 [0042.758] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString=".doc") returned 4 [0042.759] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.759] lstrlenW (lpString=".docx") returned 5 [0042.759] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0042.759] lstrlenW (lpString=".pdf") returned 4 [0042.759] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString=".xls") returned 4 [0042.759] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString=".xlsx") returned 5 [0042.759] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0042.759] lstrlenW (lpString=".ppt") returned 4 [0042.759] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString=".zip") returned 4 [0042.759] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString=".rar") returned 4 [0042.759] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.759] lstrlenW (lpString=".bz2") returned 4 [0042.759] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.759] lstrlenW (lpString=".7z") returned 3 [0042.759] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString=".dbf") returned 4 [0042.759] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString=".1cd") returned 4 [0042.759] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.759] lstrlenW (lpString=".jpg") returned 4 [0042.759] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.760] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.760] lstrlenW (lpString="TIME.XML") returned 8 [0042.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.760] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8564) returned 1 [0042.760] CloseHandle (hObject=0x188) returned 1 [0042.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0042.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.760] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.760] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.761] GetLastError () returned 0x0 [0042.761] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2174, lpOverlapped=0x0) returned 1 [0042.762] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2180, lpOverlapped=0x0) returned 1 [0042.763] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.764] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0042.764] SetEndOfFile (hFile=0x200) returned 1 [0042.764] CloseHandle (hObject=0x200) returned 1 [0042.765] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.765] SetEndOfFile (hFile=0x188) returned 1 [0042.766] CloseHandle (hObject=0x188) returned 1 [0042.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString=".doc") returned 4 [0042.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString=".docx") returned 5 [0042.767] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.767] lstrlenW (lpString=".pdf") returned 4 [0042.767] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString=".xls") returned 4 [0042.767] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString=".xlsx") returned 5 [0042.767] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.767] lstrlenW (lpString=".ppt") returned 4 [0042.767] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString=".zip") returned 4 [0042.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.767] lstrlenW (lpString=".rar") returned 4 [0042.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString=".bz2") returned 4 [0042.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString=".7z") returned 3 [0042.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString=".dbf") returned 4 [0042.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString=".1cd") returned 4 [0042.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.767] lstrlenW (lpString=".jpg") returned 4 [0042.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString=".doc") returned 4 [0042.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString=".docx") returned 5 [0042.768] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.768] lstrlenW (lpString=".pdf") returned 4 [0042.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString=".xls") returned 4 [0042.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString=".xlsx") returned 5 [0042.768] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.768] lstrlenW (lpString=".ppt") returned 4 [0042.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString=".zip") returned 4 [0042.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.768] lstrlenW (lpString=".rar") returned 4 [0042.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString=".bz2") returned 4 [0042.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString=".7z") returned 3 [0042.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString=".dbf") returned 4 [0042.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString=".1cd") returned 4 [0042.768] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.768] lstrlenW (lpString=".jpg") returned 4 [0042.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.769] lstrcmpiW (lpString1=".XSL", lpString2=".zoh") returned -1 [0042.769] lstrlenW (lpString="BASMLA.XSL") returned 10 [0042.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.769] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=227311) returned 1 [0042.769] CloseHandle (hObject=0x188) returned 1 [0042.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0042.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.769] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.769] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.770] GetLastError () returned 0x0 [0042.770] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x377ef, lpOverlapped=0x0) returned 1 [0042.776] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0042.780] ReadFile (in: hFile=0x188, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.780] WriteFile (in: hFile=0x200, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.781] SetEndOfFile (hFile=0x200) returned 1 [0042.781] CloseHandle (hObject=0x200) returned 1 [0042.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.783] SetEndOfFile (hFile=0x188) returned 1 [0042.785] CloseHandle (hObject=0x188) returned 1 [0042.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0043.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.151] lstrlenW (lpString=".doc") returned 4 [0043.151] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0043.151] lstrlenW (lpString=".docx") returned 5 [0043.151] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0043.151] lstrlenW (lpString=".pdf") returned 4 [0043.151] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0043.151] lstrlenW (lpString=".xls") returned 4 [0043.151] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0043.151] lstrlenW (lpString=".xlsx") returned 5 [0043.151] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0043.151] lstrlenW (lpString=".ppt") returned 4 [0043.151] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0043.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.151] lstrlenW (lpString=".zip") returned 4 [0043.151] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0043.151] lstrlenW (lpString=".rar") returned 4 [0043.151] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".bz2") returned 4 [0043.152] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".7z") returned 3 [0043.152] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString=".dbf") returned 4 [0043.152] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString=".1cd") returned 4 [0043.152] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString=".jpg") returned 4 [0043.152] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString=".doc") returned 4 [0043.152] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".docx") returned 5 [0043.152] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0043.152] lstrlenW (lpString=".pdf") returned 4 [0043.152] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".xls") returned 4 [0043.152] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".xlsx") returned 5 [0043.152] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0043.152] lstrlenW (lpString=".ppt") returned 4 [0043.152] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.152] lstrlenW (lpString=".zip") returned 4 [0043.152] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0043.152] lstrlenW (lpString=".rar") returned 4 [0043.152] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0043.152] lstrlenW (lpString=".bz2") returned 4 [0043.153] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0043.153] lstrlenW (lpString=".7z") returned 3 [0043.153] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0043.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.153] lstrlenW (lpString=".dbf") returned 4 [0043.153] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0043.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.153] lstrlenW (lpString=".1cd") returned 4 [0043.153] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0043.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.153] lstrlenW (lpString=".jpg") returned 4 [0043.153] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0043.153] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0043.153] lstrlenW (lpString="Bears.jpg") returned 9 [0043.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.462] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1074) returned 1 [0043.463] CloseHandle (hObject=0x1fc) returned 1 [0043.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0043.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.463] lstrlenW (lpString=".doc") returned 4 [0043.463] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.463] lstrlenW (lpString=".docx") returned 5 [0043.463] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.463] lstrlenW (lpString=".pdf") returned 4 [0043.463] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.463] lstrlenW (lpString=".xls") returned 4 [0043.463] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString=".xlsx") returned 5 [0043.464] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.464] lstrlenW (lpString=".ppt") returned 4 [0043.464] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString=".zip") returned 4 [0043.464] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString=".rar") returned 4 [0043.464] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString=".bz2") returned 4 [0043.464] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.464] lstrlenW (lpString=".7z") returned 3 [0043.464] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString=".dbf") returned 4 [0043.464] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString=".1cd") returned 4 [0043.464] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString=".jpg") returned 4 [0043.464] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.464] lstrlenW (lpString=".doc") returned 4 [0043.464] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.464] lstrlenW (lpString=".docx") returned 5 [0043.464] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.464] lstrlenW (lpString=".pdf") returned 4 [0043.464] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString=".xls") returned 4 [0043.464] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.464] lstrlenW (lpString=".xlsx") returned 5 [0043.465] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.465] lstrlenW (lpString=".ppt") returned 4 [0043.465] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.465] lstrlenW (lpString=".zip") returned 4 [0043.465] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.465] lstrlenW (lpString=".rar") returned 4 [0043.465] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.465] lstrlenW (lpString=".bz2") returned 4 [0043.465] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.465] lstrlenW (lpString=".7z") returned 3 [0043.465] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.465] lstrlenW (lpString=".dbf") returned 4 [0043.465] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.465] lstrlenW (lpString=".1cd") returned 4 [0043.465] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.465] lstrlenW (lpString=".jpg") returned 4 [0043.465] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.465] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0043.465] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0043.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.473] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2575) returned 1 [0043.473] CloseHandle (hObject=0x1fc) returned 1 [0043.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0043.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.474] lstrlenW (lpString=".doc") returned 4 [0043.474] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.474] lstrlenW (lpString=".docx") returned 5 [0043.474] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0043.474] lstrlenW (lpString=".pdf") returned 4 [0043.474] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.474] lstrlenW (lpString=".xls") returned 4 [0043.474] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.474] lstrlenW (lpString=".xlsx") returned 5 [0043.474] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0043.474] lstrlenW (lpString=".ppt") returned 4 [0043.474] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.474] lstrlenW (lpString=".zip") returned 4 [0043.474] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.474] lstrlenW (lpString=".rar") returned 4 [0043.474] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.474] lstrlenW (lpString=".bz2") returned 4 [0043.474] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.474] lstrlenW (lpString=".7z") returned 3 [0043.474] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".dbf") returned 4 [0043.475] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".1cd") returned 4 [0043.475] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".jpg") returned 4 [0043.475] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".doc") returned 4 [0043.475] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.475] lstrlenW (lpString=".docx") returned 5 [0043.475] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0043.475] lstrlenW (lpString=".pdf") returned 4 [0043.475] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.475] lstrlenW (lpString=".xls") returned 4 [0043.475] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.475] lstrlenW (lpString=".xlsx") returned 5 [0043.475] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0043.475] lstrlenW (lpString=".ppt") returned 4 [0043.475] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".zip") returned 4 [0043.475] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.475] lstrlenW (lpString=".rar") returned 4 [0043.475] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.475] lstrlenW (lpString=".bz2") returned 4 [0043.475] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.475] lstrlenW (lpString=".7z") returned 3 [0043.475] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.475] lstrlenW (lpString=".dbf") returned 4 [0043.475] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.476] lstrlenW (lpString=".1cd") returned 4 [0043.476] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.476] lstrlenW (lpString=".jpg") returned 4 [0043.476] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.476] lstrcmpiW (lpString1=".gif", lpString2=".zoh") returned -1 [0043.476] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0043.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.476] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4587) returned 1 [0043.476] CloseHandle (hObject=0x1fc) returned 1 [0043.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0043.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.476] lstrlenW (lpString=".doc") returned 4 [0043.477] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.477] lstrlenW (lpString=".docx") returned 5 [0043.477] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.477] lstrlenW (lpString=".pdf") returned 4 [0043.477] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString=".xls") returned 4 [0043.477] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString=".xlsx") returned 5 [0043.477] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.477] lstrlenW (lpString=".ppt") returned 4 [0043.477] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString=".zip") returned 4 [0043.477] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString=".rar") returned 4 [0043.477] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString=".bz2") returned 4 [0043.477] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.477] lstrlenW (lpString=".7z") returned 3 [0043.477] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString=".dbf") returned 4 [0043.477] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString=".1cd") returned 4 [0043.477] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString=".jpg") returned 4 [0043.477] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.477] lstrlenW (lpString=".doc") returned 4 [0043.478] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.478] lstrlenW (lpString=".docx") returned 5 [0043.478] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.478] lstrlenW (lpString=".pdf") returned 4 [0043.478] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.478] lstrlenW (lpString=".xls") returned 4 [0043.478] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.478] lstrlenW (lpString=".xlsx") returned 5 [0043.478] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.478] lstrlenW (lpString=".ppt") returned 4 [0043.478] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.478] lstrlenW (lpString=".zip") returned 4 [0043.478] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.478] lstrlenW (lpString=".rar") returned 4 [0043.478] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.478] lstrlenW (lpString=".bz2") returned 4 [0043.478] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.478] lstrlenW (lpString=".7z") returned 3 [0043.478] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.478] lstrlenW (lpString=".dbf") returned 4 [0043.478] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.478] lstrlenW (lpString=".1cd") returned 4 [0043.478] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.478] lstrlenW (lpString=".jpg") returned 4 [0043.478] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.478] lstrcmpiW (lpString1=".gif", lpString2=".zoh") returned -1 [0043.479] lstrlenW (lpString="Connectivity.gif") returned 16 [0043.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.479] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2319) returned 1 [0043.479] CloseHandle (hObject=0x1fc) returned 1 [0043.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0043.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.479] lstrlenW (lpString=".doc") returned 4 [0043.479] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.479] lstrlenW (lpString=".docx") returned 5 [0043.479] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.479] lstrlenW (lpString=".pdf") returned 4 [0043.479] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.479] lstrlenW (lpString=".xls") returned 4 [0043.479] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.479] lstrlenW (lpString=".xlsx") returned 5 [0043.479] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.479] lstrlenW (lpString=".ppt") returned 4 [0043.479] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".zip") returned 4 [0043.480] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString=".rar") returned 4 [0043.480] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString=".bz2") returned 4 [0043.480] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.480] lstrlenW (lpString=".7z") returned 3 [0043.480] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".dbf") returned 4 [0043.480] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".1cd") returned 4 [0043.480] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".jpg") returned 4 [0043.480] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".doc") returned 4 [0043.480] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.480] lstrlenW (lpString=".docx") returned 5 [0043.480] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.480] lstrlenW (lpString=".pdf") returned 4 [0043.480] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString=".xls") returned 4 [0043.480] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString=".xlsx") returned 5 [0043.480] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.480] lstrlenW (lpString=".ppt") returned 4 [0043.480] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.480] lstrlenW (lpString=".zip") returned 4 [0043.481] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.481] lstrlenW (lpString=".rar") returned 4 [0043.481] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.481] lstrlenW (lpString=".bz2") returned 4 [0043.481] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.481] lstrlenW (lpString=".7z") returned 3 [0043.481] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.481] lstrlenW (lpString=".dbf") returned 4 [0043.481] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.481] lstrlenW (lpString=".1cd") returned 4 [0043.481] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.481] lstrlenW (lpString=".jpg") returned 4 [0043.481] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.481] lstrcmpiW (lpString1=".ini", lpString2=".zoh") returned -1 [0043.481] lstrlenW (lpString="Desktop.ini") returned 11 [0043.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.481] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=645) returned 1 [0043.482] CloseHandle (hObject=0x1fc) returned 1 [0043.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0043.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.482] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.482] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.482] GetLastError () returned 0x0 [0043.482] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x285, lpOverlapped=0x0) returned 1 [0043.483] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x290, lpOverlapped=0x0) returned 1 [0043.484] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0043.484] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.484] SetEndOfFile (hFile=0x204) returned 1 [0043.484] CloseHandle (hObject=0x204) returned 1 [0043.484] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.485] SetEndOfFile (hFile=0x1fc) returned 1 [0043.485] CloseHandle (hObject=0x1fc) returned 1 [0043.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x26) returned 1 [0043.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0043.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.486] lstrlenW (lpString=".doc") returned 4 [0043.486] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.486] lstrlenW (lpString=".docx") returned 5 [0043.486] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.486] lstrlenW (lpString=".pdf") returned 4 [0043.486] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.486] lstrlenW (lpString=".xls") returned 4 [0043.486] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.486] lstrlenW (lpString=".xlsx") returned 5 [0043.486] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.486] lstrlenW (lpString=".ppt") returned 4 [0043.486] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.486] lstrlenW (lpString=".zip") returned 4 [0043.486] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.486] lstrlenW (lpString=".rar") returned 4 [0043.486] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.486] lstrlenW (lpString=".bz2") returned 4 [0043.486] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.486] lstrlenW (lpString=".7z") returned 3 [0043.486] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.486] lstrlenW (lpString=".dbf") returned 4 [0043.486] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString=".1cd") returned 4 [0043.487] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString=".jpg") returned 4 [0043.487] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString=".doc") returned 4 [0043.487] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.487] lstrlenW (lpString=".docx") returned 5 [0043.487] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.487] lstrlenW (lpString=".pdf") returned 4 [0043.487] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString=".xls") returned 4 [0043.487] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString=".xlsx") returned 5 [0043.487] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.487] lstrlenW (lpString=".ppt") returned 4 [0043.487] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString=".zip") returned 4 [0043.487] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString=".rar") returned 4 [0043.487] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.487] lstrlenW (lpString=".bz2") returned 4 [0043.487] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.487] lstrlenW (lpString=".7z") returned 3 [0043.487] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.487] lstrlenW (lpString=".dbf") returned 4 [0043.487] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.488] lstrlenW (lpString=".1cd") returned 4 [0043.488] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.488] lstrlenW (lpString=".jpg") returned 4 [0043.488] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.488] lstrcmpiW (lpString1=".emf", lpString2=".zoh") returned -1 [0043.488] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0043.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.488] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3792) returned 1 [0043.488] CloseHandle (hObject=0x1fc) returned 1 [0043.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0043.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.489] lstrlenW (lpString=".doc") returned 4 [0043.489] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.489] lstrlenW (lpString=".docx") returned 5 [0043.489] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.489] lstrlenW (lpString=".pdf") returned 4 [0043.489] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.489] lstrlenW (lpString=".xls") returned 4 [0043.489] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.489] lstrlenW (lpString=".xlsx") returned 5 [0043.489] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.489] lstrlenW (lpString=".ppt") returned 4 [0043.489] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.489] lstrlenW (lpString=".zip") returned 4 [0043.489] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.489] lstrlenW (lpString=".rar") returned 4 [0043.489] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.489] lstrlenW (lpString=".bz2") returned 4 [0043.489] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.489] lstrlenW (lpString=".7z") returned 3 [0043.489] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.489] lstrlenW (lpString=".dbf") returned 4 [0043.489] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.489] lstrlenW (lpString=".1cd") returned 4 [0043.489] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString=".jpg") returned 4 [0043.490] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString=".doc") returned 4 [0043.490] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.490] lstrlenW (lpString=".docx") returned 5 [0043.490] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.490] lstrlenW (lpString=".pdf") returned 4 [0043.490] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString=".xls") returned 4 [0043.490] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString=".xlsx") returned 5 [0043.490] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.490] lstrlenW (lpString=".ppt") returned 4 [0043.490] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString=".zip") returned 4 [0043.490] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString=".rar") returned 4 [0043.490] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.490] lstrlenW (lpString=".bz2") returned 4 [0043.490] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.490] lstrlenW (lpString=".7z") returned 3 [0043.490] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString=".dbf") returned 4 [0043.490] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.490] lstrlenW (lpString=".1cd") returned 4 [0043.490] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.491] lstrlenW (lpString=".jpg") returned 4 [0043.491] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.491] lstrcmpiW (lpString1=".htm", lpString2=".zoh") returned -1 [0043.491] lstrlenW (lpString="Garden.htm") returned 10 [0043.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.491] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=231) returned 1 [0043.491] CloseHandle (hObject=0x1fc) returned 1 [0043.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0043.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.491] lstrlenW (lpString=".doc") returned 4 [0043.491] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.491] lstrlenW (lpString=".docx") returned 5 [0043.491] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.491] lstrlenW (lpString=".pdf") returned 4 [0043.492] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString=".xls") returned 4 [0043.492] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString=".xlsx") returned 5 [0043.492] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.492] lstrlenW (lpString=".ppt") returned 4 [0043.492] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString=".zip") returned 4 [0043.492] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString=".rar") returned 4 [0043.492] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString=".bz2") returned 4 [0043.492] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.492] lstrlenW (lpString=".7z") returned 3 [0043.492] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString=".dbf") returned 4 [0043.492] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString=".1cd") returned 4 [0043.492] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString=".jpg") returned 4 [0043.492] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.492] lstrlenW (lpString=".doc") returned 4 [0043.492] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.492] lstrlenW (lpString=".docx") returned 5 [0043.492] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.492] lstrlenW (lpString=".pdf") returned 4 [0043.492] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.493] lstrlenW (lpString=".xls") returned 4 [0043.493] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.493] lstrlenW (lpString=".xlsx") returned 5 [0043.493] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.493] lstrlenW (lpString=".ppt") returned 4 [0043.493] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.493] lstrlenW (lpString=".zip") returned 4 [0043.493] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.493] lstrlenW (lpString=".rar") returned 4 [0043.493] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.493] lstrlenW (lpString=".bz2") returned 4 [0043.493] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.493] lstrlenW (lpString=".7z") returned 3 [0043.493] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.493] lstrlenW (lpString=".dbf") returned 4 [0043.493] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.493] lstrlenW (lpString=".1cd") returned 4 [0043.493] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.493] lstrlenW (lpString=".jpg") returned 4 [0043.493] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.493] lstrcmpiW (lpString1=".jpg", lpString2=".zoh") returned -1 [0043.493] lstrlenW (lpString="Garden.jpg") returned 10 [0043.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.494] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23871) returned 1 [0043.494] CloseHandle (hObject=0x1fc) returned 1 [0043.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0043.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.494] lstrlenW (lpString=".doc") returned 4 [0043.494] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.494] lstrlenW (lpString=".docx") returned 5 [0043.494] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.494] lstrlenW (lpString=".pdf") returned 4 [0043.494] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.494] lstrlenW (lpString=".xls") returned 4 [0043.494] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.494] lstrlenW (lpString=".xlsx") returned 5 [0043.494] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.494] lstrlenW (lpString=".ppt") returned 4 [0043.494] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.494] lstrlenW (lpString=".zip") returned 4 [0043.494] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.494] lstrlenW (lpString=".rar") returned 4 [0043.494] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.495] lstrlenW (lpString=".bz2") returned 4 [0043.495] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.495] lstrlenW (lpString=".7z") returned 3 [0043.495] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString=".dbf") returned 4 [0043.495] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString=".1cd") returned 4 [0043.495] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString=".jpg") returned 4 [0043.495] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString=".doc") returned 4 [0043.495] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.495] lstrlenW (lpString=".docx") returned 5 [0043.495] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.495] lstrlenW (lpString=".pdf") returned 4 [0043.495] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.495] lstrlenW (lpString=".xls") returned 4 [0043.495] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.495] lstrlenW (lpString=".xlsx") returned 5 [0043.495] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.495] lstrlenW (lpString=".ppt") returned 4 [0043.495] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.495] lstrlenW (lpString=".zip") returned 4 [0043.495] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.495] lstrlenW (lpString=".rar") returned 4 [0043.495] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.496] lstrlenW (lpString=".bz2") returned 4 [0043.496] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.496] lstrlenW (lpString=".7z") returned 3 [0043.496] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.496] lstrlenW (lpString=".dbf") returned 4 [0043.496] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.496] lstrlenW (lpString=".1cd") returned 4 [0043.496] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.496] lstrlenW (lpString=".jpg") returned 4 [0043.496] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.496] lstrcmpiW (lpString1=".emf", lpString2=".zoh") returned -1 [0043.496] lstrlenW (lpString="Genko_1.emf") returned 11 [0043.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.505] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5524) returned 1 [0043.505] CloseHandle (hObject=0x1fc) returned 1 [0043.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0043.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.505] lstrlenW (lpString=".doc") returned 4 [0043.505] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.505] lstrlenW (lpString=".docx") returned 5 [0043.505] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.505] lstrlenW (lpString=".pdf") returned 4 [0043.505] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.505] lstrlenW (lpString=".xls") returned 4 [0043.505] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.505] lstrlenW (lpString=".xlsx") returned 5 [0043.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.505] lstrlenW (lpString=".ppt") returned 4 [0043.506] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString=".zip") returned 4 [0043.506] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString=".rar") returned 4 [0043.506] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString=".bz2") returned 4 [0043.506] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.506] lstrlenW (lpString=".7z") returned 3 [0043.506] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString=".dbf") returned 4 [0043.506] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString=".1cd") returned 4 [0043.506] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString=".jpg") returned 4 [0043.506] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.506] lstrlenW (lpString=".doc") returned 4 [0043.506] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.506] lstrlenW (lpString=".docx") returned 5 [0043.506] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.506] lstrlenW (lpString=".pdf") returned 4 [0043.506] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString=".xls") returned 4 [0043.506] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.506] lstrlenW (lpString=".xlsx") returned 5 [0043.506] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.506] lstrlenW (lpString=".ppt") returned 4 [0043.506] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.507] lstrlenW (lpString=".zip") returned 4 [0043.507] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.507] lstrlenW (lpString=".rar") returned 4 [0043.507] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.507] lstrlenW (lpString=".bz2") returned 4 [0043.507] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.507] lstrlenW (lpString=".7z") returned 3 [0043.507] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.507] lstrlenW (lpString=".dbf") returned 4 [0043.507] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.507] lstrlenW (lpString=".1cd") returned 4 [0043.507] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.507] lstrlenW (lpString=".jpg") returned 4 [0043.507] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.507] lstrcmpiW (lpString1=".emf", lpString2=".zoh") returned -1 [0043.507] lstrlenW (lpString="Genko_2.emf") returned 11 [0043.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0043.507] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10340) returned 1 [0043.507] CloseHandle (hObject=0x1fc) returned 1 [0043.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0043.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.508] lstrlenW (lpString=".doc") returned 4 [0043.508] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.508] lstrlenW (lpString=".docx") returned 5 [0043.508] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.508] lstrlenW (lpString=".pdf") returned 4 [0043.508] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.508] lstrlenW (lpString=".xls") returned 4 [0043.508] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.508] lstrlenW (lpString=".xlsx") returned 5 [0043.508] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.508] lstrlenW (lpString=".ppt") returned 4 [0043.508] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.508] lstrlenW (lpString=".zip") returned 4 [0043.508] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.508] lstrlenW (lpString=".rar") returned 4 [0043.508] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.508] lstrlenW (lpString=".bz2") returned 4 [0043.508] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.508] lstrlenW (lpString=".7z") returned 3 [0043.508] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.508] lstrlenW (lpString=".dbf") returned 4 [0043.508] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString=".1cd") returned 4 [0043.509] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString=".jpg") returned 4 [0043.509] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString=".doc") returned 4 [0043.509] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.509] lstrlenW (lpString=".docx") returned 5 [0043.509] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.509] lstrlenW (lpString=".pdf") returned 4 [0043.509] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString=".xls") returned 4 [0043.509] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString=".xlsx") returned 5 [0043.509] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.509] lstrlenW (lpString=".ppt") returned 4 [0043.509] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString=".zip") returned 4 [0043.509] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString=".rar") returned 4 [0043.509] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.509] lstrlenW (lpString=".bz2") returned 4 [0043.509] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.509] lstrlenW (lpString=".7z") returned 3 [0043.509] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.509] lstrlenW (lpString=".dbf") returned 4 [0043.509] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.510] lstrlenW (lpString=".1cd") returned 4 [0043.510] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.510] lstrlenW (lpString=".jpg") returned 4 [0043.510] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.510] lstrcmpiW (lpString1=".emf", lpString2=".zoh") returned -1 [0043.510] lstrlenW (lpString="Graph.emf") returned 9 [0043.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.386] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=116724) returned 1 [0044.386] CloseHandle (hObject=0x1f4) returned 1 [0044.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0044.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.387] lstrlenW (lpString=".doc") returned 4 [0044.387] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0044.387] lstrlenW (lpString=".docx") returned 5 [0044.387] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0044.387] lstrlenW (lpString=".pdf") returned 4 [0044.387] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0044.387] lstrlenW (lpString=".xls") returned 4 [0044.387] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0044.387] lstrlenW (lpString=".xlsx") returned 5 [0044.387] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0044.387] lstrlenW (lpString=".ppt") returned 4 [0044.387] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0044.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.387] lstrlenW (lpString=".zip") returned 4 [0044.387] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0044.387] lstrlenW (lpString=".rar") returned 4 [0044.387] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0044.387] lstrlenW (lpString=".bz2") returned 4 [0044.387] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0044.387] lstrlenW (lpString=".7z") returned 3 [0044.387] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0044.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.388] lstrlenW (lpString=".dbf") returned 4 [0044.388] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0044.388] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=237) returned 1 [0044.388] CloseHandle (hObject=0x1f4) returned 1 [0044.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0044.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.388] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6381) returned 1 [0044.388] CloseHandle (hObject=0x1f4) returned 1 [0044.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0044.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.390] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=232) returned 1 [0044.390] CloseHandle (hObject=0x1f4) returned 1 [0044.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0044.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.391] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5115) returned 1 [0044.391] CloseHandle (hObject=0x1f4) returned 1 [0044.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0044.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.392] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3981) returned 1 [0044.392] CloseHandle (hObject=0x1f4) returned 1 [0044.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0044.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.392] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5115) returned 1 [0044.392] CloseHandle (hObject=0x1f4) returned 1 [0044.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0044.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.394] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14049) returned 1 [0044.394] CloseHandle (hObject=0x1f4) returned 1 [0044.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0044.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.395] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=233) returned 1 [0044.395] CloseHandle (hObject=0x1f4) returned 1 [0044.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0044.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.396] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1920) returned 1 [0044.396] CloseHandle (hObject=0x1f4) returned 1 [0044.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0044.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.396] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15776) returned 1 [0044.396] CloseHandle (hObject=0x1f4) returned 1 [0044.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0044.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.397] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=37316) returned 1 [0044.397] CloseHandle (hObject=0x1f4) returned 1 [0044.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0044.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.397] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=237) returned 1 [0044.398] CloseHandle (hObject=0x1f4) returned 1 [0044.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0044.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.399] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4734) returned 1 [0044.399] CloseHandle (hObject=0x1f4) returned 1 [0044.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0044.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.400] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=81292) returned 1 [0044.400] CloseHandle (hObject=0x1f4) returned 1 [0044.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0044.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.400] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1990) returned 1 [0044.400] CloseHandle (hObject=0x1f4) returned 1 [0044.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0044.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.401] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=232) returned 1 [0044.401] CloseHandle (hObject=0x1f4) returned 1 [0044.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0044.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.402] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10569) returned 1 [0044.402] CloseHandle (hObject=0x1f4) returned 1 [0044.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0044.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.403] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=230) returned 1 [0044.403] CloseHandle (hObject=0x1f4) returned 1 [0044.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0044.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.404] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7505) returned 1 [0044.404] CloseHandle (hObject=0x1f4) returned 1 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.404] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1864) returned 1 [0044.404] CloseHandle (hObject=0x1f4) returned 1 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.405] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3650) returned 1 [0044.405] CloseHandle (hObject=0x1f4) returned 1 [0044.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0044.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.406] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4638) returned 1 [0044.406] CloseHandle (hObject=0x1f4) returned 1 [0044.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0044.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.406] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26720) returned 1 [0044.406] CloseHandle (hObject=0x1f4) returned 1 [0044.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0044.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.407] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3168) returned 1 [0044.408] CloseHandle (hObject=0x1f4) returned 1 [0044.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0044.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.408] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15063) returned 1 [0044.408] CloseHandle (hObject=0x1f4) returned 1 [0044.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0044.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.410] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1569) returned 1 [0044.410] CloseHandle (hObject=0x1f4) returned 1 [0044.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0044.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.410] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.410] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.412] GetLastError () returned 0x0 [0044.412] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x621, lpOverlapped=0x0) returned 1 [0044.413] WriteFile (in: hFile=0x198, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x630, lpOverlapped=0x0) returned 1 [0044.414] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0044.414] WriteFile (in: hFile=0x198, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.414] SetEndOfFile (hFile=0x198) returned 1 [0044.415] CloseHandle (hObject=0x198) returned 1 [0044.415] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.415] SetEndOfFile (hFile=0x1f4) returned 1 [0044.416] CloseHandle (hObject=0x1f4) returned 1 [0044.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0044.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.416] lstrlenW (lpString=".doc") returned 4 [0044.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.416] lstrlenW (lpString=".docx") returned 5 [0044.416] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.416] lstrlenW (lpString=".pdf") returned 4 [0044.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.416] lstrlenW (lpString=".xls") returned 4 [0044.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.416] lstrlenW (lpString=".xlsx") returned 5 [0044.416] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.416] lstrlenW (lpString=".ppt") returned 4 [0044.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.416] lstrlenW (lpString=".zip") returned 4 [0044.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.416] lstrlenW (lpString=".rar") returned 4 [0044.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.417] lstrlenW (lpString=".bz2") returned 4 [0044.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.417] lstrlenW (lpString=".7z") returned 3 [0044.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString=".dbf") returned 4 [0044.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString=".1cd") returned 4 [0044.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString=".jpg") returned 4 [0044.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString=".doc") returned 4 [0044.417] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.417] lstrlenW (lpString=".docx") returned 5 [0044.417] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.417] lstrlenW (lpString=".pdf") returned 4 [0044.417] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.417] lstrlenW (lpString=".xls") returned 4 [0044.417] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.417] lstrlenW (lpString=".xlsx") returned 5 [0044.417] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.417] lstrlenW (lpString=".ppt") returned 4 [0044.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.417] lstrlenW (lpString=".zip") returned 4 [0044.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.418] lstrlenW (lpString=".rar") returned 4 [0044.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.418] lstrlenW (lpString=".bz2") returned 4 [0044.418] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.418] lstrlenW (lpString=".7z") returned 3 [0044.418] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.418] lstrlenW (lpString=".dbf") returned 4 [0044.418] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.418] lstrlenW (lpString=".1cd") returned 4 [0044.418] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.418] lstrlenW (lpString=".jpg") returned 4 [0044.418] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.418] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0044.418] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.419] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=25234) returned 1 [0044.419] CloseHandle (hObject=0x1f4) returned 1 [0044.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0044.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.422] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.422] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.422] GetLastError () returned 0x0 [0044.422] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6292, lpOverlapped=0x0) returned 1 [0044.425] WriteFile (in: hFile=0x198, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0044.426] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0044.426] WriteFile (in: hFile=0x198, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.426] SetEndOfFile (hFile=0x198) returned 1 [0044.426] CloseHandle (hObject=0x198) returned 1 [0044.426] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.426] SetEndOfFile (hFile=0x1f4) returned 1 [0044.427] CloseHandle (hObject=0x1f4) returned 1 [0044.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0044.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0044.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.428] lstrlenW (lpString=".doc") returned 4 [0044.428] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.428] lstrlenW (lpString=".docx") returned 5 [0044.428] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.428] lstrlenW (lpString=".pdf") returned 4 [0044.428] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.428] lstrlenW (lpString=".xls") returned 4 [0044.428] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.428] lstrlenW (lpString=".xlsx") returned 5 [0044.428] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.428] lstrlenW (lpString=".ppt") returned 4 [0044.428] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.428] lstrlenW (lpString=".zip") returned 4 [0044.428] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.428] lstrlenW (lpString=".rar") returned 4 [0044.428] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.428] lstrlenW (lpString=".bz2") returned 4 [0044.428] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.428] lstrlenW (lpString=".7z") returned 3 [0044.428] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString=".dbf") returned 4 [0044.429] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString=".1cd") returned 4 [0044.429] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString=".jpg") returned 4 [0044.429] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString=".doc") returned 4 [0044.429] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString=".docx") returned 5 [0044.429] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.429] lstrlenW (lpString=".pdf") returned 4 [0044.429] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString=".xls") returned 4 [0044.429] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.429] lstrlenW (lpString=".xlsx") returned 5 [0044.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.429] lstrlenW (lpString=".ppt") returned 4 [0044.429] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.429] lstrlenW (lpString=".zip") returned 4 [0044.429] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.429] lstrlenW (lpString=".rar") returned 4 [0044.429] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.429] lstrlenW (lpString=".bz2") returned 4 [0044.429] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.429] lstrlenW (lpString=".7z") returned 3 [0044.429] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.430] lstrlenW (lpString=".dbf") returned 4 [0044.430] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.430] lstrlenW (lpString=".1cd") returned 4 [0044.430] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.430] lstrlenW (lpString=".jpg") returned 4 [0044.430] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.430] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0044.430] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.670] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2985) returned 1 [0045.670] CloseHandle (hObject=0x1bc) returned 1 [0045.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0045.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.670] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0045.671] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0045.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.813] GetLastError () returned 0x0 [0045.813] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xba9, lpOverlapped=0x0) returned 1 [0045.815] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0045.817] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0045.817] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.817] SetEndOfFile (hFile=0x204) returned 1 [0045.817] CloseHandle (hObject=0x204) returned 1 [0045.817] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0045.817] SetEndOfFile (hFile=0x1bc) returned 1 [0045.818] CloseHandle (hObject=0x1bc) returned 1 [0045.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0045.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.819] lstrlenW (lpString=".doc") returned 4 [0045.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.819] lstrlenW (lpString=".docx") returned 5 [0045.819] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.819] lstrlenW (lpString=".pdf") returned 4 [0045.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.819] lstrlenW (lpString=".xls") returned 4 [0045.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.819] lstrlenW (lpString=".xlsx") returned 5 [0045.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.819] lstrlenW (lpString=".ppt") returned 4 [0045.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.819] lstrlenW (lpString=".zip") returned 4 [0045.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.819] lstrlenW (lpString=".rar") returned 4 [0045.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.819] lstrlenW (lpString=".bz2") returned 4 [0045.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.819] lstrlenW (lpString=".7z") returned 3 [0045.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.819] lstrlenW (lpString=".dbf") returned 4 [0045.819] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.819] lstrlenW (lpString=".1cd") returned 4 [0045.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.820] lstrlenW (lpString=".jpg") returned 4 [0045.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.820] lstrlenW (lpString=".doc") returned 4 [0045.820] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.820] lstrlenW (lpString=".docx") returned 5 [0045.820] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.820] lstrlenW (lpString=".pdf") returned 4 [0045.820] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString=".xls") returned 4 [0045.820] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString=".xlsx") returned 5 [0045.820] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.820] lstrlenW (lpString=".ppt") returned 4 [0045.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.820] lstrlenW (lpString=".zip") returned 4 [0045.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString=".rar") returned 4 [0045.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.820] lstrlenW (lpString=".bz2") returned 4 [0045.820] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.820] lstrlenW (lpString=".7z") returned 3 [0045.820] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.820] lstrlenW (lpString=".dbf") returned 4 [0045.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.821] lstrlenW (lpString=".1cd") returned 4 [0045.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0045.821] lstrlenW (lpString=".jpg") returned 4 [0045.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.821] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.821] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.646] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=25106) returned 1 [0046.646] CloseHandle (hObject=0x1c0) returned 1 [0046.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0046.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.647] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.647] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.688] GetLastError () returned 0x0 [0046.688] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6212, lpOverlapped=0x0) returned 1 [0046.705] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6220, lpOverlapped=0x0) returned 1 [0046.706] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.706] WriteFile (in: hFile=0x204, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.706] SetEndOfFile (hFile=0x204) returned 1 [0046.707] CloseHandle (hObject=0x204) returned 1 [0046.707] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.707] SetEndOfFile (hFile=0x1c0) returned 1 [0046.708] CloseHandle (hObject=0x1c0) returned 1 [0046.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0046.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.708] lstrlenW (lpString=".doc") returned 4 [0046.708] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.708] lstrlenW (lpString=".docx") returned 5 [0046.708] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.708] lstrlenW (lpString=".pdf") returned 4 [0046.708] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.708] lstrlenW (lpString=".xls") returned 4 [0046.708] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.708] lstrlenW (lpString=".xlsx") returned 5 [0046.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.709] lstrlenW (lpString=".ppt") returned 4 [0046.709] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString=".zip") returned 4 [0046.709] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.709] lstrlenW (lpString=".rar") returned 4 [0046.709] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.709] lstrlenW (lpString=".bz2") returned 4 [0046.709] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString=".7z") returned 3 [0046.709] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString=".dbf") returned 4 [0046.709] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString=".1cd") returned 4 [0046.709] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString=".jpg") returned 4 [0046.709] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.709] lstrlenW (lpString=".doc") returned 4 [0046.709] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString=".docx") returned 5 [0046.709] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.709] lstrlenW (lpString=".pdf") returned 4 [0046.709] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.709] lstrlenW (lpString=".xls") returned 4 [0046.710] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.710] lstrlenW (lpString=".xlsx") returned 5 [0046.710] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.710] lstrlenW (lpString=".ppt") returned 4 [0046.710] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.710] lstrlenW (lpString=".zip") returned 4 [0046.710] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.710] lstrlenW (lpString=".rar") returned 4 [0046.710] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.710] lstrlenW (lpString=".bz2") returned 4 [0046.710] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.710] lstrlenW (lpString=".7z") returned 3 [0046.710] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.710] lstrlenW (lpString=".dbf") returned 4 [0046.710] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.710] lstrlenW (lpString=".1cd") returned 4 [0046.710] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0046.710] lstrlenW (lpString=".jpg") returned 4 [0046.710] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.710] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.710] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.711] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5179) returned 1 [0046.711] CloseHandle (hObject=0x1c0) returned 1 [0046.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0046.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.891] GetLastError () returned 0x0 [0046.891] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x143b, lpOverlapped=0x0) returned 1 [0046.910] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1440, lpOverlapped=0x0) returned 1 [0046.911] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.911] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.911] SetEndOfFile (hFile=0x1ec) returned 1 [0046.911] CloseHandle (hObject=0x1ec) returned 1 [0046.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.911] SetEndOfFile (hFile=0x1c0) returned 1 [0046.912] CloseHandle (hObject=0x1c0) returned 1 [0046.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.912] lstrlenW (lpString=".doc") returned 4 [0046.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.913] lstrlenW (lpString=".docx") returned 5 [0046.913] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.913] lstrlenW (lpString=".pdf") returned 4 [0046.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString=".xls") returned 4 [0046.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString=".xlsx") returned 5 [0046.913] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.913] lstrlenW (lpString=".ppt") returned 4 [0046.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.913] lstrlenW (lpString=".zip") returned 4 [0046.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString=".rar") returned 4 [0046.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString=".bz2") returned 4 [0046.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.913] lstrlenW (lpString=".7z") returned 3 [0046.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.913] lstrlenW (lpString=".dbf") returned 4 [0046.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.913] lstrlenW (lpString=".1cd") returned 4 [0046.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.913] lstrlenW (lpString=".jpg") returned 4 [0046.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.914] lstrlenW (lpString=".doc") returned 4 [0046.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.914] lstrlenW (lpString=".docx") returned 5 [0046.914] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.914] lstrlenW (lpString=".pdf") returned 4 [0046.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.914] lstrlenW (lpString=".xls") returned 4 [0046.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.914] lstrlenW (lpString=".xlsx") returned 5 [0046.914] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.914] lstrlenW (lpString=".ppt") returned 4 [0046.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.914] lstrlenW (lpString=".zip") returned 4 [0046.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.914] lstrlenW (lpString=".rar") returned 4 [0046.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.914] lstrlenW (lpString=".bz2") returned 4 [0046.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.914] lstrlenW (lpString=".7z") returned 3 [0046.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.914] lstrlenW (lpString=".dbf") returned 4 [0046.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.914] lstrlenW (lpString=".1cd") returned 4 [0046.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0046.914] lstrlenW (lpString=".jpg") returned 4 [0046.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.915] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.915] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.915] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1232) returned 1 [0046.915] CloseHandle (hObject=0x1c0) returned 1 [0046.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0046.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.916] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.916] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.923] GetLastError () returned 0x0 [0046.923] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4d0, lpOverlapped=0x0) returned 1 [0046.925] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0046.934] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.934] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.934] SetEndOfFile (hFile=0x1ec) returned 1 [0046.934] CloseHandle (hObject=0x1ec) returned 1 [0046.934] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.934] SetEndOfFile (hFile=0x1c0) returned 1 [0046.935] CloseHandle (hObject=0x1c0) returned 1 [0046.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.936] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.936] lstrlenW (lpString=".doc") returned 4 [0046.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.936] lstrlenW (lpString=".docx") returned 5 [0046.936] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.936] lstrlenW (lpString=".pdf") returned 4 [0046.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.936] lstrlenW (lpString=".xls") returned 4 [0046.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.936] lstrlenW (lpString=".xlsx") returned 5 [0046.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.936] lstrlenW (lpString=".ppt") returned 4 [0046.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.936] lstrlenW (lpString=".zip") returned 4 [0046.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.936] lstrlenW (lpString=".rar") returned 4 [0046.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.936] lstrlenW (lpString=".bz2") returned 4 [0046.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.937] lstrlenW (lpString=".7z") returned 3 [0046.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString=".dbf") returned 4 [0046.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString=".1cd") returned 4 [0046.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString=".jpg") returned 4 [0046.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString=".doc") returned 4 [0046.937] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.937] lstrlenW (lpString=".docx") returned 5 [0046.937] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.937] lstrlenW (lpString=".pdf") returned 4 [0046.937] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.937] lstrlenW (lpString=".xls") returned 4 [0046.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.937] lstrlenW (lpString=".xlsx") returned 5 [0046.937] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.937] lstrlenW (lpString=".ppt") returned 4 [0046.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.937] lstrlenW (lpString=".zip") returned 4 [0046.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.937] lstrlenW (lpString=".rar") returned 4 [0046.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.938] lstrlenW (lpString=".bz2") returned 4 [0046.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.938] lstrlenW (lpString=".7z") returned 3 [0046.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.938] lstrlenW (lpString=".dbf") returned 4 [0046.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.938] lstrlenW (lpString=".1cd") returned 4 [0046.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.938] lstrlenW (lpString=".jpg") returned 4 [0046.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.938] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0046.938] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.938] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18413) returned 1 [0046.938] CloseHandle (hObject=0x1c0) returned 1 [0046.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0046.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.939] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.939] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.939] GetLastError () returned 0x0 [0046.939] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x47ed, lpOverlapped=0x0) returned 1 [0046.968] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0046.969] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.969] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.970] SetEndOfFile (hFile=0x1ec) returned 1 [0046.970] CloseHandle (hObject=0x1ec) returned 1 [0046.970] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.970] SetEndOfFile (hFile=0x1c0) returned 1 [0046.973] CloseHandle (hObject=0x1c0) returned 1 [0046.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0046.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString=".doc") returned 4 [0046.974] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.974] lstrlenW (lpString=".docx") returned 5 [0046.974] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.974] lstrlenW (lpString=".pdf") returned 4 [0046.974] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.974] lstrlenW (lpString=".xls") returned 4 [0046.974] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.974] lstrlenW (lpString=".xlsx") returned 5 [0046.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.974] lstrlenW (lpString=".ppt") returned 4 [0046.974] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString=".zip") returned 4 [0046.974] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.974] lstrlenW (lpString=".rar") returned 4 [0046.974] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.974] lstrlenW (lpString=".bz2") returned 4 [0046.974] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.974] lstrlenW (lpString=".7z") returned 3 [0046.974] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString=".dbf") returned 4 [0046.974] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString=".1cd") returned 4 [0046.974] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.974] lstrlenW (lpString=".jpg") returned 4 [0046.974] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.975] lstrlenW (lpString=".doc") returned 4 [0046.975] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString=".docx") returned 5 [0046.975] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.975] lstrlenW (lpString=".pdf") returned 4 [0046.975] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString=".xls") returned 4 [0046.975] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.975] lstrlenW (lpString=".xlsx") returned 5 [0046.975] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.975] lstrlenW (lpString=".ppt") returned 4 [0046.975] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.975] lstrlenW (lpString=".zip") returned 4 [0046.975] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.975] lstrlenW (lpString=".rar") returned 4 [0046.975] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.975] lstrlenW (lpString=".bz2") returned 4 [0046.975] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString=".7z") returned 3 [0046.975] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.975] lstrlenW (lpString=".dbf") returned 4 [0046.975] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.975] lstrlenW (lpString=".1cd") returned 4 [0046.975] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.976] lstrlenW (lpString=".jpg") returned 4 [0046.976] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.976] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.976] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.976] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1659) returned 1 [0046.976] CloseHandle (hObject=0x1c0) returned 1 [0046.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0046.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.977] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.977] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0047.768] GetLastError () returned 0x0 [0047.769] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x67b, lpOverlapped=0x0) returned 1 [0048.027] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x680, lpOverlapped=0x0) returned 1 [0048.044] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.044] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.044] SetEndOfFile (hFile=0x1bc) returned 1 [0048.044] CloseHandle (hObject=0x1bc) returned 1 [0048.045] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.045] SetEndOfFile (hFile=0x1c0) returned 1 [0048.046] CloseHandle (hObject=0x1c0) returned 1 [0048.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0048.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.046] lstrlenW (lpString=".doc") returned 4 [0048.046] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.046] lstrlenW (lpString=".docx") returned 5 [0048.046] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.046] lstrlenW (lpString=".pdf") returned 4 [0048.046] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.046] lstrlenW (lpString=".xls") returned 4 [0048.046] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.046] lstrlenW (lpString=".xlsx") returned 5 [0048.046] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.046] lstrlenW (lpString=".ppt") returned 4 [0048.047] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString=".zip") returned 4 [0048.047] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".rar") returned 4 [0048.047] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".bz2") returned 4 [0048.047] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString=".7z") returned 3 [0048.047] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString=".dbf") returned 4 [0048.047] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString=".1cd") returned 4 [0048.047] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString=".jpg") returned 4 [0048.047] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.047] lstrlenW (lpString=".doc") returned 4 [0048.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString=".docx") returned 5 [0048.047] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.047] lstrlenW (lpString=".pdf") returned 4 [0048.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".xls") returned 4 [0048.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".xlsx") returned 5 [0048.048] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.048] lstrlenW (lpString=".ppt") returned 4 [0048.048] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.048] lstrlenW (lpString=".zip") returned 4 [0048.048] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".rar") returned 4 [0048.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".bz2") returned 4 [0048.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString=".7z") returned 3 [0048.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.048] lstrlenW (lpString=".dbf") returned 4 [0048.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.048] lstrlenW (lpString=".1cd") returned 4 [0048.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.048] lstrlenW (lpString=".jpg") returned 4 [0048.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.048] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.048] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.049] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2574) returned 1 [0048.049] CloseHandle (hObject=0x1c0) returned 1 [0048.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0048.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.049] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.049] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0048.055] GetLastError () returned 0x0 [0048.055] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa0e, lpOverlapped=0x0) returned 1 [0048.057] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa10, lpOverlapped=0x0) returned 1 [0048.058] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.058] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.058] SetEndOfFile (hFile=0x1bc) returned 1 [0048.059] CloseHandle (hObject=0x1bc) returned 1 [0048.059] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.059] SetEndOfFile (hFile=0x1c0) returned 1 [0048.060] CloseHandle (hObject=0x1c0) returned 1 [0048.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.060] lstrlenW (lpString=".doc") returned 4 [0048.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.060] lstrlenW (lpString=".docx") returned 5 [0048.060] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.060] lstrlenW (lpString=".pdf") returned 4 [0048.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.060] lstrlenW (lpString=".xls") returned 4 [0048.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.060] lstrlenW (lpString=".xlsx") returned 5 [0048.060] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.060] lstrlenW (lpString=".ppt") returned 4 [0048.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.060] lstrlenW (lpString=".zip") returned 4 [0048.061] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.061] lstrlenW (lpString=".rar") returned 4 [0048.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.061] lstrlenW (lpString=".bz2") returned 4 [0048.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.061] lstrlenW (lpString=".7z") returned 3 [0048.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.061] lstrlenW (lpString=".dbf") returned 4 [0048.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.061] lstrlenW (lpString=".1cd") returned 4 [0048.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.061] lstrlenW (lpString=".jpg") returned 4 [0048.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.061] lstrlenW (lpString=".doc") returned 4 [0048.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.061] lstrlenW (lpString=".docx") returned 5 [0048.061] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.061] lstrlenW (lpString=".pdf") returned 4 [0048.061] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.061] lstrlenW (lpString=".xls") returned 4 [0048.061] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.061] lstrlenW (lpString=".xlsx") returned 5 [0048.061] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.061] lstrlenW (lpString=".ppt") returned 4 [0048.062] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.062] lstrlenW (lpString=".zip") returned 4 [0048.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.062] lstrlenW (lpString=".rar") returned 4 [0048.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.062] lstrlenW (lpString=".bz2") returned 4 [0048.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.062] lstrlenW (lpString=".7z") returned 3 [0048.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.062] lstrlenW (lpString=".dbf") returned 4 [0048.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.062] lstrlenW (lpString=".1cd") returned 4 [0048.062] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.062] lstrlenW (lpString=".jpg") returned 4 [0048.062] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.062] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.062] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.063] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=37440) returned 1 [0048.063] CloseHandle (hObject=0x1c0) returned 1 [0048.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0048.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.063] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.063] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0048.064] GetLastError () returned 0x0 [0048.064] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x9240, lpOverlapped=0x0) returned 1 [0048.066] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x9250, lpOverlapped=0x0) returned 1 [0048.068] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.068] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.068] SetEndOfFile (hFile=0x1bc) returned 1 [0048.068] CloseHandle (hObject=0x1bc) returned 1 [0048.068] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.068] SetEndOfFile (hFile=0x1c0) returned 1 [0048.069] CloseHandle (hObject=0x1c0) returned 1 [0048.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0048.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.070] lstrlenW (lpString=".doc") returned 4 [0048.070] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.070] lstrlenW (lpString=".docx") returned 5 [0048.070] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.070] lstrlenW (lpString=".pdf") returned 4 [0048.070] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.070] lstrlenW (lpString=".xls") returned 4 [0048.071] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.071] lstrlenW (lpString=".xlsx") returned 5 [0048.071] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.071] lstrlenW (lpString=".ppt") returned 4 [0048.071] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString=".zip") returned 4 [0048.071] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.071] lstrlenW (lpString=".rar") returned 4 [0048.071] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.071] lstrlenW (lpString=".bz2") returned 4 [0048.071] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.071] lstrlenW (lpString=".7z") returned 3 [0048.071] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString=".dbf") returned 4 [0048.071] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString=".1cd") returned 4 [0048.071] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString=".jpg") returned 4 [0048.071] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.071] lstrlenW (lpString=".doc") returned 4 [0048.071] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.071] lstrlenW (lpString=".docx") returned 5 [0048.071] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.072] lstrlenW (lpString=".pdf") returned 4 [0048.072] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.072] lstrlenW (lpString=".xls") returned 4 [0048.072] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.072] lstrlenW (lpString=".xlsx") returned 5 [0048.072] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.072] lstrlenW (lpString=".ppt") returned 4 [0048.072] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.072] lstrlenW (lpString=".zip") returned 4 [0048.072] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.072] lstrlenW (lpString=".rar") returned 4 [0048.072] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.072] lstrlenW (lpString=".bz2") returned 4 [0048.072] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.072] lstrlenW (lpString=".7z") returned 3 [0048.072] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.072] lstrlenW (lpString=".dbf") returned 4 [0048.072] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.072] lstrlenW (lpString=".1cd") returned 4 [0048.072] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.072] lstrlenW (lpString=".jpg") returned 4 [0048.072] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.072] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.072] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.073] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1593) returned 1 [0048.073] CloseHandle (hObject=0x1c0) returned 1 [0048.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0048.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.074] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.074] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0048.086] GetLastError () returned 0x0 [0048.086] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x639, lpOverlapped=0x0) returned 1 [0048.088] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x640, lpOverlapped=0x0) returned 1 [0048.089] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.089] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.089] SetEndOfFile (hFile=0x1bc) returned 1 [0048.089] CloseHandle (hObject=0x1bc) returned 1 [0048.089] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.089] SetEndOfFile (hFile=0x1c0) returned 1 [0048.090] CloseHandle (hObject=0x1c0) returned 1 [0048.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0048.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.091] lstrlenW (lpString=".doc") returned 4 [0048.091] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.091] lstrlenW (lpString=".docx") returned 5 [0048.091] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.091] lstrlenW (lpString=".pdf") returned 4 [0048.091] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.091] lstrlenW (lpString=".xls") returned 4 [0048.091] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.091] lstrlenW (lpString=".xlsx") returned 5 [0048.091] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.091] lstrlenW (lpString=".ppt") returned 4 [0048.091] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.091] lstrlenW (lpString=".zip") returned 4 [0048.091] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.091] lstrlenW (lpString=".rar") returned 4 [0048.091] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.091] lstrlenW (lpString=".bz2") returned 4 [0048.091] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.091] lstrlenW (lpString=".7z") returned 3 [0048.091] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.091] lstrlenW (lpString=".dbf") returned 4 [0048.092] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.092] lstrlenW (lpString=".1cd") returned 4 [0048.092] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.092] lstrlenW (lpString=".jpg") returned 4 [0048.092] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.092] lstrlenW (lpString=".doc") returned 4 [0048.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.092] lstrlenW (lpString=".docx") returned 5 [0048.092] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.092] lstrlenW (lpString=".pdf") returned 4 [0048.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString=".xls") returned 4 [0048.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString=".xlsx") returned 5 [0048.092] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.092] lstrlenW (lpString=".ppt") returned 4 [0048.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.092] lstrlenW (lpString=".zip") returned 4 [0048.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString=".rar") returned 4 [0048.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.092] lstrlenW (lpString=".bz2") returned 4 [0048.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.092] lstrlenW (lpString=".7z") returned 3 [0048.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.093] lstrlenW (lpString=".dbf") returned 4 [0048.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.093] lstrlenW (lpString=".1cd") returned 4 [0048.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.093] lstrlenW (lpString=".jpg") returned 4 [0048.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.093] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.093] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.248] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=21745) returned 1 [0048.248] CloseHandle (hObject=0x204) returned 1 [0048.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0048.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.248] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.248] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.249] GetLastError () returned 0x0 [0048.249] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x54f1, lpOverlapped=0x0) returned 1 [0048.251] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5500, lpOverlapped=0x0) returned 1 [0048.253] ReadFile (in: hFile=0x204, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.253] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.253] SetEndOfFile (hFile=0x1f8) returned 1 [0048.253] CloseHandle (hObject=0x1f8) returned 1 [0048.253] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.253] SetEndOfFile (hFile=0x204) returned 1 [0048.254] CloseHandle (hObject=0x204) returned 1 [0048.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0048.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.255] lstrlenW (lpString=".doc") returned 4 [0048.255] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.255] lstrlenW (lpString=".docx") returned 5 [0048.255] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.255] lstrlenW (lpString=".pdf") returned 4 [0048.255] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.255] lstrlenW (lpString=".xls") returned 4 [0048.255] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.255] lstrlenW (lpString=".xlsx") returned 5 [0048.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.255] lstrlenW (lpString=".ppt") returned 4 [0048.255] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.255] lstrlenW (lpString=".zip") returned 4 [0048.256] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.256] lstrlenW (lpString=".rar") returned 4 [0048.256] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.256] lstrlenW (lpString=".bz2") returned 4 [0048.256] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString=".7z") returned 3 [0048.256] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.256] lstrlenW (lpString=".dbf") returned 4 [0048.256] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.256] lstrlenW (lpString=".1cd") returned 4 [0048.256] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.256] lstrlenW (lpString=".jpg") returned 4 [0048.256] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.256] lstrlenW (lpString=".doc") returned 4 [0048.256] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString=".docx") returned 5 [0048.256] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.256] lstrlenW (lpString=".pdf") returned 4 [0048.256] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.256] lstrlenW (lpString=".xls") returned 4 [0048.256] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.256] lstrlenW (lpString=".xlsx") returned 5 [0048.256] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.256] lstrlenW (lpString=".ppt") returned 4 [0048.256] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.257] lstrlenW (lpString=".zip") returned 4 [0048.257] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.257] lstrlenW (lpString=".rar") returned 4 [0048.257] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.257] lstrlenW (lpString=".bz2") returned 4 [0048.257] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.257] lstrlenW (lpString=".7z") returned 3 [0048.257] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.257] lstrlenW (lpString=".dbf") returned 4 [0048.257] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.257] lstrlenW (lpString=".1cd") returned 4 [0048.257] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.257] lstrlenW (lpString=".jpg") returned 4 [0048.257] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.257] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.257] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.936] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16738) returned 1 [0048.942] CloseHandle (hObject=0x1ec) returned 1 [0048.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0048.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.944] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.970] GetLastError () returned 0x0 [0048.970] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4162, lpOverlapped=0x0) returned 1 [0048.972] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4170, lpOverlapped=0x0) returned 1 [0048.973] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.973] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.974] SetEndOfFile (hFile=0x218) returned 1 [0048.974] CloseHandle (hObject=0x218) returned 1 [0048.974] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.974] SetEndOfFile (hFile=0x1fc) returned 1 [0048.975] CloseHandle (hObject=0x1fc) returned 1 [0048.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0048.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.976] lstrlenW (lpString=".doc") returned 4 [0048.976] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.976] lstrlenW (lpString=".docx") returned 5 [0048.976] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.976] lstrlenW (lpString=".pdf") returned 4 [0048.976] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.976] lstrlenW (lpString=".xls") returned 4 [0048.976] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.976] lstrlenW (lpString=".xlsx") returned 5 [0048.976] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.976] lstrlenW (lpString=".ppt") returned 4 [0048.976] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString=".zip") returned 4 [0048.977] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.977] lstrlenW (lpString=".rar") returned 4 [0048.977] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.977] lstrlenW (lpString=".bz2") returned 4 [0048.977] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString=".7z") returned 3 [0048.977] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString=".dbf") returned 4 [0048.977] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString=".1cd") returned 4 [0048.977] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString=".jpg") returned 4 [0048.977] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.977] lstrlenW (lpString=".doc") returned 4 [0048.977] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString=".docx") returned 5 [0048.977] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.977] lstrlenW (lpString=".pdf") returned 4 [0048.977] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString=".xls") returned 4 [0048.977] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.977] lstrlenW (lpString=".xlsx") returned 5 [0048.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.977] lstrlenW (lpString=".ppt") returned 4 [0048.978] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.978] lstrlenW (lpString=".zip") returned 4 [0048.978] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString=".rar") returned 4 [0048.978] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString=".bz2") returned 4 [0048.978] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString=".7z") returned 3 [0048.978] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.978] lstrlenW (lpString=".dbf") returned 4 [0048.978] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.978] lstrlenW (lpString=".1cd") returned 4 [0048.978] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.978] lstrlenW (lpString=".jpg") returned 4 [0048.978] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.978] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.978] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.979] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3611) returned 1 [0048.979] CloseHandle (hObject=0x1fc) returned 1 [0048.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0048.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.979] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.979] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.991] GetLastError () returned 0x0 [0048.991] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe1b, lpOverlapped=0x0) returned 1 [0048.993] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe20, lpOverlapped=0x0) returned 1 [0048.994] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.994] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.994] SetEndOfFile (hFile=0x218) returned 1 [0048.994] CloseHandle (hObject=0x218) returned 1 [0048.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.995] SetEndOfFile (hFile=0x1fc) returned 1 [0048.996] CloseHandle (hObject=0x1fc) returned 1 [0048.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.996] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0048.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.996] lstrlenW (lpString=".doc") returned 4 [0048.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.996] lstrlenW (lpString=".docx") returned 5 [0048.996] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.996] lstrlenW (lpString=".pdf") returned 4 [0048.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.996] lstrlenW (lpString=".xls") returned 4 [0048.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.996] lstrlenW (lpString=".xlsx") returned 5 [0048.996] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.996] lstrlenW (lpString=".ppt") returned 4 [0048.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.996] lstrlenW (lpString=".zip") returned 4 [0048.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.997] lstrlenW (lpString=".rar") returned 4 [0048.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.997] lstrlenW (lpString=".bz2") returned 4 [0048.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.997] lstrlenW (lpString=".7z") returned 3 [0048.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.997] lstrlenW (lpString=".dbf") returned 4 [0048.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.997] lstrlenW (lpString=".1cd") returned 4 [0048.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.997] lstrlenW (lpString=".jpg") returned 4 [0048.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.997] lstrlenW (lpString=".doc") returned 4 [0048.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.997] lstrlenW (lpString=".docx") returned 5 [0048.997] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.997] lstrlenW (lpString=".pdf") returned 4 [0048.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.997] lstrlenW (lpString=".xls") returned 4 [0048.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.997] lstrlenW (lpString=".xlsx") returned 5 [0048.997] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.997] lstrlenW (lpString=".ppt") returned 4 [0048.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.998] lstrlenW (lpString=".zip") returned 4 [0048.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.998] lstrlenW (lpString=".rar") returned 4 [0048.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.998] lstrlenW (lpString=".bz2") returned 4 [0048.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.998] lstrlenW (lpString=".7z") returned 3 [0048.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.998] lstrlenW (lpString=".dbf") returned 4 [0048.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.998] lstrlenW (lpString=".1cd") returned 4 [0048.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.998] lstrlenW (lpString=".jpg") returned 4 [0048.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.998] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.998] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.999] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=34163) returned 1 [0048.999] CloseHandle (hObject=0x1fc) returned 1 [0048.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0048.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.999] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.999] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.999] GetLastError () returned 0x0 [0048.999] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8573, lpOverlapped=0x0) returned 1 [0049.002] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8580, lpOverlapped=0x0) returned 1 [0049.003] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.003] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.003] SetEndOfFile (hFile=0x218) returned 1 [0049.004] CloseHandle (hObject=0x218) returned 1 [0049.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.004] SetEndOfFile (hFile=0x1fc) returned 1 [0049.005] CloseHandle (hObject=0x1fc) returned 1 [0049.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0049.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.005] lstrlenW (lpString=".doc") returned 4 [0049.005] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.005] lstrlenW (lpString=".docx") returned 5 [0049.005] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.005] lstrlenW (lpString=".pdf") returned 4 [0049.005] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.005] lstrlenW (lpString=".xls") returned 4 [0049.005] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.006] lstrlenW (lpString=".xlsx") returned 5 [0049.006] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.006] lstrlenW (lpString=".ppt") returned 4 [0049.006] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString=".zip") returned 4 [0049.006] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.006] lstrlenW (lpString=".rar") returned 4 [0049.006] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.006] lstrlenW (lpString=".bz2") returned 4 [0049.006] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString=".7z") returned 3 [0049.006] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString=".dbf") returned 4 [0049.006] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString=".1cd") returned 4 [0049.006] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString=".jpg") returned 4 [0049.006] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.006] lstrlenW (lpString=".doc") returned 4 [0049.006] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString=".docx") returned 5 [0049.006] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.006] lstrlenW (lpString=".pdf") returned 4 [0049.006] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.006] lstrlenW (lpString=".xls") returned 4 [0049.006] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.007] lstrlenW (lpString=".xlsx") returned 5 [0049.007] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.007] lstrlenW (lpString=".ppt") returned 4 [0049.007] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.007] lstrlenW (lpString=".zip") returned 4 [0049.007] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.007] lstrlenW (lpString=".rar") returned 4 [0049.007] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.007] lstrlenW (lpString=".bz2") returned 4 [0049.007] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.007] lstrlenW (lpString=".7z") returned 3 [0049.007] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.007] lstrlenW (lpString=".dbf") returned 4 [0049.007] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.007] lstrlenW (lpString=".1cd") returned 4 [0049.007] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.007] lstrlenW (lpString=".jpg") returned 4 [0049.007] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.007] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.007] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.008] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=937) returned 1 [0049.008] CloseHandle (hObject=0x1fc) returned 1 [0049.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0049.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.008] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.008] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.290] GetLastError () returned 0x0 [0049.290] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3a9, lpOverlapped=0x0) returned 1 [0049.291] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0049.292] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.292] SetEndOfFile (hFile=0x188) returned 1 [0049.293] CloseHandle (hObject=0x188) returned 1 [0049.293] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.293] SetEndOfFile (hFile=0x1fc) returned 1 [0049.294] CloseHandle (hObject=0x1fc) returned 1 [0049.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.294] lstrlenW (lpString=".doc") returned 4 [0049.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.294] lstrlenW (lpString=".docx") returned 5 [0049.294] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.294] lstrlenW (lpString=".pdf") returned 4 [0049.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.294] lstrlenW (lpString=".xls") returned 4 [0049.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.294] lstrlenW (lpString=".xlsx") returned 5 [0049.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.294] lstrlenW (lpString=".ppt") returned 4 [0049.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString=".zip") returned 4 [0049.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString=".rar") returned 4 [0049.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString=".bz2") returned 4 [0049.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.295] lstrlenW (lpString=".7z") returned 3 [0049.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString=".dbf") returned 4 [0049.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString=".1cd") returned 4 [0049.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString=".jpg") returned 4 [0049.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.295] lstrlenW (lpString=".doc") returned 4 [0049.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.295] lstrlenW (lpString=".docx") returned 5 [0049.295] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.295] lstrlenW (lpString=".pdf") returned 4 [0049.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString=".xls") returned 4 [0049.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString=".xlsx") returned 5 [0049.295] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.295] lstrlenW (lpString=".ppt") returned 4 [0049.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.296] lstrlenW (lpString=".zip") returned 4 [0049.296] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.296] lstrlenW (lpString=".rar") returned 4 [0049.296] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.296] lstrlenW (lpString=".bz2") returned 4 [0049.296] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.296] lstrlenW (lpString=".7z") returned 3 [0049.296] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.296] lstrlenW (lpString=".dbf") returned 4 [0049.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.296] lstrlenW (lpString=".1cd") returned 4 [0049.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.296] lstrlenW (lpString=".jpg") returned 4 [0049.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.296] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.296] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.297] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1675) returned 1 [0049.297] CloseHandle (hObject=0x1fc) returned 1 [0049.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0049.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.299] GetLastError () returned 0x0 [0049.299] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x68b, lpOverlapped=0x0) returned 1 [0049.300] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x690, lpOverlapped=0x0) returned 1 [0049.301] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.302] SetEndOfFile (hFile=0x188) returned 1 [0049.302] CloseHandle (hObject=0x188) returned 1 [0049.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.302] SetEndOfFile (hFile=0x1fc) returned 1 [0049.303] CloseHandle (hObject=0x1fc) returned 1 [0049.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0049.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.303] lstrlenW (lpString=".doc") returned 4 [0049.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.303] lstrlenW (lpString=".docx") returned 5 [0049.303] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.303] lstrlenW (lpString=".pdf") returned 4 [0049.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.303] lstrlenW (lpString=".xls") returned 4 [0049.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.303] lstrlenW (lpString=".xlsx") returned 5 [0049.304] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.304] lstrlenW (lpString=".ppt") returned 4 [0049.304] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString=".zip") returned 4 [0049.304] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString=".rar") returned 4 [0049.304] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString=".bz2") returned 4 [0049.304] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.304] lstrlenW (lpString=".7z") returned 3 [0049.304] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString=".dbf") returned 4 [0049.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString=".1cd") returned 4 [0049.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString=".jpg") returned 4 [0049.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.304] lstrlenW (lpString=".doc") returned 4 [0049.304] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.304] lstrlenW (lpString=".docx") returned 5 [0049.304] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.304] lstrlenW (lpString=".pdf") returned 4 [0049.304] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString=".xls") returned 4 [0049.304] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.304] lstrlenW (lpString=".xlsx") returned 5 [0049.304] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.305] lstrlenW (lpString=".ppt") returned 4 [0049.305] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.305] lstrlenW (lpString=".zip") returned 4 [0049.305] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.305] lstrlenW (lpString=".rar") returned 4 [0049.305] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.305] lstrlenW (lpString=".bz2") returned 4 [0049.305] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.305] lstrlenW (lpString=".7z") returned 3 [0049.305] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.305] lstrlenW (lpString=".dbf") returned 4 [0049.305] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.305] lstrlenW (lpString=".1cd") returned 4 [0049.305] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.305] lstrlenW (lpString=".jpg") returned 4 [0049.305] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.305] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0049.305] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.306] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18380) returned 1 [0049.306] CloseHandle (hObject=0x1fc) returned 1 [0049.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0049.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.306] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.306] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.306] GetLastError () returned 0x0 [0049.306] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x47cc, lpOverlapped=0x0) returned 1 [0049.309] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0049.310] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.310] SetEndOfFile (hFile=0x188) returned 1 [0049.310] CloseHandle (hObject=0x188) returned 1 [0049.310] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.310] SetEndOfFile (hFile=0x1fc) returned 1 [0049.311] CloseHandle (hObject=0x1fc) returned 1 [0049.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0049.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.312] lstrlenW (lpString=".doc") returned 4 [0049.312] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.312] lstrlenW (lpString=".docx") returned 5 [0049.312] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.312] lstrlenW (lpString=".pdf") returned 4 [0049.312] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.312] lstrlenW (lpString=".xls") returned 4 [0049.312] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.312] lstrlenW (lpString=".xlsx") returned 5 [0049.312] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.312] lstrlenW (lpString=".ppt") returned 4 [0049.312] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.312] lstrlenW (lpString=".zip") returned 4 [0049.312] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.312] lstrlenW (lpString=".rar") returned 4 [0049.312] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.312] lstrlenW (lpString=".bz2") returned 4 [0049.312] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.312] lstrlenW (lpString=".7z") returned 3 [0049.312] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.312] lstrlenW (lpString=".dbf") returned 4 [0049.312] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString=".1cd") returned 4 [0049.313] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString=".jpg") returned 4 [0049.313] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString=".doc") returned 4 [0049.313] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString=".docx") returned 5 [0049.313] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.313] lstrlenW (lpString=".pdf") returned 4 [0049.313] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString=".xls") returned 4 [0049.313] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.313] lstrlenW (lpString=".xlsx") returned 5 [0049.313] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.313] lstrlenW (lpString=".ppt") returned 4 [0049.313] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString=".zip") returned 4 [0049.313] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.313] lstrlenW (lpString=".rar") returned 4 [0049.313] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.313] lstrlenW (lpString=".bz2") returned 4 [0049.313] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.313] lstrlenW (lpString=".7z") returned 3 [0049.313] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.313] lstrlenW (lpString=".dbf") returned 4 [0049.313] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.314] lstrlenW (lpString=".1cd") returned 4 [0049.314] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.314] lstrlenW (lpString=".jpg") returned 4 [0049.314] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.314] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.314] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.314] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4991) returned 1 [0049.314] CloseHandle (hObject=0x1fc) returned 1 [0049.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0049.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.316] GetLastError () returned 0x0 [0049.316] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x137f, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1380, lpOverlapped=0x0) returned 1 [0049.319] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.320] SetEndOfFile (hFile=0x188) returned 1 [0049.320] CloseHandle (hObject=0x188) returned 1 [0049.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.320] SetEndOfFile (hFile=0x1fc) returned 1 [0049.321] CloseHandle (hObject=0x1fc) returned 1 [0049.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.321] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.321] lstrlenW (lpString=".doc") returned 4 [0049.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.321] lstrlenW (lpString=".docx") returned 5 [0049.321] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.321] lstrlenW (lpString=".pdf") returned 4 [0049.321] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.321] lstrlenW (lpString=".xls") returned 4 [0049.321] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.321] lstrlenW (lpString=".xlsx") returned 5 [0049.321] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.321] lstrlenW (lpString=".ppt") returned 4 [0049.321] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString=".zip") returned 4 [0049.322] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.322] lstrlenW (lpString=".rar") returned 4 [0049.322] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.322] lstrlenW (lpString=".bz2") returned 4 [0049.322] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.322] lstrlenW (lpString=".7z") returned 3 [0049.322] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString=".dbf") returned 4 [0049.322] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString=".1cd") returned 4 [0049.322] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString=".jpg") returned 4 [0049.322] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.322] lstrlenW (lpString=".doc") returned 4 [0049.322] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.322] lstrlenW (lpString=".docx") returned 5 [0049.322] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.322] lstrlenW (lpString=".pdf") returned 4 [0049.322] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.322] lstrlenW (lpString=".xls") returned 4 [0049.322] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.323] lstrlenW (lpString=".xlsx") returned 5 [0049.323] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.323] lstrlenW (lpString=".ppt") returned 4 [0049.323] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.323] lstrlenW (lpString=".zip") returned 4 [0049.323] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.323] lstrlenW (lpString=".rar") returned 4 [0049.323] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.323] lstrlenW (lpString=".bz2") returned 4 [0049.323] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.323] lstrlenW (lpString=".7z") returned 3 [0049.323] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.323] lstrlenW (lpString=".dbf") returned 4 [0049.323] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.323] lstrlenW (lpString=".1cd") returned 4 [0049.323] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.323] lstrlenW (lpString=".jpg") returned 4 [0049.323] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.323] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0049.323] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.324] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=44302) returned 1 [0049.324] CloseHandle (hObject=0x1fc) returned 1 [0049.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0049.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.324] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.324] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.324] GetLastError () returned 0x0 [0049.324] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xad0e, lpOverlapped=0x0) returned 1 [0049.580] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xad10, lpOverlapped=0x0) returned 1 [0049.911] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.911] WriteFile (in: hFile=0x188, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.911] SetEndOfFile (hFile=0x188) returned 1 [0049.911] CloseHandle (hObject=0x188) returned 1 [0049.911] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.911] SetEndOfFile (hFile=0x1fc) returned 1 [0049.912] CloseHandle (hObject=0x1fc) returned 1 [0049.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0049.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.912] lstrlenW (lpString=".doc") returned 4 [0049.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".docx") returned 5 [0049.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.913] lstrlenW (lpString=".pdf") returned 4 [0049.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".xls") returned 4 [0049.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".xlsx") returned 5 [0049.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.913] lstrlenW (lpString=".ppt") returned 4 [0049.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString=".zip") returned 4 [0049.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".rar") returned 4 [0049.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".bz2") returned 4 [0049.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".7z") returned 3 [0049.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString=".dbf") returned 4 [0049.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString=".1cd") returned 4 [0049.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString=".jpg") returned 4 [0049.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.913] lstrlenW (lpString=".doc") returned 4 [0049.914] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".docx") returned 5 [0049.914] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.914] lstrlenW (lpString=".pdf") returned 4 [0049.914] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".xls") returned 4 [0049.914] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".xlsx") returned 5 [0049.914] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.914] lstrlenW (lpString=".ppt") returned 4 [0049.914] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.914] lstrlenW (lpString=".zip") returned 4 [0049.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".rar") returned 4 [0049.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".bz2") returned 4 [0049.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".7z") returned 3 [0049.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.914] lstrlenW (lpString=".dbf") returned 4 [0049.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.914] lstrlenW (lpString=".1cd") returned 4 [0049.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.914] lstrlenW (lpString=".jpg") returned 4 [0049.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.914] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0049.915] lstrlenW (lpString="VBLR6.CHM") returned 9 [0049.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.008] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=944994) returned 1 [0050.008] CloseHandle (hObject=0x208) returned 1 [0050.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0050.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.008] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.008] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.022] GetLastError () returned 0x0 [0050.022] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0050.059] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0050.327] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.328] SetEndOfFile (hFile=0x1f0) returned 1 [0050.328] CloseHandle (hObject=0x1f0) returned 1 [0050.328] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.328] SetEndOfFile (hFile=0x208) returned 1 [0050.336] CloseHandle (hObject=0x208) returned 1 [0050.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0050.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.336] lstrlenW (lpString=".doc") returned 4 [0050.336] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.336] lstrlenW (lpString=".docx") returned 5 [0050.336] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.336] lstrlenW (lpString=".pdf") returned 4 [0050.336] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.336] lstrlenW (lpString=".xls") returned 4 [0050.336] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString=".xlsx") returned 5 [0050.337] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.337] lstrlenW (lpString=".ppt") returned 4 [0050.337] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString=".zip") returned 4 [0050.337] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString=".rar") returned 4 [0050.337] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString=".bz2") returned 4 [0050.337] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.337] lstrlenW (lpString=".7z") returned 3 [0050.337] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString=".dbf") returned 4 [0050.337] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString=".1cd") returned 4 [0050.337] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString=".jpg") returned 4 [0050.337] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.337] lstrlenW (lpString=".doc") returned 4 [0050.337] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString=".docx") returned 5 [0050.337] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.337] lstrlenW (lpString=".pdf") returned 4 [0050.337] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.337] lstrlenW (lpString=".xls") returned 4 [0050.338] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.338] lstrlenW (lpString=".xlsx") returned 5 [0050.338] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.338] lstrlenW (lpString=".ppt") returned 4 [0050.338] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.338] lstrlenW (lpString=".zip") returned 4 [0050.338] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.338] lstrlenW (lpString=".rar") returned 4 [0050.338] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.338] lstrlenW (lpString=".bz2") returned 4 [0050.338] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.338] lstrlenW (lpString=".7z") returned 3 [0050.338] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.338] lstrlenW (lpString=".dbf") returned 4 [0050.338] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.338] lstrlenW (lpString=".1cd") returned 4 [0050.338] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.338] lstrlenW (lpString=".jpg") returned 4 [0050.338] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.338] lstrcmpiW (lpString1=".inc", lpString2=".zoh") returned -1 [0050.338] lstrlenW (lpString="adovbs.inc") returned 10 [0050.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.641] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14951) returned 1 [0050.641] CloseHandle (hObject=0x1f4) returned 1 [0050.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0050.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.641] lstrlenW (lpString=".doc") returned 4 [0050.641] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.641] lstrlenW (lpString=".docx") returned 5 [0050.641] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.641] lstrlenW (lpString=".pdf") returned 4 [0050.641] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.641] lstrlenW (lpString=".xls") returned 4 [0050.641] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString=".xlsx") returned 5 [0050.642] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.642] lstrlenW (lpString=".ppt") returned 4 [0050.642] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString=".zip") returned 4 [0050.642] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString=".rar") returned 4 [0050.642] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString=".bz2") returned 4 [0050.642] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.642] lstrlenW (lpString=".7z") returned 3 [0050.642] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString=".dbf") returned 4 [0050.642] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString=".1cd") returned 4 [0050.642] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString=".jpg") returned 4 [0050.642] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.642] lstrlenW (lpString=".doc") returned 4 [0050.642] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.642] lstrlenW (lpString=".docx") returned 5 [0050.642] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.642] lstrlenW (lpString=".pdf") returned 4 [0050.642] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString=".xls") returned 4 [0050.642] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.642] lstrlenW (lpString=".xlsx") returned 5 [0050.643] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.643] lstrlenW (lpString=".ppt") returned 4 [0050.643] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.643] lstrlenW (lpString=".zip") returned 4 [0050.643] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.643] lstrlenW (lpString=".rar") returned 4 [0050.643] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.643] lstrlenW (lpString=".bz2") returned 4 [0050.643] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.643] lstrlenW (lpString=".7z") returned 3 [0050.643] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.643] lstrlenW (lpString=".dbf") returned 4 [0050.643] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.643] lstrlenW (lpString=".1cd") returned 4 [0050.643] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.643] lstrlenW (lpString=".jpg") returned 4 [0050.643] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.643] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0050.643] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0050.643] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.795] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3467) returned 1 [0050.807] CloseHandle (hObject=0x1f0) returned 1 [0050.810] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0050.817] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.823] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.823] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.823] lstrlenW (lpString=".doc") returned 4 [0050.823] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.823] lstrlenW (lpString=".docx") returned 5 [0050.823] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0050.823] lstrlenW (lpString=".pdf") returned 4 [0050.823] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.823] lstrlenW (lpString=".xls") returned 4 [0050.823] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.823] lstrlenW (lpString=".xlsx") returned 5 [0050.823] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0050.823] lstrlenW (lpString=".ppt") returned 4 [0050.823] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.823] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.823] lstrlenW (lpString=".zip") returned 4 [0050.823] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.823] lstrlenW (lpString=".rar") returned 4 [0050.823] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.823] lstrlenW (lpString=".bz2") returned 4 [0050.823] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.823] lstrlenW (lpString=".7z") returned 3 [0050.823] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.823] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.823] lstrlenW (lpString=".dbf") returned 4 [0050.824] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString=".1cd") returned 4 [0050.824] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString=".jpg") returned 4 [0050.824] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString=".doc") returned 4 [0050.824] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString=".docx") returned 5 [0050.824] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0050.824] lstrlenW (lpString=".pdf") returned 4 [0050.824] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString=".xls") returned 4 [0050.824] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.824] lstrlenW (lpString=".xlsx") returned 5 [0050.824] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0050.824] lstrlenW (lpString=".ppt") returned 4 [0050.824] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString=".zip") returned 4 [0050.824] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.824] lstrlenW (lpString=".rar") returned 4 [0050.824] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.824] lstrlenW (lpString=".bz2") returned 4 [0050.824] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.824] lstrlenW (lpString=".7z") returned 3 [0050.824] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.824] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.824] lstrlenW (lpString=".dbf") returned 4 [0050.824] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.825] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.825] lstrlenW (lpString=".1cd") returned 4 [0050.825] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.825] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0050.825] lstrlenW (lpString=".jpg") returned 4 [0050.825] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.825] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0050.825] lstrlenW (lpString="content-background.png") returned 22 [0050.825] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0051.383] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=581394) returned 1 [0051.383] CloseHandle (hObject=0x1bc) returned 1 [0051.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0051.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.383] lstrlenW (lpString=".doc") returned 4 [0051.384] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString=".docx") returned 5 [0051.384] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0051.384] lstrlenW (lpString=".pdf") returned 4 [0051.384] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString=".xls") returned 4 [0051.384] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.384] lstrlenW (lpString=".xlsx") returned 5 [0051.384] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0051.384] lstrlenW (lpString=".ppt") returned 4 [0051.384] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString=".zip") returned 4 [0051.384] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.384] lstrlenW (lpString=".rar") returned 4 [0051.384] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.384] lstrlenW (lpString=".bz2") returned 4 [0051.384] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString=".7z") returned 3 [0051.384] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString=".dbf") returned 4 [0051.384] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString=".1cd") returned 4 [0051.384] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString=".jpg") returned 4 [0051.384] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.384] lstrlenW (lpString=".doc") returned 4 [0051.385] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.385] lstrlenW (lpString=".docx") returned 5 [0051.385] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0051.385] lstrlenW (lpString=".pdf") returned 4 [0051.385] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.385] lstrlenW (lpString=".xls") returned 4 [0051.385] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.385] lstrlenW (lpString=".xlsx") returned 5 [0051.385] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0051.385] lstrlenW (lpString=".ppt") returned 4 [0051.385] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.385] lstrlenW (lpString=".zip") returned 4 [0051.385] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.385] lstrlenW (lpString=".rar") returned 4 [0051.385] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.385] lstrlenW (lpString=".bz2") returned 4 [0051.385] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.385] lstrlenW (lpString=".7z") returned 3 [0051.385] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.385] lstrlenW (lpString=".dbf") returned 4 [0051.385] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.385] lstrlenW (lpString=".1cd") returned 4 [0051.385] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0051.385] lstrlenW (lpString=".jpg") returned 4 [0051.385] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.385] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0051.386] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0051.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0051.507] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4955) returned 1 [0051.509] CloseHandle (hObject=0x1c0) returned 1 [0051.512] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0051.527] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.533] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString=".doc") returned 4 [0051.534] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.534] lstrlenW (lpString=".docx") returned 5 [0051.534] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.534] lstrlenW (lpString=".pdf") returned 4 [0051.534] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.534] lstrlenW (lpString=".xls") returned 4 [0051.534] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.534] lstrlenW (lpString=".xlsx") returned 5 [0051.534] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.534] lstrlenW (lpString=".ppt") returned 4 [0051.534] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString=".zip") returned 4 [0051.534] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.534] lstrlenW (lpString=".rar") returned 4 [0051.534] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.534] lstrlenW (lpString=".bz2") returned 4 [0051.534] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.534] lstrlenW (lpString=".7z") returned 3 [0051.534] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString=".dbf") returned 4 [0051.534] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString=".1cd") returned 4 [0051.534] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.534] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.534] lstrlenW (lpString=".jpg") returned 4 [0051.534] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString=".doc") returned 4 [0051.535] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString=".docx") returned 5 [0051.535] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.535] lstrlenW (lpString=".pdf") returned 4 [0051.535] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString=".xls") returned 4 [0051.535] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.535] lstrlenW (lpString=".xlsx") returned 5 [0051.535] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.535] lstrlenW (lpString=".ppt") returned 4 [0051.535] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString=".zip") returned 4 [0051.535] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.535] lstrlenW (lpString=".rar") returned 4 [0051.535] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.535] lstrlenW (lpString=".bz2") returned 4 [0051.535] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString=".7z") returned 3 [0051.535] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString=".dbf") returned 4 [0051.535] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString=".1cd") returned 4 [0051.535] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.535] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 83 [0051.535] lstrlenW (lpString=".jpg") returned 4 [0051.535] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.536] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0051.536] lstrlenW (lpString="btn-back-static.png") returned 19 [0051.536] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.252] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10888) returned 1 [0052.252] CloseHandle (hObject=0x160) returned 1 [0052.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0052.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.252] lstrlenW (lpString=".doc") returned 4 [0052.252] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.252] lstrlenW (lpString=".docx") returned 5 [0052.252] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.252] lstrlenW (lpString=".pdf") returned 4 [0052.252] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.252] lstrlenW (lpString=".xls") returned 4 [0052.252] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.252] lstrlenW (lpString=".xlsx") returned 5 [0052.252] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.252] lstrlenW (lpString=".ppt") returned 4 [0052.252] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".zip") returned 4 [0052.253] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.253] lstrlenW (lpString=".rar") returned 4 [0052.253] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.253] lstrlenW (lpString=".bz2") returned 4 [0052.253] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString=".7z") returned 3 [0052.253] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".dbf") returned 4 [0052.253] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".1cd") returned 4 [0052.253] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".jpg") returned 4 [0052.253] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".doc") returned 4 [0052.253] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString=".docx") returned 5 [0052.253] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.253] lstrlenW (lpString=".pdf") returned 4 [0052.253] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.253] lstrlenW (lpString=".xls") returned 4 [0052.253] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.253] lstrlenW (lpString=".xlsx") returned 5 [0052.253] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.253] lstrlenW (lpString=".ppt") returned 4 [0052.253] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.253] lstrlenW (lpString=".zip") returned 4 [0052.254] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.254] lstrlenW (lpString=".rar") returned 4 [0052.254] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.254] lstrlenW (lpString=".bz2") returned 4 [0052.254] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.254] lstrlenW (lpString=".7z") returned 3 [0052.254] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.254] lstrlenW (lpString=".dbf") returned 4 [0052.254] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.254] lstrlenW (lpString=".1cd") returned 4 [0052.254] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 72 [0052.254] lstrlenW (lpString=".jpg") returned 4 [0052.254] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.380] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=661220) returned 1 [0052.380] CloseHandle (hObject=0x220) returned 1 [0052.380] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0052.380] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.380] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.380] lstrlenW (lpString=".doc") returned 4 [0052.381] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString=".docx") returned 5 [0052.381] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0052.381] lstrlenW (lpString=".pdf") returned 4 [0052.381] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString=".xls") returned 4 [0052.381] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.381] lstrlenW (lpString=".xlsx") returned 5 [0052.381] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0052.381] lstrlenW (lpString=".ppt") returned 4 [0052.381] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.381] lstrlenW (lpString=".zip") returned 4 [0052.381] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.381] lstrlenW (lpString=".rar") returned 4 [0052.381] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString=".bz2") returned 4 [0052.381] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString=".7z") returned 3 [0052.381] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.381] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.381] lstrlenW (lpString=".dbf") returned 4 [0052.381] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.381] lstrlenW (lpString=".1cd") returned 4 [0052.381] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.381] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 81 [0052.381] lstrlenW (lpString=".jpg") returned 4 [0052.381] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.382] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2821) returned 1 [0052.382] CloseHandle (hObject=0x220) returned 1 [0052.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0052.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.382] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.382] lstrlenW (lpString=".doc") returned 4 [0052.382] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.382] lstrlenW (lpString=".docx") returned 5 [0052.382] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.382] lstrlenW (lpString=".pdf") returned 4 [0052.382] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.382] lstrlenW (lpString=".xls") returned 4 [0052.382] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.382] lstrlenW (lpString=".xlsx") returned 5 [0052.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.382] lstrlenW (lpString=".ppt") returned 4 [0052.382] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.382] lstrlenW (lpString=".zip") returned 4 [0052.382] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.382] lstrlenW (lpString=".rar") returned 4 [0052.382] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.382] lstrlenW (lpString=".bz2") returned 4 [0052.383] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.383] lstrlenW (lpString=".7z") returned 3 [0052.383] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.383] lstrlenW (lpString=".dbf") returned 4 [0052.383] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.383] lstrlenW (lpString=".1cd") returned 4 [0052.383] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 67 [0052.383] lstrlenW (lpString=".jpg") returned 4 [0052.383] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.383] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5620) returned 1 [0052.383] CloseHandle (hObject=0x220) returned 1 [0052.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0052.383] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.383] lstrlenW (lpString=".doc") returned 4 [0052.383] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.384] lstrlenW (lpString=".docx") returned 5 [0052.384] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.384] lstrlenW (lpString=".pdf") returned 4 [0052.384] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.384] lstrlenW (lpString=".xls") returned 4 [0052.384] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.384] lstrlenW (lpString=".xlsx") returned 5 [0052.384] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.384] lstrlenW (lpString=".ppt") returned 4 [0052.384] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.384] lstrlenW (lpString=".zip") returned 4 [0052.384] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.384] lstrlenW (lpString=".rar") returned 4 [0052.384] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.384] lstrlenW (lpString=".bz2") returned 4 [0052.384] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.384] lstrlenW (lpString=".7z") returned 3 [0052.384] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.384] lstrlenW (lpString=".dbf") returned 4 [0052.384] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.384] lstrlenW (lpString=".1cd") returned 4 [0052.384] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 77 [0052.384] lstrlenW (lpString=".jpg") returned 4 [0052.384] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.385] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5088) returned 1 [0052.385] CloseHandle (hObject=0x220) returned 1 [0052.385] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0052.385] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.385] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.385] lstrlenW (lpString=".doc") returned 4 [0052.385] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.385] lstrlenW (lpString=".docx") returned 5 [0052.385] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.385] lstrlenW (lpString=".pdf") returned 4 [0052.385] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.385] lstrlenW (lpString=".xls") returned 4 [0052.385] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.385] lstrlenW (lpString=".xlsx") returned 5 [0052.385] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.385] lstrlenW (lpString=".ppt") returned 4 [0052.385] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.385] lstrlenW (lpString=".zip") returned 4 [0052.385] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.385] lstrlenW (lpString=".rar") returned 4 [0052.385] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.385] lstrlenW (lpString=".bz2") returned 4 [0052.385] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.386] lstrlenW (lpString=".7z") returned 3 [0052.386] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.386] lstrlenW (lpString=".dbf") returned 4 [0052.386] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.386] lstrlenW (lpString=".1cd") returned 4 [0052.386] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0052.386] lstrlenW (lpString=".jpg") returned 4 [0052.386] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.386] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3130) returned 1 [0052.386] CloseHandle (hObject=0x220) returned 1 [0052.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.386] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.386] lstrlenW (lpString=".doc") returned 4 [0052.386] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.386] lstrlenW (lpString=".docx") returned 5 [0052.387] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.387] lstrlenW (lpString=".pdf") returned 4 [0052.387] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.387] lstrlenW (lpString=".xls") returned 4 [0052.387] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.387] lstrlenW (lpString=".xlsx") returned 5 [0052.387] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.387] lstrlenW (lpString=".ppt") returned 4 [0052.387] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.387] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.387] lstrlenW (lpString=".zip") returned 4 [0052.387] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.387] lstrlenW (lpString=".rar") returned 4 [0052.387] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.387] lstrlenW (lpString=".bz2") returned 4 [0052.387] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.387] lstrlenW (lpString=".7z") returned 3 [0052.387] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.387] lstrlenW (lpString=".dbf") returned 4 [0052.387] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.387] lstrlenW (lpString=".1cd") returned 4 [0052.387] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0052.387] lstrlenW (lpString=".jpg") returned 4 [0052.387] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.387] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5025) returned 1 [0052.388] CloseHandle (hObject=0x220) returned 1 [0052.388] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0052.388] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.388] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.388] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.388] lstrlenW (lpString=".doc") returned 4 [0052.388] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.388] lstrlenW (lpString=".docx") returned 5 [0052.388] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.388] lstrlenW (lpString=".pdf") returned 4 [0052.388] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.388] lstrlenW (lpString=".xls") returned 4 [0052.388] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.388] lstrlenW (lpString=".xlsx") returned 5 [0052.388] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.388] lstrlenW (lpString=".ppt") returned 4 [0052.388] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.388] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.388] lstrlenW (lpString=".zip") returned 4 [0052.388] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.388] lstrlenW (lpString=".rar") returned 4 [0052.388] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.388] lstrlenW (lpString=".bz2") returned 4 [0052.388] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.388] lstrlenW (lpString=".7z") returned 3 [0052.388] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.389] lstrlenW (lpString=".dbf") returned 4 [0052.389] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.389] lstrlenW (lpString=".1cd") returned 4 [0052.389] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0052.389] lstrlenW (lpString=".jpg") returned 4 [0052.389] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.389] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3118) returned 1 [0052.389] CloseHandle (hObject=0x220) returned 1 [0052.389] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.389] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.389] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.389] lstrlenW (lpString=".doc") returned 4 [0052.389] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.389] lstrlenW (lpString=".docx") returned 5 [0052.389] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.389] lstrlenW (lpString=".pdf") returned 4 [0052.390] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.390] lstrlenW (lpString=".xls") returned 4 [0052.390] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.390] lstrlenW (lpString=".xlsx") returned 5 [0052.390] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.390] lstrlenW (lpString=".ppt") returned 4 [0052.390] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.390] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.390] lstrlenW (lpString=".zip") returned 4 [0052.390] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.390] lstrlenW (lpString=".rar") returned 4 [0052.390] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.390] lstrlenW (lpString=".bz2") returned 4 [0052.390] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.390] lstrlenW (lpString=".7z") returned 3 [0052.390] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.390] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.390] lstrlenW (lpString=".dbf") returned 4 [0052.390] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.390] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.390] lstrlenW (lpString=".1cd") returned 4 [0052.390] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.390] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0052.390] lstrlenW (lpString=".jpg") returned 4 [0052.390] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.390] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4955) returned 1 [0052.390] CloseHandle (hObject=0x220) returned 1 [0052.391] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0052.391] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.391] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.391] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.391] lstrlenW (lpString=".doc") returned 4 [0052.391] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.391] lstrlenW (lpString=".docx") returned 5 [0052.391] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.391] lstrlenW (lpString=".pdf") returned 4 [0052.391] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.391] lstrlenW (lpString=".xls") returned 4 [0052.391] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.391] lstrlenW (lpString=".xlsx") returned 5 [0052.391] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.391] lstrlenW (lpString=".ppt") returned 4 [0052.391] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.391] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.391] lstrlenW (lpString=".zip") returned 4 [0052.391] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.391] lstrlenW (lpString=".rar") returned 4 [0052.391] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.391] lstrlenW (lpString=".bz2") returned 4 [0052.391] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.391] lstrlenW (lpString=".7z") returned 3 [0052.391] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.391] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.392] lstrlenW (lpString=".dbf") returned 4 [0052.392] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.392] lstrlenW (lpString=".1cd") returned 4 [0052.392] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0052.392] lstrlenW (lpString=".jpg") returned 4 [0052.392] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.392] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3081) returned 1 [0052.392] CloseHandle (hObject=0x220) returned 1 [0052.392] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.392] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.392] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.392] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.392] lstrlenW (lpString=".doc") returned 4 [0052.392] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.392] lstrlenW (lpString=".docx") returned 5 [0052.392] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.392] lstrlenW (lpString=".pdf") returned 4 [0052.392] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.392] lstrlenW (lpString=".xls") returned 4 [0052.393] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.393] lstrlenW (lpString=".xlsx") returned 5 [0052.393] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.393] lstrlenW (lpString=".ppt") returned 4 [0052.393] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.393] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.393] lstrlenW (lpString=".zip") returned 4 [0052.393] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.393] lstrlenW (lpString=".rar") returned 4 [0052.393] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.393] lstrlenW (lpString=".bz2") returned 4 [0052.393] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.393] lstrlenW (lpString=".7z") returned 3 [0052.393] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.393] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.393] lstrlenW (lpString=".dbf") returned 4 [0052.393] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.393] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.393] lstrlenW (lpString=".1cd") returned 4 [0052.393] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.393] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0052.393] lstrlenW (lpString=".jpg") returned 4 [0052.393] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.609] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24852) returned 1 [0052.609] CloseHandle (hObject=0x224) returned 1 [0052.609] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0052.609] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.609] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.609] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.609] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.609] lstrlenW (lpString=".doc") returned 4 [0052.609] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.609] lstrlenW (lpString=".docx") returned 5 [0052.609] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.609] lstrlenW (lpString=".pdf") returned 4 [0052.609] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.610] lstrlenW (lpString=".xls") returned 4 [0052.610] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.610] lstrlenW (lpString=".xlsx") returned 5 [0052.610] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.610] lstrlenW (lpString=".ppt") returned 4 [0052.610] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.610] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.610] lstrlenW (lpString=".zip") returned 4 [0052.610] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.610] lstrlenW (lpString=".rar") returned 4 [0052.610] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.610] lstrlenW (lpString=".bz2") returned 4 [0052.610] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.610] lstrlenW (lpString=".7z") returned 3 [0052.610] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.610] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.610] lstrlenW (lpString=".dbf") returned 4 [0052.610] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.610] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.610] lstrlenW (lpString=".1cd") returned 4 [0052.610] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.610] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0052.610] lstrlenW (lpString=".jpg") returned 4 [0052.610] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.709] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5072) returned 1 [0052.714] CloseHandle (hObject=0x160) returned 1 [0052.719] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0052.728] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.731] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.753] lstrlenW (lpString=".doc") returned 4 [0052.753] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0052.753] lstrlenW (lpString=".docx") returned 5 [0052.753] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0052.753] lstrlenW (lpString=".pdf") returned 4 [0052.753] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0052.753] lstrlenW (lpString=".xls") returned 4 [0052.753] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0052.753] lstrlenW (lpString=".xlsx") returned 5 [0052.753] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0052.753] lstrlenW (lpString=".ppt") returned 4 [0052.754] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0052.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.754] lstrlenW (lpString=".zip") returned 4 [0052.754] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0052.754] lstrlenW (lpString=".rar") returned 4 [0052.754] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0052.754] lstrlenW (lpString=".bz2") returned 4 [0052.754] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0052.754] lstrlenW (lpString=".7z") returned 3 [0052.754] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.754] lstrlenW (lpString=".dbf") returned 4 [0052.754] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0052.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.754] lstrlenW (lpString=".1cd") returned 4 [0052.754] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0052.754] lstrlenW (lpString=".jpg") returned 4 [0052.754] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.038] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1545) returned 1 [0053.038] CloseHandle (hObject=0x224) returned 1 [0053.038] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0053.038] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.038] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.038] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.038] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.038] lstrlenW (lpString=".doc") returned 4 [0053.039] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.039] lstrlenW (lpString=".docx") returned 5 [0053.039] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.039] lstrlenW (lpString=".pdf") returned 4 [0053.039] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.039] lstrlenW (lpString=".xls") returned 4 [0053.039] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.039] lstrlenW (lpString=".xlsx") returned 5 [0053.039] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.039] lstrlenW (lpString=".ppt") returned 4 [0053.039] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.039] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.039] lstrlenW (lpString=".zip") returned 4 [0053.039] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.039] lstrlenW (lpString=".rar") returned 4 [0053.039] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.039] lstrlenW (lpString=".bz2") returned 4 [0053.039] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.039] lstrlenW (lpString=".7z") returned 3 [0053.039] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.039] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.039] lstrlenW (lpString=".dbf") returned 4 [0053.039] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.039] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.039] lstrlenW (lpString=".1cd") returned 4 [0053.039] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.039] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0053.039] lstrlenW (lpString=".jpg") returned 4 [0053.039] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.040] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=29268) returned 1 [0053.040] CloseHandle (hObject=0x224) returned 1 [0053.040] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0053.040] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.040] lstrlenW (lpString=".doc") returned 4 [0053.040] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.040] lstrlenW (lpString=".docx") returned 5 [0053.040] lstrcmpiW (lpString1=".docx", lpString2="k.wmv") returned -1 [0053.040] lstrlenW (lpString=".pdf") returned 4 [0053.040] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.040] lstrlenW (lpString=".xls") returned 4 [0053.040] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.040] lstrlenW (lpString=".xlsx") returned 5 [0053.040] lstrcmpiW (lpString1=".xlsx", lpString2="k.wmv") returned -1 [0053.040] lstrlenW (lpString=".ppt") returned 4 [0053.040] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.040] lstrlenW (lpString=".zip") returned 4 [0053.040] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.040] lstrlenW (lpString=".rar") returned 4 [0053.040] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.040] lstrlenW (lpString=".bz2") returned 4 [0053.040] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.041] lstrlenW (lpString=".7z") returned 3 [0053.041] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.041] lstrlenW (lpString=".dbf") returned 4 [0053.041] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.041] lstrlenW (lpString=".1cd") returned 4 [0053.041] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 67 [0053.041] lstrlenW (lpString=".jpg") returned 4 [0053.041] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.041] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=29268) returned 1 [0053.041] CloseHandle (hObject=0x224) returned 1 [0053.041] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0053.041] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.041] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.041] lstrlenW (lpString=".doc") returned 4 [0053.041] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.041] lstrlenW (lpString=".docx") returned 5 [0053.042] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0053.042] lstrlenW (lpString=".pdf") returned 4 [0053.042] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString=".xls") returned 4 [0053.042] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.042] lstrlenW (lpString=".xlsx") returned 5 [0053.042] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0053.042] lstrlenW (lpString=".ppt") returned 4 [0053.042] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.042] lstrlenW (lpString=".zip") returned 4 [0053.042] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.042] lstrlenW (lpString=".rar") returned 4 [0053.042] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString=".bz2") returned 4 [0053.042] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString=".7z") returned 3 [0053.042] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.042] lstrlenW (lpString=".dbf") returned 4 [0053.042] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.042] lstrlenW (lpString=".1cd") returned 4 [0053.042] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 71 [0053.042] lstrlenW (lpString=".jpg") returned 4 [0053.042] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.042] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4793) returned 1 [0053.043] CloseHandle (hObject=0x224) returned 1 [0053.043] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0053.043] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.043] lstrlenW (lpString=".doc") returned 4 [0053.043] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.043] lstrlenW (lpString=".docx") returned 5 [0053.043] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.043] lstrlenW (lpString=".pdf") returned 4 [0053.043] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.043] lstrlenW (lpString=".xls") returned 4 [0053.043] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.043] lstrlenW (lpString=".xlsx") returned 5 [0053.043] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.043] lstrlenW (lpString=".ppt") returned 4 [0053.043] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.043] lstrlenW (lpString=".zip") returned 4 [0053.043] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.043] lstrlenW (lpString=".rar") returned 4 [0053.043] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.043] lstrlenW (lpString=".bz2") returned 4 [0053.043] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.043] lstrlenW (lpString=".7z") returned 3 [0053.043] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.044] lstrlenW (lpString=".dbf") returned 4 [0053.044] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.044] lstrlenW (lpString=".1cd") returned 4 [0053.044] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 73 [0053.044] lstrlenW (lpString=".jpg") returned 4 [0053.044] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.045] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4813) returned 1 [0053.045] CloseHandle (hObject=0x224) returned 1 [0053.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0053.045] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.046] lstrlenW (lpString=".doc") returned 4 [0053.046] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.046] lstrlenW (lpString=".docx") returned 5 [0053.046] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0053.046] lstrlenW (lpString=".pdf") returned 4 [0053.046] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.046] lstrlenW (lpString=".xls") returned 4 [0053.046] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.046] lstrlenW (lpString=".xlsx") returned 5 [0053.046] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0053.046] lstrlenW (lpString=".ppt") returned 4 [0053.046] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.046] lstrlenW (lpString=".zip") returned 4 [0053.046] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.046] lstrlenW (lpString=".rar") returned 4 [0053.046] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.046] lstrlenW (lpString=".bz2") returned 4 [0053.046] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.046] lstrlenW (lpString=".7z") returned 3 [0053.046] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.046] lstrlenW (lpString=".dbf") returned 4 [0053.046] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.046] lstrlenW (lpString=".1cd") returned 4 [0053.046] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 74 [0053.046] lstrlenW (lpString=".jpg") returned 4 [0053.046] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.047] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=109292) returned 1 [0053.047] CloseHandle (hObject=0x224) returned 1 [0053.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0053.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.048] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.048] lstrlenW (lpString=".doc") returned 4 [0053.048] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.048] lstrlenW (lpString=".docx") returned 5 [0053.048] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0053.048] lstrlenW (lpString=".pdf") returned 4 [0053.048] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.048] lstrlenW (lpString=".xls") returned 4 [0053.048] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.048] lstrlenW (lpString=".xlsx") returned 5 [0053.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0053.048] lstrlenW (lpString=".ppt") returned 4 [0053.048] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.048] lstrlenW (lpString=".zip") returned 4 [0053.048] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.049] lstrlenW (lpString=".rar") returned 4 [0053.049] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.049] lstrlenW (lpString=".bz2") returned 4 [0053.049] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.049] lstrlenW (lpString=".7z") returned 3 [0053.049] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.049] lstrlenW (lpString=".dbf") returned 4 [0053.049] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.049] lstrlenW (lpString=".1cd") returned 4 [0053.049] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 67 [0053.049] lstrlenW (lpString=".jpg") returned 4 [0053.049] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.049] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=99127) returned 1 [0053.049] CloseHandle (hObject=0x224) returned 1 [0053.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0053.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString=".doc") returned 4 [0053.050] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.050] lstrlenW (lpString=".docx") returned 5 [0053.050] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0053.050] lstrlenW (lpString=".pdf") returned 4 [0053.050] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.050] lstrlenW (lpString=".xls") returned 4 [0053.050] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.050] lstrlenW (lpString=".xlsx") returned 5 [0053.050] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0053.050] lstrlenW (lpString=".ppt") returned 4 [0053.050] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString=".zip") returned 4 [0053.050] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.050] lstrlenW (lpString=".rar") returned 4 [0053.050] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.050] lstrlenW (lpString=".bz2") returned 4 [0053.050] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.050] lstrlenW (lpString=".7z") returned 3 [0053.050] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString=".dbf") returned 4 [0053.050] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString=".1cd") returned 4 [0053.050] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 70 [0053.050] lstrlenW (lpString=".jpg") returned 4 [0053.050] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.051] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3057) returned 1 [0053.051] CloseHandle (hObject=0x224) returned 1 [0053.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0053.051] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.051] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.051] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.051] lstrlenW (lpString=".doc") returned 4 [0053.051] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.051] lstrlenW (lpString=".docx") returned 5 [0053.051] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0053.051] lstrlenW (lpString=".pdf") returned 4 [0053.051] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.051] lstrlenW (lpString=".xls") returned 4 [0053.051] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.051] lstrlenW (lpString=".xlsx") returned 5 [0053.051] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0053.051] lstrlenW (lpString=".ppt") returned 4 [0053.051] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.051] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.051] lstrlenW (lpString=".zip") returned 4 [0053.051] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.052] lstrlenW (lpString=".rar") returned 4 [0053.052] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.052] lstrlenW (lpString=".bz2") returned 4 [0053.052] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.052] lstrlenW (lpString=".7z") returned 3 [0053.052] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.052] lstrlenW (lpString=".dbf") returned 4 [0053.052] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.052] lstrlenW (lpString=".1cd") returned 4 [0053.052] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 75 [0053.052] lstrlenW (lpString=".jpg") returned 4 [0053.052] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.053] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=25998) returned 1 [0053.053] CloseHandle (hObject=0x224) returned 1 [0053.053] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0053.053] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.053] lstrlenW (lpString=".doc") returned 4 [0053.053] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0053.053] lstrlenW (lpString=".docx") returned 5 [0053.053] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0053.053] lstrlenW (lpString=".pdf") returned 4 [0053.053] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0053.053] lstrlenW (lpString=".xls") returned 4 [0053.053] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0053.053] lstrlenW (lpString=".xlsx") returned 5 [0053.053] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0053.053] lstrlenW (lpString=".ppt") returned 4 [0053.053] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0053.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.053] lstrlenW (lpString=".zip") returned 4 [0053.054] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0053.054] lstrlenW (lpString=".rar") returned 4 [0053.054] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0053.054] lstrlenW (lpString=".bz2") returned 4 [0053.054] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0053.054] lstrlenW (lpString=".7z") returned 3 [0053.054] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0053.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.054] lstrlenW (lpString=".dbf") returned 4 [0053.054] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.054] lstrlenW (lpString=".1cd") returned 4 [0053.054] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0053.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 61 [0053.054] lstrlenW (lpString=".jpg") returned 4 [0053.054] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0053.054] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=205220) returned 1 [0053.054] CloseHandle (hObject=0x224) returned 1 [0053.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0053.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString=".doc") returned 4 [0053.055] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString=".docx") returned 5 [0053.055] lstrcmpiW (lpString1=".docx", lpString2="n.wmv") returned -1 [0053.055] lstrlenW (lpString=".pdf") returned 4 [0053.055] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString=".xls") returned 4 [0053.055] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.055] lstrlenW (lpString=".xlsx") returned 5 [0053.055] lstrcmpiW (lpString1=".xlsx", lpString2="n.wmv") returned -1 [0053.055] lstrlenW (lpString=".ppt") returned 4 [0053.055] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString=".zip") returned 4 [0053.055] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.055] lstrlenW (lpString=".rar") returned 4 [0053.055] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString=".bz2") returned 4 [0053.055] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString=".7z") returned 3 [0053.055] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString=".dbf") returned 4 [0053.055] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString=".1cd") returned 4 [0053.055] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 72 [0053.055] lstrlenW (lpString=".jpg") returned 4 [0053.055] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.056] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=61220) returned 1 [0053.056] CloseHandle (hObject=0x224) returned 1 [0053.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0053.056] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.056] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.056] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.056] lstrlenW (lpString=".doc") returned 4 [0053.056] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.056] lstrlenW (lpString=".docx") returned 5 [0053.056] lstrcmpiW (lpString1=".docx", lpString2="k.wmv") returned -1 [0053.056] lstrlenW (lpString=".pdf") returned 4 [0053.056] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.056] lstrlenW (lpString=".xls") returned 4 [0053.056] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.056] lstrlenW (lpString=".xlsx") returned 5 [0053.056] lstrcmpiW (lpString1=".xlsx", lpString2="k.wmv") returned -1 [0053.056] lstrlenW (lpString=".ppt") returned 4 [0053.056] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.056] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.056] lstrlenW (lpString=".zip") returned 4 [0053.056] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.056] lstrlenW (lpString=".rar") returned 4 [0053.056] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.057] lstrlenW (lpString=".bz2") returned 4 [0053.057] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.057] lstrlenW (lpString=".7z") returned 3 [0053.057] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.057] lstrlenW (lpString=".dbf") returned 4 [0053.057] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.057] lstrlenW (lpString=".1cd") returned 4 [0053.057] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 76 [0053.057] lstrlenW (lpString=".jpg") returned 4 [0053.057] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.057] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=61220) returned 1 [0053.057] CloseHandle (hObject=0x224) returned 1 [0053.057] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0053.057] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.057] lstrlenW (lpString=".doc") returned 4 [0053.058] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString=".docx") returned 5 [0053.058] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0053.058] lstrlenW (lpString=".pdf") returned 4 [0053.058] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString=".xls") returned 4 [0053.058] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0053.058] lstrlenW (lpString=".xlsx") returned 5 [0053.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0053.058] lstrlenW (lpString=".ppt") returned 4 [0053.058] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.058] lstrlenW (lpString=".zip") returned 4 [0053.058] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0053.058] lstrlenW (lpString=".rar") returned 4 [0053.058] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString=".bz2") returned 4 [0053.058] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString=".7z") returned 3 [0053.058] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0053.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.058] lstrlenW (lpString=".dbf") returned 4 [0053.058] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.058] lstrlenW (lpString=".1cd") returned 4 [0053.058] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0053.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 80 [0053.058] lstrlenW (lpString=".jpg") returned 4 [0053.058] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0053.059] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=229220) returned 1 [0053.059] CloseHandle (hObject=0x224) returned 1 [0053.059] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0053.059] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned 76 [0053.060] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned 76 [0053.060] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2820) returned 1 [0053.060] CloseHandle (hObject=0x224) returned 1 [0053.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0053.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.060] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19846) returned 1 [0053.060] CloseHandle (hObject=0x224) returned 1 [0053.060] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0053.061] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.061] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.062] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4570) returned 1 [0053.062] CloseHandle (hObject=0x224) returned 1 [0053.062] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0053.062] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.062] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2821) returned 1 [0053.062] CloseHandle (hObject=0x224) returned 1 [0053.062] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0053.062] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.063] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5088) returned 1 [0053.063] CloseHandle (hObject=0x224) returned 1 [0053.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0053.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.063] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3130) returned 1 [0053.063] CloseHandle (hObject=0x224) returned 1 [0053.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0053.063] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.064] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5025) returned 1 [0053.064] CloseHandle (hObject=0x224) returned 1 [0053.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0053.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.064] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3118) returned 1 [0053.064] CloseHandle (hObject=0x224) returned 1 [0053.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0053.064] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.065] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4955) returned 1 [0053.065] CloseHandle (hObject=0x224) returned 1 [0053.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0053.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.065] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3081) returned 1 [0053.065] CloseHandle (hObject=0x224) returned 1 [0053.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0053.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.066] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27691) returned 1 [0053.066] CloseHandle (hObject=0x224) returned 1 [0053.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0053.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.066] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.066] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=56543) returned 1 [0053.066] CloseHandle (hObject=0x224) returned 1 [0053.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.067] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.067] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7261) returned 1 [0053.067] CloseHandle (hObject=0x224) returned 1 [0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.067] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.067] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23722) returned 1 [0053.067] CloseHandle (hObject=0x224) returned 1 [0053.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0053.068] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.068] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.068] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14239) returned 1 [0053.068] CloseHandle (hObject=0x224) returned 1 [0053.068] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0053.068] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.068] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.069] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17248) returned 1 [0053.069] CloseHandle (hObject=0x224) returned 1 [0053.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0053.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0053.069] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0053.069] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0053.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0053.070] GetLastError () returned 0x0 [0053.070] ReadFile (in: hFile=0x224, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4360, lpOverlapped=0x0) returned 1 [0053.072] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4370, lpOverlapped=0x0) returned 1 [0053.073] ReadFile (in: hFile=0x224, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0053.073] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0053.073] SetEndOfFile (hFile=0x22c) returned 1 [0053.073] CloseHandle (hObject=0x22c) returned 1 [0053.073] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0053.073] SetEndOfFile (hFile=0x224) returned 1 [0053.074] CloseHandle (hObject=0x224) returned 1 [0053.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0053.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString=".doc") returned 4 [0053.075] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString=".docx") returned 5 [0053.075] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0053.075] lstrlenW (lpString=".pdf") returned 4 [0053.075] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString=".xls") returned 4 [0053.075] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString=".xlsx") returned 5 [0053.075] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0053.075] lstrlenW (lpString=".ppt") returned 4 [0053.075] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString=".zip") returned 4 [0053.075] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0053.075] lstrlenW (lpString=".rar") returned 4 [0053.075] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString=".bz2") returned 4 [0053.075] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString=".7z") returned 3 [0053.075] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString=".dbf") returned 4 [0053.075] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString=".1cd") returned 4 [0053.075] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0053.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.075] lstrlenW (lpString=".jpg") returned 4 [0053.075] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.267] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18738) returned 1 [0055.267] CloseHandle (hObject=0x1f8) returned 1 [0055.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0055.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.272] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.273] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.273] GetLastError () returned 0x0 [0055.273] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4932, lpOverlapped=0x0) returned 1 [0055.274] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4940, lpOverlapped=0x0) returned 1 [0055.276] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.276] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0055.276] SetEndOfFile (hFile=0x218) returned 1 [0055.276] CloseHandle (hObject=0x218) returned 1 [0055.276] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.276] SetEndOfFile (hFile=0x208) returned 1 [0055.277] CloseHandle (hObject=0x208) returned 1 [0055.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0055.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.277] lstrlenW (lpString=".doc") returned 4 [0055.277] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.277] lstrlenW (lpString=".docx") returned 5 [0055.277] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.277] lstrlenW (lpString=".pdf") returned 4 [0055.277] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString=".xls") returned 4 [0055.278] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString=".xlsx") returned 5 [0055.278] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.278] lstrlenW (lpString=".ppt") returned 4 [0055.278] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.278] lstrlenW (lpString=".zip") returned 4 [0055.278] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.278] lstrlenW (lpString=".rar") returned 4 [0055.278] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString=".bz2") returned 4 [0055.278] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString=".7z") returned 3 [0055.278] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.278] lstrlenW (lpString=".dbf") returned 4 [0055.278] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.278] lstrlenW (lpString=".1cd") returned 4 [0055.278] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0055.278] lstrlenW (lpString=".jpg") returned 4 [0055.278] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.279] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11891) returned 1 [0055.279] CloseHandle (hObject=0x208) returned 1 [0055.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0055.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.279] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.279] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.280] GetLastError () returned 0x0 [0055.280] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2e73, lpOverlapped=0x0) returned 1 [0055.281] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0055.282] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.282] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.282] SetEndOfFile (hFile=0x218) returned 1 [0055.283] CloseHandle (hObject=0x218) returned 1 [0055.283] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.283] SetEndOfFile (hFile=0x208) returned 1 [0055.284] CloseHandle (hObject=0x208) returned 1 [0055.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0055.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.284] lstrlenW (lpString=".doc") returned 4 [0055.284] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.284] lstrlenW (lpString=".docx") returned 5 [0055.284] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.284] lstrlenW (lpString=".pdf") returned 4 [0055.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.284] lstrlenW (lpString=".xls") returned 4 [0055.284] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.284] lstrlenW (lpString=".xlsx") returned 5 [0055.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.284] lstrlenW (lpString=".ppt") returned 4 [0055.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.284] lstrlenW (lpString=".zip") returned 4 [0055.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.284] lstrlenW (lpString=".rar") returned 4 [0055.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.284] lstrlenW (lpString=".bz2") returned 4 [0055.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.285] lstrlenW (lpString=".7z") returned 3 [0055.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.285] lstrlenW (lpString=".dbf") returned 4 [0055.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.285] lstrlenW (lpString=".1cd") returned 4 [0055.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.285] lstrlenW (lpString=".jpg") returned 4 [0055.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.285] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=517) returned 1 [0055.285] CloseHandle (hObject=0x208) returned 1 [0055.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0055.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.285] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.286] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.286] GetLastError () returned 0x0 [0055.286] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x205, lpOverlapped=0x0) returned 1 [0055.287] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x210, lpOverlapped=0x0) returned 1 [0055.288] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.288] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.288] SetEndOfFile (hFile=0x218) returned 1 [0055.288] CloseHandle (hObject=0x218) returned 1 [0055.288] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.288] SetEndOfFile (hFile=0x208) returned 1 [0055.289] CloseHandle (hObject=0x208) returned 1 [0055.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0055.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.289] lstrlenW (lpString=".doc") returned 4 [0055.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.289] lstrlenW (lpString=".docx") returned 5 [0055.289] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.289] lstrlenW (lpString=".pdf") returned 4 [0055.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.289] lstrlenW (lpString=".xls") returned 4 [0055.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.289] lstrlenW (lpString=".xlsx") returned 5 [0055.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.290] lstrlenW (lpString=".ppt") returned 4 [0055.290] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.290] lstrlenW (lpString=".zip") returned 4 [0055.290] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.290] lstrlenW (lpString=".rar") returned 4 [0055.290] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.290] lstrlenW (lpString=".bz2") returned 4 [0055.290] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.290] lstrlenW (lpString=".7z") returned 3 [0055.290] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.290] lstrlenW (lpString=".dbf") returned 4 [0055.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.290] lstrlenW (lpString=".1cd") returned 4 [0055.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0055.290] lstrlenW (lpString=".jpg") returned 4 [0055.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.290] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=502) returned 1 [0055.290] CloseHandle (hObject=0x208) returned 1 [0055.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0055.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.291] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.291] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.291] GetLastError () returned 0x0 [0055.291] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f6, lpOverlapped=0x0) returned 1 [0055.292] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x200, lpOverlapped=0x0) returned 1 [0055.293] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.293] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.293] SetEndOfFile (hFile=0x218) returned 1 [0055.293] CloseHandle (hObject=0x218) returned 1 [0055.293] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.293] SetEndOfFile (hFile=0x208) returned 1 [0055.294] CloseHandle (hObject=0x208) returned 1 [0055.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString=".doc") returned 4 [0055.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.295] lstrlenW (lpString=".docx") returned 5 [0055.295] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.295] lstrlenW (lpString=".pdf") returned 4 [0055.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.295] lstrlenW (lpString=".xls") returned 4 [0055.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.295] lstrlenW (lpString=".xlsx") returned 5 [0055.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.295] lstrlenW (lpString=".ppt") returned 4 [0055.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString=".zip") returned 4 [0055.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.295] lstrlenW (lpString=".rar") returned 4 [0055.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.295] lstrlenW (lpString=".bz2") returned 4 [0055.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.295] lstrlenW (lpString=".7z") returned 3 [0055.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString=".dbf") returned 4 [0055.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString=".1cd") returned 4 [0055.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0055.295] lstrlenW (lpString=".jpg") returned 4 [0055.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.297] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12702) returned 1 [0055.297] CloseHandle (hObject=0x208) returned 1 [0055.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0055.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.298] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.298] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.298] GetLastError () returned 0x0 [0055.298] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x319e, lpOverlapped=0x0) returned 1 [0055.300] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0055.301] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.301] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.301] SetEndOfFile (hFile=0x218) returned 1 [0055.301] CloseHandle (hObject=0x218) returned 1 [0055.301] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.301] SetEndOfFile (hFile=0x208) returned 1 [0055.302] CloseHandle (hObject=0x208) returned 1 [0055.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0055.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.303] lstrlenW (lpString=".doc") returned 4 [0055.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.303] lstrlenW (lpString=".docx") returned 5 [0055.303] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.303] lstrlenW (lpString=".pdf") returned 4 [0055.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.303] lstrlenW (lpString=".xls") returned 4 [0055.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.303] lstrlenW (lpString=".xlsx") returned 5 [0055.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.303] lstrlenW (lpString=".ppt") returned 4 [0055.303] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.303] lstrlenW (lpString=".zip") returned 4 [0055.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.303] lstrlenW (lpString=".rar") returned 4 [0055.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.303] lstrlenW (lpString=".bz2") returned 4 [0055.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.303] lstrlenW (lpString=".7z") returned 3 [0055.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.303] lstrlenW (lpString=".dbf") returned 4 [0055.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.303] lstrlenW (lpString=".1cd") returned 4 [0055.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0055.304] lstrlenW (lpString=".jpg") returned 4 [0055.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.304] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3484) returned 1 [0055.304] CloseHandle (hObject=0x208) returned 1 [0055.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0055.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.304] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.304] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.305] GetLastError () returned 0x0 [0055.305] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xd9c, lpOverlapped=0x0) returned 1 [0055.306] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xda0, lpOverlapped=0x0) returned 1 [0055.307] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.307] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.307] SetEndOfFile (hFile=0x218) returned 1 [0055.307] CloseHandle (hObject=0x218) returned 1 [0055.307] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.307] SetEndOfFile (hFile=0x208) returned 1 [0055.308] CloseHandle (hObject=0x208) returned 1 [0055.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.309] lstrlenW (lpString=".doc") returned 4 [0055.309] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.309] lstrlenW (lpString=".docx") returned 5 [0055.309] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.309] lstrlenW (lpString=".pdf") returned 4 [0055.309] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.309] lstrlenW (lpString=".xls") returned 4 [0055.309] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.309] lstrlenW (lpString=".xlsx") returned 5 [0055.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.309] lstrlenW (lpString=".ppt") returned 4 [0055.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.309] lstrlenW (lpString=".zip") returned 4 [0055.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.309] lstrlenW (lpString=".rar") returned 4 [0055.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.309] lstrlenW (lpString=".bz2") returned 4 [0055.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.309] lstrlenW (lpString=".7z") returned 3 [0055.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.309] lstrlenW (lpString=".dbf") returned 4 [0055.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.309] lstrlenW (lpString=".1cd") returned 4 [0055.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0055.310] lstrlenW (lpString=".jpg") returned 4 [0055.310] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.310] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3140) returned 1 [0055.310] CloseHandle (hObject=0x208) returned 1 [0055.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0055.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.310] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.310] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.311] GetLastError () returned 0x0 [0055.311] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xc44, lpOverlapped=0x0) returned 1 [0055.389] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xc50, lpOverlapped=0x0) returned 1 [0055.390] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.390] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.390] SetEndOfFile (hFile=0x218) returned 1 [0055.390] CloseHandle (hObject=0x218) returned 1 [0055.390] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.390] SetEndOfFile (hFile=0x208) returned 1 [0055.391] CloseHandle (hObject=0x208) returned 1 [0055.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.392] lstrlenW (lpString=".doc") returned 4 [0055.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.392] lstrlenW (lpString=".docx") returned 5 [0055.445] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.445] lstrlenW (lpString=".pdf") returned 4 [0055.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.445] lstrlenW (lpString=".xls") returned 4 [0055.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.451] lstrlenW (lpString=".xlsx") returned 5 [0055.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.451] lstrlenW (lpString=".ppt") returned 4 [0055.451] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.451] lstrlenW (lpString=".zip") returned 4 [0055.451] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.451] lstrlenW (lpString=".rar") returned 4 [0055.451] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.457] lstrlenW (lpString=".bz2") returned 4 [0055.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.457] lstrlenW (lpString=".7z") returned 3 [0055.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.457] lstrlenW (lpString=".dbf") returned 4 [0055.457] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.462] lstrlenW (lpString=".1cd") returned 4 [0055.464] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0055.464] lstrlenW (lpString=".jpg") returned 4 [0055.464] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.470] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3966) returned 1 [0055.471] CloseHandle (hObject=0x208) returned 1 [0055.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0055.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.477] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.477] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.477] GetLastError () returned 0x0 [0055.477] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xf7e, lpOverlapped=0x0) returned 1 [0055.479] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf80, lpOverlapped=0x0) returned 1 [0055.480] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.480] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.480] SetEndOfFile (hFile=0x218) returned 1 [0055.480] CloseHandle (hObject=0x218) returned 1 [0055.480] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.480] SetEndOfFile (hFile=0x208) returned 1 [0055.481] CloseHandle (hObject=0x208) returned 1 [0055.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.482] lstrlenW (lpString=".doc") returned 4 [0055.482] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.482] lstrlenW (lpString=".docx") returned 5 [0055.482] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.482] lstrlenW (lpString=".pdf") returned 4 [0055.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.482] lstrlenW (lpString=".xls") returned 4 [0055.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.482] lstrlenW (lpString=".xlsx") returned 5 [0055.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.482] lstrlenW (lpString=".ppt") returned 4 [0055.482] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.482] lstrlenW (lpString=".zip") returned 4 [0055.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.482] lstrlenW (lpString=".rar") returned 4 [0055.482] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.482] lstrlenW (lpString=".bz2") returned 4 [0055.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.482] lstrlenW (lpString=".7z") returned 3 [0055.482] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.482] lstrlenW (lpString=".dbf") returned 4 [0055.482] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.482] lstrlenW (lpString=".1cd") returned 4 [0055.482] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.483] lstrlenW (lpString=".jpg") returned 4 [0055.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.483] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3026) returned 1 [0055.483] CloseHandle (hObject=0x208) returned 1 [0055.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0055.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.484] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.484] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.484] GetLastError () returned 0x0 [0055.484] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbd2, lpOverlapped=0x0) returned 1 [0055.486] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0055.487] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.487] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.487] SetEndOfFile (hFile=0x218) returned 1 [0055.487] CloseHandle (hObject=0x218) returned 1 [0055.487] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.487] SetEndOfFile (hFile=0x208) returned 1 [0055.488] CloseHandle (hObject=0x208) returned 1 [0055.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0055.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.488] lstrlenW (lpString=".doc") returned 4 [0055.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.488] lstrlenW (lpString=".docx") returned 5 [0055.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.488] lstrlenW (lpString=".pdf") returned 4 [0055.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.488] lstrlenW (lpString=".xls") returned 4 [0055.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.488] lstrlenW (lpString=".xlsx") returned 5 [0055.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.488] lstrlenW (lpString=".ppt") returned 4 [0055.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.489] lstrlenW (lpString=".zip") returned 4 [0055.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.489] lstrlenW (lpString=".rar") returned 4 [0055.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.489] lstrlenW (lpString=".bz2") returned 4 [0055.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.489] lstrlenW (lpString=".7z") returned 3 [0055.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.489] lstrlenW (lpString=".dbf") returned 4 [0055.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.489] lstrlenW (lpString=".1cd") returned 4 [0055.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.489] lstrlenW (lpString=".jpg") returned 4 [0055.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.489] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4734) returned 1 [0055.489] CloseHandle (hObject=0x208) returned 1 [0055.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0055.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.490] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.490] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.490] GetLastError () returned 0x0 [0055.490] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x127e, lpOverlapped=0x0) returned 1 [0055.682] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1280, lpOverlapped=0x0) returned 1 [0055.719] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.722] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.725] SetEndOfFile (hFile=0x218) returned 1 [0055.735] CloseHandle (hObject=0x218) returned 1 [0055.743] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.745] SetEndOfFile (hFile=0x208) returned 1 [0055.811] CloseHandle (hObject=0x208) returned 1 [0055.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.842] lstrlenW (lpString=".doc") returned 4 [0055.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.846] lstrlenW (lpString=".docx") returned 5 [0055.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.849] lstrlenW (lpString=".pdf") returned 4 [0055.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.849] lstrlenW (lpString=".xls") returned 4 [0055.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.852] lstrlenW (lpString=".xlsx") returned 5 [0055.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.855] lstrlenW (lpString=".ppt") returned 4 [0055.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.859] lstrlenW (lpString=".zip") returned 4 [0055.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.867] lstrlenW (lpString=".rar") returned 4 [0055.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.873] lstrlenW (lpString=".bz2") returned 4 [0055.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.874] lstrlenW (lpString=".7z") returned 3 [0055.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.878] lstrlenW (lpString=".dbf") returned 4 [0055.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.881] lstrlenW (lpString=".1cd") returned 4 [0055.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.881] lstrlenW (lpString=".jpg") returned 4 [0055.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.896] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5684) returned 1 [0055.896] CloseHandle (hObject=0x208) returned 1 [0055.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0055.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.897] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.897] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.897] GetLastError () returned 0x0 [0055.897] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1634, lpOverlapped=0x0) returned 1 [0055.923] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1640, lpOverlapped=0x0) returned 1 [0055.924] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.924] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.924] SetEndOfFile (hFile=0x218) returned 1 [0055.924] CloseHandle (hObject=0x218) returned 1 [0055.924] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.924] SetEndOfFile (hFile=0x208) returned 1 [0055.925] CloseHandle (hObject=0x208) returned 1 [0055.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0055.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.925] lstrlenW (lpString=".doc") returned 4 [0055.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString=".docx") returned 5 [0055.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.926] lstrlenW (lpString=".pdf") returned 4 [0055.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString=".xls") returned 4 [0055.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.926] lstrlenW (lpString=".xlsx") returned 5 [0055.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.926] lstrlenW (lpString=".ppt") returned 4 [0055.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.926] lstrlenW (lpString=".zip") returned 4 [0055.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.926] lstrlenW (lpString=".rar") returned 4 [0055.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString=".bz2") returned 4 [0055.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString=".7z") returned 3 [0055.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.926] lstrlenW (lpString=".dbf") returned 4 [0055.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.926] lstrlenW (lpString=".1cd") returned 4 [0055.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.926] lstrlenW (lpString=".jpg") returned 4 [0055.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.927] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20578) returned 1 [0055.927] CloseHandle (hObject=0x208) returned 1 [0055.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0055.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.927] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.927] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.928] GetLastError () returned 0x0 [0055.928] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5062, lpOverlapped=0x0) returned 1 [0055.930] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5070, lpOverlapped=0x0) returned 1 [0055.931] ReadFile (in: hFile=0x208, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.931] WriteFile (in: hFile=0x218, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.931] SetEndOfFile (hFile=0x218) returned 1 [0055.931] CloseHandle (hObject=0x218) returned 1 [0055.932] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.932] SetEndOfFile (hFile=0x208) returned 1 [0055.932] CloseHandle (hObject=0x208) returned 1 [0055.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0055.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.933] lstrlenW (lpString=".doc") returned 4 [0055.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.933] lstrlenW (lpString=".docx") returned 5 [0055.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.933] lstrlenW (lpString=".pdf") returned 4 [0055.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.933] lstrlenW (lpString=".xls") returned 4 [0055.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.933] lstrlenW (lpString=".xlsx") returned 5 [0055.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.933] lstrlenW (lpString=".ppt") returned 4 [0055.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.933] lstrlenW (lpString=".zip") returned 4 [0055.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.934] lstrlenW (lpString=".rar") returned 4 [0055.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.934] lstrlenW (lpString=".bz2") returned 4 [0055.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.934] lstrlenW (lpString=".7z") returned 3 [0055.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.934] lstrlenW (lpString=".dbf") returned 4 [0055.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.934] lstrlenW (lpString=".1cd") returned 4 [0055.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.934] lstrlenW (lpString=".jpg") returned 4 [0055.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.734] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10832) returned 1 [0056.734] CloseHandle (hObject=0x1fc) returned 1 [0056.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0056.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0056.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0056.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0056.735] GetLastError () returned 0x0 [0056.735] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2a50, lpOverlapped=0x0) returned 1 [0056.748] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0056.883] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0056.883] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.883] SetEndOfFile (hFile=0x1bc) returned 1 [0056.944] CloseHandle (hObject=0x1bc) returned 1 [0056.944] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0056.944] SetEndOfFile (hFile=0x1fc) returned 1 [0056.948] CloseHandle (hObject=0x1fc) returned 1 [0056.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString=".doc") returned 4 [0057.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString=".docx") returned 5 [0057.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.002] lstrlenW (lpString=".pdf") returned 4 [0057.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString=".xls") returned 4 [0057.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.002] lstrlenW (lpString=".xlsx") returned 5 [0057.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.002] lstrlenW (lpString=".ppt") returned 4 [0057.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString=".zip") returned 4 [0057.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.002] lstrlenW (lpString=".rar") returned 4 [0057.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString=".bz2") returned 4 [0057.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString=".7z") returned 3 [0057.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString=".dbf") returned 4 [0057.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString=".1cd") returned 4 [0057.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.002] lstrlenW (lpString=".jpg") returned 4 [0057.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.283] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3746) returned 1 [0057.344] CloseHandle (hObject=0x16c) returned 1 [0057.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0057.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0057.352] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0057.352] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0057.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.352] GetLastError () returned 0x0 [0057.352] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xea2, lpOverlapped=0x0) returned 1 [0057.367] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0057.368] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0057.368] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.368] SetEndOfFile (hFile=0x22c) returned 1 [0057.368] CloseHandle (hObject=0x22c) returned 1 [0057.368] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0057.368] SetEndOfFile (hFile=0x16c) returned 1 [0057.369] CloseHandle (hObject=0x16c) returned 1 [0057.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString=".doc") returned 4 [0057.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString=".docx") returned 5 [0057.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.370] lstrlenW (lpString=".pdf") returned 4 [0057.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString=".xls") returned 4 [0057.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.370] lstrlenW (lpString=".xlsx") returned 5 [0057.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.370] lstrlenW (lpString=".ppt") returned 4 [0057.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString=".zip") returned 4 [0057.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.370] lstrlenW (lpString=".rar") returned 4 [0057.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString=".bz2") returned 4 [0057.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString=".7z") returned 3 [0057.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString=".dbf") returned 4 [0057.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString=".1cd") returned 4 [0057.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0057.370] lstrlenW (lpString=".jpg") returned 4 [0057.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.028] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2636) returned 1 [0058.028] CloseHandle (hObject=0x160) returned 1 [0058.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0058.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.038] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.041] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.044] GetLastError () returned 0x0 [0058.044] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa4c, lpOverlapped=0x0) returned 1 [0058.046] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa50, lpOverlapped=0x0) returned 1 [0058.047] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.047] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.047] SetEndOfFile (hFile=0x1fc) returned 1 [0058.047] CloseHandle (hObject=0x1fc) returned 1 [0058.047] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.047] SetEndOfFile (hFile=0x160) returned 1 [0058.048] CloseHandle (hObject=0x160) returned 1 [0058.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0058.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.048] lstrlenW (lpString=".doc") returned 4 [0058.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.048] lstrlenW (lpString=".docx") returned 5 [0058.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.048] lstrlenW (lpString=".pdf") returned 4 [0058.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString=".xls") returned 4 [0058.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.049] lstrlenW (lpString=".xlsx") returned 5 [0058.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.049] lstrlenW (lpString=".ppt") returned 4 [0058.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString=".zip") returned 4 [0058.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.049] lstrlenW (lpString=".rar") returned 4 [0058.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString=".bz2") returned 4 [0058.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString=".7z") returned 3 [0058.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString=".dbf") returned 4 [0058.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString=".1cd") returned 4 [0058.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString=".jpg") returned 4 [0058.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.049] lstrlenW (lpString=".doc") returned 4 [0058.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.049] lstrlenW (lpString=".docx") returned 5 [0058.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.049] lstrlenW (lpString=".pdf") returned 4 [0058.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString=".xls") returned 4 [0058.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.050] lstrlenW (lpString=".xlsx") returned 5 [0058.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.050] lstrlenW (lpString=".ppt") returned 4 [0058.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.050] lstrlenW (lpString=".zip") returned 4 [0058.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.050] lstrlenW (lpString=".rar") returned 4 [0058.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString=".bz2") returned 4 [0058.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString=".7z") returned 3 [0058.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.050] lstrlenW (lpString=".dbf") returned 4 [0058.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.050] lstrlenW (lpString=".1cd") returned 4 [0058.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.050] lstrlenW (lpString=".jpg") returned 4 [0058.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.050] @NlsCompareInvariantNoCase@16 () [0058.050] lstrlenW (lpString="AN04191_.WMF") returned 12 [0058.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.051] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6636) returned 1 [0058.051] CloseHandle (hObject=0x160) returned 1 [0058.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0058.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.051] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.051] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.051] GetLastError () returned 0x0 [0058.051] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x19ec, lpOverlapped=0x0) returned 1 [0058.053] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0058.054] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.054] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.055] SetEndOfFile (hFile=0x1fc) returned 1 [0058.055] CloseHandle (hObject=0x1fc) returned 1 [0058.055] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.055] SetEndOfFile (hFile=0x160) returned 1 [0058.056] CloseHandle (hObject=0x160) returned 1 [0058.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0058.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.056] lstrlenW (lpString=".doc") returned 4 [0058.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.056] lstrlenW (lpString=".docx") returned 5 [0058.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.056] lstrlenW (lpString=".pdf") returned 4 [0058.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.056] lstrlenW (lpString=".xls") returned 4 [0058.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.056] lstrlenW (lpString=".xlsx") returned 5 [0058.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.056] lstrlenW (lpString=".ppt") returned 4 [0058.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".zip") returned 4 [0058.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.057] lstrlenW (lpString=".rar") returned 4 [0058.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString=".bz2") returned 4 [0058.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString=".7z") returned 3 [0058.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".dbf") returned 4 [0058.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".1cd") returned 4 [0058.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".jpg") returned 4 [0058.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".doc") returned 4 [0058.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString=".docx") returned 5 [0058.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.057] lstrlenW (lpString=".pdf") returned 4 [0058.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString=".xls") returned 4 [0058.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.057] lstrlenW (lpString=".xlsx") returned 5 [0058.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.057] lstrlenW (lpString=".ppt") returned 4 [0058.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.057] lstrlenW (lpString=".zip") returned 4 [0058.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.058] lstrlenW (lpString=".rar") returned 4 [0058.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.058] lstrlenW (lpString=".bz2") returned 4 [0058.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.058] lstrlenW (lpString=".7z") returned 3 [0058.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.058] lstrlenW (lpString=".dbf") returned 4 [0058.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.058] lstrlenW (lpString=".1cd") returned 4 [0058.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.058] lstrlenW (lpString=".jpg") returned 4 [0058.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.058] @NlsCompareInvariantNoCase@16 () [0058.058] lstrlenW (lpString="AN04195_.WMF") returned 12 [0058.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.059] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4612) returned 1 [0058.059] CloseHandle (hObject=0x160) returned 1 [0058.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0058.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.059] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.059] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.059] GetLastError () returned 0x0 [0058.059] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1204, lpOverlapped=0x0) returned 1 [0058.061] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1210, lpOverlapped=0x0) returned 1 [0058.062] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.062] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.062] SetEndOfFile (hFile=0x1fc) returned 1 [0058.062] CloseHandle (hObject=0x1fc) returned 1 [0058.062] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.062] SetEndOfFile (hFile=0x160) returned 1 [0058.063] CloseHandle (hObject=0x160) returned 1 [0058.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0058.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".doc") returned 4 [0058.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString=".docx") returned 5 [0058.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.064] lstrlenW (lpString=".pdf") returned 4 [0058.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString=".xls") returned 4 [0058.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.064] lstrlenW (lpString=".xlsx") returned 5 [0058.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.064] lstrlenW (lpString=".ppt") returned 4 [0058.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".zip") returned 4 [0058.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.064] lstrlenW (lpString=".rar") returned 4 [0058.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString=".bz2") returned 4 [0058.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString=".7z") returned 3 [0058.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".dbf") returned 4 [0058.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".1cd") returned 4 [0058.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".jpg") returned 4 [0058.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.064] lstrlenW (lpString=".doc") returned 4 [0058.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString=".docx") returned 5 [0058.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.065] lstrlenW (lpString=".pdf") returned 4 [0058.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString=".xls") returned 4 [0058.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.065] lstrlenW (lpString=".xlsx") returned 5 [0058.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.065] lstrlenW (lpString=".ppt") returned 4 [0058.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.065] lstrlenW (lpString=".zip") returned 4 [0058.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.065] lstrlenW (lpString=".rar") returned 4 [0058.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString=".bz2") returned 4 [0058.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString=".7z") returned 3 [0058.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.065] lstrlenW (lpString=".dbf") returned 4 [0058.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.065] lstrlenW (lpString=".1cd") returned 4 [0058.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.065] lstrlenW (lpString=".jpg") returned 4 [0058.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.065] @NlsCompareInvariantNoCase@16 () [0058.065] lstrlenW (lpString="AN04196_.WMF") returned 12 [0058.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.066] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3144) returned 1 [0058.066] CloseHandle (hObject=0x160) returned 1 [0058.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0058.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.066] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.066] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.066] GetLastError () returned 0x0 [0058.066] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xc48, lpOverlapped=0x0) returned 1 [0058.068] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xc50, lpOverlapped=0x0) returned 1 [0058.069] ReadFile (in: hFile=0x160, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.069] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.069] SetEndOfFile (hFile=0x1fc) returned 1 [0058.069] CloseHandle (hObject=0x1fc) returned 1 [0058.069] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.069] SetEndOfFile (hFile=0x160) returned 1 [0058.070] CloseHandle (hObject=0x160) returned 1 [0058.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.071] lstrlenW (lpString=".doc") returned 4 [0058.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString=".docx") returned 5 [0058.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.071] lstrlenW (lpString=".pdf") returned 4 [0058.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString=".xls") returned 4 [0058.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.071] lstrlenW (lpString=".xlsx") returned 5 [0058.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.071] lstrlenW (lpString=".ppt") returned 4 [0058.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.071] lstrlenW (lpString=".zip") returned 4 [0058.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.071] lstrlenW (lpString=".rar") returned 4 [0058.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString=".bz2") returned 4 [0058.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString=".7z") returned 3 [0058.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.071] lstrlenW (lpString=".dbf") returned 4 [0058.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.071] lstrlenW (lpString=".1cd") returned 4 [0058.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".jpg") returned 4 [0058.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".doc") returned 4 [0058.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString=".docx") returned 5 [0058.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.072] lstrlenW (lpString=".pdf") returned 4 [0058.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString=".xls") returned 4 [0058.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.072] lstrlenW (lpString=".xlsx") returned 5 [0058.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.072] lstrlenW (lpString=".ppt") returned 4 [0058.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".zip") returned 4 [0058.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.072] lstrlenW (lpString=".rar") returned 4 [0058.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString=".bz2") returned 4 [0058.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString=".7z") returned 3 [0058.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".dbf") returned 4 [0058.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".1cd") returned 4 [0058.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0058.072] lstrlenW (lpString=".jpg") returned 4 [0058.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.073] @NlsCompareInvariantNoCase@16 () [0058.073] lstrlenW (lpString="AN04206_.WMF") returned 12 [0058.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.073] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7668) returned 1 [0058.073] CloseHandle (hObject=0x150) returned 1 [0058.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0058.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.074] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.074] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.074] GetLastError () returned 0x0 [0058.074] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1df4, lpOverlapped=0x0) returned 1 [0058.076] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0058.077] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.077] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.077] SetEndOfFile (hFile=0x160) returned 1 [0058.077] CloseHandle (hObject=0x160) returned 1 [0058.077] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.077] SetEndOfFile (hFile=0x150) returned 1 [0058.078] CloseHandle (hObject=0x150) returned 1 [0058.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0058.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".doc") returned 4 [0058.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString=".docx") returned 5 [0058.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.079] lstrlenW (lpString=".pdf") returned 4 [0058.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString=".xls") returned 4 [0058.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.079] lstrlenW (lpString=".xlsx") returned 5 [0058.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.079] lstrlenW (lpString=".ppt") returned 4 [0058.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".zip") returned 4 [0058.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.079] lstrlenW (lpString=".rar") returned 4 [0058.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString=".bz2") returned 4 [0058.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString=".7z") returned 3 [0058.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".dbf") returned 4 [0058.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".1cd") returned 4 [0058.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".jpg") returned 4 [0058.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.079] lstrlenW (lpString=".doc") returned 4 [0058.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.079] lstrlenW (lpString=".docx") returned 5 [0058.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.080] lstrlenW (lpString=".pdf") returned 4 [0058.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString=".xls") returned 4 [0058.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.080] lstrlenW (lpString=".xlsx") returned 5 [0058.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.080] lstrlenW (lpString=".ppt") returned 4 [0058.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.080] lstrlenW (lpString=".zip") returned 4 [0058.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.080] lstrlenW (lpString=".rar") returned 4 [0058.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString=".bz2") returned 4 [0058.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString=".7z") returned 3 [0058.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.080] lstrlenW (lpString=".dbf") returned 4 [0058.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.080] lstrlenW (lpString=".1cd") returned 4 [0058.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0058.080] lstrlenW (lpString=".jpg") returned 4 [0058.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.080] @NlsCompareInvariantNoCase@16 () [0058.080] lstrlenW (lpString="AN04225_.WMF") returned 12 [0058.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.081] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8492) returned 1 [0058.081] CloseHandle (hObject=0x150) returned 1 [0058.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0058.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.081] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.081] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.081] GetLastError () returned 0x0 [0058.081] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x212c, lpOverlapped=0x0) returned 1 [0058.290] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2130, lpOverlapped=0x0) returned 1 [0058.303] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.303] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.304] SetEndOfFile (hFile=0x160) returned 1 [0058.304] CloseHandle (hObject=0x160) returned 1 [0058.304] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.304] SetEndOfFile (hFile=0x150) returned 1 [0058.305] CloseHandle (hObject=0x150) returned 1 [0058.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0058.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.305] lstrlenW (lpString=".doc") returned 4 [0058.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.305] lstrlenW (lpString=".docx") returned 5 [0058.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.305] lstrlenW (lpString=".pdf") returned 4 [0058.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.305] lstrlenW (lpString=".xls") returned 4 [0058.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.305] lstrlenW (lpString=".xlsx") returned 5 [0058.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.306] lstrlenW (lpString=".ppt") returned 4 [0058.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.306] lstrlenW (lpString=".zip") returned 4 [0058.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.306] lstrlenW (lpString=".rar") returned 4 [0058.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.306] lstrlenW (lpString=".bz2") returned 4 [0058.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.306] lstrlenW (lpString=".7z") returned 3 [0058.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.306] lstrlenW (lpString=".dbf") returned 4 [0058.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.306] lstrlenW (lpString=".1cd") returned 4 [0058.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0058.306] lstrlenW (lpString=".jpg") returned 4 [0058.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.306] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26886) returned 1 [0058.306] CloseHandle (hObject=0x150) returned 1 [0058.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0058.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0058.307] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.307] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0058.307] GetLastError () returned 0x0 [0058.307] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6906, lpOverlapped=0x0) returned 1 [0058.339] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6910, lpOverlapped=0x0) returned 1 [0058.344] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.344] WriteFile (in: hFile=0x160, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.344] SetEndOfFile (hFile=0x160) returned 1 [0058.347] CloseHandle (hObject=0x160) returned 1 [0058.347] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.347] SetEndOfFile (hFile=0x150) returned 1 [0058.348] CloseHandle (hObject=0x150) returned 1 [0058.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0058.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.385] lstrlenW (lpString=".doc") returned 4 [0058.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.385] lstrlenW (lpString=".docx") returned 5 [0058.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.385] lstrlenW (lpString=".pdf") returned 4 [0058.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString=".xls") returned 4 [0058.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.386] lstrlenW (lpString=".xlsx") returned 5 [0058.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.386] lstrlenW (lpString=".ppt") returned 4 [0058.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.386] lstrlenW (lpString=".zip") returned 4 [0058.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.386] lstrlenW (lpString=".rar") returned 4 [0058.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString=".bz2") returned 4 [0058.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString=".7z") returned 3 [0058.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.386] lstrlenW (lpString=".dbf") returned 4 [0058.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.386] lstrlenW (lpString=".1cd") returned 4 [0058.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0058.386] lstrlenW (lpString=".jpg") returned 4 [0058.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.387] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26748) returned 1 [0058.387] CloseHandle (hObject=0x1c8) returned 1 [0058.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0058.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.387] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.387] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.388] GetLastError () returned 0x0 [0058.388] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x687c, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6880, lpOverlapped=0x0) returned 1 [0058.392] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.392] SetEndOfFile (hFile=0x22c) returned 1 [0058.392] CloseHandle (hObject=0x22c) returned 1 [0058.392] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.392] SetEndOfFile (hFile=0x1c8) returned 1 [0058.393] CloseHandle (hObject=0x1c8) returned 1 [0058.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.394] lstrlenW (lpString=".doc") returned 4 [0058.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".docx") returned 5 [0058.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.394] lstrlenW (lpString=".pdf") returned 4 [0058.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".xls") returned 4 [0058.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.394] lstrlenW (lpString=".xlsx") returned 5 [0058.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.395] lstrlenW (lpString=".ppt") returned 4 [0058.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.395] lstrlenW (lpString=".zip") returned 4 [0058.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.395] lstrlenW (lpString=".rar") returned 4 [0058.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".bz2") returned 4 [0058.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".7z") returned 3 [0058.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.395] lstrlenW (lpString=".dbf") returned 4 [0058.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.395] lstrlenW (lpString=".1cd") returned 4 [0058.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0058.395] lstrlenW (lpString=".jpg") returned 4 [0058.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.396] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4924) returned 1 [0058.396] CloseHandle (hObject=0x1c8) returned 1 [0058.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0058.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.396] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.396] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.396] GetLastError () returned 0x0 [0058.396] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x133c, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1340, lpOverlapped=0x0) returned 1 [0058.399] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.399] SetEndOfFile (hFile=0x22c) returned 1 [0058.399] CloseHandle (hObject=0x22c) returned 1 [0058.399] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.399] SetEndOfFile (hFile=0x1c8) returned 1 [0058.400] CloseHandle (hObject=0x1c8) returned 1 [0058.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.401] lstrlenW (lpString=".doc") returned 4 [0058.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString=".docx") returned 5 [0058.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.401] lstrlenW (lpString=".pdf") returned 4 [0058.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString=".xls") returned 4 [0058.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.401] lstrlenW (lpString=".xlsx") returned 5 [0058.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.401] lstrlenW (lpString=".ppt") returned 4 [0058.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.401] lstrlenW (lpString=".zip") returned 4 [0058.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.401] lstrlenW (lpString=".rar") returned 4 [0058.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString=".bz2") returned 4 [0058.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString=".7z") returned 3 [0058.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.401] lstrlenW (lpString=".dbf") returned 4 [0058.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.402] lstrlenW (lpString=".1cd") returned 4 [0058.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0058.402] lstrlenW (lpString=".jpg") returned 4 [0058.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.403] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4066) returned 1 [0058.403] CloseHandle (hObject=0x1c8) returned 1 [0058.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0058.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.403] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.403] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.403] GetLastError () returned 0x0 [0058.403] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xfe2, lpOverlapped=0x0) returned 1 [0058.405] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xff0, lpOverlapped=0x0) returned 1 [0058.406] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.406] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.406] SetEndOfFile (hFile=0x22c) returned 1 [0058.406] CloseHandle (hObject=0x22c) returned 1 [0058.406] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.406] SetEndOfFile (hFile=0x1c8) returned 1 [0058.407] CloseHandle (hObject=0x1c8) returned 1 [0058.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString=".doc") returned 4 [0058.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString=".docx") returned 5 [0058.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.408] lstrlenW (lpString=".pdf") returned 4 [0058.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString=".xls") returned 4 [0058.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.408] lstrlenW (lpString=".xlsx") returned 5 [0058.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.408] lstrlenW (lpString=".ppt") returned 4 [0058.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString=".zip") returned 4 [0058.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.408] lstrlenW (lpString=".rar") returned 4 [0058.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString=".bz2") returned 4 [0058.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString=".7z") returned 3 [0058.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString=".dbf") returned 4 [0058.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString=".1cd") returned 4 [0058.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0058.408] lstrlenW (lpString=".jpg") returned 4 [0058.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.409] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24320) returned 1 [0058.409] CloseHandle (hObject=0x1c8) returned 1 [0058.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0058.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.409] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.409] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0058.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0058.410] GetLastError () returned 0x0 [0058.410] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5f00, lpOverlapped=0x0) returned 1 [0058.455] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0058.456] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0058.457] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.457] SetEndOfFile (hFile=0x22c) returned 1 [0059.109] CloseHandle (hObject=0x22c) returned 1 [0059.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0059.110] SetEndOfFile (hFile=0x1c8) returned 1 [0059.110] CloseHandle (hObject=0x1c8) returned 1 [0059.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0059.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.188] lstrlenW (lpString=".doc") returned 4 [0059.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.188] lstrlenW (lpString=".docx") returned 5 [0059.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.188] lstrlenW (lpString=".pdf") returned 4 [0059.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.188] lstrlenW (lpString=".xls") returned 4 [0059.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.189] lstrlenW (lpString=".xlsx") returned 5 [0059.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.189] lstrlenW (lpString=".ppt") returned 4 [0059.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.189] lstrlenW (lpString=".zip") returned 4 [0059.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.189] lstrlenW (lpString=".rar") returned 4 [0059.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.189] lstrlenW (lpString=".bz2") returned 4 [0059.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.189] lstrlenW (lpString=".7z") returned 3 [0059.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.189] lstrlenW (lpString=".dbf") returned 4 [0059.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.189] lstrlenW (lpString=".1cd") returned 4 [0059.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0059.189] lstrlenW (lpString=".jpg") returned 4 [0059.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.190] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20554) returned 1 [0059.190] CloseHandle (hObject=0x154) returned 1 [0059.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0059.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.190] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0059.190] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0059.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.190] GetLastError () returned 0x0 [0059.191] ReadFile (in: hFile=0x154, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x504a, lpOverlapped=0x0) returned 1 [0059.361] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5050, lpOverlapped=0x0) returned 1 [0059.362] ReadFile (in: hFile=0x154, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0059.362] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.362] SetEndOfFile (hFile=0x1f4) returned 1 [0059.369] CloseHandle (hObject=0x1f4) returned 1 [0059.369] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0059.369] SetEndOfFile (hFile=0x154) returned 1 [0059.370] CloseHandle (hObject=0x154) returned 1 [0059.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.684] lstrlenW (lpString=".doc") returned 4 [0059.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.686] lstrlenW (lpString=".docx") returned 5 [0059.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.688] lstrlenW (lpString=".pdf") returned 4 [0059.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.694] lstrlenW (lpString=".xls") returned 4 [0059.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.699] lstrlenW (lpString=".xlsx") returned 5 [0059.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.700] lstrlenW (lpString=".ppt") returned 4 [0059.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.704] lstrlenW (lpString=".zip") returned 4 [0059.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.704] lstrlenW (lpString=".rar") returned 4 [0059.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.708] lstrlenW (lpString=".bz2") returned 4 [0059.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString=".7z") returned 3 [0059.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.714] lstrlenW (lpString=".dbf") returned 4 [0059.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.716] lstrlenW (lpString=".1cd") returned 4 [0059.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0059.720] lstrlenW (lpString=".jpg") returned 4 [0059.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.515] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15733) returned 1 [0060.543] CloseHandle (hObject=0x158) returned 1 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.544] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.544] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.545] GetLastError () returned 0x0 [0060.545] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3d75, lpOverlapped=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0060.548] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.548] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.548] SetEndOfFile (hFile=0x16c) returned 1 [0060.548] CloseHandle (hObject=0x16c) returned 1 [0060.548] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.548] SetEndOfFile (hFile=0x158) returned 1 [0060.549] CloseHandle (hObject=0x158) returned 1 [0060.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString=".doc") returned 4 [0060.550] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString=".docx") returned 5 [0060.550] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.550] lstrlenW (lpString=".pdf") returned 4 [0060.550] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xls") returned 4 [0060.550] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xlsx") returned 5 [0060.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.550] lstrlenW (lpString=".ppt") returned 4 [0060.550] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString=".zip") returned 4 [0060.550] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".rar") returned 4 [0060.550] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".bz2") returned 4 [0060.550] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString=".7z") returned 3 [0060.550] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString=".dbf") returned 4 [0060.550] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString=".1cd") returned 4 [0060.550] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0060.550] lstrlenW (lpString=".jpg") returned 4 [0060.550] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.551] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1012) returned 1 [0060.551] CloseHandle (hObject=0x158) returned 1 [0060.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0060.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.551] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.551] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.552] GetLastError () returned 0x0 [0060.552] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3f4, lpOverlapped=0x0) returned 1 [0060.553] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x400, lpOverlapped=0x0) returned 1 [0060.554] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.554] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.554] SetEndOfFile (hFile=0x16c) returned 1 [0060.554] CloseHandle (hObject=0x16c) returned 1 [0060.554] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.554] SetEndOfFile (hFile=0x158) returned 1 [0060.555] CloseHandle (hObject=0x158) returned 1 [0060.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString=".doc") returned 4 [0060.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString=".docx") returned 5 [0060.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.556] lstrlenW (lpString=".pdf") returned 4 [0060.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString=".xls") returned 4 [0060.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.556] lstrlenW (lpString=".xlsx") returned 5 [0060.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.556] lstrlenW (lpString=".ppt") returned 4 [0060.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString=".zip") returned 4 [0060.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.556] lstrlenW (lpString=".rar") returned 4 [0060.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString=".bz2") returned 4 [0060.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString=".7z") returned 3 [0060.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString=".dbf") returned 4 [0060.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString=".1cd") returned 4 [0060.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0060.556] lstrlenW (lpString=".jpg") returned 4 [0060.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.557] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=880) returned 1 [0060.557] CloseHandle (hObject=0x158) returned 1 [0060.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0060.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.558] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.558] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.558] GetLastError () returned 0x0 [0060.558] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x370, lpOverlapped=0x0) returned 1 [0060.559] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x380, lpOverlapped=0x0) returned 1 [0060.560] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.560] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.560] SetEndOfFile (hFile=0x16c) returned 1 [0060.560] CloseHandle (hObject=0x16c) returned 1 [0060.561] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.561] SetEndOfFile (hFile=0x158) returned 1 [0060.561] CloseHandle (hObject=0x158) returned 1 [0060.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0060.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.562] lstrlenW (lpString=".doc") returned 4 [0060.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.562] lstrlenW (lpString=".docx") returned 5 [0060.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.562] lstrlenW (lpString=".pdf") returned 4 [0060.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.562] lstrlenW (lpString=".xls") returned 4 [0060.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.562] lstrlenW (lpString=".xlsx") returned 5 [0060.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.562] lstrlenW (lpString=".ppt") returned 4 [0060.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.562] lstrlenW (lpString=".zip") returned 4 [0060.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.562] lstrlenW (lpString=".rar") returned 4 [0060.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.563] lstrlenW (lpString=".bz2") returned 4 [0060.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.563] lstrlenW (lpString=".7z") returned 3 [0060.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.563] lstrlenW (lpString=".dbf") returned 4 [0060.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.563] lstrlenW (lpString=".1cd") returned 4 [0060.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0060.563] lstrlenW (lpString=".jpg") returned 4 [0060.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.563] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10146) returned 1 [0060.563] CloseHandle (hObject=0x158) returned 1 [0060.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0060.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.564] GetLastError () returned 0x0 [0060.564] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x27a2, lpOverlapped=0x0) returned 1 [0060.565] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0060.566] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.567] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.567] SetEndOfFile (hFile=0x16c) returned 1 [0060.567] CloseHandle (hObject=0x16c) returned 1 [0060.567] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.567] SetEndOfFile (hFile=0x158) returned 1 [0060.568] CloseHandle (hObject=0x158) returned 1 [0060.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0060.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.568] lstrlenW (lpString=".doc") returned 4 [0060.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.568] lstrlenW (lpString=".docx") returned 5 [0060.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.568] lstrlenW (lpString=".pdf") returned 4 [0060.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.568] lstrlenW (lpString=".xls") returned 4 [0060.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.568] lstrlenW (lpString=".xlsx") returned 5 [0060.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.568] lstrlenW (lpString=".ppt") returned 4 [0060.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.569] lstrlenW (lpString=".zip") returned 4 [0060.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.569] lstrlenW (lpString=".rar") returned 4 [0060.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.569] lstrlenW (lpString=".bz2") returned 4 [0060.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.569] lstrlenW (lpString=".7z") returned 3 [0060.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.569] lstrlenW (lpString=".dbf") returned 4 [0060.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.569] lstrlenW (lpString=".1cd") returned 4 [0060.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0060.569] lstrlenW (lpString=".jpg") returned 4 [0060.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.569] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1464) returned 1 [0060.569] CloseHandle (hObject=0x158) returned 1 [0060.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0060.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.570] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.570] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.570] GetLastError () returned 0x0 [0060.570] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5b8, lpOverlapped=0x0) returned 1 [0060.572] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0060.573] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.573] SetEndOfFile (hFile=0x16c) returned 1 [0060.573] CloseHandle (hObject=0x16c) returned 1 [0060.573] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.573] SetEndOfFile (hFile=0x158) returned 1 [0060.574] CloseHandle (hObject=0x158) returned 1 [0060.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0060.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.575] lstrlenW (lpString=".doc") returned 4 [0060.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString=".docx") returned 5 [0060.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.575] lstrlenW (lpString=".pdf") returned 4 [0060.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString=".xls") returned 4 [0060.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.575] lstrlenW (lpString=".xlsx") returned 5 [0060.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.575] lstrlenW (lpString=".ppt") returned 4 [0060.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.575] lstrlenW (lpString=".zip") returned 4 [0060.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.575] lstrlenW (lpString=".rar") returned 4 [0060.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString=".bz2") returned 4 [0060.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString=".7z") returned 3 [0060.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.575] lstrlenW (lpString=".dbf") returned 4 [0060.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.575] lstrlenW (lpString=".1cd") returned 4 [0060.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0060.575] lstrlenW (lpString=".jpg") returned 4 [0060.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.576] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1696) returned 1 [0060.576] CloseHandle (hObject=0x158) returned 1 [0060.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0060.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0060.576] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.576] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.576] GetLastError () returned 0x0 [0060.577] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6a0, lpOverlapped=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0060.820] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0060.820] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.821] SetEndOfFile (hFile=0x16c) returned 1 [0060.821] CloseHandle (hObject=0x16c) returned 1 [0060.821] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0060.821] SetEndOfFile (hFile=0x158) returned 1 [0060.822] CloseHandle (hObject=0x158) returned 1 [0060.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0060.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.925] lstrlenW (lpString=".doc") returned 4 [0060.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.925] lstrlenW (lpString=".docx") returned 5 [0060.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.926] lstrlenW (lpString=".pdf") returned 4 [0060.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString=".xls") returned 4 [0060.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.926] lstrlenW (lpString=".xlsx") returned 5 [0060.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.926] lstrlenW (lpString=".ppt") returned 4 [0060.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.926] lstrlenW (lpString=".zip") returned 4 [0060.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.926] lstrlenW (lpString=".rar") returned 4 [0060.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString=".bz2") returned 4 [0060.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString=".7z") returned 3 [0060.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.926] lstrlenW (lpString=".dbf") returned 4 [0060.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.926] lstrlenW (lpString=".1cd") returned 4 [0060.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0060.926] lstrlenW (lpString=".jpg") returned 4 [0060.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.899] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5752) returned 1 [0061.899] CloseHandle (hObject=0x190) returned 1 [0061.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0061.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.900] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0061.900] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0061.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0061.900] GetLastError () returned 0x0 [0061.900] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1678, lpOverlapped=0x0) returned 1 [0061.980] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1680, lpOverlapped=0x0) returned 1 [0061.981] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0061.981] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.981] SetEndOfFile (hFile=0x1ec) returned 1 [0061.981] CloseHandle (hObject=0x1ec) returned 1 [0061.981] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0061.981] SetEndOfFile (hFile=0x190) returned 1 [0061.982] CloseHandle (hObject=0x190) returned 1 [0061.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0061.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0061.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.983] lstrlenW (lpString=".doc") returned 4 [0061.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString=".docx") returned 5 [0061.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.983] lstrlenW (lpString=".pdf") returned 4 [0061.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString=".xls") returned 4 [0061.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.983] lstrlenW (lpString=".xlsx") returned 5 [0061.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.983] lstrlenW (lpString=".ppt") returned 4 [0061.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.983] lstrlenW (lpString=".zip") returned 4 [0061.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.983] lstrlenW (lpString=".rar") returned 4 [0061.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString=".bz2") returned 4 [0061.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString=".7z") returned 3 [0061.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.983] lstrlenW (lpString=".dbf") returned 4 [0061.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.984] lstrlenW (lpString=".1cd") returned 4 [0061.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0061.984] lstrlenW (lpString=".jpg") returned 4 [0061.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.178] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3016) returned 1 [0062.178] CloseHandle (hObject=0x1c8) returned 1 [0062.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0062.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.179] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.179] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.179] GetLastError () returned 0x0 [0062.179] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbc8, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0062.182] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.182] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.182] SetEndOfFile (hFile=0x1bc) returned 1 [0062.182] CloseHandle (hObject=0x1bc) returned 1 [0062.182] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.182] SetEndOfFile (hFile=0x1c8) returned 1 [0062.183] CloseHandle (hObject=0x1c8) returned 1 [0062.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0062.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString=".doc") returned 4 [0062.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString=".docx") returned 5 [0062.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.184] lstrlenW (lpString=".pdf") returned 4 [0062.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString=".xls") returned 4 [0062.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.184] lstrlenW (lpString=".xlsx") returned 5 [0062.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.184] lstrlenW (lpString=".ppt") returned 4 [0062.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString=".zip") returned 4 [0062.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.184] lstrlenW (lpString=".rar") returned 4 [0062.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString=".bz2") returned 4 [0062.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString=".7z") returned 3 [0062.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString=".dbf") returned 4 [0062.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString=".1cd") returned 4 [0062.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0062.184] lstrlenW (lpString=".jpg") returned 4 [0062.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.185] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3780) returned 1 [0062.185] CloseHandle (hObject=0x1c8) returned 1 [0062.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0062.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.185] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.185] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.186] GetLastError () returned 0x0 [0062.186] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xec4, lpOverlapped=0x0) returned 1 [0062.188] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xed0, lpOverlapped=0x0) returned 1 [0062.190] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.190] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.190] SetEndOfFile (hFile=0x1bc) returned 1 [0062.191] CloseHandle (hObject=0x1bc) returned 1 [0062.191] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.191] SetEndOfFile (hFile=0x1c8) returned 1 [0062.193] CloseHandle (hObject=0x1c8) returned 1 [0062.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0062.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.194] lstrlenW (lpString=".doc") returned 4 [0062.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.194] lstrlenW (lpString=".docx") returned 5 [0062.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.194] lstrlenW (lpString=".pdf") returned 4 [0062.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.194] lstrlenW (lpString=".xls") returned 4 [0062.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.194] lstrlenW (lpString=".xlsx") returned 5 [0062.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.194] lstrlenW (lpString=".ppt") returned 4 [0062.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.194] lstrlenW (lpString=".zip") returned 4 [0062.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.194] lstrlenW (lpString=".rar") returned 4 [0062.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.195] lstrlenW (lpString=".bz2") returned 4 [0062.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.195] lstrlenW (lpString=".7z") returned 3 [0062.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.195] lstrlenW (lpString=".dbf") returned 4 [0062.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.195] lstrlenW (lpString=".1cd") returned 4 [0062.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0062.195] lstrlenW (lpString=".jpg") returned 4 [0062.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.195] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4164) returned 1 [0062.195] CloseHandle (hObject=0x1c8) returned 1 [0062.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0062.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.196] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.196] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.196] GetLastError () returned 0x0 [0062.196] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1044, lpOverlapped=0x0) returned 1 [0062.199] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1050, lpOverlapped=0x0) returned 1 [0062.200] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.200] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.200] SetEndOfFile (hFile=0x1bc) returned 1 [0062.200] CloseHandle (hObject=0x1bc) returned 1 [0062.201] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.201] SetEndOfFile (hFile=0x1c8) returned 1 [0062.201] CloseHandle (hObject=0x1c8) returned 1 [0062.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0062.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.202] lstrlenW (lpString=".doc") returned 4 [0062.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.202] lstrlenW (lpString=".docx") returned 5 [0062.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.202] lstrlenW (lpString=".pdf") returned 4 [0062.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.202] lstrlenW (lpString=".xls") returned 4 [0062.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.202] lstrlenW (lpString=".xlsx") returned 5 [0062.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.202] lstrlenW (lpString=".ppt") returned 4 [0062.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.202] lstrlenW (lpString=".zip") returned 4 [0062.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.202] lstrlenW (lpString=".rar") returned 4 [0062.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.202] lstrlenW (lpString=".bz2") returned 4 [0062.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.203] lstrlenW (lpString=".7z") returned 3 [0062.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.203] lstrlenW (lpString=".dbf") returned 4 [0062.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.203] lstrlenW (lpString=".1cd") returned 4 [0062.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0062.203] lstrlenW (lpString=".jpg") returned 4 [0062.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.203] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=812) returned 1 [0062.203] CloseHandle (hObject=0x1c8) returned 1 [0062.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0062.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.204] GetLastError () returned 0x0 [0062.204] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x32c, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x330, lpOverlapped=0x0) returned 1 [0062.206] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.206] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.206] SetEndOfFile (hFile=0x1bc) returned 1 [0062.206] CloseHandle (hObject=0x1bc) returned 1 [0062.207] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.207] SetEndOfFile (hFile=0x1c8) returned 1 [0062.208] CloseHandle (hObject=0x1c8) returned 1 [0062.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0062.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.208] lstrlenW (lpString=".doc") returned 4 [0062.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.208] lstrlenW (lpString=".docx") returned 5 [0062.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.208] lstrlenW (lpString=".pdf") returned 4 [0062.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString=".xls") returned 4 [0062.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.209] lstrlenW (lpString=".xlsx") returned 5 [0062.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.209] lstrlenW (lpString=".ppt") returned 4 [0062.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.209] lstrlenW (lpString=".zip") returned 4 [0062.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.209] lstrlenW (lpString=".rar") returned 4 [0062.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString=".bz2") returned 4 [0062.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString=".7z") returned 3 [0062.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.209] lstrlenW (lpString=".dbf") returned 4 [0062.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.209] lstrlenW (lpString=".1cd") returned 4 [0062.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0062.209] lstrlenW (lpString=".jpg") returned 4 [0062.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.251] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13102) returned 1 [0062.251] CloseHandle (hObject=0x22c) returned 1 [0062.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0062.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.251] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.251] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.260] GetLastError () returned 0x0 [0062.260] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x332e, lpOverlapped=0x0) returned 1 [0062.262] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3330, lpOverlapped=0x0) returned 1 [0062.263] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.263] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.263] SetEndOfFile (hFile=0x214) returned 1 [0062.263] CloseHandle (hObject=0x214) returned 1 [0062.263] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.263] SetEndOfFile (hFile=0x22c) returned 1 [0062.264] CloseHandle (hObject=0x22c) returned 1 [0062.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0062.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString=".doc") returned 4 [0062.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString=".docx") returned 5 [0062.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.265] lstrlenW (lpString=".pdf") returned 4 [0062.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString=".xls") returned 4 [0062.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.265] lstrlenW (lpString=".xlsx") returned 5 [0062.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.265] lstrlenW (lpString=".ppt") returned 4 [0062.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString=".zip") returned 4 [0062.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.265] lstrlenW (lpString=".rar") returned 4 [0062.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString=".bz2") returned 4 [0062.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString=".7z") returned 3 [0062.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString=".dbf") returned 4 [0062.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString=".1cd") returned 4 [0062.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0062.265] lstrlenW (lpString=".jpg") returned 4 [0062.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.266] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6996) returned 1 [0062.266] CloseHandle (hObject=0x22c) returned 1 [0062.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0062.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.266] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.266] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.267] GetLastError () returned 0x0 [0062.267] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b54, lpOverlapped=0x0) returned 1 [0062.268] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0062.269] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.269] SetEndOfFile (hFile=0x214) returned 1 [0062.269] CloseHandle (hObject=0x214) returned 1 [0062.270] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.270] SetEndOfFile (hFile=0x22c) returned 1 [0062.271] CloseHandle (hObject=0x22c) returned 1 [0062.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0062.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.271] lstrlenW (lpString=".doc") returned 4 [0062.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.271] lstrlenW (lpString=".docx") returned 5 [0062.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.271] lstrlenW (lpString=".pdf") returned 4 [0062.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.271] lstrlenW (lpString=".xls") returned 4 [0062.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.271] lstrlenW (lpString=".xlsx") returned 5 [0062.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.271] lstrlenW (lpString=".ppt") returned 4 [0062.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.272] lstrlenW (lpString=".zip") returned 4 [0062.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.272] lstrlenW (lpString=".rar") returned 4 [0062.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.272] lstrlenW (lpString=".bz2") returned 4 [0062.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.272] lstrlenW (lpString=".7z") returned 3 [0062.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.272] lstrlenW (lpString=".dbf") returned 4 [0062.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.272] lstrlenW (lpString=".1cd") returned 4 [0062.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0062.272] lstrlenW (lpString=".jpg") returned 4 [0062.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.272] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9590) returned 1 [0062.272] CloseHandle (hObject=0x22c) returned 1 [0062.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0062.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.273] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.273] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.273] GetLastError () returned 0x0 [0062.273] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2576, lpOverlapped=0x0) returned 1 [0062.275] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2580, lpOverlapped=0x0) returned 1 [0062.276] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.276] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.276] SetEndOfFile (hFile=0x214) returned 1 [0062.276] CloseHandle (hObject=0x214) returned 1 [0062.276] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.276] SetEndOfFile (hFile=0x22c) returned 1 [0062.277] CloseHandle (hObject=0x22c) returned 1 [0062.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.278] lstrlenW (lpString=".doc") returned 4 [0062.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString=".docx") returned 5 [0062.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.278] lstrlenW (lpString=".pdf") returned 4 [0062.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString=".xls") returned 4 [0062.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.278] lstrlenW (lpString=".xlsx") returned 5 [0062.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.278] lstrlenW (lpString=".ppt") returned 4 [0062.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.278] lstrlenW (lpString=".zip") returned 4 [0062.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.278] lstrlenW (lpString=".rar") returned 4 [0062.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString=".bz2") returned 4 [0062.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString=".7z") returned 3 [0062.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.278] lstrlenW (lpString=".dbf") returned 4 [0062.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.278] lstrlenW (lpString=".1cd") returned 4 [0062.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0062.279] lstrlenW (lpString=".jpg") returned 4 [0062.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.279] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27552) returned 1 [0062.279] CloseHandle (hObject=0x22c) returned 1 [0062.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0062.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.279] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.279] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.280] GetLastError () returned 0x0 [0062.280] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0062.282] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0062.283] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0062.283] WriteFile (in: hFile=0x214, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.283] SetEndOfFile (hFile=0x214) returned 1 [0062.283] CloseHandle (hObject=0x214) returned 1 [0062.283] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.283] SetEndOfFile (hFile=0x22c) returned 1 [0062.284] CloseHandle (hObject=0x22c) returned 1 [0062.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0062.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.285] lstrlenW (lpString=".doc") returned 4 [0062.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.285] lstrlenW (lpString=".docx") returned 5 [0062.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.285] lstrlenW (lpString=".pdf") returned 4 [0062.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.285] lstrlenW (lpString=".xls") returned 4 [0062.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.285] lstrlenW (lpString=".xlsx") returned 5 [0062.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.285] lstrlenW (lpString=".ppt") returned 4 [0062.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.285] lstrlenW (lpString=".zip") returned 4 [0062.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.285] lstrlenW (lpString=".rar") returned 4 [0062.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.285] lstrlenW (lpString=".bz2") returned 4 [0062.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.286] lstrlenW (lpString=".7z") returned 3 [0062.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.286] lstrlenW (lpString=".dbf") returned 4 [0062.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.286] lstrlenW (lpString=".1cd") returned 4 [0062.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0062.416] lstrlenW (lpString=".jpg") returned 4 [0062.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.426] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12788) returned 1 [0062.426] CloseHandle (hObject=0x1bc) returned 1 [0062.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0062.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.447] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.447] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0062.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0063.504] GetLastError () returned 0x0 [0063.504] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x31f4, lpOverlapped=0x0) returned 1 [0063.508] WriteFile (in: hFile=0x154, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3200, lpOverlapped=0x0) returned 1 [0063.509] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.509] WriteFile (in: hFile=0x154, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.509] SetEndOfFile (hFile=0x154) returned 1 [0063.510] CloseHandle (hObject=0x154) returned 1 [0063.510] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.510] SetEndOfFile (hFile=0x16c) returned 1 [0063.510] CloseHandle (hObject=0x16c) returned 1 [0063.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0063.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.511] lstrlenW (lpString=".doc") returned 4 [0063.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.511] lstrlenW (lpString=".docx") returned 5 [0063.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.511] lstrlenW (lpString=".pdf") returned 4 [0063.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.511] lstrlenW (lpString=".xls") returned 4 [0063.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.511] lstrlenW (lpString=".xlsx") returned 5 [0063.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.511] lstrlenW (lpString=".ppt") returned 4 [0063.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.511] lstrlenW (lpString=".zip") returned 4 [0063.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.511] lstrlenW (lpString=".rar") returned 4 [0063.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.511] lstrlenW (lpString=".bz2") returned 4 [0063.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.511] lstrlenW (lpString=".7z") returned 3 [0063.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.511] lstrlenW (lpString=".dbf") returned 4 [0063.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.512] lstrlenW (lpString=".1cd") returned 4 [0063.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0063.512] lstrlenW (lpString=".jpg") returned 4 [0063.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.513] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2262) returned 1 [0063.513] CloseHandle (hObject=0x15c) returned 1 [0063.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0063.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0063.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.513] GetLastError () returned 0x0 [0063.513] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8d6, lpOverlapped=0x0) returned 1 [0063.515] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0063.516] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.516] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0063.516] SetEndOfFile (hFile=0x16c) returned 1 [0063.516] CloseHandle (hObject=0x16c) returned 1 [0063.516] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.516] SetEndOfFile (hFile=0x15c) returned 1 [0063.517] CloseHandle (hObject=0x15c) returned 1 [0063.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.517] lstrlenW (lpString=".doc") returned 4 [0063.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".docx") returned 5 [0063.518] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0063.518] lstrlenW (lpString=".pdf") returned 4 [0063.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".xls") returned 4 [0063.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.518] lstrlenW (lpString=".xlsx") returned 5 [0063.518] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0063.518] lstrlenW (lpString=".ppt") returned 4 [0063.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.518] lstrlenW (lpString=".zip") returned 4 [0063.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.518] lstrlenW (lpString=".rar") returned 4 [0063.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".bz2") returned 4 [0063.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".7z") returned 3 [0063.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.518] lstrlenW (lpString=".dbf") returned 4 [0063.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.518] lstrlenW (lpString=".1cd") returned 4 [0063.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0063.518] lstrlenW (lpString=".jpg") returned 4 [0063.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.519] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5270) returned 1 [0063.519] CloseHandle (hObject=0x15c) returned 1 [0063.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0063.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0063.520] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.520] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.520] GetLastError () returned 0x0 [0063.520] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1496, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0063.523] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.523] SetEndOfFile (hFile=0x16c) returned 1 [0063.524] CloseHandle (hObject=0x16c) returned 1 [0063.524] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.524] SetEndOfFile (hFile=0x15c) returned 1 [0063.524] CloseHandle (hObject=0x15c) returned 1 [0063.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0063.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.525] lstrlenW (lpString=".doc") returned 4 [0063.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.525] lstrlenW (lpString=".docx") returned 5 [0063.525] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0063.525] lstrlenW (lpString=".pdf") returned 4 [0063.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.525] lstrlenW (lpString=".xls") returned 4 [0063.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.525] lstrlenW (lpString=".xlsx") returned 5 [0063.525] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0063.525] lstrlenW (lpString=".ppt") returned 4 [0063.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.525] lstrlenW (lpString=".zip") returned 4 [0063.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.525] lstrlenW (lpString=".rar") returned 4 [0063.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.525] lstrlenW (lpString=".bz2") returned 4 [0063.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.525] lstrlenW (lpString=".7z") returned 3 [0063.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.525] lstrlenW (lpString=".dbf") returned 4 [0063.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.526] lstrlenW (lpString=".1cd") returned 4 [0063.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0063.526] lstrlenW (lpString=".jpg") returned 4 [0063.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.526] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=49546) returned 1 [0063.526] CloseHandle (hObject=0x15c) returned 1 [0063.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0063.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0063.527] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.527] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.527] GetLastError () returned 0x0 [0063.527] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xc18a, lpOverlapped=0x0) returned 1 [0063.530] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xc190, lpOverlapped=0x0) returned 1 [0063.532] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.532] SetEndOfFile (hFile=0x16c) returned 1 [0063.532] CloseHandle (hObject=0x16c) returned 1 [0063.532] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.532] SetEndOfFile (hFile=0x15c) returned 1 [0063.533] CloseHandle (hObject=0x15c) returned 1 [0063.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0063.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.533] lstrlenW (lpString=".doc") returned 4 [0063.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString=".docx") returned 5 [0063.534] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0063.534] lstrlenW (lpString=".pdf") returned 4 [0063.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString=".xls") returned 4 [0063.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.534] lstrlenW (lpString=".xlsx") returned 5 [0063.534] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0063.534] lstrlenW (lpString=".ppt") returned 4 [0063.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.534] lstrlenW (lpString=".zip") returned 4 [0063.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.534] lstrlenW (lpString=".rar") returned 4 [0063.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString=".bz2") returned 4 [0063.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString=".7z") returned 3 [0063.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.534] lstrlenW (lpString=".dbf") returned 4 [0063.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.534] lstrlenW (lpString=".1cd") returned 4 [0063.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0063.534] lstrlenW (lpString=".jpg") returned 4 [0063.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.537] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2966) returned 1 [0063.537] CloseHandle (hObject=0x15c) returned 1 [0063.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0063.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0063.537] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.537] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.538] GetLastError () returned 0x0 [0063.538] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb96, lpOverlapped=0x0) returned 1 [0063.539] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xba0, lpOverlapped=0x0) returned 1 [0063.540] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0063.540] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe2, lpOverlapped=0x0) returned 1 [0063.540] SetEndOfFile (hFile=0x16c) returned 1 [0063.541] CloseHandle (hObject=0x16c) returned 1 [0063.541] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0063.541] SetEndOfFile (hFile=0x15c) returned 1 [0063.541] CloseHandle (hObject=0x15c) returned 1 [0063.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0063.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.542] lstrlenW (lpString=".doc") returned 4 [0063.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.542] lstrlenW (lpString=".docx") returned 5 [0063.542] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0063.542] lstrlenW (lpString=".pdf") returned 4 [0063.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.542] lstrlenW (lpString=".xls") returned 4 [0063.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.542] lstrlenW (lpString=".xlsx") returned 5 [0063.542] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0063.542] lstrlenW (lpString=".ppt") returned 4 [0063.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.542] lstrlenW (lpString=".zip") returned 4 [0063.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.542] lstrlenW (lpString=".rar") returned 4 [0063.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.542] lstrlenW (lpString=".bz2") returned 4 [0063.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.542] lstrlenW (lpString=".7z") returned 3 [0063.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.543] lstrlenW (lpString=".dbf") returned 4 [0063.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.543] lstrlenW (lpString=".1cd") returned 4 [0063.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0063.543] lstrlenW (lpString=".jpg") returned 4 [0063.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.352] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10326) returned 1 [0064.353] CloseHandle (hObject=0x190) returned 1 [0064.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0064.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0064.786] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0064.786] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0064.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0065.058] GetLastError () returned 0x0 [0065.058] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2856, lpOverlapped=0x0) returned 1 [0065.060] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2860, lpOverlapped=0x0) returned 1 [0065.061] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.061] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.061] SetEndOfFile (hFile=0x1c8) returned 1 [0065.062] CloseHandle (hObject=0x1c8) returned 1 [0065.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.062] SetEndOfFile (hFile=0x1f4) returned 1 [0065.062] CloseHandle (hObject=0x1f4) returned 1 [0065.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0065.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.063] lstrlenW (lpString=".doc") returned 4 [0065.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.063] lstrlenW (lpString=".docx") returned 5 [0065.063] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0065.063] lstrlenW (lpString=".pdf") returned 4 [0065.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.063] lstrlenW (lpString=".xls") returned 4 [0065.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.063] lstrlenW (lpString=".xlsx") returned 5 [0065.063] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0065.063] lstrlenW (lpString=".ppt") returned 4 [0065.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.063] lstrlenW (lpString=".zip") returned 4 [0065.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.063] lstrlenW (lpString=".rar") returned 4 [0065.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.064] lstrlenW (lpString=".bz2") returned 4 [0065.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.064] lstrlenW (lpString=".7z") returned 3 [0065.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.064] lstrlenW (lpString=".dbf") returned 4 [0065.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.064] lstrlenW (lpString=".1cd") returned 4 [0065.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0065.064] lstrlenW (lpString=".jpg") returned 4 [0065.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.064] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2140) returned 1 [0065.064] CloseHandle (hObject=0x1f4) returned 1 [0065.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0065.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.065] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.065] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0065.065] GetLastError () returned 0x0 [0065.065] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x85c, lpOverlapped=0x0) returned 1 [0065.067] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x860, lpOverlapped=0x0) returned 1 [0065.068] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.068] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.068] SetEndOfFile (hFile=0x1c8) returned 1 [0065.068] CloseHandle (hObject=0x1c8) returned 1 [0065.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.068] SetEndOfFile (hFile=0x1f4) returned 1 [0065.069] CloseHandle (hObject=0x1f4) returned 1 [0065.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0065.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.069] lstrlenW (lpString=".doc") returned 4 [0065.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.069] lstrlenW (lpString=".docx") returned 5 [0065.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.069] lstrlenW (lpString=".pdf") returned 4 [0065.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.069] lstrlenW (lpString=".xls") returned 4 [0065.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.070] lstrlenW (lpString=".xlsx") returned 5 [0065.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.070] lstrlenW (lpString=".ppt") returned 4 [0065.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.070] lstrlenW (lpString=".zip") returned 4 [0065.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.070] lstrlenW (lpString=".rar") returned 4 [0065.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.070] lstrlenW (lpString=".bz2") returned 4 [0065.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.070] lstrlenW (lpString=".7z") returned 3 [0065.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.070] lstrlenW (lpString=".dbf") returned 4 [0065.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.070] lstrlenW (lpString=".1cd") returned 4 [0065.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0065.070] lstrlenW (lpString=".jpg") returned 4 [0065.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.070] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2780) returned 1 [0065.070] CloseHandle (hObject=0x1f4) returned 1 [0065.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0065.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0065.071] GetLastError () returned 0x0 [0065.071] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xadc, lpOverlapped=0x0) returned 1 [0065.073] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xae0, lpOverlapped=0x0) returned 1 [0065.074] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.074] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.074] SetEndOfFile (hFile=0x1c8) returned 1 [0065.074] CloseHandle (hObject=0x1c8) returned 1 [0065.074] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.074] SetEndOfFile (hFile=0x1f4) returned 1 [0065.075] CloseHandle (hObject=0x1f4) returned 1 [0065.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0065.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.075] lstrlenW (lpString=".doc") returned 4 [0065.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.075] lstrlenW (lpString=".docx") returned 5 [0065.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.075] lstrlenW (lpString=".pdf") returned 4 [0065.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.075] lstrlenW (lpString=".xls") returned 4 [0065.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.075] lstrlenW (lpString=".xlsx") returned 5 [0065.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.076] lstrlenW (lpString=".ppt") returned 4 [0065.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.076] lstrlenW (lpString=".zip") returned 4 [0065.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.076] lstrlenW (lpString=".rar") returned 4 [0065.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.076] lstrlenW (lpString=".bz2") returned 4 [0065.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.076] lstrlenW (lpString=".7z") returned 3 [0065.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.076] lstrlenW (lpString=".dbf") returned 4 [0065.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.076] lstrlenW (lpString=".1cd") returned 4 [0065.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0065.076] lstrlenW (lpString=".jpg") returned 4 [0065.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.076] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2960) returned 1 [0065.076] CloseHandle (hObject=0x1f4) returned 1 [0065.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0065.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0065.077] GetLastError () returned 0x0 [0065.077] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb90, lpOverlapped=0x0) returned 1 [0065.079] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xba0, lpOverlapped=0x0) returned 1 [0065.080] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.080] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.080] SetEndOfFile (hFile=0x1c8) returned 1 [0065.080] CloseHandle (hObject=0x1c8) returned 1 [0065.080] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.080] SetEndOfFile (hFile=0x1f4) returned 1 [0065.081] CloseHandle (hObject=0x1f4) returned 1 [0065.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString=".doc") returned 4 [0065.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString=".docx") returned 5 [0065.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.090] lstrlenW (lpString=".pdf") returned 4 [0065.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString=".xls") returned 4 [0065.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.090] lstrlenW (lpString=".xlsx") returned 5 [0065.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.090] lstrlenW (lpString=".ppt") returned 4 [0065.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString=".zip") returned 4 [0065.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.090] lstrlenW (lpString=".rar") returned 4 [0065.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString=".bz2") returned 4 [0065.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString=".7z") returned 3 [0065.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString=".dbf") returned 4 [0065.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString=".1cd") returned 4 [0065.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0065.090] lstrlenW (lpString=".jpg") returned 4 [0065.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.091] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2960) returned 1 [0065.091] CloseHandle (hObject=0x1f4) returned 1 [0065.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0065.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.091] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.091] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0065.092] GetLastError () returned 0x0 [0065.092] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb90, lpOverlapped=0x0) returned 1 [0065.141] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xba0, lpOverlapped=0x0) returned 1 [0065.147] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0065.148] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.148] SetEndOfFile (hFile=0x1c8) returned 1 [0065.644] CloseHandle (hObject=0x1c8) returned 1 [0065.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0065.646] SetEndOfFile (hFile=0x1f4) returned 1 [0065.660] CloseHandle (hObject=0x1f4) returned 1 [0065.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0066.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.126] lstrlenW (lpString=".doc") returned 4 [0066.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.126] lstrlenW (lpString=".docx") returned 5 [0066.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.126] lstrlenW (lpString=".pdf") returned 4 [0066.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.127] lstrlenW (lpString=".xls") returned 4 [0066.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.127] lstrlenW (lpString=".xlsx") returned 5 [0066.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.127] lstrlenW (lpString=".ppt") returned 4 [0066.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.127] lstrlenW (lpString=".zip") returned 4 [0066.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.127] lstrlenW (lpString=".rar") returned 4 [0066.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.127] lstrlenW (lpString=".bz2") returned 4 [0066.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.132] lstrlenW (lpString=".7z") returned 3 [0066.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.132] lstrlenW (lpString=".dbf") returned 4 [0066.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.132] lstrlenW (lpString=".1cd") returned 4 [0066.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0066.132] lstrlenW (lpString=".jpg") returned 4 [0066.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.396] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2020) returned 1 [0066.396] CloseHandle (hObject=0x1fc) returned 1 [0066.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0066.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.417] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.417] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.418] GetLastError () returned 0x0 [0066.418] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7e4, lpOverlapped=0x0) returned 1 [0066.419] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0066.420] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.420] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.420] SetEndOfFile (hFile=0x150) returned 1 [0066.420] CloseHandle (hObject=0x150) returned 1 [0066.421] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.421] SetEndOfFile (hFile=0x1fc) returned 1 [0066.421] CloseHandle (hObject=0x1fc) returned 1 [0066.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0066.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.422] lstrlenW (lpString=".doc") returned 4 [0066.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString=".docx") returned 5 [0066.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.422] lstrlenW (lpString=".pdf") returned 4 [0066.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString=".xls") returned 4 [0066.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.422] lstrlenW (lpString=".xlsx") returned 5 [0066.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.422] lstrlenW (lpString=".ppt") returned 4 [0066.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.422] lstrlenW (lpString=".zip") returned 4 [0066.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.422] lstrlenW (lpString=".rar") returned 4 [0066.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString=".bz2") returned 4 [0066.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString=".7z") returned 3 [0066.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.422] lstrlenW (lpString=".dbf") returned 4 [0066.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.423] lstrlenW (lpString=".1cd") returned 4 [0066.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0066.423] lstrlenW (lpString=".jpg") returned 4 [0066.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.423] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2324) returned 1 [0066.423] CloseHandle (hObject=0x1fc) returned 1 [0066.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0066.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.423] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.423] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.424] GetLastError () returned 0x0 [0066.424] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x914, lpOverlapped=0x0) returned 1 [0066.425] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x920, lpOverlapped=0x0) returned 1 [0066.426] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.426] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.426] SetEndOfFile (hFile=0x150) returned 1 [0066.426] CloseHandle (hObject=0x150) returned 1 [0066.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.426] SetEndOfFile (hFile=0x1fc) returned 1 [0066.427] CloseHandle (hObject=0x1fc) returned 1 [0066.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.428] lstrlenW (lpString=".doc") returned 4 [0066.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString=".docx") returned 5 [0066.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.428] lstrlenW (lpString=".pdf") returned 4 [0066.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString=".xls") returned 4 [0066.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.428] lstrlenW (lpString=".xlsx") returned 5 [0066.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.428] lstrlenW (lpString=".ppt") returned 4 [0066.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.428] lstrlenW (lpString=".zip") returned 4 [0066.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.428] lstrlenW (lpString=".rar") returned 4 [0066.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString=".bz2") returned 4 [0066.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString=".7z") returned 3 [0066.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.428] lstrlenW (lpString=".dbf") returned 4 [0066.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.428] lstrlenW (lpString=".1cd") returned 4 [0066.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0066.429] lstrlenW (lpString=".jpg") returned 4 [0066.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.429] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19068) returned 1 [0066.429] CloseHandle (hObject=0x1fc) returned 1 [0066.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0066.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.429] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.429] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.430] GetLastError () returned 0x0 [0066.430] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0066.432] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0066.433] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.433] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.433] SetEndOfFile (hFile=0x150) returned 1 [0066.433] CloseHandle (hObject=0x150) returned 1 [0066.433] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.433] SetEndOfFile (hFile=0x1fc) returned 1 [0066.434] CloseHandle (hObject=0x1fc) returned 1 [0066.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0066.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.435] lstrlenW (lpString=".doc") returned 4 [0066.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString=".docx") returned 5 [0066.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.435] lstrlenW (lpString=".pdf") returned 4 [0066.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString=".xls") returned 4 [0066.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.435] lstrlenW (lpString=".xlsx") returned 5 [0066.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.435] lstrlenW (lpString=".ppt") returned 4 [0066.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.435] lstrlenW (lpString=".zip") returned 4 [0066.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.435] lstrlenW (lpString=".rar") returned 4 [0066.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString=".bz2") returned 4 [0066.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString=".7z") returned 3 [0066.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.435] lstrlenW (lpString=".dbf") returned 4 [0066.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.435] lstrlenW (lpString=".1cd") returned 4 [0066.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0066.436] lstrlenW (lpString=".jpg") returned 4 [0066.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.436] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=580) returned 1 [0066.436] CloseHandle (hObject=0x1fc) returned 1 [0066.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0066.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.436] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.436] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.437] GetLastError () returned 0x0 [0066.437] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x244, lpOverlapped=0x0) returned 1 [0066.438] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x250, lpOverlapped=0x0) returned 1 [0066.439] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.439] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x150) returned 1 [0066.439] CloseHandle (hObject=0x150) returned 1 [0066.439] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x1fc) returned 1 [0066.440] CloseHandle (hObject=0x1fc) returned 1 [0066.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0066.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.440] lstrlenW (lpString=".doc") returned 4 [0066.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.440] lstrlenW (lpString=".docx") returned 5 [0066.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.440] lstrlenW (lpString=".pdf") returned 4 [0066.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.440] lstrlenW (lpString=".xls") returned 4 [0066.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.440] lstrlenW (lpString=".xlsx") returned 5 [0066.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.440] lstrlenW (lpString=".ppt") returned 4 [0066.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.441] lstrlenW (lpString=".zip") returned 4 [0066.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.441] lstrlenW (lpString=".rar") returned 4 [0066.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".bz2") returned 4 [0066.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".7z") returned 3 [0066.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.441] lstrlenW (lpString=".dbf") returned 4 [0066.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.441] lstrlenW (lpString=".1cd") returned 4 [0066.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0066.441] lstrlenW (lpString=".jpg") returned 4 [0066.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.441] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=296) returned 1 [0066.441] CloseHandle (hObject=0x1fc) returned 1 [0066.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0066.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.442] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.442] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.442] GetLastError () returned 0x0 [0066.442] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x128, lpOverlapped=0x0) returned 1 [0066.443] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x130, lpOverlapped=0x0) returned 1 [0066.444] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.444] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.444] SetEndOfFile (hFile=0x150) returned 1 [0066.444] CloseHandle (hObject=0x150) returned 1 [0066.444] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.444] SetEndOfFile (hFile=0x1fc) returned 1 [0066.445] CloseHandle (hObject=0x1fc) returned 1 [0066.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString=".doc") returned 4 [0066.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString=".docx") returned 5 [0066.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.446] lstrlenW (lpString=".pdf") returned 4 [0066.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString=".xls") returned 4 [0066.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.446] lstrlenW (lpString=".xlsx") returned 5 [0066.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.446] lstrlenW (lpString=".ppt") returned 4 [0066.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString=".zip") returned 4 [0066.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.446] lstrlenW (lpString=".rar") returned 4 [0066.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString=".bz2") returned 4 [0066.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString=".7z") returned 3 [0066.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString=".dbf") returned 4 [0066.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString=".1cd") returned 4 [0066.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0066.446] lstrlenW (lpString=".jpg") returned 4 [0066.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.447] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=552) returned 1 [0066.447] CloseHandle (hObject=0x1fc) returned 1 [0066.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0066.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.447] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.447] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.448] GetLastError () returned 0x0 [0066.448] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x228, lpOverlapped=0x0) returned 1 [0066.448] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x230, lpOverlapped=0x0) returned 1 [0066.452] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.452] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.452] SetEndOfFile (hFile=0x150) returned 1 [0066.452] CloseHandle (hObject=0x150) returned 1 [0066.452] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.452] SetEndOfFile (hFile=0x1fc) returned 1 [0066.453] CloseHandle (hObject=0x1fc) returned 1 [0066.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0066.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.454] lstrlenW (lpString=".doc") returned 4 [0066.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString=".docx") returned 5 [0066.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.454] lstrlenW (lpString=".pdf") returned 4 [0066.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString=".xls") returned 4 [0066.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.454] lstrlenW (lpString=".xlsx") returned 5 [0066.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.454] lstrlenW (lpString=".ppt") returned 4 [0066.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.454] lstrlenW (lpString=".zip") returned 4 [0066.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.454] lstrlenW (lpString=".rar") returned 4 [0066.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString=".bz2") returned 4 [0066.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString=".7z") returned 3 [0066.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.454] lstrlenW (lpString=".dbf") returned 4 [0066.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.454] lstrlenW (lpString=".1cd") returned 4 [0066.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0066.454] lstrlenW (lpString=".jpg") returned 4 [0066.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.455] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4148) returned 1 [0066.455] CloseHandle (hObject=0x1fc) returned 1 [0066.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0066.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.455] GetLastError () returned 0x0 [0066.455] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1034, lpOverlapped=0x0) returned 1 [0066.458] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1040, lpOverlapped=0x0) returned 1 [0066.459] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.459] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.459] SetEndOfFile (hFile=0x150) returned 1 [0066.459] CloseHandle (hObject=0x150) returned 1 [0066.459] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.459] SetEndOfFile (hFile=0x1fc) returned 1 [0066.460] CloseHandle (hObject=0x1fc) returned 1 [0066.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0066.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.460] lstrlenW (lpString=".doc") returned 4 [0066.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.460] lstrlenW (lpString=".docx") returned 5 [0066.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.460] lstrlenW (lpString=".pdf") returned 4 [0066.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.460] lstrlenW (lpString=".xls") returned 4 [0066.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.460] lstrlenW (lpString=".xlsx") returned 5 [0066.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.461] lstrlenW (lpString=".ppt") returned 4 [0066.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.461] lstrlenW (lpString=".zip") returned 4 [0066.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.461] lstrlenW (lpString=".rar") returned 4 [0066.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.461] lstrlenW (lpString=".bz2") returned 4 [0066.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.461] lstrlenW (lpString=".7z") returned 3 [0066.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.461] lstrlenW (lpString=".dbf") returned 4 [0066.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.461] lstrlenW (lpString=".1cd") returned 4 [0066.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0066.461] lstrlenW (lpString=".jpg") returned 4 [0066.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.470] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2300) returned 1 [0066.470] CloseHandle (hObject=0x1fc) returned 1 [0066.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0066.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.471] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.471] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.472] GetLastError () returned 0x0 [0066.472] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8fc, lpOverlapped=0x0) returned 1 [0066.479] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x900, lpOverlapped=0x0) returned 1 [0066.480] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.480] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.480] SetEndOfFile (hFile=0x150) returned 1 [0066.480] CloseHandle (hObject=0x150) returned 1 [0066.481] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.481] SetEndOfFile (hFile=0x1fc) returned 1 [0066.481] CloseHandle (hObject=0x1fc) returned 1 [0066.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.482] lstrlenW (lpString=".doc") returned 4 [0066.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString=".docx") returned 5 [0066.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.482] lstrlenW (lpString=".pdf") returned 4 [0066.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString=".xls") returned 4 [0066.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.482] lstrlenW (lpString=".xlsx") returned 5 [0066.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.482] lstrlenW (lpString=".ppt") returned 4 [0066.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.482] lstrlenW (lpString=".zip") returned 4 [0066.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.482] lstrlenW (lpString=".rar") returned 4 [0066.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString=".bz2") returned 4 [0066.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString=".7z") returned 3 [0066.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.483] lstrlenW (lpString=".dbf") returned 4 [0066.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.483] lstrlenW (lpString=".1cd") returned 4 [0066.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0066.483] lstrlenW (lpString=".jpg") returned 4 [0066.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.483] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3252) returned 1 [0066.483] CloseHandle (hObject=0x1fc) returned 1 [0066.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0066.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.484] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.484] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.484] GetLastError () returned 0x0 [0066.484] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xcb4, lpOverlapped=0x0) returned 1 [0066.486] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0066.487] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.487] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.487] SetEndOfFile (hFile=0x150) returned 1 [0066.487] CloseHandle (hObject=0x150) returned 1 [0066.487] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.487] SetEndOfFile (hFile=0x1fc) returned 1 [0066.488] CloseHandle (hObject=0x1fc) returned 1 [0066.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0066.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.488] lstrlenW (lpString=".doc") returned 4 [0066.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.488] lstrlenW (lpString=".docx") returned 5 [0066.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.488] lstrlenW (lpString=".pdf") returned 4 [0066.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.488] lstrlenW (lpString=".xls") returned 4 [0066.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.488] lstrlenW (lpString=".xlsx") returned 5 [0066.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.488] lstrlenW (lpString=".ppt") returned 4 [0066.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.488] lstrlenW (lpString=".zip") returned 4 [0066.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.489] lstrlenW (lpString=".rar") returned 4 [0066.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.489] lstrlenW (lpString=".bz2") returned 4 [0066.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.489] lstrlenW (lpString=".7z") returned 3 [0066.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.489] lstrlenW (lpString=".dbf") returned 4 [0066.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.489] lstrlenW (lpString=".1cd") returned 4 [0066.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0066.489] lstrlenW (lpString=".jpg") returned 4 [0066.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.489] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1382) returned 1 [0066.489] CloseHandle (hObject=0x1fc) returned 1 [0066.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0066.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.490] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.490] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.490] GetLastError () returned 0x0 [0066.490] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x566, lpOverlapped=0x0) returned 1 [0066.492] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x570, lpOverlapped=0x0) returned 1 [0066.493] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.493] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.493] SetEndOfFile (hFile=0x150) returned 1 [0066.493] CloseHandle (hObject=0x150) returned 1 [0066.493] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.493] SetEndOfFile (hFile=0x1fc) returned 1 [0066.494] CloseHandle (hObject=0x1fc) returned 1 [0066.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0066.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.494] lstrlenW (lpString=".doc") returned 4 [0066.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.494] lstrlenW (lpString=".docx") returned 5 [0066.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.494] lstrlenW (lpString=".pdf") returned 4 [0066.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.494] lstrlenW (lpString=".xls") returned 4 [0066.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.494] lstrlenW (lpString=".xlsx") returned 5 [0066.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.495] lstrlenW (lpString=".ppt") returned 4 [0066.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.495] lstrlenW (lpString=".zip") returned 4 [0066.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.495] lstrlenW (lpString=".rar") returned 4 [0066.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.495] lstrlenW (lpString=".bz2") returned 4 [0066.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.495] lstrlenW (lpString=".7z") returned 3 [0066.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.495] lstrlenW (lpString=".dbf") returned 4 [0066.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.495] lstrlenW (lpString=".1cd") returned 4 [0066.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0066.495] lstrlenW (lpString=".jpg") returned 4 [0066.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.495] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13042) returned 1 [0066.495] CloseHandle (hObject=0x1fc) returned 1 [0066.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0066.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.496] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.496] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0066.496] GetLastError () returned 0x0 [0066.496] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x32f2, lpOverlapped=0x0) returned 1 [0066.498] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3300, lpOverlapped=0x0) returned 1 [0066.499] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0066.499] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.499] SetEndOfFile (hFile=0x150) returned 1 [0066.500] CloseHandle (hObject=0x150) returned 1 [0066.500] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0066.500] SetEndOfFile (hFile=0x1fc) returned 1 [0066.500] CloseHandle (hObject=0x1fc) returned 1 [0066.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0066.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.501] lstrlenW (lpString=".doc") returned 4 [0066.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.501] lstrlenW (lpString=".docx") returned 5 [0066.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.501] lstrlenW (lpString=".pdf") returned 4 [0066.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.501] lstrlenW (lpString=".xls") returned 4 [0066.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.501] lstrlenW (lpString=".xlsx") returned 5 [0066.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.501] lstrlenW (lpString=".ppt") returned 4 [0066.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.501] lstrlenW (lpString=".zip") returned 4 [0066.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.501] lstrlenW (lpString=".rar") returned 4 [0066.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.501] lstrlenW (lpString=".bz2") returned 4 [0066.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.502] lstrlenW (lpString=".7z") returned 3 [0066.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.502] lstrlenW (lpString=".dbf") returned 4 [0066.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.502] lstrlenW (lpString=".1cd") returned 4 [0066.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0066.502] lstrlenW (lpString=".jpg") returned 4 [0066.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.206] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2700) returned 1 [0068.206] CloseHandle (hObject=0x1c8) returned 1 [0068.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0068.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.206] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.206] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.207] GetLastError () returned 0x0 [0068.207] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa8c, lpOverlapped=0x0) returned 1 [0068.209] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa90, lpOverlapped=0x0) returned 1 [0068.209] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.209] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.210] SetEndOfFile (hFile=0x1fc) returned 1 [0068.210] CloseHandle (hObject=0x1fc) returned 1 [0068.210] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.210] SetEndOfFile (hFile=0x1c8) returned 1 [0068.211] CloseHandle (hObject=0x1c8) returned 1 [0068.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.211] lstrlenW (lpString=".doc") returned 4 [0068.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString=".docx") returned 5 [0068.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.211] lstrlenW (lpString=".pdf") returned 4 [0068.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString=".xls") returned 4 [0068.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.211] lstrlenW (lpString=".xlsx") returned 5 [0068.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.211] lstrlenW (lpString=".ppt") returned 4 [0068.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.211] lstrlenW (lpString=".zip") returned 4 [0068.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.211] lstrlenW (lpString=".rar") returned 4 [0068.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.212] lstrlenW (lpString=".bz2") returned 4 [0068.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.212] lstrlenW (lpString=".7z") returned 3 [0068.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.212] lstrlenW (lpString=".dbf") returned 4 [0068.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.212] lstrlenW (lpString=".1cd") returned 4 [0068.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0068.212] lstrlenW (lpString=".jpg") returned 4 [0068.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.212] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12356) returned 1 [0068.212] CloseHandle (hObject=0x1c8) returned 1 [0068.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0068.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.213] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.213] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.213] GetLastError () returned 0x0 [0068.213] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3044, lpOverlapped=0x0) returned 1 [0068.215] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3050, lpOverlapped=0x0) returned 1 [0068.216] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.216] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.216] SetEndOfFile (hFile=0x1fc) returned 1 [0068.216] CloseHandle (hObject=0x1fc) returned 1 [0068.216] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.216] SetEndOfFile (hFile=0x1c8) returned 1 [0068.217] CloseHandle (hObject=0x1c8) returned 1 [0068.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0068.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString=".doc") returned 4 [0068.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString=".docx") returned 5 [0068.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.218] lstrlenW (lpString=".pdf") returned 4 [0068.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString=".xls") returned 4 [0068.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.218] lstrlenW (lpString=".xlsx") returned 5 [0068.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.218] lstrlenW (lpString=".ppt") returned 4 [0068.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString=".zip") returned 4 [0068.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.218] lstrlenW (lpString=".rar") returned 4 [0068.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString=".bz2") returned 4 [0068.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString=".7z") returned 3 [0068.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString=".dbf") returned 4 [0068.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString=".1cd") returned 4 [0068.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0068.218] lstrlenW (lpString=".jpg") returned 4 [0068.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.219] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6780) returned 1 [0068.219] CloseHandle (hObject=0x1c8) returned 1 [0068.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0068.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.220] GetLastError () returned 0x0 [0068.220] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0068.222] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0068.223] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.223] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.223] SetEndOfFile (hFile=0x1fc) returned 1 [0068.223] CloseHandle (hObject=0x1fc) returned 1 [0068.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.223] SetEndOfFile (hFile=0x1c8) returned 1 [0068.224] CloseHandle (hObject=0x1c8) returned 1 [0068.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0068.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.224] lstrlenW (lpString=".doc") returned 4 [0068.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.224] lstrlenW (lpString=".docx") returned 5 [0068.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.225] lstrlenW (lpString=".pdf") returned 4 [0068.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString=".xls") returned 4 [0068.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.225] lstrlenW (lpString=".xlsx") returned 5 [0068.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.225] lstrlenW (lpString=".ppt") returned 4 [0068.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.225] lstrlenW (lpString=".zip") returned 4 [0068.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.225] lstrlenW (lpString=".rar") returned 4 [0068.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString=".bz2") returned 4 [0068.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString=".7z") returned 3 [0068.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.225] lstrlenW (lpString=".dbf") returned 4 [0068.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.225] lstrlenW (lpString=".1cd") returned 4 [0068.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0068.225] lstrlenW (lpString=".jpg") returned 4 [0068.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.226] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2280) returned 1 [0068.226] CloseHandle (hObject=0x1c8) returned 1 [0068.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0068.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.226] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.226] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.226] GetLastError () returned 0x0 [0068.226] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8e8, lpOverlapped=0x0) returned 1 [0068.228] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0068.229] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.229] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.229] SetEndOfFile (hFile=0x1fc) returned 1 [0068.229] CloseHandle (hObject=0x1fc) returned 1 [0068.229] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.229] SetEndOfFile (hFile=0x1c8) returned 1 [0068.230] CloseHandle (hObject=0x1c8) returned 1 [0068.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0068.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.231] lstrlenW (lpString=".doc") returned 4 [0068.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString=".docx") returned 5 [0068.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.231] lstrlenW (lpString=".pdf") returned 4 [0068.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString=".xls") returned 4 [0068.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.231] lstrlenW (lpString=".xlsx") returned 5 [0068.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.231] lstrlenW (lpString=".ppt") returned 4 [0068.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.231] lstrlenW (lpString=".zip") returned 4 [0068.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.231] lstrlenW (lpString=".rar") returned 4 [0068.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString=".bz2") returned 4 [0068.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString=".7z") returned 3 [0068.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.231] lstrlenW (lpString=".dbf") returned 4 [0068.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.231] lstrlenW (lpString=".1cd") returned 4 [0068.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0068.232] lstrlenW (lpString=".jpg") returned 4 [0068.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.232] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=736) returned 1 [0068.232] CloseHandle (hObject=0x1c8) returned 1 [0068.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0068.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.233] GetLastError () returned 0x0 [0068.233] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2e0, lpOverlapped=0x0) returned 1 [0068.234] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0068.235] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.235] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.235] SetEndOfFile (hFile=0x1fc) returned 1 [0068.235] CloseHandle (hObject=0x1fc) returned 1 [0068.235] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.235] SetEndOfFile (hFile=0x1c8) returned 1 [0068.236] CloseHandle (hObject=0x1c8) returned 1 [0068.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString=".doc") returned 4 [0068.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString=".docx") returned 5 [0068.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.237] lstrlenW (lpString=".pdf") returned 4 [0068.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString=".xls") returned 4 [0068.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.237] lstrlenW (lpString=".xlsx") returned 5 [0068.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.237] lstrlenW (lpString=".ppt") returned 4 [0068.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString=".zip") returned 4 [0068.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.237] lstrlenW (lpString=".rar") returned 4 [0068.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString=".bz2") returned 4 [0068.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString=".7z") returned 3 [0068.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString=".dbf") returned 4 [0068.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString=".1cd") returned 4 [0068.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0068.237] lstrlenW (lpString=".jpg") returned 4 [0068.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.238] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17308) returned 1 [0068.238] CloseHandle (hObject=0x1c8) returned 1 [0068.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0068.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.238] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.238] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.239] GetLastError () returned 0x0 [0068.239] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x439c, lpOverlapped=0x0) returned 1 [0068.240] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0068.241] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.242] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.242] SetEndOfFile (hFile=0x1fc) returned 1 [0068.242] CloseHandle (hObject=0x1fc) returned 1 [0068.242] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.242] SetEndOfFile (hFile=0x1c8) returned 1 [0068.243] CloseHandle (hObject=0x1c8) returned 1 [0068.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.243] lstrlenW (lpString=".doc") returned 4 [0068.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".docx") returned 5 [0068.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.243] lstrlenW (lpString=".pdf") returned 4 [0068.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".xls") returned 4 [0068.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.243] lstrlenW (lpString=".xlsx") returned 5 [0068.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.243] lstrlenW (lpString=".ppt") returned 4 [0068.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.244] lstrlenW (lpString=".zip") returned 4 [0068.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.244] lstrlenW (lpString=".rar") returned 4 [0068.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString=".bz2") returned 4 [0068.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString=".7z") returned 3 [0068.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.244] lstrlenW (lpString=".dbf") returned 4 [0068.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.244] lstrlenW (lpString=".1cd") returned 4 [0068.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0068.244] lstrlenW (lpString=".jpg") returned 4 [0068.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.458] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7944) returned 1 [0068.458] CloseHandle (hObject=0x1c0) returned 1 [0068.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0068.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0068.458] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.458] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.458] GetLastError () returned 0x0 [0068.459] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f08, lpOverlapped=0x0) returned 1 [0068.460] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0068.461] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.461] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.461] SetEndOfFile (hFile=0x1f0) returned 1 [0068.461] CloseHandle (hObject=0x1f0) returned 1 [0068.461] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.461] SetEndOfFile (hFile=0x1c0) returned 1 [0068.462] CloseHandle (hObject=0x1c0) returned 1 [0068.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0068.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.462] lstrlenW (lpString=".doc") returned 4 [0068.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".docx") returned 5 [0068.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.463] lstrlenW (lpString=".pdf") returned 4 [0068.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".xls") returned 4 [0068.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.463] lstrlenW (lpString=".xlsx") returned 5 [0068.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.463] lstrlenW (lpString=".ppt") returned 4 [0068.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.463] lstrlenW (lpString=".zip") returned 4 [0068.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.463] lstrlenW (lpString=".rar") returned 4 [0068.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".bz2") returned 4 [0068.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".7z") returned 3 [0068.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.463] lstrlenW (lpString=".dbf") returned 4 [0068.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.463] lstrlenW (lpString=".1cd") returned 4 [0068.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.463] lstrlenW (lpString=".jpg") returned 4 [0068.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".pdf") returned 4 [0068.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.463] lstrlenW (lpString=".xls") returned 4 [0068.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.464] lstrlenW (lpString=".xlsx") returned 5 [0068.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.464] lstrlenW (lpString=".ppt") returned 4 [0068.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.464] lstrlenW (lpString=".zip") returned 4 [0068.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.464] lstrlenW (lpString=".rar") returned 4 [0068.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.464] lstrlenW (lpString=".bz2") returned 4 [0068.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.464] lstrlenW (lpString=".7z") returned 3 [0068.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.464] lstrlenW (lpString=".dbf") returned 4 [0068.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.464] lstrlenW (lpString=".1cd") returned 4 [0068.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0068.464] lstrlenW (lpString=".jpg") returned 4 [0068.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.464] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") [0068.465] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=30240) returned 1 [0068.465] CloseHandle (hObject=0x1c0) returned 1 [0068.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0068.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0068.465] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.465] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.466] GetLastError () returned 0x0 [0068.466] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7620, lpOverlapped=0x0) returned 1 [0068.696] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7630, lpOverlapped=0x0) returned 1 [0068.699] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.699] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.699] SetEndOfFile (hFile=0x1f0) returned 1 [0068.699] CloseHandle (hObject=0x1f0) returned 1 [0068.699] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.699] SetEndOfFile (hFile=0x1c0) returned 1 [0068.704] CloseHandle (hObject=0x1c0) returned 1 [0068.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0068.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.704] lstrlenW (lpString=".doc") returned 4 [0068.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.704] lstrlenW (lpString=".docx") returned 5 [0068.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.704] lstrlenW (lpString=".pdf") returned 4 [0068.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.704] lstrlenW (lpString=".xls") returned 4 [0068.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.704] lstrlenW (lpString=".xlsx") returned 5 [0068.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.704] lstrlenW (lpString=".ppt") returned 4 [0068.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.705] lstrlenW (lpString=".zip") returned 4 [0068.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.705] lstrlenW (lpString=".rar") returned 4 [0068.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString=".bz2") returned 4 [0068.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString=".7z") returned 3 [0068.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.705] lstrlenW (lpString=".dbf") returned 4 [0068.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.705] lstrlenW (lpString=".1cd") returned 4 [0068.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.705] lstrlenW (lpString=".jpg") returned 4 [0068.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString=".pdf") returned 4 [0068.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString=".xls") returned 4 [0068.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.705] lstrlenW (lpString=".xlsx") returned 5 [0068.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.705] lstrlenW (lpString=".ppt") returned 4 [0068.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.705] lstrlenW (lpString=".zip") returned 4 [0068.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.705] lstrlenW (lpString=".rar") returned 4 [0068.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.705] lstrlenW (lpString=".bz2") returned 4 [0068.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.706] lstrlenW (lpString=".7z") returned 3 [0068.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.706] lstrlenW (lpString=".dbf") returned 4 [0068.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.706] lstrlenW (lpString=".1cd") returned 4 [0068.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0068.706] lstrlenW (lpString=".jpg") returned 4 [0068.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.706] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") [0068.706] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15856) returned 1 [0068.706] CloseHandle (hObject=0x1c0) returned 1 [0068.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0068.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0068.707] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.707] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0068.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.707] GetLastError () returned 0x0 [0068.707] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3df0, lpOverlapped=0x0) returned 1 [0068.790] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0068.791] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0068.791] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.791] SetEndOfFile (hFile=0x1f0) returned 1 [0069.301] CloseHandle (hObject=0x1f0) returned 1 [0069.317] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0069.318] SetEndOfFile (hFile=0x1c0) returned 1 [0069.318] CloseHandle (hObject=0x1c0) returned 1 [0069.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0069.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.490] lstrlenW (lpString=".doc") returned 4 [0069.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.490] lstrlenW (lpString=".docx") returned 5 [0069.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.491] lstrlenW (lpString=".pdf") returned 4 [0069.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.491] lstrlenW (lpString=".xls") returned 4 [0069.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.504] lstrlenW (lpString=".xlsx") returned 5 [0069.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.504] lstrlenW (lpString=".ppt") returned 4 [0069.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.504] lstrlenW (lpString=".zip") returned 4 [0069.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.504] lstrlenW (lpString=".rar") returned 4 [0069.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString=".bz2") returned 4 [0069.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString=".7z") returned 3 [0069.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.504] lstrlenW (lpString=".dbf") returned 4 [0069.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.504] lstrlenW (lpString=".1cd") returned 4 [0069.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.504] lstrlenW (lpString=".jpg") returned 4 [0069.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString=".pdf") returned 4 [0069.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.504] lstrlenW (lpString=".xls") returned 4 [0069.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.504] lstrlenW (lpString=".xlsx") returned 5 [0069.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.505] lstrlenW (lpString=".ppt") returned 4 [0069.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.505] lstrlenW (lpString=".zip") returned 4 [0069.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.505] lstrlenW (lpString=".rar") returned 4 [0069.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.505] lstrlenW (lpString=".bz2") returned 4 [0069.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.505] lstrlenW (lpString=".7z") returned 3 [0069.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.505] lstrlenW (lpString=".dbf") returned 4 [0069.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.505] lstrlenW (lpString=".1cd") returned 4 [0069.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0069.505] lstrlenW (lpString=".jpg") returned 4 [0069.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.505] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") [0070.212] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4074) returned 1 [0070.212] CloseHandle (hObject=0x158) returned 1 [0070.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0070.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.213] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.213] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.213] GetLastError () returned 0x0 [0070.213] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xfea, lpOverlapped=0x0) returned 1 [0070.215] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xff0, lpOverlapped=0x0) returned 1 [0070.216] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.216] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.216] SetEndOfFile (hFile=0x1f0) returned 1 [0070.216] CloseHandle (hObject=0x1f0) returned 1 [0070.216] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.216] SetEndOfFile (hFile=0x158) returned 1 [0070.217] CloseHandle (hObject=0x158) returned 1 [0070.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0070.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.217] lstrlenW (lpString=".doc") returned 4 [0070.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.217] lstrlenW (lpString=".docx") returned 5 [0070.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.217] lstrlenW (lpString=".pdf") returned 4 [0070.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.217] lstrlenW (lpString=".xls") returned 4 [0070.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.218] lstrlenW (lpString=".xlsx") returned 5 [0070.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.218] lstrlenW (lpString=".ppt") returned 4 [0070.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.218] lstrlenW (lpString=".zip") returned 4 [0070.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.218] lstrlenW (lpString=".rar") returned 4 [0070.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString=".bz2") returned 4 [0070.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString=".7z") returned 3 [0070.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.218] lstrlenW (lpString=".dbf") returned 4 [0070.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.218] lstrlenW (lpString=".1cd") returned 4 [0070.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.218] lstrlenW (lpString=".jpg") returned 4 [0070.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString=".pdf") returned 4 [0070.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString=".xls") returned 4 [0070.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.218] lstrlenW (lpString=".xlsx") returned 5 [0070.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.218] lstrlenW (lpString=".ppt") returned 4 [0070.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.218] lstrlenW (lpString=".zip") returned 4 [0070.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.219] lstrlenW (lpString=".rar") returned 4 [0070.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.219] lstrlenW (lpString=".bz2") returned 4 [0070.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.219] lstrlenW (lpString=".7z") returned 3 [0070.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.219] lstrlenW (lpString=".dbf") returned 4 [0070.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.219] lstrlenW (lpString=".1cd") returned 4 [0070.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0070.219] lstrlenW (lpString=".jpg") returned 4 [0070.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.219] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") [0070.222] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11002) returned 1 [0070.222] CloseHandle (hObject=0x158) returned 1 [0070.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0070.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.222] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.222] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.223] GetLastError () returned 0x0 [0070.223] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2afa, lpOverlapped=0x0) returned 1 [0070.225] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0070.226] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.226] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.226] SetEndOfFile (hFile=0x1f0) returned 1 [0070.226] CloseHandle (hObject=0x1f0) returned 1 [0070.226] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.226] SetEndOfFile (hFile=0x158) returned 1 [0070.236] CloseHandle (hObject=0x158) returned 1 [0070.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0070.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.265] lstrlenW (lpString=".doc") returned 4 [0070.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString=".docx") returned 5 [0070.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.265] lstrlenW (lpString=".pdf") returned 4 [0070.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString=".xls") returned 4 [0070.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.265] lstrlenW (lpString=".xlsx") returned 5 [0070.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.265] lstrlenW (lpString=".ppt") returned 4 [0070.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.265] lstrlenW (lpString=".zip") returned 4 [0070.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.265] lstrlenW (lpString=".rar") returned 4 [0070.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString=".bz2") returned 4 [0070.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString=".7z") returned 3 [0070.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.265] lstrlenW (lpString=".dbf") returned 4 [0070.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.265] lstrlenW (lpString=".1cd") returned 4 [0070.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.266] lstrlenW (lpString=".jpg") returned 4 [0070.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString=".pdf") returned 4 [0070.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString=".xls") returned 4 [0070.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.266] lstrlenW (lpString=".xlsx") returned 5 [0070.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.266] lstrlenW (lpString=".ppt") returned 4 [0070.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.266] lstrlenW (lpString=".zip") returned 4 [0070.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.266] lstrlenW (lpString=".rar") returned 4 [0070.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString=".bz2") returned 4 [0070.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString=".7z") returned 3 [0070.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.266] lstrlenW (lpString=".dbf") returned 4 [0070.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.266] lstrlenW (lpString=".1cd") returned 4 [0070.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0070.266] lstrlenW (lpString=".jpg") returned 4 [0070.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.266] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") [0070.267] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16396) returned 1 [0070.267] CloseHandle (hObject=0x158) returned 1 [0070.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0070.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.267] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.267] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.268] GetLastError () returned 0x0 [0070.268] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x400c, lpOverlapped=0x0) returned 1 [0070.273] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4010, lpOverlapped=0x0) returned 1 [0070.274] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.274] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.274] SetEndOfFile (hFile=0x1f0) returned 1 [0070.274] CloseHandle (hObject=0x1f0) returned 1 [0070.274] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.274] SetEndOfFile (hFile=0x158) returned 1 [0070.275] CloseHandle (hObject=0x158) returned 1 [0070.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0070.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.275] lstrlenW (lpString=".doc") returned 4 [0070.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".docx") returned 5 [0070.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.276] lstrlenW (lpString=".pdf") returned 4 [0070.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".xls") returned 4 [0070.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.276] lstrlenW (lpString=".xlsx") returned 5 [0070.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.276] lstrlenW (lpString=".ppt") returned 4 [0070.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.276] lstrlenW (lpString=".zip") returned 4 [0070.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.276] lstrlenW (lpString=".rar") returned 4 [0070.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".bz2") returned 4 [0070.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".7z") returned 3 [0070.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.276] lstrlenW (lpString=".dbf") returned 4 [0070.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.276] lstrlenW (lpString=".1cd") returned 4 [0070.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.276] lstrlenW (lpString=".jpg") returned 4 [0070.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".pdf") returned 4 [0070.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.276] lstrlenW (lpString=".xls") returned 4 [0070.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.276] lstrlenW (lpString=".xlsx") returned 5 [0070.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.277] lstrlenW (lpString=".ppt") returned 4 [0070.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.277] lstrlenW (lpString=".zip") returned 4 [0070.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.277] lstrlenW (lpString=".rar") returned 4 [0070.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.277] lstrlenW (lpString=".bz2") returned 4 [0070.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.277] lstrlenW (lpString=".7z") returned 3 [0070.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.277] lstrlenW (lpString=".dbf") returned 4 [0070.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.277] lstrlenW (lpString=".1cd") returned 4 [0070.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0070.277] lstrlenW (lpString=".jpg") returned 4 [0070.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.277] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") [0070.277] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4796) returned 1 [0070.278] CloseHandle (hObject=0x158) returned 1 [0070.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0070.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.278] GetLastError () returned 0x0 [0070.278] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x12bc, lpOverlapped=0x0) returned 1 [0070.280] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0070.281] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.281] SetEndOfFile (hFile=0x1f0) returned 1 [0070.281] CloseHandle (hObject=0x1f0) returned 1 [0070.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.282] SetEndOfFile (hFile=0x158) returned 1 [0070.282] CloseHandle (hObject=0x158) returned 1 [0070.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0070.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.283] lstrlenW (lpString=".doc") returned 4 [0070.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.283] lstrlenW (lpString=".docx") returned 5 [0070.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.283] lstrlenW (lpString=".pdf") returned 4 [0070.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.283] lstrlenW (lpString=".xls") returned 4 [0070.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.283] lstrlenW (lpString=".xlsx") returned 5 [0070.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.283] lstrlenW (lpString=".ppt") returned 4 [0070.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.283] lstrlenW (lpString=".zip") returned 4 [0070.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.283] lstrlenW (lpString=".rar") returned 4 [0070.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.283] lstrlenW (lpString=".bz2") returned 4 [0070.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.283] lstrlenW (lpString=".7z") returned 3 [0070.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.283] lstrlenW (lpString=".dbf") returned 4 [0070.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".1cd") returned 4 [0070.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".jpg") returned 4 [0070.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString=".pdf") returned 4 [0070.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString=".xls") returned 4 [0070.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.284] lstrlenW (lpString=".xlsx") returned 5 [0070.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.284] lstrlenW (lpString=".ppt") returned 4 [0070.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".zip") returned 4 [0070.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.284] lstrlenW (lpString=".rar") returned 4 [0070.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString=".bz2") returned 4 [0070.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString=".7z") returned 3 [0070.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".dbf") returned 4 [0070.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".1cd") returned 4 [0070.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0070.284] lstrlenW (lpString=".jpg") returned 4 [0070.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.285] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") [0070.285] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2108) returned 1 [0070.285] CloseHandle (hObject=0x158) returned 1 [0070.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0070.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.286] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.286] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.286] GetLastError () returned 0x0 [0070.286] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x83c, lpOverlapped=0x0) returned 1 [0070.288] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x840, lpOverlapped=0x0) returned 1 [0070.909] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.911] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.915] SetEndOfFile (hFile=0x1f0) returned 1 [0070.923] CloseHandle (hObject=0x1f0) returned 1 [0070.925] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.926] SetEndOfFile (hFile=0x158) returned 1 [0070.947] CloseHandle (hObject=0x158) returned 1 [0070.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.204] lstrlenW (lpString=".doc") returned 4 [0071.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString=".docx") returned 5 [0071.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.205] lstrlenW (lpString=".pdf") returned 4 [0071.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString=".xls") returned 4 [0071.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.205] lstrlenW (lpString=".xlsx") returned 5 [0071.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.205] lstrlenW (lpString=".ppt") returned 4 [0071.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.205] lstrlenW (lpString=".zip") returned 4 [0071.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.205] lstrlenW (lpString=".rar") returned 4 [0071.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString=".bz2") returned 4 [0071.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString=".7z") returned 3 [0071.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.205] lstrlenW (lpString=".dbf") returned 4 [0071.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.205] lstrlenW (lpString=".1cd") returned 4 [0071.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.205] lstrlenW (lpString=".jpg") returned 4 [0071.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.205] lstrlenW (lpString=".pdf") returned 4 [0071.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString=".xls") returned 4 [0071.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.206] lstrlenW (lpString=".xlsx") returned 5 [0071.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.206] lstrlenW (lpString=".ppt") returned 4 [0071.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.206] lstrlenW (lpString=".zip") returned 4 [0071.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.206] lstrlenW (lpString=".rar") returned 4 [0071.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString=".bz2") returned 4 [0071.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString=".7z") returned 3 [0071.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.206] lstrlenW (lpString=".dbf") returned 4 [0071.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.206] lstrlenW (lpString=".1cd") returned 4 [0071.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0071.206] lstrlenW (lpString=".jpg") returned 4 [0071.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.206] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") [0072.107] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1160) returned 1 [0072.107] CloseHandle (hObject=0x1f4) returned 1 [0072.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0072.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.107] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.107] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0072.107] GetLastError () returned 0x0 [0072.107] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x488, lpOverlapped=0x0) returned 1 [0072.138] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x490, lpOverlapped=0x0) returned 1 [0072.139] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.139] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.139] SetEndOfFile (hFile=0x158) returned 1 [0072.144] CloseHandle (hObject=0x158) returned 1 [0072.144] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.144] SetEndOfFile (hFile=0x1f4) returned 1 [0072.152] CloseHandle (hObject=0x1f4) returned 1 [0072.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.161] lstrlenW (lpString=".doc") returned 4 [0072.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.161] lstrlenW (lpString=".docx") returned 5 [0072.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.161] lstrlenW (lpString=".pdf") returned 4 [0072.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.161] lstrlenW (lpString=".xls") returned 4 [0072.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.161] lstrlenW (lpString=".xlsx") returned 5 [0072.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.161] lstrlenW (lpString=".ppt") returned 4 [0072.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.161] lstrlenW (lpString=".zip") returned 4 [0072.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.161] lstrlenW (lpString=".rar") returned 4 [0072.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.161] lstrlenW (lpString=".bz2") returned 4 [0072.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString=".7z") returned 3 [0072.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.162] lstrlenW (lpString=".dbf") returned 4 [0072.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.162] lstrlenW (lpString=".1cd") returned 4 [0072.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.162] lstrlenW (lpString=".jpg") returned 4 [0072.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString=".pdf") returned 4 [0072.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString=".xls") returned 4 [0072.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.162] lstrlenW (lpString=".xlsx") returned 5 [0072.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.162] lstrlenW (lpString=".ppt") returned 4 [0072.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.162] lstrlenW (lpString=".zip") returned 4 [0072.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.162] lstrlenW (lpString=".rar") returned 4 [0072.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString=".bz2") returned 4 [0072.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.162] lstrlenW (lpString=".7z") returned 3 [0072.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.162] lstrlenW (lpString=".dbf") returned 4 [0072.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.163] lstrlenW (lpString=".1cd") returned 4 [0072.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0072.163] lstrlenW (lpString=".jpg") returned 4 [0072.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.163] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") [0072.163] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4396) returned 1 [0072.163] CloseHandle (hObject=0x1f4) returned 1 [0072.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0072.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.163] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.163] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0072.164] GetLastError () returned 0x0 [0072.164] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x112c, lpOverlapped=0x0) returned 1 [0072.167] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1130, lpOverlapped=0x0) returned 1 [0072.168] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.168] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.168] SetEndOfFile (hFile=0x158) returned 1 [0072.168] CloseHandle (hObject=0x158) returned 1 [0072.168] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.168] SetEndOfFile (hFile=0x1f4) returned 1 [0072.169] CloseHandle (hObject=0x1f4) returned 1 [0072.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0072.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.169] lstrlenW (lpString=".doc") returned 4 [0072.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.169] lstrlenW (lpString=".docx") returned 5 [0072.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.169] lstrlenW (lpString=".pdf") returned 4 [0072.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString=".xls") returned 4 [0072.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.170] lstrlenW (lpString=".xlsx") returned 5 [0072.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.170] lstrlenW (lpString=".ppt") returned 4 [0072.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.170] lstrlenW (lpString=".zip") returned 4 [0072.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.170] lstrlenW (lpString=".rar") returned 4 [0072.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString=".bz2") returned 4 [0072.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString=".7z") returned 3 [0072.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.170] lstrlenW (lpString=".dbf") returned 4 [0072.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.170] lstrlenW (lpString=".1cd") returned 4 [0072.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.170] lstrlenW (lpString=".jpg") returned 4 [0072.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString=".pdf") returned 4 [0072.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.170] lstrlenW (lpString=".xls") returned 4 [0072.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.170] lstrlenW (lpString=".xlsx") returned 5 [0072.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.171] lstrlenW (lpString=".ppt") returned 4 [0072.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.171] lstrlenW (lpString=".zip") returned 4 [0072.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.171] lstrlenW (lpString=".rar") returned 4 [0072.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.171] lstrlenW (lpString=".bz2") returned 4 [0072.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.171] lstrlenW (lpString=".7z") returned 3 [0072.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.171] lstrlenW (lpString=".dbf") returned 4 [0072.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.171] lstrlenW (lpString=".1cd") returned 4 [0072.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0072.171] lstrlenW (lpString=".jpg") returned 4 [0072.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.171] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") [0072.172] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3696) returned 1 [0072.172] CloseHandle (hObject=0x1f4) returned 1 [0072.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0072.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0072.173] GetLastError () returned 0x0 [0072.173] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe70, lpOverlapped=0x0) returned 1 [0072.175] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe80, lpOverlapped=0x0) returned 1 [0072.176] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.176] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.176] SetEndOfFile (hFile=0x158) returned 1 [0072.177] CloseHandle (hObject=0x158) returned 1 [0072.177] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.177] SetEndOfFile (hFile=0x1f4) returned 1 [0072.178] CloseHandle (hObject=0x1f4) returned 1 [0072.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.178] lstrlenW (lpString=".doc") returned 4 [0072.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.178] lstrlenW (lpString=".docx") returned 5 [0072.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.179] lstrlenW (lpString=".pdf") returned 4 [0072.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString=".xls") returned 4 [0072.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.179] lstrlenW (lpString=".xlsx") returned 5 [0072.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.179] lstrlenW (lpString=".ppt") returned 4 [0072.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.179] lstrlenW (lpString=".zip") returned 4 [0072.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.179] lstrlenW (lpString=".rar") returned 4 [0072.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString=".bz2") returned 4 [0072.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString=".7z") returned 3 [0072.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.179] lstrlenW (lpString=".dbf") returned 4 [0072.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.179] lstrlenW (lpString=".1cd") returned 4 [0072.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.179] lstrlenW (lpString=".jpg") returned 4 [0072.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.179] lstrlenW (lpString=".pdf") returned 4 [0072.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString=".xls") returned 4 [0072.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.180] lstrlenW (lpString=".xlsx") returned 5 [0072.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.180] lstrlenW (lpString=".ppt") returned 4 [0072.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.180] lstrlenW (lpString=".zip") returned 4 [0072.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.180] lstrlenW (lpString=".rar") returned 4 [0072.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString=".bz2") returned 4 [0072.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString=".7z") returned 3 [0072.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.180] lstrlenW (lpString=".dbf") returned 4 [0072.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.180] lstrlenW (lpString=".1cd") returned 4 [0072.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0072.180] lstrlenW (lpString=".jpg") returned 4 [0072.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.180] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") [0072.181] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1564) returned 1 [0072.181] CloseHandle (hObject=0x1f4) returned 1 [0072.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0072.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.181] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.182] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0072.182] GetLastError () returned 0x0 [0072.182] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x61c, lpOverlapped=0x0) returned 1 [0072.184] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x620, lpOverlapped=0x0) returned 1 [0072.186] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.186] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.186] SetEndOfFile (hFile=0x158) returned 1 [0072.186] CloseHandle (hObject=0x158) returned 1 [0072.186] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.186] SetEndOfFile (hFile=0x1f4) returned 1 [0072.187] CloseHandle (hObject=0x1f4) returned 1 [0072.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0072.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.188] lstrlenW (lpString=".doc") returned 4 [0072.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.188] lstrlenW (lpString=".docx") returned 5 [0072.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.188] lstrlenW (lpString=".pdf") returned 4 [0072.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.188] lstrlenW (lpString=".xls") returned 4 [0072.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.188] lstrlenW (lpString=".xlsx") returned 5 [0072.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.188] lstrlenW (lpString=".ppt") returned 4 [0072.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.188] lstrlenW (lpString=".zip") returned 4 [0072.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.188] lstrlenW (lpString=".rar") returned 4 [0072.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString=".bz2") returned 4 [0072.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString=".7z") returned 3 [0072.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.189] lstrlenW (lpString=".dbf") returned 4 [0072.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.189] lstrlenW (lpString=".1cd") returned 4 [0072.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.189] lstrlenW (lpString=".jpg") returned 4 [0072.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString=".pdf") returned 4 [0072.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString=".xls") returned 4 [0072.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.189] lstrlenW (lpString=".xlsx") returned 5 [0072.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.189] lstrlenW (lpString=".ppt") returned 4 [0072.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.189] lstrlenW (lpString=".zip") returned 4 [0072.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.189] lstrlenW (lpString=".rar") returned 4 [0072.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.190] lstrlenW (lpString=".bz2") returned 4 [0072.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.190] lstrlenW (lpString=".7z") returned 3 [0072.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.190] lstrlenW (lpString=".dbf") returned 4 [0072.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.190] lstrlenW (lpString=".1cd") returned 4 [0072.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0072.190] lstrlenW (lpString=".jpg") returned 4 [0072.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.190] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") [0072.408] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4660) returned 1 [0072.409] CloseHandle (hObject=0x150) returned 1 [0072.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0072.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.409] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.409] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.409] GetLastError () returned 0x0 [0072.409] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1234, lpOverlapped=0x0) returned 1 [0072.411] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1240, lpOverlapped=0x0) returned 1 [0072.412] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.412] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.412] SetEndOfFile (hFile=0x1ec) returned 1 [0072.412] CloseHandle (hObject=0x1ec) returned 1 [0072.412] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.412] SetEndOfFile (hFile=0x150) returned 1 [0072.413] CloseHandle (hObject=0x150) returned 1 [0072.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0072.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.414] lstrlenW (lpString=".doc") returned 4 [0072.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString=".docx") returned 5 [0072.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.414] lstrlenW (lpString=".pdf") returned 4 [0072.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString=".xls") returned 4 [0072.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.414] lstrlenW (lpString=".xlsx") returned 5 [0072.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.414] lstrlenW (lpString=".ppt") returned 4 [0072.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.414] lstrlenW (lpString=".zip") returned 4 [0072.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.414] lstrlenW (lpString=".rar") returned 4 [0072.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString=".bz2") returned 4 [0072.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString=".7z") returned 3 [0072.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.414] lstrlenW (lpString=".dbf") returned 4 [0072.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.414] lstrlenW (lpString=".1cd") returned 4 [0072.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.414] lstrlenW (lpString=".jpg") returned 4 [0072.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.414] lstrlenW (lpString=".pdf") returned 4 [0072.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString=".xls") returned 4 [0072.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.415] lstrlenW (lpString=".xlsx") returned 5 [0072.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.415] lstrlenW (lpString=".ppt") returned 4 [0072.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.415] lstrlenW (lpString=".zip") returned 4 [0072.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.415] lstrlenW (lpString=".rar") returned 4 [0072.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString=".bz2") returned 4 [0072.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString=".7z") returned 3 [0072.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.415] lstrlenW (lpString=".dbf") returned 4 [0072.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.415] lstrlenW (lpString=".1cd") returned 4 [0072.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0072.415] lstrlenW (lpString=".jpg") returned 4 [0072.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.415] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") [0072.416] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3988) returned 1 [0072.416] CloseHandle (hObject=0x150) returned 1 [0072.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0072.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.416] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.416] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.416] GetLastError () returned 0x0 [0072.416] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xf94, lpOverlapped=0x0) returned 1 [0072.418] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0072.419] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.419] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.419] SetEndOfFile (hFile=0x1ec) returned 1 [0072.419] CloseHandle (hObject=0x1ec) returned 1 [0072.419] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.419] SetEndOfFile (hFile=0x150) returned 1 [0072.420] CloseHandle (hObject=0x150) returned 1 [0072.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0072.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.421] lstrlenW (lpString=".doc") returned 4 [0072.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.421] lstrlenW (lpString=".docx") returned 5 [0072.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.421] lstrlenW (lpString=".pdf") returned 4 [0072.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.421] lstrlenW (lpString=".xls") returned 4 [0072.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.421] lstrlenW (lpString=".xlsx") returned 5 [0072.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.421] lstrlenW (lpString=".ppt") returned 4 [0072.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.421] lstrlenW (lpString=".zip") returned 4 [0072.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.421] lstrlenW (lpString=".rar") returned 4 [0072.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.421] lstrlenW (lpString=".bz2") returned 4 [0072.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.421] lstrlenW (lpString=".7z") returned 3 [0072.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".dbf") returned 4 [0072.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".1cd") returned 4 [0072.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".jpg") returned 4 [0072.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString=".pdf") returned 4 [0072.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString=".xls") returned 4 [0072.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.422] lstrlenW (lpString=".xlsx") returned 5 [0072.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.422] lstrlenW (lpString=".ppt") returned 4 [0072.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".zip") returned 4 [0072.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.422] lstrlenW (lpString=".rar") returned 4 [0072.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString=".bz2") returned 4 [0072.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString=".7z") returned 3 [0072.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".dbf") returned 4 [0072.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.422] lstrlenW (lpString=".1cd") returned 4 [0072.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0072.423] lstrlenW (lpString=".jpg") returned 4 [0072.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.423] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") [0072.423] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2636) returned 1 [0072.423] CloseHandle (hObject=0x150) returned 1 [0072.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0072.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.423] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.423] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.424] GetLastError () returned 0x0 [0072.424] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa4c, lpOverlapped=0x0) returned 1 [0072.426] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa50, lpOverlapped=0x0) returned 1 [0072.427] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.427] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.427] SetEndOfFile (hFile=0x1ec) returned 1 [0072.427] CloseHandle (hObject=0x1ec) returned 1 [0072.427] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.427] SetEndOfFile (hFile=0x150) returned 1 [0072.428] CloseHandle (hObject=0x150) returned 1 [0072.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0072.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.428] lstrlenW (lpString=".doc") returned 4 [0072.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.428] lstrlenW (lpString=".docx") returned 5 [0072.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.428] lstrlenW (lpString=".pdf") returned 4 [0072.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.428] lstrlenW (lpString=".xls") returned 4 [0072.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.428] lstrlenW (lpString=".xlsx") returned 5 [0072.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.428] lstrlenW (lpString=".ppt") returned 4 [0072.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.429] lstrlenW (lpString=".zip") returned 4 [0072.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.429] lstrlenW (lpString=".rar") returned 4 [0072.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString=".bz2") returned 4 [0072.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString=".7z") returned 3 [0072.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.429] lstrlenW (lpString=".dbf") returned 4 [0072.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.429] lstrlenW (lpString=".1cd") returned 4 [0072.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.429] lstrlenW (lpString=".jpg") returned 4 [0072.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString=".pdf") returned 4 [0072.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString=".xls") returned 4 [0072.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.429] lstrlenW (lpString=".xlsx") returned 5 [0072.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.429] lstrlenW (lpString=".ppt") returned 4 [0072.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.429] lstrlenW (lpString=".zip") returned 4 [0072.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.429] lstrlenW (lpString=".rar") returned 4 [0072.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.430] lstrlenW (lpString=".bz2") returned 4 [0072.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.430] lstrlenW (lpString=".7z") returned 3 [0072.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.430] lstrlenW (lpString=".dbf") returned 4 [0072.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.430] lstrlenW (lpString=".1cd") returned 4 [0072.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0072.430] lstrlenW (lpString=".jpg") returned 4 [0072.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.430] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") [0072.430] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5392) returned 1 [0072.430] CloseHandle (hObject=0x150) returned 1 [0072.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0072.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.431] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.431] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.431] GetLastError () returned 0x0 [0072.431] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1510, lpOverlapped=0x0) returned 1 [0072.433] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1520, lpOverlapped=0x0) returned 1 [0072.433] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.434] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.434] SetEndOfFile (hFile=0x1ec) returned 1 [0072.434] CloseHandle (hObject=0x1ec) returned 1 [0072.434] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.434] SetEndOfFile (hFile=0x150) returned 1 [0072.435] CloseHandle (hObject=0x150) returned 1 [0072.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0072.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.435] lstrlenW (lpString=".doc") returned 4 [0072.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.435] lstrlenW (lpString=".docx") returned 5 [0072.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.435] lstrlenW (lpString=".pdf") returned 4 [0072.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.435] lstrlenW (lpString=".xls") returned 4 [0072.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.435] lstrlenW (lpString=".xlsx") returned 5 [0072.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.435] lstrlenW (lpString=".ppt") returned 4 [0072.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.435] lstrlenW (lpString=".zip") returned 4 [0072.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.436] lstrlenW (lpString=".rar") returned 4 [0072.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString=".bz2") returned 4 [0072.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString=".7z") returned 3 [0072.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.436] lstrlenW (lpString=".dbf") returned 4 [0072.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.436] lstrlenW (lpString=".1cd") returned 4 [0072.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.436] lstrlenW (lpString=".jpg") returned 4 [0072.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString=".pdf") returned 4 [0072.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString=".xls") returned 4 [0072.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.436] lstrlenW (lpString=".xlsx") returned 5 [0072.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.436] lstrlenW (lpString=".ppt") returned 4 [0072.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.436] lstrlenW (lpString=".zip") returned 4 [0072.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.436] lstrlenW (lpString=".rar") returned 4 [0072.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.436] lstrlenW (lpString=".bz2") returned 4 [0072.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.437] lstrlenW (lpString=".7z") returned 3 [0072.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.437] lstrlenW (lpString=".dbf") returned 4 [0072.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.437] lstrlenW (lpString=".1cd") returned 4 [0072.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0072.437] lstrlenW (lpString=".jpg") returned 4 [0072.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.437] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") [0072.437] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1648) returned 1 [0072.437] CloseHandle (hObject=0x150) returned 1 [0072.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0072.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.438] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.438] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.438] GetLastError () returned 0x0 [0072.438] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x670, lpOverlapped=0x0) returned 1 [0072.440] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x680, lpOverlapped=0x0) returned 1 [0072.440] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.440] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.441] SetEndOfFile (hFile=0x1ec) returned 1 [0072.441] CloseHandle (hObject=0x1ec) returned 1 [0072.441] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.441] SetEndOfFile (hFile=0x150) returned 1 [0072.442] CloseHandle (hObject=0x150) returned 1 [0072.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0072.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.442] lstrlenW (lpString=".doc") returned 4 [0072.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.442] lstrlenW (lpString=".docx") returned 5 [0072.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.442] lstrlenW (lpString=".pdf") returned 4 [0072.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.442] lstrlenW (lpString=".xls") returned 4 [0072.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.442] lstrlenW (lpString=".xlsx") returned 5 [0072.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.442] lstrlenW (lpString=".ppt") returned 4 [0072.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.443] lstrlenW (lpString=".zip") returned 4 [0072.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.443] lstrlenW (lpString=".rar") returned 4 [0072.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString=".bz2") returned 4 [0072.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString=".7z") returned 3 [0072.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.443] lstrlenW (lpString=".dbf") returned 4 [0072.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.443] lstrlenW (lpString=".1cd") returned 4 [0072.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.443] lstrlenW (lpString=".jpg") returned 4 [0072.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString=".pdf") returned 4 [0072.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString=".xls") returned 4 [0072.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.443] lstrlenW (lpString=".xlsx") returned 5 [0072.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.443] lstrlenW (lpString=".ppt") returned 4 [0072.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.443] lstrlenW (lpString=".zip") returned 4 [0072.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.443] lstrlenW (lpString=".rar") returned 4 [0072.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.444] lstrlenW (lpString=".bz2") returned 4 [0072.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.444] lstrlenW (lpString=".7z") returned 3 [0072.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.444] lstrlenW (lpString=".dbf") returned 4 [0072.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.444] lstrlenW (lpString=".1cd") returned 4 [0072.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0072.444] lstrlenW (lpString=".jpg") returned 4 [0072.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.444] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") [0072.444] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3128) returned 1 [0072.444] CloseHandle (hObject=0x150) returned 1 [0072.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0072.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.445] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.445] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.445] GetLastError () returned 0x0 [0072.445] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xc38, lpOverlapped=0x0) returned 1 [0072.447] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xc40, lpOverlapped=0x0) returned 1 [0072.447] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.448] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.448] SetEndOfFile (hFile=0x1ec) returned 1 [0072.448] CloseHandle (hObject=0x1ec) returned 1 [0072.448] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.448] SetEndOfFile (hFile=0x150) returned 1 [0072.449] CloseHandle (hObject=0x150) returned 1 [0072.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.449] lstrlenW (lpString=".doc") returned 4 [0072.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".docx") returned 5 [0072.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.449] lstrlenW (lpString=".pdf") returned 4 [0072.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".xls") returned 4 [0072.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.449] lstrlenW (lpString=".xlsx") returned 5 [0072.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.449] lstrlenW (lpString=".ppt") returned 4 [0072.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.449] lstrlenW (lpString=".zip") returned 4 [0072.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.449] lstrlenW (lpString=".rar") returned 4 [0072.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".bz2") returned 4 [0072.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".7z") returned 3 [0072.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.450] lstrlenW (lpString=".dbf") returned 4 [0072.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.450] lstrlenW (lpString=".1cd") returned 4 [0072.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.450] lstrlenW (lpString=".jpg") returned 4 [0072.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".pdf") returned 4 [0072.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".xls") returned 4 [0072.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.450] lstrlenW (lpString=".xlsx") returned 5 [0072.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.450] lstrlenW (lpString=".ppt") returned 4 [0072.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.450] lstrlenW (lpString=".zip") returned 4 [0072.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.450] lstrlenW (lpString=".rar") returned 4 [0072.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".bz2") returned 4 [0072.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.450] lstrlenW (lpString=".7z") returned 3 [0072.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.451] lstrlenW (lpString=".dbf") returned 4 [0072.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.451] lstrlenW (lpString=".1cd") returned 4 [0072.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0072.451] lstrlenW (lpString=".jpg") returned 4 [0072.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.451] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") [0072.452] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2070) returned 1 [0072.452] CloseHandle (hObject=0x150) returned 1 [0072.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0072.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0072.452] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.452] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.452] GetLastError () returned 0x0 [0072.452] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x816, lpOverlapped=0x0) returned 1 [0072.630] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x820, lpOverlapped=0x0) returned 1 [0072.631] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.631] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0072.632] SetEndOfFile (hFile=0x1ec) returned 1 [0073.590] CloseHandle (hObject=0x1ec) returned 1 [0073.590] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.598] SetEndOfFile (hFile=0x150) returned 1 [0073.612] CloseHandle (hObject=0x150) returned 1 [0073.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.612] lstrlenW (lpString=".doc") returned 4 [0073.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString=".docx") returned 5 [0073.612] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0073.612] lstrlenW (lpString=".pdf") returned 4 [0073.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString=".xls") returned 4 [0073.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.613] lstrlenW (lpString=".xlsx") returned 5 [0073.613] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0073.613] lstrlenW (lpString=".ppt") returned 4 [0073.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.613] lstrlenW (lpString=".zip") returned 4 [0073.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.613] lstrlenW (lpString=".rar") returned 4 [0073.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString=".bz2") returned 4 [0073.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString=".7z") returned 3 [0073.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.613] lstrlenW (lpString=".dbf") returned 4 [0073.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.613] lstrlenW (lpString=".1cd") returned 4 [0073.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0073.613] lstrlenW (lpString=".jpg") returned 4 [0073.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.613] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") [0073.614] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1960) returned 1 [0073.614] CloseHandle (hObject=0x150) returned 1 [0073.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0073.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0073.614] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.614] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.614] GetLastError () returned 0x0 [0073.614] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7a8, lpOverlapped=0x0) returned 1 [0073.616] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0073.617] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.617] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.617] SetEndOfFile (hFile=0x1ec) returned 1 [0073.617] CloseHandle (hObject=0x1ec) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.617] SetEndOfFile (hFile=0x150) returned 1 [0073.618] CloseHandle (hObject=0x150) returned 1 [0073.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0073.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.618] lstrlenW (lpString=".doc") returned 4 [0073.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.618] lstrlenW (lpString=".docx") returned 5 [0073.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.618] lstrlenW (lpString=".pdf") returned 4 [0073.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.618] lstrlenW (lpString=".xls") returned 4 [0073.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.618] lstrlenW (lpString=".xlsx") returned 5 [0073.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.618] lstrlenW (lpString=".ppt") returned 4 [0073.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.619] lstrlenW (lpString=".zip") returned 4 [0073.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.619] lstrlenW (lpString=".rar") returned 4 [0073.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString=".bz2") returned 4 [0073.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString=".7z") returned 3 [0073.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.619] lstrlenW (lpString=".dbf") returned 4 [0073.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.619] lstrlenW (lpString=".1cd") returned 4 [0073.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.619] lstrlenW (lpString=".jpg") returned 4 [0073.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString=".pdf") returned 4 [0073.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString=".xls") returned 4 [0073.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.619] lstrlenW (lpString=".xlsx") returned 5 [0073.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.619] lstrlenW (lpString=".ppt") returned 4 [0073.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.619] lstrlenW (lpString=".zip") returned 4 [0073.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.619] lstrlenW (lpString=".rar") returned 4 [0073.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.620] lstrlenW (lpString=".bz2") returned 4 [0073.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.620] lstrlenW (lpString=".7z") returned 3 [0073.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.620] lstrlenW (lpString=".dbf") returned 4 [0073.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.620] lstrlenW (lpString=".1cd") returned 4 [0073.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0073.620] lstrlenW (lpString=".jpg") returned 4 [0073.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.620] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") [0073.621] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3662) returned 1 [0073.621] CloseHandle (hObject=0x150) returned 1 [0073.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0073.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0073.621] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.621] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.622] GetLastError () returned 0x0 [0073.622] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe4e, lpOverlapped=0x0) returned 1 [0073.643] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe50, lpOverlapped=0x0) returned 1 [0073.644] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.644] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.644] SetEndOfFile (hFile=0x1ec) returned 1 [0073.644] CloseHandle (hObject=0x1ec) returned 1 [0073.644] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.644] SetEndOfFile (hFile=0x150) returned 1 [0073.645] CloseHandle (hObject=0x150) returned 1 [0073.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0073.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.645] lstrlenW (lpString=".doc") returned 4 [0073.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.645] lstrlenW (lpString=".docx") returned 5 [0073.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.645] lstrlenW (lpString=".pdf") returned 4 [0073.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString=".xls") returned 4 [0073.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.646] lstrlenW (lpString=".xlsx") returned 5 [0073.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.646] lstrlenW (lpString=".ppt") returned 4 [0073.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.646] lstrlenW (lpString=".zip") returned 4 [0073.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.646] lstrlenW (lpString=".rar") returned 4 [0073.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString=".bz2") returned 4 [0073.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString=".7z") returned 3 [0073.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.646] lstrlenW (lpString=".dbf") returned 4 [0073.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.646] lstrlenW (lpString=".1cd") returned 4 [0073.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.646] lstrlenW (lpString=".jpg") returned 4 [0073.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString=".pdf") returned 4 [0073.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.646] lstrlenW (lpString=".xls") returned 4 [0073.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.646] lstrlenW (lpString=".xlsx") returned 5 [0073.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.646] lstrlenW (lpString=".ppt") returned 4 [0073.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.647] lstrlenW (lpString=".zip") returned 4 [0073.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.647] lstrlenW (lpString=".rar") returned 4 [0073.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.647] lstrlenW (lpString=".bz2") returned 4 [0073.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.647] lstrlenW (lpString=".7z") returned 3 [0073.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.647] lstrlenW (lpString=".dbf") returned 4 [0073.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.647] lstrlenW (lpString=".1cd") returned 4 [0073.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0073.647] lstrlenW (lpString=".jpg") returned 4 [0073.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.647] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") [0073.652] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3298) returned 1 [0073.652] CloseHandle (hObject=0x1c0) returned 1 [0073.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0073.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.652] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.652] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.653] GetLastError () returned 0x0 [0073.653] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xce2, lpOverlapped=0x0) returned 1 [0073.654] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0073.655] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.655] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.655] SetEndOfFile (hFile=0x180) returned 1 [0073.655] CloseHandle (hObject=0x180) returned 1 [0073.655] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.655] SetEndOfFile (hFile=0x1c0) returned 1 [0073.656] CloseHandle (hObject=0x1c0) returned 1 [0073.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0073.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.657] lstrlenW (lpString=".doc") returned 4 [0073.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString=".docx") returned 5 [0073.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.657] lstrlenW (lpString=".pdf") returned 4 [0073.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString=".xls") returned 4 [0073.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.657] lstrlenW (lpString=".xlsx") returned 5 [0073.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.657] lstrlenW (lpString=".ppt") returned 4 [0073.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.657] lstrlenW (lpString=".zip") returned 4 [0073.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.657] lstrlenW (lpString=".rar") returned 4 [0073.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString=".bz2") returned 4 [0073.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString=".7z") returned 3 [0073.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.657] lstrlenW (lpString=".dbf") returned 4 [0073.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.657] lstrlenW (lpString=".1cd") returned 4 [0073.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.657] lstrlenW (lpString=".jpg") returned 4 [0073.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.657] lstrlenW (lpString=".pdf") returned 4 [0073.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".xls") returned 4 [0073.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.658] lstrlenW (lpString=".xlsx") returned 5 [0073.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.658] lstrlenW (lpString=".ppt") returned 4 [0073.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.658] lstrlenW (lpString=".zip") returned 4 [0073.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.658] lstrlenW (lpString=".rar") returned 4 [0073.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".bz2") returned 4 [0073.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".7z") returned 3 [0073.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.658] lstrlenW (lpString=".dbf") returned 4 [0073.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.658] lstrlenW (lpString=".1cd") returned 4 [0073.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0073.658] lstrlenW (lpString=".jpg") returned 4 [0073.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.658] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") [0073.659] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=818) returned 1 [0073.659] CloseHandle (hObject=0x1c0) returned 1 [0073.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0073.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.659] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.659] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.660] GetLastError () returned 0x0 [0073.660] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x332, lpOverlapped=0x0) returned 1 [0073.668] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x340, lpOverlapped=0x0) returned 1 [0073.668] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.668] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.669] SetEndOfFile (hFile=0x180) returned 1 [0073.669] CloseHandle (hObject=0x180) returned 1 [0073.669] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.669] SetEndOfFile (hFile=0x1c0) returned 1 [0073.670] CloseHandle (hObject=0x1c0) returned 1 [0073.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0073.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.670] lstrlenW (lpString=".doc") returned 4 [0073.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.670] lstrlenW (lpString=".docx") returned 5 [0073.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.670] lstrlenW (lpString=".pdf") returned 4 [0073.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.670] lstrlenW (lpString=".xls") returned 4 [0073.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.670] lstrlenW (lpString=".xlsx") returned 5 [0073.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.670] lstrlenW (lpString=".ppt") returned 4 [0073.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.670] lstrlenW (lpString=".zip") returned 4 [0073.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.670] lstrlenW (lpString=".rar") returned 4 [0073.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".bz2") returned 4 [0073.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".7z") returned 3 [0073.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.671] lstrlenW (lpString=".dbf") returned 4 [0073.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.671] lstrlenW (lpString=".1cd") returned 4 [0073.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.671] lstrlenW (lpString=".jpg") returned 4 [0073.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".pdf") returned 4 [0073.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".xls") returned 4 [0073.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.671] lstrlenW (lpString=".xlsx") returned 5 [0073.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.671] lstrlenW (lpString=".ppt") returned 4 [0073.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.671] lstrlenW (lpString=".zip") returned 4 [0073.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.671] lstrlenW (lpString=".rar") returned 4 [0073.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".bz2") returned 4 [0073.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.671] lstrlenW (lpString=".7z") returned 3 [0073.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.671] lstrlenW (lpString=".dbf") returned 4 [0073.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.672] lstrlenW (lpString=".1cd") returned 4 [0073.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0073.672] lstrlenW (lpString=".jpg") returned 4 [0073.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.672] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") [0073.672] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13538) returned 1 [0073.672] CloseHandle (hObject=0x1c0) returned 1 [0073.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0073.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.672] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.672] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.673] GetLastError () returned 0x0 [0073.673] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x34e2, lpOverlapped=0x0) returned 1 [0073.687] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0073.689] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.689] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.689] SetEndOfFile (hFile=0x180) returned 1 [0073.762] CloseHandle (hObject=0x180) returned 1 [0073.762] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.762] SetEndOfFile (hFile=0x1c0) returned 1 [0073.763] CloseHandle (hObject=0x1c0) returned 1 [0073.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0073.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.763] lstrlenW (lpString=".doc") returned 4 [0073.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.763] lstrlenW (lpString=".docx") returned 5 [0073.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.763] lstrlenW (lpString=".pdf") returned 4 [0073.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.763] lstrlenW (lpString=".xls") returned 4 [0073.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.763] lstrlenW (lpString=".xlsx") returned 5 [0073.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.763] lstrlenW (lpString=".ppt") returned 4 [0073.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.764] lstrlenW (lpString=".zip") returned 4 [0073.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.764] lstrlenW (lpString=".rar") returned 4 [0073.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString=".bz2") returned 4 [0073.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString=".7z") returned 3 [0073.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.764] lstrlenW (lpString=".dbf") returned 4 [0073.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.764] lstrlenW (lpString=".1cd") returned 4 [0073.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.764] lstrlenW (lpString=".jpg") returned 4 [0073.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString=".pdf") returned 4 [0073.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString=".xls") returned 4 [0073.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.764] lstrlenW (lpString=".xlsx") returned 5 [0073.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.764] lstrlenW (lpString=".ppt") returned 4 [0073.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.764] lstrlenW (lpString=".zip") returned 4 [0073.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.764] lstrlenW (lpString=".rar") returned 4 [0073.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.764] lstrlenW (lpString=".bz2") returned 4 [0073.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.765] lstrlenW (lpString=".7z") returned 3 [0073.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.765] lstrlenW (lpString=".dbf") returned 4 [0073.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.765] lstrlenW (lpString=".1cd") returned 4 [0073.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0073.765] lstrlenW (lpString=".jpg") returned 4 [0073.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.765] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") [0073.765] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2116) returned 1 [0073.765] CloseHandle (hObject=0x1c0) returned 1 [0073.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0073.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.766] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.766] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.766] GetLastError () returned 0x0 [0073.766] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x844, lpOverlapped=0x0) returned 1 [0073.938] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x850, lpOverlapped=0x0) returned 1 [0073.939] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.939] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.939] SetEndOfFile (hFile=0x180) returned 1 [0074.077] CloseHandle (hObject=0x180) returned 1 [0074.077] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.077] SetEndOfFile (hFile=0x1c0) returned 1 [0074.078] CloseHandle (hObject=0x1c0) returned 1 [0074.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0074.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.148] lstrlenW (lpString=".doc") returned 4 [0074.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.148] lstrlenW (lpString=".docx") returned 5 [0074.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.148] lstrlenW (lpString=".pdf") returned 4 [0074.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.148] lstrlenW (lpString=".xls") returned 4 [0074.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.148] lstrlenW (lpString=".xlsx") returned 5 [0074.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.148] lstrlenW (lpString=".ppt") returned 4 [0074.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.148] lstrlenW (lpString=".zip") returned 4 [0074.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.148] lstrlenW (lpString=".rar") returned 4 [0074.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.148] lstrlenW (lpString=".bz2") returned 4 [0074.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.148] lstrlenW (lpString=".7z") returned 3 [0074.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString=".dbf") returned 4 [0074.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString=".1cd") returned 4 [0074.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString=".jpg") returned 4 [0074.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString=".doc") returned 4 [0074.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString=".docx") returned 5 [0074.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.149] lstrlenW (lpString=".pdf") returned 4 [0074.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString=".xls") returned 4 [0074.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.149] lstrlenW (lpString=".xlsx") returned 5 [0074.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.149] lstrlenW (lpString=".ppt") returned 4 [0074.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.149] lstrlenW (lpString=".zip") returned 4 [0074.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.149] lstrlenW (lpString=".rar") returned 4 [0074.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString=".bz2") returned 4 [0074.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.149] lstrlenW (lpString=".7z") returned 3 [0074.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.150] lstrlenW (lpString=".dbf") returned 4 [0074.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.150] lstrlenW (lpString=".1cd") returned 4 [0074.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0074.150] lstrlenW (lpString=".jpg") returned 4 [0074.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="HH00685_.WMF") returned 12 [0074.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.380] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4032) returned 1 [0074.380] CloseHandle (hObject=0x1f4) returned 1 [0074.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0074.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.381] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.381] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.381] GetLastError () returned 0x0 [0074.381] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xfc0, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0074.383] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.383] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.384] SetEndOfFile (hFile=0x158) returned 1 [0074.384] CloseHandle (hObject=0x158) returned 1 [0074.384] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.384] SetEndOfFile (hFile=0x1f4) returned 1 [0074.384] CloseHandle (hObject=0x1f4) returned 1 [0074.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0074.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.385] lstrlenW (lpString=".doc") returned 4 [0074.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.385] lstrlenW (lpString=".docx") returned 5 [0074.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.385] lstrlenW (lpString=".pdf") returned 4 [0074.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.385] lstrlenW (lpString=".xls") returned 4 [0074.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.385] lstrlenW (lpString=".xlsx") returned 5 [0074.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.385] lstrlenW (lpString=".ppt") returned 4 [0074.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.385] lstrlenW (lpString=".zip") returned 4 [0074.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.385] lstrlenW (lpString=".rar") returned 4 [0074.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.385] lstrlenW (lpString=".bz2") returned 4 [0074.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString=".7z") returned 3 [0074.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.386] lstrlenW (lpString=".dbf") returned 4 [0074.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.386] lstrlenW (lpString=".1cd") returned 4 [0074.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.386] lstrlenW (lpString=".jpg") returned 4 [0074.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString=".pdf") returned 4 [0074.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString=".xls") returned 4 [0074.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.386] lstrlenW (lpString=".xlsx") returned 5 [0074.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.386] lstrlenW (lpString=".ppt") returned 4 [0074.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.386] lstrlenW (lpString=".zip") returned 4 [0074.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.386] lstrlenW (lpString=".rar") returned 4 [0074.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString=".bz2") returned 4 [0074.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.386] lstrlenW (lpString=".7z") returned 3 [0074.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.386] lstrlenW (lpString=".dbf") returned 4 [0074.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.387] lstrlenW (lpString=".1cd") returned 4 [0074.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0074.387] lstrlenW (lpString=".jpg") returned 4 [0074.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.387] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") [0074.388] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5414) returned 1 [0074.388] CloseHandle (hObject=0x1f4) returned 1 [0074.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0074.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.389] GetLastError () returned 0x0 [0074.389] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1526, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1530, lpOverlapped=0x0) returned 1 [0074.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.392] SetEndOfFile (hFile=0x158) returned 1 [0074.392] CloseHandle (hObject=0x158) returned 1 [0074.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.392] SetEndOfFile (hFile=0x1f4) returned 1 [0074.393] CloseHandle (hObject=0x1f4) returned 1 [0074.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0074.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.393] lstrlenW (lpString=".doc") returned 4 [0074.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.393] lstrlenW (lpString=".docx") returned 5 [0074.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.393] lstrlenW (lpString=".pdf") returned 4 [0074.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.393] lstrlenW (lpString=".xls") returned 4 [0074.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.393] lstrlenW (lpString=".xlsx") returned 5 [0074.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.394] lstrlenW (lpString=".ppt") returned 4 [0074.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.394] lstrlenW (lpString=".zip") returned 4 [0074.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.394] lstrlenW (lpString=".rar") returned 4 [0074.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString=".bz2") returned 4 [0074.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString=".7z") returned 3 [0074.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.394] lstrlenW (lpString=".dbf") returned 4 [0074.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.394] lstrlenW (lpString=".1cd") returned 4 [0074.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.394] lstrlenW (lpString=".jpg") returned 4 [0074.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString=".pdf") returned 4 [0074.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString=".xls") returned 4 [0074.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.394] lstrlenW (lpString=".xlsx") returned 5 [0074.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.394] lstrlenW (lpString=".ppt") returned 4 [0074.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.394] lstrlenW (lpString=".zip") returned 4 [0074.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.394] lstrlenW (lpString=".rar") returned 4 [0074.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.395] lstrlenW (lpString=".bz2") returned 4 [0074.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.395] lstrlenW (lpString=".7z") returned 3 [0074.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.395] lstrlenW (lpString=".dbf") returned 4 [0074.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.395] lstrlenW (lpString=".1cd") returned 4 [0074.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0074.395] lstrlenW (lpString=".jpg") returned 4 [0074.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.395] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") [0074.395] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2616) returned 1 [0074.395] CloseHandle (hObject=0x1f4) returned 1 [0074.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0074.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.396] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.396] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.396] GetLastError () returned 0x0 [0074.396] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa38, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa40, lpOverlapped=0x0) returned 1 [0074.488] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.488] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.488] SetEndOfFile (hFile=0x158) returned 1 [0074.488] CloseHandle (hObject=0x158) returned 1 [0074.488] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.488] SetEndOfFile (hFile=0x1f4) returned 1 [0074.489] CloseHandle (hObject=0x1f4) returned 1 [0074.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0074.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.494] lstrlenW (lpString=".doc") returned 4 [0074.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.494] lstrlenW (lpString=".docx") returned 5 [0074.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.494] lstrlenW (lpString=".pdf") returned 4 [0074.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.494] lstrlenW (lpString=".xls") returned 4 [0074.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.494] lstrlenW (lpString=".xlsx") returned 5 [0074.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.494] lstrlenW (lpString=".ppt") returned 4 [0074.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.494] lstrlenW (lpString=".zip") returned 4 [0074.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.494] lstrlenW (lpString=".rar") returned 4 [0074.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString=".bz2") returned 4 [0074.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString=".7z") returned 3 [0074.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString=".dbf") returned 4 [0074.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString=".1cd") returned 4 [0074.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString=".jpg") returned 4 [0074.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString=".doc") returned 4 [0074.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString=".docx") returned 5 [0074.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.495] lstrlenW (lpString=".pdf") returned 4 [0074.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString=".xls") returned 4 [0074.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.495] lstrlenW (lpString=".xlsx") returned 5 [0074.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.495] lstrlenW (lpString=".ppt") returned 4 [0074.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.495] lstrlenW (lpString=".zip") returned 4 [0074.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.495] lstrlenW (lpString=".rar") returned 4 [0074.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.496] lstrlenW (lpString=".bz2") returned 4 [0074.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.496] lstrlenW (lpString=".7z") returned 3 [0074.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.496] lstrlenW (lpString=".dbf") returned 4 [0074.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.496] lstrlenW (lpString=".1cd") returned 4 [0074.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0074.496] lstrlenW (lpString=".jpg") returned 4 [0074.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.496] lstrlenW (lpString="HM00114_.WMF") returned 12 [0074.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.521] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=22116) returned 1 [0074.521] CloseHandle (hObject=0x150) returned 1 [0074.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0074.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.521] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.521] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.521] GetLastError () returned 0x0 [0074.522] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5664, lpOverlapped=0x0) returned 1 [0074.540] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5670, lpOverlapped=0x0) returned 1 [0074.541] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.541] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.541] SetEndOfFile (hFile=0x210) returned 1 [0074.546] CloseHandle (hObject=0x210) returned 1 [0074.546] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.546] SetEndOfFile (hFile=0x150) returned 1 [0074.547] CloseHandle (hObject=0x150) returned 1 [0074.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0074.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.550] lstrlenW (lpString=".doc") returned 4 [0074.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString=".docx") returned 5 [0074.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.550] lstrlenW (lpString=".pdf") returned 4 [0074.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString=".xls") returned 4 [0074.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.550] lstrlenW (lpString=".xlsx") returned 5 [0074.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.550] lstrlenW (lpString=".ppt") returned 4 [0074.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.550] lstrlenW (lpString=".zip") returned 4 [0074.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.550] lstrlenW (lpString=".rar") returned 4 [0074.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString=".bz2") returned 4 [0074.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString=".7z") returned 3 [0074.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.550] lstrlenW (lpString=".dbf") returned 4 [0074.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.550] lstrlenW (lpString=".1cd") returned 4 [0074.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString=".jpg") returned 4 [0074.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString=".doc") returned 4 [0074.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString=".docx") returned 5 [0074.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.551] lstrlenW (lpString=".pdf") returned 4 [0074.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString=".xls") returned 4 [0074.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.551] lstrlenW (lpString=".xlsx") returned 5 [0074.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.551] lstrlenW (lpString=".ppt") returned 4 [0074.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString=".zip") returned 4 [0074.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.551] lstrlenW (lpString=".rar") returned 4 [0074.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString=".bz2") returned 4 [0074.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString=".7z") returned 3 [0074.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString=".dbf") returned 4 [0074.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.551] lstrlenW (lpString=".1cd") returned 4 [0074.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0074.552] lstrlenW (lpString=".jpg") returned 4 [0074.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.552] lstrlenW (lpString="IN00204_.WMF") returned 12 [0074.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.561] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1848) returned 1 [0074.561] CloseHandle (hObject=0x1c0) returned 1 [0074.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0074.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.561] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.561] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0074.561] GetLastError () returned 0x0 [0074.561] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x738, lpOverlapped=0x0) returned 1 [0074.652] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x740, lpOverlapped=0x0) returned 1 [0074.653] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.653] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.653] SetEndOfFile (hFile=0x180) returned 1 [0074.653] CloseHandle (hObject=0x180) returned 1 [0074.653] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.653] SetEndOfFile (hFile=0x1c0) returned 1 [0074.654] CloseHandle (hObject=0x1c0) returned 1 [0074.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString=".doc") returned 4 [0074.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString=".docx") returned 5 [0074.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.655] lstrlenW (lpString=".pdf") returned 4 [0074.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString=".xls") returned 4 [0074.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.655] lstrlenW (lpString=".xlsx") returned 5 [0074.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.655] lstrlenW (lpString=".ppt") returned 4 [0074.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString=".zip") returned 4 [0074.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.655] lstrlenW (lpString=".rar") returned 4 [0074.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString=".bz2") returned 4 [0074.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString=".7z") returned 3 [0074.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString=".dbf") returned 4 [0074.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString=".1cd") returned 4 [0074.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.655] lstrlenW (lpString=".jpg") returned 4 [0074.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString=".doc") returned 4 [0074.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString=".docx") returned 5 [0074.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.656] lstrlenW (lpString=".pdf") returned 4 [0074.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString=".xls") returned 4 [0074.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.656] lstrlenW (lpString=".xlsx") returned 5 [0074.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.656] lstrlenW (lpString=".ppt") returned 4 [0074.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString=".zip") returned 4 [0074.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.656] lstrlenW (lpString=".rar") returned 4 [0074.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString=".bz2") returned 4 [0074.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString=".7z") returned 3 [0074.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString=".dbf") returned 4 [0074.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString=".1cd") returned 4 [0074.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0074.656] lstrlenW (lpString=".jpg") returned 4 [0074.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.656] lstrlenW (lpString="IN00915_.WMF") returned 12 [0074.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.716] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12748) returned 1 [0074.716] CloseHandle (hObject=0x1fc) returned 1 [0074.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0074.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.716] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.716] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.717] GetLastError () returned 0x0 [0074.717] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x31cc, lpOverlapped=0x0) returned 1 [0074.720] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0074.722] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.722] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.722] SetEndOfFile (hFile=0x1c0) returned 1 [0074.722] CloseHandle (hObject=0x1c0) returned 1 [0074.722] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.722] SetEndOfFile (hFile=0x1fc) returned 1 [0074.723] CloseHandle (hObject=0x1fc) returned 1 [0074.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0074.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.723] lstrlenW (lpString=".doc") returned 4 [0074.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.723] lstrlenW (lpString=".docx") returned 5 [0074.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.723] lstrlenW (lpString=".pdf") returned 4 [0074.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString=".xls") returned 4 [0074.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.724] lstrlenW (lpString=".xlsx") returned 5 [0074.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.724] lstrlenW (lpString=".ppt") returned 4 [0074.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString=".zip") returned 4 [0074.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.724] lstrlenW (lpString=".rar") returned 4 [0074.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString=".bz2") returned 4 [0074.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString=".7z") returned 3 [0074.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString=".dbf") returned 4 [0074.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString=".1cd") returned 4 [0074.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString=".jpg") returned 4 [0074.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.724] lstrlenW (lpString=".doc") returned 4 [0074.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString=".docx") returned 5 [0074.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.724] lstrlenW (lpString=".pdf") returned 4 [0074.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.724] lstrlenW (lpString=".xls") returned 4 [0074.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.725] lstrlenW (lpString=".xlsx") returned 5 [0074.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.725] lstrlenW (lpString=".ppt") returned 4 [0074.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.725] lstrlenW (lpString=".zip") returned 4 [0074.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.725] lstrlenW (lpString=".rar") returned 4 [0074.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString=".bz2") returned 4 [0074.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString=".7z") returned 3 [0074.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.725] lstrlenW (lpString=".dbf") returned 4 [0074.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.725] lstrlenW (lpString=".1cd") returned 4 [0074.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0074.725] lstrlenW (lpString=".jpg") returned 4 [0074.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.725] lstrlenW (lpString="IN00957_.WMF") returned 12 [0074.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.726] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2944) returned 1 [0074.726] CloseHandle (hObject=0x1fc) returned 1 [0074.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0074.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0074.726] GetLastError () returned 0x0 [0074.726] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb80, lpOverlapped=0x0) returned 1 [0074.728] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb90, lpOverlapped=0x0) returned 1 [0074.729] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.729] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.729] SetEndOfFile (hFile=0x1c0) returned 1 [0074.729] CloseHandle (hObject=0x1c0) returned 1 [0074.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.729] SetEndOfFile (hFile=0x1fc) returned 1 [0074.730] CloseHandle (hObject=0x1fc) returned 1 [0074.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0074.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.730] lstrlenW (lpString=".doc") returned 4 [0074.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.730] lstrlenW (lpString=".docx") returned 5 [0074.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.730] lstrlenW (lpString=".pdf") returned 4 [0074.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.730] lstrlenW (lpString=".xls") returned 4 [0074.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.730] lstrlenW (lpString=".xlsx") returned 5 [0074.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.730] lstrlenW (lpString=".ppt") returned 4 [0074.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".zip") returned 4 [0074.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.731] lstrlenW (lpString=".rar") returned 4 [0074.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString=".bz2") returned 4 [0074.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString=".7z") returned 3 [0074.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".dbf") returned 4 [0074.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".1cd") returned 4 [0074.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".jpg") returned 4 [0074.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".doc") returned 4 [0074.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString=".docx") returned 5 [0074.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.731] lstrlenW (lpString=".pdf") returned 4 [0074.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString=".xls") returned 4 [0074.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.731] lstrlenW (lpString=".xlsx") returned 5 [0074.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.731] lstrlenW (lpString=".ppt") returned 4 [0074.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.731] lstrlenW (lpString=".zip") returned 4 [0074.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.732] lstrlenW (lpString=".rar") returned 4 [0074.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.732] lstrlenW (lpString=".bz2") returned 4 [0074.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.732] lstrlenW (lpString=".7z") returned 3 [0074.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.732] lstrlenW (lpString=".dbf") returned 4 [0074.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.732] lstrlenW (lpString=".1cd") returned 4 [0074.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0074.732] lstrlenW (lpString=".jpg") returned 4 [0074.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.732] lstrlenW (lpString="J0075478.GIF") returned 12 [0074.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.332] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1220) returned 1 [0075.332] CloseHandle (hObject=0x150) returned 1 [0075.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0075.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.334] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.334] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.959] GetLastError () returned 0x0 [0075.959] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4c4, lpOverlapped=0x0) returned 1 [0075.961] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0075.962] ReadFile (in: hFile=0x150, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0075.962] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.962] SetEndOfFile (hFile=0x1ec) returned 1 [0075.984] CloseHandle (hObject=0x1ec) returned 1 [0075.987] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.987] SetEndOfFile (hFile=0x150) returned 1 [0075.988] CloseHandle (hObject=0x150) returned 1 [0075.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0075.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.995] lstrlenW (lpString=".doc") returned 4 [0075.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.995] lstrlenW (lpString=".docx") returned 5 [0075.995] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0075.995] lstrlenW (lpString=".pdf") returned 4 [0075.995] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.995] lstrlenW (lpString=".xls") returned 4 [0075.995] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.995] lstrlenW (lpString=".xlsx") returned 5 [0075.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0075.995] lstrlenW (lpString=".ppt") returned 4 [0075.995] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.995] lstrlenW (lpString=".zip") returned 4 [0075.995] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.995] lstrlenW (lpString=".rar") returned 4 [0075.995] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.995] lstrlenW (lpString=".bz2") returned 4 [0075.995] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.995] lstrlenW (lpString=".7z") returned 3 [0075.995] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.995] lstrlenW (lpString=".dbf") returned 4 [0075.995] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.995] lstrlenW (lpString=".1cd") returned 4 [0075.995] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0075.995] lstrlenW (lpString=".jpg") returned 4 [0075.995] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.995] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") [0075.998] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4970) returned 1 [0075.998] CloseHandle (hObject=0x1ec) returned 1 [0075.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0075.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.998] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.998] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0075.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.999] GetLastError () returned 0x0 [0075.999] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x136a, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1370, lpOverlapped=0x0) returned 1 [0076.010] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.011] SetEndOfFile (hFile=0x158) returned 1 [0076.011] CloseHandle (hObject=0x158) returned 1 [0076.011] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.011] SetEndOfFile (hFile=0x1ec) returned 1 [0076.012] CloseHandle (hObject=0x1ec) returned 1 [0076.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.020] lstrlenW (lpString=".doc") returned 4 [0076.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.020] lstrlenW (lpString=".docx") returned 5 [0076.020] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0076.020] lstrlenW (lpString=".pdf") returned 4 [0076.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.020] lstrlenW (lpString=".xls") returned 4 [0076.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.021] lstrlenW (lpString=".xlsx") returned 5 [0076.021] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0076.021] lstrlenW (lpString=".ppt") returned 4 [0076.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.021] lstrlenW (lpString=".zip") returned 4 [0076.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.021] lstrlenW (lpString=".rar") returned 4 [0076.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString=".bz2") returned 4 [0076.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString=".7z") returned 3 [0076.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.021] lstrlenW (lpString=".dbf") returned 4 [0076.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.021] lstrlenW (lpString=".1cd") returned 4 [0076.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0076.021] lstrlenW (lpString=".jpg") returned 4 [0076.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.021] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") [0076.022] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16596) returned 1 [0076.022] CloseHandle (hObject=0x1ec) returned 1 [0076.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0076.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.022] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.022] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.022] GetLastError () returned 0x0 [0076.022] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x40d4, lpOverlapped=0x0) returned 1 [0076.037] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0076.038] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.038] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.038] SetEndOfFile (hFile=0x158) returned 1 [0076.038] CloseHandle (hObject=0x158) returned 1 [0076.038] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.038] SetEndOfFile (hFile=0x1ec) returned 1 [0076.039] CloseHandle (hObject=0x1ec) returned 1 [0076.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0076.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.039] lstrlenW (lpString=".doc") returned 4 [0076.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".docx") returned 5 [0076.040] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0076.040] lstrlenW (lpString=".pdf") returned 4 [0076.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".xls") returned 4 [0076.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.040] lstrlenW (lpString=".xlsx") returned 5 [0076.040] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0076.040] lstrlenW (lpString=".ppt") returned 4 [0076.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.040] lstrlenW (lpString=".zip") returned 4 [0076.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.040] lstrlenW (lpString=".rar") returned 4 [0076.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".bz2") returned 4 [0076.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".7z") returned 3 [0076.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.040] lstrlenW (lpString=".dbf") returned 4 [0076.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.040] lstrlenW (lpString=".1cd") returned 4 [0076.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0076.040] lstrlenW (lpString=".jpg") returned 4 [0076.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.040] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") [0076.041] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18258) returned 1 [0076.041] CloseHandle (hObject=0x1ec) returned 1 [0076.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0076.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.041] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.041] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.042] GetLastError () returned 0x0 [0076.042] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4752, lpOverlapped=0x0) returned 1 [0076.056] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4760, lpOverlapped=0x0) returned 1 [0076.057] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.057] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.057] SetEndOfFile (hFile=0x158) returned 1 [0076.058] CloseHandle (hObject=0x158) returned 1 [0076.058] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.058] SetEndOfFile (hFile=0x1ec) returned 1 [0076.059] CloseHandle (hObject=0x1ec) returned 1 [0076.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0076.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.059] lstrlenW (lpString=".doc") returned 4 [0076.059] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.059] lstrlenW (lpString=".docx") returned 5 [0076.059] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0076.059] lstrlenW (lpString=".pdf") returned 4 [0076.059] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.059] lstrlenW (lpString=".xls") returned 4 [0076.059] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.059] lstrlenW (lpString=".xlsx") returned 5 [0076.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0076.059] lstrlenW (lpString=".ppt") returned 4 [0076.059] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.060] lstrlenW (lpString=".zip") returned 4 [0076.060] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.060] lstrlenW (lpString=".rar") returned 4 [0076.060] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.060] lstrlenW (lpString=".bz2") returned 4 [0076.060] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.060] lstrlenW (lpString=".7z") returned 3 [0076.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.060] lstrlenW (lpString=".dbf") returned 4 [0076.060] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.060] lstrlenW (lpString=".1cd") returned 4 [0076.060] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0076.060] lstrlenW (lpString=".jpg") returned 4 [0076.060] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.060] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") [0076.060] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=21914) returned 1 [0076.060] CloseHandle (hObject=0x1ec) returned 1 [0076.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0076.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.061] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.061] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.061] GetLastError () returned 0x0 [0076.061] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x559a, lpOverlapped=0x0) returned 1 [0076.079] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0076.080] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.081] SetEndOfFile (hFile=0x158) returned 1 [0076.087] CloseHandle (hObject=0x158) returned 1 [0076.089] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.089] SetEndOfFile (hFile=0x1ec) returned 1 [0076.091] CloseHandle (hObject=0x1ec) returned 1 [0076.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.095] lstrlenW (lpString=".doc") returned 4 [0076.095] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.095] lstrlenW (lpString=".docx") returned 5 [0076.095] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0076.095] lstrlenW (lpString=".pdf") returned 4 [0076.095] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.095] lstrlenW (lpString=".xls") returned 4 [0076.095] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.095] lstrlenW (lpString=".xlsx") returned 5 [0076.096] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0076.096] lstrlenW (lpString=".ppt") returned 4 [0076.096] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.096] lstrlenW (lpString=".zip") returned 4 [0076.096] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.096] lstrlenW (lpString=".rar") returned 4 [0076.096] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.096] lstrlenW (lpString=".bz2") returned 4 [0076.096] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.096] lstrlenW (lpString=".7z") returned 3 [0076.096] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.096] lstrlenW (lpString=".dbf") returned 4 [0076.096] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.096] lstrlenW (lpString=".1cd") returned 4 [0076.096] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0076.096] lstrlenW (lpString=".jpg") returned 4 [0076.096] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.096] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") [0076.097] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13874) returned 1 [0076.097] CloseHandle (hObject=0x158) returned 1 [0076.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0076.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.097] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.097] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.098] GetLastError () returned 0x0 [0076.098] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3632, lpOverlapped=0x0) returned 1 [0076.117] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3640, lpOverlapped=0x0) returned 1 [0076.118] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.118] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.118] SetEndOfFile (hFile=0x150) returned 1 [0076.118] CloseHandle (hObject=0x150) returned 1 [0076.118] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.118] SetEndOfFile (hFile=0x158) returned 1 [0076.119] CloseHandle (hObject=0x158) returned 1 [0076.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0076.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.119] lstrlenW (lpString=".doc") returned 4 [0076.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.119] lstrlenW (lpString=".docx") returned 5 [0076.119] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0076.119] lstrlenW (lpString=".pdf") returned 4 [0076.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.119] lstrlenW (lpString=".xls") returned 4 [0076.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.119] lstrlenW (lpString=".xlsx") returned 5 [0076.120] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0076.120] lstrlenW (lpString=".ppt") returned 4 [0076.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.120] lstrlenW (lpString=".zip") returned 4 [0076.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.120] lstrlenW (lpString=".rar") returned 4 [0076.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.120] lstrlenW (lpString=".bz2") returned 4 [0076.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.120] lstrlenW (lpString=".7z") returned 3 [0076.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.120] lstrlenW (lpString=".dbf") returned 4 [0076.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.120] lstrlenW (lpString=".1cd") returned 4 [0076.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0076.120] lstrlenW (lpString=".jpg") returned 4 [0076.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.120] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") [0076.121] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6929) returned 1 [0076.121] CloseHandle (hObject=0x158) returned 1 [0076.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0076.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.122] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.122] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.122] GetLastError () returned 0x0 [0076.122] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b11, lpOverlapped=0x0) returned 1 [0076.169] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0076.170] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.171] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.171] SetEndOfFile (hFile=0x150) returned 1 [0076.171] CloseHandle (hObject=0x150) returned 1 [0076.171] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.171] SetEndOfFile (hFile=0x158) returned 1 [0076.172] CloseHandle (hObject=0x158) returned 1 [0076.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0076.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.172] lstrlenW (lpString=".doc") returned 4 [0076.172] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.172] lstrlenW (lpString=".docx") returned 5 [0076.172] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0076.172] lstrlenW (lpString=".pdf") returned 4 [0076.172] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.172] lstrlenW (lpString=".xls") returned 4 [0076.172] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.172] lstrlenW (lpString=".xlsx") returned 5 [0076.173] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0076.173] lstrlenW (lpString=".ppt") returned 4 [0076.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.173] lstrlenW (lpString=".zip") returned 4 [0076.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.173] lstrlenW (lpString=".rar") returned 4 [0076.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.173] lstrlenW (lpString=".bz2") returned 4 [0076.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.173] lstrlenW (lpString=".7z") returned 3 [0076.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.173] lstrlenW (lpString=".dbf") returned 4 [0076.173] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.173] lstrlenW (lpString=".1cd") returned 4 [0076.173] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0076.173] lstrlenW (lpString=".jpg") returned 4 [0076.173] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.181] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") [0076.181] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8826) returned 1 [0076.181] CloseHandle (hObject=0x158) returned 1 [0076.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0076.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.181] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.181] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.182] GetLastError () returned 0x0 [0076.182] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x227a, lpOverlapped=0x0) returned 1 [0076.221] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2280, lpOverlapped=0x0) returned 1 [0076.222] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.223] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x150) returned 1 [0076.223] CloseHandle (hObject=0x150) returned 1 [0076.223] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x158) returned 1 [0076.224] CloseHandle (hObject=0x158) returned 1 [0076.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.224] lstrlenW (lpString=".doc") returned 4 [0076.224] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.224] lstrlenW (lpString=".docx") returned 5 [0076.224] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0076.224] lstrlenW (lpString=".pdf") returned 4 [0076.225] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.225] lstrlenW (lpString=".xls") returned 4 [0076.225] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.225] lstrlenW (lpString=".xlsx") returned 5 [0076.225] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0076.225] lstrlenW (lpString=".ppt") returned 4 [0076.225] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.225] lstrlenW (lpString=".zip") returned 4 [0076.225] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.225] lstrlenW (lpString=".rar") returned 4 [0076.225] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.225] lstrlenW (lpString=".bz2") returned 4 [0076.225] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.225] lstrlenW (lpString=".7z") returned 3 [0076.225] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.225] lstrlenW (lpString=".dbf") returned 4 [0076.225] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.225] lstrlenW (lpString=".1cd") returned 4 [0076.225] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0076.225] lstrlenW (lpString=".jpg") returned 4 [0076.225] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.225] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") [0076.226] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13954) returned 1 [0076.226] CloseHandle (hObject=0x158) returned 1 [0076.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0076.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.226] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.226] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.227] GetLastError () returned 0x0 [0076.227] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3682, lpOverlapped=0x0) returned 1 [0076.259] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3690, lpOverlapped=0x0) returned 1 [0076.260] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.260] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.260] SetEndOfFile (hFile=0x150) returned 1 [0076.260] CloseHandle (hObject=0x150) returned 1 [0076.260] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.260] SetEndOfFile (hFile=0x158) returned 1 [0076.261] CloseHandle (hObject=0x158) returned 1 [0076.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0076.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.261] lstrlenW (lpString=".doc") returned 4 [0076.261] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.261] lstrlenW (lpString=".docx") returned 5 [0076.261] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0076.261] lstrlenW (lpString=".pdf") returned 4 [0076.261] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.261] lstrlenW (lpString=".xls") returned 4 [0076.261] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.261] lstrlenW (lpString=".xlsx") returned 5 [0076.262] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0076.262] lstrlenW (lpString=".ppt") returned 4 [0076.262] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.262] lstrlenW (lpString=".zip") returned 4 [0076.262] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.262] lstrlenW (lpString=".rar") returned 4 [0076.262] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.262] lstrlenW (lpString=".bz2") returned 4 [0076.262] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.262] lstrlenW (lpString=".7z") returned 3 [0076.262] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.262] lstrlenW (lpString=".dbf") returned 4 [0076.262] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.262] lstrlenW (lpString=".1cd") returned 4 [0076.262] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0076.262] lstrlenW (lpString=".jpg") returned 4 [0076.262] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.262] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") [0076.270] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15145) returned 1 [0076.270] CloseHandle (hObject=0x158) returned 1 [0076.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0076.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.271] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.271] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.271] GetLastError () returned 0x0 [0076.271] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3b29, lpOverlapped=0x0) returned 1 [0076.671] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0076.684] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.684] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.684] SetEndOfFile (hFile=0x150) returned 1 [0076.693] CloseHandle (hObject=0x150) returned 1 [0076.693] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.693] SetEndOfFile (hFile=0x158) returned 1 [0076.693] CloseHandle (hObject=0x158) returned 1 [0076.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.695] lstrlenW (lpString=".doc") returned 4 [0076.695] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.695] lstrlenW (lpString=".docx") returned 5 [0076.695] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0076.695] lstrlenW (lpString=".pdf") returned 4 [0076.695] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.695] lstrlenW (lpString=".xls") returned 4 [0076.695] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.696] lstrlenW (lpString=".xlsx") returned 5 [0076.696] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0076.696] lstrlenW (lpString=".ppt") returned 4 [0076.696] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.696] lstrlenW (lpString=".zip") returned 4 [0076.696] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.696] lstrlenW (lpString=".rar") returned 4 [0076.696] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.696] lstrlenW (lpString=".bz2") returned 4 [0076.696] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.696] lstrlenW (lpString=".7z") returned 3 [0076.696] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.696] lstrlenW (lpString=".dbf") returned 4 [0076.696] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.696] lstrlenW (lpString=".1cd") returned 4 [0076.696] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0076.696] lstrlenW (lpString=".jpg") returned 4 [0076.696] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.696] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") [0076.700] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43949) returned 1 [0076.700] CloseHandle (hObject=0x22c) returned 1 [0076.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0076.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.700] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.700] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0076.722] GetLastError () returned 0x0 [0076.723] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xabad, lpOverlapped=0x0) returned 1 [0076.772] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0076.774] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.774] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.774] SetEndOfFile (hFile=0x180) returned 1 [0076.774] CloseHandle (hObject=0x180) returned 1 [0076.774] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.774] SetEndOfFile (hFile=0x22c) returned 1 [0076.775] CloseHandle (hObject=0x22c) returned 1 [0076.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0076.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.926] lstrlenW (lpString=".doc") returned 4 [0076.926] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.926] lstrlenW (lpString=".docx") returned 5 [0076.926] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0076.926] lstrlenW (lpString=".pdf") returned 4 [0076.926] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.926] lstrlenW (lpString=".xls") returned 4 [0076.926] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.927] lstrlenW (lpString=".xlsx") returned 5 [0076.927] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0076.927] lstrlenW (lpString=".ppt") returned 4 [0076.927] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.927] lstrlenW (lpString=".zip") returned 4 [0076.927] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.927] lstrlenW (lpString=".rar") returned 4 [0076.927] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.927] lstrlenW (lpString=".bz2") returned 4 [0076.927] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.927] lstrlenW (lpString=".7z") returned 3 [0076.927] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.927] lstrlenW (lpString=".dbf") returned 4 [0076.927] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.927] lstrlenW (lpString=".1cd") returned 4 [0076.927] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0076.927] lstrlenW (lpString=".jpg") returned 4 [0076.927] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.927] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") [0077.477] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9154) returned 1 [0077.477] CloseHandle (hObject=0x1fc) returned 1 [0077.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0077.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.478] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.478] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.478] GetLastError () returned 0x0 [0077.478] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x23c2, lpOverlapped=0x0) returned 1 [0077.500] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0077.501] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.501] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.501] SetEndOfFile (hFile=0x15c) returned 1 [0077.501] CloseHandle (hObject=0x15c) returned 1 [0077.501] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.501] SetEndOfFile (hFile=0x1fc) returned 1 [0077.502] CloseHandle (hObject=0x1fc) returned 1 [0077.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0077.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.503] lstrlenW (lpString=".doc") returned 4 [0077.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString=".docx") returned 5 [0077.503] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0077.503] lstrlenW (lpString=".pdf") returned 4 [0077.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString=".xls") returned 4 [0077.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.503] lstrlenW (lpString=".xlsx") returned 5 [0077.503] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0077.503] lstrlenW (lpString=".ppt") returned 4 [0077.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.503] lstrlenW (lpString=".zip") returned 4 [0077.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.503] lstrlenW (lpString=".rar") returned 4 [0077.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString=".bz2") returned 4 [0077.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString=".7z") returned 3 [0077.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.503] lstrlenW (lpString=".dbf") returned 4 [0077.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.503] lstrlenW (lpString=".1cd") returned 4 [0077.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0077.504] lstrlenW (lpString=".jpg") returned 4 [0077.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.504] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") [0077.504] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3282) returned 1 [0077.504] CloseHandle (hObject=0x1fc) returned 1 [0077.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0077.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.504] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.504] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.505] GetLastError () returned 0x0 [0077.505] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xcd2, lpOverlapped=0x0) returned 1 [0077.519] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xce0, lpOverlapped=0x0) returned 1 [0077.521] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.521] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.521] SetEndOfFile (hFile=0x15c) returned 1 [0077.521] CloseHandle (hObject=0x15c) returned 1 [0077.521] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.521] SetEndOfFile (hFile=0x1fc) returned 1 [0077.522] CloseHandle (hObject=0x1fc) returned 1 [0077.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0077.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.522] lstrlenW (lpString=".doc") returned 4 [0077.522] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.522] lstrlenW (lpString=".docx") returned 5 [0077.522] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0077.522] lstrlenW (lpString=".pdf") returned 4 [0077.522] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.522] lstrlenW (lpString=".xls") returned 4 [0077.522] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.522] lstrlenW (lpString=".xlsx") returned 5 [0077.522] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0077.523] lstrlenW (lpString=".ppt") returned 4 [0077.523] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.523] lstrlenW (lpString=".zip") returned 4 [0077.523] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.523] lstrlenW (lpString=".rar") returned 4 [0077.523] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.523] lstrlenW (lpString=".bz2") returned 4 [0077.523] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.523] lstrlenW (lpString=".7z") returned 3 [0077.523] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.523] lstrlenW (lpString=".dbf") returned 4 [0077.523] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.523] lstrlenW (lpString=".1cd") returned 4 [0077.523] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0077.523] lstrlenW (lpString=".jpg") returned 4 [0077.523] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.523] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") [0077.523] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9080) returned 1 [0077.524] CloseHandle (hObject=0x1fc) returned 1 [0077.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0077.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.524] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.524] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.524] GetLastError () returned 0x0 [0077.524] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2378, lpOverlapped=0x0) returned 1 [0077.526] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2380, lpOverlapped=0x0) returned 1 [0077.534] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.534] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.535] SetEndOfFile (hFile=0x15c) returned 1 [0077.535] CloseHandle (hObject=0x15c) returned 1 [0077.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.535] SetEndOfFile (hFile=0x1fc) returned 1 [0077.536] CloseHandle (hObject=0x1fc) returned 1 [0077.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0077.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.536] lstrlenW (lpString=".doc") returned 4 [0077.536] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.536] lstrlenW (lpString=".docx") returned 5 [0077.536] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0077.536] lstrlenW (lpString=".pdf") returned 4 [0077.536] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.536] lstrlenW (lpString=".xls") returned 4 [0077.536] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.536] lstrlenW (lpString=".xlsx") returned 5 [0077.536] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0077.536] lstrlenW (lpString=".ppt") returned 4 [0077.536] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.536] lstrlenW (lpString=".zip") returned 4 [0077.536] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.536] lstrlenW (lpString=".rar") returned 4 [0077.537] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.537] lstrlenW (lpString=".bz2") returned 4 [0077.537] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.537] lstrlenW (lpString=".7z") returned 3 [0077.537] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.537] lstrlenW (lpString=".dbf") returned 4 [0077.537] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.537] lstrlenW (lpString=".1cd") returned 4 [0077.537] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0077.537] lstrlenW (lpString=".jpg") returned 4 [0077.537] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.537] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") [0077.558] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43892) returned 1 [0077.559] CloseHandle (hObject=0x1fc) returned 1 [0077.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0077.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.559] GetLastError () returned 0x0 [0077.559] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xab74, lpOverlapped=0x0) returned 1 [0077.579] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xab80, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.580] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.580] SetEndOfFile (hFile=0x1c0) returned 1 [0077.581] CloseHandle (hObject=0x1c0) returned 1 [0077.581] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.581] SetEndOfFile (hFile=0x1fc) returned 1 [0077.582] CloseHandle (hObject=0x1fc) returned 1 [0077.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0077.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.650] lstrlenW (lpString=".doc") returned 4 [0077.650] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.650] lstrlenW (lpString=".docx") returned 5 [0077.650] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0077.650] lstrlenW (lpString=".pdf") returned 4 [0077.650] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.650] lstrlenW (lpString=".xls") returned 4 [0077.650] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.650] lstrlenW (lpString=".xlsx") returned 5 [0077.650] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0077.650] lstrlenW (lpString=".ppt") returned 4 [0077.650] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.650] lstrlenW (lpString=".zip") returned 4 [0077.650] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.650] lstrlenW (lpString=".rar") returned 4 [0077.650] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.650] lstrlenW (lpString=".bz2") returned 4 [0077.650] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.650] lstrlenW (lpString=".7z") returned 3 [0077.650] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.650] lstrlenW (lpString=".dbf") returned 4 [0077.650] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.650] lstrlenW (lpString=".1cd") returned 4 [0077.650] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0077.651] lstrlenW (lpString=".jpg") returned 4 [0077.651] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.651] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") [0077.651] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5259) returned 1 [0077.651] CloseHandle (hObject=0x1f4) returned 1 [0077.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0077.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0077.651] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.651] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0077.652] GetLastError () returned 0x0 [0077.652] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x148b, lpOverlapped=0x0) returned 1 [0077.928] WriteFile (in: hFile=0x154, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1490, lpOverlapped=0x0) returned 1 [0077.929] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.929] WriteFile (in: hFile=0x154, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.929] SetEndOfFile (hFile=0x154) returned 1 [0077.929] CloseHandle (hObject=0x154) returned 1 [0077.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.929] SetEndOfFile (hFile=0x1f4) returned 1 [0077.930] CloseHandle (hObject=0x1f4) returned 1 [0077.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0077.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString=".doc") returned 4 [0077.931] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.931] lstrlenW (lpString=".docx") returned 5 [0077.931] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0077.931] lstrlenW (lpString=".pdf") returned 4 [0077.931] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.931] lstrlenW (lpString=".xls") returned 4 [0077.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.931] lstrlenW (lpString=".xlsx") returned 5 [0077.931] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0077.931] lstrlenW (lpString=".ppt") returned 4 [0077.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString=".zip") returned 4 [0077.931] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.931] lstrlenW (lpString=".rar") returned 4 [0077.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.931] lstrlenW (lpString=".bz2") returned 4 [0077.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.931] lstrlenW (lpString=".7z") returned 3 [0077.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString=".dbf") returned 4 [0077.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString=".1cd") returned 4 [0077.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0077.931] lstrlenW (lpString=".jpg") returned 4 [0077.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.932] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") [0077.947] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17854) returned 1 [0077.947] CloseHandle (hObject=0x1c8) returned 1 [0077.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0077.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.947] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.947] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.948] GetLastError () returned 0x0 [0077.948] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x45be, lpOverlapped=0x0) returned 1 [0077.950] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0077.951] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.951] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.952] SetEndOfFile (hFile=0x180) returned 1 [0077.952] CloseHandle (hObject=0x180) returned 1 [0077.952] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.952] SetEndOfFile (hFile=0x1c8) returned 1 [0077.953] CloseHandle (hObject=0x1c8) returned 1 [0077.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0077.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.953] lstrlenW (lpString=".doc") returned 4 [0077.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.953] lstrlenW (lpString=".docx") returned 5 [0077.953] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0077.953] lstrlenW (lpString=".pdf") returned 4 [0077.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.953] lstrlenW (lpString=".xls") returned 4 [0077.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.953] lstrlenW (lpString=".xlsx") returned 5 [0077.953] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0077.953] lstrlenW (lpString=".ppt") returned 4 [0077.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.954] lstrlenW (lpString=".zip") returned 4 [0077.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.954] lstrlenW (lpString=".rar") returned 4 [0077.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.954] lstrlenW (lpString=".bz2") returned 4 [0077.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.954] lstrlenW (lpString=".7z") returned 3 [0077.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.954] lstrlenW (lpString=".dbf") returned 4 [0077.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.954] lstrlenW (lpString=".1cd") returned 4 [0077.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0077.954] lstrlenW (lpString=".jpg") returned 4 [0077.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.954] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") [0077.955] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17854) returned 1 [0077.955] CloseHandle (hObject=0x1c8) returned 1 [0077.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0077.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.955] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.955] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.956] GetLastError () returned 0x0 [0077.956] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x45be, lpOverlapped=0x0) returned 1 [0077.957] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0077.958] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.959] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.959] SetEndOfFile (hFile=0x180) returned 1 [0077.959] CloseHandle (hObject=0x180) returned 1 [0077.959] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.959] SetEndOfFile (hFile=0x1c8) returned 1 [0077.960] CloseHandle (hObject=0x1c8) returned 1 [0077.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0077.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.960] lstrlenW (lpString=".doc") returned 4 [0077.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.960] lstrlenW (lpString=".docx") returned 5 [0077.960] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0077.960] lstrlenW (lpString=".pdf") returned 4 [0077.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.960] lstrlenW (lpString=".xls") returned 4 [0077.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.960] lstrlenW (lpString=".xlsx") returned 5 [0077.960] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0077.960] lstrlenW (lpString=".ppt") returned 4 [0077.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.961] lstrlenW (lpString=".zip") returned 4 [0077.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.961] lstrlenW (lpString=".rar") returned 4 [0077.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.961] lstrlenW (lpString=".bz2") returned 4 [0077.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.961] lstrlenW (lpString=".7z") returned 3 [0077.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.961] lstrlenW (lpString=".dbf") returned 4 [0077.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.961] lstrlenW (lpString=".1cd") returned 4 [0077.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0077.961] lstrlenW (lpString=".jpg") returned 4 [0077.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.961] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") [0077.962] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=78840) returned 1 [0077.962] CloseHandle (hObject=0x1c8) returned 1 [0077.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0077.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.962] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.963] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.963] GetLastError () returned 0x0 [0077.963] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x133f8, lpOverlapped=0x0) returned 1 [0077.966] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x13400, lpOverlapped=0x0) returned 1 [0077.968] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.968] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.968] SetEndOfFile (hFile=0x180) returned 1 [0077.968] CloseHandle (hObject=0x180) returned 1 [0077.968] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.968] SetEndOfFile (hFile=0x1c8) returned 1 [0077.969] CloseHandle (hObject=0x1c8) returned 1 [0077.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0077.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.970] lstrlenW (lpString=".doc") returned 4 [0077.970] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".docx") returned 5 [0077.970] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0077.970] lstrlenW (lpString=".pdf") returned 4 [0077.970] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".xls") returned 4 [0077.970] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".xlsx") returned 5 [0077.970] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0077.970] lstrlenW (lpString=".ppt") returned 4 [0077.970] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.970] lstrlenW (lpString=".zip") returned 4 [0077.970] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".rar") returned 4 [0077.970] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".bz2") returned 4 [0077.970] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0077.970] lstrlenW (lpString=".7z") returned 3 [0077.970] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0077.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.971] lstrlenW (lpString=".dbf") returned 4 [0077.971] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0077.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.971] lstrlenW (lpString=".1cd") returned 4 [0077.971] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0077.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0077.971] lstrlenW (lpString=".jpg") returned 4 [0077.971] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0077.971] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") [0077.971] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32184) returned 1 [0077.971] CloseHandle (hObject=0x1c8) returned 1 [0077.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0077.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.972] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.972] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.972] GetLastError () returned 0x0 [0077.972] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7db8, lpOverlapped=0x0) returned 1 [0077.974] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0077.976] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.976] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.976] SetEndOfFile (hFile=0x180) returned 1 [0077.976] CloseHandle (hObject=0x180) returned 1 [0077.976] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.976] SetEndOfFile (hFile=0x1c8) returned 1 [0077.977] CloseHandle (hObject=0x1c8) returned 1 [0077.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString=".doc") returned 4 [0077.978] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".docx") returned 5 [0077.978] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0077.978] lstrlenW (lpString=".pdf") returned 4 [0077.978] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".xls") returned 4 [0077.978] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".xlsx") returned 5 [0077.978] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0077.978] lstrlenW (lpString=".ppt") returned 4 [0077.978] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString=".zip") returned 4 [0077.978] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".rar") returned 4 [0077.978] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".bz2") returned 4 [0077.978] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString=".7z") returned 3 [0077.978] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString=".dbf") returned 4 [0077.978] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString=".1cd") returned 4 [0077.978] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0077.978] lstrlenW (lpString=".jpg") returned 4 [0077.978] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0077.979] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") [0077.979] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32184) returned 1 [0077.979] CloseHandle (hObject=0x1c8) returned 1 [0077.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0077.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.979] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.979] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.255] GetLastError () returned 0x0 [0078.255] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.330] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.341] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.341] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.341] SetEndOfFile (hFile=0x22c) returned 1 [0078.341] CloseHandle (hObject=0x22c) returned 1 [0078.341] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.341] SetEndOfFile (hFile=0x1c8) returned 1 [0078.348] CloseHandle (hObject=0x1c8) returned 1 [0078.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.349] lstrlenW (lpString=".doc") returned 4 [0078.349] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".docx") returned 5 [0078.349] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0078.349] lstrlenW (lpString=".pdf") returned 4 [0078.349] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".xls") returned 4 [0078.349] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".xlsx") returned 5 [0078.349] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0078.349] lstrlenW (lpString=".ppt") returned 4 [0078.349] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.349] lstrlenW (lpString=".zip") returned 4 [0078.349] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".rar") returned 4 [0078.349] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".bz2") returned 4 [0078.349] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString=".7z") returned 3 [0078.349] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.349] lstrlenW (lpString=".dbf") returned 4 [0078.349] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.350] lstrlenW (lpString=".1cd") returned 4 [0078.350] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0078.350] lstrlenW (lpString=".jpg") returned 4 [0078.350] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.350] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") [0078.350] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6568) returned 1 [0078.350] CloseHandle (hObject=0x1c8) returned 1 [0078.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0078.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.352] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.352] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.353] GetLastError () returned 0x0 [0078.353] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x19a8, lpOverlapped=0x0) returned 1 [0078.360] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0078.362] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.362] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.362] SetEndOfFile (hFile=0x22c) returned 1 [0078.362] CloseHandle (hObject=0x22c) returned 1 [0078.362] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.362] SetEndOfFile (hFile=0x1c8) returned 1 [0078.363] CloseHandle (hObject=0x1c8) returned 1 [0078.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0078.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.363] lstrlenW (lpString=".doc") returned 4 [0078.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.363] lstrlenW (lpString=".docx") returned 5 [0078.363] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.363] lstrlenW (lpString=".pdf") returned 4 [0078.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.363] lstrlenW (lpString=".xls") returned 4 [0078.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.363] lstrlenW (lpString=".xlsx") returned 5 [0078.363] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.363] lstrlenW (lpString=".ppt") returned 4 [0078.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.363] lstrlenW (lpString=".zip") returned 4 [0078.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.364] lstrlenW (lpString=".rar") returned 4 [0078.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.364] lstrlenW (lpString=".bz2") returned 4 [0078.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.364] lstrlenW (lpString=".7z") returned 3 [0078.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.364] lstrlenW (lpString=".dbf") returned 4 [0078.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.364] lstrlenW (lpString=".1cd") returned 4 [0078.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0078.364] lstrlenW (lpString=".jpg") returned 4 [0078.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.364] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") [0078.364] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14868) returned 1 [0078.364] CloseHandle (hObject=0x1c8) returned 1 [0078.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0078.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.365] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.365] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.365] GetLastError () returned 0x0 [0078.365] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3a14, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0078.374] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.375] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.375] SetEndOfFile (hFile=0x22c) returned 1 [0078.375] CloseHandle (hObject=0x22c) returned 1 [0078.375] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.375] SetEndOfFile (hFile=0x1c8) returned 1 [0078.376] CloseHandle (hObject=0x1c8) returned 1 [0078.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0078.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.376] lstrlenW (lpString=".doc") returned 4 [0078.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.376] lstrlenW (lpString=".docx") returned 5 [0078.376] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.376] lstrlenW (lpString=".pdf") returned 4 [0078.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.376] lstrlenW (lpString=".xls") returned 4 [0078.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.376] lstrlenW (lpString=".xlsx") returned 5 [0078.376] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.376] lstrlenW (lpString=".ppt") returned 4 [0078.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.377] lstrlenW (lpString=".zip") returned 4 [0078.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.377] lstrlenW (lpString=".rar") returned 4 [0078.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString=".bz2") returned 4 [0078.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString=".7z") returned 3 [0078.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.377] lstrlenW (lpString=".dbf") returned 4 [0078.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.377] lstrlenW (lpString=".1cd") returned 4 [0078.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0078.377] lstrlenW (lpString=".jpg") returned 4 [0078.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.377] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") [0078.392] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6320) returned 1 [0078.392] CloseHandle (hObject=0x1c8) returned 1 [0078.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0078.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.392] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.392] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.408] GetLastError () returned 0x0 [0078.408] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x18b0, lpOverlapped=0x0) returned 1 [0078.417] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0078.418] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.418] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.418] SetEndOfFile (hFile=0x22c) returned 1 [0078.419] CloseHandle (hObject=0x22c) returned 1 [0078.419] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.419] SetEndOfFile (hFile=0x1c8) returned 1 [0078.419] CloseHandle (hObject=0x1c8) returned 1 [0078.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0078.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.420] lstrlenW (lpString=".doc") returned 4 [0078.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.420] lstrlenW (lpString=".docx") returned 5 [0078.420] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.420] lstrlenW (lpString=".pdf") returned 4 [0078.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.420] lstrlenW (lpString=".xls") returned 4 [0078.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.420] lstrlenW (lpString=".xlsx") returned 5 [0078.420] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.420] lstrlenW (lpString=".ppt") returned 4 [0078.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.420] lstrlenW (lpString=".zip") returned 4 [0078.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.420] lstrlenW (lpString=".rar") returned 4 [0078.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.421] lstrlenW (lpString=".bz2") returned 4 [0078.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.421] lstrlenW (lpString=".7z") returned 3 [0078.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.421] lstrlenW (lpString=".dbf") returned 4 [0078.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.421] lstrlenW (lpString=".1cd") returned 4 [0078.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0078.421] lstrlenW (lpString=".jpg") returned 4 [0078.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.421] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") [0078.422] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11584) returned 1 [0078.422] CloseHandle (hObject=0x1c8) returned 1 [0078.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0078.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.422] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.422] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.423] GetLastError () returned 0x0 [0078.423] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2d40, lpOverlapped=0x0) returned 1 [0078.424] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0078.425] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.425] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.425] SetEndOfFile (hFile=0x22c) returned 1 [0078.425] CloseHandle (hObject=0x22c) returned 1 [0078.426] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.426] SetEndOfFile (hFile=0x1c8) returned 1 [0078.426] CloseHandle (hObject=0x1c8) returned 1 [0078.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.427] lstrlenW (lpString=".doc") returned 4 [0078.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.427] lstrlenW (lpString=".docx") returned 5 [0078.427] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.427] lstrlenW (lpString=".pdf") returned 4 [0078.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.427] lstrlenW (lpString=".xls") returned 4 [0078.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.427] lstrlenW (lpString=".xlsx") returned 5 [0078.427] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.427] lstrlenW (lpString=".ppt") returned 4 [0078.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.427] lstrlenW (lpString=".zip") returned 4 [0078.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.427] lstrlenW (lpString=".rar") returned 4 [0078.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.427] lstrlenW (lpString=".bz2") returned 4 [0078.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.427] lstrlenW (lpString=".7z") returned 3 [0078.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.428] lstrlenW (lpString=".dbf") returned 4 [0078.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.428] lstrlenW (lpString=".1cd") returned 4 [0078.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0078.428] lstrlenW (lpString=".jpg") returned 4 [0078.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.428] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") [0078.428] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17060) returned 1 [0078.428] CloseHandle (hObject=0x1c8) returned 1 [0078.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0078.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.429] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.429] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0078.429] GetLastError () returned 0x0 [0078.429] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x42a4, lpOverlapped=0x0) returned 1 [0078.446] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0078.447] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0078.447] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.447] SetEndOfFile (hFile=0x22c) returned 1 [0078.762] CloseHandle (hObject=0x22c) returned 1 [0078.762] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0078.762] SetEndOfFile (hFile=0x1c8) returned 1 [0078.763] CloseHandle (hObject=0x1c8) returned 1 [0078.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0079.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.222] lstrlenW (lpString=".doc") returned 4 [0079.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.222] lstrlenW (lpString=".docx") returned 5 [0079.222] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.222] lstrlenW (lpString=".pdf") returned 4 [0079.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.222] lstrlenW (lpString=".xls") returned 4 [0079.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.222] lstrlenW (lpString=".xlsx") returned 5 [0079.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.222] lstrlenW (lpString=".ppt") returned 4 [0079.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.222] lstrlenW (lpString=".zip") returned 4 [0079.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.223] lstrlenW (lpString=".rar") returned 4 [0079.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.223] lstrlenW (lpString=".bz2") returned 4 [0079.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.223] lstrlenW (lpString=".7z") returned 3 [0079.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.223] lstrlenW (lpString=".dbf") returned 4 [0079.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.223] lstrlenW (lpString=".1cd") returned 4 [0079.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0079.223] lstrlenW (lpString=".jpg") returned 4 [0079.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.223] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") [0079.223] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4964) returned 1 [0079.223] CloseHandle (hObject=0x1ec) returned 1 [0079.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0079.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.224] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.224] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0079.224] GetLastError () returned 0x0 [0079.224] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1364, lpOverlapped=0x0) returned 1 [0079.255] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1370, lpOverlapped=0x0) returned 1 [0079.277] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.278] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.278] SetEndOfFile (hFile=0x1f4) returned 1 [0079.278] CloseHandle (hObject=0x1f4) returned 1 [0079.278] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.278] SetEndOfFile (hFile=0x1ec) returned 1 [0079.279] CloseHandle (hObject=0x1ec) returned 1 [0079.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0079.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.279] lstrlenW (lpString=".doc") returned 4 [0079.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.279] lstrlenW (lpString=".docx") returned 5 [0079.279] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.279] lstrlenW (lpString=".pdf") returned 4 [0079.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.279] lstrlenW (lpString=".xls") returned 4 [0079.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.279] lstrlenW (lpString=".xlsx") returned 5 [0079.279] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.280] lstrlenW (lpString=".ppt") returned 4 [0079.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.280] lstrlenW (lpString=".zip") returned 4 [0079.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.280] lstrlenW (lpString=".rar") returned 4 [0079.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.280] lstrlenW (lpString=".bz2") returned 4 [0079.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.280] lstrlenW (lpString=".7z") returned 3 [0079.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.280] lstrlenW (lpString=".dbf") returned 4 [0079.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.280] lstrlenW (lpString=".1cd") returned 4 [0079.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0079.280] lstrlenW (lpString=".jpg") returned 4 [0079.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.280] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") [0079.281] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4624) returned 1 [0079.281] CloseHandle (hObject=0x1ec) returned 1 [0079.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0079.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.281] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.281] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0079.282] GetLastError () returned 0x0 [0079.282] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1210, lpOverlapped=0x0) returned 1 [0079.330] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1220, lpOverlapped=0x0) returned 1 [0079.331] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.331] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.331] SetEndOfFile (hFile=0x1f4) returned 1 [0079.331] CloseHandle (hObject=0x1f4) returned 1 [0079.331] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.332] SetEndOfFile (hFile=0x1ec) returned 1 [0079.332] CloseHandle (hObject=0x1ec) returned 1 [0079.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.479] lstrlenW (lpString=".doc") returned 4 [0079.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".docx") returned 5 [0079.479] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.479] lstrlenW (lpString=".pdf") returned 4 [0079.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".xls") returned 4 [0079.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.487] lstrlenW (lpString=".xlsx") returned 5 [0079.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.487] lstrlenW (lpString=".ppt") returned 4 [0079.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.488] lstrlenW (lpString=".zip") returned 4 [0079.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.488] lstrlenW (lpString=".rar") returned 4 [0079.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".bz2") returned 4 [0079.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".7z") returned 3 [0079.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.509] lstrlenW (lpString=".dbf") returned 4 [0079.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.509] lstrlenW (lpString=".1cd") returned 4 [0079.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0079.509] lstrlenW (lpString=".jpg") returned 4 [0079.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.509] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") [0079.510] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5156) returned 1 [0079.510] CloseHandle (hObject=0x22c) returned 1 [0079.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0079.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.510] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.510] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.511] GetLastError () returned 0x0 [0079.511] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1424, lpOverlapped=0x0) returned 1 [0079.513] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1430, lpOverlapped=0x0) returned 1 [0079.514] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.514] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.514] SetEndOfFile (hFile=0x190) returned 1 [0079.514] CloseHandle (hObject=0x190) returned 1 [0079.514] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.514] SetEndOfFile (hFile=0x22c) returned 1 [0079.515] CloseHandle (hObject=0x22c) returned 1 [0079.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0079.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.515] lstrlenW (lpString=".doc") returned 4 [0079.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString=".docx") returned 5 [0079.516] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.516] lstrlenW (lpString=".pdf") returned 4 [0079.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString=".xls") returned 4 [0079.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.516] lstrlenW (lpString=".xlsx") returned 5 [0079.516] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.516] lstrlenW (lpString=".ppt") returned 4 [0079.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.516] lstrlenW (lpString=".zip") returned 4 [0079.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.516] lstrlenW (lpString=".rar") returned 4 [0079.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString=".bz2") returned 4 [0079.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString=".7z") returned 3 [0079.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.516] lstrlenW (lpString=".dbf") returned 4 [0079.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.516] lstrlenW (lpString=".1cd") returned 4 [0079.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0079.516] lstrlenW (lpString=".jpg") returned 4 [0079.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.516] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") [0079.518] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5472) returned 1 [0079.518] CloseHandle (hObject=0x22c) returned 1 [0079.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0079.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.518] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.518] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.519] GetLastError () returned 0x0 [0079.519] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1560, lpOverlapped=0x0) returned 1 [0079.521] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1570, lpOverlapped=0x0) returned 1 [0079.522] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.522] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.522] SetEndOfFile (hFile=0x190) returned 1 [0079.522] CloseHandle (hObject=0x190) returned 1 [0079.522] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.522] SetEndOfFile (hFile=0x22c) returned 1 [0079.523] CloseHandle (hObject=0x22c) returned 1 [0079.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0079.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.524] lstrlenW (lpString=".doc") returned 4 [0079.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.524] lstrlenW (lpString=".docx") returned 5 [0079.524] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0079.524] lstrlenW (lpString=".pdf") returned 4 [0079.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.524] lstrlenW (lpString=".xls") returned 4 [0079.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.524] lstrlenW (lpString=".xlsx") returned 5 [0079.524] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0079.524] lstrlenW (lpString=".ppt") returned 4 [0079.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.524] lstrlenW (lpString=".zip") returned 4 [0079.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.524] lstrlenW (lpString=".rar") returned 4 [0079.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.524] lstrlenW (lpString=".bz2") returned 4 [0079.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.524] lstrlenW (lpString=".7z") returned 3 [0079.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.525] lstrlenW (lpString=".dbf") returned 4 [0079.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.525] lstrlenW (lpString=".1cd") returned 4 [0079.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0079.525] lstrlenW (lpString=".jpg") returned 4 [0079.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.525] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") [0079.526] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4148) returned 1 [0079.526] CloseHandle (hObject=0x22c) returned 1 [0079.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0079.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.526] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.526] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.527] GetLastError () returned 0x0 [0079.527] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1034, lpOverlapped=0x0) returned 1 [0079.529] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1040, lpOverlapped=0x0) returned 1 [0079.530] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.530] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.530] SetEndOfFile (hFile=0x190) returned 1 [0079.530] CloseHandle (hObject=0x190) returned 1 [0079.530] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.530] SetEndOfFile (hFile=0x22c) returned 1 [0079.531] CloseHandle (hObject=0x22c) returned 1 [0079.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0079.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.531] lstrlenW (lpString=".doc") returned 4 [0079.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString=".docx") returned 5 [0079.532] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.532] lstrlenW (lpString=".pdf") returned 4 [0079.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString=".xls") returned 4 [0079.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.532] lstrlenW (lpString=".xlsx") returned 5 [0079.532] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.532] lstrlenW (lpString=".ppt") returned 4 [0079.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.532] lstrlenW (lpString=".zip") returned 4 [0079.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.532] lstrlenW (lpString=".rar") returned 4 [0079.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString=".bz2") returned 4 [0079.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString=".7z") returned 3 [0079.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.532] lstrlenW (lpString=".dbf") returned 4 [0079.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.532] lstrlenW (lpString=".1cd") returned 4 [0079.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0079.532] lstrlenW (lpString=".jpg") returned 4 [0079.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.533] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") [0079.533] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2912) returned 1 [0079.533] CloseHandle (hObject=0x22c) returned 1 [0079.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0079.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.533] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.534] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.534] GetLastError () returned 0x0 [0079.534] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb60, lpOverlapped=0x0) returned 1 [0079.538] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb70, lpOverlapped=0x0) returned 1 [0079.539] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.539] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.539] SetEndOfFile (hFile=0x190) returned 1 [0079.539] CloseHandle (hObject=0x190) returned 1 [0079.539] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.539] SetEndOfFile (hFile=0x22c) returned 1 [0079.540] CloseHandle (hObject=0x22c) returned 1 [0079.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0079.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.541] lstrlenW (lpString=".doc") returned 4 [0079.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString=".docx") returned 5 [0079.541] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.541] lstrlenW (lpString=".pdf") returned 4 [0079.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString=".xls") returned 4 [0079.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.541] lstrlenW (lpString=".xlsx") returned 5 [0079.541] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.541] lstrlenW (lpString=".ppt") returned 4 [0079.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.541] lstrlenW (lpString=".zip") returned 4 [0079.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.541] lstrlenW (lpString=".rar") returned 4 [0079.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString=".bz2") returned 4 [0079.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString=".7z") returned 3 [0079.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.541] lstrlenW (lpString=".dbf") returned 4 [0079.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.541] lstrlenW (lpString=".1cd") returned 4 [0079.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0079.542] lstrlenW (lpString=".jpg") returned 4 [0079.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.542] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") [0079.542] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31812) returned 1 [0079.542] CloseHandle (hObject=0x22c) returned 1 [0079.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0079.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.543] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.543] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.543] GetLastError () returned 0x0 [0079.543] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7c44, lpOverlapped=0x0) returned 1 [0079.685] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0079.687] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.687] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.687] SetEndOfFile (hFile=0x190) returned 1 [0079.687] CloseHandle (hObject=0x190) returned 1 [0079.687] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.687] SetEndOfFile (hFile=0x22c) returned 1 [0079.688] CloseHandle (hObject=0x22c) returned 1 [0079.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0079.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.805] lstrlenW (lpString=".doc") returned 4 [0079.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.805] lstrlenW (lpString=".docx") returned 5 [0079.805] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.805] lstrlenW (lpString=".pdf") returned 4 [0079.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.805] lstrlenW (lpString=".xls") returned 4 [0079.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.805] lstrlenW (lpString=".xlsx") returned 5 [0079.805] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.805] lstrlenW (lpString=".ppt") returned 4 [0079.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.805] lstrlenW (lpString=".zip") returned 4 [0079.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.806] lstrlenW (lpString=".rar") returned 4 [0079.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.806] lstrlenW (lpString=".bz2") returned 4 [0079.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.806] lstrlenW (lpString=".7z") returned 3 [0079.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.806] lstrlenW (lpString=".dbf") returned 4 [0079.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.806] lstrlenW (lpString=".1cd") returned 4 [0079.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0079.806] lstrlenW (lpString=".jpg") returned 4 [0079.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.806] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") [0080.819] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3332) returned 1 [0080.819] CloseHandle (hObject=0x22c) returned 1 [0080.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0080.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.820] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.820] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.820] GetLastError () returned 0x0 [0080.821] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xd04, lpOverlapped=0x0) returned 1 [0080.822] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xd10, lpOverlapped=0x0) returned 1 [0080.823] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.823] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.824] SetEndOfFile (hFile=0x15c) returned 1 [0080.824] CloseHandle (hObject=0x15c) returned 1 [0080.824] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.824] SetEndOfFile (hFile=0x22c) returned 1 [0080.825] CloseHandle (hObject=0x22c) returned 1 [0080.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0080.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.825] lstrlenW (lpString=".doc") returned 4 [0080.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.825] lstrlenW (lpString=".docx") returned 5 [0080.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0080.826] lstrlenW (lpString=".pdf") returned 4 [0080.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString=".xls") returned 4 [0080.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.826] lstrlenW (lpString=".xlsx") returned 5 [0080.826] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0080.826] lstrlenW (lpString=".ppt") returned 4 [0080.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.826] lstrlenW (lpString=".zip") returned 4 [0080.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.826] lstrlenW (lpString=".rar") returned 4 [0080.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString=".bz2") returned 4 [0080.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString=".7z") returned 3 [0080.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.826] lstrlenW (lpString=".dbf") returned 4 [0080.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.826] lstrlenW (lpString=".1cd") returned 4 [0080.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0080.826] lstrlenW (lpString=".jpg") returned 4 [0080.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.827] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") [0080.827] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27084) returned 1 [0080.827] CloseHandle (hObject=0x22c) returned 1 [0080.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0080.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.828] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.828] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.828] GetLastError () returned 0x0 [0080.828] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x69cc, lpOverlapped=0x0) returned 1 [0080.831] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0080.833] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.833] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.833] SetEndOfFile (hFile=0x15c) returned 1 [0080.833] CloseHandle (hObject=0x15c) returned 1 [0080.833] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.833] SetEndOfFile (hFile=0x22c) returned 1 [0080.834] CloseHandle (hObject=0x22c) returned 1 [0080.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0080.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.835] lstrlenW (lpString=".doc") returned 4 [0080.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.835] lstrlenW (lpString=".docx") returned 5 [0080.835] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0080.835] lstrlenW (lpString=".pdf") returned 4 [0080.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.835] lstrlenW (lpString=".xls") returned 4 [0080.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.835] lstrlenW (lpString=".xlsx") returned 5 [0080.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0080.835] lstrlenW (lpString=".ppt") returned 4 [0080.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.835] lstrlenW (lpString=".zip") returned 4 [0080.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.836] lstrlenW (lpString=".rar") returned 4 [0080.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.836] lstrlenW (lpString=".bz2") returned 4 [0080.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.836] lstrlenW (lpString=".7z") returned 3 [0080.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.836] lstrlenW (lpString=".dbf") returned 4 [0080.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.836] lstrlenW (lpString=".1cd") returned 4 [0080.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0080.836] lstrlenW (lpString=".jpg") returned 4 [0080.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.836] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") [0080.837] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=48380) returned 1 [0080.837] CloseHandle (hObject=0x22c) returned 1 [0080.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0080.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.837] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.837] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.838] GetLastError () returned 0x0 [0080.838] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0080.841] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0080.843] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.843] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.843] SetEndOfFile (hFile=0x15c) returned 1 [0080.844] CloseHandle (hObject=0x15c) returned 1 [0080.844] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.844] SetEndOfFile (hFile=0x22c) returned 1 [0080.845] CloseHandle (hObject=0x22c) returned 1 [0080.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0080.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.846] lstrlenW (lpString=".doc") returned 4 [0080.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.846] lstrlenW (lpString=".docx") returned 5 [0080.846] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0080.846] lstrlenW (lpString=".pdf") returned 4 [0080.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.846] lstrlenW (lpString=".xls") returned 4 [0080.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.846] lstrlenW (lpString=".xlsx") returned 5 [0080.846] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0080.846] lstrlenW (lpString=".ppt") returned 4 [0080.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.846] lstrlenW (lpString=".zip") returned 4 [0080.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.846] lstrlenW (lpString=".rar") returned 4 [0080.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.846] lstrlenW (lpString=".bz2") returned 4 [0080.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.846] lstrlenW (lpString=".7z") returned 3 [0080.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.847] lstrlenW (lpString=".dbf") returned 4 [0080.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.847] lstrlenW (lpString=".1cd") returned 4 [0080.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0080.847] lstrlenW (lpString=".jpg") returned 4 [0080.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.847] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") [0080.847] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=48388) returned 1 [0080.848] CloseHandle (hObject=0x22c) returned 1 [0080.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0080.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.848] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.848] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0080.849] GetLastError () returned 0x0 [0080.849] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbd04, lpOverlapped=0x0) returned 1 [0080.851] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0080.853] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0080.853] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.853] SetEndOfFile (hFile=0x15c) returned 1 [0080.853] CloseHandle (hObject=0x15c) returned 1 [0080.853] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0080.853] SetEndOfFile (hFile=0x22c) returned 1 [0080.854] CloseHandle (hObject=0x22c) returned 1 [0080.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0080.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.855] lstrlenW (lpString=".doc") returned 4 [0080.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.855] lstrlenW (lpString=".docx") returned 5 [0080.855] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0080.855] lstrlenW (lpString=".pdf") returned 4 [0080.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.855] lstrlenW (lpString=".xls") returned 4 [0080.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.855] lstrlenW (lpString=".xlsx") returned 5 [0080.855] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0080.855] lstrlenW (lpString=".ppt") returned 4 [0080.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.855] lstrlenW (lpString=".zip") returned 4 [0080.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.855] lstrlenW (lpString=".rar") returned 4 [0080.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.855] lstrlenW (lpString=".bz2") returned 4 [0080.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.855] lstrlenW (lpString=".7z") returned 3 [0080.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.856] lstrlenW (lpString=".dbf") returned 4 [0080.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.856] lstrlenW (lpString=".1cd") returned 4 [0080.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0080.856] lstrlenW (lpString=".jpg") returned 4 [0080.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.856] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") [0081.466] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17200) returned 1 [0081.466] CloseHandle (hObject=0x22c) returned 1 [0081.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0081.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0081.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0081.476] GetLastError () returned 0x0 [0081.476] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4330, lpOverlapped=0x0) returned 1 [0081.794] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4340, lpOverlapped=0x0) returned 1 [0081.807] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.807] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.807] SetEndOfFile (hFile=0x158) returned 1 [0081.807] CloseHandle (hObject=0x158) returned 1 [0081.807] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.807] SetEndOfFile (hFile=0x22c) returned 1 [0081.808] CloseHandle (hObject=0x22c) returned 1 [0081.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0081.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.809] lstrlenW (lpString=".doc") returned 4 [0081.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.809] lstrlenW (lpString=".docx") returned 5 [0081.809] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0081.809] lstrlenW (lpString=".pdf") returned 4 [0081.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.809] lstrlenW (lpString=".xls") returned 4 [0081.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.809] lstrlenW (lpString=".xlsx") returned 5 [0081.809] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0081.809] lstrlenW (lpString=".ppt") returned 4 [0081.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.809] lstrlenW (lpString=".zip") returned 4 [0081.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.809] lstrlenW (lpString=".rar") returned 4 [0081.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.809] lstrlenW (lpString=".bz2") returned 4 [0081.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.809] lstrlenW (lpString=".7z") returned 3 [0081.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.809] lstrlenW (lpString=".dbf") returned 4 [0081.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.810] lstrlenW (lpString=".1cd") returned 4 [0081.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0081.810] lstrlenW (lpString=".jpg") returned 4 [0081.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.810] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") [0082.003] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20136) returned 1 [0082.003] CloseHandle (hObject=0x1fc) returned 1 [0082.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0082.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0082.004] GetLastError () returned 0x0 [0082.004] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0082.092] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0082.093] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0082.093] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.093] SetEndOfFile (hFile=0x1c0) returned 1 [0082.093] CloseHandle (hObject=0x1c0) returned 1 [0082.093] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.093] SetEndOfFile (hFile=0x1fc) returned 1 [0082.094] CloseHandle (hObject=0x1fc) returned 1 [0082.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0082.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.095] lstrlenW (lpString=".doc") returned 4 [0082.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.095] lstrlenW (lpString=".docx") returned 5 [0082.095] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0082.095] lstrlenW (lpString=".pdf") returned 4 [0082.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.095] lstrlenW (lpString=".xls") returned 4 [0082.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.095] lstrlenW (lpString=".xlsx") returned 5 [0082.095] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0082.095] lstrlenW (lpString=".ppt") returned 4 [0082.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.095] lstrlenW (lpString=".zip") returned 4 [0082.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.095] lstrlenW (lpString=".rar") returned 4 [0082.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.095] lstrlenW (lpString=".bz2") returned 4 [0082.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.095] lstrlenW (lpString=".7z") returned 3 [0082.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.095] lstrlenW (lpString=".dbf") returned 4 [0082.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.096] lstrlenW (lpString=".1cd") returned 4 [0082.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0082.096] lstrlenW (lpString=".jpg") returned 4 [0082.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.096] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") [0082.108] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8552) returned 1 [0082.111] CloseHandle (hObject=0x1fc) returned 1 [0082.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0082.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.127] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.127] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0082.128] GetLastError () returned 0x0 [0082.128] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2168, lpOverlapped=0x0) returned 1 [0082.137] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2170, lpOverlapped=0x0) returned 1 [0082.138] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0082.138] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.138] SetEndOfFile (hFile=0x1c0) returned 1 [0082.138] CloseHandle (hObject=0x1c0) returned 1 [0082.138] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.139] SetEndOfFile (hFile=0x1fc) returned 1 [0082.139] CloseHandle (hObject=0x1fc) returned 1 [0082.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0082.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.140] lstrlenW (lpString=".doc") returned 4 [0082.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.140] lstrlenW (lpString=".docx") returned 5 [0082.140] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0082.140] lstrlenW (lpString=".pdf") returned 4 [0082.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.140] lstrlenW (lpString=".xls") returned 4 [0082.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.140] lstrlenW (lpString=".xlsx") returned 5 [0082.140] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0082.140] lstrlenW (lpString=".ppt") returned 4 [0082.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.140] lstrlenW (lpString=".zip") returned 4 [0082.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.140] lstrlenW (lpString=".rar") returned 4 [0082.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.140] lstrlenW (lpString=".bz2") returned 4 [0082.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.140] lstrlenW (lpString=".7z") returned 3 [0082.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.140] lstrlenW (lpString=".dbf") returned 4 [0082.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.141] lstrlenW (lpString=".1cd") returned 4 [0082.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0082.141] lstrlenW (lpString=".jpg") returned 4 [0082.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.141] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") [0082.141] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11108) returned 1 [0082.141] CloseHandle (hObject=0x1fc) returned 1 [0082.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0082.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.142] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.142] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0082.142] GetLastError () returned 0x0 [0082.142] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2b64, lpOverlapped=0x0) returned 1 [0082.144] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0082.145] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0082.145] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.145] SetEndOfFile (hFile=0x1c0) returned 1 [0082.145] CloseHandle (hObject=0x1c0) returned 1 [0082.145] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.145] SetEndOfFile (hFile=0x1fc) returned 1 [0082.146] CloseHandle (hObject=0x1fc) returned 1 [0082.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0082.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.146] lstrlenW (lpString=".doc") returned 4 [0082.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString=".docx") returned 5 [0082.147] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0082.147] lstrlenW (lpString=".pdf") returned 4 [0082.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString=".xls") returned 4 [0082.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.147] lstrlenW (lpString=".xlsx") returned 5 [0082.147] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0082.147] lstrlenW (lpString=".ppt") returned 4 [0082.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.147] lstrlenW (lpString=".zip") returned 4 [0082.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.147] lstrlenW (lpString=".rar") returned 4 [0082.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString=".bz2") returned 4 [0082.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString=".7z") returned 3 [0082.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.147] lstrlenW (lpString=".dbf") returned 4 [0082.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.147] lstrlenW (lpString=".1cd") returned 4 [0082.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0082.147] lstrlenW (lpString=".jpg") returned 4 [0082.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.147] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") [0082.148] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14132) returned 1 [0082.148] CloseHandle (hObject=0x1fc) returned 1 [0082.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0082.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0082.149] GetLastError () returned 0x0 [0082.149] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3734, lpOverlapped=0x0) returned 1 [0082.209] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3740, lpOverlapped=0x0) returned 1 [0082.210] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0082.210] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.210] SetEndOfFile (hFile=0x1c0) returned 1 [0082.416] CloseHandle (hObject=0x1c0) returned 1 [0082.416] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0082.416] SetEndOfFile (hFile=0x1fc) returned 1 [0082.417] CloseHandle (hObject=0x1fc) returned 1 [0082.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString=".doc") returned 4 [0082.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString=".docx") returned 5 [0082.474] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0082.474] lstrlenW (lpString=".pdf") returned 4 [0082.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString=".xls") returned 4 [0082.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.474] lstrlenW (lpString=".xlsx") returned 5 [0082.474] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0082.474] lstrlenW (lpString=".ppt") returned 4 [0082.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString=".zip") returned 4 [0082.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.474] lstrlenW (lpString=".rar") returned 4 [0082.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString=".bz2") returned 4 [0082.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString=".7z") returned 3 [0082.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString=".dbf") returned 4 [0082.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString=".1cd") returned 4 [0082.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0082.474] lstrlenW (lpString=".jpg") returned 4 [0082.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.475] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") [0083.925] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11288) returned 1 [0083.925] CloseHandle (hObject=0x210) returned 1 [0083.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0083.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.925] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.925] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.926] GetLastError () returned 0x0 [0083.926] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2c18, lpOverlapped=0x0) returned 1 [0083.928] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0083.929] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.929] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.929] SetEndOfFile (hFile=0x150) returned 1 [0083.930] CloseHandle (hObject=0x150) returned 1 [0083.930] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.930] SetEndOfFile (hFile=0x210) returned 1 [0083.930] CloseHandle (hObject=0x210) returned 1 [0083.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0083.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.931] lstrlenW (lpString=".doc") returned 4 [0083.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.931] lstrlenW (lpString=".docx") returned 5 [0083.931] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0083.931] lstrlenW (lpString=".pdf") returned 4 [0083.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.931] lstrlenW (lpString=".xls") returned 4 [0083.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.931] lstrlenW (lpString=".xlsx") returned 5 [0083.931] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0083.931] lstrlenW (lpString=".ppt") returned 4 [0083.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.931] lstrlenW (lpString=".zip") returned 4 [0083.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.931] lstrlenW (lpString=".rar") returned 4 [0083.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.931] lstrlenW (lpString=".bz2") returned 4 [0083.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.932] lstrlenW (lpString=".7z") returned 3 [0083.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.932] lstrlenW (lpString=".dbf") returned 4 [0083.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.932] lstrlenW (lpString=".1cd") returned 4 [0083.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0083.932] lstrlenW (lpString=".jpg") returned 4 [0083.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.932] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") [0083.932] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3568) returned 1 [0083.932] CloseHandle (hObject=0x210) returned 1 [0083.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0083.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.933] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.933] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.933] GetLastError () returned 0x0 [0083.933] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xdf0, lpOverlapped=0x0) returned 1 [0083.935] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe00, lpOverlapped=0x0) returned 1 [0083.936] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.936] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.936] SetEndOfFile (hFile=0x150) returned 1 [0083.936] CloseHandle (hObject=0x150) returned 1 [0083.936] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.936] SetEndOfFile (hFile=0x210) returned 1 [0083.937] CloseHandle (hObject=0x210) returned 1 [0083.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0083.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.937] lstrlenW (lpString=".doc") returned 4 [0083.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.937] lstrlenW (lpString=".docx") returned 5 [0083.937] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.937] lstrlenW (lpString=".pdf") returned 4 [0083.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.937] lstrlenW (lpString=".xls") returned 4 [0083.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.937] lstrlenW (lpString=".xlsx") returned 5 [0083.937] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.937] lstrlenW (lpString=".ppt") returned 4 [0083.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.938] lstrlenW (lpString=".zip") returned 4 [0083.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.938] lstrlenW (lpString=".rar") returned 4 [0083.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.938] lstrlenW (lpString=".bz2") returned 4 [0083.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.938] lstrlenW (lpString=".7z") returned 3 [0083.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.938] lstrlenW (lpString=".dbf") returned 4 [0083.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.938] lstrlenW (lpString=".1cd") returned 4 [0083.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0083.938] lstrlenW (lpString=".jpg") returned 4 [0083.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.938] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") [0083.938] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9612) returned 1 [0083.939] CloseHandle (hObject=0x210) returned 1 [0083.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0083.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.939] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.939] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.939] GetLastError () returned 0x0 [0083.940] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x258c, lpOverlapped=0x0) returned 1 [0083.941] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2590, lpOverlapped=0x0) returned 1 [0083.942] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.942] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.942] SetEndOfFile (hFile=0x150) returned 1 [0083.942] CloseHandle (hObject=0x150) returned 1 [0083.943] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.943] SetEndOfFile (hFile=0x210) returned 1 [0083.943] CloseHandle (hObject=0x210) returned 1 [0083.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0083.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.944] lstrlenW (lpString=".doc") returned 4 [0083.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.944] lstrlenW (lpString=".docx") returned 5 [0083.944] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0083.944] lstrlenW (lpString=".pdf") returned 4 [0083.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.944] lstrlenW (lpString=".xls") returned 4 [0083.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.944] lstrlenW (lpString=".xlsx") returned 5 [0083.944] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0083.944] lstrlenW (lpString=".ppt") returned 4 [0083.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.944] lstrlenW (lpString=".zip") returned 4 [0083.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.944] lstrlenW (lpString=".rar") returned 4 [0083.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.944] lstrlenW (lpString=".bz2") returned 4 [0083.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.944] lstrlenW (lpString=".7z") returned 3 [0083.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.945] lstrlenW (lpString=".dbf") returned 4 [0083.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.945] lstrlenW (lpString=".1cd") returned 4 [0083.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0083.945] lstrlenW (lpString=".jpg") returned 4 [0083.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.945] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") [0083.945] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6024) returned 1 [0083.945] CloseHandle (hObject=0x210) returned 1 [0083.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0083.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.946] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.946] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.946] GetLastError () returned 0x0 [0083.946] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1788, lpOverlapped=0x0) returned 1 [0083.948] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1790, lpOverlapped=0x0) returned 1 [0083.949] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.949] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.949] SetEndOfFile (hFile=0x150) returned 1 [0083.949] CloseHandle (hObject=0x150) returned 1 [0083.949] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.949] SetEndOfFile (hFile=0x210) returned 1 [0083.950] CloseHandle (hObject=0x210) returned 1 [0083.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0083.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.950] lstrlenW (lpString=".doc") returned 4 [0083.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.950] lstrlenW (lpString=".docx") returned 5 [0083.950] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0083.950] lstrlenW (lpString=".pdf") returned 4 [0083.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.950] lstrlenW (lpString=".xls") returned 4 [0083.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.951] lstrlenW (lpString=".xlsx") returned 5 [0083.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0083.951] lstrlenW (lpString=".ppt") returned 4 [0083.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.951] lstrlenW (lpString=".zip") returned 4 [0083.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.951] lstrlenW (lpString=".rar") returned 4 [0083.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.951] lstrlenW (lpString=".bz2") returned 4 [0083.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.951] lstrlenW (lpString=".7z") returned 3 [0083.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.951] lstrlenW (lpString=".dbf") returned 4 [0083.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.951] lstrlenW (lpString=".1cd") returned 4 [0083.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0083.951] lstrlenW (lpString=".jpg") returned 4 [0083.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.951] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") [0083.952] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4980) returned 1 [0083.952] CloseHandle (hObject=0x210) returned 1 [0083.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0083.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.952] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.952] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.952] GetLastError () returned 0x0 [0083.953] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1374, lpOverlapped=0x0) returned 1 [0083.954] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1380, lpOverlapped=0x0) returned 1 [0083.955] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0083.955] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.955] SetEndOfFile (hFile=0x150) returned 1 [0083.955] CloseHandle (hObject=0x150) returned 1 [0083.955] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.956] SetEndOfFile (hFile=0x210) returned 1 [0083.956] CloseHandle (hObject=0x210) returned 1 [0083.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0083.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.957] lstrlenW (lpString=".doc") returned 4 [0083.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString=".docx") returned 5 [0083.957] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0083.957] lstrlenW (lpString=".pdf") returned 4 [0083.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString=".xls") returned 4 [0083.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.957] lstrlenW (lpString=".xlsx") returned 5 [0083.957] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0083.957] lstrlenW (lpString=".ppt") returned 4 [0083.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.957] lstrlenW (lpString=".zip") returned 4 [0083.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.957] lstrlenW (lpString=".rar") returned 4 [0083.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString=".bz2") returned 4 [0083.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString=".7z") returned 3 [0083.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.957] lstrlenW (lpString=".dbf") returned 4 [0083.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.957] lstrlenW (lpString=".1cd") returned 4 [0083.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0083.958] lstrlenW (lpString=".jpg") returned 4 [0083.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.958] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") [0083.959] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3040) returned 1 [0083.959] CloseHandle (hObject=0x210) returned 1 [0083.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0083.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.959] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.959] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.960] GetLastError () returned 0x0 [0083.960] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbe0, lpOverlapped=0x0) returned 1 [0084.082] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbf0, lpOverlapped=0x0) returned 1 [0084.116] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.116] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.116] SetEndOfFile (hFile=0x150) returned 1 [0084.116] CloseHandle (hObject=0x150) returned 1 [0084.116] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.116] SetEndOfFile (hFile=0x210) returned 1 [0084.117] CloseHandle (hObject=0x210) returned 1 [0084.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString=".doc") returned 4 [0084.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString=".docx") returned 5 [0084.118] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0084.118] lstrlenW (lpString=".pdf") returned 4 [0084.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString=".xls") returned 4 [0084.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.118] lstrlenW (lpString=".xlsx") returned 5 [0084.118] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0084.118] lstrlenW (lpString=".ppt") returned 4 [0084.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString=".zip") returned 4 [0084.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.118] lstrlenW (lpString=".rar") returned 4 [0084.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString=".bz2") returned 4 [0084.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString=".7z") returned 3 [0084.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString=".dbf") returned 4 [0084.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString=".1cd") returned 4 [0084.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0084.118] lstrlenW (lpString=".jpg") returned 4 [0084.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.119] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") [0084.119] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4636) returned 1 [0084.119] CloseHandle (hObject=0x210) returned 1 [0084.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0084.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0084.119] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.119] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0084.120] GetLastError () returned 0x0 [0084.120] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x121c, lpOverlapped=0x0) returned 1 [0084.121] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1220, lpOverlapped=0x0) returned 1 [0084.122] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.122] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.122] SetEndOfFile (hFile=0x150) returned 1 [0084.123] CloseHandle (hObject=0x150) returned 1 [0084.123] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.123] SetEndOfFile (hFile=0x210) returned 1 [0084.123] CloseHandle (hObject=0x210) returned 1 [0084.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0084.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.124] lstrlenW (lpString=".doc") returned 4 [0084.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.124] lstrlenW (lpString=".docx") returned 5 [0084.124] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0084.124] lstrlenW (lpString=".pdf") returned 4 [0084.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.124] lstrlenW (lpString=".xls") returned 4 [0084.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.124] lstrlenW (lpString=".xlsx") returned 5 [0084.124] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0084.124] lstrlenW (lpString=".ppt") returned 4 [0084.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.124] lstrlenW (lpString=".zip") returned 4 [0084.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.124] lstrlenW (lpString=".rar") returned 4 [0084.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.124] lstrlenW (lpString=".bz2") returned 4 [0084.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.124] lstrlenW (lpString=".7z") returned 3 [0084.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.125] lstrlenW (lpString=".dbf") returned 4 [0084.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.125] lstrlenW (lpString=".1cd") returned 4 [0084.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0084.125] lstrlenW (lpString=".jpg") returned 4 [0084.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.125] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") [0084.125] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3800) returned 1 [0084.125] CloseHandle (hObject=0x210) returned 1 [0084.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0084.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0084.126] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.126] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0084.176] GetLastError () returned 0x0 [0084.176] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xed8, lpOverlapped=0x0) returned 1 [0084.186] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee0, lpOverlapped=0x0) returned 1 [0084.187] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.187] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.187] SetEndOfFile (hFile=0x150) returned 1 [0084.187] CloseHandle (hObject=0x150) returned 1 [0084.187] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.187] SetEndOfFile (hFile=0x210) returned 1 [0084.188] CloseHandle (hObject=0x210) returned 1 [0084.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0084.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.188] lstrlenW (lpString=".doc") returned 4 [0084.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString=".docx") returned 5 [0084.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0084.189] lstrlenW (lpString=".pdf") returned 4 [0084.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString=".xls") returned 4 [0084.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.189] lstrlenW (lpString=".xlsx") returned 5 [0084.189] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0084.189] lstrlenW (lpString=".ppt") returned 4 [0084.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.189] lstrlenW (lpString=".zip") returned 4 [0084.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.189] lstrlenW (lpString=".rar") returned 4 [0084.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString=".bz2") returned 4 [0084.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString=".7z") returned 3 [0084.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.189] lstrlenW (lpString=".dbf") returned 4 [0084.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.189] lstrlenW (lpString=".1cd") returned 4 [0084.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0084.189] lstrlenW (lpString=".jpg") returned 4 [0084.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.189] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") [0084.190] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8260) returned 1 [0084.190] CloseHandle (hObject=0x210) returned 1 [0084.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0084.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0084.191] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.191] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0084.191] GetLastError () returned 0x0 [0084.191] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2044, lpOverlapped=0x0) returned 1 [0084.193] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2050, lpOverlapped=0x0) returned 1 [0084.194] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.194] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.194] SetEndOfFile (hFile=0x150) returned 1 [0084.194] CloseHandle (hObject=0x150) returned 1 [0084.195] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.195] SetEndOfFile (hFile=0x210) returned 1 [0084.195] CloseHandle (hObject=0x210) returned 1 [0084.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0084.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.196] lstrlenW (lpString=".doc") returned 4 [0084.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.196] lstrlenW (lpString=".docx") returned 5 [0084.196] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0084.196] lstrlenW (lpString=".pdf") returned 4 [0084.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.196] lstrlenW (lpString=".xls") returned 4 [0084.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.196] lstrlenW (lpString=".xlsx") returned 5 [0084.196] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0084.196] lstrlenW (lpString=".ppt") returned 4 [0084.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.196] lstrlenW (lpString=".zip") returned 4 [0084.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.196] lstrlenW (lpString=".rar") returned 4 [0084.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.196] lstrlenW (lpString=".bz2") returned 4 [0084.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.196] lstrlenW (lpString=".7z") returned 3 [0084.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.197] lstrlenW (lpString=".dbf") returned 4 [0084.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.197] lstrlenW (lpString=".1cd") returned 4 [0084.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0084.197] lstrlenW (lpString=".jpg") returned 4 [0084.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.197] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") [0084.197] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7016) returned 1 [0084.198] CloseHandle (hObject=0x210) returned 1 [0084.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0084.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0084.198] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.198] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0084.198] GetLastError () returned 0x0 [0084.198] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b68, lpOverlapped=0x0) returned 1 [0084.255] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0084.298] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.298] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.299] SetEndOfFile (hFile=0x150) returned 1 [0084.455] CloseHandle (hObject=0x150) returned 1 [0084.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.464] SetEndOfFile (hFile=0x210) returned 1 [0084.515] CloseHandle (hObject=0x210) returned 1 [0084.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0085.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.128] lstrlenW (lpString=".doc") returned 4 [0085.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString=".docx") returned 5 [0085.129] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0085.129] lstrlenW (lpString=".pdf") returned 4 [0085.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString=".xls") returned 4 [0085.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.129] lstrlenW (lpString=".xlsx") returned 5 [0085.129] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0085.129] lstrlenW (lpString=".ppt") returned 4 [0085.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.129] lstrlenW (lpString=".zip") returned 4 [0085.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.129] lstrlenW (lpString=".rar") returned 4 [0085.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString=".bz2") returned 4 [0085.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString=".7z") returned 3 [0085.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.129] lstrlenW (lpString=".dbf") returned 4 [0085.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.129] lstrlenW (lpString=".1cd") returned 4 [0085.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0085.129] lstrlenW (lpString=".jpg") returned 4 [0085.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.129] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") [0085.130] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4716) returned 1 [0085.130] CloseHandle (hObject=0x22c) returned 1 [0085.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0085.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.130] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.130] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0085.149] GetLastError () returned 0x0 [0085.149] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x126c, lpOverlapped=0x0) returned 1 [0085.204] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1270, lpOverlapped=0x0) returned 1 [0085.205] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.205] SetEndOfFile (hFile=0x16c) returned 1 [0085.508] CloseHandle (hObject=0x16c) returned 1 [0085.513] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.516] SetEndOfFile (hFile=0x22c) returned 1 [0085.526] CloseHandle (hObject=0x22c) returned 1 [0085.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.526] lstrlenW (lpString=".doc") returned 4 [0085.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.526] lstrlenW (lpString=".docx") returned 5 [0085.526] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0085.526] lstrlenW (lpString=".pdf") returned 4 [0085.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.526] lstrlenW (lpString=".xls") returned 4 [0085.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.526] lstrlenW (lpString=".xlsx") returned 5 [0085.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0085.526] lstrlenW (lpString=".ppt") returned 4 [0085.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.526] lstrlenW (lpString=".zip") returned 4 [0085.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.527] lstrlenW (lpString=".rar") returned 4 [0085.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.527] lstrlenW (lpString=".bz2") returned 4 [0085.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.527] lstrlenW (lpString=".7z") returned 3 [0085.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.527] lstrlenW (lpString=".dbf") returned 4 [0085.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.527] lstrlenW (lpString=".1cd") returned 4 [0085.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0085.527] lstrlenW (lpString=".jpg") returned 4 [0085.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.527] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") [0085.527] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=21125) returned 1 [0085.527] CloseHandle (hObject=0x22c) returned 1 [0085.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0085.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.528] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.528] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.528] GetLastError () returned 0x0 [0085.528] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5285, lpOverlapped=0x0) returned 1 [0085.548] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5290, lpOverlapped=0x0) returned 1 [0085.550] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.550] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.550] SetEndOfFile (hFile=0x158) returned 1 [0085.550] CloseHandle (hObject=0x158) returned 1 [0085.550] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.550] SetEndOfFile (hFile=0x22c) returned 1 [0085.551] CloseHandle (hObject=0x22c) returned 1 [0085.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0085.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.551] lstrlenW (lpString=".doc") returned 4 [0085.551] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.551] lstrlenW (lpString=".docx") returned 5 [0085.551] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0085.551] lstrlenW (lpString=".pdf") returned 4 [0085.551] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.551] lstrlenW (lpString=".xls") returned 4 [0085.551] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.551] lstrlenW (lpString=".xlsx") returned 5 [0085.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0085.552] lstrlenW (lpString=".ppt") returned 4 [0085.552] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.552] lstrlenW (lpString=".zip") returned 4 [0085.552] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.552] lstrlenW (lpString=".rar") returned 4 [0085.552] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.552] lstrlenW (lpString=".bz2") returned 4 [0085.552] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.552] lstrlenW (lpString=".7z") returned 3 [0085.552] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.552] lstrlenW (lpString=".dbf") returned 4 [0085.552] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.552] lstrlenW (lpString=".1cd") returned 4 [0085.552] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0085.552] lstrlenW (lpString=".jpg") returned 4 [0085.552] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.552] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") [0085.553] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31850) returned 1 [0085.553] CloseHandle (hObject=0x22c) returned 1 [0085.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0085.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.553] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.553] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.554] GetLastError () returned 0x0 [0085.554] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0085.558] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7c70, lpOverlapped=0x0) returned 1 [0085.560] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.560] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.560] SetEndOfFile (hFile=0x158) returned 1 [0085.560] CloseHandle (hObject=0x158) returned 1 [0085.560] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.560] SetEndOfFile (hFile=0x22c) returned 1 [0085.561] CloseHandle (hObject=0x22c) returned 1 [0085.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0085.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.561] lstrlenW (lpString=".doc") returned 4 [0085.561] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.561] lstrlenW (lpString=".docx") returned 5 [0085.561] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0085.562] lstrlenW (lpString=".pdf") returned 4 [0085.562] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.562] lstrlenW (lpString=".xls") returned 4 [0085.562] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.562] lstrlenW (lpString=".xlsx") returned 5 [0085.562] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0085.562] lstrlenW (lpString=".ppt") returned 4 [0085.562] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.562] lstrlenW (lpString=".zip") returned 4 [0085.562] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.562] lstrlenW (lpString=".rar") returned 4 [0085.562] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.562] lstrlenW (lpString=".bz2") returned 4 [0085.562] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.562] lstrlenW (lpString=".7z") returned 3 [0085.562] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.562] lstrlenW (lpString=".dbf") returned 4 [0085.562] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.562] lstrlenW (lpString=".1cd") returned 4 [0085.562] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0085.562] lstrlenW (lpString=".jpg") returned 4 [0085.562] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.562] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") [0085.563] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=36820) returned 1 [0085.563] CloseHandle (hObject=0x22c) returned 1 [0085.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0085.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.563] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.563] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.564] GetLastError () returned 0x0 [0085.564] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0085.566] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8fe0, lpOverlapped=0x0) returned 1 [0085.567] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.568] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.568] SetEndOfFile (hFile=0x158) returned 1 [0085.568] CloseHandle (hObject=0x158) returned 1 [0085.568] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.568] SetEndOfFile (hFile=0x22c) returned 1 [0085.569] CloseHandle (hObject=0x22c) returned 1 [0085.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0085.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.570] lstrlenW (lpString=".doc") returned 4 [0085.570] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.570] lstrlenW (lpString=".docx") returned 5 [0085.570] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0085.570] lstrlenW (lpString=".pdf") returned 4 [0085.570] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.570] lstrlenW (lpString=".xls") returned 4 [0085.570] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.570] lstrlenW (lpString=".xlsx") returned 5 [0085.570] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0085.570] lstrlenW (lpString=".ppt") returned 4 [0085.570] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.570] lstrlenW (lpString=".zip") returned 4 [0085.570] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.570] lstrlenW (lpString=".rar") returned 4 [0085.570] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.570] lstrlenW (lpString=".bz2") returned 4 [0085.570] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.570] lstrlenW (lpString=".7z") returned 3 [0085.570] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.570] lstrlenW (lpString=".dbf") returned 4 [0085.570] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.570] lstrlenW (lpString=".1cd") returned 4 [0085.570] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0085.570] lstrlenW (lpString=".jpg") returned 4 [0085.570] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.570] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") [0085.571] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=36792) returned 1 [0085.571] CloseHandle (hObject=0x22c) returned 1 [0085.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0085.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.572] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.572] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.572] GetLastError () returned 0x0 [0085.572] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0085.575] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8fc0, lpOverlapped=0x0) returned 1 [0085.576] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.576] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.576] SetEndOfFile (hFile=0x158) returned 1 [0085.577] CloseHandle (hObject=0x158) returned 1 [0085.577] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.577] SetEndOfFile (hFile=0x22c) returned 1 [0085.578] CloseHandle (hObject=0x22c) returned 1 [0085.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0085.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.578] lstrlenW (lpString=".doc") returned 4 [0085.578] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.578] lstrlenW (lpString=".docx") returned 5 [0085.578] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0085.578] lstrlenW (lpString=".pdf") returned 4 [0085.578] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.578] lstrlenW (lpString=".xls") returned 4 [0085.579] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.579] lstrlenW (lpString=".xlsx") returned 5 [0085.579] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0085.579] lstrlenW (lpString=".ppt") returned 4 [0085.579] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.579] lstrlenW (lpString=".zip") returned 4 [0085.579] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.579] lstrlenW (lpString=".rar") returned 4 [0085.579] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.579] lstrlenW (lpString=".bz2") returned 4 [0085.579] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.579] lstrlenW (lpString=".7z") returned 3 [0085.579] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.579] lstrlenW (lpString=".dbf") returned 4 [0085.579] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.579] lstrlenW (lpString=".1cd") returned 4 [0085.579] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0085.579] lstrlenW (lpString=".jpg") returned 4 [0085.579] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.579] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") [0085.580] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=35419) returned 1 [0085.580] CloseHandle (hObject=0x22c) returned 1 [0085.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0085.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0085.581] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.581] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.581] GetLastError () returned 0x0 [0085.581] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0085.756] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8a60, lpOverlapped=0x0) returned 1 [0085.758] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.758] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.758] SetEndOfFile (hFile=0x158) returned 1 [0085.965] CloseHandle (hObject=0x158) returned 1 [0085.965] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.965] SetEndOfFile (hFile=0x22c) returned 1 [0085.966] CloseHandle (hObject=0x22c) returned 1 [0085.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.114] lstrlenW (lpString=".doc") returned 4 [0086.114] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0086.125] lstrlenW (lpString=".docx") returned 5 [0086.125] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0086.125] lstrlenW (lpString=".pdf") returned 4 [0086.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0086.125] lstrlenW (lpString=".xls") returned 4 [0086.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0086.125] lstrlenW (lpString=".xlsx") returned 5 [0086.125] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0086.126] lstrlenW (lpString=".ppt") returned 4 [0086.126] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0086.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.126] lstrlenW (lpString=".zip") returned 4 [0086.126] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0086.126] lstrlenW (lpString=".rar") returned 4 [0086.126] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0086.126] lstrlenW (lpString=".bz2") returned 4 [0086.126] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0086.126] lstrlenW (lpString=".7z") returned 3 [0086.126] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0086.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.126] lstrlenW (lpString=".dbf") returned 4 [0086.126] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0086.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.126] lstrlenW (lpString=".1cd") returned 4 [0086.126] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0086.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0086.126] lstrlenW (lpString=".jpg") returned 4 [0086.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0086.126] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") [0086.473] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14632) returned 1 [0086.473] CloseHandle (hObject=0x1fc) returned 1 [0086.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0086.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.473] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.473] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.474] GetLastError () returned 0x0 [0086.474] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3928, lpOverlapped=0x0) returned 1 [0086.505] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3930, lpOverlapped=0x0) returned 1 [0086.840] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.841] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.841] SetEndOfFile (hFile=0x158) returned 1 [0086.841] CloseHandle (hObject=0x158) returned 1 [0086.841] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.842] SetEndOfFile (hFile=0x1fc) returned 1 [0086.843] CloseHandle (hObject=0x1fc) returned 1 [0086.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0086.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.844] lstrlenW (lpString=".doc") returned 4 [0086.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString=".docx") returned 5 [0086.844] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0086.844] lstrlenW (lpString=".pdf") returned 4 [0086.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString=".xls") returned 4 [0086.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.844] lstrlenW (lpString=".xlsx") returned 5 [0086.844] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0086.844] lstrlenW (lpString=".ppt") returned 4 [0086.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.844] lstrlenW (lpString=".zip") returned 4 [0086.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.844] lstrlenW (lpString=".rar") returned 4 [0086.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString=".bz2") returned 4 [0086.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString=".7z") returned 3 [0086.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.844] lstrlenW (lpString=".dbf") returned 4 [0086.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.844] lstrlenW (lpString=".1cd") returned 4 [0086.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.845] lstrlenW (lpString=".jpg") returned 4 [0086.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.845] @NlsCompareInvariantNoCase@16 () [0086.845] lstrlenW (lpString=".docx") returned 5 [0086.845] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0086.845] lstrlenW (lpString=".pdf") returned 4 [0086.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString=".xls") returned 4 [0086.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.845] lstrlenW (lpString=".xlsx") returned 5 [0086.845] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0086.845] lstrlenW (lpString=".ppt") returned 4 [0086.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.845] lstrlenW (lpString=".zip") returned 4 [0086.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.845] lstrlenW (lpString=".rar") returned 4 [0086.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString=".bz2") returned 4 [0086.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString=".7z") returned 3 [0086.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.845] lstrlenW (lpString=".dbf") returned 4 [0086.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.845] lstrlenW (lpString=".1cd") returned 4 [0086.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0086.845] lstrlenW (lpString=".jpg") returned 4 [0086.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.846] @NlsCompareInvariantNoCase@16 () [0086.846] lstrlenW (lpString="J0151067.WMF") returned 12 [0086.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.847] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13204) returned 1 [0086.847] CloseHandle (hObject=0x1fc) returned 1 [0086.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0086.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.847] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.848] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.848] GetLastError () returned 0x0 [0086.848] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3394, lpOverlapped=0x0) returned 1 [0086.853] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0086.854] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.854] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.854] SetEndOfFile (hFile=0x158) returned 1 [0086.854] CloseHandle (hObject=0x158) returned 1 [0086.854] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.854] SetEndOfFile (hFile=0x1fc) returned 1 [0086.855] CloseHandle (hObject=0x1fc) returned 1 [0086.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0086.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.856] lstrlenW (lpString=".doc") returned 4 [0086.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.856] lstrlenW (lpString=".docx") returned 5 [0086.856] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0086.856] lstrlenW (lpString=".pdf") returned 4 [0086.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.856] lstrlenW (lpString=".xls") returned 4 [0086.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.856] lstrlenW (lpString=".xlsx") returned 5 [0086.856] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0086.856] lstrlenW (lpString=".ppt") returned 4 [0086.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.856] lstrlenW (lpString=".zip") returned 4 [0086.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.856] lstrlenW (lpString=".rar") returned 4 [0086.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.856] lstrlenW (lpString=".bz2") returned 4 [0086.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.856] lstrlenW (lpString=".7z") returned 3 [0086.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.856] lstrlenW (lpString=".dbf") returned 4 [0086.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.857] lstrlenW (lpString=".1cd") returned 4 [0086.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.857] lstrlenW (lpString=".jpg") returned 4 [0086.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.857] @NlsCompareInvariantNoCase@16 () [0086.857] lstrlenW (lpString=".docx") returned 5 [0086.857] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0086.857] lstrlenW (lpString=".pdf") returned 4 [0086.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString=".xls") returned 4 [0086.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.857] lstrlenW (lpString=".xlsx") returned 5 [0086.857] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0086.857] lstrlenW (lpString=".ppt") returned 4 [0086.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.857] lstrlenW (lpString=".zip") returned 4 [0086.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.857] lstrlenW (lpString=".rar") returned 4 [0086.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString=".bz2") returned 4 [0086.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString=".7z") returned 3 [0086.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.857] lstrlenW (lpString=".dbf") returned 4 [0086.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.857] lstrlenW (lpString=".1cd") returned 4 [0086.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0086.858] lstrlenW (lpString=".jpg") returned 4 [0086.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.858] @NlsCompareInvariantNoCase@16 () [0086.858] lstrlenW (lpString="J0151073.WMF") returned 12 [0086.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.858] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13336) returned 1 [0086.859] CloseHandle (hObject=0x1fc) returned 1 [0086.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0086.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.859] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.859] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.860] GetLastError () returned 0x0 [0086.860] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3418, lpOverlapped=0x0) returned 1 [0086.871] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3420, lpOverlapped=0x0) returned 1 [0086.872] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.872] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.872] SetEndOfFile (hFile=0x158) returned 1 [0087.091] CloseHandle (hObject=0x158) returned 1 [0087.091] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.091] SetEndOfFile (hFile=0x1fc) returned 1 [0087.092] CloseHandle (hObject=0x1fc) returned 1 [0087.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0087.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.092] lstrlenW (lpString=".doc") returned 4 [0087.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.092] lstrlenW (lpString=".docx") returned 5 [0087.092] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0087.093] lstrlenW (lpString=".pdf") returned 4 [0087.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString=".xls") returned 4 [0087.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.093] lstrlenW (lpString=".xlsx") returned 5 [0087.093] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0087.093] lstrlenW (lpString=".ppt") returned 4 [0087.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.093] lstrlenW (lpString=".zip") returned 4 [0087.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.093] lstrlenW (lpString=".rar") returned 4 [0087.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString=".bz2") returned 4 [0087.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString=".7z") returned 3 [0087.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.093] lstrlenW (lpString=".dbf") returned 4 [0087.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.093] lstrlenW (lpString=".1cd") returned 4 [0087.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0087.093] lstrlenW (lpString=".jpg") returned 4 [0087.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.093] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") [0087.094] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5960) returned 1 [0087.094] CloseHandle (hObject=0x1fc) returned 1 [0087.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0087.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.094] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.094] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.095] GetLastError () returned 0x0 [0087.095] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1748, lpOverlapped=0x0) returned 1 [0087.096] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1750, lpOverlapped=0x0) returned 1 [0087.097] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.097] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.098] SetEndOfFile (hFile=0x158) returned 1 [0087.098] CloseHandle (hObject=0x158) returned 1 [0087.098] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.098] SetEndOfFile (hFile=0x1fc) returned 1 [0087.099] CloseHandle (hObject=0x1fc) returned 1 [0087.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0087.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.099] lstrlenW (lpString=".doc") returned 4 [0087.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.099] lstrlenW (lpString=".docx") returned 5 [0087.099] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0087.099] lstrlenW (lpString=".pdf") returned 4 [0087.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.099] lstrlenW (lpString=".xls") returned 4 [0087.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.099] lstrlenW (lpString=".xlsx") returned 5 [0087.099] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0087.099] lstrlenW (lpString=".ppt") returned 4 [0087.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.099] lstrlenW (lpString=".zip") returned 4 [0087.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.100] lstrlenW (lpString=".rar") returned 4 [0087.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.100] lstrlenW (lpString=".bz2") returned 4 [0087.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.100] lstrlenW (lpString=".7z") returned 3 [0087.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.100] lstrlenW (lpString=".dbf") returned 4 [0087.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.100] lstrlenW (lpString=".1cd") returned 4 [0087.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0087.100] lstrlenW (lpString=".jpg") returned 4 [0087.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.100] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") [0087.101] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9604) returned 1 [0087.101] CloseHandle (hObject=0x1fc) returned 1 [0087.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0087.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.102] GetLastError () returned 0x0 [0087.102] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2584, lpOverlapped=0x0) returned 1 [0087.104] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2590, lpOverlapped=0x0) returned 1 [0087.105] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.105] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.105] SetEndOfFile (hFile=0x158) returned 1 [0087.105] CloseHandle (hObject=0x158) returned 1 [0087.105] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.105] SetEndOfFile (hFile=0x1fc) returned 1 [0087.106] CloseHandle (hObject=0x1fc) returned 1 [0087.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString=".doc") returned 4 [0087.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString=".docx") returned 5 [0087.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.107] lstrlenW (lpString=".pdf") returned 4 [0087.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString=".xls") returned 4 [0087.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.107] lstrlenW (lpString=".xlsx") returned 5 [0087.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.107] lstrlenW (lpString=".ppt") returned 4 [0087.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString=".zip") returned 4 [0087.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.107] lstrlenW (lpString=".rar") returned 4 [0087.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString=".bz2") returned 4 [0087.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString=".7z") returned 3 [0087.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString=".dbf") returned 4 [0087.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString=".1cd") returned 4 [0087.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0087.107] lstrlenW (lpString=".jpg") returned 4 [0087.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.108] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") [0087.108] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26248) returned 1 [0087.108] CloseHandle (hObject=0x1fc) returned 1 [0087.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0087.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.108] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.108] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.109] GetLastError () returned 0x0 [0087.109] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6688, lpOverlapped=0x0) returned 1 [0087.299] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6690, lpOverlapped=0x0) returned 1 [0087.300] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.300] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.300] SetEndOfFile (hFile=0x158) returned 1 [0087.300] CloseHandle (hObject=0x158) returned 1 [0087.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.301] SetEndOfFile (hFile=0x1fc) returned 1 [0087.301] CloseHandle (hObject=0x1fc) returned 1 [0087.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0087.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.302] lstrlenW (lpString=".doc") returned 4 [0087.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.302] lstrlenW (lpString=".docx") returned 5 [0087.302] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.302] lstrlenW (lpString=".pdf") returned 4 [0087.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.302] lstrlenW (lpString=".xls") returned 4 [0087.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.302] lstrlenW (lpString=".xlsx") returned 5 [0087.302] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.302] lstrlenW (lpString=".ppt") returned 4 [0087.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.302] lstrlenW (lpString=".zip") returned 4 [0087.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.302] lstrlenW (lpString=".rar") returned 4 [0087.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.302] lstrlenW (lpString=".bz2") returned 4 [0087.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.302] lstrlenW (lpString=".7z") returned 3 [0087.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.303] lstrlenW (lpString=".dbf") returned 4 [0087.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.303] lstrlenW (lpString=".1cd") returned 4 [0087.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0087.303] lstrlenW (lpString=".jpg") returned 4 [0087.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.303] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") [0087.303] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6956) returned 1 [0087.303] CloseHandle (hObject=0x1fc) returned 1 [0087.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0087.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.304] GetLastError () returned 0x0 [0087.304] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0087.308] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0087.309] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.309] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.309] SetEndOfFile (hFile=0x158) returned 1 [0087.309] CloseHandle (hObject=0x158) returned 1 [0087.309] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.309] SetEndOfFile (hFile=0x1fc) returned 1 [0087.310] CloseHandle (hObject=0x1fc) returned 1 [0087.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0087.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.310] lstrlenW (lpString=".doc") returned 4 [0087.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString=".docx") returned 5 [0087.311] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0087.311] lstrlenW (lpString=".pdf") returned 4 [0087.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString=".xls") returned 4 [0087.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.311] lstrlenW (lpString=".xlsx") returned 5 [0087.311] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0087.311] lstrlenW (lpString=".ppt") returned 4 [0087.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.311] lstrlenW (lpString=".zip") returned 4 [0087.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.311] lstrlenW (lpString=".rar") returned 4 [0087.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString=".bz2") returned 4 [0087.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString=".7z") returned 3 [0087.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.311] lstrlenW (lpString=".dbf") returned 4 [0087.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.311] lstrlenW (lpString=".1cd") returned 4 [0087.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0087.311] lstrlenW (lpString=".jpg") returned 4 [0087.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.311] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") [0087.312] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1940) returned 1 [0087.312] CloseHandle (hObject=0x1fc) returned 1 [0087.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0087.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.313] GetLastError () returned 0x0 [0087.313] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x794, lpOverlapped=0x0) returned 1 [0087.315] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0087.316] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.316] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.316] SetEndOfFile (hFile=0x158) returned 1 [0087.316] CloseHandle (hObject=0x158) returned 1 [0087.316] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.316] SetEndOfFile (hFile=0x1fc) returned 1 [0087.317] CloseHandle (hObject=0x1fc) returned 1 [0087.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0087.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.318] lstrlenW (lpString=".doc") returned 4 [0087.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.318] lstrlenW (lpString=".docx") returned 5 [0087.318] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0087.318] lstrlenW (lpString=".pdf") returned 4 [0087.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.318] lstrlenW (lpString=".xls") returned 4 [0087.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.318] lstrlenW (lpString=".xlsx") returned 5 [0087.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0087.318] lstrlenW (lpString=".ppt") returned 4 [0087.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.318] lstrlenW (lpString=".zip") returned 4 [0087.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.318] lstrlenW (lpString=".rar") returned 4 [0087.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.318] lstrlenW (lpString=".bz2") returned 4 [0087.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.318] lstrlenW (lpString=".7z") returned 3 [0087.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.318] lstrlenW (lpString=".dbf") returned 4 [0087.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.319] lstrlenW (lpString=".1cd") returned 4 [0087.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0087.319] lstrlenW (lpString=".jpg") returned 4 [0087.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.319] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") [0087.319] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10668) returned 1 [0087.319] CloseHandle (hObject=0x1fc) returned 1 [0087.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0087.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.320] GetLastError () returned 0x0 [0087.320] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x29ac, lpOverlapped=0x0) returned 1 [0087.322] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x29b0, lpOverlapped=0x0) returned 1 [0087.323] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.323] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.323] SetEndOfFile (hFile=0x158) returned 1 [0087.323] CloseHandle (hObject=0x158) returned 1 [0087.323] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.323] SetEndOfFile (hFile=0x1fc) returned 1 [0087.324] CloseHandle (hObject=0x1fc) returned 1 [0087.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0087.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.325] lstrlenW (lpString=".doc") returned 4 [0087.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString=".docx") returned 5 [0087.325] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.325] lstrlenW (lpString=".pdf") returned 4 [0087.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString=".xls") returned 4 [0087.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.325] lstrlenW (lpString=".xlsx") returned 5 [0087.325] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.325] lstrlenW (lpString=".ppt") returned 4 [0087.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.325] lstrlenW (lpString=".zip") returned 4 [0087.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.325] lstrlenW (lpString=".rar") returned 4 [0087.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString=".bz2") returned 4 [0087.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString=".7z") returned 3 [0087.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.325] lstrlenW (lpString=".dbf") returned 4 [0087.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.325] lstrlenW (lpString=".1cd") returned 4 [0087.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0087.326] lstrlenW (lpString=".jpg") returned 4 [0087.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.326] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") [0087.326] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11348) returned 1 [0087.326] CloseHandle (hObject=0x1fc) returned 1 [0087.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0087.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.327] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.327] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.327] GetLastError () returned 0x0 [0087.327] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2c54, lpOverlapped=0x0) returned 1 [0087.329] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2c60, lpOverlapped=0x0) returned 1 [0087.330] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.330] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.330] SetEndOfFile (hFile=0x158) returned 1 [0087.330] CloseHandle (hObject=0x158) returned 1 [0087.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.330] SetEndOfFile (hFile=0x1fc) returned 1 [0087.331] CloseHandle (hObject=0x1fc) returned 1 [0087.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString=".doc") returned 4 [0087.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString=".docx") returned 5 [0087.332] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0087.332] lstrlenW (lpString=".pdf") returned 4 [0087.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString=".xls") returned 4 [0087.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.332] lstrlenW (lpString=".xlsx") returned 5 [0087.332] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0087.332] lstrlenW (lpString=".ppt") returned 4 [0087.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString=".zip") returned 4 [0087.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.332] lstrlenW (lpString=".rar") returned 4 [0087.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString=".bz2") returned 4 [0087.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString=".7z") returned 3 [0087.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString=".dbf") returned 4 [0087.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString=".1cd") returned 4 [0087.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0087.332] lstrlenW (lpString=".jpg") returned 4 [0087.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.333] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") [0087.333] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4496) returned 1 [0087.333] CloseHandle (hObject=0x1fc) returned 1 [0087.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0087.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0087.333] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.333] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0087.334] GetLastError () returned 0x0 [0087.334] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1190, lpOverlapped=0x0) returned 1 [0087.377] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x11a0, lpOverlapped=0x0) returned 1 [0087.378] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0087.378] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.378] SetEndOfFile (hFile=0x158) returned 1 [0087.456] CloseHandle (hObject=0x158) returned 1 [0087.456] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.456] SetEndOfFile (hFile=0x1fc) returned 1 [0087.457] CloseHandle (hObject=0x1fc) returned 1 [0087.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0087.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.630] lstrlenW (lpString=".doc") returned 4 [0087.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.630] lstrlenW (lpString=".docx") returned 5 [0087.630] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.630] lstrlenW (lpString=".pdf") returned 4 [0087.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString=".xls") returned 4 [0087.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.631] lstrlenW (lpString=".xlsx") returned 5 [0087.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.631] lstrlenW (lpString=".ppt") returned 4 [0087.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.631] lstrlenW (lpString=".zip") returned 4 [0087.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.631] lstrlenW (lpString=".rar") returned 4 [0087.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString=".bz2") returned 4 [0087.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString=".7z") returned 3 [0087.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.631] lstrlenW (lpString=".dbf") returned 4 [0087.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.631] lstrlenW (lpString=".1cd") returned 4 [0087.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0087.631] lstrlenW (lpString=".jpg") returned 4 [0087.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.632] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") [0088.353] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8136) returned 1 [0088.354] CloseHandle (hObject=0x158) returned 1 [0088.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0088.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.354] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.354] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.355] GetLastError () returned 0x0 [0088.355] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0088.357] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0088.358] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.358] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.358] SetEndOfFile (hFile=0x190) returned 1 [0088.358] CloseHandle (hObject=0x190) returned 1 [0088.358] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.358] SetEndOfFile (hFile=0x158) returned 1 [0088.359] CloseHandle (hObject=0x158) returned 1 [0088.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.359] lstrlenW (lpString=".doc") returned 4 [0088.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString=".docx") returned 5 [0088.359] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0088.359] lstrlenW (lpString=".pdf") returned 4 [0088.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString=".xls") returned 4 [0088.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.360] lstrlenW (lpString=".xlsx") returned 5 [0088.360] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0088.360] lstrlenW (lpString=".ppt") returned 4 [0088.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.360] lstrlenW (lpString=".zip") returned 4 [0088.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.360] lstrlenW (lpString=".rar") returned 4 [0088.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString=".bz2") returned 4 [0088.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString=".7z") returned 3 [0088.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.360] lstrlenW (lpString=".dbf") returned 4 [0088.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.360] lstrlenW (lpString=".1cd") returned 4 [0088.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0088.360] lstrlenW (lpString=".jpg") returned 4 [0088.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.360] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") [0088.361] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8880) returned 1 [0088.361] CloseHandle (hObject=0x158) returned 1 [0088.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0088.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.362] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.362] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.362] GetLastError () returned 0x0 [0088.362] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x22b0, lpOverlapped=0x0) returned 1 [0088.364] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x22c0, lpOverlapped=0x0) returned 1 [0088.365] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.365] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.365] SetEndOfFile (hFile=0x190) returned 1 [0088.367] CloseHandle (hObject=0x190) returned 1 [0088.368] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.368] SetEndOfFile (hFile=0x158) returned 1 [0088.368] CloseHandle (hObject=0x158) returned 1 [0088.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0088.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.369] lstrlenW (lpString=".doc") returned 4 [0088.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.369] lstrlenW (lpString=".docx") returned 5 [0088.369] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0088.369] lstrlenW (lpString=".pdf") returned 4 [0088.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.369] lstrlenW (lpString=".xls") returned 4 [0088.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.369] lstrlenW (lpString=".xlsx") returned 5 [0088.369] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0088.369] lstrlenW (lpString=".ppt") returned 4 [0088.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.369] lstrlenW (lpString=".zip") returned 4 [0088.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.369] lstrlenW (lpString=".rar") returned 4 [0088.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.369] lstrlenW (lpString=".bz2") returned 4 [0088.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.370] lstrlenW (lpString=".7z") returned 3 [0088.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.370] lstrlenW (lpString=".dbf") returned 4 [0088.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.370] lstrlenW (lpString=".1cd") returned 4 [0088.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0088.370] lstrlenW (lpString=".jpg") returned 4 [0088.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.370] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") [0088.370] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3704) returned 1 [0088.370] CloseHandle (hObject=0x158) returned 1 [0088.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0088.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.371] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.371] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.371] GetLastError () returned 0x0 [0088.371] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe78, lpOverlapped=0x0) returned 1 [0088.373] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe80, lpOverlapped=0x0) returned 1 [0088.373] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.374] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.374] SetEndOfFile (hFile=0x190) returned 1 [0088.374] CloseHandle (hObject=0x190) returned 1 [0088.374] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.374] SetEndOfFile (hFile=0x158) returned 1 [0088.375] CloseHandle (hObject=0x158) returned 1 [0088.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.375] lstrlenW (lpString=".doc") returned 4 [0088.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString=".docx") returned 5 [0088.375] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0088.375] lstrlenW (lpString=".pdf") returned 4 [0088.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString=".xls") returned 4 [0088.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.375] lstrlenW (lpString=".xlsx") returned 5 [0088.375] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0088.375] lstrlenW (lpString=".ppt") returned 4 [0088.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.375] lstrlenW (lpString=".zip") returned 4 [0088.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.375] lstrlenW (lpString=".rar") returned 4 [0088.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.376] lstrlenW (lpString=".bz2") returned 4 [0088.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.376] lstrlenW (lpString=".7z") returned 3 [0088.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.376] lstrlenW (lpString=".dbf") returned 4 [0088.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.376] lstrlenW (lpString=".1cd") returned 4 [0088.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0088.376] lstrlenW (lpString=".jpg") returned 4 [0088.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.376] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") [0088.376] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3008) returned 1 [0088.376] CloseHandle (hObject=0x158) returned 1 [0088.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0088.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.377] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.377] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.377] GetLastError () returned 0x0 [0088.377] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbc0, lpOverlapped=0x0) returned 1 [0088.379] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0088.380] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.380] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.380] SetEndOfFile (hFile=0x190) returned 1 [0088.380] CloseHandle (hObject=0x190) returned 1 [0088.380] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.380] SetEndOfFile (hFile=0x158) returned 1 [0088.381] CloseHandle (hObject=0x158) returned 1 [0088.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.381] lstrlenW (lpString=".doc") returned 4 [0088.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".docx") returned 5 [0088.382] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0088.382] lstrlenW (lpString=".pdf") returned 4 [0088.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".xls") returned 4 [0088.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.382] lstrlenW (lpString=".xlsx") returned 5 [0088.382] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0088.382] lstrlenW (lpString=".ppt") returned 4 [0088.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.382] lstrlenW (lpString=".zip") returned 4 [0088.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.382] lstrlenW (lpString=".rar") returned 4 [0088.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".bz2") returned 4 [0088.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".7z") returned 3 [0088.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.382] lstrlenW (lpString=".dbf") returned 4 [0088.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.382] lstrlenW (lpString=".1cd") returned 4 [0088.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0088.382] lstrlenW (lpString=".jpg") returned 4 [0088.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.382] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") [0088.383] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20096) returned 1 [0088.383] CloseHandle (hObject=0x158) returned 1 [0088.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0088.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.384] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.384] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.384] GetLastError () returned 0x0 [0088.384] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4e80, lpOverlapped=0x0) returned 1 [0088.386] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0088.387] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.387] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.387] SetEndOfFile (hFile=0x190) returned 1 [0088.388] CloseHandle (hObject=0x190) returned 1 [0088.388] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.388] SetEndOfFile (hFile=0x158) returned 1 [0088.388] CloseHandle (hObject=0x158) returned 1 [0088.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0088.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.389] lstrlenW (lpString=".doc") returned 4 [0088.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.389] lstrlenW (lpString=".docx") returned 5 [0088.389] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0088.389] lstrlenW (lpString=".pdf") returned 4 [0088.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.389] lstrlenW (lpString=".xls") returned 4 [0088.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.389] lstrlenW (lpString=".xlsx") returned 5 [0088.389] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0088.389] lstrlenW (lpString=".ppt") returned 4 [0088.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.389] lstrlenW (lpString=".zip") returned 4 [0088.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.389] lstrlenW (lpString=".rar") returned 4 [0088.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.389] lstrlenW (lpString=".bz2") returned 4 [0088.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.389] lstrlenW (lpString=".7z") returned 3 [0088.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.390] lstrlenW (lpString=".dbf") returned 4 [0088.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.390] lstrlenW (lpString=".1cd") returned 4 [0088.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0088.390] lstrlenW (lpString=".jpg") returned 4 [0088.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.390] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") [0088.390] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=36620) returned 1 [0088.390] CloseHandle (hObject=0x158) returned 1 [0088.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0088.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0088.391] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.391] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.391] GetLastError () returned 0x0 [0088.391] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0088.453] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0088.454] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.454] WriteFile (in: hFile=0x190, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.455] SetEndOfFile (hFile=0x190) returned 1 [0088.574] CloseHandle (hObject=0x190) returned 1 [0088.574] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.574] SetEndOfFile (hFile=0x158) returned 1 [0088.575] CloseHandle (hObject=0x158) returned 1 [0088.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0089.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.093] lstrlenW (lpString=".doc") returned 4 [0089.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.093] lstrlenW (lpString=".docx") returned 5 [0089.093] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0089.093] lstrlenW (lpString=".pdf") returned 4 [0089.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.093] lstrlenW (lpString=".xls") returned 4 [0089.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.093] lstrlenW (lpString=".xlsx") returned 5 [0089.093] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0089.093] lstrlenW (lpString=".ppt") returned 4 [0089.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.094] lstrlenW (lpString=".zip") returned 4 [0089.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.094] lstrlenW (lpString=".rar") returned 4 [0089.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.094] lstrlenW (lpString=".bz2") returned 4 [0089.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.094] lstrlenW (lpString=".7z") returned 3 [0089.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.094] lstrlenW (lpString=".dbf") returned 4 [0089.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.094] lstrlenW (lpString=".1cd") returned 4 [0089.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0089.094] lstrlenW (lpString=".jpg") returned 4 [0089.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.094] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") [0089.901] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12752) returned 1 [0089.901] CloseHandle (hObject=0x190) returned 1 [0089.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0089.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.902] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.902] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.902] GetLastError () returned 0x0 [0089.902] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x31d0, lpOverlapped=0x0) returned 1 [0089.905] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0089.906] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.906] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.906] SetEndOfFile (hFile=0x16c) returned 1 [0089.906] CloseHandle (hObject=0x16c) returned 1 [0089.906] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.906] SetEndOfFile (hFile=0x190) returned 1 [0089.907] CloseHandle (hObject=0x190) returned 1 [0089.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0089.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.907] lstrlenW (lpString=".doc") returned 4 [0089.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.907] lstrlenW (lpString=".docx") returned 5 [0089.907] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0089.907] lstrlenW (lpString=".pdf") returned 4 [0089.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.907] lstrlenW (lpString=".xls") returned 4 [0089.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.907] lstrlenW (lpString=".xlsx") returned 5 [0089.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0089.908] lstrlenW (lpString=".ppt") returned 4 [0089.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.908] lstrlenW (lpString=".zip") returned 4 [0089.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.908] lstrlenW (lpString=".rar") returned 4 [0089.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.908] lstrlenW (lpString=".bz2") returned 4 [0089.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.908] lstrlenW (lpString=".7z") returned 3 [0089.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.908] lstrlenW (lpString=".dbf") returned 4 [0089.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.908] lstrlenW (lpString=".1cd") returned 4 [0089.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0089.908] lstrlenW (lpString=".jpg") returned 4 [0089.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.908] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") [0089.909] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20906) returned 1 [0089.909] CloseHandle (hObject=0x190) returned 1 [0089.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0089.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.909] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.909] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.910] GetLastError () returned 0x0 [0089.910] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x51aa, lpOverlapped=0x0) returned 1 [0089.912] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0089.913] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.913] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.913] SetEndOfFile (hFile=0x16c) returned 1 [0089.913] CloseHandle (hObject=0x16c) returned 1 [0089.913] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.913] SetEndOfFile (hFile=0x190) returned 1 [0089.914] CloseHandle (hObject=0x190) returned 1 [0089.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0089.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.915] lstrlenW (lpString=".doc") returned 4 [0089.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString=".docx") returned 5 [0089.915] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0089.915] lstrlenW (lpString=".pdf") returned 4 [0089.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString=".xls") returned 4 [0089.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.915] lstrlenW (lpString=".xlsx") returned 5 [0089.915] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0089.915] lstrlenW (lpString=".ppt") returned 4 [0089.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.915] lstrlenW (lpString=".zip") returned 4 [0089.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.915] lstrlenW (lpString=".rar") returned 4 [0089.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString=".bz2") returned 4 [0089.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString=".7z") returned 3 [0089.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.915] lstrlenW (lpString=".dbf") returned 4 [0089.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.915] lstrlenW (lpString=".1cd") returned 4 [0089.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0089.916] lstrlenW (lpString=".jpg") returned 4 [0089.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.916] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") [0089.916] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14472) returned 1 [0089.916] CloseHandle (hObject=0x190) returned 1 [0089.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0089.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.916] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.916] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.917] GetLastError () returned 0x0 [0089.917] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3888, lpOverlapped=0x0) returned 1 [0089.919] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3890, lpOverlapped=0x0) returned 1 [0089.920] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.920] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.920] SetEndOfFile (hFile=0x16c) returned 1 [0089.920] CloseHandle (hObject=0x16c) returned 1 [0089.920] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.920] SetEndOfFile (hFile=0x190) returned 1 [0089.921] CloseHandle (hObject=0x190) returned 1 [0089.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0089.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.921] lstrlenW (lpString=".doc") returned 4 [0089.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString=".docx") returned 5 [0089.922] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0089.922] lstrlenW (lpString=".pdf") returned 4 [0089.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString=".xls") returned 4 [0089.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.922] lstrlenW (lpString=".xlsx") returned 5 [0089.922] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0089.922] lstrlenW (lpString=".ppt") returned 4 [0089.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.922] lstrlenW (lpString=".zip") returned 4 [0089.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.922] lstrlenW (lpString=".rar") returned 4 [0089.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString=".bz2") returned 4 [0089.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString=".7z") returned 3 [0089.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.922] lstrlenW (lpString=".dbf") returned 4 [0089.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.922] lstrlenW (lpString=".1cd") returned 4 [0089.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0089.922] lstrlenW (lpString=".jpg") returned 4 [0089.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.922] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") [0089.923] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6888) returned 1 [0089.923] CloseHandle (hObject=0x190) returned 1 [0089.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0089.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.923] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.923] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.924] GetLastError () returned 0x0 [0089.924] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0089.926] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0089.926] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.926] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.927] SetEndOfFile (hFile=0x16c) returned 1 [0089.927] CloseHandle (hObject=0x16c) returned 1 [0089.927] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.927] SetEndOfFile (hFile=0x190) returned 1 [0089.928] CloseHandle (hObject=0x190) returned 1 [0089.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0089.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.928] lstrlenW (lpString=".doc") returned 4 [0089.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.928] lstrlenW (lpString=".docx") returned 5 [0089.928] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.928] lstrlenW (lpString=".pdf") returned 4 [0089.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.928] lstrlenW (lpString=".xls") returned 4 [0089.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.928] lstrlenW (lpString=".xlsx") returned 5 [0089.928] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.928] lstrlenW (lpString=".ppt") returned 4 [0089.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.928] lstrlenW (lpString=".zip") returned 4 [0089.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.928] lstrlenW (lpString=".rar") returned 4 [0089.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.929] lstrlenW (lpString=".bz2") returned 4 [0089.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.929] lstrlenW (lpString=".7z") returned 3 [0089.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.929] lstrlenW (lpString=".dbf") returned 4 [0089.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.929] lstrlenW (lpString=".1cd") returned 4 [0089.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0089.929] lstrlenW (lpString=".jpg") returned 4 [0089.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.929] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") [0089.929] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7448) returned 1 [0089.929] CloseHandle (hObject=0x190) returned 1 [0089.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0089.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.930] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.930] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0089.930] GetLastError () returned 0x0 [0089.930] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1d18, lpOverlapped=0x0) returned 1 [0089.932] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0089.933] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.933] WriteFile (in: hFile=0x16c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.933] SetEndOfFile (hFile=0x16c) returned 1 [0089.933] CloseHandle (hObject=0x16c) returned 1 [0089.933] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.933] SetEndOfFile (hFile=0x190) returned 1 [0089.934] CloseHandle (hObject=0x190) returned 1 [0089.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0089.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.934] lstrlenW (lpString=".doc") returned 4 [0089.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString=".docx") returned 5 [0089.935] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0089.935] lstrlenW (lpString=".pdf") returned 4 [0089.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString=".xls") returned 4 [0089.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.935] lstrlenW (lpString=".xlsx") returned 5 [0089.935] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0089.935] lstrlenW (lpString=".ppt") returned 4 [0089.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.935] lstrlenW (lpString=".zip") returned 4 [0089.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.935] lstrlenW (lpString=".rar") returned 4 [0089.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString=".bz2") returned 4 [0089.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString=".7z") returned 3 [0089.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.935] lstrlenW (lpString=".dbf") returned 4 [0089.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.935] lstrlenW (lpString=".1cd") returned 4 [0089.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0089.935] lstrlenW (lpString=".jpg") returned 4 [0089.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.935] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") [0090.120] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7028) returned 1 [0090.120] CloseHandle (hObject=0x22c) returned 1 [0090.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0090.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.120] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.120] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.129] GetLastError () returned 0x0 [0090.146] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b74, lpOverlapped=0x0) returned 1 [0090.155] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0090.156] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.156] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.156] SetEndOfFile (hFile=0x150) returned 1 [0090.156] CloseHandle (hObject=0x150) returned 1 [0090.157] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.157] SetEndOfFile (hFile=0x22c) returned 1 [0090.157] CloseHandle (hObject=0x22c) returned 1 [0090.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0090.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.158] lstrlenW (lpString=".doc") returned 4 [0090.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.158] lstrlenW (lpString=".docx") returned 5 [0090.158] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.158] lstrlenW (lpString=".pdf") returned 4 [0090.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.158] lstrlenW (lpString=".xls") returned 4 [0090.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.158] lstrlenW (lpString=".xlsx") returned 5 [0090.158] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.158] lstrlenW (lpString=".ppt") returned 4 [0090.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.158] lstrlenW (lpString=".zip") returned 4 [0090.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.158] lstrlenW (lpString=".rar") returned 4 [0090.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.158] lstrlenW (lpString=".bz2") returned 4 [0090.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.158] lstrlenW (lpString=".7z") returned 3 [0090.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.159] lstrlenW (lpString=".dbf") returned 4 [0090.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.159] lstrlenW (lpString=".1cd") returned 4 [0090.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0090.159] lstrlenW (lpString=".jpg") returned 4 [0090.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.159] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") [0090.159] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26531) returned 1 [0090.159] CloseHandle (hObject=0x22c) returned 1 [0090.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0090.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.160] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.160] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.160] GetLastError () returned 0x0 [0090.160] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x67a3, lpOverlapped=0x0) returned 1 [0090.163] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x67b0, lpOverlapped=0x0) returned 1 [0090.164] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.164] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.164] SetEndOfFile (hFile=0x150) returned 1 [0090.164] CloseHandle (hObject=0x150) returned 1 [0090.164] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.164] SetEndOfFile (hFile=0x22c) returned 1 [0090.165] CloseHandle (hObject=0x22c) returned 1 [0090.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0090.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.166] lstrlenW (lpString=".doc") returned 4 [0090.166] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.166] lstrlenW (lpString=".docx") returned 5 [0090.166] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0090.166] lstrlenW (lpString=".pdf") returned 4 [0090.166] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.166] lstrlenW (lpString=".xls") returned 4 [0090.166] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.166] lstrlenW (lpString=".xlsx") returned 5 [0090.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0090.166] lstrlenW (lpString=".ppt") returned 4 [0090.166] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.166] lstrlenW (lpString=".zip") returned 4 [0090.166] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.166] lstrlenW (lpString=".rar") returned 4 [0090.166] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.166] lstrlenW (lpString=".bz2") returned 4 [0090.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.166] lstrlenW (lpString=".7z") returned 3 [0090.166] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.166] lstrlenW (lpString=".dbf") returned 4 [0090.166] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.166] lstrlenW (lpString=".1cd") returned 4 [0090.167] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0090.167] lstrlenW (lpString=".jpg") returned 4 [0090.167] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.167] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") [0090.167] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24034) returned 1 [0090.167] CloseHandle (hObject=0x22c) returned 1 [0090.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0090.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.167] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.168] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.168] GetLastError () returned 0x0 [0090.168] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5de2, lpOverlapped=0x0) returned 1 [0090.170] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5df0, lpOverlapped=0x0) returned 1 [0090.171] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.171] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.172] SetEndOfFile (hFile=0x150) returned 1 [0090.172] CloseHandle (hObject=0x150) returned 1 [0090.172] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.172] SetEndOfFile (hFile=0x22c) returned 1 [0090.173] CloseHandle (hObject=0x22c) returned 1 [0090.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0090.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.173] lstrlenW (lpString=".doc") returned 4 [0090.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.173] lstrlenW (lpString=".docx") returned 5 [0090.173] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0090.173] lstrlenW (lpString=".pdf") returned 4 [0090.173] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.173] lstrlenW (lpString=".xls") returned 4 [0090.173] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.173] lstrlenW (lpString=".xlsx") returned 5 [0090.173] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0090.174] lstrlenW (lpString=".ppt") returned 4 [0090.174] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.174] lstrlenW (lpString=".zip") returned 4 [0090.174] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.174] lstrlenW (lpString=".rar") returned 4 [0090.174] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.174] lstrlenW (lpString=".bz2") returned 4 [0090.174] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.174] lstrlenW (lpString=".7z") returned 3 [0090.174] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.174] lstrlenW (lpString=".dbf") returned 4 [0090.174] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.174] lstrlenW (lpString=".1cd") returned 4 [0090.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0090.174] lstrlenW (lpString=".jpg") returned 4 [0090.174] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.174] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") [0090.175] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23338) returned 1 [0090.175] CloseHandle (hObject=0x22c) returned 1 [0090.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0090.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.175] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.175] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.176] GetLastError () returned 0x0 [0090.176] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5b2a, lpOverlapped=0x0) returned 1 [0090.178] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5b30, lpOverlapped=0x0) returned 1 [0090.179] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.179] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.179] SetEndOfFile (hFile=0x150) returned 1 [0090.179] CloseHandle (hObject=0x150) returned 1 [0090.179] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.179] SetEndOfFile (hFile=0x22c) returned 1 [0090.180] CloseHandle (hObject=0x22c) returned 1 [0090.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0090.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString=".doc") returned 4 [0090.181] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.181] lstrlenW (lpString=".docx") returned 5 [0090.181] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0090.181] lstrlenW (lpString=".pdf") returned 4 [0090.181] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.181] lstrlenW (lpString=".xls") returned 4 [0090.181] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.181] lstrlenW (lpString=".xlsx") returned 5 [0090.181] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0090.181] lstrlenW (lpString=".ppt") returned 4 [0090.181] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString=".zip") returned 4 [0090.181] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.181] lstrlenW (lpString=".rar") returned 4 [0090.181] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.181] lstrlenW (lpString=".bz2") returned 4 [0090.181] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.181] lstrlenW (lpString=".7z") returned 3 [0090.181] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString=".dbf") returned 4 [0090.181] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString=".1cd") returned 4 [0090.181] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0090.181] lstrlenW (lpString=".jpg") returned 4 [0090.181] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.182] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") [0090.182] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32038) returned 1 [0090.182] CloseHandle (hObject=0x22c) returned 1 [0090.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0090.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.182] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.182] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.183] GetLastError () returned 0x0 [0090.183] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7d26, lpOverlapped=0x0) returned 1 [0090.185] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7d30, lpOverlapped=0x0) returned 1 [0090.186] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.186] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.187] SetEndOfFile (hFile=0x150) returned 1 [0090.187] CloseHandle (hObject=0x150) returned 1 [0090.187] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.187] SetEndOfFile (hFile=0x22c) returned 1 [0090.188] CloseHandle (hObject=0x22c) returned 1 [0090.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0090.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.188] lstrlenW (lpString=".doc") returned 4 [0090.188] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.188] lstrlenW (lpString=".docx") returned 5 [0090.188] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0090.188] lstrlenW (lpString=".pdf") returned 4 [0090.188] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.189] lstrlenW (lpString=".xls") returned 4 [0090.189] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.189] lstrlenW (lpString=".xlsx") returned 5 [0090.189] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0090.189] lstrlenW (lpString=".ppt") returned 4 [0090.189] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.189] lstrlenW (lpString=".zip") returned 4 [0090.189] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.189] lstrlenW (lpString=".rar") returned 4 [0090.189] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.189] lstrlenW (lpString=".bz2") returned 4 [0090.189] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.189] lstrlenW (lpString=".7z") returned 3 [0090.189] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.189] lstrlenW (lpString=".dbf") returned 4 [0090.189] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.189] lstrlenW (lpString=".1cd") returned 4 [0090.189] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0090.189] lstrlenW (lpString=".jpg") returned 4 [0090.189] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.189] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") [0090.543] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=35340) returned 1 [0090.543] CloseHandle (hObject=0x16c) returned 1 [0090.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0090.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.544] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.544] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.545] GetLastError () returned 0x0 [0090.545] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8a0c, lpOverlapped=0x0) returned 1 [0090.547] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8a10, lpOverlapped=0x0) returned 1 [0090.548] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.548] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.548] SetEndOfFile (hFile=0x1c8) returned 1 [0090.548] CloseHandle (hObject=0x1c8) returned 1 [0090.549] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.549] SetEndOfFile (hFile=0x16c) returned 1 [0090.550] CloseHandle (hObject=0x16c) returned 1 [0090.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.550] lstrlenW (lpString=".doc") returned 4 [0090.550] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.550] lstrlenW (lpString=".docx") returned 5 [0090.550] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0090.550] lstrlenW (lpString=".pdf") returned 4 [0090.550] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.550] lstrlenW (lpString=".xls") returned 4 [0090.550] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.550] lstrlenW (lpString=".xlsx") returned 5 [0090.550] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0090.550] lstrlenW (lpString=".ppt") returned 4 [0090.550] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.550] lstrlenW (lpString=".zip") returned 4 [0090.550] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.550] lstrlenW (lpString=".rar") returned 4 [0090.551] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.551] lstrlenW (lpString=".bz2") returned 4 [0090.551] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.551] lstrlenW (lpString=".7z") returned 3 [0090.551] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.551] lstrlenW (lpString=".dbf") returned 4 [0090.551] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.551] lstrlenW (lpString=".1cd") returned 4 [0090.551] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0090.551] lstrlenW (lpString=".jpg") returned 4 [0090.551] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.551] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") [0090.552] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24392) returned 1 [0090.552] CloseHandle (hObject=0x16c) returned 1 [0090.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0090.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.552] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.552] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.553] GetLastError () returned 0x0 [0090.553] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5f48, lpOverlapped=0x0) returned 1 [0090.555] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5f50, lpOverlapped=0x0) returned 1 [0090.556] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.557] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.557] SetEndOfFile (hFile=0x1c8) returned 1 [0090.557] CloseHandle (hObject=0x1c8) returned 1 [0090.557] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.557] SetEndOfFile (hFile=0x16c) returned 1 [0090.558] CloseHandle (hObject=0x16c) returned 1 [0090.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0090.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.558] lstrlenW (lpString=".doc") returned 4 [0090.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.558] lstrlenW (lpString=".docx") returned 5 [0090.558] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.558] lstrlenW (lpString=".pdf") returned 4 [0090.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.558] lstrlenW (lpString=".xls") returned 4 [0090.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".xlsx") returned 5 [0090.559] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.559] lstrlenW (lpString=".ppt") returned 4 [0090.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.559] lstrlenW (lpString=".zip") returned 4 [0090.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".rar") returned 4 [0090.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".bz2") returned 4 [0090.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".7z") returned 3 [0090.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.559] lstrlenW (lpString=".dbf") returned 4 [0090.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.559] lstrlenW (lpString=".1cd") returned 4 [0090.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0090.559] lstrlenW (lpString=".jpg") returned 4 [0090.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.559] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") [0090.560] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15150) returned 1 [0090.560] CloseHandle (hObject=0x16c) returned 1 [0090.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0090.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.560] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.560] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.561] GetLastError () returned 0x0 [0090.561] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0090.562] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0090.563] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.563] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.563] SetEndOfFile (hFile=0x1c8) returned 1 [0090.564] CloseHandle (hObject=0x1c8) returned 1 [0090.564] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.564] SetEndOfFile (hFile=0x16c) returned 1 [0090.564] CloseHandle (hObject=0x16c) returned 1 [0090.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0090.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.565] lstrlenW (lpString=".doc") returned 4 [0090.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.565] lstrlenW (lpString=".docx") returned 5 [0090.565] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.565] lstrlenW (lpString=".pdf") returned 4 [0090.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.565] lstrlenW (lpString=".xls") returned 4 [0090.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.565] lstrlenW (lpString=".xlsx") returned 5 [0090.565] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.565] lstrlenW (lpString=".ppt") returned 4 [0090.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.565] lstrlenW (lpString=".zip") returned 4 [0090.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.565] lstrlenW (lpString=".rar") returned 4 [0090.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.565] lstrlenW (lpString=".bz2") returned 4 [0090.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.565] lstrlenW (lpString=".7z") returned 3 [0090.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.566] lstrlenW (lpString=".dbf") returned 4 [0090.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.566] lstrlenW (lpString=".1cd") returned 4 [0090.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0090.566] lstrlenW (lpString=".jpg") returned 4 [0090.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.566] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") [0090.566] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7822) returned 1 [0090.566] CloseHandle (hObject=0x16c) returned 1 [0090.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0090.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.567] GetLastError () returned 0x0 [0090.567] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1e8e, lpOverlapped=0x0) returned 1 [0090.569] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e90, lpOverlapped=0x0) returned 1 [0090.570] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.570] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.570] SetEndOfFile (hFile=0x1c8) returned 1 [0090.570] CloseHandle (hObject=0x1c8) returned 1 [0090.570] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.570] SetEndOfFile (hFile=0x16c) returned 1 [0090.571] CloseHandle (hObject=0x16c) returned 1 [0090.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0090.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.571] lstrlenW (lpString=".doc") returned 4 [0090.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.571] lstrlenW (lpString=".docx") returned 5 [0090.571] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.571] lstrlenW (lpString=".pdf") returned 4 [0090.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString=".xls") returned 4 [0090.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.572] lstrlenW (lpString=".xlsx") returned 5 [0090.572] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.572] lstrlenW (lpString=".ppt") returned 4 [0090.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.572] lstrlenW (lpString=".zip") returned 4 [0090.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.572] lstrlenW (lpString=".rar") returned 4 [0090.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString=".bz2") returned 4 [0090.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString=".7z") returned 3 [0090.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.572] lstrlenW (lpString=".dbf") returned 4 [0090.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.572] lstrlenW (lpString=".1cd") returned 4 [0090.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0090.572] lstrlenW (lpString=".jpg") returned 4 [0090.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.572] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") [0090.573] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16082) returned 1 [0090.573] CloseHandle (hObject=0x16c) returned 1 [0090.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0090.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.573] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.573] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.574] GetLastError () returned 0x0 [0090.574] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3ed2, lpOverlapped=0x0) returned 1 [0090.575] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3ee0, lpOverlapped=0x0) returned 1 [0090.577] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.577] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.577] SetEndOfFile (hFile=0x1c8) returned 1 [0090.577] CloseHandle (hObject=0x1c8) returned 1 [0090.577] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.577] SetEndOfFile (hFile=0x16c) returned 1 [0090.578] CloseHandle (hObject=0x16c) returned 1 [0090.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0090.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.578] lstrlenW (lpString=".doc") returned 4 [0090.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.578] lstrlenW (lpString=".docx") returned 5 [0090.578] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0090.578] lstrlenW (lpString=".pdf") returned 4 [0090.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.578] lstrlenW (lpString=".xls") returned 4 [0090.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.578] lstrlenW (lpString=".xlsx") returned 5 [0090.578] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0090.578] lstrlenW (lpString=".ppt") returned 4 [0090.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.579] lstrlenW (lpString=".zip") returned 4 [0090.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.579] lstrlenW (lpString=".rar") returned 4 [0090.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.579] lstrlenW (lpString=".bz2") returned 4 [0090.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.579] lstrlenW (lpString=".7z") returned 3 [0090.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.579] lstrlenW (lpString=".dbf") returned 4 [0090.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.579] lstrlenW (lpString=".1cd") returned 4 [0090.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0090.579] lstrlenW (lpString=".jpg") returned 4 [0090.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.579] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") [0090.747] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=29788) returned 1 [0090.747] CloseHandle (hObject=0x1fc) returned 1 [0090.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0090.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.747] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.747] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0090.748] GetLastError () returned 0x0 [0090.748] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x745c, lpOverlapped=0x0) returned 1 [0090.843] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7460, lpOverlapped=0x0) returned 1 [0090.845] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.845] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.845] SetEndOfFile (hFile=0x15c) returned 1 [0090.845] CloseHandle (hObject=0x15c) returned 1 [0090.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.845] SetEndOfFile (hFile=0x1fc) returned 1 [0090.846] CloseHandle (hObject=0x1fc) returned 1 [0090.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0090.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.846] lstrlenW (lpString=".doc") returned 4 [0090.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.846] lstrlenW (lpString=".docx") returned 5 [0090.847] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.847] lstrlenW (lpString=".pdf") returned 4 [0090.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString=".xls") returned 4 [0090.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.847] lstrlenW (lpString=".xlsx") returned 5 [0090.847] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.847] lstrlenW (lpString=".ppt") returned 4 [0090.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.847] lstrlenW (lpString=".zip") returned 4 [0090.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.847] lstrlenW (lpString=".rar") returned 4 [0090.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString=".bz2") returned 4 [0090.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString=".7z") returned 3 [0090.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.847] lstrlenW (lpString=".dbf") returned 4 [0090.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.847] lstrlenW (lpString=".1cd") returned 4 [0090.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0090.847] lstrlenW (lpString=".jpg") returned 4 [0090.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.847] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") [0090.848] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=28626) returned 1 [0090.848] CloseHandle (hObject=0x1fc) returned 1 [0090.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0090.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.848] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.848] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0090.849] GetLastError () returned 0x0 [0090.849] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6fd2, lpOverlapped=0x0) returned 1 [0090.936] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6fe0, lpOverlapped=0x0) returned 1 [0090.937] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.937] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.938] SetEndOfFile (hFile=0x15c) returned 1 [0091.353] CloseHandle (hObject=0x15c) returned 1 [0091.353] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0091.353] SetEndOfFile (hFile=0x1fc) returned 1 [0091.422] CloseHandle (hObject=0x1fc) returned 1 [0091.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0091.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.495] lstrlenW (lpString=".doc") returned 4 [0091.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.495] lstrlenW (lpString=".docx") returned 5 [0091.495] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.495] lstrlenW (lpString=".pdf") returned 4 [0091.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.495] lstrlenW (lpString=".xls") returned 4 [0091.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.495] lstrlenW (lpString=".xlsx") returned 5 [0091.495] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.504] lstrlenW (lpString=".ppt") returned 4 [0091.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.504] lstrlenW (lpString=".zip") returned 4 [0091.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.504] lstrlenW (lpString=".rar") returned 4 [0091.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.504] lstrlenW (lpString=".bz2") returned 4 [0091.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.504] lstrlenW (lpString=".7z") returned 3 [0091.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.504] lstrlenW (lpString=".dbf") returned 4 [0091.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.504] lstrlenW (lpString=".1cd") returned 4 [0091.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0091.515] lstrlenW (lpString=".jpg") returned 4 [0091.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.515] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") [0091.530] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=25868) returned 1 [0091.530] CloseHandle (hObject=0x210) returned 1 [0091.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0091.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0091.531] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0091.531] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0091.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.035] GetLastError () returned 0x0 [0092.035] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x650c, lpOverlapped=0x0) returned 1 [0092.038] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6510, lpOverlapped=0x0) returned 1 [0092.039] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.039] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.039] SetEndOfFile (hFile=0x150) returned 1 [0092.040] CloseHandle (hObject=0x150) returned 1 [0092.040] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.040] SetEndOfFile (hFile=0x210) returned 1 [0092.041] CloseHandle (hObject=0x210) returned 1 [0092.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0092.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.041] lstrlenW (lpString=".doc") returned 4 [0092.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.041] lstrlenW (lpString=".docx") returned 5 [0092.041] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0092.041] lstrlenW (lpString=".pdf") returned 4 [0092.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.041] lstrlenW (lpString=".xls") returned 4 [0092.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.041] lstrlenW (lpString=".xlsx") returned 5 [0092.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0092.041] lstrlenW (lpString=".ppt") returned 4 [0092.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.041] lstrlenW (lpString=".zip") returned 4 [0092.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.042] lstrlenW (lpString=".rar") returned 4 [0092.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.042] lstrlenW (lpString=".bz2") returned 4 [0092.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.042] lstrlenW (lpString=".7z") returned 3 [0092.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.042] lstrlenW (lpString=".dbf") returned 4 [0092.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.042] lstrlenW (lpString=".1cd") returned 4 [0092.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0092.042] lstrlenW (lpString=".jpg") returned 4 [0092.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.042] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") [0092.043] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=30522) returned 1 [0092.043] CloseHandle (hObject=0x210) returned 1 [0092.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0092.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.043] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.043] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.044] GetLastError () returned 0x0 [0092.044] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x773a, lpOverlapped=0x0) returned 1 [0092.046] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7740, lpOverlapped=0x0) returned 1 [0092.048] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.048] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.048] SetEndOfFile (hFile=0x150) returned 1 [0092.048] CloseHandle (hObject=0x150) returned 1 [0092.048] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.048] SetEndOfFile (hFile=0x210) returned 1 [0092.049] CloseHandle (hObject=0x210) returned 1 [0092.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString=".doc") returned 4 [0092.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString=".docx") returned 5 [0092.050] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0092.050] lstrlenW (lpString=".pdf") returned 4 [0092.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString=".xls") returned 4 [0092.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.050] lstrlenW (lpString=".xlsx") returned 5 [0092.050] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0092.050] lstrlenW (lpString=".ppt") returned 4 [0092.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString=".zip") returned 4 [0092.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.050] lstrlenW (lpString=".rar") returned 4 [0092.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString=".bz2") returned 4 [0092.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString=".7z") returned 3 [0092.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString=".dbf") returned 4 [0092.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString=".1cd") returned 4 [0092.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0092.050] lstrlenW (lpString=".jpg") returned 4 [0092.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.051] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") [0092.051] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=35726) returned 1 [0092.051] CloseHandle (hObject=0x210) returned 1 [0092.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0092.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.052] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.052] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.052] GetLastError () returned 0x0 [0092.052] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8b8e, lpOverlapped=0x0) returned 1 [0092.054] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8b90, lpOverlapped=0x0) returned 1 [0092.056] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.056] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.056] SetEndOfFile (hFile=0x150) returned 1 [0092.056] CloseHandle (hObject=0x150) returned 1 [0092.056] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.056] SetEndOfFile (hFile=0x210) returned 1 [0092.057] CloseHandle (hObject=0x210) returned 1 [0092.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0092.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString=".doc") returned 4 [0092.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString=".docx") returned 5 [0092.058] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0092.058] lstrlenW (lpString=".pdf") returned 4 [0092.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString=".xls") returned 4 [0092.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.058] lstrlenW (lpString=".xlsx") returned 5 [0092.058] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0092.058] lstrlenW (lpString=".ppt") returned 4 [0092.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString=".zip") returned 4 [0092.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.058] lstrlenW (lpString=".rar") returned 4 [0092.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString=".bz2") returned 4 [0092.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString=".7z") returned 3 [0092.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString=".dbf") returned 4 [0092.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString=".1cd") returned 4 [0092.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0092.058] lstrlenW (lpString=".jpg") returned 4 [0092.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.059] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") [0092.059] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7796) returned 1 [0092.059] CloseHandle (hObject=0x210) returned 1 [0092.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0092.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.059] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.059] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.060] GetLastError () returned 0x0 [0092.060] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1e74, lpOverlapped=0x0) returned 1 [0092.062] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0092.063] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.063] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.063] SetEndOfFile (hFile=0x150) returned 1 [0092.063] CloseHandle (hObject=0x150) returned 1 [0092.063] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.063] SetEndOfFile (hFile=0x210) returned 1 [0092.064] CloseHandle (hObject=0x210) returned 1 [0092.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0092.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.064] lstrlenW (lpString=".doc") returned 4 [0092.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.064] lstrlenW (lpString=".docx") returned 5 [0092.064] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0092.064] lstrlenW (lpString=".pdf") returned 4 [0092.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString=".xls") returned 4 [0092.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.065] lstrlenW (lpString=".xlsx") returned 5 [0092.065] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0092.065] lstrlenW (lpString=".ppt") returned 4 [0092.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.065] lstrlenW (lpString=".zip") returned 4 [0092.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.065] lstrlenW (lpString=".rar") returned 4 [0092.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString=".bz2") returned 4 [0092.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString=".7z") returned 3 [0092.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.065] lstrlenW (lpString=".dbf") returned 4 [0092.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.065] lstrlenW (lpString=".1cd") returned 4 [0092.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0092.065] lstrlenW (lpString=".jpg") returned 4 [0092.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.065] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") [0092.066] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8578) returned 1 [0092.066] CloseHandle (hObject=0x210) returned 1 [0092.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0092.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.067] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.067] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.067] GetLastError () returned 0x0 [0092.067] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2182, lpOverlapped=0x0) returned 1 [0092.069] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2190, lpOverlapped=0x0) returned 1 [0092.070] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.070] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.070] SetEndOfFile (hFile=0x150) returned 1 [0092.070] CloseHandle (hObject=0x150) returned 1 [0092.070] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.070] SetEndOfFile (hFile=0x210) returned 1 [0092.071] CloseHandle (hObject=0x210) returned 1 [0092.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString=".doc") returned 4 [0092.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString=".docx") returned 5 [0092.072] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0092.072] lstrlenW (lpString=".pdf") returned 4 [0092.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString=".xls") returned 4 [0092.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.072] lstrlenW (lpString=".xlsx") returned 5 [0092.072] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0092.072] lstrlenW (lpString=".ppt") returned 4 [0092.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString=".zip") returned 4 [0092.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.072] lstrlenW (lpString=".rar") returned 4 [0092.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString=".bz2") returned 4 [0092.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString=".7z") returned 3 [0092.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString=".dbf") returned 4 [0092.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString=".1cd") returned 4 [0092.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0092.072] lstrlenW (lpString=".jpg") returned 4 [0092.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.073] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") [0092.165] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14308) returned 1 [0092.165] CloseHandle (hObject=0x15c) returned 1 [0092.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0092.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.165] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.165] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.166] GetLastError () returned 0x0 [0092.166] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x37e4, lpOverlapped=0x0) returned 1 [0092.172] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x37f0, lpOverlapped=0x0) returned 1 [0092.173] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.174] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.174] SetEndOfFile (hFile=0x1fc) returned 1 [0092.174] CloseHandle (hObject=0x1fc) returned 1 [0092.174] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.174] SetEndOfFile (hFile=0x15c) returned 1 [0092.175] CloseHandle (hObject=0x15c) returned 1 [0092.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0092.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.175] lstrlenW (lpString=".doc") returned 4 [0092.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.175] lstrlenW (lpString=".docx") returned 5 [0092.175] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0092.176] lstrlenW (lpString=".pdf") returned 4 [0092.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString=".xls") returned 4 [0092.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.176] lstrlenW (lpString=".xlsx") returned 5 [0092.176] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0092.176] lstrlenW (lpString=".ppt") returned 4 [0092.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.176] lstrlenW (lpString=".zip") returned 4 [0092.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.176] lstrlenW (lpString=".rar") returned 4 [0092.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString=".bz2") returned 4 [0092.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString=".7z") returned 3 [0092.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.176] lstrlenW (lpString=".dbf") returned 4 [0092.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.176] lstrlenW (lpString=".1cd") returned 4 [0092.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0092.177] lstrlenW (lpString=".jpg") returned 4 [0092.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.177] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") [0092.177] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=33850) returned 1 [0092.177] CloseHandle (hObject=0x15c) returned 1 [0092.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0092.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.178] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.178] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.178] GetLastError () returned 0x0 [0092.178] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x843a, lpOverlapped=0x0) returned 1 [0092.185] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8440, lpOverlapped=0x0) returned 1 [0092.186] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.186] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.186] SetEndOfFile (hFile=0x1fc) returned 1 [0092.187] CloseHandle (hObject=0x1fc) returned 1 [0092.187] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.187] SetEndOfFile (hFile=0x15c) returned 1 [0092.188] CloseHandle (hObject=0x15c) returned 1 [0092.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0092.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.188] lstrlenW (lpString=".doc") returned 4 [0092.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.188] lstrlenW (lpString=".docx") returned 5 [0092.188] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0092.188] lstrlenW (lpString=".pdf") returned 4 [0092.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.188] lstrlenW (lpString=".xls") returned 4 [0092.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.188] lstrlenW (lpString=".xlsx") returned 5 [0092.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0092.188] lstrlenW (lpString=".ppt") returned 4 [0092.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.189] lstrlenW (lpString=".zip") returned 4 [0092.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.189] lstrlenW (lpString=".rar") returned 4 [0092.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.189] lstrlenW (lpString=".bz2") returned 4 [0092.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.189] lstrlenW (lpString=".7z") returned 3 [0092.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.189] lstrlenW (lpString=".dbf") returned 4 [0092.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.189] lstrlenW (lpString=".1cd") returned 4 [0092.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0092.189] lstrlenW (lpString=".jpg") returned 4 [0092.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.189] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") [0092.190] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17662) returned 1 [0092.190] CloseHandle (hObject=0x15c) returned 1 [0092.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0092.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.190] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.190] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.191] GetLastError () returned 0x0 [0092.191] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x44fe, lpOverlapped=0x0) returned 1 [0092.198] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4500, lpOverlapped=0x0) returned 1 [0092.199] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.199] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.199] SetEndOfFile (hFile=0x1fc) returned 1 [0092.199] CloseHandle (hObject=0x1fc) returned 1 [0092.200] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.200] SetEndOfFile (hFile=0x15c) returned 1 [0092.200] CloseHandle (hObject=0x15c) returned 1 [0092.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.201] lstrlenW (lpString=".doc") returned 4 [0092.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.201] lstrlenW (lpString=".docx") returned 5 [0092.201] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0092.201] lstrlenW (lpString=".pdf") returned 4 [0092.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.201] lstrlenW (lpString=".xls") returned 4 [0092.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.201] lstrlenW (lpString=".xlsx") returned 5 [0092.201] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0092.201] lstrlenW (lpString=".ppt") returned 4 [0092.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.201] lstrlenW (lpString=".zip") returned 4 [0092.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.201] lstrlenW (lpString=".rar") returned 4 [0092.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.201] lstrlenW (lpString=".bz2") returned 4 [0092.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.202] lstrlenW (lpString=".7z") returned 3 [0092.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.202] lstrlenW (lpString=".dbf") returned 4 [0092.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.202] lstrlenW (lpString=".1cd") returned 4 [0092.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0092.202] lstrlenW (lpString=".jpg") returned 4 [0092.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.202] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") [0092.202] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18212) returned 1 [0092.202] CloseHandle (hObject=0x15c) returned 1 [0092.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0092.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.203] GetLastError () returned 0x0 [0092.203] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4724, lpOverlapped=0x0) returned 1 [0092.208] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4730, lpOverlapped=0x0) returned 1 [0092.209] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.209] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.210] SetEndOfFile (hFile=0x1fc) returned 1 [0092.210] CloseHandle (hObject=0x1fc) returned 1 [0092.210] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.210] SetEndOfFile (hFile=0x15c) returned 1 [0092.211] CloseHandle (hObject=0x15c) returned 1 [0092.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0092.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.211] lstrlenW (lpString=".doc") returned 4 [0092.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.211] lstrlenW (lpString=".docx") returned 5 [0092.211] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0092.211] lstrlenW (lpString=".pdf") returned 4 [0092.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.211] lstrlenW (lpString=".xls") returned 4 [0092.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.211] lstrlenW (lpString=".xlsx") returned 5 [0092.211] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0092.211] lstrlenW (lpString=".ppt") returned 4 [0092.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.211] lstrlenW (lpString=".zip") returned 4 [0092.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.212] lstrlenW (lpString=".rar") returned 4 [0092.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.212] lstrlenW (lpString=".bz2") returned 4 [0092.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.212] lstrlenW (lpString=".7z") returned 3 [0092.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.212] lstrlenW (lpString=".dbf") returned 4 [0092.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.212] lstrlenW (lpString=".1cd") returned 4 [0092.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0092.212] lstrlenW (lpString=".jpg") returned 4 [0092.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.212] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") [0092.239] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6596) returned 1 [0092.239] CloseHandle (hObject=0x15c) returned 1 [0092.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0092.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.240] GetLastError () returned 0x0 [0092.241] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x19c4, lpOverlapped=0x0) returned 1 [0092.242] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x19d0, lpOverlapped=0x0) returned 1 [0092.243] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.244] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.244] SetEndOfFile (hFile=0x1fc) returned 1 [0092.244] CloseHandle (hObject=0x1fc) returned 1 [0092.244] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.244] SetEndOfFile (hFile=0x15c) returned 1 [0092.245] CloseHandle (hObject=0x15c) returned 1 [0092.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0092.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.245] lstrlenW (lpString=".doc") returned 4 [0092.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.245] lstrlenW (lpString=".docx") returned 5 [0092.245] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0092.245] lstrlenW (lpString=".pdf") returned 4 [0092.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.245] lstrlenW (lpString=".xls") returned 4 [0092.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.245] lstrlenW (lpString=".xlsx") returned 5 [0092.245] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0092.245] lstrlenW (lpString=".ppt") returned 4 [0092.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.246] lstrlenW (lpString=".zip") returned 4 [0092.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.246] lstrlenW (lpString=".rar") returned 4 [0092.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.246] lstrlenW (lpString=".bz2") returned 4 [0092.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.246] lstrlenW (lpString=".7z") returned 3 [0092.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.246] lstrlenW (lpString=".dbf") returned 4 [0092.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.246] lstrlenW (lpString=".1cd") returned 4 [0092.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0092.246] lstrlenW (lpString=".jpg") returned 4 [0092.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.246] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") [0092.247] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5376) returned 1 [0092.247] CloseHandle (hObject=0x15c) returned 1 [0092.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0092.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.247] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.247] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.248] GetLastError () returned 0x0 [0092.248] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1500, lpOverlapped=0x0) returned 1 [0092.479] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1510, lpOverlapped=0x0) returned 1 [0092.480] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.480] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.480] SetEndOfFile (hFile=0x1fc) returned 1 [0092.480] CloseHandle (hObject=0x1fc) returned 1 [0092.480] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.480] SetEndOfFile (hFile=0x15c) returned 1 [0092.481] CloseHandle (hObject=0x15c) returned 1 [0092.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0092.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.481] lstrlenW (lpString=".doc") returned 4 [0092.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString=".docx") returned 5 [0092.482] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0092.482] lstrlenW (lpString=".pdf") returned 4 [0092.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString=".xls") returned 4 [0092.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.482] lstrlenW (lpString=".xlsx") returned 5 [0092.482] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0092.482] lstrlenW (lpString=".ppt") returned 4 [0092.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.482] lstrlenW (lpString=".zip") returned 4 [0092.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.482] lstrlenW (lpString=".rar") returned 4 [0092.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString=".bz2") returned 4 [0092.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString=".7z") returned 3 [0092.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.482] lstrlenW (lpString=".dbf") returned 4 [0092.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.482] lstrlenW (lpString=".1cd") returned 4 [0092.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0092.482] lstrlenW (lpString=".jpg") returned 4 [0092.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.482] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") [0092.483] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4696) returned 1 [0092.483] CloseHandle (hObject=0x15c) returned 1 [0092.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0092.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.484] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.484] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.484] GetLastError () returned 0x0 [0092.484] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1258, lpOverlapped=0x0) returned 1 [0092.486] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1260, lpOverlapped=0x0) returned 1 [0092.487] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.487] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.487] SetEndOfFile (hFile=0x1fc) returned 1 [0092.487] CloseHandle (hObject=0x1fc) returned 1 [0092.487] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.487] SetEndOfFile (hFile=0x15c) returned 1 [0092.489] CloseHandle (hObject=0x15c) returned 1 [0092.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0092.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.490] lstrlenW (lpString=".doc") returned 4 [0092.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.490] lstrlenW (lpString=".docx") returned 5 [0092.490] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.490] lstrlenW (lpString=".pdf") returned 4 [0092.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.490] lstrlenW (lpString=".xls") returned 4 [0092.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.490] lstrlenW (lpString=".xlsx") returned 5 [0092.490] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.490] lstrlenW (lpString=".ppt") returned 4 [0092.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.490] lstrlenW (lpString=".zip") returned 4 [0092.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.490] lstrlenW (lpString=".rar") returned 4 [0092.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.490] lstrlenW (lpString=".bz2") returned 4 [0092.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.491] lstrlenW (lpString=".7z") returned 3 [0092.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.491] lstrlenW (lpString=".dbf") returned 4 [0092.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.491] lstrlenW (lpString=".1cd") returned 4 [0092.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0092.491] lstrlenW (lpString=".jpg") returned 4 [0092.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.491] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") [0092.491] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2100) returned 1 [0092.491] CloseHandle (hObject=0x15c) returned 1 [0092.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0092.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.492] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.492] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.492] GetLastError () returned 0x0 [0092.492] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x834, lpOverlapped=0x0) returned 1 [0092.494] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x840, lpOverlapped=0x0) returned 1 [0092.496] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.496] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.496] SetEndOfFile (hFile=0x1fc) returned 1 [0092.496] CloseHandle (hObject=0x1fc) returned 1 [0092.496] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.496] SetEndOfFile (hFile=0x15c) returned 1 [0092.497] CloseHandle (hObject=0x15c) returned 1 [0092.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0092.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.497] lstrlenW (lpString=".doc") returned 4 [0092.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString=".docx") returned 5 [0092.498] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0092.498] lstrlenW (lpString=".pdf") returned 4 [0092.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString=".xls") returned 4 [0092.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.498] lstrlenW (lpString=".xlsx") returned 5 [0092.498] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0092.498] lstrlenW (lpString=".ppt") returned 4 [0092.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.498] lstrlenW (lpString=".zip") returned 4 [0092.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.498] lstrlenW (lpString=".rar") returned 4 [0092.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString=".bz2") returned 4 [0092.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString=".7z") returned 3 [0092.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.498] lstrlenW (lpString=".dbf") returned 4 [0092.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.498] lstrlenW (lpString=".1cd") returned 4 [0092.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0092.498] lstrlenW (lpString=".jpg") returned 4 [0092.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.498] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") [0092.499] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5620) returned 1 [0092.499] CloseHandle (hObject=0x15c) returned 1 [0092.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0092.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.500] GetLastError () returned 0x0 [0092.500] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x15f4, lpOverlapped=0x0) returned 1 [0092.501] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1600, lpOverlapped=0x0) returned 1 [0092.502] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.502] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.502] SetEndOfFile (hFile=0x1fc) returned 1 [0092.503] CloseHandle (hObject=0x1fc) returned 1 [0092.503] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.503] SetEndOfFile (hFile=0x15c) returned 1 [0092.504] CloseHandle (hObject=0x15c) returned 1 [0092.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0092.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.504] lstrlenW (lpString=".doc") returned 4 [0092.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.504] lstrlenW (lpString=".docx") returned 5 [0092.504] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0092.504] lstrlenW (lpString=".pdf") returned 4 [0092.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.504] lstrlenW (lpString=".xls") returned 4 [0092.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.504] lstrlenW (lpString=".xlsx") returned 5 [0092.504] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0092.504] lstrlenW (lpString=".ppt") returned 4 [0092.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.504] lstrlenW (lpString=".zip") returned 4 [0092.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.504] lstrlenW (lpString=".rar") returned 4 [0092.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.505] lstrlenW (lpString=".bz2") returned 4 [0092.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.505] lstrlenW (lpString=".7z") returned 3 [0092.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.505] lstrlenW (lpString=".dbf") returned 4 [0092.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.505] lstrlenW (lpString=".1cd") returned 4 [0092.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0092.505] lstrlenW (lpString=".jpg") returned 4 [0092.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.505] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") [0092.505] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3472) returned 1 [0092.505] CloseHandle (hObject=0x15c) returned 1 [0092.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0092.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.506] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.506] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.506] GetLastError () returned 0x0 [0092.506] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xd90, lpOverlapped=0x0) returned 1 [0092.508] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xda0, lpOverlapped=0x0) returned 1 [0092.509] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.509] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.509] SetEndOfFile (hFile=0x1fc) returned 1 [0092.509] CloseHandle (hObject=0x1fc) returned 1 [0092.509] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.509] SetEndOfFile (hFile=0x15c) returned 1 [0092.510] CloseHandle (hObject=0x15c) returned 1 [0092.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0092.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.510] lstrlenW (lpString=".doc") returned 4 [0092.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.510] lstrlenW (lpString=".docx") returned 5 [0092.510] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0092.511] lstrlenW (lpString=".pdf") returned 4 [0092.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString=".xls") returned 4 [0092.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.511] lstrlenW (lpString=".xlsx") returned 5 [0092.511] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0092.511] lstrlenW (lpString=".ppt") returned 4 [0092.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.511] lstrlenW (lpString=".zip") returned 4 [0092.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.511] lstrlenW (lpString=".rar") returned 4 [0092.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString=".bz2") returned 4 [0092.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString=".7z") returned 3 [0092.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.511] lstrlenW (lpString=".dbf") returned 4 [0092.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.511] lstrlenW (lpString=".1cd") returned 4 [0092.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0092.511] lstrlenW (lpString=".jpg") returned 4 [0092.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.511] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") [0092.512] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5000) returned 1 [0092.512] CloseHandle (hObject=0x15c) returned 1 [0092.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0092.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.513] GetLastError () returned 0x0 [0092.513] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1388, lpOverlapped=0x0) returned 1 [0092.526] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1390, lpOverlapped=0x0) returned 1 [0092.527] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0092.527] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.527] SetEndOfFile (hFile=0x1fc) returned 1 [0092.606] CloseHandle (hObject=0x1fc) returned 1 [0092.606] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.606] SetEndOfFile (hFile=0x15c) returned 1 [0092.607] CloseHandle (hObject=0x15c) returned 1 [0092.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0092.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString=".doc") returned 4 [0092.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString=".docx") returned 5 [0092.820] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.820] lstrlenW (lpString=".pdf") returned 4 [0092.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString=".xls") returned 4 [0092.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.820] lstrlenW (lpString=".xlsx") returned 5 [0092.820] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.820] lstrlenW (lpString=".ppt") returned 4 [0092.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString=".zip") returned 4 [0092.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.820] lstrlenW (lpString=".rar") returned 4 [0092.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString=".bz2") returned 4 [0092.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString=".7z") returned 3 [0092.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString=".dbf") returned 4 [0092.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString=".1cd") returned 4 [0092.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0092.820] lstrlenW (lpString=".jpg") returned 4 [0092.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.821] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") [0093.307] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15196) returned 1 [0093.307] CloseHandle (hObject=0x1c0) returned 1 [0093.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0093.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.307] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.307] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0093.308] GetLastError () returned 0x0 [0093.308] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3b5c, lpOverlapped=0x0) returned 1 [0093.310] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b60, lpOverlapped=0x0) returned 1 [0093.311] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.311] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.311] SetEndOfFile (hFile=0x1c8) returned 1 [0093.311] CloseHandle (hObject=0x1c8) returned 1 [0093.311] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.311] SetEndOfFile (hFile=0x1c0) returned 1 [0093.312] CloseHandle (hObject=0x1c0) returned 1 [0093.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0093.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.312] lstrlenW (lpString=".doc") returned 4 [0093.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString=".docx") returned 5 [0093.313] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.313] lstrlenW (lpString=".pdf") returned 4 [0093.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString=".xls") returned 4 [0093.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.313] lstrlenW (lpString=".xlsx") returned 5 [0093.313] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.313] lstrlenW (lpString=".ppt") returned 4 [0093.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.313] lstrlenW (lpString=".zip") returned 4 [0093.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.313] lstrlenW (lpString=".rar") returned 4 [0093.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString=".bz2") returned 4 [0093.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString=".7z") returned 3 [0093.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.313] lstrlenW (lpString=".dbf") returned 4 [0093.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.313] lstrlenW (lpString=".1cd") returned 4 [0093.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0093.313] lstrlenW (lpString=".jpg") returned 4 [0093.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.313] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") [0093.314] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13702) returned 1 [0093.314] CloseHandle (hObject=0x1c0) returned 1 [0093.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0093.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.314] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.315] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0093.315] GetLastError () returned 0x0 [0093.315] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3586, lpOverlapped=0x0) returned 1 [0093.317] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3590, lpOverlapped=0x0) returned 1 [0093.318] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.318] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.318] SetEndOfFile (hFile=0x1c8) returned 1 [0093.318] CloseHandle (hObject=0x1c8) returned 1 [0093.318] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.318] SetEndOfFile (hFile=0x1c0) returned 1 [0093.319] CloseHandle (hObject=0x1c0) returned 1 [0093.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0093.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.320] lstrlenW (lpString=".doc") returned 4 [0093.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString=".docx") returned 5 [0093.320] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.320] lstrlenW (lpString=".pdf") returned 4 [0093.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString=".xls") returned 4 [0093.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.320] lstrlenW (lpString=".xlsx") returned 5 [0093.320] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.320] lstrlenW (lpString=".ppt") returned 4 [0093.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.320] lstrlenW (lpString=".zip") returned 4 [0093.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.320] lstrlenW (lpString=".rar") returned 4 [0093.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString=".bz2") returned 4 [0093.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString=".7z") returned 3 [0093.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.320] lstrlenW (lpString=".dbf") returned 4 [0093.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.320] lstrlenW (lpString=".1cd") returned 4 [0093.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0093.320] lstrlenW (lpString=".jpg") returned 4 [0093.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.320] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") [0093.321] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6912) returned 1 [0093.321] CloseHandle (hObject=0x1c0) returned 1 [0093.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0093.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.321] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.321] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0093.322] GetLastError () returned 0x0 [0093.322] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b00, lpOverlapped=0x0) returned 1 [0093.324] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0093.325] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.325] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.325] SetEndOfFile (hFile=0x1c8) returned 1 [0093.325] CloseHandle (hObject=0x1c8) returned 1 [0093.325] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.325] SetEndOfFile (hFile=0x1c0) returned 1 [0093.326] CloseHandle (hObject=0x1c0) returned 1 [0093.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0093.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.326] lstrlenW (lpString=".doc") returned 4 [0093.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.326] lstrlenW (lpString=".docx") returned 5 [0093.326] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.326] lstrlenW (lpString=".pdf") returned 4 [0093.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.326] lstrlenW (lpString=".xls") returned 4 [0093.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.327] lstrlenW (lpString=".xlsx") returned 5 [0093.327] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.327] lstrlenW (lpString=".ppt") returned 4 [0093.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.327] lstrlenW (lpString=".zip") returned 4 [0093.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.327] lstrlenW (lpString=".rar") returned 4 [0093.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.327] lstrlenW (lpString=".bz2") returned 4 [0093.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.327] lstrlenW (lpString=".7z") returned 3 [0093.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.327] lstrlenW (lpString=".dbf") returned 4 [0093.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.327] lstrlenW (lpString=".1cd") returned 4 [0093.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0093.327] lstrlenW (lpString=".jpg") returned 4 [0093.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.327] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") [0093.328] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5708) returned 1 [0093.328] CloseHandle (hObject=0x1c0) returned 1 [0093.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0093.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.329] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.329] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0093.332] GetLastError () returned 0x0 [0093.332] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x164c, lpOverlapped=0x0) returned 1 [0093.336] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1650, lpOverlapped=0x0) returned 1 [0093.337] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.337] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.337] SetEndOfFile (hFile=0x1c8) returned 1 [0093.337] CloseHandle (hObject=0x1c8) returned 1 [0093.337] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.337] SetEndOfFile (hFile=0x1c0) returned 1 [0093.338] CloseHandle (hObject=0x1c0) returned 1 [0093.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0093.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.339] lstrlenW (lpString=".doc") returned 4 [0093.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString=".docx") returned 5 [0093.339] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.339] lstrlenW (lpString=".pdf") returned 4 [0093.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString=".xls") returned 4 [0093.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.339] lstrlenW (lpString=".xlsx") returned 5 [0093.339] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.339] lstrlenW (lpString=".ppt") returned 4 [0093.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.339] lstrlenW (lpString=".zip") returned 4 [0093.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.339] lstrlenW (lpString=".rar") returned 4 [0093.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString=".bz2") returned 4 [0093.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString=".7z") returned 3 [0093.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.339] lstrlenW (lpString=".dbf") returned 4 [0093.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.339] lstrlenW (lpString=".1cd") returned 4 [0093.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0093.340] lstrlenW (lpString=".jpg") returned 4 [0093.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.340] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") [0093.340] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=40230) returned 1 [0093.340] CloseHandle (hObject=0x1c0) returned 1 [0093.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0093.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.341] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.341] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0093.341] GetLastError () returned 0x0 [0093.341] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x9d26, lpOverlapped=0x0) returned 1 [0093.343] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0093.345] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.345] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.345] SetEndOfFile (hFile=0x1c8) returned 1 [0093.345] CloseHandle (hObject=0x1c8) returned 1 [0093.345] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.345] SetEndOfFile (hFile=0x1c0) returned 1 [0093.487] CloseHandle (hObject=0x1c0) returned 1 [0093.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0093.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.534] lstrlenW (lpString=".doc") returned 4 [0093.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.534] lstrlenW (lpString=".docx") returned 5 [0093.534] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.534] lstrlenW (lpString=".pdf") returned 4 [0093.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.534] lstrlenW (lpString=".xls") returned 4 [0093.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.534] lstrlenW (lpString=".xlsx") returned 5 [0093.534] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.534] lstrlenW (lpString=".ppt") returned 4 [0093.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.534] lstrlenW (lpString=".zip") returned 4 [0093.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.534] lstrlenW (lpString=".rar") returned 4 [0093.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.534] lstrlenW (lpString=".bz2") returned 4 [0093.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.534] lstrlenW (lpString=".7z") returned 3 [0093.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.535] lstrlenW (lpString=".dbf") returned 4 [0093.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.535] lstrlenW (lpString=".1cd") returned 4 [0093.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0093.535] lstrlenW (lpString=".jpg") returned 4 [0093.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.535] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") [0093.535] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13756) returned 1 [0093.535] CloseHandle (hObject=0x190) returned 1 [0093.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 0x20 [0093.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.536] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.536] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.536] GetLastError () returned 0x0 [0093.536] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x35bc, lpOverlapped=0x0) returned 1 [0093.556] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0093.557] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.557] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.557] SetEndOfFile (hFile=0x150) returned 1 [0093.557] CloseHandle (hObject=0x150) returned 1 [0093.558] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.558] SetEndOfFile (hFile=0x190) returned 1 [0093.558] CloseHandle (hObject=0x190) returned 1 [0093.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0093.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.559] lstrlenW (lpString=".doc") returned 4 [0093.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.559] lstrlenW (lpString=".docx") returned 5 [0093.559] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.559] lstrlenW (lpString=".pdf") returned 4 [0093.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.559] lstrlenW (lpString=".xls") returned 4 [0093.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.559] lstrlenW (lpString=".xlsx") returned 5 [0093.559] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.559] lstrlenW (lpString=".ppt") returned 4 [0093.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.559] lstrlenW (lpString=".zip") returned 4 [0093.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.559] lstrlenW (lpString=".rar") returned 4 [0093.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.559] lstrlenW (lpString=".bz2") returned 4 [0093.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.559] lstrlenW (lpString=".7z") returned 3 [0093.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.559] lstrlenW (lpString=".dbf") returned 4 [0093.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.560] lstrlenW (lpString=".1cd") returned 4 [0093.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0093.560] lstrlenW (lpString=".jpg") returned 4 [0093.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.560] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") [0093.560] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10164) returned 1 [0093.560] CloseHandle (hObject=0x190) returned 1 [0093.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 0x20 [0093.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.561] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.561] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.561] GetLastError () returned 0x0 [0093.561] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x27b4, lpOverlapped=0x0) returned 1 [0093.569] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0093.570] ReadFile (in: hFile=0x190, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.570] WriteFile (in: hFile=0x150, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.570] SetEndOfFile (hFile=0x150) returned 1 [0093.570] CloseHandle (hObject=0x150) returned 1 [0093.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.570] SetEndOfFile (hFile=0x190) returned 1 [0093.571] CloseHandle (hObject=0x190) returned 1 [0093.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString=".doc") returned 4 [0093.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString=".docx") returned 5 [0093.572] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.572] lstrlenW (lpString=".pdf") returned 4 [0093.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString=".xls") returned 4 [0093.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.572] lstrlenW (lpString=".xlsx") returned 5 [0093.572] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.572] lstrlenW (lpString=".ppt") returned 4 [0093.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString=".zip") returned 4 [0093.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.572] lstrlenW (lpString=".rar") returned 4 [0093.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString=".bz2") returned 4 [0093.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString=".7z") returned 3 [0093.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString=".dbf") returned 4 [0093.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString=".1cd") returned 4 [0093.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0093.572] lstrlenW (lpString=".jpg") returned 4 [0093.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.573] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") [0093.578] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8196) returned 1 [0093.578] CloseHandle (hObject=0x1f0) returned 1 [0093.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 0x20 [0093.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.578] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.579] GetLastError () returned 0x0 [0093.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2004, lpOverlapped=0x0) returned 1 [0093.581] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2010, lpOverlapped=0x0) returned 1 [0093.582] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.582] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.582] SetEndOfFile (hFile=0x1c0) returned 1 [0093.582] CloseHandle (hObject=0x1c0) returned 1 [0093.582] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.582] SetEndOfFile (hFile=0x1f0) returned 1 [0093.583] CloseHandle (hObject=0x1f0) returned 1 [0093.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.584] lstrlenW (lpString=".doc") returned 4 [0093.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString=".docx") returned 5 [0093.584] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0093.584] lstrlenW (lpString=".pdf") returned 4 [0093.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString=".xls") returned 4 [0093.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.584] lstrlenW (lpString=".xlsx") returned 5 [0093.584] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0093.584] lstrlenW (lpString=".ppt") returned 4 [0093.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.584] lstrlenW (lpString=".zip") returned 4 [0093.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.584] lstrlenW (lpString=".rar") returned 4 [0093.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString=".bz2") returned 4 [0093.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString=".7z") returned 3 [0093.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.584] lstrlenW (lpString=".dbf") returned 4 [0093.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.584] lstrlenW (lpString=".1cd") returned 4 [0093.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0093.585] lstrlenW (lpString=".jpg") returned 4 [0093.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.585] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") [0093.585] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5312) returned 1 [0093.585] CloseHandle (hObject=0x1f0) returned 1 [0093.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 0x20 [0093.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.585] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.585] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.586] GetLastError () returned 0x0 [0093.586] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x14c0, lpOverlapped=0x0) returned 1 [0093.588] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0093.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.589] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.589] SetEndOfFile (hFile=0x1c0) returned 1 [0093.589] CloseHandle (hObject=0x1c0) returned 1 [0093.589] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.589] SetEndOfFile (hFile=0x1f0) returned 1 [0093.590] CloseHandle (hObject=0x1f0) returned 1 [0093.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.590] lstrlenW (lpString=".doc") returned 4 [0093.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.590] lstrlenW (lpString=".docx") returned 5 [0093.590] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.590] lstrlenW (lpString=".pdf") returned 4 [0093.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.590] lstrlenW (lpString=".xls") returned 4 [0093.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.590] lstrlenW (lpString=".xlsx") returned 5 [0093.590] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.590] lstrlenW (lpString=".ppt") returned 4 [0093.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.591] lstrlenW (lpString=".zip") returned 4 [0093.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.591] lstrlenW (lpString=".rar") returned 4 [0093.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.591] lstrlenW (lpString=".bz2") returned 4 [0093.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.591] lstrlenW (lpString=".7z") returned 3 [0093.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.591] lstrlenW (lpString=".dbf") returned 4 [0093.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.591] lstrlenW (lpString=".1cd") returned 4 [0093.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0093.591] lstrlenW (lpString=".jpg") returned 4 [0093.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.591] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") [0093.591] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8060) returned 1 [0093.592] CloseHandle (hObject=0x1f0) returned 1 [0093.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 0x20 [0093.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.592] GetLastError () returned 0x0 [0093.593] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f7c, lpOverlapped=0x0) returned 1 [0093.594] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f80, lpOverlapped=0x0) returned 1 [0093.595] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0093.595] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.595] SetEndOfFile (hFile=0x1c0) returned 1 [0093.595] CloseHandle (hObject=0x1c0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.596] SetEndOfFile (hFile=0x1f0) returned 1 [0093.596] CloseHandle (hObject=0x1f0) returned 1 [0093.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0093.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.763] lstrlenW (lpString=".doc") returned 4 [0093.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.764] lstrlenW (lpString=".docx") returned 5 [0093.764] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.769] lstrlenW (lpString=".pdf") returned 4 [0093.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.769] lstrlenW (lpString=".xls") returned 4 [0093.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.769] lstrlenW (lpString=".xlsx") returned 5 [0093.769] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.769] lstrlenW (lpString=".ppt") returned 4 [0093.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.769] lstrlenW (lpString=".zip") returned 4 [0093.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.769] lstrlenW (lpString=".rar") returned 4 [0093.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.769] lstrlenW (lpString=".bz2") returned 4 [0093.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.770] lstrlenW (lpString=".7z") returned 3 [0093.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.770] lstrlenW (lpString=".dbf") returned 4 [0093.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.770] lstrlenW (lpString=".1cd") returned 4 [0093.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0093.770] lstrlenW (lpString=".jpg") returned 4 [0093.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.770] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") [0094.088] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31302) returned 1 [0094.088] CloseHandle (hObject=0x1f0) returned 1 [0094.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 0x20 [0094.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.090] GetLastError () returned 0x0 [0094.090] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7a46, lpOverlapped=0x0) returned 1 [0094.092] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7a50, lpOverlapped=0x0) returned 1 [0094.093] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.093] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.093] SetEndOfFile (hFile=0x1c8) returned 1 [0094.093] CloseHandle (hObject=0x1c8) returned 1 [0094.094] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.094] SetEndOfFile (hFile=0x1f0) returned 1 [0094.095] CloseHandle (hObject=0x1f0) returned 1 [0094.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0094.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.095] lstrlenW (lpString=".doc") returned 4 [0094.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.095] lstrlenW (lpString=".docx") returned 5 [0094.095] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.095] lstrlenW (lpString=".pdf") returned 4 [0094.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.095] lstrlenW (lpString=".xls") returned 4 [0094.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.095] lstrlenW (lpString=".xlsx") returned 5 [0094.095] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.095] lstrlenW (lpString=".ppt") returned 4 [0094.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.096] lstrlenW (lpString=".zip") returned 4 [0094.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.096] lstrlenW (lpString=".rar") returned 4 [0094.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.096] lstrlenW (lpString=".bz2") returned 4 [0094.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.096] lstrlenW (lpString=".7z") returned 3 [0094.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.096] lstrlenW (lpString=".dbf") returned 4 [0094.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.096] lstrlenW (lpString=".1cd") returned 4 [0094.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0094.096] lstrlenW (lpString=".jpg") returned 4 [0094.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.096] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") [0094.097] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31926) returned 1 [0094.097] CloseHandle (hObject=0x1f0) returned 1 [0094.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 0x20 [0094.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.098] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.098] GetLastError () returned 0x0 [0094.098] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7cb6, lpOverlapped=0x0) returned 1 [0094.101] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7cc0, lpOverlapped=0x0) returned 1 [0094.102] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.102] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.102] SetEndOfFile (hFile=0x1c8) returned 1 [0094.102] CloseHandle (hObject=0x1c8) returned 1 [0094.102] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.102] SetEndOfFile (hFile=0x1f0) returned 1 [0094.103] CloseHandle (hObject=0x1f0) returned 1 [0094.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 1 [0094.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.104] lstrlenW (lpString=".doc") returned 4 [0094.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.104] lstrlenW (lpString=".docx") returned 5 [0094.104] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0094.104] lstrlenW (lpString=".pdf") returned 4 [0094.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.104] lstrlenW (lpString=".xls") returned 4 [0094.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.104] lstrlenW (lpString=".xlsx") returned 5 [0094.104] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0094.104] lstrlenW (lpString=".ppt") returned 4 [0094.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.104] lstrlenW (lpString=".zip") returned 4 [0094.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.104] lstrlenW (lpString=".rar") returned 4 [0094.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.104] lstrlenW (lpString=".bz2") returned 4 [0094.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.104] lstrlenW (lpString=".7z") returned 3 [0094.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.105] lstrlenW (lpString=".dbf") returned 4 [0094.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.105] lstrlenW (lpString=".1cd") returned 4 [0094.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0094.105] lstrlenW (lpString=".jpg") returned 4 [0094.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.105] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") [0094.106] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=44794) returned 1 [0094.106] CloseHandle (hObject=0x1f0) returned 1 [0094.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 0x20 [0094.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.106] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.107] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.107] GetLastError () returned 0x0 [0094.107] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xaefa, lpOverlapped=0x0) returned 1 [0094.110] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xaf00, lpOverlapped=0x0) returned 1 [0094.111] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.111] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.111] SetEndOfFile (hFile=0x1c8) returned 1 [0094.111] CloseHandle (hObject=0x1c8) returned 1 [0094.111] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.112] SetEndOfFile (hFile=0x1f0) returned 1 [0094.112] CloseHandle (hObject=0x1f0) returned 1 [0094.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.113] lstrlenW (lpString=".doc") returned 4 [0094.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.113] lstrlenW (lpString=".docx") returned 5 [0094.113] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.113] lstrlenW (lpString=".pdf") returned 4 [0094.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.113] lstrlenW (lpString=".xls") returned 4 [0094.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.113] lstrlenW (lpString=".xlsx") returned 5 [0094.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.113] lstrlenW (lpString=".ppt") returned 4 [0094.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.113] lstrlenW (lpString=".zip") returned 4 [0094.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.113] lstrlenW (lpString=".rar") returned 4 [0094.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.114] lstrlenW (lpString=".bz2") returned 4 [0094.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.114] lstrlenW (lpString=".7z") returned 3 [0094.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.114] lstrlenW (lpString=".dbf") returned 4 [0094.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.114] lstrlenW (lpString=".1cd") returned 4 [0094.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0094.114] lstrlenW (lpString=".jpg") returned 4 [0094.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.114] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") [0094.115] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11628) returned 1 [0094.115] CloseHandle (hObject=0x1f0) returned 1 [0094.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 0x20 [0094.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.115] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.115] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.116] GetLastError () returned 0x0 [0094.116] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2d6c, lpOverlapped=0x0) returned 1 [0094.118] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2d70, lpOverlapped=0x0) returned 1 [0094.119] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.119] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.119] SetEndOfFile (hFile=0x1c8) returned 1 [0094.119] CloseHandle (hObject=0x1c8) returned 1 [0094.119] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.119] SetEndOfFile (hFile=0x1f0) returned 1 [0094.120] CloseHandle (hObject=0x1f0) returned 1 [0094.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0094.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.120] lstrlenW (lpString=".doc") returned 4 [0094.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.120] lstrlenW (lpString=".docx") returned 5 [0094.121] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.121] lstrlenW (lpString=".pdf") returned 4 [0094.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString=".xls") returned 4 [0094.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.121] lstrlenW (lpString=".xlsx") returned 5 [0094.121] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.121] lstrlenW (lpString=".ppt") returned 4 [0094.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.121] lstrlenW (lpString=".zip") returned 4 [0094.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.121] lstrlenW (lpString=".rar") returned 4 [0094.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString=".bz2") returned 4 [0094.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString=".7z") returned 3 [0094.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.121] lstrlenW (lpString=".dbf") returned 4 [0094.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.121] lstrlenW (lpString=".1cd") returned 4 [0094.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0094.121] lstrlenW (lpString=".jpg") returned 4 [0094.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.121] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") [0094.122] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8016) returned 1 [0094.122] CloseHandle (hObject=0x1f0) returned 1 [0094.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 0x20 [0094.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.122] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.122] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.123] GetLastError () returned 0x0 [0094.123] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f50, lpOverlapped=0x0) returned 1 [0094.204] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f60, lpOverlapped=0x0) returned 1 [0094.205] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.205] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.205] SetEndOfFile (hFile=0x1c8) returned 1 [0094.301] CloseHandle (hObject=0x1c8) returned 1 [0094.301] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.301] SetEndOfFile (hFile=0x1f0) returned 1 [0094.345] CloseHandle (hObject=0x1f0) returned 1 [0094.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0094.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.473] lstrlenW (lpString=".doc") returned 4 [0094.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.473] lstrlenW (lpString=".docx") returned 5 [0094.473] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0094.473] lstrlenW (lpString=".pdf") returned 4 [0094.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.473] lstrlenW (lpString=".xls") returned 4 [0094.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.473] lstrlenW (lpString=".xlsx") returned 5 [0094.473] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0094.473] lstrlenW (lpString=".ppt") returned 4 [0094.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.473] lstrlenW (lpString=".zip") returned 4 [0094.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.473] lstrlenW (lpString=".rar") returned 4 [0094.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.473] lstrlenW (lpString=".bz2") returned 4 [0094.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.473] lstrlenW (lpString=".7z") returned 3 [0094.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.473] lstrlenW (lpString=".dbf") returned 4 [0094.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.474] lstrlenW (lpString=".1cd") returned 4 [0094.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0094.474] lstrlenW (lpString=".jpg") returned 4 [0094.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.474] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") [0094.474] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24796) returned 1 [0094.474] CloseHandle (hObject=0x15c) returned 1 [0094.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 0x20 [0094.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.475] GetLastError () returned 0x0 [0094.476] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x60dc, lpOverlapped=0x0) returned 1 [0094.561] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x60e0, lpOverlapped=0x0) returned 1 [0094.563] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.563] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.563] SetEndOfFile (hFile=0x1f4) returned 1 [0094.563] CloseHandle (hObject=0x1f4) returned 1 [0094.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.563] SetEndOfFile (hFile=0x15c) returned 1 [0094.564] CloseHandle (hObject=0x15c) returned 1 [0094.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 1 [0094.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.571] lstrlenW (lpString=".doc") returned 4 [0094.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString=".docx") returned 5 [0094.572] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.572] lstrlenW (lpString=".pdf") returned 4 [0094.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString=".xls") returned 4 [0094.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.572] lstrlenW (lpString=".xlsx") returned 5 [0094.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.572] lstrlenW (lpString=".ppt") returned 4 [0094.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.572] lstrlenW (lpString=".zip") returned 4 [0094.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.572] lstrlenW (lpString=".rar") returned 4 [0094.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString=".bz2") returned 4 [0094.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString=".7z") returned 3 [0094.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.572] lstrlenW (lpString=".dbf") returned 4 [0094.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.572] lstrlenW (lpString=".1cd") returned 4 [0094.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0094.573] lstrlenW (lpString=".jpg") returned 4 [0094.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.573] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") [0094.573] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26022) returned 1 [0094.573] CloseHandle (hObject=0x15c) returned 1 [0094.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 0x20 [0094.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.573] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.574] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.574] GetLastError () returned 0x0 [0094.574] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x65a6, lpOverlapped=0x0) returned 1 [0094.576] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x65b0, lpOverlapped=0x0) returned 1 [0094.577] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.578] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.578] SetEndOfFile (hFile=0x1f4) returned 1 [0094.578] CloseHandle (hObject=0x1f4) returned 1 [0094.578] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.578] SetEndOfFile (hFile=0x15c) returned 1 [0094.579] CloseHandle (hObject=0x15c) returned 1 [0094.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 1 [0094.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.579] lstrlenW (lpString=".doc") returned 4 [0094.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.579] lstrlenW (lpString=".docx") returned 5 [0094.580] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.580] lstrlenW (lpString=".pdf") returned 4 [0094.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString=".xls") returned 4 [0094.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.580] lstrlenW (lpString=".xlsx") returned 5 [0094.580] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.580] lstrlenW (lpString=".ppt") returned 4 [0094.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.580] lstrlenW (lpString=".zip") returned 4 [0094.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.580] lstrlenW (lpString=".rar") returned 4 [0094.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString=".bz2") returned 4 [0094.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString=".7z") returned 3 [0094.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.580] lstrlenW (lpString=".dbf") returned 4 [0094.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.580] lstrlenW (lpString=".1cd") returned 4 [0094.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0094.580] lstrlenW (lpString=".jpg") returned 4 [0094.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.580] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") [0094.581] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=37260) returned 1 [0094.581] CloseHandle (hObject=0x15c) returned 1 [0094.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 0x20 [0094.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.581] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.581] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.582] GetLastError () returned 0x0 [0094.582] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x918c, lpOverlapped=0x0) returned 1 [0094.584] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x9190, lpOverlapped=0x0) returned 1 [0094.586] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.586] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.586] SetEndOfFile (hFile=0x1f4) returned 1 [0094.586] CloseHandle (hObject=0x1f4) returned 1 [0094.586] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.586] SetEndOfFile (hFile=0x15c) returned 1 [0094.590] CloseHandle (hObject=0x15c) returned 1 [0094.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 1 [0094.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.590] lstrlenW (lpString=".doc") returned 4 [0094.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.590] lstrlenW (lpString=".docx") returned 5 [0094.590] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.590] lstrlenW (lpString=".pdf") returned 4 [0094.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.590] lstrlenW (lpString=".xls") returned 4 [0094.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.590] lstrlenW (lpString=".xlsx") returned 5 [0094.590] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.590] lstrlenW (lpString=".ppt") returned 4 [0094.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.591] lstrlenW (lpString=".zip") returned 4 [0094.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.591] lstrlenW (lpString=".rar") returned 4 [0094.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.591] lstrlenW (lpString=".bz2") returned 4 [0094.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.591] lstrlenW (lpString=".7z") returned 3 [0094.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.591] lstrlenW (lpString=".dbf") returned 4 [0094.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.591] lstrlenW (lpString=".1cd") returned 4 [0094.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0094.591] lstrlenW (lpString=".jpg") returned 4 [0094.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.591] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") [0094.642] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7594) returned 1 [0094.642] CloseHandle (hObject=0x1f4) returned 1 [0094.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 0x20 [0094.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.642] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.642] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.643] GetLastError () returned 0x0 [0094.643] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1daa, lpOverlapped=0x0) returned 1 [0094.651] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1db0, lpOverlapped=0x0) returned 1 [0094.652] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.652] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.652] SetEndOfFile (hFile=0x180) returned 1 [0094.652] CloseHandle (hObject=0x180) returned 1 [0094.652] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.652] SetEndOfFile (hFile=0x1f4) returned 1 [0094.653] CloseHandle (hObject=0x1f4) returned 1 [0094.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString=".doc") returned 4 [0094.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString=".docx") returned 5 [0094.654] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.654] lstrlenW (lpString=".pdf") returned 4 [0094.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString=".xls") returned 4 [0094.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.654] lstrlenW (lpString=".xlsx") returned 5 [0094.654] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.654] lstrlenW (lpString=".ppt") returned 4 [0094.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString=".zip") returned 4 [0094.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.654] lstrlenW (lpString=".rar") returned 4 [0094.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString=".bz2") returned 4 [0094.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString=".7z") returned 3 [0094.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString=".dbf") returned 4 [0094.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString=".1cd") returned 4 [0094.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0094.654] lstrlenW (lpString=".jpg") returned 4 [0094.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.655] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") [0094.655] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=41094) returned 1 [0094.655] CloseHandle (hObject=0x1f4) returned 1 [0094.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 0x20 [0094.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.655] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.656] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.822] GetLastError () returned 0x0 [0094.822] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa086, lpOverlapped=0x0) returned 1 [0094.849] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa090, lpOverlapped=0x0) returned 1 [0094.850] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.850] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.851] SetEndOfFile (hFile=0x180) returned 1 [0094.851] CloseHandle (hObject=0x180) returned 1 [0094.851] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.851] SetEndOfFile (hFile=0x1f4) returned 1 [0094.852] CloseHandle (hObject=0x1f4) returned 1 [0094.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.852] lstrlenW (lpString=".doc") returned 4 [0094.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.852] lstrlenW (lpString=".docx") returned 5 [0094.852] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.852] lstrlenW (lpString=".pdf") returned 4 [0094.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.852] lstrlenW (lpString=".xls") returned 4 [0094.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.852] lstrlenW (lpString=".xlsx") returned 5 [0094.852] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.853] lstrlenW (lpString=".ppt") returned 4 [0094.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.853] lstrlenW (lpString=".zip") returned 4 [0094.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.853] lstrlenW (lpString=".rar") returned 4 [0094.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.853] lstrlenW (lpString=".bz2") returned 4 [0094.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.853] lstrlenW (lpString=".7z") returned 3 [0094.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.853] lstrlenW (lpString=".dbf") returned 4 [0094.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.853] lstrlenW (lpString=".1cd") returned 4 [0094.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 63 [0094.853] lstrlenW (lpString=".jpg") returned 4 [0094.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.853] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") [0094.854] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24770) returned 1 [0094.854] CloseHandle (hObject=0x1f4) returned 1 [0094.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 0x20 [0094.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.854] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.854] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.855] GetLastError () returned 0x0 [0094.855] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x60c2, lpOverlapped=0x0) returned 1 [0094.859] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0094.860] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.860] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.861] SetEndOfFile (hFile=0x180) returned 1 [0094.861] CloseHandle (hObject=0x180) returned 1 [0094.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.861] SetEndOfFile (hFile=0x1f4) returned 1 [0094.862] CloseHandle (hObject=0x1f4) returned 1 [0094.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 1 [0094.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.862] lstrlenW (lpString=".doc") returned 4 [0094.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.862] lstrlenW (lpString=".docx") returned 5 [0094.862] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0094.862] lstrlenW (lpString=".pdf") returned 4 [0094.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.862] lstrlenW (lpString=".xls") returned 4 [0094.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.862] lstrlenW (lpString=".xlsx") returned 5 [0094.862] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0094.862] lstrlenW (lpString=".ppt") returned 4 [0094.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.862] lstrlenW (lpString=".zip") returned 4 [0094.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.863] lstrlenW (lpString=".rar") returned 4 [0094.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.863] lstrlenW (lpString=".bz2") returned 4 [0094.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.863] lstrlenW (lpString=".7z") returned 3 [0094.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.863] lstrlenW (lpString=".dbf") returned 4 [0094.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.863] lstrlenW (lpString=".1cd") returned 4 [0094.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 63 [0094.863] lstrlenW (lpString=".jpg") returned 4 [0094.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.863] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") [0094.863] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20926) returned 1 [0094.864] CloseHandle (hObject=0x1f4) returned 1 [0094.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 0x20 [0094.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.864] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.864] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.864] GetLastError () returned 0x0 [0094.864] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x51be, lpOverlapped=0x0) returned 1 [0094.866] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x51c0, lpOverlapped=0x0) returned 1 [0094.868] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.868] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.868] SetEndOfFile (hFile=0x180) returned 1 [0094.868] CloseHandle (hObject=0x180) returned 1 [0094.868] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.868] SetEndOfFile (hFile=0x1f4) returned 1 [0094.869] CloseHandle (hObject=0x1f4) returned 1 [0094.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 1 [0094.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.869] lstrlenW (lpString=".doc") returned 4 [0094.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.869] lstrlenW (lpString=".docx") returned 5 [0094.869] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.870] lstrlenW (lpString=".pdf") returned 4 [0094.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString=".xls") returned 4 [0094.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.870] lstrlenW (lpString=".xlsx") returned 5 [0094.870] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.870] lstrlenW (lpString=".ppt") returned 4 [0094.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.870] lstrlenW (lpString=".zip") returned 4 [0094.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.870] lstrlenW (lpString=".rar") returned 4 [0094.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString=".bz2") returned 4 [0094.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString=".7z") returned 3 [0094.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.870] lstrlenW (lpString=".dbf") returned 4 [0094.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.870] lstrlenW (lpString=".1cd") returned 4 [0094.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 63 [0094.870] lstrlenW (lpString=".jpg") returned 4 [0094.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.870] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") [0094.871] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=22944) returned 1 [0094.871] CloseHandle (hObject=0x1f4) returned 1 [0094.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 0x20 [0094.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.871] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.871] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.872] GetLastError () returned 0x0 [0094.872] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x59a0, lpOverlapped=0x0) returned 1 [0094.874] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x59b0, lpOverlapped=0x0) returned 1 [0094.875] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.875] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.875] SetEndOfFile (hFile=0x180) returned 1 [0094.875] CloseHandle (hObject=0x180) returned 1 [0094.875] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.876] SetEndOfFile (hFile=0x1f4) returned 1 [0094.876] CloseHandle (hObject=0x1f4) returned 1 [0094.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 1 [0094.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.877] lstrlenW (lpString=".doc") returned 4 [0094.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.877] lstrlenW (lpString=".docx") returned 5 [0094.877] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.877] lstrlenW (lpString=".pdf") returned 4 [0094.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.877] lstrlenW (lpString=".xls") returned 4 [0094.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.877] lstrlenW (lpString=".xlsx") returned 5 [0094.877] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.877] lstrlenW (lpString=".ppt") returned 4 [0094.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.877] lstrlenW (lpString=".zip") returned 4 [0094.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.877] lstrlenW (lpString=".rar") returned 4 [0094.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.877] lstrlenW (lpString=".bz2") returned 4 [0094.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.877] lstrlenW (lpString=".7z") returned 3 [0094.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.877] lstrlenW (lpString=".dbf") returned 4 [0094.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.878] lstrlenW (lpString=".1cd") returned 4 [0094.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 63 [0094.878] lstrlenW (lpString=".jpg") returned 4 [0094.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.878] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") [0094.878] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4916) returned 1 [0094.878] CloseHandle (hObject=0x1f4) returned 1 [0094.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 0x20 [0094.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.879] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.879] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.879] GetLastError () returned 0x0 [0094.879] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1334, lpOverlapped=0x0) returned 1 [0094.889] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1340, lpOverlapped=0x0) returned 1 [0094.890] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.890] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.890] SetEndOfFile (hFile=0x180) returned 1 [0094.891] CloseHandle (hObject=0x180) returned 1 [0094.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.891] SetEndOfFile (hFile=0x1f4) returned 1 [0094.891] CloseHandle (hObject=0x1f4) returned 1 [0094.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 1 [0094.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.892] lstrlenW (lpString=".doc") returned 4 [0094.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.892] lstrlenW (lpString=".docx") returned 5 [0094.892] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0094.892] lstrlenW (lpString=".pdf") returned 4 [0094.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.892] lstrlenW (lpString=".xls") returned 4 [0094.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.892] lstrlenW (lpString=".xlsx") returned 5 [0094.892] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0094.892] lstrlenW (lpString=".ppt") returned 4 [0094.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.892] lstrlenW (lpString=".zip") returned 4 [0094.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.892] lstrlenW (lpString=".rar") returned 4 [0094.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.892] lstrlenW (lpString=".bz2") returned 4 [0094.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.892] lstrlenW (lpString=".7z") returned 3 [0094.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.892] lstrlenW (lpString=".dbf") returned 4 [0094.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.893] lstrlenW (lpString=".1cd") returned 4 [0094.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 63 [0094.893] lstrlenW (lpString=".jpg") returned 4 [0094.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.893] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") [0094.893] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7484) returned 1 [0094.893] CloseHandle (hObject=0x1f4) returned 1 [0094.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 0x20 [0094.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0094.894] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.894] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.895] GetLastError () returned 0x0 [0094.895] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1d3c, lpOverlapped=0x0) returned 1 [0095.023] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1d40, lpOverlapped=0x0) returned 1 [0095.038] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.038] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.038] SetEndOfFile (hFile=0x180) returned 1 [0095.038] CloseHandle (hObject=0x180) returned 1 [0095.038] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.038] SetEndOfFile (hFile=0x1f4) returned 1 [0095.039] CloseHandle (hObject=0x1f4) returned 1 [0095.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 1 [0095.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.039] lstrlenW (lpString=".doc") returned 4 [0095.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.039] lstrlenW (lpString=".docx") returned 5 [0095.039] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.039] lstrlenW (lpString=".pdf") returned 4 [0095.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.039] lstrlenW (lpString=".xls") returned 4 [0095.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.039] lstrlenW (lpString=".xlsx") returned 5 [0095.039] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.039] lstrlenW (lpString=".ppt") returned 4 [0095.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.040] lstrlenW (lpString=".zip") returned 4 [0095.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.040] lstrlenW (lpString=".rar") returned 4 [0095.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.040] lstrlenW (lpString=".bz2") returned 4 [0095.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.040] lstrlenW (lpString=".7z") returned 3 [0095.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.040] lstrlenW (lpString=".dbf") returned 4 [0095.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.040] lstrlenW (lpString=".1cd") returned 4 [0095.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 63 [0095.040] lstrlenW (lpString=".jpg") returned 4 [0095.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.040] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") [0095.041] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3288) returned 1 [0095.041] CloseHandle (hObject=0x1f4) returned 1 [0095.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 0x20 [0095.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.041] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.041] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.042] GetLastError () returned 0x0 [0095.042] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xcd8, lpOverlapped=0x0) returned 1 [0095.043] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xce0, lpOverlapped=0x0) returned 1 [0095.046] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.046] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.046] SetEndOfFile (hFile=0x180) returned 1 [0095.047] CloseHandle (hObject=0x180) returned 1 [0095.047] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.047] SetEndOfFile (hFile=0x1f4) returned 1 [0095.047] CloseHandle (hObject=0x1f4) returned 1 [0095.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 1 [0095.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.048] lstrlenW (lpString=".doc") returned 4 [0095.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.048] lstrlenW (lpString=".docx") returned 5 [0095.048] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.048] lstrlenW (lpString=".pdf") returned 4 [0095.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.048] lstrlenW (lpString=".xls") returned 4 [0095.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.048] lstrlenW (lpString=".xlsx") returned 5 [0095.048] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.048] lstrlenW (lpString=".ppt") returned 4 [0095.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.048] lstrlenW (lpString=".zip") returned 4 [0095.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.048] lstrlenW (lpString=".rar") returned 4 [0095.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.048] lstrlenW (lpString=".bz2") returned 4 [0095.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.048] lstrlenW (lpString=".7z") returned 3 [0095.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.048] lstrlenW (lpString=".dbf") returned 4 [0095.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.049] lstrlenW (lpString=".1cd") returned 4 [0095.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 63 [0095.049] lstrlenW (lpString=".jpg") returned 4 [0095.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.049] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") [0095.050] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7672) returned 1 [0095.050] CloseHandle (hObject=0x1f4) returned 1 [0095.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 0x20 [0095.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.050] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.050] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.051] GetLastError () returned 0x0 [0095.051] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1df8, lpOverlapped=0x0) returned 1 [0095.053] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0095.054] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.054] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.054] SetEndOfFile (hFile=0x180) returned 1 [0095.054] CloseHandle (hObject=0x180) returned 1 [0095.054] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.054] SetEndOfFile (hFile=0x1f4) returned 1 [0095.055] CloseHandle (hObject=0x1f4) returned 1 [0095.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 1 [0095.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.055] lstrlenW (lpString=".doc") returned 4 [0095.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.055] lstrlenW (lpString=".docx") returned 5 [0095.055] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.055] lstrlenW (lpString=".pdf") returned 4 [0095.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.055] lstrlenW (lpString=".xls") returned 4 [0095.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.055] lstrlenW (lpString=".xlsx") returned 5 [0095.055] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.055] lstrlenW (lpString=".ppt") returned 4 [0095.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.056] lstrlenW (lpString=".zip") returned 4 [0095.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.056] lstrlenW (lpString=".rar") returned 4 [0095.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.056] lstrlenW (lpString=".bz2") returned 4 [0095.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.056] lstrlenW (lpString=".7z") returned 3 [0095.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.056] lstrlenW (lpString=".dbf") returned 4 [0095.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.056] lstrlenW (lpString=".1cd") returned 4 [0095.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 63 [0095.056] lstrlenW (lpString=".jpg") returned 4 [0095.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.056] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") [0095.057] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=42000) returned 1 [0095.057] CloseHandle (hObject=0x1f4) returned 1 [0095.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 0x20 [0095.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.057] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.057] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.058] GetLastError () returned 0x0 [0095.058] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa410, lpOverlapped=0x0) returned 1 [0095.060] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa420, lpOverlapped=0x0) returned 1 [0095.062] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.062] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.062] SetEndOfFile (hFile=0x180) returned 1 [0095.062] CloseHandle (hObject=0x180) returned 1 [0095.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.062] SetEndOfFile (hFile=0x1f4) returned 1 [0095.063] CloseHandle (hObject=0x1f4) returned 1 [0095.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 1 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString=".doc") returned 4 [0095.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString=".docx") returned 5 [0095.064] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0095.064] lstrlenW (lpString=".pdf") returned 4 [0095.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString=".xls") returned 4 [0095.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.064] lstrlenW (lpString=".xlsx") returned 5 [0095.064] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0095.064] lstrlenW (lpString=".ppt") returned 4 [0095.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString=".zip") returned 4 [0095.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.064] lstrlenW (lpString=".rar") returned 4 [0095.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString=".bz2") returned 4 [0095.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString=".7z") returned 3 [0095.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString=".dbf") returned 4 [0095.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString=".1cd") returned 4 [0095.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 63 [0095.064] lstrlenW (lpString=".jpg") returned 4 [0095.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.065] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") [0095.065] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3524) returned 1 [0095.065] CloseHandle (hObject=0x1f4) returned 1 [0095.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 0x20 [0095.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.066] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.066] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.066] GetLastError () returned 0x0 [0095.066] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xdc4, lpOverlapped=0x0) returned 1 [0095.068] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0095.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.069] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.069] SetEndOfFile (hFile=0x180) returned 1 [0095.069] CloseHandle (hObject=0x180) returned 1 [0095.069] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.069] SetEndOfFile (hFile=0x1f4) returned 1 [0095.070] CloseHandle (hObject=0x1f4) returned 1 [0095.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 1 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString=".doc") returned 4 [0095.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString=".docx") returned 5 [0095.071] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0095.071] lstrlenW (lpString=".pdf") returned 4 [0095.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString=".xls") returned 4 [0095.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.071] lstrlenW (lpString=".xlsx") returned 5 [0095.071] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0095.071] lstrlenW (lpString=".ppt") returned 4 [0095.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString=".zip") returned 4 [0095.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.071] lstrlenW (lpString=".rar") returned 4 [0095.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString=".bz2") returned 4 [0095.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString=".7z") returned 3 [0095.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString=".dbf") returned 4 [0095.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString=".1cd") returned 4 [0095.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 63 [0095.071] lstrlenW (lpString=".jpg") returned 4 [0095.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.071] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") [0095.072] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5238) returned 1 [0095.072] CloseHandle (hObject=0x1f4) returned 1 [0095.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 0x20 [0095.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.072] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.073] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.073] GetLastError () returned 0x0 [0095.073] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1476, lpOverlapped=0x0) returned 1 [0095.120] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1480, lpOverlapped=0x0) returned 1 [0095.121] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.121] WriteFile (in: hFile=0x180, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.121] SetEndOfFile (hFile=0x180) returned 1 [0095.126] CloseHandle (hObject=0x180) returned 1 [0095.127] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.127] SetEndOfFile (hFile=0x1f4) returned 1 [0095.127] CloseHandle (hObject=0x1f4) returned 1 [0095.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 1 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.166] lstrlenW (lpString=".doc") returned 4 [0095.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString=".docx") returned 5 [0095.166] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0095.166] lstrlenW (lpString=".pdf") returned 4 [0095.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString=".xls") returned 4 [0095.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.166] lstrlenW (lpString=".xlsx") returned 5 [0095.166] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0095.166] lstrlenW (lpString=".ppt") returned 4 [0095.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.166] lstrlenW (lpString=".zip") returned 4 [0095.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.166] lstrlenW (lpString=".rar") returned 4 [0095.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString=".bz2") returned 4 [0095.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString=".7z") returned 3 [0095.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.166] lstrlenW (lpString=".dbf") returned 4 [0095.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.166] lstrlenW (lpString=".1cd") returned 4 [0095.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 63 [0095.167] lstrlenW (lpString=".jpg") returned 4 [0095.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.167] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") [0095.370] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26968) returned 1 [0095.370] CloseHandle (hObject=0x1f4) returned 1 [0095.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 0x20 [0095.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.371] GetLastError () returned 0x0 [0095.371] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6958, lpOverlapped=0x0) returned 1 [0095.374] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6960, lpOverlapped=0x0) returned 1 [0095.375] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.375] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.375] SetEndOfFile (hFile=0x210) returned 1 [0095.375] CloseHandle (hObject=0x210) returned 1 [0095.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.375] SetEndOfFile (hFile=0x1f4) returned 1 [0095.376] CloseHandle (hObject=0x1f4) returned 1 [0095.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString=".doc") returned 4 [0095.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString=".docx") returned 5 [0095.377] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.377] lstrlenW (lpString=".pdf") returned 4 [0095.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString=".xls") returned 4 [0095.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.377] lstrlenW (lpString=".xlsx") returned 5 [0095.377] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.377] lstrlenW (lpString=".ppt") returned 4 [0095.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString=".zip") returned 4 [0095.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.377] lstrlenW (lpString=".rar") returned 4 [0095.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString=".bz2") returned 4 [0095.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString=".7z") returned 3 [0095.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString=".dbf") returned 4 [0095.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString=".1cd") returned 4 [0095.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 63 [0095.377] lstrlenW (lpString=".jpg") returned 4 [0095.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.378] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") [0095.379] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=33126) returned 1 [0095.379] CloseHandle (hObject=0x1f4) returned 1 [0095.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 0x20 [0095.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.379] GetLastError () returned 0x0 [0095.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8166, lpOverlapped=0x0) returned 1 [0095.382] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8170, lpOverlapped=0x0) returned 1 [0095.383] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.383] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.383] SetEndOfFile (hFile=0x210) returned 1 [0095.384] CloseHandle (hObject=0x210) returned 1 [0095.384] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.384] SetEndOfFile (hFile=0x1f4) returned 1 [0095.385] CloseHandle (hObject=0x1f4) returned 1 [0095.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 1 [0095.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.385] lstrlenW (lpString=".doc") returned 4 [0095.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.385] lstrlenW (lpString=".docx") returned 5 [0095.385] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.385] lstrlenW (lpString=".pdf") returned 4 [0095.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.385] lstrlenW (lpString=".xls") returned 4 [0095.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.385] lstrlenW (lpString=".xlsx") returned 5 [0095.385] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.385] lstrlenW (lpString=".ppt") returned 4 [0095.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.385] lstrlenW (lpString=".zip") returned 4 [0095.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.386] lstrlenW (lpString=".rar") returned 4 [0095.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.386] lstrlenW (lpString=".bz2") returned 4 [0095.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.386] lstrlenW (lpString=".7z") returned 3 [0095.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.386] lstrlenW (lpString=".dbf") returned 4 [0095.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.386] lstrlenW (lpString=".1cd") returned 4 [0095.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 63 [0095.386] lstrlenW (lpString=".jpg") returned 4 [0095.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.386] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") [0095.387] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14080) returned 1 [0095.387] CloseHandle (hObject=0x1f4) returned 1 [0095.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 0x20 [0095.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.387] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.387] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.387] GetLastError () returned 0x0 [0095.388] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3700, lpOverlapped=0x0) returned 1 [0095.390] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3710, lpOverlapped=0x0) returned 1 [0095.391] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.391] SetEndOfFile (hFile=0x210) returned 1 [0095.391] CloseHandle (hObject=0x210) returned 1 [0095.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.391] SetEndOfFile (hFile=0x1f4) returned 1 [0095.392] CloseHandle (hObject=0x1f4) returned 1 [0095.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 1 [0095.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.392] lstrlenW (lpString=".doc") returned 4 [0095.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString=".docx") returned 5 [0095.393] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.393] lstrlenW (lpString=".pdf") returned 4 [0095.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString=".xls") returned 4 [0095.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.393] lstrlenW (lpString=".xlsx") returned 5 [0095.393] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.393] lstrlenW (lpString=".ppt") returned 4 [0095.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.393] lstrlenW (lpString=".zip") returned 4 [0095.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.393] lstrlenW (lpString=".rar") returned 4 [0095.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString=".bz2") returned 4 [0095.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString=".7z") returned 3 [0095.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.393] lstrlenW (lpString=".dbf") returned 4 [0095.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.393] lstrlenW (lpString=".1cd") returned 4 [0095.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 63 [0095.393] lstrlenW (lpString=".jpg") returned 4 [0095.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.393] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") [0095.394] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14474) returned 1 [0095.394] CloseHandle (hObject=0x1f4) returned 1 [0095.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 0x20 [0095.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.395] GetLastError () returned 0x0 [0095.395] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x388a, lpOverlapped=0x0) returned 1 [0095.396] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3890, lpOverlapped=0x0) returned 1 [0095.398] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.398] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.398] SetEndOfFile (hFile=0x210) returned 1 [0095.398] CloseHandle (hObject=0x210) returned 1 [0095.398] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] SetEndOfFile (hFile=0x1f4) returned 1 [0095.399] CloseHandle (hObject=0x1f4) returned 1 [0095.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 1 [0095.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.399] lstrlenW (lpString=".doc") returned 4 [0095.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.399] lstrlenW (lpString=".docx") returned 5 [0095.399] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.399] lstrlenW (lpString=".pdf") returned 4 [0095.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.399] lstrlenW (lpString=".xls") returned 4 [0095.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.399] lstrlenW (lpString=".xlsx") returned 5 [0095.399] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.399] lstrlenW (lpString=".ppt") returned 4 [0095.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.400] lstrlenW (lpString=".zip") returned 4 [0095.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.400] lstrlenW (lpString=".rar") returned 4 [0095.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.400] lstrlenW (lpString=".bz2") returned 4 [0095.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.400] lstrlenW (lpString=".7z") returned 3 [0095.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.400] lstrlenW (lpString=".dbf") returned 4 [0095.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.400] lstrlenW (lpString=".1cd") returned 4 [0095.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 63 [0095.400] lstrlenW (lpString=".jpg") returned 4 [0095.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.400] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") [0095.400] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9280) returned 1 [0095.401] CloseHandle (hObject=0x1f4) returned 1 [0095.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 0x20 [0095.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.401] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.401] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.401] GetLastError () returned 0x0 [0095.401] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2440, lpOverlapped=0x0) returned 1 [0095.403] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2450, lpOverlapped=0x0) returned 1 [0095.404] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.404] SetEndOfFile (hFile=0x210) returned 1 [0095.404] CloseHandle (hObject=0x210) returned 1 [0095.404] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.404] SetEndOfFile (hFile=0x1f4) returned 1 [0095.405] CloseHandle (hObject=0x1f4) returned 1 [0095.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.406] lstrlenW (lpString=".doc") returned 4 [0095.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString=".docx") returned 5 [0095.406] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0095.406] lstrlenW (lpString=".pdf") returned 4 [0095.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString=".xls") returned 4 [0095.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.406] lstrlenW (lpString=".xlsx") returned 5 [0095.406] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0095.406] lstrlenW (lpString=".ppt") returned 4 [0095.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.406] lstrlenW (lpString=".zip") returned 4 [0095.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.406] lstrlenW (lpString=".rar") returned 4 [0095.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString=".bz2") returned 4 [0095.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString=".7z") returned 3 [0095.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.407] lstrlenW (lpString=".dbf") returned 4 [0095.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.407] lstrlenW (lpString=".1cd") returned 4 [0095.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 63 [0095.407] lstrlenW (lpString=".jpg") returned 4 [0095.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.407] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") [0095.407] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31068) returned 1 [0095.407] CloseHandle (hObject=0x1f4) returned 1 [0095.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 0x20 [0095.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.408] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.408] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.408] GetLastError () returned 0x0 [0095.408] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x795c, lpOverlapped=0x0) returned 1 [0095.427] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7960, lpOverlapped=0x0) returned 1 [0095.428] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.428] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.429] SetEndOfFile (hFile=0x210) returned 1 [0095.524] CloseHandle (hObject=0x210) returned 1 [0095.524] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.524] SetEndOfFile (hFile=0x1f4) returned 1 [0095.545] CloseHandle (hObject=0x1f4) returned 1 [0095.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 1 [0095.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.728] lstrlenW (lpString=".doc") returned 4 [0095.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.728] lstrlenW (lpString=".docx") returned 5 [0095.728] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0095.728] lstrlenW (lpString=".pdf") returned 4 [0095.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.728] lstrlenW (lpString=".xls") returned 4 [0095.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.728] lstrlenW (lpString=".xlsx") returned 5 [0095.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0095.729] lstrlenW (lpString=".ppt") returned 4 [0095.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.729] lstrlenW (lpString=".zip") returned 4 [0095.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.729] lstrlenW (lpString=".rar") returned 4 [0095.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.729] lstrlenW (lpString=".bz2") returned 4 [0095.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.729] lstrlenW (lpString=".7z") returned 3 [0095.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.729] lstrlenW (lpString=".dbf") returned 4 [0095.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.729] lstrlenW (lpString=".1cd") returned 4 [0095.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 63 [0095.729] lstrlenW (lpString=".jpg") returned 4 [0095.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.729] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") [0095.745] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9204) returned 1 [0095.745] CloseHandle (hObject=0x180) returned 1 [0095.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 0x20 [0095.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.746] GetLastError () returned 0x0 [0095.746] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x23f4, lpOverlapped=0x0) returned 1 [0095.813] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2400, lpOverlapped=0x0) returned 1 [0095.814] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.814] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.814] SetEndOfFile (hFile=0x22c) returned 1 [0095.814] CloseHandle (hObject=0x22c) returned 1 [0095.814] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.814] SetEndOfFile (hFile=0x180) returned 1 [0095.815] CloseHandle (hObject=0x180) returned 1 [0095.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 1 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString=".doc") returned 4 [0095.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString=".docx") returned 5 [0095.816] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.816] lstrlenW (lpString=".pdf") returned 4 [0095.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString=".xls") returned 4 [0095.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.816] lstrlenW (lpString=".xlsx") returned 5 [0095.816] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.816] lstrlenW (lpString=".ppt") returned 4 [0095.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString=".zip") returned 4 [0095.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.816] lstrlenW (lpString=".rar") returned 4 [0095.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString=".bz2") returned 4 [0095.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString=".7z") returned 3 [0095.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString=".dbf") returned 4 [0095.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString=".1cd") returned 4 [0095.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 63 [0095.816] lstrlenW (lpString=".jpg") returned 4 [0095.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.817] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") [0095.817] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8720) returned 1 [0095.817] CloseHandle (hObject=0x180) returned 1 [0095.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 0x20 [0095.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0095.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.818] GetLastError () returned 0x0 [0095.818] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2210, lpOverlapped=0x0) returned 1 [0095.848] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2220, lpOverlapped=0x0) returned 1 [0095.849] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.849] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.849] SetEndOfFile (hFile=0x22c) returned 1 [0095.972] CloseHandle (hObject=0x22c) returned 1 [0095.975] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.975] SetEndOfFile (hFile=0x180) returned 1 [0095.983] CloseHandle (hObject=0x180) returned 1 [0095.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 1 [0096.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.092] lstrlenW (lpString=".doc") returned 4 [0096.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.092] lstrlenW (lpString=".docx") returned 5 [0096.092] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0096.093] lstrlenW (lpString=".pdf") returned 4 [0096.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString=".xls") returned 4 [0096.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.093] lstrlenW (lpString=".xlsx") returned 5 [0096.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0096.093] lstrlenW (lpString=".ppt") returned 4 [0096.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.093] lstrlenW (lpString=".zip") returned 4 [0096.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.093] lstrlenW (lpString=".rar") returned 4 [0096.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString=".bz2") returned 4 [0096.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString=".7z") returned 3 [0096.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.093] lstrlenW (lpString=".dbf") returned 4 [0096.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.093] lstrlenW (lpString=".1cd") returned 4 [0096.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 63 [0096.093] lstrlenW (lpString=".jpg") returned 4 [0096.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.093] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") [0096.461] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11553) returned 1 [0096.462] CloseHandle (hObject=0x210) returned 1 [0096.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 0x20 [0096.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0096.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0096.463] GetLastError () returned 0x0 [0096.463] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2d21, lpOverlapped=0x0) returned 1 [0096.562] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2d30, lpOverlapped=0x0) returned 1 [0096.563] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0096.563] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.563] SetEndOfFile (hFile=0x1a0) returned 1 [0096.584] CloseHandle (hObject=0x1a0) returned 1 [0096.585] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.585] SetEndOfFile (hFile=0x210) returned 1 [0096.585] CloseHandle (hObject=0x210) returned 1 [0096.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 1 [0096.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.589] lstrlenW (lpString=".doc") returned 4 [0096.589] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0096.589] lstrlenW (lpString=".docx") returned 5 [0096.589] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0096.589] lstrlenW (lpString=".pdf") returned 4 [0096.589] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0096.589] lstrlenW (lpString=".xls") returned 4 [0096.589] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0096.589] lstrlenW (lpString=".xlsx") returned 5 [0096.589] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0096.590] lstrlenW (lpString=".ppt") returned 4 [0096.590] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0096.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.590] lstrlenW (lpString=".zip") returned 4 [0096.590] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0096.590] lstrlenW (lpString=".rar") returned 4 [0096.590] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0096.590] lstrlenW (lpString=".bz2") returned 4 [0096.590] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0096.590] lstrlenW (lpString=".7z") returned 3 [0096.590] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0096.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.590] lstrlenW (lpString=".dbf") returned 4 [0096.590] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0096.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.590] lstrlenW (lpString=".1cd") returned 4 [0096.590] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0096.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 63 [0096.590] lstrlenW (lpString=".jpg") returned 4 [0096.590] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0096.590] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") [0096.591] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=67564) returned 1 [0096.591] CloseHandle (hObject=0x1fc) returned 1 [0096.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 0x20 [0096.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.594] GetLastError () returned 0x0 [0096.594] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x107ec, lpOverlapped=0x0) returned 1 [0096.597] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x107f0, lpOverlapped=0x0) returned 1 [0096.599] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0096.599] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.599] SetEndOfFile (hFile=0x22c) returned 1 [0096.599] CloseHandle (hObject=0x22c) returned 1 [0096.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.600] SetEndOfFile (hFile=0x1fc) returned 1 [0096.601] CloseHandle (hObject=0x1fc) returned 1 [0096.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 1 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.601] lstrlenW (lpString=".doc") returned 4 [0096.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.601] lstrlenW (lpString=".docx") returned 5 [0096.601] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0096.601] lstrlenW (lpString=".pdf") returned 4 [0096.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.601] lstrlenW (lpString=".xls") returned 4 [0096.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.601] lstrlenW (lpString=".xlsx") returned 5 [0096.601] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0096.601] lstrlenW (lpString=".ppt") returned 4 [0096.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.602] lstrlenW (lpString=".zip") returned 4 [0096.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.602] lstrlenW (lpString=".rar") returned 4 [0096.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.602] lstrlenW (lpString=".bz2") returned 4 [0096.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.602] lstrlenW (lpString=".7z") returned 3 [0096.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.602] lstrlenW (lpString=".dbf") returned 4 [0096.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.602] lstrlenW (lpString=".1cd") returned 4 [0096.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 63 [0096.602] lstrlenW (lpString=".jpg") returned 4 [0096.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.602] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") [0096.603] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=22990) returned 1 [0096.603] CloseHandle (hObject=0x1fc) returned 1 [0096.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 0x20 [0096.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.603] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.603] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.604] GetLastError () returned 0x0 [0096.604] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x59ce, lpOverlapped=0x0) returned 1 [0096.606] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x59d0, lpOverlapped=0x0) returned 1 [0096.607] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0096.607] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.607] SetEndOfFile (hFile=0x22c) returned 1 [0096.607] CloseHandle (hObject=0x22c) returned 1 [0096.607] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.607] SetEndOfFile (hFile=0x1fc) returned 1 [0096.608] CloseHandle (hObject=0x1fc) returned 1 [0096.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 1 [0096.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString=".doc") returned 4 [0096.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString=".docx") returned 5 [0096.609] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0096.609] lstrlenW (lpString=".pdf") returned 4 [0096.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString=".xls") returned 4 [0096.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.609] lstrlenW (lpString=".xlsx") returned 5 [0096.609] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0096.609] lstrlenW (lpString=".ppt") returned 4 [0096.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString=".zip") returned 4 [0096.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.609] lstrlenW (lpString=".rar") returned 4 [0096.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString=".bz2") returned 4 [0096.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString=".7z") returned 3 [0096.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString=".dbf") returned 4 [0096.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString=".1cd") returned 4 [0096.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 63 [0096.609] lstrlenW (lpString=".jpg") returned 4 [0096.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.610] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") [0096.610] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=15652) returned 1 [0096.610] CloseHandle (hObject=0x1fc) returned 1 [0096.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 0x20 [0096.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.611] GetLastError () returned 0x0 [0096.611] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3d24, lpOverlapped=0x0) returned 1 [0096.613] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3d30, lpOverlapped=0x0) returned 1 [0096.614] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0096.614] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.614] SetEndOfFile (hFile=0x22c) returned 1 [0096.615] CloseHandle (hObject=0x22c) returned 1 [0096.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.615] SetEndOfFile (hFile=0x1fc) returned 1 [0096.615] CloseHandle (hObject=0x1fc) returned 1 [0096.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 1 [0096.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.616] lstrlenW (lpString=".doc") returned 4 [0096.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.616] lstrlenW (lpString=".docx") returned 5 [0096.616] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0096.616] lstrlenW (lpString=".pdf") returned 4 [0096.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.616] lstrlenW (lpString=".xls") returned 4 [0096.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.616] lstrlenW (lpString=".xlsx") returned 5 [0096.616] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0096.616] lstrlenW (lpString=".ppt") returned 4 [0096.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.616] lstrlenW (lpString=".zip") returned 4 [0096.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.616] lstrlenW (lpString=".rar") returned 4 [0096.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.616] lstrlenW (lpString=".bz2") returned 4 [0096.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.616] lstrlenW (lpString=".7z") returned 3 [0096.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.617] lstrlenW (lpString=".dbf") returned 4 [0096.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.617] lstrlenW (lpString=".1cd") returned 4 [0096.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 63 [0096.617] lstrlenW (lpString=".jpg") returned 4 [0096.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.617] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") [0096.618] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16950) returned 1 [0096.618] CloseHandle (hObject=0x1fc) returned 1 [0096.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 0x20 [0096.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0096.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.619] GetLastError () returned 0x0 [0096.619] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4236, lpOverlapped=0x0) returned 1 [0096.811] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4240, lpOverlapped=0x0) returned 1 [0096.812] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0096.812] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.812] SetEndOfFile (hFile=0x22c) returned 1 [0097.001] CloseHandle (hObject=0x22c) returned 1 [0097.001] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.001] SetEndOfFile (hFile=0x1fc) returned 1 [0097.110] CloseHandle (hObject=0x1fc) returned 1 [0097.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 1 [0097.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.110] lstrlenW (lpString=".doc") returned 4 [0097.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.110] lstrlenW (lpString=".docx") returned 5 [0097.110] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0097.110] lstrlenW (lpString=".pdf") returned 4 [0097.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.110] lstrlenW (lpString=".xls") returned 4 [0097.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.110] lstrlenW (lpString=".xlsx") returned 5 [0097.111] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0097.111] lstrlenW (lpString=".ppt") returned 4 [0097.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.111] lstrlenW (lpString=".zip") returned 4 [0097.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.111] lstrlenW (lpString=".rar") returned 4 [0097.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.111] lstrlenW (lpString=".bz2") returned 4 [0097.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.111] lstrlenW (lpString=".7z") returned 3 [0097.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.111] lstrlenW (lpString=".dbf") returned 4 [0097.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.111] lstrlenW (lpString=".1cd") returned 4 [0097.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 63 [0097.111] lstrlenW (lpString=".jpg") returned 4 [0097.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.111] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") [0097.112] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11022) returned 1 [0097.112] CloseHandle (hObject=0x1fc) returned 1 [0097.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 0x20 [0097.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0097.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0097.115] GetLastError () returned 0x0 [0097.115] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2b0e, lpOverlapped=0x0) returned 1 [0097.185] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0097.215] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0097.215] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.215] SetEndOfFile (hFile=0x15c) returned 1 [0097.215] CloseHandle (hObject=0x15c) returned 1 [0097.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.215] SetEndOfFile (hFile=0x1fc) returned 1 [0097.216] CloseHandle (hObject=0x1fc) returned 1 [0097.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 1 [0097.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.217] lstrlenW (lpString=".doc") returned 4 [0097.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.217] lstrlenW (lpString=".docx") returned 5 [0097.217] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0097.217] lstrlenW (lpString=".pdf") returned 4 [0097.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.217] lstrlenW (lpString=".xls") returned 4 [0097.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.217] lstrlenW (lpString=".xlsx") returned 5 [0097.217] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0097.218] lstrlenW (lpString=".ppt") returned 4 [0097.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.218] lstrlenW (lpString=".zip") returned 4 [0097.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.218] lstrlenW (lpString=".rar") returned 4 [0097.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.218] lstrlenW (lpString=".bz2") returned 4 [0097.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.218] lstrlenW (lpString=".7z") returned 3 [0097.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.218] lstrlenW (lpString=".dbf") returned 4 [0097.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.218] lstrlenW (lpString=".1cd") returned 4 [0097.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 63 [0097.218] lstrlenW (lpString=".jpg") returned 4 [0097.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.218] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") [0097.219] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10984) returned 1 [0097.219] CloseHandle (hObject=0x1fc) returned 1 [0097.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 0x20 [0097.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0097.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0097.221] GetLastError () returned 0x0 [0097.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2ae8, lpOverlapped=0x0) returned 1 [0097.282] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2af0, lpOverlapped=0x0) returned 1 [0097.283] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0097.283] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.283] SetEndOfFile (hFile=0x15c) returned 1 [0097.424] CloseHandle (hObject=0x15c) returned 1 [0097.424] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0097.424] SetEndOfFile (hFile=0x1fc) returned 1 [0098.214] CloseHandle (hObject=0x1fc) returned 1 [0098.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 1 [0098.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.303] lstrlenW (lpString=".doc") returned 4 [0098.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.303] lstrlenW (lpString=".docx") returned 5 [0098.303] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0098.303] lstrlenW (lpString=".pdf") returned 4 [0098.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.303] lstrlenW (lpString=".xls") returned 4 [0098.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.303] lstrlenW (lpString=".xlsx") returned 5 [0098.303] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0098.310] lstrlenW (lpString=".ppt") returned 4 [0098.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.310] lstrlenW (lpString=".zip") returned 4 [0098.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.310] lstrlenW (lpString=".rar") returned 4 [0098.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.310] lstrlenW (lpString=".bz2") returned 4 [0098.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.316] lstrlenW (lpString=".7z") returned 3 [0098.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.317] lstrlenW (lpString=".dbf") returned 4 [0098.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.317] lstrlenW (lpString=".1cd") returned 4 [0098.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 63 [0098.317] lstrlenW (lpString=".jpg") returned 4 [0098.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.317] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") [0098.318] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11064) returned 1 [0098.318] CloseHandle (hObject=0x210) returned 1 [0098.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 0x20 [0098.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.318] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.318] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.318] GetLastError () returned 0x0 [0098.318] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2b38, lpOverlapped=0x0) returned 1 [0098.320] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0098.321] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.321] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.321] SetEndOfFile (hFile=0x19c) returned 1 [0098.322] CloseHandle (hObject=0x19c) returned 1 [0098.322] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.322] SetEndOfFile (hFile=0x210) returned 1 [0098.323] CloseHandle (hObject=0x210) returned 1 [0098.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 1 [0098.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.323] lstrlenW (lpString=".doc") returned 4 [0098.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.323] lstrlenW (lpString=".docx") returned 5 [0098.323] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0098.323] lstrlenW (lpString=".pdf") returned 4 [0098.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.323] lstrlenW (lpString=".xls") returned 4 [0098.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.323] lstrlenW (lpString=".xlsx") returned 5 [0098.323] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0098.323] lstrlenW (lpString=".ppt") returned 4 [0098.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.323] lstrlenW (lpString=".zip") returned 4 [0098.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.323] lstrlenW (lpString=".rar") returned 4 [0098.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.323] lstrlenW (lpString=".bz2") returned 4 [0098.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.323] lstrlenW (lpString=".7z") returned 3 [0098.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.324] lstrlenW (lpString=".dbf") returned 4 [0098.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.324] lstrlenW (lpString=".1cd") returned 4 [0098.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 63 [0098.324] lstrlenW (lpString=".jpg") returned 4 [0098.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.324] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") [0098.327] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=37146) returned 1 [0098.327] CloseHandle (hObject=0x210) returned 1 [0098.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 0x20 [0098.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.327] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.327] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.328] GetLastError () returned 0x0 [0098.328] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x911a, lpOverlapped=0x0) returned 1 [0098.330] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x9120, lpOverlapped=0x0) returned 1 [0098.331] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.331] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.331] SetEndOfFile (hFile=0x19c) returned 1 [0098.332] CloseHandle (hObject=0x19c) returned 1 [0098.332] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.332] SetEndOfFile (hFile=0x210) returned 1 [0098.333] CloseHandle (hObject=0x210) returned 1 [0098.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 1 [0098.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.333] lstrlenW (lpString=".doc") returned 4 [0098.333] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.333] lstrlenW (lpString=".docx") returned 5 [0098.333] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0098.333] lstrlenW (lpString=".pdf") returned 4 [0098.333] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.333] lstrlenW (lpString=".xls") returned 4 [0098.333] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.333] lstrlenW (lpString=".xlsx") returned 5 [0098.333] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0098.333] lstrlenW (lpString=".ppt") returned 4 [0098.333] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.333] lstrlenW (lpString=".zip") returned 4 [0098.333] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.334] lstrlenW (lpString=".rar") returned 4 [0098.334] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.334] lstrlenW (lpString=".bz2") returned 4 [0098.334] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.334] lstrlenW (lpString=".7z") returned 3 [0098.334] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.334] lstrlenW (lpString=".dbf") returned 4 [0098.334] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.334] lstrlenW (lpString=".1cd") returned 4 [0098.334] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 63 [0098.334] lstrlenW (lpString=".jpg") returned 4 [0098.334] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.334] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") [0098.334] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=42842) returned 1 [0098.334] CloseHandle (hObject=0x210) returned 1 [0098.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 0x20 [0098.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.335] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.335] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.335] GetLastError () returned 0x0 [0098.335] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa75a, lpOverlapped=0x0) returned 1 [0098.338] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa760, lpOverlapped=0x0) returned 1 [0098.340] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.340] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.340] SetEndOfFile (hFile=0x19c) returned 1 [0098.340] CloseHandle (hObject=0x19c) returned 1 [0098.340] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.340] SetEndOfFile (hFile=0x210) returned 1 [0098.341] CloseHandle (hObject=0x210) returned 1 [0098.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 1 [0098.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.341] lstrlenW (lpString=".doc") returned 4 [0098.341] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.341] lstrlenW (lpString=".docx") returned 5 [0098.341] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.341] lstrlenW (lpString=".pdf") returned 4 [0098.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.341] lstrlenW (lpString=".xls") returned 4 [0098.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.342] lstrlenW (lpString=".xlsx") returned 5 [0098.342] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.342] lstrlenW (lpString=".ppt") returned 4 [0098.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.342] lstrlenW (lpString=".zip") returned 4 [0098.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.342] lstrlenW (lpString=".rar") returned 4 [0098.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.342] lstrlenW (lpString=".bz2") returned 4 [0098.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.342] lstrlenW (lpString=".7z") returned 3 [0098.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.342] lstrlenW (lpString=".dbf") returned 4 [0098.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.342] lstrlenW (lpString=".1cd") returned 4 [0098.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 63 [0098.342] lstrlenW (lpString=".jpg") returned 4 [0098.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.342] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") [0098.343] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=33195) returned 1 [0098.343] CloseHandle (hObject=0x210) returned 1 [0098.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 0x20 [0098.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.343] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.343] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.344] GetLastError () returned 0x0 [0098.344] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x81ab, lpOverlapped=0x0) returned 1 [0098.346] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x81b0, lpOverlapped=0x0) returned 1 [0098.347] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.347] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.347] SetEndOfFile (hFile=0x19c) returned 1 [0098.347] CloseHandle (hObject=0x19c) returned 1 [0098.347] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.347] SetEndOfFile (hFile=0x210) returned 1 [0098.348] CloseHandle (hObject=0x210) returned 1 [0098.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString=".doc") returned 4 [0098.349] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.349] lstrlenW (lpString=".docx") returned 5 [0098.349] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0098.349] lstrlenW (lpString=".pdf") returned 4 [0098.349] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.349] lstrlenW (lpString=".xls") returned 4 [0098.349] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.349] lstrlenW (lpString=".xlsx") returned 5 [0098.349] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0098.349] lstrlenW (lpString=".ppt") returned 4 [0098.349] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString=".zip") returned 4 [0098.349] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.349] lstrlenW (lpString=".rar") returned 4 [0098.349] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.349] lstrlenW (lpString=".bz2") returned 4 [0098.349] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.349] lstrlenW (lpString=".7z") returned 3 [0098.349] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString=".dbf") returned 4 [0098.349] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString=".1cd") returned 4 [0098.349] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 63 [0098.349] lstrlenW (lpString=".jpg") returned 4 [0098.349] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.350] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") [0098.350] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=47569) returned 1 [0098.350] CloseHandle (hObject=0x210) returned 1 [0098.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 0x20 [0098.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.350] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.350] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.351] GetLastError () returned 0x0 [0098.351] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb9d1, lpOverlapped=0x0) returned 1 [0098.364] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb9e0, lpOverlapped=0x0) returned 1 [0098.366] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.366] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.366] SetEndOfFile (hFile=0x19c) returned 1 [0098.370] CloseHandle (hObject=0x19c) returned 1 [0098.370] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.370] SetEndOfFile (hFile=0x210) returned 1 [0098.371] CloseHandle (hObject=0x210) returned 1 [0098.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 1 [0098.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.390] lstrlenW (lpString=".doc") returned 4 [0098.390] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.390] lstrlenW (lpString=".docx") returned 5 [0098.390] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.390] lstrlenW (lpString=".pdf") returned 4 [0098.390] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.390] lstrlenW (lpString=".xls") returned 4 [0098.390] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.390] lstrlenW (lpString=".xlsx") returned 5 [0098.390] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.390] lstrlenW (lpString=".ppt") returned 4 [0098.390] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.390] lstrlenW (lpString=".zip") returned 4 [0098.390] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.390] lstrlenW (lpString=".rar") returned 4 [0098.390] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.391] lstrlenW (lpString=".bz2") returned 4 [0098.391] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.391] lstrlenW (lpString=".7z") returned 3 [0098.391] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.391] lstrlenW (lpString=".dbf") returned 4 [0098.391] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.391] lstrlenW (lpString=".1cd") returned 4 [0098.391] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 63 [0098.391] lstrlenW (lpString=".jpg") returned 4 [0098.391] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.391] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") [0098.478] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16768) returned 1 [0098.478] CloseHandle (hObject=0x22c) returned 1 [0098.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 0x20 [0098.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.479] GetLastError () returned 0x0 [0098.479] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4180, lpOverlapped=0x0) returned 1 [0098.490] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4190, lpOverlapped=0x0) returned 1 [0098.491] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.491] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.491] SetEndOfFile (hFile=0x1fc) returned 1 [0098.491] CloseHandle (hObject=0x1fc) returned 1 [0098.492] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.492] SetEndOfFile (hFile=0x22c) returned 1 [0098.493] CloseHandle (hObject=0x22c) returned 1 [0098.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 1 [0098.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.493] lstrlenW (lpString=".doc") returned 4 [0098.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.493] lstrlenW (lpString=".docx") returned 5 [0098.493] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0098.493] lstrlenW (lpString=".pdf") returned 4 [0098.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.493] lstrlenW (lpString=".xls") returned 4 [0098.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.493] lstrlenW (lpString=".xlsx") returned 5 [0098.493] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0098.493] lstrlenW (lpString=".ppt") returned 4 [0098.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.494] lstrlenW (lpString=".zip") returned 4 [0098.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.494] lstrlenW (lpString=".rar") returned 4 [0098.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.494] lstrlenW (lpString=".bz2") returned 4 [0098.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.494] lstrlenW (lpString=".7z") returned 3 [0098.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.494] lstrlenW (lpString=".dbf") returned 4 [0098.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.494] lstrlenW (lpString=".1cd") returned 4 [0098.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 63 [0098.494] lstrlenW (lpString=".jpg") returned 4 [0098.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.494] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") [0098.495] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11770) returned 1 [0098.495] CloseHandle (hObject=0x22c) returned 1 [0098.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 0x20 [0098.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.495] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.495] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.496] GetLastError () returned 0x0 [0098.496] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2dfa, lpOverlapped=0x0) returned 1 [0098.500] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2e00, lpOverlapped=0x0) returned 1 [0098.501] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.502] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.502] SetEndOfFile (hFile=0x1fc) returned 1 [0098.502] CloseHandle (hObject=0x1fc) returned 1 [0098.502] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.502] SetEndOfFile (hFile=0x22c) returned 1 [0098.503] CloseHandle (hObject=0x22c) returned 1 [0098.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 1 [0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.503] lstrlenW (lpString=".doc") returned 4 [0098.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.503] lstrlenW (lpString=".docx") returned 5 [0098.503] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0098.503] lstrlenW (lpString=".pdf") returned 4 [0098.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.503] lstrlenW (lpString=".xls") returned 4 [0098.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.503] lstrlenW (lpString=".xlsx") returned 5 [0098.503] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0098.503] lstrlenW (lpString=".ppt") returned 4 [0098.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.503] lstrlenW (lpString=".zip") returned 4 [0098.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.504] lstrlenW (lpString=".rar") returned 4 [0098.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.504] lstrlenW (lpString=".bz2") returned 4 [0098.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.504] lstrlenW (lpString=".7z") returned 3 [0098.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.504] lstrlenW (lpString=".dbf") returned 4 [0098.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.504] lstrlenW (lpString=".1cd") returned 4 [0098.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 63 [0098.504] lstrlenW (lpString=".jpg") returned 4 [0098.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.504] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") [0098.505] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10430) returned 1 [0098.505] CloseHandle (hObject=0x22c) returned 1 [0098.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 0x20 [0098.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.505] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.505] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.506] GetLastError () returned 0x0 [0098.506] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x28be, lpOverlapped=0x0) returned 1 [0098.535] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x28c0, lpOverlapped=0x0) returned 1 [0098.536] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.536] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.536] SetEndOfFile (hFile=0x1fc) returned 1 [0098.536] CloseHandle (hObject=0x1fc) returned 1 [0098.536] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.536] SetEndOfFile (hFile=0x22c) returned 1 [0098.537] CloseHandle (hObject=0x22c) returned 1 [0098.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 1 [0098.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.537] lstrlenW (lpString=".doc") returned 4 [0098.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.537] lstrlenW (lpString=".docx") returned 5 [0098.537] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0098.538] lstrlenW (lpString=".pdf") returned 4 [0098.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString=".xls") returned 4 [0098.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.538] lstrlenW (lpString=".xlsx") returned 5 [0098.538] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0098.538] lstrlenW (lpString=".ppt") returned 4 [0098.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.538] lstrlenW (lpString=".zip") returned 4 [0098.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.538] lstrlenW (lpString=".rar") returned 4 [0098.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString=".bz2") returned 4 [0098.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString=".7z") returned 3 [0098.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.538] lstrlenW (lpString=".dbf") returned 4 [0098.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.538] lstrlenW (lpString=".1cd") returned 4 [0098.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 63 [0098.538] lstrlenW (lpString=".jpg") returned 4 [0098.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.538] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") [0098.552] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9431) returned 1 [0098.552] CloseHandle (hObject=0x210) returned 1 [0098.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 0x20 [0098.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.553] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.553] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.553] GetLastError () returned 0x0 [0098.553] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x24d7, lpOverlapped=0x0) returned 1 [0098.564] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x24e0, lpOverlapped=0x0) returned 1 [0098.565] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.565] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.565] SetEndOfFile (hFile=0x1ec) returned 1 [0098.565] CloseHandle (hObject=0x1ec) returned 1 [0098.565] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.565] SetEndOfFile (hFile=0x210) returned 1 [0098.566] CloseHandle (hObject=0x210) returned 1 [0098.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString=".doc") returned 4 [0098.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.567] lstrlenW (lpString=".docx") returned 5 [0098.567] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0098.567] lstrlenW (lpString=".pdf") returned 4 [0098.567] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.567] lstrlenW (lpString=".xls") returned 4 [0098.567] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.567] lstrlenW (lpString=".xlsx") returned 5 [0098.567] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0098.567] lstrlenW (lpString=".ppt") returned 4 [0098.567] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString=".zip") returned 4 [0098.567] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.567] lstrlenW (lpString=".rar") returned 4 [0098.567] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.567] lstrlenW (lpString=".bz2") returned 4 [0098.567] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.567] lstrlenW (lpString=".7z") returned 3 [0098.567] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString=".dbf") returned 4 [0098.567] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString=".1cd") returned 4 [0098.567] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 63 [0098.567] lstrlenW (lpString=".jpg") returned 4 [0098.568] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.568] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") [0098.568] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12280) returned 1 [0098.568] CloseHandle (hObject=0x210) returned 1 [0098.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 0x20 [0098.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.570] GetLastError () returned 0x0 [0098.570] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2ff8, lpOverlapped=0x0) returned 1 [0098.578] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3000, lpOverlapped=0x0) returned 1 [0098.579] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.579] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.579] SetEndOfFile (hFile=0x1ec) returned 1 [0098.579] CloseHandle (hObject=0x1ec) returned 1 [0098.579] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.579] SetEndOfFile (hFile=0x210) returned 1 [0098.580] CloseHandle (hObject=0x210) returned 1 [0098.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 1 [0098.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.580] lstrlenW (lpString=".doc") returned 4 [0098.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.580] lstrlenW (lpString=".docx") returned 5 [0098.580] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0098.580] lstrlenW (lpString=".pdf") returned 4 [0098.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString=".xls") returned 4 [0098.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.581] lstrlenW (lpString=".xlsx") returned 5 [0098.581] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0098.581] lstrlenW (lpString=".ppt") returned 4 [0098.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.581] lstrlenW (lpString=".zip") returned 4 [0098.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.581] lstrlenW (lpString=".rar") returned 4 [0098.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString=".bz2") returned 4 [0098.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString=".7z") returned 3 [0098.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.581] lstrlenW (lpString=".dbf") returned 4 [0098.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.581] lstrlenW (lpString=".1cd") returned 4 [0098.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 63 [0098.581] lstrlenW (lpString=".jpg") returned 4 [0098.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.581] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") [0098.602] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11902) returned 1 [0098.602] CloseHandle (hObject=0x210) returned 1 [0098.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 0x20 [0098.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.602] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.602] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.603] GetLastError () returned 0x0 [0098.603] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2e7e, lpOverlapped=0x0) returned 1 [0098.605] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0098.606] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.606] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.606] SetEndOfFile (hFile=0x22c) returned 1 [0098.606] CloseHandle (hObject=0x22c) returned 1 [0098.606] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.606] SetEndOfFile (hFile=0x210) returned 1 [0098.607] CloseHandle (hObject=0x210) returned 1 [0098.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 1 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString=".doc") returned 4 [0098.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString=".docx") returned 5 [0098.608] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0098.608] lstrlenW (lpString=".pdf") returned 4 [0098.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString=".xls") returned 4 [0098.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.608] lstrlenW (lpString=".xlsx") returned 5 [0098.608] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0098.608] lstrlenW (lpString=".ppt") returned 4 [0098.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString=".zip") returned 4 [0098.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.608] lstrlenW (lpString=".rar") returned 4 [0098.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString=".bz2") returned 4 [0098.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString=".7z") returned 3 [0098.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString=".dbf") returned 4 [0098.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString=".1cd") returned 4 [0098.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 63 [0098.608] lstrlenW (lpString=".jpg") returned 4 [0098.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.609] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") [0098.609] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12896) returned 1 [0098.609] CloseHandle (hObject=0x210) returned 1 [0098.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0098.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.609] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.609] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.610] GetLastError () returned 0x0 [0098.610] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3260, lpOverlapped=0x0) returned 1 [0098.612] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3270, lpOverlapped=0x0) returned 1 [0098.613] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.613] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.613] SetEndOfFile (hFile=0x22c) returned 1 [0098.613] CloseHandle (hObject=0x22c) returned 1 [0098.613] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.613] SetEndOfFile (hFile=0x210) returned 1 [0098.614] CloseHandle (hObject=0x210) returned 1 [0098.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 1 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString=".doc") returned 4 [0098.615] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.615] lstrlenW (lpString=".docx") returned 5 [0098.615] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0098.615] lstrlenW (lpString=".pdf") returned 4 [0098.615] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.615] lstrlenW (lpString=".xls") returned 4 [0098.615] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.615] lstrlenW (lpString=".xlsx") returned 5 [0098.615] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0098.615] lstrlenW (lpString=".ppt") returned 4 [0098.615] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString=".zip") returned 4 [0098.615] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.615] lstrlenW (lpString=".rar") returned 4 [0098.615] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.615] lstrlenW (lpString=".bz2") returned 4 [0098.615] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.615] lstrlenW (lpString=".7z") returned 3 [0098.615] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString=".dbf") returned 4 [0098.615] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString=".1cd") returned 4 [0098.615] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 63 [0098.615] lstrlenW (lpString=".jpg") returned 4 [0098.615] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.615] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") [0098.617] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10196) returned 1 [0098.617] CloseHandle (hObject=0x210) returned 1 [0098.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0098.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.617] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.617] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.618] GetLastError () returned 0x0 [0098.618] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x27d4, lpOverlapped=0x0) returned 1 [0098.619] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0098.620] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.620] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.620] SetEndOfFile (hFile=0x22c) returned 1 [0098.621] CloseHandle (hObject=0x22c) returned 1 [0098.621] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.621] SetEndOfFile (hFile=0x210) returned 1 [0098.622] CloseHandle (hObject=0x210) returned 1 [0098.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 1 [0098.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.622] lstrlenW (lpString=".doc") returned 4 [0098.622] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.622] lstrlenW (lpString=".docx") returned 5 [0098.622] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.622] lstrlenW (lpString=".pdf") returned 4 [0098.622] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.622] lstrlenW (lpString=".xls") returned 4 [0098.622] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.622] lstrlenW (lpString=".xlsx") returned 5 [0098.622] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.622] lstrlenW (lpString=".ppt") returned 4 [0098.622] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.622] lstrlenW (lpString=".zip") returned 4 [0098.622] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.622] lstrlenW (lpString=".rar") returned 4 [0098.622] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.622] lstrlenW (lpString=".bz2") returned 4 [0098.623] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.623] lstrlenW (lpString=".7z") returned 3 [0098.623] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.623] lstrlenW (lpString=".dbf") returned 4 [0098.623] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.623] lstrlenW (lpString=".1cd") returned 4 [0098.623] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 63 [0098.623] lstrlenW (lpString=".jpg") returned 4 [0098.623] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.623] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") [0098.624] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11485) returned 1 [0098.624] CloseHandle (hObject=0x210) returned 1 [0098.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 0x20 [0098.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.624] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.624] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.625] GetLastError () returned 0x0 [0098.625] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2cdd, lpOverlapped=0x0) returned 1 [0098.627] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2ce0, lpOverlapped=0x0) returned 1 [0098.628] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.628] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.628] SetEndOfFile (hFile=0x22c) returned 1 [0098.628] CloseHandle (hObject=0x22c) returned 1 [0098.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.628] SetEndOfFile (hFile=0x210) returned 1 [0098.629] CloseHandle (hObject=0x210) returned 1 [0098.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 1 [0098.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.629] lstrlenW (lpString=".doc") returned 4 [0098.629] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.629] lstrlenW (lpString=".docx") returned 5 [0098.629] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0098.629] lstrlenW (lpString=".pdf") returned 4 [0098.629] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.630] lstrlenW (lpString=".xls") returned 4 [0098.630] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.630] lstrlenW (lpString=".xlsx") returned 5 [0098.630] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0098.630] lstrlenW (lpString=".ppt") returned 4 [0098.630] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.630] lstrlenW (lpString=".zip") returned 4 [0098.630] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.630] lstrlenW (lpString=".rar") returned 4 [0098.630] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.630] lstrlenW (lpString=".bz2") returned 4 [0098.630] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.630] lstrlenW (lpString=".7z") returned 3 [0098.630] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.630] lstrlenW (lpString=".dbf") returned 4 [0098.630] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.630] lstrlenW (lpString=".1cd") returned 4 [0098.630] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 63 [0098.630] lstrlenW (lpString=".jpg") returned 4 [0098.630] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.630] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") [0098.631] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19565) returned 1 [0098.631] CloseHandle (hObject=0x210) returned 1 [0098.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 0x20 [0098.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.631] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.631] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.632] GetLastError () returned 0x0 [0098.632] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4c6d, lpOverlapped=0x0) returned 1 [0098.634] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0098.637] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.637] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.637] SetEndOfFile (hFile=0x22c) returned 1 [0098.637] CloseHandle (hObject=0x22c) returned 1 [0098.637] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.637] SetEndOfFile (hFile=0x210) returned 1 [0098.638] CloseHandle (hObject=0x210) returned 1 [0098.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 1 [0098.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.638] lstrlenW (lpString=".doc") returned 4 [0098.638] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.638] lstrlenW (lpString=".docx") returned 5 [0098.638] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0098.638] lstrlenW (lpString=".pdf") returned 4 [0098.639] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.639] lstrlenW (lpString=".xls") returned 4 [0098.639] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.639] lstrlenW (lpString=".xlsx") returned 5 [0098.639] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0098.639] lstrlenW (lpString=".ppt") returned 4 [0098.639] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.639] lstrlenW (lpString=".zip") returned 4 [0098.639] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.639] lstrlenW (lpString=".rar") returned 4 [0098.639] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.639] lstrlenW (lpString=".bz2") returned 4 [0098.639] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.639] lstrlenW (lpString=".7z") returned 3 [0098.639] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.639] lstrlenW (lpString=".dbf") returned 4 [0098.639] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.639] lstrlenW (lpString=".1cd") returned 4 [0098.639] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 63 [0098.639] lstrlenW (lpString=".jpg") returned 4 [0098.639] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.639] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") [0098.640] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19160) returned 1 [0098.640] CloseHandle (hObject=0x210) returned 1 [0098.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0098.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.640] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.640] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.641] GetLastError () returned 0x0 [0098.641] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4ad8, lpOverlapped=0x0) returned 1 [0098.742] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4ae0, lpOverlapped=0x0) returned 1 [0098.744] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.744] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.744] SetEndOfFile (hFile=0x22c) returned 1 [0098.744] CloseHandle (hObject=0x22c) returned 1 [0098.744] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.744] SetEndOfFile (hFile=0x210) returned 1 [0098.745] CloseHandle (hObject=0x210) returned 1 [0098.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 1 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString=".doc") returned 4 [0098.746] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.746] lstrlenW (lpString=".docx") returned 5 [0098.746] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0098.746] lstrlenW (lpString=".pdf") returned 4 [0098.746] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.746] lstrlenW (lpString=".xls") returned 4 [0098.746] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.746] lstrlenW (lpString=".xlsx") returned 5 [0098.746] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0098.746] lstrlenW (lpString=".ppt") returned 4 [0098.746] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString=".zip") returned 4 [0098.746] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.746] lstrlenW (lpString=".rar") returned 4 [0098.746] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.746] lstrlenW (lpString=".bz2") returned 4 [0098.746] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.746] lstrlenW (lpString=".7z") returned 3 [0098.746] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString=".dbf") returned 4 [0098.746] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString=".1cd") returned 4 [0098.746] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 63 [0098.746] lstrlenW (lpString=".jpg") returned 4 [0098.746] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.747] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") [0098.828] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8230) returned 1 [0098.828] CloseHandle (hObject=0x180) returned 1 [0098.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 0x20 [0098.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.828] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.828] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.829] GetLastError () returned 0x0 [0098.829] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2026, lpOverlapped=0x0) returned 1 [0098.831] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2030, lpOverlapped=0x0) returned 1 [0098.832] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.832] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.832] SetEndOfFile (hFile=0x158) returned 1 [0098.832] CloseHandle (hObject=0x158) returned 1 [0098.832] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.832] SetEndOfFile (hFile=0x180) returned 1 [0098.833] CloseHandle (hObject=0x180) returned 1 [0098.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 1 [0098.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.833] lstrlenW (lpString=".doc") returned 4 [0098.833] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.833] lstrlenW (lpString=".docx") returned 5 [0098.833] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.833] lstrlenW (lpString=".pdf") returned 4 [0098.834] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.834] lstrlenW (lpString=".xls") returned 4 [0098.834] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.834] lstrlenW (lpString=".xlsx") returned 5 [0098.834] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.834] lstrlenW (lpString=".ppt") returned 4 [0098.834] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.834] lstrlenW (lpString=".zip") returned 4 [0098.834] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.834] lstrlenW (lpString=".rar") returned 4 [0098.834] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.834] lstrlenW (lpString=".bz2") returned 4 [0098.834] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.834] lstrlenW (lpString=".7z") returned 3 [0098.834] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.834] lstrlenW (lpString=".dbf") returned 4 [0098.834] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.834] lstrlenW (lpString=".1cd") returned 4 [0098.834] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 63 [0098.834] lstrlenW (lpString=".jpg") returned 4 [0098.834] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.834] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") [0098.955] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18874) returned 1 [0098.955] CloseHandle (hObject=0x1c0) returned 1 [0098.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 0x20 [0098.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.960] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.960] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.971] GetLastError () returned 0x0 [0098.971] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x49ba, lpOverlapped=0x0) returned 1 [0098.979] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x49c0, lpOverlapped=0x0) returned 1 [0098.980] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.980] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.980] SetEndOfFile (hFile=0x210) returned 1 [0098.981] CloseHandle (hObject=0x210) returned 1 [0098.981] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.981] SetEndOfFile (hFile=0x1c0) returned 1 [0098.981] CloseHandle (hObject=0x1c0) returned 1 [0098.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 1 [0098.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.982] lstrlenW (lpString=".doc") returned 4 [0098.982] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.982] lstrlenW (lpString=".docx") returned 5 [0098.982] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0098.982] lstrlenW (lpString=".pdf") returned 4 [0098.982] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.982] lstrlenW (lpString=".xls") returned 4 [0098.982] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.982] lstrlenW (lpString=".xlsx") returned 5 [0098.982] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0098.982] lstrlenW (lpString=".ppt") returned 4 [0098.982] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.982] lstrlenW (lpString=".zip") returned 4 [0098.982] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.982] lstrlenW (lpString=".rar") returned 4 [0098.982] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.982] lstrlenW (lpString=".bz2") returned 4 [0098.982] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.982] lstrlenW (lpString=".7z") returned 3 [0098.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.983] lstrlenW (lpString=".dbf") returned 4 [0098.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.983] lstrlenW (lpString=".1cd") returned 4 [0098.983] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 63 [0098.983] lstrlenW (lpString=".jpg") returned 4 [0098.983] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.983] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") [0098.983] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=86812) returned 1 [0098.983] CloseHandle (hObject=0x1c0) returned 1 [0098.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 0x20 [0098.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.984] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.984] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.984] GetLastError () returned 0x0 [0098.984] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1531c, lpOverlapped=0x0) returned 1 [0098.990] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x15320, lpOverlapped=0x0) returned 1 [0098.992] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0098.992] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.992] SetEndOfFile (hFile=0x210) returned 1 [0098.992] CloseHandle (hObject=0x210) returned 1 [0098.992] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.992] SetEndOfFile (hFile=0x1c0) returned 1 [0098.993] CloseHandle (hObject=0x1c0) returned 1 [0098.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 1 [0098.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.994] lstrlenW (lpString=".doc") returned 4 [0098.994] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.994] lstrlenW (lpString=".docx") returned 5 [0098.994] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0098.994] lstrlenW (lpString=".pdf") returned 4 [0098.994] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.994] lstrlenW (lpString=".xls") returned 4 [0098.994] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.994] lstrlenW (lpString=".xlsx") returned 5 [0098.994] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0098.994] lstrlenW (lpString=".ppt") returned 4 [0098.994] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.994] lstrlenW (lpString=".zip") returned 4 [0098.994] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.994] lstrlenW (lpString=".rar") returned 4 [0098.994] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.994] lstrlenW (lpString=".bz2") returned 4 [0098.994] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.994] lstrlenW (lpString=".7z") returned 3 [0098.994] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.995] lstrlenW (lpString=".dbf") returned 4 [0098.995] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.995] lstrlenW (lpString=".1cd") returned 4 [0098.995] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 63 [0098.995] lstrlenW (lpString=".jpg") returned 4 [0098.995] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.995] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") [0098.995] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=109879) returned 1 [0098.995] CloseHandle (hObject=0x1c0) returned 1 [0098.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 0x20 [0098.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0098.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.997] GetLastError () returned 0x0 [0098.997] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1ad37, lpOverlapped=0x0) returned 1 [0099.001] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1ad40, lpOverlapped=0x0) returned 1 [0099.003] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.003] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.003] SetEndOfFile (hFile=0x210) returned 1 [0099.003] CloseHandle (hObject=0x210) returned 1 [0099.003] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.003] SetEndOfFile (hFile=0x1c0) returned 1 [0099.005] CloseHandle (hObject=0x1c0) returned 1 [0099.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 1 [0099.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.005] lstrlenW (lpString=".doc") returned 4 [0099.005] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.005] lstrlenW (lpString=".docx") returned 5 [0099.005] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0099.005] lstrlenW (lpString=".pdf") returned 4 [0099.005] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.005] lstrlenW (lpString=".xls") returned 4 [0099.005] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.005] lstrlenW (lpString=".xlsx") returned 5 [0099.005] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0099.005] lstrlenW (lpString=".ppt") returned 4 [0099.006] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.006] lstrlenW (lpString=".zip") returned 4 [0099.006] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.006] lstrlenW (lpString=".rar") returned 4 [0099.006] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.006] lstrlenW (lpString=".bz2") returned 4 [0099.006] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.006] lstrlenW (lpString=".7z") returned 3 [0099.006] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.006] lstrlenW (lpString=".dbf") returned 4 [0099.006] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.006] lstrlenW (lpString=".1cd") returned 4 [0099.006] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 63 [0099.006] lstrlenW (lpString=".jpg") returned 4 [0099.006] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.006] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") [0099.349] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=96466) returned 1 [0099.349] CloseHandle (hObject=0x168) returned 1 [0099.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 0x20 [0099.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.360] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.360] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0099.373] GetLastError () returned 0x0 [0099.373] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x178d2, lpOverlapped=0x0) returned 1 [0099.377] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x178e0, lpOverlapped=0x0) returned 1 [0099.379] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.379] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.379] SetEndOfFile (hFile=0x1b4) returned 1 [0099.380] CloseHandle (hObject=0x1b4) returned 1 [0099.380] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.380] SetEndOfFile (hFile=0x168) returned 1 [0099.381] CloseHandle (hObject=0x168) returned 1 [0099.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 1 [0099.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.381] lstrlenW (lpString=".doc") returned 4 [0099.381] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.381] lstrlenW (lpString=".docx") returned 5 [0099.381] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.382] lstrlenW (lpString=".pdf") returned 4 [0099.382] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.382] lstrlenW (lpString=".xls") returned 4 [0099.382] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.382] lstrlenW (lpString=".xlsx") returned 5 [0099.382] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.382] lstrlenW (lpString=".ppt") returned 4 [0099.382] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.382] lstrlenW (lpString=".zip") returned 4 [0099.382] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.382] lstrlenW (lpString=".rar") returned 4 [0099.382] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.382] lstrlenW (lpString=".bz2") returned 4 [0099.382] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.382] lstrlenW (lpString=".7z") returned 3 [0099.382] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.382] lstrlenW (lpString=".dbf") returned 4 [0099.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.382] lstrlenW (lpString=".1cd") returned 4 [0099.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 63 [0099.382] lstrlenW (lpString=".jpg") returned 4 [0099.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.382] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") [0099.383] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=100488) returned 1 [0099.383] CloseHandle (hObject=0x168) returned 1 [0099.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 0x20 [0099.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.383] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.383] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0099.384] GetLastError () returned 0x0 [0099.384] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x18888, lpOverlapped=0x0) returned 1 [0099.387] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x18890, lpOverlapped=0x0) returned 1 [0099.390] ReadFile (in: hFile=0x168, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.390] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.390] SetEndOfFile (hFile=0x1b4) returned 1 [0099.390] CloseHandle (hObject=0x1b4) returned 1 [0099.390] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.390] SetEndOfFile (hFile=0x168) returned 1 [0099.391] CloseHandle (hObject=0x168) returned 1 [0099.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 1 [0099.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.394] lstrlenW (lpString=".doc") returned 4 [0099.394] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.394] lstrlenW (lpString=".docx") returned 5 [0099.394] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0099.394] lstrlenW (lpString=".pdf") returned 4 [0099.394] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.395] lstrlenW (lpString=".xls") returned 4 [0099.395] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.395] lstrlenW (lpString=".xlsx") returned 5 [0099.395] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0099.395] lstrlenW (lpString=".ppt") returned 4 [0099.395] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.395] lstrlenW (lpString=".zip") returned 4 [0099.395] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.395] lstrlenW (lpString=".rar") returned 4 [0099.395] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.395] lstrlenW (lpString=".bz2") returned 4 [0099.395] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.395] lstrlenW (lpString=".7z") returned 3 [0099.395] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.395] lstrlenW (lpString=".dbf") returned 4 [0099.395] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.395] lstrlenW (lpString=".1cd") returned 4 [0099.395] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 63 [0099.395] lstrlenW (lpString=".jpg") returned 4 [0099.395] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.395] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") [0099.397] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=93448) returned 1 [0099.397] CloseHandle (hObject=0x15c) returned 1 [0099.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 0x20 [0099.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.397] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.397] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.398] GetLastError () returned 0x0 [0099.398] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x16d08, lpOverlapped=0x0) returned 1 [0099.401] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x16d10, lpOverlapped=0x0) returned 1 [0099.403] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.403] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.403] SetEndOfFile (hFile=0x168) returned 1 [0099.403] CloseHandle (hObject=0x168) returned 1 [0099.403] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.403] SetEndOfFile (hFile=0x15c) returned 1 [0099.405] CloseHandle (hObject=0x15c) returned 1 [0099.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 1 [0099.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.405] lstrlenW (lpString=".doc") returned 4 [0099.405] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.405] lstrlenW (lpString=".docx") returned 5 [0099.405] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0099.405] lstrlenW (lpString=".pdf") returned 4 [0099.405] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.405] lstrlenW (lpString=".xls") returned 4 [0099.405] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.405] lstrlenW (lpString=".xlsx") returned 5 [0099.405] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0099.405] lstrlenW (lpString=".ppt") returned 4 [0099.405] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.406] lstrlenW (lpString=".zip") returned 4 [0099.406] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.406] lstrlenW (lpString=".rar") returned 4 [0099.406] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.406] lstrlenW (lpString=".bz2") returned 4 [0099.406] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.406] lstrlenW (lpString=".7z") returned 3 [0099.406] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.406] lstrlenW (lpString=".dbf") returned 4 [0099.406] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.406] lstrlenW (lpString=".1cd") returned 4 [0099.406] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 63 [0099.406] lstrlenW (lpString=".jpg") returned 4 [0099.406] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.406] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") [0099.407] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=112479) returned 1 [0099.407] CloseHandle (hObject=0x15c) returned 1 [0099.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 0x20 [0099.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.407] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.408] GetLastError () returned 0x0 [0099.408] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b75f, lpOverlapped=0x0) returned 1 [0099.427] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b760, lpOverlapped=0x0) returned 1 [0099.429] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.429] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.429] SetEndOfFile (hFile=0x168) returned 1 [0099.706] CloseHandle (hObject=0x168) returned 1 [0099.706] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.706] SetEndOfFile (hFile=0x15c) returned 1 [0099.707] CloseHandle (hObject=0x15c) returned 1 [0099.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 1 [0099.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.767] lstrlenW (lpString=".doc") returned 4 [0099.768] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.768] lstrlenW (lpString=".docx") returned 5 [0099.768] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0099.768] lstrlenW (lpString=".pdf") returned 4 [0099.768] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.768] lstrlenW (lpString=".xls") returned 4 [0099.768] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.768] lstrlenW (lpString=".xlsx") returned 5 [0099.768] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0099.768] lstrlenW (lpString=".ppt") returned 4 [0099.768] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.768] lstrlenW (lpString=".zip") returned 4 [0099.768] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.768] lstrlenW (lpString=".rar") returned 4 [0099.768] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.768] lstrlenW (lpString=".bz2") returned 4 [0099.768] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.768] lstrlenW (lpString=".7z") returned 3 [0099.768] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.768] lstrlenW (lpString=".dbf") returned 4 [0099.768] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.768] lstrlenW (lpString=".1cd") returned 4 [0099.768] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 63 [0099.768] lstrlenW (lpString=".jpg") returned 4 [0099.768] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.768] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") [0099.843] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=97145) returned 1 [0099.843] CloseHandle (hObject=0x15c) returned 1 [0099.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 0x20 [0099.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.843] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.843] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0099.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.844] GetLastError () returned 0x0 [0099.844] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x17b79, lpOverlapped=0x0) returned 1 [0099.949] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x17b80, lpOverlapped=0x0) returned 1 [0099.951] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0099.951] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.951] SetEndOfFile (hFile=0x19c) returned 1 [0100.201] CloseHandle (hObject=0x19c) returned 1 [0100.201] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.202] SetEndOfFile (hFile=0x15c) returned 1 [0100.217] CloseHandle (hObject=0x15c) returned 1 [0100.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 1 [0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.218] lstrlenW (lpString=".doc") returned 4 [0100.218] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.218] lstrlenW (lpString=".docx") returned 5 [0100.218] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0100.218] lstrlenW (lpString=".pdf") returned 4 [0100.218] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.218] lstrlenW (lpString=".xls") returned 4 [0100.218] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.218] lstrlenW (lpString=".xlsx") returned 5 [0100.218] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0100.218] lstrlenW (lpString=".ppt") returned 4 [0100.218] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.218] lstrlenW (lpString=".zip") returned 4 [0100.218] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.218] lstrlenW (lpString=".rar") returned 4 [0100.218] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.218] lstrlenW (lpString=".bz2") returned 4 [0100.218] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.218] lstrlenW (lpString=".7z") returned 3 [0100.218] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.219] lstrlenW (lpString=".dbf") returned 4 [0100.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.219] lstrlenW (lpString=".1cd") returned 4 [0100.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 63 [0100.219] lstrlenW (lpString=".jpg") returned 4 [0100.219] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.219] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") [0100.219] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=89417) returned 1 [0100.219] CloseHandle (hObject=0x15c) returned 1 [0100.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 0x20 [0100.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.220] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.220] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.220] GetLastError () returned 0x0 [0100.220] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x15d49, lpOverlapped=0x0) returned 1 [0100.224] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x15d50, lpOverlapped=0x0) returned 1 [0100.226] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.226] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.226] SetEndOfFile (hFile=0x19c) returned 1 [0100.226] CloseHandle (hObject=0x19c) returned 1 [0100.226] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.226] SetEndOfFile (hFile=0x15c) returned 1 [0100.228] CloseHandle (hObject=0x15c) returned 1 [0100.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 1 [0100.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.228] lstrlenW (lpString=".doc") returned 4 [0100.229] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0100.229] lstrlenW (lpString=".docx") returned 5 [0100.229] lstrcmpiW (lpString1=".docx", lpString2="2.PNG") returned -1 [0100.229] lstrlenW (lpString=".pdf") returned 4 [0100.229] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0100.229] lstrlenW (lpString=".xls") returned 4 [0100.229] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0100.229] lstrlenW (lpString=".xlsx") returned 5 [0100.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.PNG") returned -1 [0100.229] lstrlenW (lpString=".ppt") returned 4 [0100.229] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.229] lstrlenW (lpString=".zip") returned 4 [0100.229] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0100.229] lstrlenW (lpString=".rar") returned 4 [0100.229] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0100.229] lstrlenW (lpString=".bz2") returned 4 [0100.229] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0100.229] lstrlenW (lpString=".7z") returned 3 [0100.229] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.229] lstrlenW (lpString=".dbf") returned 4 [0100.229] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.229] lstrlenW (lpString=".1cd") returned 4 [0100.229] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 63 [0100.230] lstrlenW (lpString=".jpg") returned 4 [0100.230] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0100.230] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") [0100.231] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=124982) returned 1 [0100.231] CloseHandle (hObject=0x15c) returned 1 [0100.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 0x20 [0100.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.231] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.231] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.232] GetLastError () returned 0x0 [0100.232] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1e836, lpOverlapped=0x0) returned 1 [0100.236] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e840, lpOverlapped=0x0) returned 1 [0100.239] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.239] SetEndOfFile (hFile=0x19c) returned 1 [0100.240] CloseHandle (hObject=0x19c) returned 1 [0100.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.240] SetEndOfFile (hFile=0x15c) returned 1 [0100.242] CloseHandle (hObject=0x15c) returned 1 [0100.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 1 [0100.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.242] lstrlenW (lpString=".doc") returned 4 [0100.242] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0100.242] lstrlenW (lpString=".docx") returned 5 [0100.243] lstrcmpiW (lpString1=".docx", lpString2="3.PNG") returned -1 [0100.243] lstrlenW (lpString=".pdf") returned 4 [0100.243] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0100.243] lstrlenW (lpString=".xls") returned 4 [0100.243] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0100.243] lstrlenW (lpString=".xlsx") returned 5 [0100.243] lstrcmpiW (lpString1=".xlsx", lpString2="3.PNG") returned -1 [0100.243] lstrlenW (lpString=".ppt") returned 4 [0100.243] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.243] lstrlenW (lpString=".zip") returned 4 [0100.243] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0100.243] lstrlenW (lpString=".rar") returned 4 [0100.243] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0100.243] lstrlenW (lpString=".bz2") returned 4 [0100.243] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0100.243] lstrlenW (lpString=".7z") returned 3 [0100.243] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.243] lstrlenW (lpString=".dbf") returned 4 [0100.243] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.243] lstrlenW (lpString=".1cd") returned 4 [0100.243] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0100.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 63 [0100.243] lstrlenW (lpString=".jpg") returned 4 [0100.243] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0100.244] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") [0100.245] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=105053) returned 1 [0100.245] CloseHandle (hObject=0x15c) returned 1 [0100.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 0x20 [0100.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.245] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.245] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.247] GetLastError () returned 0x0 [0100.247] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x19a5d, lpOverlapped=0x0) returned 1 [0100.251] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x19a60, lpOverlapped=0x0) returned 1 [0100.253] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.253] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.254] SetEndOfFile (hFile=0x19c) returned 1 [0100.254] CloseHandle (hObject=0x19c) returned 1 [0100.254] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.254] SetEndOfFile (hFile=0x15c) returned 1 [0100.255] CloseHandle (hObject=0x15c) returned 1 [0100.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 1 [0100.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.256] lstrlenW (lpString=".doc") returned 4 [0100.256] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0100.256] lstrlenW (lpString=".docx") returned 5 [0100.256] lstrcmpiW (lpString1=".docx", lpString2="4.PNG") returned -1 [0100.256] lstrlenW (lpString=".pdf") returned 4 [0100.256] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0100.256] lstrlenW (lpString=".xls") returned 4 [0100.256] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0100.256] lstrlenW (lpString=".xlsx") returned 5 [0100.376] lstrcmpiW (lpString1=".xlsx", lpString2="4.PNG") returned -1 [0100.376] lstrlenW (lpString=".ppt") returned 4 [0100.376] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0100.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.376] lstrlenW (lpString=".zip") returned 4 [0100.376] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0100.376] lstrlenW (lpString=".rar") returned 4 [0100.376] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0100.376] lstrlenW (lpString=".bz2") returned 4 [0100.376] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0100.376] lstrlenW (lpString=".7z") returned 3 [0100.376] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0100.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.376] lstrlenW (lpString=".dbf") returned 4 [0100.376] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0100.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.376] lstrlenW (lpString=".1cd") returned 4 [0100.376] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0100.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 63 [0100.376] lstrlenW (lpString=".jpg") returned 4 [0100.376] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0100.376] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") [0100.485] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4996) returned 1 [0100.486] CloseHandle (hObject=0x16c) returned 1 [0100.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 0x20 [0100.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.486] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.486] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.487] GetLastError () returned 0x0 [0100.487] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1384, lpOverlapped=0x0) returned 1 [0100.489] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1390, lpOverlapped=0x0) returned 1 [0100.490] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.490] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.490] SetEndOfFile (hFile=0x1fc) returned 1 [0100.490] CloseHandle (hObject=0x1fc) returned 1 [0100.491] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.491] SetEndOfFile (hFile=0x16c) returned 1 [0100.491] CloseHandle (hObject=0x16c) returned 1 [0100.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 1 [0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.492] lstrlenW (lpString=".doc") returned 4 [0100.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.492] lstrlenW (lpString=".docx") returned 5 [0100.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.492] lstrlenW (lpString=".pdf") returned 4 [0100.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.492] lstrlenW (lpString=".xls") returned 4 [0100.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.492] lstrlenW (lpString=".xlsx") returned 5 [0100.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.492] lstrlenW (lpString=".ppt") returned 4 [0100.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.492] lstrlenW (lpString=".zip") returned 4 [0100.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.492] lstrlenW (lpString=".rar") returned 4 [0100.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.492] lstrlenW (lpString=".bz2") returned 4 [0100.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.492] lstrlenW (lpString=".7z") returned 3 [0100.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.492] lstrlenW (lpString=".dbf") returned 4 [0100.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".1cd") returned 4 [0100.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".jpg") returned 4 [0100.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString=".pdf") returned 4 [0100.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString=".xls") returned 4 [0100.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.493] lstrlenW (lpString=".xlsx") returned 5 [0100.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.493] lstrlenW (lpString=".ppt") returned 4 [0100.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".zip") returned 4 [0100.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.493] lstrlenW (lpString=".rar") returned 4 [0100.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString=".bz2") returned 4 [0100.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString=".7z") returned 3 [0100.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".dbf") returned 4 [0100.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".1cd") returned 4 [0100.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 63 [0100.493] lstrlenW (lpString=".jpg") returned 4 [0100.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.494] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") [0100.494] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2148) returned 1 [0100.494] CloseHandle (hObject=0x16c) returned 1 [0100.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 0x20 [0100.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.494] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.495] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.495] GetLastError () returned 0x0 [0100.495] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x864, lpOverlapped=0x0) returned 1 [0100.497] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x870, lpOverlapped=0x0) returned 1 [0100.498] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.498] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.498] SetEndOfFile (hFile=0x1fc) returned 1 [0100.498] CloseHandle (hObject=0x1fc) returned 1 [0100.498] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.498] SetEndOfFile (hFile=0x16c) returned 1 [0100.499] CloseHandle (hObject=0x16c) returned 1 [0100.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 1 [0100.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.499] lstrlenW (lpString=".doc") returned 4 [0100.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.499] lstrlenW (lpString=".docx") returned 5 [0100.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.499] lstrlenW (lpString=".pdf") returned 4 [0100.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.499] lstrlenW (lpString=".xls") returned 4 [0100.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.500] lstrlenW (lpString=".xlsx") returned 5 [0100.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.500] lstrlenW (lpString=".ppt") returned 4 [0100.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.500] lstrlenW (lpString=".zip") returned 4 [0100.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.500] lstrlenW (lpString=".rar") returned 4 [0100.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString=".bz2") returned 4 [0100.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString=".7z") returned 3 [0100.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.500] lstrlenW (lpString=".dbf") returned 4 [0100.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.500] lstrlenW (lpString=".1cd") returned 4 [0100.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.500] lstrlenW (lpString=".jpg") returned 4 [0100.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString=".pdf") returned 4 [0100.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString=".xls") returned 4 [0100.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.500] lstrlenW (lpString=".xlsx") returned 5 [0100.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.500] lstrlenW (lpString=".ppt") returned 4 [0100.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.500] lstrlenW (lpString=".zip") returned 4 [0100.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.501] lstrlenW (lpString=".rar") returned 4 [0100.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.501] lstrlenW (lpString=".bz2") returned 4 [0100.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.501] lstrlenW (lpString=".7z") returned 3 [0100.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.501] lstrlenW (lpString=".dbf") returned 4 [0100.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.501] lstrlenW (lpString=".1cd") returned 4 [0100.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 63 [0100.501] lstrlenW (lpString=".jpg") returned 4 [0100.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.501] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") [0100.502] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4466) returned 1 [0100.502] CloseHandle (hObject=0x16c) returned 1 [0100.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 0x20 [0100.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.502] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.502] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.503] GetLastError () returned 0x0 [0100.503] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1172, lpOverlapped=0x0) returned 1 [0100.504] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1180, lpOverlapped=0x0) returned 1 [0100.505] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.505] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.505] SetEndOfFile (hFile=0x1fc) returned 1 [0100.505] CloseHandle (hObject=0x1fc) returned 1 [0100.505] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.506] SetEndOfFile (hFile=0x16c) returned 1 [0100.506] CloseHandle (hObject=0x16c) returned 1 [0100.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 1 [0100.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.507] lstrlenW (lpString=".doc") returned 4 [0100.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.507] lstrlenW (lpString=".docx") returned 5 [0100.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.507] lstrlenW (lpString=".pdf") returned 4 [0100.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.507] lstrlenW (lpString=".xls") returned 4 [0100.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.507] lstrlenW (lpString=".xlsx") returned 5 [0100.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.507] lstrlenW (lpString=".ppt") returned 4 [0100.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.507] lstrlenW (lpString=".zip") returned 4 [0100.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.507] lstrlenW (lpString=".rar") returned 4 [0100.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.507] lstrlenW (lpString=".bz2") returned 4 [0100.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.507] lstrlenW (lpString=".7z") returned 3 [0100.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.507] lstrlenW (lpString=".dbf") returned 4 [0100.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".1cd") returned 4 [0100.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".jpg") returned 4 [0100.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString=".pdf") returned 4 [0100.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString=".xls") returned 4 [0100.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.508] lstrlenW (lpString=".xlsx") returned 5 [0100.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.508] lstrlenW (lpString=".ppt") returned 4 [0100.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".zip") returned 4 [0100.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.508] lstrlenW (lpString=".rar") returned 4 [0100.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString=".bz2") returned 4 [0100.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString=".7z") returned 3 [0100.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".dbf") returned 4 [0100.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".1cd") returned 4 [0100.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 63 [0100.508] lstrlenW (lpString=".jpg") returned 4 [0100.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.509] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") [0100.510] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8394) returned 1 [0100.510] CloseHandle (hObject=0x16c) returned 1 [0100.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 0x20 [0100.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.510] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.510] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.511] GetLastError () returned 0x0 [0100.511] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x20ca, lpOverlapped=0x0) returned 1 [0100.513] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x20d0, lpOverlapped=0x0) returned 1 [0100.513] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.514] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.514] SetEndOfFile (hFile=0x1fc) returned 1 [0100.514] CloseHandle (hObject=0x1fc) returned 1 [0100.514] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.514] SetEndOfFile (hFile=0x16c) returned 1 [0100.515] CloseHandle (hObject=0x16c) returned 1 [0100.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 1 [0100.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.515] lstrlenW (lpString=".doc") returned 4 [0100.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.515] lstrlenW (lpString=".docx") returned 5 [0100.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.515] lstrlenW (lpString=".pdf") returned 4 [0100.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.515] lstrlenW (lpString=".xls") returned 4 [0100.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.515] lstrlenW (lpString=".xlsx") returned 5 [0100.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.515] lstrlenW (lpString=".ppt") returned 4 [0100.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.516] lstrlenW (lpString=".zip") returned 4 [0100.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.516] lstrlenW (lpString=".rar") returned 4 [0100.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString=".bz2") returned 4 [0100.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString=".7z") returned 3 [0100.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.516] lstrlenW (lpString=".dbf") returned 4 [0100.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.516] lstrlenW (lpString=".1cd") returned 4 [0100.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.516] lstrlenW (lpString=".jpg") returned 4 [0100.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString=".pdf") returned 4 [0100.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString=".xls") returned 4 [0100.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.516] lstrlenW (lpString=".xlsx") returned 5 [0100.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.516] lstrlenW (lpString=".ppt") returned 4 [0100.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.516] lstrlenW (lpString=".zip") returned 4 [0100.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.516] lstrlenW (lpString=".rar") returned 4 [0100.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.516] lstrlenW (lpString=".bz2") returned 4 [0100.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.517] lstrlenW (lpString=".7z") returned 3 [0100.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.517] lstrlenW (lpString=".dbf") returned 4 [0100.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.517] lstrlenW (lpString=".1cd") returned 4 [0100.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 63 [0100.517] lstrlenW (lpString=".jpg") returned 4 [0100.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.517] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") [0100.518] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8642) returned 1 [0100.518] CloseHandle (hObject=0x16c) returned 1 [0100.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 0x20 [0100.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.518] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.518] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.519] GetLastError () returned 0x0 [0100.519] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x21c2, lpOverlapped=0x0) returned 1 [0100.646] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x21d0, lpOverlapped=0x0) returned 1 [0100.647] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.647] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.648] SetEndOfFile (hFile=0x1fc) returned 1 [0100.648] CloseHandle (hObject=0x1fc) returned 1 [0100.648] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.648] SetEndOfFile (hFile=0x16c) returned 1 [0100.649] CloseHandle (hObject=0x16c) returned 1 [0100.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.659] lstrlenW (lpString=".doc") returned 4 [0100.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.659] lstrlenW (lpString=".docx") returned 5 [0100.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.660] lstrlenW (lpString=".pdf") returned 4 [0100.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString=".xls") returned 4 [0100.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.660] lstrlenW (lpString=".xlsx") returned 5 [0100.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.660] lstrlenW (lpString=".ppt") returned 4 [0100.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.660] lstrlenW (lpString=".zip") returned 4 [0100.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.660] lstrlenW (lpString=".rar") returned 4 [0100.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString=".bz2") returned 4 [0100.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString=".7z") returned 3 [0100.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.660] lstrlenW (lpString=".dbf") returned 4 [0100.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.660] lstrlenW (lpString=".1cd") returned 4 [0100.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.660] lstrlenW (lpString=".jpg") returned 4 [0100.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString=".pdf") returned 4 [0100.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.660] lstrlenW (lpString=".xls") returned 4 [0100.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.660] lstrlenW (lpString=".xlsx") returned 5 [0100.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.660] lstrlenW (lpString=".ppt") returned 4 [0100.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.661] lstrlenW (lpString=".zip") returned 4 [0100.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.661] lstrlenW (lpString=".rar") returned 4 [0100.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.661] lstrlenW (lpString=".bz2") returned 4 [0100.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.661] lstrlenW (lpString=".7z") returned 3 [0100.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.661] lstrlenW (lpString=".dbf") returned 4 [0100.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.661] lstrlenW (lpString=".1cd") returned 4 [0100.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 63 [0100.661] lstrlenW (lpString=".jpg") returned 4 [0100.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.661] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") [0100.804] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2912) returned 1 [0100.804] CloseHandle (hObject=0x158) returned 1 [0100.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 0x20 [0100.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.810] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.810] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.826] GetLastError () returned 0x0 [0100.826] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb60, lpOverlapped=0x0) returned 1 [0100.835] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb70, lpOverlapped=0x0) returned 1 [0100.836] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.836] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.836] SetEndOfFile (hFile=0x1fc) returned 1 [0100.837] CloseHandle (hObject=0x1fc) returned 1 [0100.837] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.837] SetEndOfFile (hFile=0x158) returned 1 [0100.837] CloseHandle (hObject=0x158) returned 1 [0100.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 1 [0100.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.838] lstrlenW (lpString=".doc") returned 4 [0100.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.838] lstrlenW (lpString=".docx") returned 5 [0100.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.838] lstrlenW (lpString=".pdf") returned 4 [0100.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.838] lstrlenW (lpString=".xls") returned 4 [0100.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.838] lstrlenW (lpString=".xlsx") returned 5 [0100.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.838] lstrlenW (lpString=".ppt") returned 4 [0100.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.838] lstrlenW (lpString=".zip") returned 4 [0100.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.838] lstrlenW (lpString=".rar") returned 4 [0100.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.838] lstrlenW (lpString=".bz2") returned 4 [0100.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.838] lstrlenW (lpString=".7z") returned 3 [0100.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".dbf") returned 4 [0100.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".1cd") returned 4 [0100.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".jpg") returned 4 [0100.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString=".pdf") returned 4 [0100.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString=".xls") returned 4 [0100.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.839] lstrlenW (lpString=".xlsx") returned 5 [0100.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.839] lstrlenW (lpString=".ppt") returned 4 [0100.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".zip") returned 4 [0100.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.839] lstrlenW (lpString=".rar") returned 4 [0100.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString=".bz2") returned 4 [0100.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString=".7z") returned 3 [0100.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".dbf") returned 4 [0100.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".1cd") returned 4 [0100.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 63 [0100.839] lstrlenW (lpString=".jpg") returned 4 [0100.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.840] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") [0100.840] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1612) returned 1 [0100.840] CloseHandle (hObject=0x158) returned 1 [0100.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 0x20 [0100.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.840] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.841] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.841] GetLastError () returned 0x0 [0100.841] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x64c, lpOverlapped=0x0) returned 1 [0100.843] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x650, lpOverlapped=0x0) returned 1 [0100.844] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.844] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.844] SetEndOfFile (hFile=0x1fc) returned 1 [0100.844] CloseHandle (hObject=0x1fc) returned 1 [0100.844] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.844] SetEndOfFile (hFile=0x158) returned 1 [0100.845] CloseHandle (hObject=0x158) returned 1 [0100.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 1 [0100.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.845] lstrlenW (lpString=".doc") returned 4 [0100.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.845] lstrlenW (lpString=".docx") returned 5 [0100.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.845] lstrlenW (lpString=".pdf") returned 4 [0100.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.845] lstrlenW (lpString=".xls") returned 4 [0100.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.845] lstrlenW (lpString=".xlsx") returned 5 [0100.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.846] lstrlenW (lpString=".ppt") returned 4 [0100.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.846] lstrlenW (lpString=".zip") returned 4 [0100.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.846] lstrlenW (lpString=".rar") returned 4 [0100.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString=".bz2") returned 4 [0100.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString=".7z") returned 3 [0100.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.846] lstrlenW (lpString=".dbf") returned 4 [0100.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.846] lstrlenW (lpString=".1cd") returned 4 [0100.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.846] lstrlenW (lpString=".jpg") returned 4 [0100.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString=".pdf") returned 4 [0100.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString=".xls") returned 4 [0100.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.846] lstrlenW (lpString=".xlsx") returned 5 [0100.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.846] lstrlenW (lpString=".ppt") returned 4 [0100.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.846] lstrlenW (lpString=".zip") returned 4 [0100.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.846] lstrlenW (lpString=".rar") returned 4 [0100.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.847] lstrlenW (lpString=".bz2") returned 4 [0100.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.847] lstrlenW (lpString=".7z") returned 3 [0100.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.847] lstrlenW (lpString=".dbf") returned 4 [0100.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.847] lstrlenW (lpString=".1cd") returned 4 [0100.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 63 [0100.847] lstrlenW (lpString=".jpg") returned 4 [0100.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.847] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") [0100.848] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=30296) returned 1 [0100.848] CloseHandle (hObject=0x158) returned 1 [0100.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 0x20 [0100.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.848] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.848] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.849] GetLastError () returned 0x0 [0100.849] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7658, lpOverlapped=0x0) returned 1 [0100.851] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7660, lpOverlapped=0x0) returned 1 [0100.852] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.853] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.853] SetEndOfFile (hFile=0x1fc) returned 1 [0100.853] CloseHandle (hObject=0x1fc) returned 1 [0100.853] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.853] SetEndOfFile (hFile=0x158) returned 1 [0100.854] CloseHandle (hObject=0x158) returned 1 [0100.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.854] lstrlenW (lpString=".doc") returned 4 [0100.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.854] lstrlenW (lpString=".docx") returned 5 [0100.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.854] lstrlenW (lpString=".pdf") returned 4 [0100.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.854] lstrlenW (lpString=".xls") returned 4 [0100.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.854] lstrlenW (lpString=".xlsx") returned 5 [0100.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.855] lstrlenW (lpString=".ppt") returned 4 [0100.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.855] lstrlenW (lpString=".zip") returned 4 [0100.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.855] lstrlenW (lpString=".rar") returned 4 [0100.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString=".bz2") returned 4 [0100.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString=".7z") returned 3 [0100.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.855] lstrlenW (lpString=".dbf") returned 4 [0100.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.855] lstrlenW (lpString=".1cd") returned 4 [0100.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.855] lstrlenW (lpString=".jpg") returned 4 [0100.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString=".pdf") returned 4 [0100.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString=".xls") returned 4 [0100.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.855] lstrlenW (lpString=".xlsx") returned 5 [0100.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.855] lstrlenW (lpString=".ppt") returned 4 [0100.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.855] lstrlenW (lpString=".zip") returned 4 [0100.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.855] lstrlenW (lpString=".rar") returned 4 [0100.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.855] lstrlenW (lpString=".bz2") returned 4 [0100.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.856] lstrlenW (lpString=".7z") returned 3 [0100.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.856] lstrlenW (lpString=".dbf") returned 4 [0100.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.856] lstrlenW (lpString=".1cd") returned 4 [0100.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 63 [0100.856] lstrlenW (lpString=".jpg") returned 4 [0100.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.856] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") [0100.856] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9208) returned 1 [0100.856] CloseHandle (hObject=0x158) returned 1 [0100.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 0x20 [0100.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.857] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.857] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.857] GetLastError () returned 0x0 [0100.857] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x23f8, lpOverlapped=0x0) returned 1 [0100.859] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2400, lpOverlapped=0x0) returned 1 [0100.860] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.860] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.861] SetEndOfFile (hFile=0x1fc) returned 1 [0100.861] CloseHandle (hObject=0x1fc) returned 1 [0100.861] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.861] SetEndOfFile (hFile=0x158) returned 1 [0100.862] CloseHandle (hObject=0x158) returned 1 [0100.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 1 [0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.862] lstrlenW (lpString=".doc") returned 4 [0100.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.862] lstrlenW (lpString=".docx") returned 5 [0100.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.862] lstrlenW (lpString=".pdf") returned 4 [0100.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.862] lstrlenW (lpString=".xls") returned 4 [0100.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.862] lstrlenW (lpString=".xlsx") returned 5 [0100.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.862] lstrlenW (lpString=".ppt") returned 4 [0100.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.862] lstrlenW (lpString=".zip") returned 4 [0100.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.862] lstrlenW (lpString=".rar") returned 4 [0100.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.862] lstrlenW (lpString=".bz2") returned 4 [0100.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString=".7z") returned 3 [0100.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.863] lstrlenW (lpString=".dbf") returned 4 [0100.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.863] lstrlenW (lpString=".1cd") returned 4 [0100.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.863] lstrlenW (lpString=".jpg") returned 4 [0100.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString=".pdf") returned 4 [0100.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString=".xls") returned 4 [0100.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.863] lstrlenW (lpString=".xlsx") returned 5 [0100.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.863] lstrlenW (lpString=".ppt") returned 4 [0100.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.863] lstrlenW (lpString=".zip") returned 4 [0100.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.863] lstrlenW (lpString=".rar") returned 4 [0100.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString=".bz2") returned 4 [0100.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString=".7z") returned 3 [0100.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.863] lstrlenW (lpString=".dbf") returned 4 [0100.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.864] lstrlenW (lpString=".1cd") returned 4 [0100.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 63 [0100.864] lstrlenW (lpString=".jpg") returned 4 [0100.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.864] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") [0100.864] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1928) returned 1 [0100.864] CloseHandle (hObject=0x158) returned 1 [0100.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 0x20 [0100.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.865] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.865] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.865] GetLastError () returned 0x0 [0100.866] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x788, lpOverlapped=0x0) returned 1 [0100.867] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x790, lpOverlapped=0x0) returned 1 [0100.868] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.868] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.868] SetEndOfFile (hFile=0x1fc) returned 1 [0100.868] CloseHandle (hObject=0x1fc) returned 1 [0100.868] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.868] SetEndOfFile (hFile=0x158) returned 1 [0100.869] CloseHandle (hObject=0x158) returned 1 [0100.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 1 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString=".doc") returned 4 [0100.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString=".docx") returned 5 [0100.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.870] lstrlenW (lpString=".pdf") returned 4 [0100.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString=".xls") returned 4 [0100.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.870] lstrlenW (lpString=".xlsx") returned 5 [0100.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.870] lstrlenW (lpString=".ppt") returned 4 [0100.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString=".zip") returned 4 [0100.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.870] lstrlenW (lpString=".rar") returned 4 [0100.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString=".bz2") returned 4 [0100.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString=".7z") returned 3 [0100.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString=".dbf") returned 4 [0100.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString=".1cd") returned 4 [0100.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.870] lstrlenW (lpString=".jpg") returned 4 [0100.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.870] lstrlenW (lpString=".pdf") returned 4 [0100.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString=".xls") returned 4 [0100.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.871] lstrlenW (lpString=".xlsx") returned 5 [0100.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.871] lstrlenW (lpString=".ppt") returned 4 [0100.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.871] lstrlenW (lpString=".zip") returned 4 [0100.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.871] lstrlenW (lpString=".rar") returned 4 [0100.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString=".bz2") returned 4 [0100.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString=".7z") returned 3 [0100.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.871] lstrlenW (lpString=".dbf") returned 4 [0100.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.871] lstrlenW (lpString=".1cd") returned 4 [0100.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 63 [0100.871] lstrlenW (lpString=".jpg") returned 4 [0100.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.871] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") [0100.872] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2980) returned 1 [0100.872] CloseHandle (hObject=0x158) returned 1 [0100.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 0x20 [0100.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.872] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.872] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.873] GetLastError () returned 0x0 [0100.873] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xba4, lpOverlapped=0x0) returned 1 [0100.874] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0100.875] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.875] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.875] SetEndOfFile (hFile=0x1fc) returned 1 [0100.876] CloseHandle (hObject=0x1fc) returned 1 [0100.876] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.876] SetEndOfFile (hFile=0x158) returned 1 [0100.876] CloseHandle (hObject=0x158) returned 1 [0100.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 1 [0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.877] lstrlenW (lpString=".doc") returned 4 [0100.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString=".docx") returned 5 [0100.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.877] lstrlenW (lpString=".pdf") returned 4 [0100.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString=".xls") returned 4 [0100.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.877] lstrlenW (lpString=".xlsx") returned 5 [0100.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.877] lstrlenW (lpString=".ppt") returned 4 [0100.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.877] lstrlenW (lpString=".zip") returned 4 [0100.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.877] lstrlenW (lpString=".rar") returned 4 [0100.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString=".bz2") returned 4 [0100.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString=".7z") returned 3 [0100.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.877] lstrlenW (lpString=".dbf") returned 4 [0100.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".1cd") returned 4 [0100.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".jpg") returned 4 [0100.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString=".pdf") returned 4 [0100.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString=".xls") returned 4 [0100.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.878] lstrlenW (lpString=".xlsx") returned 5 [0100.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.878] lstrlenW (lpString=".ppt") returned 4 [0100.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".zip") returned 4 [0100.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.878] lstrlenW (lpString=".rar") returned 4 [0100.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString=".bz2") returned 4 [0100.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString=".7z") returned 3 [0100.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".dbf") returned 4 [0100.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".1cd") returned 4 [0100.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 63 [0100.878] lstrlenW (lpString=".jpg") returned 4 [0100.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.878] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") [0100.880] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1300) returned 1 [0100.880] CloseHandle (hObject=0x158) returned 1 [0100.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 0x20 [0100.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.880] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.880] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.881] GetLastError () returned 0x0 [0100.881] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x514, lpOverlapped=0x0) returned 1 [0100.882] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x520, lpOverlapped=0x0) returned 1 [0100.883] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.883] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.883] SetEndOfFile (hFile=0x1fc) returned 1 [0100.883] CloseHandle (hObject=0x1fc) returned 1 [0100.883] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.883] SetEndOfFile (hFile=0x158) returned 1 [0100.884] CloseHandle (hObject=0x158) returned 1 [0100.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString=".doc") returned 4 [0100.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString=".docx") returned 5 [0100.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.885] lstrlenW (lpString=".pdf") returned 4 [0100.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString=".xls") returned 4 [0100.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.885] lstrlenW (lpString=".xlsx") returned 5 [0100.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.885] lstrlenW (lpString=".ppt") returned 4 [0100.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString=".zip") returned 4 [0100.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.885] lstrlenW (lpString=".rar") returned 4 [0100.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString=".bz2") returned 4 [0100.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString=".7z") returned 3 [0100.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString=".dbf") returned 4 [0100.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString=".1cd") returned 4 [0100.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.885] lstrlenW (lpString=".jpg") returned 4 [0100.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString=".pdf") returned 4 [0100.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString=".xls") returned 4 [0100.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.886] lstrlenW (lpString=".xlsx") returned 5 [0100.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.886] lstrlenW (lpString=".ppt") returned 4 [0100.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.886] lstrlenW (lpString=".zip") returned 4 [0100.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.886] lstrlenW (lpString=".rar") returned 4 [0100.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString=".bz2") returned 4 [0100.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString=".7z") returned 3 [0100.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.886] lstrlenW (lpString=".dbf") returned 4 [0100.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.886] lstrlenW (lpString=".1cd") returned 4 [0100.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 63 [0100.886] lstrlenW (lpString=".jpg") returned 4 [0100.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.886] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") [0100.887] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1544) returned 1 [0100.887] CloseHandle (hObject=0x158) returned 1 [0100.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 0x20 [0100.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.887] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.887] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.888] GetLastError () returned 0x0 [0100.888] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x608, lpOverlapped=0x0) returned 1 [0100.889] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x610, lpOverlapped=0x0) returned 1 [0100.890] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.890] SetEndOfFile (hFile=0x1fc) returned 1 [0100.890] CloseHandle (hObject=0x1fc) returned 1 [0100.890] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.890] SetEndOfFile (hFile=0x158) returned 1 [0100.891] CloseHandle (hObject=0x158) returned 1 [0100.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString=".doc") returned 4 [0100.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString=".docx") returned 5 [0100.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.892] lstrlenW (lpString=".pdf") returned 4 [0100.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString=".xls") returned 4 [0100.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.892] lstrlenW (lpString=".xlsx") returned 5 [0100.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.892] lstrlenW (lpString=".ppt") returned 4 [0100.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString=".zip") returned 4 [0100.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.892] lstrlenW (lpString=".rar") returned 4 [0100.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString=".bz2") returned 4 [0100.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString=".7z") returned 3 [0100.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString=".dbf") returned 4 [0100.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString=".1cd") returned 4 [0100.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.892] lstrlenW (lpString=".jpg") returned 4 [0100.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString=".pdf") returned 4 [0100.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString=".xls") returned 4 [0100.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.893] lstrlenW (lpString=".xlsx") returned 5 [0100.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.893] lstrlenW (lpString=".ppt") returned 4 [0100.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.893] lstrlenW (lpString=".zip") returned 4 [0100.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.893] lstrlenW (lpString=".rar") returned 4 [0100.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString=".bz2") returned 4 [0100.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString=".7z") returned 3 [0100.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.893] lstrlenW (lpString=".dbf") returned 4 [0100.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.893] lstrlenW (lpString=".1cd") returned 4 [0100.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 63 [0100.893] lstrlenW (lpString=".jpg") returned 4 [0100.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.893] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") [0100.894] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3416) returned 1 [0100.894] CloseHandle (hObject=0x158) returned 1 [0100.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 0x20 [0100.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.894] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.894] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.895] GetLastError () returned 0x0 [0100.895] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xd58, lpOverlapped=0x0) returned 1 [0100.897] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xd60, lpOverlapped=0x0) returned 1 [0100.898] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0100.898] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.898] SetEndOfFile (hFile=0x1fc) returned 1 [0100.898] CloseHandle (hObject=0x1fc) returned 1 [0100.898] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.898] SetEndOfFile (hFile=0x158) returned 1 [0100.899] CloseHandle (hObject=0x158) returned 1 [0100.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 1 [0100.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.899] lstrlenW (lpString=".doc") returned 4 [0100.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.899] lstrlenW (lpString=".docx") returned 5 [0100.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.899] lstrlenW (lpString=".pdf") returned 4 [0100.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.899] lstrlenW (lpString=".xls") returned 4 [0100.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.899] lstrlenW (lpString=".xlsx") returned 5 [0100.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.899] lstrlenW (lpString=".ppt") returned 4 [0100.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.899] lstrlenW (lpString=".zip") returned 4 [0100.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.900] lstrlenW (lpString=".rar") returned 4 [0100.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".bz2") returned 4 [0100.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".7z") returned 3 [0100.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.900] lstrlenW (lpString=".dbf") returned 4 [0100.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.900] lstrlenW (lpString=".1cd") returned 4 [0100.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.900] lstrlenW (lpString=".jpg") returned 4 [0100.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".pdf") returned 4 [0100.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".xls") returned 4 [0100.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.900] lstrlenW (lpString=".xlsx") returned 5 [0100.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.900] lstrlenW (lpString=".ppt") returned 4 [0100.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.900] lstrlenW (lpString=".zip") returned 4 [0100.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.900] lstrlenW (lpString=".rar") returned 4 [0100.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".bz2") returned 4 [0100.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.900] lstrlenW (lpString=".7z") returned 3 [0100.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.901] lstrlenW (lpString=".dbf") returned 4 [0100.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.901] lstrlenW (lpString=".1cd") returned 4 [0100.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 63 [0100.901] lstrlenW (lpString=".jpg") returned 4 [0100.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.901] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") [0100.901] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12816) returned 1 [0100.901] CloseHandle (hObject=0x158) returned 1 [0100.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 0x20 [0100.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.902] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.902] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0100.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.902] GetLastError () returned 0x0 [0100.902] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3210, lpOverlapped=0x0) returned 1 [0101.022] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3220, lpOverlapped=0x0) returned 1 [0101.047] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0101.047] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.047] SetEndOfFile (hFile=0x1fc) returned 1 [0101.047] CloseHandle (hObject=0x1fc) returned 1 [0101.047] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.047] SetEndOfFile (hFile=0x158) returned 1 [0101.048] CloseHandle (hObject=0x158) returned 1 [0101.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString=".doc") returned 4 [0101.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString=".docx") returned 5 [0101.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.049] lstrlenW (lpString=".pdf") returned 4 [0101.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString=".xls") returned 4 [0101.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.049] lstrlenW (lpString=".xlsx") returned 5 [0101.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.049] lstrlenW (lpString=".ppt") returned 4 [0101.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString=".zip") returned 4 [0101.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.049] lstrlenW (lpString=".rar") returned 4 [0101.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString=".bz2") returned 4 [0101.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString=".7z") returned 3 [0101.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString=".dbf") returned 4 [0101.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString=".1cd") returned 4 [0101.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.049] lstrlenW (lpString=".jpg") returned 4 [0101.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString=".pdf") returned 4 [0101.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString=".xls") returned 4 [0101.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.050] lstrlenW (lpString=".xlsx") returned 5 [0101.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.050] lstrlenW (lpString=".ppt") returned 4 [0101.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.050] lstrlenW (lpString=".zip") returned 4 [0101.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.050] lstrlenW (lpString=".rar") returned 4 [0101.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString=".bz2") returned 4 [0101.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString=".7z") returned 3 [0101.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.050] lstrlenW (lpString=".dbf") returned 4 [0101.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.050] lstrlenW (lpString=".1cd") returned 4 [0101.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 63 [0101.050] lstrlenW (lpString=".jpg") returned 4 [0101.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.050] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") [0101.198] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7284) returned 1 [0101.198] CloseHandle (hObject=0x158) returned 1 [0101.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 0x20 [0101.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.198] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.198] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.199] GetLastError () returned 0x0 [0101.199] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1c74, lpOverlapped=0x0) returned 1 [0101.289] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1c80, lpOverlapped=0x0) returned 1 [0101.290] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0101.290] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.290] SetEndOfFile (hFile=0x1fc) returned 1 [0101.290] CloseHandle (hObject=0x1fc) returned 1 [0101.290] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.290] SetEndOfFile (hFile=0x158) returned 1 [0101.291] CloseHandle (hObject=0x158) returned 1 [0101.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.292] lstrlenW (lpString=".doc") returned 4 [0101.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".docx") returned 5 [0101.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.292] lstrlenW (lpString=".pdf") returned 4 [0101.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".xls") returned 4 [0101.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.292] lstrlenW (lpString=".xlsx") returned 5 [0101.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.292] lstrlenW (lpString=".ppt") returned 4 [0101.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.292] lstrlenW (lpString=".zip") returned 4 [0101.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.292] lstrlenW (lpString=".rar") returned 4 [0101.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".bz2") returned 4 [0101.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".7z") returned 3 [0101.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.292] lstrlenW (lpString=".dbf") returned 4 [0101.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.293] lstrlenW (lpString=".1cd") returned 4 [0101.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.293] lstrlenW (lpString=".jpg") returned 4 [0101.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString=".pdf") returned 4 [0101.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString=".xls") returned 4 [0101.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.293] lstrlenW (lpString=".xlsx") returned 5 [0101.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.293] lstrlenW (lpString=".ppt") returned 4 [0101.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.293] lstrlenW (lpString=".zip") returned 4 [0101.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.293] lstrlenW (lpString=".rar") returned 4 [0101.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString=".bz2") returned 4 [0101.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString=".7z") returned 3 [0101.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.293] lstrlenW (lpString=".dbf") returned 4 [0101.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.293] lstrlenW (lpString=".1cd") returned 4 [0101.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 63 [0101.294] lstrlenW (lpString=".jpg") returned 4 [0101.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.294] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") [0101.295] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27638) returned 1 [0101.295] CloseHandle (hObject=0x158) returned 1 [0101.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 0x20 [0101.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.295] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.295] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.296] GetLastError () returned 0x0 [0101.296] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6bf6, lpOverlapped=0x0) returned 1 [0101.357] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6c00, lpOverlapped=0x0) returned 1 [0101.358] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0101.358] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.359] SetEndOfFile (hFile=0x1fc) returned 1 [0101.516] CloseHandle (hObject=0x1fc) returned 1 [0101.516] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.516] SetEndOfFile (hFile=0x158) returned 1 [0101.517] CloseHandle (hObject=0x158) returned 1 [0101.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.770] lstrlenW (lpString=".doc") returned 4 [0101.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.770] lstrlenW (lpString=".docx") returned 5 [0101.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.770] lstrlenW (lpString=".pdf") returned 4 [0101.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.770] lstrlenW (lpString=".xls") returned 4 [0101.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.771] lstrlenW (lpString=".xlsx") returned 5 [0101.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.771] lstrlenW (lpString=".ppt") returned 4 [0101.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.771] lstrlenW (lpString=".zip") returned 4 [0101.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.771] lstrlenW (lpString=".rar") returned 4 [0101.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString=".bz2") returned 4 [0101.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString=".7z") returned 3 [0101.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.771] lstrlenW (lpString=".dbf") returned 4 [0101.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.771] lstrlenW (lpString=".1cd") returned 4 [0101.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.771] lstrlenW (lpString=".jpg") returned 4 [0101.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString=".pdf") returned 4 [0101.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString=".xls") returned 4 [0101.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.771] lstrlenW (lpString=".xlsx") returned 5 [0101.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.771] lstrlenW (lpString=".ppt") returned 4 [0101.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.771] lstrlenW (lpString=".zip") returned 4 [0101.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.772] lstrlenW (lpString=".rar") returned 4 [0101.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.772] lstrlenW (lpString=".bz2") returned 4 [0101.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.772] lstrlenW (lpString=".7z") returned 3 [0101.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.772] lstrlenW (lpString=".dbf") returned 4 [0101.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.772] lstrlenW (lpString=".1cd") returned 4 [0101.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 63 [0101.772] lstrlenW (lpString=".jpg") returned 4 [0101.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.772] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") [0101.773] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=263186) returned 1 [0101.773] CloseHandle (hObject=0x1a0) returned 1 [0101.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 0x20 [0101.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.773] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.773] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0101.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.118] GetLastError () returned 0x0 [0102.118] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x40412, lpOverlapped=0x0) returned 1 [0102.126] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x40420, lpOverlapped=0x0) returned 1 [0102.141] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.141] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.141] SetEndOfFile (hFile=0x15c) returned 1 [0102.141] CloseHandle (hObject=0x15c) returned 1 [0102.141] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.141] SetEndOfFile (hFile=0x1a0) returned 1 [0102.144] CloseHandle (hObject=0x1a0) returned 1 [0102.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 1 [0102.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.145] lstrlenW (lpString=".doc") returned 4 [0102.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString=".docx") returned 5 [0102.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.145] lstrlenW (lpString=".pdf") returned 4 [0102.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString=".xls") returned 4 [0102.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.145] lstrlenW (lpString=".xlsx") returned 5 [0102.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.145] lstrlenW (lpString=".ppt") returned 4 [0102.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.145] lstrlenW (lpString=".zip") returned 4 [0102.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.145] lstrlenW (lpString=".rar") returned 4 [0102.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString=".bz2") returned 4 [0102.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString=".7z") returned 3 [0102.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.145] lstrlenW (lpString=".dbf") returned 4 [0102.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.145] lstrlenW (lpString=".1cd") returned 4 [0102.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.146] lstrlenW (lpString=".jpg") returned 4 [0102.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString=".pdf") returned 4 [0102.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString=".xls") returned 4 [0102.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.146] lstrlenW (lpString=".xlsx") returned 5 [0102.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.146] lstrlenW (lpString=".ppt") returned 4 [0102.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.146] lstrlenW (lpString=".zip") returned 4 [0102.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.146] lstrlenW (lpString=".rar") returned 4 [0102.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString=".bz2") returned 4 [0102.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString=".7z") returned 3 [0102.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.146] lstrlenW (lpString=".dbf") returned 4 [0102.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.146] lstrlenW (lpString=".1cd") returned 4 [0102.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 63 [0102.146] lstrlenW (lpString=".jpg") returned 4 [0102.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.146] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") [0102.148] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=176494) returned 1 [0102.148] CloseHandle (hObject=0x1a0) returned 1 [0102.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 0x20 [0102.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.148] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.148] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.149] GetLastError () returned 0x0 [0102.149] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2b16e, lpOverlapped=0x0) returned 1 [0102.154] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2b170, lpOverlapped=0x0) returned 1 [0102.157] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.157] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.157] SetEndOfFile (hFile=0x15c) returned 1 [0102.157] CloseHandle (hObject=0x15c) returned 1 [0102.157] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.157] SetEndOfFile (hFile=0x1a0) returned 1 [0102.159] CloseHandle (hObject=0x1a0) returned 1 [0102.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 1 [0102.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.159] lstrlenW (lpString=".doc") returned 4 [0102.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.159] lstrlenW (lpString=".docx") returned 5 [0102.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.159] lstrlenW (lpString=".pdf") returned 4 [0102.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.159] lstrlenW (lpString=".xls") returned 4 [0102.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.160] lstrlenW (lpString=".xlsx") returned 5 [0102.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.160] lstrlenW (lpString=".ppt") returned 4 [0102.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.160] lstrlenW (lpString=".zip") returned 4 [0102.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.160] lstrlenW (lpString=".rar") returned 4 [0102.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString=".bz2") returned 4 [0102.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString=".7z") returned 3 [0102.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.160] lstrlenW (lpString=".dbf") returned 4 [0102.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.160] lstrlenW (lpString=".1cd") returned 4 [0102.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.160] lstrlenW (lpString=".jpg") returned 4 [0102.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString=".pdf") returned 4 [0102.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString=".xls") returned 4 [0102.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.160] lstrlenW (lpString=".xlsx") returned 5 [0102.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.160] lstrlenW (lpString=".ppt") returned 4 [0102.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.161] lstrlenW (lpString=".zip") returned 4 [0102.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.161] lstrlenW (lpString=".rar") returned 4 [0102.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.161] lstrlenW (lpString=".bz2") returned 4 [0102.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.161] lstrlenW (lpString=".7z") returned 3 [0102.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.161] lstrlenW (lpString=".dbf") returned 4 [0102.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.161] lstrlenW (lpString=".1cd") returned 4 [0102.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 63 [0102.161] lstrlenW (lpString=".jpg") returned 4 [0102.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.161] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") [0102.219] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20098) returned 1 [0102.219] CloseHandle (hObject=0x16c) returned 1 [0102.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 0x20 [0102.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.219] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.219] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.220] GetLastError () returned 0x0 [0102.220] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4e82, lpOverlapped=0x0) returned 1 [0102.223] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0102.224] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.224] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.224] SetEndOfFile (hFile=0x22c) returned 1 [0102.224] CloseHandle (hObject=0x22c) returned 1 [0102.224] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.224] SetEndOfFile (hFile=0x16c) returned 1 [0102.225] CloseHandle (hObject=0x16c) returned 1 [0102.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 1 [0102.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString=".doc") returned 4 [0102.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString=".docx") returned 5 [0102.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.226] lstrlenW (lpString=".pdf") returned 4 [0102.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString=".xls") returned 4 [0102.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.226] lstrlenW (lpString=".xlsx") returned 5 [0102.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.226] lstrlenW (lpString=".ppt") returned 4 [0102.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString=".zip") returned 4 [0102.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.226] lstrlenW (lpString=".rar") returned 4 [0102.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString=".bz2") returned 4 [0102.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString=".7z") returned 3 [0102.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString=".dbf") returned 4 [0102.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString=".1cd") returned 4 [0102.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.226] lstrlenW (lpString=".jpg") returned 4 [0102.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.226] lstrlenW (lpString=".pdf") returned 4 [0102.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString=".xls") returned 4 [0102.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.227] lstrlenW (lpString=".xlsx") returned 5 [0102.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.227] lstrlenW (lpString=".ppt") returned 4 [0102.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.227] lstrlenW (lpString=".zip") returned 4 [0102.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.227] lstrlenW (lpString=".rar") returned 4 [0102.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString=".bz2") returned 4 [0102.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString=".7z") returned 3 [0102.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.227] lstrlenW (lpString=".dbf") returned 4 [0102.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.227] lstrlenW (lpString=".1cd") returned 4 [0102.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 63 [0102.227] lstrlenW (lpString=".jpg") returned 4 [0102.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.227] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") [0102.228] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8232) returned 1 [0102.228] CloseHandle (hObject=0x16c) returned 1 [0102.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 0x20 [0102.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.228] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.228] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.229] GetLastError () returned 0x0 [0102.229] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2028, lpOverlapped=0x0) returned 1 [0102.230] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2030, lpOverlapped=0x0) returned 1 [0102.232] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.232] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.232] SetEndOfFile (hFile=0x22c) returned 1 [0102.232] CloseHandle (hObject=0x22c) returned 1 [0102.232] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.232] SetEndOfFile (hFile=0x16c) returned 1 [0102.233] CloseHandle (hObject=0x16c) returned 1 [0102.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 1 [0102.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.233] lstrlenW (lpString=".doc") returned 4 [0102.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.233] lstrlenW (lpString=".docx") returned 5 [0102.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.233] lstrlenW (lpString=".pdf") returned 4 [0102.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.233] lstrlenW (lpString=".xls") returned 4 [0102.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.233] lstrlenW (lpString=".xlsx") returned 5 [0102.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.234] lstrlenW (lpString=".ppt") returned 4 [0102.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.234] lstrlenW (lpString=".zip") returned 4 [0102.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.234] lstrlenW (lpString=".rar") returned 4 [0102.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString=".bz2") returned 4 [0102.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString=".7z") returned 3 [0102.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.234] lstrlenW (lpString=".dbf") returned 4 [0102.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.234] lstrlenW (lpString=".1cd") returned 4 [0102.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.234] lstrlenW (lpString=".jpg") returned 4 [0102.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString=".pdf") returned 4 [0102.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString=".xls") returned 4 [0102.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.234] lstrlenW (lpString=".xlsx") returned 5 [0102.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.234] lstrlenW (lpString=".ppt") returned 4 [0102.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.234] lstrlenW (lpString=".zip") returned 4 [0102.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.234] lstrlenW (lpString=".rar") returned 4 [0102.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.235] lstrlenW (lpString=".bz2") returned 4 [0102.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.235] lstrlenW (lpString=".7z") returned 3 [0102.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.235] lstrlenW (lpString=".dbf") returned 4 [0102.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.235] lstrlenW (lpString=".1cd") returned 4 [0102.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 63 [0102.235] lstrlenW (lpString=".jpg") returned 4 [0102.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.235] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") [0102.236] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10414) returned 1 [0102.236] CloseHandle (hObject=0x16c) returned 1 [0102.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 0x20 [0102.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.236] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.237] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.237] GetLastError () returned 0x0 [0102.237] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x28ae, lpOverlapped=0x0) returned 1 [0102.240] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x28b0, lpOverlapped=0x0) returned 1 [0102.241] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.241] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.241] SetEndOfFile (hFile=0x22c) returned 1 [0102.242] CloseHandle (hObject=0x22c) returned 1 [0102.242] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.242] SetEndOfFile (hFile=0x16c) returned 1 [0102.243] CloseHandle (hObject=0x16c) returned 1 [0102.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 1 [0102.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.243] lstrlenW (lpString=".doc") returned 4 [0102.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.243] lstrlenW (lpString=".docx") returned 5 [0102.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.243] lstrlenW (lpString=".pdf") returned 4 [0102.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.243] lstrlenW (lpString=".xls") returned 4 [0102.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.243] lstrlenW (lpString=".xlsx") returned 5 [0102.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.243] lstrlenW (lpString=".ppt") returned 4 [0102.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.243] lstrlenW (lpString=".zip") returned 4 [0102.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.243] lstrlenW (lpString=".rar") returned 4 [0102.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.243] lstrlenW (lpString=".bz2") returned 4 [0102.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.243] lstrlenW (lpString=".7z") returned 3 [0102.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".dbf") returned 4 [0102.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".1cd") returned 4 [0102.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".jpg") returned 4 [0102.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString=".pdf") returned 4 [0102.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString=".xls") returned 4 [0102.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.244] lstrlenW (lpString=".xlsx") returned 5 [0102.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.244] lstrlenW (lpString=".ppt") returned 4 [0102.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".zip") returned 4 [0102.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.244] lstrlenW (lpString=".rar") returned 4 [0102.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString=".bz2") returned 4 [0102.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString=".7z") returned 3 [0102.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".dbf") returned 4 [0102.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.244] lstrlenW (lpString=".1cd") returned 4 [0102.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 63 [0102.245] lstrlenW (lpString=".jpg") returned 4 [0102.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.245] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") [0102.245] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13468) returned 1 [0102.245] CloseHandle (hObject=0x16c) returned 1 [0102.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 0x20 [0102.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.245] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.246] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.246] GetLastError () returned 0x0 [0102.246] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x349c, lpOverlapped=0x0) returned 1 [0102.248] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0102.249] ReadFile (in: hFile=0x16c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.249] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.249] SetEndOfFile (hFile=0x22c) returned 1 [0102.249] CloseHandle (hObject=0x22c) returned 1 [0102.249] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.249] SetEndOfFile (hFile=0x16c) returned 1 [0102.250] CloseHandle (hObject=0x16c) returned 1 [0102.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString=".doc") returned 4 [0102.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString=".docx") returned 5 [0102.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.251] lstrlenW (lpString=".pdf") returned 4 [0102.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString=".xls") returned 4 [0102.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.251] lstrlenW (lpString=".xlsx") returned 5 [0102.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.251] lstrlenW (lpString=".ppt") returned 4 [0102.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString=".zip") returned 4 [0102.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.251] lstrlenW (lpString=".rar") returned 4 [0102.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString=".bz2") returned 4 [0102.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString=".7z") returned 3 [0102.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString=".dbf") returned 4 [0102.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString=".1cd") returned 4 [0102.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.251] lstrlenW (lpString=".jpg") returned 4 [0102.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.251] lstrlenW (lpString=".pdf") returned 4 [0102.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString=".xls") returned 4 [0102.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.252] lstrlenW (lpString=".xlsx") returned 5 [0102.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.252] lstrlenW (lpString=".ppt") returned 4 [0102.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.252] lstrlenW (lpString=".zip") returned 4 [0102.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.252] lstrlenW (lpString=".rar") returned 4 [0102.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString=".bz2") returned 4 [0102.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString=".7z") returned 3 [0102.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.252] lstrlenW (lpString=".dbf") returned 4 [0102.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.252] lstrlenW (lpString=".1cd") returned 4 [0102.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 63 [0102.252] lstrlenW (lpString=".jpg") returned 4 [0102.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.252] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") [0102.253] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3296) returned 1 [0102.253] CloseHandle (hObject=0x16c) returned 1 [0102.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 0x20 [0102.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.410] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.410] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.418] GetLastError () returned 0x0 [0102.418] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xce0, lpOverlapped=0x0) returned 1 [0102.426] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0102.427] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.427] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.427] SetEndOfFile (hFile=0x168) returned 1 [0102.428] CloseHandle (hObject=0x168) returned 1 [0102.428] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.428] SetEndOfFile (hFile=0x1a0) returned 1 [0102.428] CloseHandle (hObject=0x1a0) returned 1 [0102.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.429] lstrlenW (lpString=".doc") returned 4 [0102.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.429] lstrlenW (lpString=".docx") returned 5 [0102.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.429] lstrlenW (lpString=".pdf") returned 4 [0102.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.429] lstrlenW (lpString=".xls") returned 4 [0102.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.429] lstrlenW (lpString=".xlsx") returned 5 [0102.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.429] lstrlenW (lpString=".ppt") returned 4 [0102.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.429] lstrlenW (lpString=".zip") returned 4 [0102.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.429] lstrlenW (lpString=".rar") returned 4 [0102.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.429] lstrlenW (lpString=".bz2") returned 4 [0102.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.429] lstrlenW (lpString=".7z") returned 3 [0102.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".dbf") returned 4 [0102.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".1cd") returned 4 [0102.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".jpg") returned 4 [0102.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString=".pdf") returned 4 [0102.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString=".xls") returned 4 [0102.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.430] lstrlenW (lpString=".xlsx") returned 5 [0102.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.430] lstrlenW (lpString=".ppt") returned 4 [0102.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".zip") returned 4 [0102.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.430] lstrlenW (lpString=".rar") returned 4 [0102.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString=".bz2") returned 4 [0102.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString=".7z") returned 3 [0102.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".dbf") returned 4 [0102.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".1cd") returned 4 [0102.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 63 [0102.430] lstrlenW (lpString=".jpg") returned 4 [0102.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.431] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") [0102.431] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10208) returned 1 [0102.431] CloseHandle (hObject=0x1a0) returned 1 [0102.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 0x20 [0102.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.431] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.431] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.432] GetLastError () returned 0x0 [0102.432] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x27e0, lpOverlapped=0x0) returned 1 [0102.435] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x27f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x27f0, lpOverlapped=0x0) returned 1 [0102.436] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.436] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.436] SetEndOfFile (hFile=0x168) returned 1 [0102.437] CloseHandle (hObject=0x168) returned 1 [0102.437] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.437] SetEndOfFile (hFile=0x1a0) returned 1 [0102.437] CloseHandle (hObject=0x1a0) returned 1 [0102.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 1 [0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.438] lstrlenW (lpString=".doc") returned 4 [0102.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.438] lstrlenW (lpString=".docx") returned 5 [0102.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.438] lstrlenW (lpString=".pdf") returned 4 [0102.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.438] lstrlenW (lpString=".xls") returned 4 [0102.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.438] lstrlenW (lpString=".xlsx") returned 5 [0102.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.438] lstrlenW (lpString=".ppt") returned 4 [0102.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.438] lstrlenW (lpString=".zip") returned 4 [0102.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.438] lstrlenW (lpString=".rar") returned 4 [0102.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.438] lstrlenW (lpString=".bz2") returned 4 [0102.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.438] lstrlenW (lpString=".7z") returned 3 [0102.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".dbf") returned 4 [0102.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".1cd") returned 4 [0102.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".jpg") returned 4 [0102.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString=".pdf") returned 4 [0102.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString=".xls") returned 4 [0102.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.439] lstrlenW (lpString=".xlsx") returned 5 [0102.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.439] lstrlenW (lpString=".ppt") returned 4 [0102.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".zip") returned 4 [0102.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.439] lstrlenW (lpString=".rar") returned 4 [0102.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString=".bz2") returned 4 [0102.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString=".7z") returned 3 [0102.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".dbf") returned 4 [0102.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".1cd") returned 4 [0102.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 63 [0102.439] lstrlenW (lpString=".jpg") returned 4 [0102.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.440] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") [0102.440] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2328) returned 1 [0102.440] CloseHandle (hObject=0x1a0) returned 1 [0102.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 0x20 [0102.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.441] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.441] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.441] GetLastError () returned 0x0 [0102.442] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x918, lpOverlapped=0x0) returned 1 [0102.443] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x920, lpOverlapped=0x0) returned 1 [0102.444] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.444] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.444] SetEndOfFile (hFile=0x168) returned 1 [0102.444] CloseHandle (hObject=0x168) returned 1 [0102.444] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.444] SetEndOfFile (hFile=0x1a0) returned 1 [0102.445] CloseHandle (hObject=0x1a0) returned 1 [0102.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 1 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.446] lstrlenW (lpString=".doc") returned 4 [0102.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString=".docx") returned 5 [0102.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.446] lstrlenW (lpString=".pdf") returned 4 [0102.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString=".xls") returned 4 [0102.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.446] lstrlenW (lpString=".xlsx") returned 5 [0102.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.446] lstrlenW (lpString=".ppt") returned 4 [0102.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.446] lstrlenW (lpString=".zip") returned 4 [0102.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.446] lstrlenW (lpString=".rar") returned 4 [0102.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString=".bz2") returned 4 [0102.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString=".7z") returned 3 [0102.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.446] lstrlenW (lpString=".dbf") returned 4 [0102.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.446] lstrlenW (lpString=".1cd") returned 4 [0102.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.447] lstrlenW (lpString=".jpg") returned 4 [0102.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString=".pdf") returned 4 [0102.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString=".xls") returned 4 [0102.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.447] lstrlenW (lpString=".xlsx") returned 5 [0102.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.447] lstrlenW (lpString=".ppt") returned 4 [0102.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.447] lstrlenW (lpString=".zip") returned 4 [0102.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.447] lstrlenW (lpString=".rar") returned 4 [0102.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString=".bz2") returned 4 [0102.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString=".7z") returned 3 [0102.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.447] lstrlenW (lpString=".dbf") returned 4 [0102.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.447] lstrlenW (lpString=".1cd") returned 4 [0102.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 63 [0102.447] lstrlenW (lpString=".jpg") returned 4 [0102.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.447] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") [0102.449] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1084) returned 1 [0102.449] CloseHandle (hObject=0x1a0) returned 1 [0102.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 0x20 [0102.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.449] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.449] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.450] GetLastError () returned 0x0 [0102.450] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x43c, lpOverlapped=0x0) returned 1 [0102.451] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x440, lpOverlapped=0x0) returned 1 [0102.452] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.452] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.452] SetEndOfFile (hFile=0x168) returned 1 [0102.452] CloseHandle (hObject=0x168) returned 1 [0102.452] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.453] SetEndOfFile (hFile=0x1a0) returned 1 [0102.453] CloseHandle (hObject=0x1a0) returned 1 [0102.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.454] lstrlenW (lpString=".doc") returned 4 [0102.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString=".docx") returned 5 [0102.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.454] lstrlenW (lpString=".pdf") returned 4 [0102.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString=".xls") returned 4 [0102.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.454] lstrlenW (lpString=".xlsx") returned 5 [0102.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.454] lstrlenW (lpString=".ppt") returned 4 [0102.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.454] lstrlenW (lpString=".zip") returned 4 [0102.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.454] lstrlenW (lpString=".rar") returned 4 [0102.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString=".bz2") returned 4 [0102.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString=".7z") returned 3 [0102.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.454] lstrlenW (lpString=".dbf") returned 4 [0102.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".1cd") returned 4 [0102.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".jpg") returned 4 [0102.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString=".pdf") returned 4 [0102.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString=".xls") returned 4 [0102.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.455] lstrlenW (lpString=".xlsx") returned 5 [0102.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.455] lstrlenW (lpString=".ppt") returned 4 [0102.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".zip") returned 4 [0102.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.455] lstrlenW (lpString=".rar") returned 4 [0102.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString=".bz2") returned 4 [0102.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString=".7z") returned 3 [0102.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".dbf") returned 4 [0102.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".1cd") returned 4 [0102.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 63 [0102.455] lstrlenW (lpString=".jpg") returned 4 [0102.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.456] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") [0102.456] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1140) returned 1 [0102.456] CloseHandle (hObject=0x1a0) returned 1 [0102.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 0x20 [0102.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.457] GetLastError () returned 0x0 [0102.457] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x474, lpOverlapped=0x0) returned 1 [0102.597] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x480, lpOverlapped=0x0) returned 1 [0102.598] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.598] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.599] SetEndOfFile (hFile=0x168) returned 1 [0102.599] CloseHandle (hObject=0x168) returned 1 [0102.599] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.599] SetEndOfFile (hFile=0x1a0) returned 1 [0102.600] CloseHandle (hObject=0x1a0) returned 1 [0102.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.600] lstrlenW (lpString=".doc") returned 4 [0102.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".docx") returned 5 [0102.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.600] lstrlenW (lpString=".pdf") returned 4 [0102.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".xls") returned 4 [0102.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.600] lstrlenW (lpString=".xlsx") returned 5 [0102.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.600] lstrlenW (lpString=".ppt") returned 4 [0102.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.601] lstrlenW (lpString=".zip") returned 4 [0102.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.601] lstrlenW (lpString=".rar") returned 4 [0102.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".bz2") returned 4 [0102.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".7z") returned 3 [0102.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.601] lstrlenW (lpString=".dbf") returned 4 [0102.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.601] lstrlenW (lpString=".1cd") returned 4 [0102.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.601] lstrlenW (lpString=".jpg") returned 4 [0102.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".pdf") returned 4 [0102.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".xls") returned 4 [0102.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.601] lstrlenW (lpString=".xlsx") returned 5 [0102.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.601] lstrlenW (lpString=".ppt") returned 4 [0102.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.601] lstrlenW (lpString=".zip") returned 4 [0102.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.601] lstrlenW (lpString=".rar") returned 4 [0102.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".bz2") returned 4 [0102.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.601] lstrlenW (lpString=".7z") returned 3 [0102.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.602] lstrlenW (lpString=".dbf") returned 4 [0102.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.602] lstrlenW (lpString=".1cd") returned 4 [0102.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 63 [0102.602] lstrlenW (lpString=".jpg") returned 4 [0102.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.602] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") [0102.602] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31824) returned 1 [0102.603] CloseHandle (hObject=0x1a0) returned 1 [0102.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 0x20 [0102.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.603] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.603] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.604] GetLastError () returned 0x0 [0102.604] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7c50, lpOverlapped=0x0) returned 1 [0102.605] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0102.607] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.607] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.607] SetEndOfFile (hFile=0x168) returned 1 [0102.607] CloseHandle (hObject=0x168) returned 1 [0102.607] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.607] SetEndOfFile (hFile=0x1a0) returned 1 [0102.608] CloseHandle (hObject=0x1a0) returned 1 [0102.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 1 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString=".doc") returned 4 [0102.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString=".docx") returned 5 [0102.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.609] lstrlenW (lpString=".pdf") returned 4 [0102.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString=".xls") returned 4 [0102.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.609] lstrlenW (lpString=".xlsx") returned 5 [0102.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.609] lstrlenW (lpString=".ppt") returned 4 [0102.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString=".zip") returned 4 [0102.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.609] lstrlenW (lpString=".rar") returned 4 [0102.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString=".bz2") returned 4 [0102.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString=".7z") returned 3 [0102.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString=".dbf") returned 4 [0102.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString=".1cd") returned 4 [0102.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.609] lstrlenW (lpString=".jpg") returned 4 [0102.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString=".pdf") returned 4 [0102.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString=".xls") returned 4 [0102.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.610] lstrlenW (lpString=".xlsx") returned 5 [0102.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.610] lstrlenW (lpString=".ppt") returned 4 [0102.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.610] lstrlenW (lpString=".zip") returned 4 [0102.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.610] lstrlenW (lpString=".rar") returned 4 [0102.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString=".bz2") returned 4 [0102.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString=".7z") returned 3 [0102.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.610] lstrlenW (lpString=".dbf") returned 4 [0102.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.610] lstrlenW (lpString=".1cd") returned 4 [0102.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 63 [0102.610] lstrlenW (lpString=".jpg") returned 4 [0102.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.610] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") [0102.612] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4068) returned 1 [0102.612] CloseHandle (hObject=0x1a0) returned 1 [0102.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 0x20 [0102.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.612] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.612] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.613] GetLastError () returned 0x0 [0102.613] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xfe4, lpOverlapped=0x0) returned 1 [0102.672] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xff0, lpOverlapped=0x0) returned 1 [0102.673] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.673] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.673] SetEndOfFile (hFile=0x168) returned 1 [0102.673] CloseHandle (hObject=0x168) returned 1 [0102.673] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.673] SetEndOfFile (hFile=0x1a0) returned 1 [0102.674] CloseHandle (hObject=0x1a0) returned 1 [0102.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 1 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString=".doc") returned 4 [0102.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString=".docx") returned 5 [0102.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.675] lstrlenW (lpString=".pdf") returned 4 [0102.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString=".xls") returned 4 [0102.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.675] lstrlenW (lpString=".xlsx") returned 5 [0102.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.675] lstrlenW (lpString=".ppt") returned 4 [0102.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString=".zip") returned 4 [0102.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.675] lstrlenW (lpString=".rar") returned 4 [0102.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString=".bz2") returned 4 [0102.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString=".7z") returned 3 [0102.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString=".dbf") returned 4 [0102.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString=".1cd") returned 4 [0102.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.675] lstrlenW (lpString=".jpg") returned 4 [0102.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString=".pdf") returned 4 [0102.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString=".xls") returned 4 [0102.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.676] lstrlenW (lpString=".xlsx") returned 5 [0102.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.676] lstrlenW (lpString=".ppt") returned 4 [0102.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.676] lstrlenW (lpString=".zip") returned 4 [0102.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.676] lstrlenW (lpString=".rar") returned 4 [0102.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString=".bz2") returned 4 [0102.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString=".7z") returned 3 [0102.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.676] lstrlenW (lpString=".dbf") returned 4 [0102.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.676] lstrlenW (lpString=".1cd") returned 4 [0102.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 63 [0102.676] lstrlenW (lpString=".jpg") returned 4 [0102.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.676] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") [0102.677] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6084) returned 1 [0102.677] CloseHandle (hObject=0x1a0) returned 1 [0102.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 0x20 [0102.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.677] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.677] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.678] GetLastError () returned 0x0 [0102.678] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x17c4, lpOverlapped=0x0) returned 1 [0102.729] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x17d0, lpOverlapped=0x0) returned 1 [0102.730] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.730] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.730] SetEndOfFile (hFile=0x168) returned 1 [0102.761] CloseHandle (hObject=0x168) returned 1 [0102.761] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.769] SetEndOfFile (hFile=0x1a0) returned 1 [0102.777] CloseHandle (hObject=0x1a0) returned 1 [0102.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 1 [0102.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.798] lstrlenW (lpString=".doc") returned 4 [0102.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.798] lstrlenW (lpString=".docx") returned 5 [0102.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.798] lstrlenW (lpString=".pdf") returned 4 [0102.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.798] lstrlenW (lpString=".xls") returned 4 [0102.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.798] lstrlenW (lpString=".xlsx") returned 5 [0102.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.799] lstrlenW (lpString=".ppt") returned 4 [0102.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.799] lstrlenW (lpString=".zip") returned 4 [0102.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.799] lstrlenW (lpString=".rar") returned 4 [0102.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString=".bz2") returned 4 [0102.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString=".7z") returned 3 [0102.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.799] lstrlenW (lpString=".dbf") returned 4 [0102.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.799] lstrlenW (lpString=".1cd") returned 4 [0102.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.799] lstrlenW (lpString=".jpg") returned 4 [0102.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString=".pdf") returned 4 [0102.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.799] lstrlenW (lpString=".xls") returned 4 [0102.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.800] lstrlenW (lpString=".xlsx") returned 5 [0102.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.800] lstrlenW (lpString=".ppt") returned 4 [0102.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.800] lstrlenW (lpString=".zip") returned 4 [0102.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.800] lstrlenW (lpString=".rar") returned 4 [0102.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.800] lstrlenW (lpString=".bz2") returned 4 [0102.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.800] lstrlenW (lpString=".7z") returned 3 [0102.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.800] lstrlenW (lpString=".dbf") returned 4 [0102.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.800] lstrlenW (lpString=".1cd") returned 4 [0102.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 63 [0102.800] lstrlenW (lpString=".jpg") returned 4 [0102.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.800] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") [0102.801] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3204) returned 1 [0102.801] CloseHandle (hObject=0x180) returned 1 [0102.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 0x20 [0102.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.801] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.801] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.802] GetLastError () returned 0x0 [0102.802] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xc84, lpOverlapped=0x0) returned 1 [0102.808] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xc90, lpOverlapped=0x0) returned 1 [0102.809] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.809] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.809] SetEndOfFile (hFile=0x168) returned 1 [0102.809] CloseHandle (hObject=0x168) returned 1 [0102.809] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.809] SetEndOfFile (hFile=0x180) returned 1 [0102.810] CloseHandle (hObject=0x180) returned 1 [0102.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 1 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString=".doc") returned 4 [0102.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString=".docx") returned 5 [0102.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.811] lstrlenW (lpString=".pdf") returned 4 [0102.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString=".xls") returned 4 [0102.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.811] lstrlenW (lpString=".xlsx") returned 5 [0102.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.811] lstrlenW (lpString=".ppt") returned 4 [0102.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString=".zip") returned 4 [0102.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.811] lstrlenW (lpString=".rar") returned 4 [0102.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString=".bz2") returned 4 [0102.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString=".7z") returned 3 [0102.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString=".dbf") returned 4 [0102.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString=".1cd") returned 4 [0102.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.811] lstrlenW (lpString=".jpg") returned 4 [0102.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString=".pdf") returned 4 [0102.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString=".xls") returned 4 [0102.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.812] lstrlenW (lpString=".xlsx") returned 5 [0102.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.812] lstrlenW (lpString=".ppt") returned 4 [0102.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.812] lstrlenW (lpString=".zip") returned 4 [0102.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.812] lstrlenW (lpString=".rar") returned 4 [0102.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString=".bz2") returned 4 [0102.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString=".7z") returned 3 [0102.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.812] lstrlenW (lpString=".dbf") returned 4 [0102.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.812] lstrlenW (lpString=".1cd") returned 4 [0102.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 63 [0102.812] lstrlenW (lpString=".jpg") returned 4 [0102.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.812] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") [0102.813] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3684) returned 1 [0102.813] CloseHandle (hObject=0x180) returned 1 [0102.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 0x20 [0102.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0102.813] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.813] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0102.814] GetLastError () returned 0x0 [0102.814] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe64, lpOverlapped=0x0) returned 1 [0102.915] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe70, lpOverlapped=0x0) returned 1 [0102.918] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0102.918] WriteFile (in: hFile=0x168, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.918] SetEndOfFile (hFile=0x168) returned 1 [0102.918] CloseHandle (hObject=0x168) returned 1 [0102.918] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.918] SetEndOfFile (hFile=0x180) returned 1 [0102.919] CloseHandle (hObject=0x180) returned 1 [0102.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 1 [0102.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString=".doc") returned 4 [0102.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString=".docx") returned 5 [0102.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.972] lstrlenW (lpString=".pdf") returned 4 [0102.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString=".xls") returned 4 [0102.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.972] lstrlenW (lpString=".xlsx") returned 5 [0102.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.972] lstrlenW (lpString=".ppt") returned 4 [0102.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString=".zip") returned 4 [0102.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.972] lstrlenW (lpString=".rar") returned 4 [0102.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString=".bz2") returned 4 [0102.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString=".7z") returned 3 [0102.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString=".dbf") returned 4 [0102.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString=".1cd") returned 4 [0102.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.972] lstrlenW (lpString=".jpg") returned 4 [0102.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.972] lstrlenW (lpString=".pdf") returned 4 [0102.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString=".xls") returned 4 [0102.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.973] lstrlenW (lpString=".xlsx") returned 5 [0102.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.973] lstrlenW (lpString=".ppt") returned 4 [0102.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.973] lstrlenW (lpString=".zip") returned 4 [0102.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.973] lstrlenW (lpString=".rar") returned 4 [0102.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString=".bz2") returned 4 [0102.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString=".7z") returned 3 [0102.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.973] lstrlenW (lpString=".dbf") returned 4 [0102.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.973] lstrlenW (lpString=".1cd") returned 4 [0102.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 63 [0102.973] lstrlenW (lpString=".jpg") returned 4 [0102.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.973] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") [0102.992] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8136) returned 1 [0102.992] CloseHandle (hObject=0x1c0) returned 1 [0102.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 0x20 [0102.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0102.993] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.993] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0102.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0102.994] GetLastError () returned 0x0 [0102.995] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0103.028] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0103.029] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0103.029] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.029] SetEndOfFile (hFile=0x210) returned 1 [0103.029] CloseHandle (hObject=0x210) returned 1 [0103.029] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.029] SetEndOfFile (hFile=0x1c0) returned 1 [0103.030] CloseHandle (hObject=0x1c0) returned 1 [0103.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 1 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString=".doc") returned 4 [0103.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString=".docx") returned 5 [0103.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.076] lstrlenW (lpString=".pdf") returned 4 [0103.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString=".xls") returned 4 [0103.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.076] lstrlenW (lpString=".xlsx") returned 5 [0103.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.076] lstrlenW (lpString=".ppt") returned 4 [0103.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString=".zip") returned 4 [0103.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.076] lstrlenW (lpString=".rar") returned 4 [0103.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString=".bz2") returned 4 [0103.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString=".7z") returned 3 [0103.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString=".dbf") returned 4 [0103.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString=".1cd") returned 4 [0103.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.076] lstrlenW (lpString=".jpg") returned 4 [0103.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString=".pdf") returned 4 [0103.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString=".xls") returned 4 [0103.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.077] lstrlenW (lpString=".xlsx") returned 5 [0103.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.077] lstrlenW (lpString=".ppt") returned 4 [0103.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.077] lstrlenW (lpString=".zip") returned 4 [0103.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.077] lstrlenW (lpString=".rar") returned 4 [0103.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString=".bz2") returned 4 [0103.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString=".7z") returned 3 [0103.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.077] lstrlenW (lpString=".dbf") returned 4 [0103.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.077] lstrlenW (lpString=".1cd") returned 4 [0103.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 63 [0103.077] lstrlenW (lpString=".jpg") returned 4 [0103.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.077] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") [0103.078] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6472) returned 1 [0103.078] CloseHandle (hObject=0x1ec) returned 1 [0103.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 0x20 [0103.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0103.078] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.078] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0103.079] GetLastError () returned 0x0 [0103.079] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1948, lpOverlapped=0x0) returned 1 [0103.287] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1950, lpOverlapped=0x0) returned 1 [0103.288] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0103.288] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.288] SetEndOfFile (hFile=0x1b4) returned 1 [0103.289] CloseHandle (hObject=0x1b4) returned 1 [0103.289] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.289] SetEndOfFile (hFile=0x1ec) returned 1 [0103.289] CloseHandle (hObject=0x1ec) returned 1 [0103.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 1 [0103.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.290] lstrlenW (lpString=".doc") returned 4 [0103.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.290] lstrlenW (lpString=".docx") returned 5 [0103.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.290] lstrlenW (lpString=".pdf") returned 4 [0103.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.290] lstrlenW (lpString=".xls") returned 4 [0103.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.290] lstrlenW (lpString=".xlsx") returned 5 [0103.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.290] lstrlenW (lpString=".ppt") returned 4 [0103.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.290] lstrlenW (lpString=".zip") returned 4 [0103.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.290] lstrlenW (lpString=".rar") returned 4 [0103.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.290] lstrlenW (lpString=".bz2") returned 4 [0103.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString=".7z") returned 3 [0103.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.291] lstrlenW (lpString=".dbf") returned 4 [0103.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.291] lstrlenW (lpString=".1cd") returned 4 [0103.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.291] lstrlenW (lpString=".jpg") returned 4 [0103.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString=".pdf") returned 4 [0103.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString=".xls") returned 4 [0103.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.291] lstrlenW (lpString=".xlsx") returned 5 [0103.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.291] lstrlenW (lpString=".ppt") returned 4 [0103.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.291] lstrlenW (lpString=".zip") returned 4 [0103.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.291] lstrlenW (lpString=".rar") returned 4 [0103.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString=".bz2") returned 4 [0103.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.291] lstrlenW (lpString=".7z") returned 3 [0103.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.291] lstrlenW (lpString=".dbf") returned 4 [0103.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.292] lstrlenW (lpString=".1cd") returned 4 [0103.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 63 [0103.292] lstrlenW (lpString=".jpg") returned 4 [0103.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.292] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") [0103.293] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12824) returned 1 [0103.293] CloseHandle (hObject=0x1ec) returned 1 [0103.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 0x20 [0103.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0103.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.293] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0103.295] GetLastError () returned 0x0 [0103.295] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3218, lpOverlapped=0x0) returned 1 [0103.371] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3220, lpOverlapped=0x0) returned 1 [0103.372] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0103.372] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.372] SetEndOfFile (hFile=0x1b4) returned 1 [0103.373] CloseHandle (hObject=0x1b4) returned 1 [0103.373] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.373] SetEndOfFile (hFile=0x1ec) returned 1 [0103.374] CloseHandle (hObject=0x1ec) returned 1 [0103.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 1 [0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.374] lstrlenW (lpString=".doc") returned 4 [0103.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.374] lstrlenW (lpString=".docx") returned 5 [0103.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.374] lstrlenW (lpString=".pdf") returned 4 [0103.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.374] lstrlenW (lpString=".xls") returned 4 [0103.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.374] lstrlenW (lpString=".xlsx") returned 5 [0103.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.374] lstrlenW (lpString=".ppt") returned 4 [0103.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.375] lstrlenW (lpString=".zip") returned 4 [0103.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.375] lstrlenW (lpString=".rar") returned 4 [0103.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString=".bz2") returned 4 [0103.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString=".7z") returned 3 [0103.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.375] lstrlenW (lpString=".dbf") returned 4 [0103.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.375] lstrlenW (lpString=".1cd") returned 4 [0103.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.375] lstrlenW (lpString=".jpg") returned 4 [0103.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString=".pdf") returned 4 [0103.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString=".xls") returned 4 [0103.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.375] lstrlenW (lpString=".xlsx") returned 5 [0103.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.375] lstrlenW (lpString=".ppt") returned 4 [0103.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.375] lstrlenW (lpString=".zip") returned 4 [0103.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.375] lstrlenW (lpString=".rar") returned 4 [0103.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.376] lstrlenW (lpString=".bz2") returned 4 [0103.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.376] lstrlenW (lpString=".7z") returned 3 [0103.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.376] lstrlenW (lpString=".dbf") returned 4 [0103.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.376] lstrlenW (lpString=".1cd") returned 4 [0103.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 63 [0103.376] lstrlenW (lpString=".jpg") returned 4 [0103.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.376] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") [0103.805] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2208) returned 1 [0103.805] CloseHandle (hObject=0x1c0) returned 1 [0103.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 0x20 [0103.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0103.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.064] GetLastError () returned 0x0 [0104.064] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8a0, lpOverlapped=0x0) returned 1 [0104.066] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0104.182] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.182] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.183] SetEndOfFile (hFile=0x22c) returned 1 [0104.183] CloseHandle (hObject=0x22c) returned 1 [0104.183] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.183] SetEndOfFile (hFile=0x1a0) returned 1 [0104.184] CloseHandle (hObject=0x1a0) returned 1 [0104.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 1 [0104.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.258] lstrlenW (lpString=".doc") returned 4 [0104.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.259] lstrlenW (lpString=".docx") returned 5 [0104.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.282] lstrlenW (lpString=".pdf") returned 4 [0104.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.282] lstrlenW (lpString=".xls") returned 4 [0104.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.282] lstrlenW (lpString=".xlsx") returned 5 [0104.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.282] lstrlenW (lpString=".ppt") returned 4 [0104.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.282] lstrlenW (lpString=".zip") returned 4 [0104.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.282] lstrlenW (lpString=".rar") returned 4 [0104.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.282] lstrlenW (lpString=".bz2") returned 4 [0104.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.282] lstrlenW (lpString=".7z") returned 3 [0104.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".dbf") returned 4 [0104.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".1cd") returned 4 [0104.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".jpg") returned 4 [0104.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString=".pdf") returned 4 [0104.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString=".xls") returned 4 [0104.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.283] lstrlenW (lpString=".xlsx") returned 5 [0104.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.283] lstrlenW (lpString=".ppt") returned 4 [0104.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".zip") returned 4 [0104.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.283] lstrlenW (lpString=".rar") returned 4 [0104.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString=".bz2") returned 4 [0104.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString=".7z") returned 3 [0104.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".dbf") returned 4 [0104.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".1cd") returned 4 [0104.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 63 [0104.283] lstrlenW (lpString=".jpg") returned 4 [0104.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.284] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") [0104.292] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6440) returned 1 [0104.292] CloseHandle (hObject=0x210) returned 1 [0104.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x20 [0104.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.292] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.292] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.293] GetLastError () returned 0x0 [0104.293] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1928, lpOverlapped=0x0) returned 1 [0104.295] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1930, lpOverlapped=0x0) returned 1 [0104.296] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.296] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.296] SetEndOfFile (hFile=0x15c) returned 1 [0104.296] CloseHandle (hObject=0x15c) returned 1 [0104.296] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.296] SetEndOfFile (hFile=0x210) returned 1 [0104.297] CloseHandle (hObject=0x210) returned 1 [0104.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 1 [0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.298] lstrlenW (lpString=".doc") returned 4 [0104.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString=".docx") returned 5 [0104.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.298] lstrlenW (lpString=".pdf") returned 4 [0104.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString=".xls") returned 4 [0104.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.298] lstrlenW (lpString=".xlsx") returned 5 [0104.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.298] lstrlenW (lpString=".ppt") returned 4 [0104.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.298] lstrlenW (lpString=".zip") returned 4 [0104.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.298] lstrlenW (lpString=".rar") returned 4 [0104.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString=".bz2") returned 4 [0104.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString=".7z") returned 3 [0104.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.298] lstrlenW (lpString=".dbf") returned 4 [0104.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.298] lstrlenW (lpString=".1cd") returned 4 [0104.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.298] lstrlenW (lpString=".jpg") returned 4 [0104.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.298] lstrlenW (lpString=".pdf") returned 4 [0104.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString=".xls") returned 4 [0104.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.299] lstrlenW (lpString=".xlsx") returned 5 [0104.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.299] lstrlenW (lpString=".ppt") returned 4 [0104.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.299] lstrlenW (lpString=".zip") returned 4 [0104.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.299] lstrlenW (lpString=".rar") returned 4 [0104.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString=".bz2") returned 4 [0104.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString=".7z") returned 3 [0104.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.299] lstrlenW (lpString=".dbf") returned 4 [0104.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.299] lstrlenW (lpString=".1cd") returned 4 [0104.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 63 [0104.299] lstrlenW (lpString=".jpg") returned 4 [0104.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.299] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") [0104.300] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19690) returned 1 [0104.300] CloseHandle (hObject=0x210) returned 1 [0104.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x20 [0104.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0104.300] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.300] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.301] GetLastError () returned 0x0 [0104.301] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4cea, lpOverlapped=0x0) returned 1 [0104.302] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4cf0, lpOverlapped=0x0) returned 1 [0104.304] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.304] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.304] SetEndOfFile (hFile=0x15c) returned 1 [0104.304] CloseHandle (hObject=0x15c) returned 1 [0104.304] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.304] SetEndOfFile (hFile=0x210) returned 1 [0104.305] CloseHandle (hObject=0x210) returned 1 [0104.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 1 [0104.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.305] lstrlenW (lpString=".doc") returned 4 [0104.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.305] lstrlenW (lpString=".docx") returned 5 [0104.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.305] lstrlenW (lpString=".pdf") returned 4 [0104.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.305] lstrlenW (lpString=".xls") returned 4 [0104.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.305] lstrlenW (lpString=".xlsx") returned 5 [0104.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.306] lstrlenW (lpString=".ppt") returned 4 [0104.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.306] lstrlenW (lpString=".zip") returned 4 [0104.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.306] lstrlenW (lpString=".rar") returned 4 [0104.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString=".bz2") returned 4 [0104.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString=".7z") returned 3 [0104.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.306] lstrlenW (lpString=".dbf") returned 4 [0104.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.306] lstrlenW (lpString=".1cd") returned 4 [0104.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.306] lstrlenW (lpString=".jpg") returned 4 [0104.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString=".pdf") returned 4 [0104.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString=".xls") returned 4 [0104.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.306] lstrlenW (lpString=".xlsx") returned 5 [0104.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.306] lstrlenW (lpString=".ppt") returned 4 [0104.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.306] lstrlenW (lpString=".zip") returned 4 [0104.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.306] lstrlenW (lpString=".rar") returned 4 [0104.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.307] lstrlenW (lpString=".bz2") returned 4 [0104.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.307] lstrlenW (lpString=".7z") returned 3 [0104.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.307] lstrlenW (lpString=".dbf") returned 4 [0104.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.307] lstrlenW (lpString=".1cd") returned 4 [0104.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 63 [0104.307] lstrlenW (lpString=".jpg") returned 4 [0104.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.307] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") [0104.929] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=45356) returned 1 [0104.930] CloseHandle (hObject=0x158) returned 1 [0104.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x20 [0104.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.930] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.930] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.931] GetLastError () returned 0x0 [0104.931] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb12c, lpOverlapped=0x0) returned 1 [0104.934] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb130, lpOverlapped=0x0) returned 1 [0104.935] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.935] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.935] SetEndOfFile (hFile=0x1b8) returned 1 [0104.936] CloseHandle (hObject=0x1b8) returned 1 [0104.936] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.936] SetEndOfFile (hFile=0x158) returned 1 [0104.937] CloseHandle (hObject=0x158) returned 1 [0104.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 1 [0104.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.937] lstrlenW (lpString=".doc") returned 4 [0104.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.937] lstrlenW (lpString=".docx") returned 5 [0104.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.937] lstrlenW (lpString=".pdf") returned 4 [0104.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.937] lstrlenW (lpString=".xls") returned 4 [0104.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.937] lstrlenW (lpString=".xlsx") returned 5 [0104.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.938] lstrlenW (lpString=".ppt") returned 4 [0104.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.938] lstrlenW (lpString=".zip") returned 4 [0104.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.938] lstrlenW (lpString=".rar") returned 4 [0104.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString=".bz2") returned 4 [0104.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString=".7z") returned 3 [0104.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.938] lstrlenW (lpString=".dbf") returned 4 [0104.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.938] lstrlenW (lpString=".1cd") returned 4 [0104.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.938] lstrlenW (lpString=".jpg") returned 4 [0104.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString=".pdf") returned 4 [0104.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString=".xls") returned 4 [0104.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.938] lstrlenW (lpString=".xlsx") returned 5 [0104.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.938] lstrlenW (lpString=".ppt") returned 4 [0104.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.938] lstrlenW (lpString=".zip") returned 4 [0104.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.939] lstrlenW (lpString=".rar") returned 4 [0104.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.939] lstrlenW (lpString=".bz2") returned 4 [0104.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.939] lstrlenW (lpString=".7z") returned 3 [0104.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.939] lstrlenW (lpString=".dbf") returned 4 [0104.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.939] lstrlenW (lpString=".1cd") returned 4 [0104.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 63 [0104.939] lstrlenW (lpString=".jpg") returned 4 [0104.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.939] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") [0104.940] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=25266) returned 1 [0104.940] CloseHandle (hObject=0x158) returned 1 [0104.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x20 [0104.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.940] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.940] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.941] GetLastError () returned 0x0 [0104.941] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x62b2, lpOverlapped=0x0) returned 1 [0104.944] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0104.946] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.946] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.946] SetEndOfFile (hFile=0x1b8) returned 1 [0104.946] CloseHandle (hObject=0x1b8) returned 1 [0104.946] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.946] SetEndOfFile (hFile=0x158) returned 1 [0104.947] CloseHandle (hObject=0x158) returned 1 [0104.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 1 [0104.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.947] lstrlenW (lpString=".doc") returned 4 [0104.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.947] lstrlenW (lpString=".docx") returned 5 [0104.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.948] lstrlenW (lpString=".pdf") returned 4 [0104.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString=".xls") returned 4 [0104.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.948] lstrlenW (lpString=".xlsx") returned 5 [0104.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.948] lstrlenW (lpString=".ppt") returned 4 [0104.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.948] lstrlenW (lpString=".zip") returned 4 [0104.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.948] lstrlenW (lpString=".rar") returned 4 [0104.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString=".bz2") returned 4 [0104.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString=".7z") returned 3 [0104.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.948] lstrlenW (lpString=".dbf") returned 4 [0104.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.948] lstrlenW (lpString=".1cd") returned 4 [0104.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.948] lstrlenW (lpString=".jpg") returned 4 [0104.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString=".pdf") returned 4 [0104.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.948] lstrlenW (lpString=".xls") returned 4 [0104.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.948] lstrlenW (lpString=".xlsx") returned 5 [0104.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.949] lstrlenW (lpString=".ppt") returned 4 [0104.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.949] lstrlenW (lpString=".zip") returned 4 [0104.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.949] lstrlenW (lpString=".rar") returned 4 [0104.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.949] lstrlenW (lpString=".bz2") returned 4 [0104.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.949] lstrlenW (lpString=".7z") returned 3 [0104.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.949] lstrlenW (lpString=".dbf") returned 4 [0104.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.949] lstrlenW (lpString=".1cd") returned 4 [0104.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 63 [0104.949] lstrlenW (lpString=".jpg") returned 4 [0104.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.949] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") [0104.950] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=30944) returned 1 [0104.950] CloseHandle (hObject=0x158) returned 1 [0104.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x20 [0104.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.951] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.951] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.951] GetLastError () returned 0x0 [0104.951] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x78e0, lpOverlapped=0x0) returned 1 [0104.953] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0104.956] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.956] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.956] SetEndOfFile (hFile=0x1b8) returned 1 [0104.956] CloseHandle (hObject=0x1b8) returned 1 [0104.956] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.956] SetEndOfFile (hFile=0x158) returned 1 [0104.957] CloseHandle (hObject=0x158) returned 1 [0104.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 1 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.958] lstrlenW (lpString=".doc") returned 4 [0104.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString=".docx") returned 5 [0104.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.958] lstrlenW (lpString=".pdf") returned 4 [0104.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString=".xls") returned 4 [0104.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.958] lstrlenW (lpString=".xlsx") returned 5 [0104.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.958] lstrlenW (lpString=".ppt") returned 4 [0104.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.958] lstrlenW (lpString=".zip") returned 4 [0104.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.958] lstrlenW (lpString=".rar") returned 4 [0104.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString=".bz2") returned 4 [0104.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString=".7z") returned 3 [0104.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.958] lstrlenW (lpString=".dbf") returned 4 [0104.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.958] lstrlenW (lpString=".1cd") returned 4 [0104.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.959] lstrlenW (lpString=".jpg") returned 4 [0104.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString=".pdf") returned 4 [0104.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString=".xls") returned 4 [0104.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.959] lstrlenW (lpString=".xlsx") returned 5 [0104.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.959] lstrlenW (lpString=".ppt") returned 4 [0104.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.959] lstrlenW (lpString=".zip") returned 4 [0104.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.959] lstrlenW (lpString=".rar") returned 4 [0104.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString=".bz2") returned 4 [0104.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString=".7z") returned 3 [0104.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.959] lstrlenW (lpString=".dbf") returned 4 [0104.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.959] lstrlenW (lpString=".1cd") returned 4 [0104.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 63 [0104.959] lstrlenW (lpString=".jpg") returned 4 [0104.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.959] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") [0104.960] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=28454) returned 1 [0104.960] CloseHandle (hObject=0x158) returned 1 [0104.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x20 [0104.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.960] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.960] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0104.961] GetLastError () returned 0x0 [0104.961] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6f26, lpOverlapped=0x0) returned 1 [0104.963] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6f30, lpOverlapped=0x0) returned 1 [0104.964] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0104.964] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.964] SetEndOfFile (hFile=0x1b8) returned 1 [0104.964] CloseHandle (hObject=0x1b8) returned 1 [0104.964] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0104.965] SetEndOfFile (hFile=0x158) returned 1 [0104.965] CloseHandle (hObject=0x158) returned 1 [0104.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 1 [0104.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.966] lstrlenW (lpString=".doc") returned 4 [0104.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.966] lstrlenW (lpString=".docx") returned 5 [0104.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.966] lstrlenW (lpString=".pdf") returned 4 [0104.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.966] lstrlenW (lpString=".xls") returned 4 [0104.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.966] lstrlenW (lpString=".xlsx") returned 5 [0104.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.966] lstrlenW (lpString=".ppt") returned 4 [0104.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.966] lstrlenW (lpString=".zip") returned 4 [0104.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.966] lstrlenW (lpString=".rar") returned 4 [0104.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.966] lstrlenW (lpString=".bz2") returned 4 [0104.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.966] lstrlenW (lpString=".7z") returned 3 [0104.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.966] lstrlenW (lpString=".dbf") returned 4 [0104.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.967] lstrlenW (lpString=".1cd") returned 4 [0104.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.967] lstrlenW (lpString=".jpg") returned 4 [0104.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString=".pdf") returned 4 [0104.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString=".xls") returned 4 [0104.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.967] lstrlenW (lpString=".xlsx") returned 5 [0104.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.967] lstrlenW (lpString=".ppt") returned 4 [0104.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.967] lstrlenW (lpString=".zip") returned 4 [0104.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.967] lstrlenW (lpString=".rar") returned 4 [0104.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString=".bz2") returned 4 [0104.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString=".7z") returned 3 [0104.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.967] lstrlenW (lpString=".dbf") returned 4 [0104.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0104.967] lstrlenW (lpString=".1cd") returned 4 [0104.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 63 [0105.011] lstrlenW (lpString=".jpg") returned 4 [0105.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.011] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") [0105.021] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=26920) returned 1 [0105.021] CloseHandle (hObject=0x1f4) returned 1 [0105.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x20 [0105.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.021] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.021] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.022] GetLastError () returned 0x0 [0105.022] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6928, lpOverlapped=0x0) returned 1 [0105.025] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6930, lpOverlapped=0x0) returned 1 [0105.026] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.026] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.026] SetEndOfFile (hFile=0x22c) returned 1 [0105.026] CloseHandle (hObject=0x22c) returned 1 [0105.026] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.026] SetEndOfFile (hFile=0x1f4) returned 1 [0105.027] CloseHandle (hObject=0x1f4) returned 1 [0105.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 1 [0105.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.028] lstrlenW (lpString=".doc") returned 4 [0105.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString=".docx") returned 5 [0105.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.028] lstrlenW (lpString=".pdf") returned 4 [0105.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString=".xls") returned 4 [0105.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.028] lstrlenW (lpString=".xlsx") returned 5 [0105.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.028] lstrlenW (lpString=".ppt") returned 4 [0105.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.028] lstrlenW (lpString=".zip") returned 4 [0105.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.028] lstrlenW (lpString=".rar") returned 4 [0105.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString=".bz2") returned 4 [0105.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString=".7z") returned 3 [0105.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.028] lstrlenW (lpString=".dbf") returned 4 [0105.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.028] lstrlenW (lpString=".1cd") returned 4 [0105.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.029] lstrlenW (lpString=".jpg") returned 4 [0105.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString=".pdf") returned 4 [0105.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString=".xls") returned 4 [0105.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.029] lstrlenW (lpString=".xlsx") returned 5 [0105.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.029] lstrlenW (lpString=".ppt") returned 4 [0105.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.029] lstrlenW (lpString=".zip") returned 4 [0105.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.029] lstrlenW (lpString=".rar") returned 4 [0105.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString=".bz2") returned 4 [0105.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString=".7z") returned 3 [0105.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.029] lstrlenW (lpString=".dbf") returned 4 [0105.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.029] lstrlenW (lpString=".1cd") returned 4 [0105.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 63 [0105.029] lstrlenW (lpString=".jpg") returned 4 [0105.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.030] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") [0105.030] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=29696) returned 1 [0105.030] CloseHandle (hObject=0x1f4) returned 1 [0105.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x20 [0105.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.031] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.031] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.031] GetLastError () returned 0x0 [0105.031] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7400, lpOverlapped=0x0) returned 1 [0105.033] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7410, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7410, lpOverlapped=0x0) returned 1 [0105.035] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.035] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.035] SetEndOfFile (hFile=0x22c) returned 1 [0105.035] CloseHandle (hObject=0x22c) returned 1 [0105.035] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.035] SetEndOfFile (hFile=0x1f4) returned 1 [0105.036] CloseHandle (hObject=0x1f4) returned 1 [0105.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 1 [0105.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString=".doc") returned 4 [0105.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString=".docx") returned 5 [0105.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.037] lstrlenW (lpString=".pdf") returned 4 [0105.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString=".xls") returned 4 [0105.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.037] lstrlenW (lpString=".xlsx") returned 5 [0105.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.037] lstrlenW (lpString=".ppt") returned 4 [0105.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString=".zip") returned 4 [0105.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.037] lstrlenW (lpString=".rar") returned 4 [0105.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString=".bz2") returned 4 [0105.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString=".7z") returned 3 [0105.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString=".dbf") returned 4 [0105.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString=".1cd") returned 4 [0105.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.037] lstrlenW (lpString=".jpg") returned 4 [0105.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString=".pdf") returned 4 [0105.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString=".xls") returned 4 [0105.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.038] lstrlenW (lpString=".xlsx") returned 5 [0105.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.038] lstrlenW (lpString=".ppt") returned 4 [0105.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.038] lstrlenW (lpString=".zip") returned 4 [0105.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.038] lstrlenW (lpString=".rar") returned 4 [0105.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString=".bz2") returned 4 [0105.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString=".7z") returned 3 [0105.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.038] lstrlenW (lpString=".dbf") returned 4 [0105.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.038] lstrlenW (lpString=".1cd") returned 4 [0105.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 63 [0105.038] lstrlenW (lpString=".jpg") returned 4 [0105.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.038] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") [0105.039] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16528) returned 1 [0105.039] CloseHandle (hObject=0x1f4) returned 1 [0105.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x20 [0105.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.039] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.039] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.040] GetLastError () returned 0x0 [0105.040] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4090, lpOverlapped=0x0) returned 1 [0105.042] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0105.043] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.043] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.043] SetEndOfFile (hFile=0x22c) returned 1 [0105.043] CloseHandle (hObject=0x22c) returned 1 [0105.043] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.043] SetEndOfFile (hFile=0x1f4) returned 1 [0105.044] CloseHandle (hObject=0x1f4) returned 1 [0105.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 1 [0105.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.044] lstrlenW (lpString=".doc") returned 4 [0105.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.044] lstrlenW (lpString=".docx") returned 5 [0105.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.044] lstrlenW (lpString=".pdf") returned 4 [0105.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString=".xls") returned 4 [0105.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.045] lstrlenW (lpString=".xlsx") returned 5 [0105.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.045] lstrlenW (lpString=".ppt") returned 4 [0105.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.045] lstrlenW (lpString=".zip") returned 4 [0105.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.045] lstrlenW (lpString=".rar") returned 4 [0105.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString=".bz2") returned 4 [0105.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString=".7z") returned 3 [0105.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.045] lstrlenW (lpString=".dbf") returned 4 [0105.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.045] lstrlenW (lpString=".1cd") returned 4 [0105.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.045] lstrlenW (lpString=".jpg") returned 4 [0105.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString=".pdf") returned 4 [0105.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.045] lstrlenW (lpString=".xls") returned 4 [0105.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.046] lstrlenW (lpString=".xlsx") returned 5 [0105.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.046] lstrlenW (lpString=".ppt") returned 4 [0105.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.046] lstrlenW (lpString=".zip") returned 4 [0105.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.046] lstrlenW (lpString=".rar") returned 4 [0105.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.046] lstrlenW (lpString=".bz2") returned 4 [0105.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.046] lstrlenW (lpString=".7z") returned 3 [0105.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.046] lstrlenW (lpString=".dbf") returned 4 [0105.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.046] lstrlenW (lpString=".1cd") returned 4 [0105.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 63 [0105.046] lstrlenW (lpString=".jpg") returned 4 [0105.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.046] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") [0105.047] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=17796) returned 1 [0105.047] CloseHandle (hObject=0x1f4) returned 1 [0105.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x20 [0105.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.048] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.048] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.048] GetLastError () returned 0x0 [0105.048] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4584, lpOverlapped=0x0) returned 1 [0105.050] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4590, lpOverlapped=0x0) returned 1 [0105.051] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.051] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.051] SetEndOfFile (hFile=0x22c) returned 1 [0105.052] CloseHandle (hObject=0x22c) returned 1 [0105.052] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.052] SetEndOfFile (hFile=0x1f4) returned 1 [0105.052] CloseHandle (hObject=0x1f4) returned 1 [0105.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 1 [0105.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.053] lstrlenW (lpString=".doc") returned 4 [0105.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.053] lstrlenW (lpString=".docx") returned 5 [0105.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.053] lstrlenW (lpString=".pdf") returned 4 [0105.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.053] lstrlenW (lpString=".xls") returned 4 [0105.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.053] lstrlenW (lpString=".xlsx") returned 5 [0105.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.053] lstrlenW (lpString=".ppt") returned 4 [0105.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.053] lstrlenW (lpString=".zip") returned 4 [0105.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.053] lstrlenW (lpString=".rar") returned 4 [0105.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".bz2") returned 4 [0105.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".7z") returned 3 [0105.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.054] lstrlenW (lpString=".dbf") returned 4 [0105.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.054] lstrlenW (lpString=".1cd") returned 4 [0105.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.054] lstrlenW (lpString=".jpg") returned 4 [0105.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".pdf") returned 4 [0105.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".xls") returned 4 [0105.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.054] lstrlenW (lpString=".xlsx") returned 5 [0105.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.054] lstrlenW (lpString=".ppt") returned 4 [0105.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.054] lstrlenW (lpString=".zip") returned 4 [0105.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.054] lstrlenW (lpString=".rar") returned 4 [0105.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".bz2") returned 4 [0105.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.054] lstrlenW (lpString=".7z") returned 3 [0105.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.054] lstrlenW (lpString=".dbf") returned 4 [0105.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.055] lstrlenW (lpString=".1cd") returned 4 [0105.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 63 [0105.055] lstrlenW (lpString=".jpg") returned 4 [0105.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.055] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") [0105.055] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=30432) returned 1 [0105.055] CloseHandle (hObject=0x1f4) returned 1 [0105.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x20 [0105.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.056] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.056] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.056] GetLastError () returned 0x0 [0105.056] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x76e0, lpOverlapped=0x0) returned 1 [0105.147] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x76f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x76f0, lpOverlapped=0x0) returned 1 [0105.186] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.186] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.186] SetEndOfFile (hFile=0x22c) returned 1 [0105.186] CloseHandle (hObject=0x22c) returned 1 [0105.186] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.186] SetEndOfFile (hFile=0x1f4) returned 1 [0105.187] CloseHandle (hObject=0x1f4) returned 1 [0105.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 1 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString=".doc") returned 4 [0105.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString=".docx") returned 5 [0105.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.188] lstrlenW (lpString=".pdf") returned 4 [0105.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString=".xls") returned 4 [0105.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.188] lstrlenW (lpString=".xlsx") returned 5 [0105.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.188] lstrlenW (lpString=".ppt") returned 4 [0105.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString=".zip") returned 4 [0105.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.188] lstrlenW (lpString=".rar") returned 4 [0105.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString=".bz2") returned 4 [0105.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString=".7z") returned 3 [0105.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString=".dbf") returned 4 [0105.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString=".1cd") returned 4 [0105.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.188] lstrlenW (lpString=".jpg") returned 4 [0105.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString=".pdf") returned 4 [0105.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString=".xls") returned 4 [0105.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.189] lstrlenW (lpString=".xlsx") returned 5 [0105.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.189] lstrlenW (lpString=".ppt") returned 4 [0105.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.189] lstrlenW (lpString=".zip") returned 4 [0105.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.189] lstrlenW (lpString=".rar") returned 4 [0105.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString=".bz2") returned 4 [0105.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString=".7z") returned 3 [0105.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.189] lstrlenW (lpString=".dbf") returned 4 [0105.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.189] lstrlenW (lpString=".1cd") returned 4 [0105.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 63 [0105.189] lstrlenW (lpString=".jpg") returned 4 [0105.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.189] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") [0105.195] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8568) returned 1 [0105.195] CloseHandle (hObject=0x1c8) returned 1 [0105.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 0x20 [0105.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.195] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.195] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.196] GetLastError () returned 0x0 [0105.196] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2178, lpOverlapped=0x0) returned 1 [0105.198] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2180, lpOverlapped=0x0) returned 1 [0105.199] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.199] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.199] SetEndOfFile (hFile=0x19c) returned 1 [0105.199] CloseHandle (hObject=0x19c) returned 1 [0105.200] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.200] SetEndOfFile (hFile=0x1c8) returned 1 [0105.200] CloseHandle (hObject=0x1c8) returned 1 [0105.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 1 [0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.201] lstrlenW (lpString=".doc") returned 4 [0105.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.201] lstrlenW (lpString=".docx") returned 5 [0105.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.201] lstrlenW (lpString=".pdf") returned 4 [0105.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.201] lstrlenW (lpString=".xls") returned 4 [0105.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.201] lstrlenW (lpString=".xlsx") returned 5 [0105.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.201] lstrlenW (lpString=".ppt") returned 4 [0105.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.201] lstrlenW (lpString=".zip") returned 4 [0105.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.201] lstrlenW (lpString=".rar") returned 4 [0105.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString=".bz2") returned 4 [0105.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString=".7z") returned 3 [0105.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.202] lstrlenW (lpString=".dbf") returned 4 [0105.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.202] lstrlenW (lpString=".1cd") returned 4 [0105.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.202] lstrlenW (lpString=".jpg") returned 4 [0105.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString=".pdf") returned 4 [0105.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString=".xls") returned 4 [0105.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.202] lstrlenW (lpString=".xlsx") returned 5 [0105.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.202] lstrlenW (lpString=".ppt") returned 4 [0105.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.202] lstrlenW (lpString=".zip") returned 4 [0105.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.203] lstrlenW (lpString=".rar") returned 4 [0105.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.203] lstrlenW (lpString=".bz2") returned 4 [0105.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.203] lstrlenW (lpString=".7z") returned 3 [0105.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.203] lstrlenW (lpString=".dbf") returned 4 [0105.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.203] lstrlenW (lpString=".1cd") returned 4 [0105.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 63 [0105.203] lstrlenW (lpString=".jpg") returned 4 [0105.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.203] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") [0105.204] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5732) returned 1 [0105.204] CloseHandle (hObject=0x1c8) returned 1 [0105.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x20 [0105.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.205] GetLastError () returned 0x0 [0105.205] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1664, lpOverlapped=0x0) returned 1 [0105.206] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1670, lpOverlapped=0x0) returned 1 [0105.207] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.207] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.208] SetEndOfFile (hFile=0x19c) returned 1 [0105.208] CloseHandle (hObject=0x19c) returned 1 [0105.208] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.208] SetEndOfFile (hFile=0x1c8) returned 1 [0105.209] CloseHandle (hObject=0x1c8) returned 1 [0105.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 1 [0105.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.209] lstrlenW (lpString=".doc") returned 4 [0105.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.209] lstrlenW (lpString=".docx") returned 5 [0105.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.209] lstrlenW (lpString=".pdf") returned 4 [0105.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.209] lstrlenW (lpString=".xls") returned 4 [0105.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.209] lstrlenW (lpString=".xlsx") returned 5 [0105.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.209] lstrlenW (lpString=".ppt") returned 4 [0105.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.209] lstrlenW (lpString=".zip") returned 4 [0105.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.209] lstrlenW (lpString=".rar") returned 4 [0105.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".bz2") returned 4 [0105.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".7z") returned 3 [0105.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.210] lstrlenW (lpString=".dbf") returned 4 [0105.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.210] lstrlenW (lpString=".1cd") returned 4 [0105.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.210] lstrlenW (lpString=".jpg") returned 4 [0105.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".pdf") returned 4 [0105.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".xls") returned 4 [0105.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.210] lstrlenW (lpString=".xlsx") returned 5 [0105.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.210] lstrlenW (lpString=".ppt") returned 4 [0105.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.210] lstrlenW (lpString=".zip") returned 4 [0105.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.210] lstrlenW (lpString=".rar") returned 4 [0105.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".bz2") returned 4 [0105.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.210] lstrlenW (lpString=".7z") returned 3 [0105.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.210] lstrlenW (lpString=".dbf") returned 4 [0105.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.211] lstrlenW (lpString=".1cd") returned 4 [0105.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 63 [0105.211] lstrlenW (lpString=".jpg") returned 4 [0105.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.211] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") [0105.211] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16800) returned 1 [0105.211] CloseHandle (hObject=0x1c8) returned 1 [0105.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x20 [0105.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.212] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.212] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.212] GetLastError () returned 0x0 [0105.212] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x41a0, lpOverlapped=0x0) returned 1 [0105.214] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x41b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x41b0, lpOverlapped=0x0) returned 1 [0105.215] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.216] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.216] SetEndOfFile (hFile=0x19c) returned 1 [0105.216] CloseHandle (hObject=0x19c) returned 1 [0105.216] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.216] SetEndOfFile (hFile=0x1c8) returned 1 [0105.217] CloseHandle (hObject=0x1c8) returned 1 [0105.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 1 [0105.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.217] lstrlenW (lpString=".doc") returned 4 [0105.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.217] lstrlenW (lpString=".docx") returned 5 [0105.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.217] lstrlenW (lpString=".pdf") returned 4 [0105.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.217] lstrlenW (lpString=".xls") returned 4 [0105.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.217] lstrlenW (lpString=".xlsx") returned 5 [0105.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.217] lstrlenW (lpString=".ppt") returned 4 [0105.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.218] lstrlenW (lpString=".zip") returned 4 [0105.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.218] lstrlenW (lpString=".rar") returned 4 [0105.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString=".bz2") returned 4 [0105.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString=".7z") returned 3 [0105.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.218] lstrlenW (lpString=".dbf") returned 4 [0105.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.218] lstrlenW (lpString=".1cd") returned 4 [0105.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.218] lstrlenW (lpString=".jpg") returned 4 [0105.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString=".pdf") returned 4 [0105.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString=".xls") returned 4 [0105.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.218] lstrlenW (lpString=".xlsx") returned 5 [0105.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.218] lstrlenW (lpString=".ppt") returned 4 [0105.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.218] lstrlenW (lpString=".zip") returned 4 [0105.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.218] lstrlenW (lpString=".rar") returned 4 [0105.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.218] lstrlenW (lpString=".bz2") returned 4 [0105.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.219] lstrlenW (lpString=".7z") returned 3 [0105.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.219] lstrlenW (lpString=".dbf") returned 4 [0105.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.219] lstrlenW (lpString=".1cd") returned 4 [0105.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 63 [0105.219] lstrlenW (lpString=".jpg") returned 4 [0105.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.219] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") [0105.219] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14744) returned 1 [0105.219] CloseHandle (hObject=0x1c8) returned 1 [0105.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x20 [0105.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.220] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.220] GetLastError () returned 0x0 [0105.220] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3998, lpOverlapped=0x0) returned 1 [0105.222] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x39a0, lpOverlapped=0x0) returned 1 [0105.223] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.223] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.223] SetEndOfFile (hFile=0x19c) returned 1 [0105.223] CloseHandle (hObject=0x19c) returned 1 [0105.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.223] SetEndOfFile (hFile=0x1c8) returned 1 [0105.224] CloseHandle (hObject=0x1c8) returned 1 [0105.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 1 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString=".doc") returned 4 [0105.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString=".docx") returned 5 [0105.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.225] lstrlenW (lpString=".pdf") returned 4 [0105.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString=".xls") returned 4 [0105.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.225] lstrlenW (lpString=".xlsx") returned 5 [0105.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.225] lstrlenW (lpString=".ppt") returned 4 [0105.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString=".zip") returned 4 [0105.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.225] lstrlenW (lpString=".rar") returned 4 [0105.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString=".bz2") returned 4 [0105.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString=".7z") returned 3 [0105.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString=".dbf") returned 4 [0105.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString=".1cd") returned 4 [0105.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.225] lstrlenW (lpString=".jpg") returned 4 [0105.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString=".pdf") returned 4 [0105.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString=".xls") returned 4 [0105.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.226] lstrlenW (lpString=".xlsx") returned 5 [0105.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.226] lstrlenW (lpString=".ppt") returned 4 [0105.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.226] lstrlenW (lpString=".zip") returned 4 [0105.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.226] lstrlenW (lpString=".rar") returned 4 [0105.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString=".bz2") returned 4 [0105.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString=".7z") returned 3 [0105.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.226] lstrlenW (lpString=".dbf") returned 4 [0105.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.226] lstrlenW (lpString=".1cd") returned 4 [0105.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 63 [0105.226] lstrlenW (lpString=".jpg") returned 4 [0105.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.226] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") [0105.333] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3780) returned 1 [0105.333] CloseHandle (hObject=0x1f4) returned 1 [0105.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x20 [0105.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.333] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.333] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.334] GetLastError () returned 0x0 [0105.334] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xec4, lpOverlapped=0x0) returned 1 [0105.369] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xed0, lpOverlapped=0x0) returned 1 [0105.370] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.370] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.370] SetEndOfFile (hFile=0x22c) returned 1 [0105.370] CloseHandle (hObject=0x22c) returned 1 [0105.370] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.370] SetEndOfFile (hFile=0x1f4) returned 1 [0105.371] CloseHandle (hObject=0x1f4) returned 1 [0105.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 1 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString=".doc") returned 4 [0105.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString=".docx") returned 5 [0105.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.372] lstrlenW (lpString=".pdf") returned 4 [0105.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString=".xls") returned 4 [0105.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.372] lstrlenW (lpString=".xlsx") returned 5 [0105.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.372] lstrlenW (lpString=".ppt") returned 4 [0105.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString=".zip") returned 4 [0105.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.372] lstrlenW (lpString=".rar") returned 4 [0105.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString=".bz2") returned 4 [0105.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString=".7z") returned 3 [0105.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString=".dbf") returned 4 [0105.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString=".1cd") returned 4 [0105.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.372] lstrlenW (lpString=".jpg") returned 4 [0105.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString=".pdf") returned 4 [0105.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString=".xls") returned 4 [0105.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.373] lstrlenW (lpString=".xlsx") returned 5 [0105.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.373] lstrlenW (lpString=".ppt") returned 4 [0105.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.373] lstrlenW (lpString=".zip") returned 4 [0105.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.373] lstrlenW (lpString=".rar") returned 4 [0105.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString=".bz2") returned 4 [0105.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString=".7z") returned 3 [0105.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.373] lstrlenW (lpString=".dbf") returned 4 [0105.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.373] lstrlenW (lpString=".1cd") returned 4 [0105.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 63 [0105.373] lstrlenW (lpString=".jpg") returned 4 [0105.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.373] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") [0105.374] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1930) returned 1 [0105.374] CloseHandle (hObject=0x1f4) returned 1 [0105.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x20 [0105.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.376] GetLastError () returned 0x0 [0105.376] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x78a, lpOverlapped=0x0) returned 1 [0105.377] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x790, lpOverlapped=0x0) returned 1 [0105.378] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.378] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.378] SetEndOfFile (hFile=0x22c) returned 1 [0105.379] CloseHandle (hObject=0x22c) returned 1 [0105.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.379] SetEndOfFile (hFile=0x1f4) returned 1 [0105.379] CloseHandle (hObject=0x1f4) returned 1 [0105.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 1 [0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.380] lstrlenW (lpString=".doc") returned 4 [0105.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.380] lstrlenW (lpString=".docx") returned 5 [0105.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.380] lstrlenW (lpString=".pdf") returned 4 [0105.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.380] lstrlenW (lpString=".xls") returned 4 [0105.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.380] lstrlenW (lpString=".xlsx") returned 5 [0105.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.380] lstrlenW (lpString=".ppt") returned 4 [0105.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.380] lstrlenW (lpString=".zip") returned 4 [0105.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.380] lstrlenW (lpString=".rar") returned 4 [0105.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.380] lstrlenW (lpString=".bz2") returned 4 [0105.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.380] lstrlenW (lpString=".7z") returned 3 [0105.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.380] lstrlenW (lpString=".dbf") returned 4 [0105.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".1cd") returned 4 [0105.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".jpg") returned 4 [0105.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString=".pdf") returned 4 [0105.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString=".xls") returned 4 [0105.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.381] lstrlenW (lpString=".xlsx") returned 5 [0105.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.381] lstrlenW (lpString=".ppt") returned 4 [0105.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".zip") returned 4 [0105.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.381] lstrlenW (lpString=".rar") returned 4 [0105.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString=".bz2") returned 4 [0105.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString=".7z") returned 3 [0105.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".dbf") returned 4 [0105.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".1cd") returned 4 [0105.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 63 [0105.381] lstrlenW (lpString=".jpg") returned 4 [0105.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.382] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") [0105.382] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4128) returned 1 [0105.382] CloseHandle (hObject=0x1f4) returned 1 [0105.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 0x20 [0105.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.384] GetLastError () returned 0x0 [0105.384] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1020, lpOverlapped=0x0) returned 1 [0105.385] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1030, lpOverlapped=0x0) returned 1 [0105.386] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.386] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.386] SetEndOfFile (hFile=0x22c) returned 1 [0105.386] CloseHandle (hObject=0x22c) returned 1 [0105.386] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.386] SetEndOfFile (hFile=0x1f4) returned 1 [0105.387] CloseHandle (hObject=0x1f4) returned 1 [0105.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 1 [0105.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.388] lstrlenW (lpString=".doc") returned 4 [0105.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString=".docx") returned 5 [0105.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.388] lstrlenW (lpString=".pdf") returned 4 [0105.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString=".xls") returned 4 [0105.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.388] lstrlenW (lpString=".xlsx") returned 5 [0105.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.388] lstrlenW (lpString=".ppt") returned 4 [0105.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.388] lstrlenW (lpString=".zip") returned 4 [0105.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.388] lstrlenW (lpString=".rar") returned 4 [0105.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString=".bz2") returned 4 [0105.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString=".7z") returned 3 [0105.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.388] lstrlenW (lpString=".dbf") returned 4 [0105.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.388] lstrlenW (lpString=".1cd") returned 4 [0105.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.389] lstrlenW (lpString=".jpg") returned 4 [0105.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString=".pdf") returned 4 [0105.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString=".xls") returned 4 [0105.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.389] lstrlenW (lpString=".xlsx") returned 5 [0105.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.389] lstrlenW (lpString=".ppt") returned 4 [0105.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.389] lstrlenW (lpString=".zip") returned 4 [0105.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.389] lstrlenW (lpString=".rar") returned 4 [0105.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString=".bz2") returned 4 [0105.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.389] lstrlenW (lpString=".7z") returned 3 [0105.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.389] lstrlenW (lpString=".dbf") returned 4 [0105.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.390] lstrlenW (lpString=".1cd") returned 4 [0105.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 63 [0105.390] lstrlenW (lpString=".jpg") returned 4 [0105.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.390] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") [0105.391] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14328) returned 1 [0105.391] CloseHandle (hObject=0x1f4) returned 1 [0105.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x20 [0105.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.392] GetLastError () returned 0x0 [0105.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x37f8, lpOverlapped=0x0) returned 1 [0105.394] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3800, lpOverlapped=0x0) returned 1 [0105.395] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.395] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.395] SetEndOfFile (hFile=0x22c) returned 1 [0105.395] CloseHandle (hObject=0x22c) returned 1 [0105.395] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.396] SetEndOfFile (hFile=0x1f4) returned 1 [0105.396] CloseHandle (hObject=0x1f4) returned 1 [0105.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 1 [0105.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.397] lstrlenW (lpString=".doc") returned 4 [0105.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString=".docx") returned 5 [0105.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.397] lstrlenW (lpString=".pdf") returned 4 [0105.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString=".xls") returned 4 [0105.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.397] lstrlenW (lpString=".xlsx") returned 5 [0105.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.397] lstrlenW (lpString=".ppt") returned 4 [0105.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.397] lstrlenW (lpString=".zip") returned 4 [0105.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.397] lstrlenW (lpString=".rar") returned 4 [0105.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString=".bz2") returned 4 [0105.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString=".7z") returned 3 [0105.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.397] lstrlenW (lpString=".dbf") returned 4 [0105.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".1cd") returned 4 [0105.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".jpg") returned 4 [0105.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString=".pdf") returned 4 [0105.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString=".xls") returned 4 [0105.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.398] lstrlenW (lpString=".xlsx") returned 5 [0105.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.398] lstrlenW (lpString=".ppt") returned 4 [0105.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".zip") returned 4 [0105.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.398] lstrlenW (lpString=".rar") returned 4 [0105.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString=".bz2") returned 4 [0105.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString=".7z") returned 3 [0105.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".dbf") returned 4 [0105.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".1cd") returned 4 [0105.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 63 [0105.398] lstrlenW (lpString=".jpg") returned 4 [0105.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.399] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") [0105.399] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5756) returned 1 [0105.399] CloseHandle (hObject=0x1f4) returned 1 [0105.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x20 [0105.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.400] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.400] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0105.400] GetLastError () returned 0x0 [0105.400] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x167c, lpOverlapped=0x0) returned 1 [0105.431] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1680, lpOverlapped=0x0) returned 1 [0105.432] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.432] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.432] SetEndOfFile (hFile=0x22c) returned 1 [0105.432] CloseHandle (hObject=0x22c) returned 1 [0105.432] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.433] SetEndOfFile (hFile=0x1f4) returned 1 [0105.433] CloseHandle (hObject=0x1f4) returned 1 [0105.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 1 [0105.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.930] lstrlenW (lpString=".doc") returned 4 [0105.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".docx") returned 5 [0105.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.931] lstrlenW (lpString=".pdf") returned 4 [0105.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".xls") returned 4 [0105.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.935] lstrlenW (lpString=".xlsx") returned 5 [0105.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.935] lstrlenW (lpString=".ppt") returned 4 [0105.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.936] lstrlenW (lpString=".zip") returned 4 [0105.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.936] lstrlenW (lpString=".rar") returned 4 [0105.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.936] lstrlenW (lpString=".bz2") returned 4 [0105.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.936] lstrlenW (lpString=".7z") returned 3 [0105.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.943] lstrlenW (lpString=".dbf") returned 4 [0105.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.943] lstrlenW (lpString=".1cd") returned 4 [0105.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.959] lstrlenW (lpString=".jpg") returned 4 [0105.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.959] lstrlenW (lpString=".pdf") returned 4 [0105.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.966] lstrlenW (lpString=".xls") returned 4 [0105.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.966] lstrlenW (lpString=".xlsx") returned 5 [0105.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.966] lstrlenW (lpString=".ppt") returned 4 [0105.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.966] lstrlenW (lpString=".zip") returned 4 [0105.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.966] lstrlenW (lpString=".rar") returned 4 [0105.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.966] lstrlenW (lpString=".bz2") returned 4 [0105.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.966] lstrlenW (lpString=".7z") returned 3 [0105.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.966] lstrlenW (lpString=".dbf") returned 4 [0105.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.967] lstrlenW (lpString=".1cd") returned 4 [0105.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 63 [0105.967] lstrlenW (lpString=".jpg") returned 4 [0105.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.967] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") [0105.967] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1577) returned 1 [0105.967] CloseHandle (hObject=0x15c) returned 1 [0105.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 0x20 [0105.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.968] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.968] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.969] GetLastError () returned 0x0 [0105.969] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x629, lpOverlapped=0x0) returned 1 [0105.971] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x630, lpOverlapped=0x0) returned 1 [0105.971] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.971] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.972] SetEndOfFile (hFile=0x1b8) returned 1 [0105.972] CloseHandle (hObject=0x1b8) returned 1 [0105.972] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.972] SetEndOfFile (hFile=0x15c) returned 1 [0105.973] CloseHandle (hObject=0x15c) returned 1 [0105.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 1 [0105.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.973] lstrlenW (lpString=".doc") returned 4 [0105.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.973] lstrlenW (lpString=".docx") returned 5 [0105.973] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0105.973] lstrlenW (lpString=".pdf") returned 4 [0105.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.973] lstrlenW (lpString=".xls") returned 4 [0105.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.973] lstrlenW (lpString=".xlsx") returned 5 [0105.973] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0105.973] lstrlenW (lpString=".ppt") returned 4 [0105.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.973] lstrlenW (lpString=".zip") returned 4 [0105.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.973] lstrlenW (lpString=".rar") returned 4 [0105.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.973] lstrlenW (lpString=".bz2") returned 4 [0105.974] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.974] lstrlenW (lpString=".7z") returned 3 [0105.974] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.974] lstrlenW (lpString=".dbf") returned 4 [0105.974] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.974] lstrlenW (lpString=".1cd") returned 4 [0105.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 63 [0105.974] lstrlenW (lpString=".jpg") returned 4 [0105.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.974] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") [0105.974] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=34344) returned 1 [0105.974] CloseHandle (hObject=0x15c) returned 1 [0105.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x20 [0105.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.975] GetLastError () returned 0x0 [0105.975] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8628, lpOverlapped=0x0) returned 1 [0105.977] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8630, lpOverlapped=0x0) returned 1 [0105.979] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.979] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.979] SetEndOfFile (hFile=0x1b8) returned 1 [0105.979] CloseHandle (hObject=0x1b8) returned 1 [0105.979] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.979] SetEndOfFile (hFile=0x15c) returned 1 [0105.980] CloseHandle (hObject=0x15c) returned 1 [0105.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 1 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString=".doc") returned 4 [0105.981] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".docx") returned 5 [0105.981] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0105.981] lstrlenW (lpString=".pdf") returned 4 [0105.981] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".xls") returned 4 [0105.981] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".xlsx") returned 5 [0105.981] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0105.981] lstrlenW (lpString=".ppt") returned 4 [0105.981] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString=".zip") returned 4 [0105.981] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".rar") returned 4 [0105.981] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".bz2") returned 4 [0105.981] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString=".7z") returned 3 [0105.981] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString=".dbf") returned 4 [0105.981] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString=".1cd") returned 4 [0105.981] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0105.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 63 [0105.981] lstrlenW (lpString=".jpg") returned 4 [0105.982] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0105.982] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") [0105.983] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32400) returned 1 [0105.983] CloseHandle (hObject=0x15c) returned 1 [0105.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x20 [0105.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.983] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.983] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.984] GetLastError () returned 0x0 [0105.984] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7e90, lpOverlapped=0x0) returned 1 [0105.986] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0105.987] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.987] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.987] SetEndOfFile (hFile=0x1b8) returned 1 [0105.987] CloseHandle (hObject=0x1b8) returned 1 [0105.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.988] SetEndOfFile (hFile=0x15c) returned 1 [0105.988] CloseHandle (hObject=0x15c) returned 1 [0105.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 1 [0105.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.989] lstrlenW (lpString=".doc") returned 4 [0105.989] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".docx") returned 5 [0105.989] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0105.989] lstrlenW (lpString=".pdf") returned 4 [0105.989] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".xls") returned 4 [0105.989] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".xlsx") returned 5 [0105.989] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0105.989] lstrlenW (lpString=".ppt") returned 4 [0105.989] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.989] lstrlenW (lpString=".zip") returned 4 [0105.989] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".rar") returned 4 [0105.989] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".bz2") returned 4 [0105.989] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0105.989] lstrlenW (lpString=".7z") returned 3 [0105.989] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0105.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.990] lstrlenW (lpString=".dbf") returned 4 [0105.990] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.990] lstrlenW (lpString=".1cd") returned 4 [0105.990] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 63 [0105.990] lstrlenW (lpString=".jpg") returned 4 [0105.990] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0105.990] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") [0105.991] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=135611) returned 1 [0105.991] CloseHandle (hObject=0x15c) returned 1 [0105.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x20 [0105.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.991] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.991] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0105.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.992] GetLastError () returned 0x0 [0105.992] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x211bb, lpOverlapped=0x0) returned 1 [0105.996] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x211c0, lpOverlapped=0x0) returned 1 [0105.999] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0105.999] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.999] SetEndOfFile (hFile=0x1b8) returned 1 [0105.999] CloseHandle (hObject=0x1b8) returned 1 [0106.000] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.000] SetEndOfFile (hFile=0x15c) returned 1 [0106.001] CloseHandle (hObject=0x15c) returned 1 [0106.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 1 [0106.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString=".doc") returned 4 [0106.002] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.002] lstrlenW (lpString=".docx") returned 5 [0106.002] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0106.002] lstrlenW (lpString=".pdf") returned 4 [0106.002] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.002] lstrlenW (lpString=".xls") returned 4 [0106.002] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.002] lstrlenW (lpString=".xlsx") returned 5 [0106.002] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0106.002] lstrlenW (lpString=".ppt") returned 4 [0106.002] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString=".zip") returned 4 [0106.002] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.002] lstrlenW (lpString=".rar") returned 4 [0106.002] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.002] lstrlenW (lpString=".bz2") returned 4 [0106.002] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.002] lstrlenW (lpString=".7z") returned 3 [0106.002] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString=".dbf") returned 4 [0106.002] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString=".1cd") returned 4 [0106.002] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 63 [0106.002] lstrlenW (lpString=".jpg") returned 4 [0106.002] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.002] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") [0106.003] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=41474) returned 1 [0106.003] CloseHandle (hObject=0x15c) returned 1 [0106.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 0x20 [0106.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0106.003] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.004] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0106.004] GetLastError () returned 0x0 [0106.004] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa202, lpOverlapped=0x0) returned 1 [0106.068] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa210, lpOverlapped=0x0) returned 1 [0106.070] ReadFile (in: hFile=0x15c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.070] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.070] SetEndOfFile (hFile=0x1b8) returned 1 [0106.293] CloseHandle (hObject=0x1b8) returned 1 [0106.302] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.302] SetEndOfFile (hFile=0x15c) returned 1 [0106.332] CloseHandle (hObject=0x15c) returned 1 [0106.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 1 [0106.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.333] lstrlenW (lpString=".doc") returned 4 [0106.333] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.333] lstrlenW (lpString=".docx") returned 5 [0106.333] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0106.333] lstrlenW (lpString=".pdf") returned 4 [0106.333] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.333] lstrlenW (lpString=".xls") returned 4 [0106.333] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.333] lstrlenW (lpString=".xlsx") returned 5 [0106.333] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0106.333] lstrlenW (lpString=".ppt") returned 4 [0106.333] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.333] lstrlenW (lpString=".zip") returned 4 [0106.333] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.333] lstrlenW (lpString=".rar") returned 4 [0106.333] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.333] lstrlenW (lpString=".bz2") returned 4 [0106.333] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.333] lstrlenW (lpString=".7z") returned 3 [0106.333] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.333] lstrlenW (lpString=".dbf") returned 4 [0106.334] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.334] lstrlenW (lpString=".1cd") returned 4 [0106.334] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 63 [0106.334] lstrlenW (lpString=".jpg") returned 4 [0106.334] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.334] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") [0106.592] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32184) returned 1 [0106.592] CloseHandle (hObject=0x1fc) returned 1 [0106.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x20 [0106.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.592] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.592] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.594] GetLastError () returned 0x0 [0106.594] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.596] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.597] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.597] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.597] SetEndOfFile (hFile=0x1f4) returned 1 [0106.597] CloseHandle (hObject=0x1f4) returned 1 [0106.597] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.597] SetEndOfFile (hFile=0x1fc) returned 1 [0106.598] CloseHandle (hObject=0x1fc) returned 1 [0106.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 1 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString=".doc") returned 4 [0106.599] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".docx") returned 5 [0106.599] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.599] lstrlenW (lpString=".pdf") returned 4 [0106.599] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".xls") returned 4 [0106.599] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".xlsx") returned 5 [0106.599] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.599] lstrlenW (lpString=".ppt") returned 4 [0106.599] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString=".zip") returned 4 [0106.599] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".rar") returned 4 [0106.599] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".bz2") returned 4 [0106.599] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString=".7z") returned 3 [0106.599] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString=".dbf") returned 4 [0106.599] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString=".1cd") returned 4 [0106.599] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 63 [0106.599] lstrlenW (lpString=".jpg") returned 4 [0106.599] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.600] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") [0106.602] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31968) returned 1 [0106.602] CloseHandle (hObject=0x1fc) returned 1 [0106.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x20 [0106.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.602] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.602] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.603] GetLastError () returned 0x0 [0106.603] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.605] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.607] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.607] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.607] SetEndOfFile (hFile=0x1f4) returned 1 [0106.607] CloseHandle (hObject=0x1f4) returned 1 [0106.607] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.607] SetEndOfFile (hFile=0x1fc) returned 1 [0106.608] CloseHandle (hObject=0x1fc) returned 1 [0106.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 1 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString=".doc") returned 4 [0106.609] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".docx") returned 5 [0106.609] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.609] lstrlenW (lpString=".pdf") returned 4 [0106.609] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".xls") returned 4 [0106.609] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".xlsx") returned 5 [0106.609] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.609] lstrlenW (lpString=".ppt") returned 4 [0106.609] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString=".zip") returned 4 [0106.609] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".rar") returned 4 [0106.609] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".bz2") returned 4 [0106.609] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString=".7z") returned 3 [0106.609] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString=".dbf") returned 4 [0106.609] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString=".1cd") returned 4 [0106.609] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 63 [0106.609] lstrlenW (lpString=".jpg") returned 4 [0106.610] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.610] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") [0106.611] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31968) returned 1 [0106.611] CloseHandle (hObject=0x1fc) returned 1 [0106.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x20 [0106.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.612] GetLastError () returned 0x0 [0106.612] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.614] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.615] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.615] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.615] SetEndOfFile (hFile=0x1f4) returned 1 [0106.615] CloseHandle (hObject=0x1f4) returned 1 [0106.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.615] SetEndOfFile (hFile=0x1fc) returned 1 [0106.616] CloseHandle (hObject=0x1fc) returned 1 [0106.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 1 [0106.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.617] lstrlenW (lpString=".doc") returned 4 [0106.617] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".docx") returned 5 [0106.617] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.617] lstrlenW (lpString=".pdf") returned 4 [0106.617] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".xls") returned 4 [0106.617] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".xlsx") returned 5 [0106.617] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.617] lstrlenW (lpString=".ppt") returned 4 [0106.617] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.617] lstrlenW (lpString=".zip") returned 4 [0106.617] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".rar") returned 4 [0106.617] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".bz2") returned 4 [0106.617] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString=".7z") returned 3 [0106.617] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.617] lstrlenW (lpString=".dbf") returned 4 [0106.617] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.617] lstrlenW (lpString=".1cd") returned 4 [0106.617] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 63 [0106.618] lstrlenW (lpString=".jpg") returned 4 [0106.618] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.618] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") [0106.618] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32184) returned 1 [0106.618] CloseHandle (hObject=0x1fc) returned 1 [0106.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x20 [0106.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.619] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.619] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.619] GetLastError () returned 0x0 [0106.619] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.950] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.950] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.950] SetEndOfFile (hFile=0x1f4) returned 1 [0106.951] CloseHandle (hObject=0x1f4) returned 1 [0106.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.951] SetEndOfFile (hFile=0x1fc) returned 1 [0106.952] CloseHandle (hObject=0x1fc) returned 1 [0106.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.952] lstrlenW (lpString=".doc") returned 4 [0106.952] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.952] lstrlenW (lpString=".docx") returned 5 [0106.952] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.952] lstrlenW (lpString=".pdf") returned 4 [0106.952] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.952] lstrlenW (lpString=".xls") returned 4 [0106.952] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.952] lstrlenW (lpString=".xlsx") returned 5 [0106.952] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.952] lstrlenW (lpString=".ppt") returned 4 [0106.952] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.952] lstrlenW (lpString=".zip") returned 4 [0106.953] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.953] lstrlenW (lpString=".rar") returned 4 [0106.953] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.953] lstrlenW (lpString=".bz2") returned 4 [0106.953] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.953] lstrlenW (lpString=".7z") returned 3 [0106.953] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.953] lstrlenW (lpString=".dbf") returned 4 [0106.953] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.953] lstrlenW (lpString=".1cd") returned 4 [0106.953] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 63 [0106.953] lstrlenW (lpString=".jpg") returned 4 [0106.953] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.953] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") [0106.954] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32616) returned 1 [0106.954] CloseHandle (hObject=0x1fc) returned 1 [0106.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 0x20 [0106.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.954] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.954] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.955] GetLastError () returned 0x0 [0106.955] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7f68, lpOverlapped=0x0) returned 1 [0106.957] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0106.958] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.959] SetEndOfFile (hFile=0x1f4) returned 1 [0106.959] CloseHandle (hObject=0x1f4) returned 1 [0106.959] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.959] SetEndOfFile (hFile=0x1fc) returned 1 [0106.960] CloseHandle (hObject=0x1fc) returned 1 [0106.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 1 [0106.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.960] lstrlenW (lpString=".doc") returned 4 [0106.960] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.960] lstrlenW (lpString=".docx") returned 5 [0106.960] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.960] lstrlenW (lpString=".pdf") returned 4 [0106.960] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.960] lstrlenW (lpString=".xls") returned 4 [0106.960] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.960] lstrlenW (lpString=".xlsx") returned 5 [0106.960] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.960] lstrlenW (lpString=".ppt") returned 4 [0106.960] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.961] lstrlenW (lpString=".zip") returned 4 [0106.961] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.961] lstrlenW (lpString=".rar") returned 4 [0106.961] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.961] lstrlenW (lpString=".bz2") returned 4 [0106.961] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.961] lstrlenW (lpString=".7z") returned 3 [0106.961] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.961] lstrlenW (lpString=".dbf") returned 4 [0106.961] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.961] lstrlenW (lpString=".1cd") returned 4 [0106.961] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 63 [0106.961] lstrlenW (lpString=".jpg") returned 4 [0106.961] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.961] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") [0106.962] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20645) returned 1 [0106.962] CloseHandle (hObject=0x1fc) returned 1 [0106.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 0x20 [0106.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.962] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.962] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.963] GetLastError () returned 0x0 [0106.963] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x50a5, lpOverlapped=0x0) returned 1 [0106.965] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x50b0, lpOverlapped=0x0) returned 1 [0106.966] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.966] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.966] SetEndOfFile (hFile=0x1f4) returned 1 [0106.966] CloseHandle (hObject=0x1f4) returned 1 [0106.966] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.966] SetEndOfFile (hFile=0x1fc) returned 1 [0106.967] CloseHandle (hObject=0x1fc) returned 1 [0106.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString=".doc") returned 4 [0106.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.968] lstrlenW (lpString=".docx") returned 5 [0106.968] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0106.968] lstrlenW (lpString=".pdf") returned 4 [0106.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.968] lstrlenW (lpString=".xls") returned 4 [0106.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.968] lstrlenW (lpString=".xlsx") returned 5 [0106.968] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0106.968] lstrlenW (lpString=".ppt") returned 4 [0106.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString=".zip") returned 4 [0106.968] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.968] lstrlenW (lpString=".rar") returned 4 [0106.968] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.968] lstrlenW (lpString=".bz2") returned 4 [0106.968] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.968] lstrlenW (lpString=".7z") returned 3 [0106.968] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString=".dbf") returned 4 [0106.968] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString=".1cd") returned 4 [0106.968] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 63 [0106.968] lstrlenW (lpString=".jpg") returned 4 [0106.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.969] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") [0106.969] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31968) returned 1 [0106.969] CloseHandle (hObject=0x1fc) returned 1 [0106.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x20 [0106.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.970] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.970] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.975] GetLastError () returned 0x0 [0106.975] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.977] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.978] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0106.978] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.978] SetEndOfFile (hFile=0x1f4) returned 1 [0106.978] CloseHandle (hObject=0x1f4) returned 1 [0106.978] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.978] SetEndOfFile (hFile=0x1fc) returned 1 [0106.979] CloseHandle (hObject=0x1fc) returned 1 [0106.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 1 [0106.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.980] lstrlenW (lpString=".doc") returned 4 [0106.980] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".docx") returned 5 [0106.980] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.980] lstrlenW (lpString=".pdf") returned 4 [0106.980] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".xls") returned 4 [0106.980] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".xlsx") returned 5 [0106.980] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.980] lstrlenW (lpString=".ppt") returned 4 [0106.980] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.980] lstrlenW (lpString=".zip") returned 4 [0106.980] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".rar") returned 4 [0106.980] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".bz2") returned 4 [0106.980] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.980] lstrlenW (lpString=".7z") returned 3 [0106.980] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.980] lstrlenW (lpString=".dbf") returned 4 [0106.980] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.981] lstrlenW (lpString=".1cd") returned 4 [0106.981] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 63 [0106.981] lstrlenW (lpString=".jpg") returned 4 [0106.981] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.981] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") [0106.981] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=28038) returned 1 [0106.981] CloseHandle (hObject=0x1fc) returned 1 [0106.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 0x20 [0106.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.982] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.982] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0106.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0106.982] GetLastError () returned 0x0 [0106.982] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6d86, lpOverlapped=0x0) returned 1 [0107.176] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6d90, lpOverlapped=0x0) returned 1 [0107.177] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0107.178] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.178] SetEndOfFile (hFile=0x1f4) returned 1 [0107.178] CloseHandle (hObject=0x1f4) returned 1 [0107.178] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.178] SetEndOfFile (hFile=0x1fc) returned 1 [0107.179] CloseHandle (hObject=0x1fc) returned 1 [0107.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 1 [0107.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.179] lstrlenW (lpString=".doc") returned 4 [0107.179] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.179] lstrlenW (lpString=".docx") returned 5 [0107.179] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.179] lstrlenW (lpString=".pdf") returned 4 [0107.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.179] lstrlenW (lpString=".xls") returned 4 [0107.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.179] lstrlenW (lpString=".xlsx") returned 5 [0107.179] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.179] lstrlenW (lpString=".ppt") returned 4 [0107.179] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.180] lstrlenW (lpString=".zip") returned 4 [0107.180] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.180] lstrlenW (lpString=".rar") returned 4 [0107.180] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.180] lstrlenW (lpString=".bz2") returned 4 [0107.180] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.180] lstrlenW (lpString=".7z") returned 3 [0107.180] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.180] lstrlenW (lpString=".dbf") returned 4 [0107.180] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.180] lstrlenW (lpString=".1cd") returned 4 [0107.180] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 63 [0107.180] lstrlenW (lpString=".jpg") returned 4 [0107.180] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.180] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") [0107.181] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=108504) returned 1 [0107.181] CloseHandle (hObject=0x1fc) returned 1 [0107.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 0x20 [0107.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.181] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.181] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0107.182] GetLastError () returned 0x0 [0107.182] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0107.185] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1a7e0, lpOverlapped=0x0) returned 1 [0107.187] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0107.187] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.187] SetEndOfFile (hFile=0x1f4) returned 1 [0107.188] CloseHandle (hObject=0x1f4) returned 1 [0107.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.188] SetEndOfFile (hFile=0x1fc) returned 1 [0107.189] CloseHandle (hObject=0x1fc) returned 1 [0107.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 1 [0107.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.190] lstrlenW (lpString=".doc") returned 4 [0107.190] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".docx") returned 5 [0107.190] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.190] lstrlenW (lpString=".pdf") returned 4 [0107.190] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".xls") returned 4 [0107.190] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".xlsx") returned 5 [0107.190] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.190] lstrlenW (lpString=".ppt") returned 4 [0107.190] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.190] lstrlenW (lpString=".zip") returned 4 [0107.190] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".rar") returned 4 [0107.190] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".bz2") returned 4 [0107.190] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString=".7z") returned 3 [0107.190] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.190] lstrlenW (lpString=".dbf") returned 4 [0107.190] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.190] lstrlenW (lpString=".1cd") returned 4 [0107.190] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 63 [0107.190] lstrlenW (lpString=".jpg") returned 4 [0107.190] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.190] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") [0107.192] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=197640) returned 1 [0107.192] CloseHandle (hObject=0x1fc) returned 1 [0107.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x20 [0107.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.192] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.192] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0107.193] GetLastError () returned 0x0 [0107.193] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x30408, lpOverlapped=0x0) returned 1 [0107.197] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x30410, lpOverlapped=0x0) returned 1 [0107.201] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0107.201] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.201] SetEndOfFile (hFile=0x1f4) returned 1 [0107.201] CloseHandle (hObject=0x1f4) returned 1 [0107.201] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.201] SetEndOfFile (hFile=0x1fc) returned 1 [0107.203] CloseHandle (hObject=0x1fc) returned 1 [0107.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 1 [0107.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.203] lstrlenW (lpString=".doc") returned 4 [0107.203] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".docx") returned 5 [0107.204] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.204] lstrlenW (lpString=".pdf") returned 4 [0107.204] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".xls") returned 4 [0107.204] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".xlsx") returned 5 [0107.204] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.204] lstrlenW (lpString=".ppt") returned 4 [0107.204] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.204] lstrlenW (lpString=".zip") returned 4 [0107.204] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".rar") returned 4 [0107.204] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".bz2") returned 4 [0107.204] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString=".7z") returned 3 [0107.204] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.204] lstrlenW (lpString=".dbf") returned 4 [0107.204] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.204] lstrlenW (lpString=".1cd") returned 4 [0107.204] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 63 [0107.204] lstrlenW (lpString=".jpg") returned 4 [0107.204] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.204] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") [0107.205] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=197640) returned 1 [0107.205] CloseHandle (hObject=0x1fc) returned 1 [0107.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x20 [0107.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.205] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.205] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0107.206] GetLastError () returned 0x0 [0107.206] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x30408, lpOverlapped=0x0) returned 1 [0107.211] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x30410, lpOverlapped=0x0) returned 1 [0107.214] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0107.214] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.333] SetEndOfFile (hFile=0x1f4) returned 1 [0107.337] CloseHandle (hObject=0x1f4) returned 1 [0107.337] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0107.337] SetEndOfFile (hFile=0x1fc) returned 1 [0107.339] CloseHandle (hObject=0x1fc) returned 1 [0107.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.344] lstrlenW (lpString=".doc") returned 4 [0107.344] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.344] lstrlenW (lpString=".docx") returned 5 [0107.345] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.345] lstrlenW (lpString=".pdf") returned 4 [0107.345] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString=".xls") returned 4 [0107.345] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString=".xlsx") returned 5 [0107.345] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.345] lstrlenW (lpString=".ppt") returned 4 [0107.345] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.345] lstrlenW (lpString=".zip") returned 4 [0107.345] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString=".rar") returned 4 [0107.345] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString=".bz2") returned 4 [0107.345] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString=".7z") returned 3 [0107.345] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.345] lstrlenW (lpString=".dbf") returned 4 [0107.345] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.345] lstrlenW (lpString=".1cd") returned 4 [0107.345] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 63 [0107.345] lstrlenW (lpString=".jpg") returned 4 [0107.345] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.345] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") [0108.347] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11170) returned 1 [0108.347] CloseHandle (hObject=0x1a0) returned 1 [0108.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0108.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0108.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0108.348] GetLastError () returned 0x0 [0108.348] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2ba2, lpOverlapped=0x0) returned 1 [0108.361] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2bb0, lpOverlapped=0x0) returned 1 [0108.362] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.362] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.362] SetEndOfFile (hFile=0x210) returned 1 [0108.363] CloseHandle (hObject=0x210) returned 1 [0108.363] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.363] SetEndOfFile (hFile=0x1a0) returned 1 [0108.363] CloseHandle (hObject=0x1a0) returned 1 [0108.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 1 [0108.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.364] lstrlenW (lpString=".doc") returned 4 [0108.364] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0108.364] lstrlenW (lpString=".docx") returned 5 [0108.364] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0108.364] lstrlenW (lpString=".pdf") returned 4 [0108.364] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0108.364] lstrlenW (lpString=".xls") returned 4 [0108.364] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0108.364] lstrlenW (lpString=".xlsx") returned 5 [0108.364] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0108.364] lstrlenW (lpString=".ppt") returned 4 [0108.364] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0108.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.364] lstrlenW (lpString=".zip") returned 4 [0108.364] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0108.364] lstrlenW (lpString=".rar") returned 4 [0108.364] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0108.364] lstrlenW (lpString=".bz2") returned 4 [0108.364] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0108.364] lstrlenW (lpString=".7z") returned 3 [0108.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0108.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.365] lstrlenW (lpString=".dbf") returned 4 [0108.365] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0108.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.365] lstrlenW (lpString=".1cd") returned 4 [0108.365] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0108.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 63 [0108.365] lstrlenW (lpString=".jpg") returned 4 [0108.365] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0108.365] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") [0108.365] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31908) returned 1 [0108.365] CloseHandle (hObject=0x1a0) returned 1 [0108.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 0x20 [0108.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0108.366] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.366] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0108.366] GetLastError () returned 0x0 [0108.367] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7ca4, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7cb0, lpOverlapped=0x0) returned 1 [0108.378] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.379] SetEndOfFile (hFile=0x210) returned 1 [0108.379] CloseHandle (hObject=0x210) returned 1 [0108.379] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.379] SetEndOfFile (hFile=0x1a0) returned 1 [0108.380] CloseHandle (hObject=0x1a0) returned 1 [0108.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 1 [0108.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.381] lstrlenW (lpString=".doc") returned 4 [0108.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString=".docx") returned 5 [0108.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.381] lstrlenW (lpString=".pdf") returned 4 [0108.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString=".xls") returned 4 [0108.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.381] lstrlenW (lpString=".xlsx") returned 5 [0108.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.381] lstrlenW (lpString=".ppt") returned 4 [0108.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.381] lstrlenW (lpString=".zip") returned 4 [0108.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.381] lstrlenW (lpString=".rar") returned 4 [0108.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString=".bz2") returned 4 [0108.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString=".7z") returned 3 [0108.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.381] lstrlenW (lpString=".dbf") returned 4 [0108.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.381] lstrlenW (lpString=".1cd") returned 4 [0108.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.382] lstrlenW (lpString=".jpg") returned 4 [0108.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString=".pdf") returned 4 [0108.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString=".xls") returned 4 [0108.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.382] lstrlenW (lpString=".xlsx") returned 5 [0108.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.382] lstrlenW (lpString=".ppt") returned 4 [0108.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.382] lstrlenW (lpString=".zip") returned 4 [0108.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.382] lstrlenW (lpString=".rar") returned 4 [0108.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString=".bz2") returned 4 [0108.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString=".7z") returned 3 [0108.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.382] lstrlenW (lpString=".dbf") returned 4 [0108.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.382] lstrlenW (lpString=".1cd") returned 4 [0108.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 63 [0108.382] lstrlenW (lpString=".jpg") returned 4 [0108.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.382] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") [0108.397] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7596) returned 1 [0108.397] CloseHandle (hObject=0x1b8) returned 1 [0108.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x20 [0108.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.398] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.398] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.398] GetLastError () returned 0x0 [0108.399] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1dac, lpOverlapped=0x0) returned 1 [0108.401] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1db0, lpOverlapped=0x0) returned 1 [0108.402] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.402] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.402] SetEndOfFile (hFile=0x158) returned 1 [0108.402] CloseHandle (hObject=0x158) returned 1 [0108.402] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.402] SetEndOfFile (hFile=0x1b8) returned 1 [0108.403] CloseHandle (hObject=0x1b8) returned 1 [0108.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 1 [0108.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.403] lstrlenW (lpString=".doc") returned 4 [0108.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.403] lstrlenW (lpString=".docx") returned 5 [0108.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.404] lstrlenW (lpString=".pdf") returned 4 [0108.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString=".xls") returned 4 [0108.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.404] lstrlenW (lpString=".xlsx") returned 5 [0108.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.404] lstrlenW (lpString=".ppt") returned 4 [0108.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.404] lstrlenW (lpString=".zip") returned 4 [0108.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.404] lstrlenW (lpString=".rar") returned 4 [0108.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString=".bz2") returned 4 [0108.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString=".7z") returned 3 [0108.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.404] lstrlenW (lpString=".dbf") returned 4 [0108.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.404] lstrlenW (lpString=".1cd") returned 4 [0108.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.404] lstrlenW (lpString=".jpg") returned 4 [0108.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString=".pdf") returned 4 [0108.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.404] lstrlenW (lpString=".xls") returned 4 [0108.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.404] lstrlenW (lpString=".xlsx") returned 5 [0108.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.405] lstrlenW (lpString=".ppt") returned 4 [0108.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.405] lstrlenW (lpString=".zip") returned 4 [0108.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.405] lstrlenW (lpString=".rar") returned 4 [0108.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.405] lstrlenW (lpString=".bz2") returned 4 [0108.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.405] lstrlenW (lpString=".7z") returned 3 [0108.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.405] lstrlenW (lpString=".dbf") returned 4 [0108.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.405] lstrlenW (lpString=".1cd") returned 4 [0108.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 63 [0108.405] lstrlenW (lpString=".jpg") returned 4 [0108.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.405] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") [0108.406] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8416) returned 1 [0108.406] CloseHandle (hObject=0x1b8) returned 1 [0108.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 0x20 [0108.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.406] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.406] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.407] GetLastError () returned 0x0 [0108.407] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x20e0, lpOverlapped=0x0) returned 1 [0108.417] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0108.418] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.418] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.418] SetEndOfFile (hFile=0x158) returned 1 [0108.418] CloseHandle (hObject=0x158) returned 1 [0108.418] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.418] SetEndOfFile (hFile=0x1b8) returned 1 [0108.419] CloseHandle (hObject=0x1b8) returned 1 [0108.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 1 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.422] lstrlenW (lpString=".doc") returned 4 [0108.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString=".docx") returned 5 [0108.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.422] lstrlenW (lpString=".pdf") returned 4 [0108.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString=".xls") returned 4 [0108.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.422] lstrlenW (lpString=".xlsx") returned 5 [0108.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.422] lstrlenW (lpString=".ppt") returned 4 [0108.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.422] lstrlenW (lpString=".zip") returned 4 [0108.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.422] lstrlenW (lpString=".rar") returned 4 [0108.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString=".bz2") returned 4 [0108.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString=".7z") returned 3 [0108.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.422] lstrlenW (lpString=".dbf") returned 4 [0108.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.422] lstrlenW (lpString=".1cd") returned 4 [0108.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.423] lstrlenW (lpString=".jpg") returned 4 [0108.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString=".pdf") returned 4 [0108.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString=".xls") returned 4 [0108.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.423] lstrlenW (lpString=".xlsx") returned 5 [0108.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.423] lstrlenW (lpString=".ppt") returned 4 [0108.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.423] lstrlenW (lpString=".zip") returned 4 [0108.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.423] lstrlenW (lpString=".rar") returned 4 [0108.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString=".bz2") returned 4 [0108.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString=".7z") returned 3 [0108.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.423] lstrlenW (lpString=".dbf") returned 4 [0108.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.423] lstrlenW (lpString=".1cd") returned 4 [0108.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 63 [0108.423] lstrlenW (lpString=".jpg") returned 4 [0108.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.423] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") [0108.424] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1344) returned 1 [0108.424] CloseHandle (hObject=0x1b8) returned 1 [0108.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x20 [0108.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.425] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.425] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.425] GetLastError () returned 0x0 [0108.425] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x540, lpOverlapped=0x0) returned 1 [0108.512] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x550, lpOverlapped=0x0) returned 1 [0108.513] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.513] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.513] SetEndOfFile (hFile=0x158) returned 1 [0108.513] CloseHandle (hObject=0x158) returned 1 [0108.514] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.514] SetEndOfFile (hFile=0x1b8) returned 1 [0108.514] CloseHandle (hObject=0x1b8) returned 1 [0108.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 1 [0108.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.515] lstrlenW (lpString=".doc") returned 4 [0108.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString=".docx") returned 5 [0108.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.515] lstrlenW (lpString=".pdf") returned 4 [0108.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString=".xls") returned 4 [0108.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.515] lstrlenW (lpString=".xlsx") returned 5 [0108.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.515] lstrlenW (lpString=".ppt") returned 4 [0108.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.515] lstrlenW (lpString=".zip") returned 4 [0108.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.515] lstrlenW (lpString=".rar") returned 4 [0108.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString=".bz2") returned 4 [0108.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString=".7z") returned 3 [0108.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.515] lstrlenW (lpString=".dbf") returned 4 [0108.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".1cd") returned 4 [0108.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".jpg") returned 4 [0108.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString=".pdf") returned 4 [0108.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString=".xls") returned 4 [0108.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.516] lstrlenW (lpString=".xlsx") returned 5 [0108.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.516] lstrlenW (lpString=".ppt") returned 4 [0108.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".zip") returned 4 [0108.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.516] lstrlenW (lpString=".rar") returned 4 [0108.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString=".bz2") returned 4 [0108.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString=".7z") returned 3 [0108.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".dbf") returned 4 [0108.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".1cd") returned 4 [0108.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 63 [0108.516] lstrlenW (lpString=".jpg") returned 4 [0108.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.517] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") [0108.539] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18260) returned 1 [0108.539] CloseHandle (hObject=0x1fc) returned 1 [0108.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 0x20 [0108.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.540] GetLastError () returned 0x0 [0108.540] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4754, lpOverlapped=0x0) returned 1 [0108.574] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4760, lpOverlapped=0x0) returned 1 [0108.575] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.575] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.575] SetEndOfFile (hFile=0x1b8) returned 1 [0108.575] CloseHandle (hObject=0x1b8) returned 1 [0108.576] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.576] SetEndOfFile (hFile=0x1fc) returned 1 [0108.576] CloseHandle (hObject=0x1fc) returned 1 [0108.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 1 [0108.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.577] lstrlenW (lpString=".doc") returned 4 [0108.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.577] lstrlenW (lpString=".docx") returned 5 [0108.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.577] lstrlenW (lpString=".pdf") returned 4 [0108.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.577] lstrlenW (lpString=".xls") returned 4 [0108.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.577] lstrlenW (lpString=".xlsx") returned 5 [0108.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.577] lstrlenW (lpString=".ppt") returned 4 [0108.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.577] lstrlenW (lpString=".zip") returned 4 [0108.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.577] lstrlenW (lpString=".rar") returned 4 [0108.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.577] lstrlenW (lpString=".bz2") returned 4 [0108.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString=".7z") returned 3 [0108.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".dbf") returned 4 [0108.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".1cd") returned 4 [0108.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".jpg") returned 4 [0108.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString=".pdf") returned 4 [0108.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString=".xls") returned 4 [0108.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.578] lstrlenW (lpString=".xlsx") returned 5 [0108.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.578] lstrlenW (lpString=".ppt") returned 4 [0108.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".zip") returned 4 [0108.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.578] lstrlenW (lpString=".rar") returned 4 [0108.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString=".bz2") returned 4 [0108.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString=".7z") returned 3 [0108.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".dbf") returned 4 [0108.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.578] lstrlenW (lpString=".1cd") returned 4 [0108.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 63 [0108.579] lstrlenW (lpString=".jpg") returned 4 [0108.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.579] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") [0108.580] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10300) returned 1 [0108.580] CloseHandle (hObject=0x1fc) returned 1 [0108.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 0x20 [0108.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.581] GetLastError () returned 0x0 [0108.581] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x283c, lpOverlapped=0x0) returned 1 [0108.582] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2840, lpOverlapped=0x0) returned 1 [0108.583] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.583] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.584] SetEndOfFile (hFile=0x1b8) returned 1 [0108.584] CloseHandle (hObject=0x1b8) returned 1 [0108.584] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.584] SetEndOfFile (hFile=0x1fc) returned 1 [0108.585] CloseHandle (hObject=0x1fc) returned 1 [0108.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 1 [0108.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.585] lstrlenW (lpString=".doc") returned 4 [0108.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.585] lstrlenW (lpString=".docx") returned 5 [0108.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.585] lstrlenW (lpString=".pdf") returned 4 [0108.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.585] lstrlenW (lpString=".xls") returned 4 [0108.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.585] lstrlenW (lpString=".xlsx") returned 5 [0108.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.585] lstrlenW (lpString=".ppt") returned 4 [0108.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.586] lstrlenW (lpString=".zip") returned 4 [0108.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.586] lstrlenW (lpString=".rar") returned 4 [0108.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString=".bz2") returned 4 [0108.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString=".7z") returned 3 [0108.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.586] lstrlenW (lpString=".dbf") returned 4 [0108.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.586] lstrlenW (lpString=".1cd") returned 4 [0108.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.586] lstrlenW (lpString=".jpg") returned 4 [0108.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString=".pdf") returned 4 [0108.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString=".xls") returned 4 [0108.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.586] lstrlenW (lpString=".xlsx") returned 5 [0108.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.586] lstrlenW (lpString=".ppt") returned 4 [0108.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.586] lstrlenW (lpString=".zip") returned 4 [0108.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.586] lstrlenW (lpString=".rar") returned 4 [0108.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.586] lstrlenW (lpString=".bz2") returned 4 [0108.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.587] lstrlenW (lpString=".7z") returned 3 [0108.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.587] lstrlenW (lpString=".dbf") returned 4 [0108.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.587] lstrlenW (lpString=".1cd") returned 4 [0108.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 63 [0108.587] lstrlenW (lpString=".jpg") returned 4 [0108.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.587] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") [0108.588] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20812) returned 1 [0108.588] CloseHandle (hObject=0x1fc) returned 1 [0108.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 0x20 [0108.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.589] GetLastError () returned 0x0 [0108.589] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x514c, lpOverlapped=0x0) returned 1 [0108.592] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5150, lpOverlapped=0x0) returned 1 [0108.594] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.594] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.594] SetEndOfFile (hFile=0x1b8) returned 1 [0108.594] CloseHandle (hObject=0x1b8) returned 1 [0108.594] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.594] SetEndOfFile (hFile=0x1fc) returned 1 [0108.595] CloseHandle (hObject=0x1fc) returned 1 [0108.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 1 [0108.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.595] lstrlenW (lpString=".doc") returned 4 [0108.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.595] lstrlenW (lpString=".docx") returned 5 [0108.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.595] lstrlenW (lpString=".pdf") returned 4 [0108.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.595] lstrlenW (lpString=".xls") returned 4 [0108.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.596] lstrlenW (lpString=".xlsx") returned 5 [0108.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.596] lstrlenW (lpString=".ppt") returned 4 [0108.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.596] lstrlenW (lpString=".zip") returned 4 [0108.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.596] lstrlenW (lpString=".rar") returned 4 [0108.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString=".bz2") returned 4 [0108.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString=".7z") returned 3 [0108.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.596] lstrlenW (lpString=".dbf") returned 4 [0108.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.596] lstrlenW (lpString=".1cd") returned 4 [0108.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.596] lstrlenW (lpString=".jpg") returned 4 [0108.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString=".pdf") returned 4 [0108.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString=".xls") returned 4 [0108.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.596] lstrlenW (lpString=".xlsx") returned 5 [0108.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.596] lstrlenW (lpString=".ppt") returned 4 [0108.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.596] lstrlenW (lpString=".zip") returned 4 [0108.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.597] lstrlenW (lpString=".rar") returned 4 [0108.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.597] lstrlenW (lpString=".bz2") returned 4 [0108.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.597] lstrlenW (lpString=".7z") returned 3 [0108.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.597] lstrlenW (lpString=".dbf") returned 4 [0108.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.597] lstrlenW (lpString=".1cd") returned 4 [0108.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 63 [0108.597] lstrlenW (lpString=".jpg") returned 4 [0108.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.597] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") [0108.598] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8336) returned 1 [0108.598] CloseHandle (hObject=0x1fc) returned 1 [0108.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 0x20 [0108.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.598] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.598] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.599] GetLastError () returned 0x0 [0108.599] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2090, lpOverlapped=0x0) returned 1 [0108.612] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x20a0, lpOverlapped=0x0) returned 1 [0108.621] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.621] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.621] SetEndOfFile (hFile=0x1b8) returned 1 [0108.622] CloseHandle (hObject=0x1b8) returned 1 [0108.622] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.622] SetEndOfFile (hFile=0x1fc) returned 1 [0108.622] CloseHandle (hObject=0x1fc) returned 1 [0108.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 1 [0108.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.623] lstrlenW (lpString=".doc") returned 4 [0108.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.623] lstrlenW (lpString=".docx") returned 5 [0108.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.623] lstrlenW (lpString=".pdf") returned 4 [0108.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.623] lstrlenW (lpString=".xls") returned 4 [0108.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.623] lstrlenW (lpString=".xlsx") returned 5 [0108.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.623] lstrlenW (lpString=".ppt") returned 4 [0108.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.623] lstrlenW (lpString=".zip") returned 4 [0108.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.623] lstrlenW (lpString=".rar") returned 4 [0108.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".bz2") returned 4 [0108.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".7z") returned 3 [0108.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.624] lstrlenW (lpString=".dbf") returned 4 [0108.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.624] lstrlenW (lpString=".1cd") returned 4 [0108.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.624] lstrlenW (lpString=".jpg") returned 4 [0108.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".pdf") returned 4 [0108.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".xls") returned 4 [0108.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.624] lstrlenW (lpString=".xlsx") returned 5 [0108.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.624] lstrlenW (lpString=".ppt") returned 4 [0108.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.624] lstrlenW (lpString=".zip") returned 4 [0108.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.624] lstrlenW (lpString=".rar") returned 4 [0108.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".bz2") returned 4 [0108.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.624] lstrlenW (lpString=".7z") returned 3 [0108.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.624] lstrlenW (lpString=".dbf") returned 4 [0108.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.625] lstrlenW (lpString=".1cd") returned 4 [0108.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 63 [0108.625] lstrlenW (lpString=".jpg") returned 4 [0108.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.625] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") [0108.626] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=10176) returned 1 [0108.626] CloseHandle (hObject=0x1fc) returned 1 [0108.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) returned 0x20 [0108.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.627] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.627] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.628] GetLastError () returned 0x0 [0108.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x27c0, lpOverlapped=0x0) returned 1 [0108.630] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x27d0, lpOverlapped=0x0) returned 1 [0108.631] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.631] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.631] SetEndOfFile (hFile=0x1b8) returned 1 [0108.631] CloseHandle (hObject=0x1b8) returned 1 [0108.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.631] SetEndOfFile (hFile=0x1fc) returned 1 [0108.632] CloseHandle (hObject=0x1fc) returned 1 [0108.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) returned 1 [0108.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.632] lstrlenW (lpString=".doc") returned 4 [0108.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.632] lstrlenW (lpString=".docx") returned 5 [0108.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.632] lstrlenW (lpString=".pdf") returned 4 [0108.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.632] lstrlenW (lpString=".xls") returned 4 [0108.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.632] lstrlenW (lpString=".xlsx") returned 5 [0108.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.633] lstrlenW (lpString=".ppt") returned 4 [0108.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.633] lstrlenW (lpString=".zip") returned 4 [0108.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.633] lstrlenW (lpString=".rar") returned 4 [0108.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString=".bz2") returned 4 [0108.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString=".7z") returned 3 [0108.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.633] lstrlenW (lpString=".dbf") returned 4 [0108.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.633] lstrlenW (lpString=".1cd") returned 4 [0108.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.633] lstrlenW (lpString=".jpg") returned 4 [0108.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString=".pdf") returned 4 [0108.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.633] lstrlenW (lpString=".xls") returned 4 [0108.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.633] lstrlenW (lpString=".xlsx") returned 5 [0108.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.633] lstrlenW (lpString=".ppt") returned 4 [0108.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.634] lstrlenW (lpString=".zip") returned 4 [0108.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.634] lstrlenW (lpString=".rar") returned 4 [0108.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.634] lstrlenW (lpString=".bz2") returned 4 [0108.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.634] lstrlenW (lpString=".7z") returned 3 [0108.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.634] lstrlenW (lpString=".dbf") returned 4 [0108.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.634] lstrlenW (lpString=".1cd") returned 4 [0108.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 63 [0108.634] lstrlenW (lpString=".jpg") returned 4 [0108.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.634] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") [0108.636] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9100) returned 1 [0108.636] CloseHandle (hObject=0x1fc) returned 1 [0108.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf")) returned 0x20 [0108.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.636] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.636] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.637] GetLastError () returned 0x0 [0108.637] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x238c, lpOverlapped=0x0) returned 1 [0108.639] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2390, lpOverlapped=0x0) returned 1 [0108.640] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.640] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.640] SetEndOfFile (hFile=0x1b8) returned 1 [0108.640] CloseHandle (hObject=0x1b8) returned 1 [0108.640] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.640] SetEndOfFile (hFile=0x1fc) returned 1 [0108.641] CloseHandle (hObject=0x1fc) returned 1 [0108.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf")) returned 1 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.641] lstrlenW (lpString=".doc") returned 4 [0108.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString=".docx") returned 5 [0108.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.642] lstrlenW (lpString=".pdf") returned 4 [0108.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString=".xls") returned 4 [0108.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.642] lstrlenW (lpString=".xlsx") returned 5 [0108.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.642] lstrlenW (lpString=".ppt") returned 4 [0108.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.642] lstrlenW (lpString=".zip") returned 4 [0108.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.642] lstrlenW (lpString=".rar") returned 4 [0108.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString=".bz2") returned 4 [0108.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString=".7z") returned 3 [0108.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.642] lstrlenW (lpString=".dbf") returned 4 [0108.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.642] lstrlenW (lpString=".1cd") returned 4 [0108.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.642] lstrlenW (lpString=".jpg") returned 4 [0108.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString=".pdf") returned 4 [0108.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.642] lstrlenW (lpString=".xls") returned 4 [0108.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.642] lstrlenW (lpString=".xlsx") returned 5 [0108.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.643] lstrlenW (lpString=".ppt") returned 4 [0108.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.643] lstrlenW (lpString=".zip") returned 4 [0108.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.643] lstrlenW (lpString=".rar") returned 4 [0108.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.643] lstrlenW (lpString=".bz2") returned 4 [0108.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.643] lstrlenW (lpString=".7z") returned 3 [0108.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.643] lstrlenW (lpString=".dbf") returned 4 [0108.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.643] lstrlenW (lpString=".1cd") returned 4 [0108.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 63 [0108.643] lstrlenW (lpString=".jpg") returned 4 [0108.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.643] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") [0108.644] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5630) returned 1 [0108.644] CloseHandle (hObject=0x1fc) returned 1 [0108.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf")) returned 0x20 [0108.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.644] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.644] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.645] GetLastError () returned 0x0 [0108.645] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x15fe, lpOverlapped=0x0) returned 1 [0108.669] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1600, lpOverlapped=0x0) returned 1 [0108.671] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.671] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.671] SetEndOfFile (hFile=0x1b8) returned 1 [0108.672] CloseHandle (hObject=0x1b8) returned 1 [0108.672] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.672] SetEndOfFile (hFile=0x1fc) returned 1 [0108.673] CloseHandle (hObject=0x1fc) returned 1 [0108.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf")) returned 1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString=".doc") returned 4 [0108.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".docx") returned 5 [0108.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.674] lstrlenW (lpString=".pdf") returned 4 [0108.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".xls") returned 4 [0108.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.674] lstrlenW (lpString=".xlsx") returned 5 [0108.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.674] lstrlenW (lpString=".ppt") returned 4 [0108.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString=".zip") returned 4 [0108.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.674] lstrlenW (lpString=".rar") returned 4 [0108.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".bz2") returned 4 [0108.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".7z") returned 3 [0108.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString=".dbf") returned 4 [0108.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString=".1cd") returned 4 [0108.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.674] lstrlenW (lpString=".jpg") returned 4 [0108.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString=".pdf") returned 4 [0108.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString=".xls") returned 4 [0108.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.675] lstrlenW (lpString=".xlsx") returned 5 [0108.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.675] lstrlenW (lpString=".ppt") returned 4 [0108.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.675] lstrlenW (lpString=".zip") returned 4 [0108.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.675] lstrlenW (lpString=".rar") returned 4 [0108.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString=".bz2") returned 4 [0108.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString=".7z") returned 3 [0108.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.675] lstrlenW (lpString=".dbf") returned 4 [0108.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.675] lstrlenW (lpString=".1cd") returned 4 [0108.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 63 [0108.675] lstrlenW (lpString=".jpg") returned 4 [0108.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.675] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") [0108.677] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20338) returned 1 [0108.677] CloseHandle (hObject=0x1fc) returned 1 [0108.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf")) returned 0x20 [0108.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.677] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.677] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.678] GetLastError () returned 0x0 [0108.678] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x4f72, lpOverlapped=0x0) returned 1 [0108.680] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4f80, lpOverlapped=0x0) returned 1 [0108.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.681] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.681] SetEndOfFile (hFile=0x1b8) returned 1 [0108.681] CloseHandle (hObject=0x1b8) returned 1 [0108.682] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.682] SetEndOfFile (hFile=0x1fc) returned 1 [0108.682] CloseHandle (hObject=0x1fc) returned 1 [0108.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf")) returned 1 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.683] lstrlenW (lpString=".doc") returned 4 [0108.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString=".docx") returned 5 [0108.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.683] lstrlenW (lpString=".pdf") returned 4 [0108.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString=".xls") returned 4 [0108.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.683] lstrlenW (lpString=".xlsx") returned 5 [0108.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.683] lstrlenW (lpString=".ppt") returned 4 [0108.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.683] lstrlenW (lpString=".zip") returned 4 [0108.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.683] lstrlenW (lpString=".rar") returned 4 [0108.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString=".bz2") returned 4 [0108.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString=".7z") returned 3 [0108.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".dbf") returned 4 [0108.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".1cd") returned 4 [0108.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".jpg") returned 4 [0108.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".pdf") returned 4 [0108.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".xls") returned 4 [0108.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.684] lstrlenW (lpString=".xlsx") returned 5 [0108.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.684] lstrlenW (lpString=".ppt") returned 4 [0108.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".zip") returned 4 [0108.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.684] lstrlenW (lpString=".rar") returned 4 [0108.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".bz2") returned 4 [0108.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".7z") returned 3 [0108.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".dbf") returned 4 [0108.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.684] lstrlenW (lpString=".1cd") returned 4 [0108.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 63 [0108.685] lstrlenW (lpString=".jpg") returned 4 [0108.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.685] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") [0108.686] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8052) returned 1 [0108.686] CloseHandle (hObject=0x1fc) returned 1 [0108.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf")) returned 0x20 [0108.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.687] GetLastError () returned 0x0 [0108.687] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f74, lpOverlapped=0x0) returned 1 [0108.689] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f80, lpOverlapped=0x0) returned 1 [0108.690] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.690] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.690] SetEndOfFile (hFile=0x1b8) returned 1 [0108.691] CloseHandle (hObject=0x1b8) returned 1 [0108.691] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.691] SetEndOfFile (hFile=0x1fc) returned 1 [0108.692] CloseHandle (hObject=0x1fc) returned 1 [0108.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf")) returned 1 [0108.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.692] lstrlenW (lpString=".doc") returned 4 [0108.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.692] lstrlenW (lpString=".docx") returned 5 [0108.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.692] lstrlenW (lpString=".pdf") returned 4 [0108.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.692] lstrlenW (lpString=".xls") returned 4 [0108.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.692] lstrlenW (lpString=".xlsx") returned 5 [0108.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.692] lstrlenW (lpString=".ppt") returned 4 [0108.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.692] lstrlenW (lpString=".zip") returned 4 [0108.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.693] lstrlenW (lpString=".rar") returned 4 [0108.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".bz2") returned 4 [0108.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".7z") returned 3 [0108.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.693] lstrlenW (lpString=".dbf") returned 4 [0108.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.693] lstrlenW (lpString=".1cd") returned 4 [0108.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.693] lstrlenW (lpString=".jpg") returned 4 [0108.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".pdf") returned 4 [0108.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".xls") returned 4 [0108.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.693] lstrlenW (lpString=".xlsx") returned 5 [0108.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.693] lstrlenW (lpString=".ppt") returned 4 [0108.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.693] lstrlenW (lpString=".zip") returned 4 [0108.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.693] lstrlenW (lpString=".rar") returned 4 [0108.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".bz2") returned 4 [0108.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.693] lstrlenW (lpString=".7z") returned 3 [0108.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.694] lstrlenW (lpString=".dbf") returned 4 [0108.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.694] lstrlenW (lpString=".1cd") returned 4 [0108.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 63 [0108.694] lstrlenW (lpString=".jpg") returned 4 [0108.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.694] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") [0108.695] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7772) returned 1 [0108.695] CloseHandle (hObject=0x1fc) returned 1 [0108.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 0x20 [0108.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.696] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.696] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.697] GetLastError () returned 0x0 [0108.697] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1e5c, lpOverlapped=0x0) returned 1 [0108.723] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0108.724] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.724] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.724] SetEndOfFile (hFile=0x1b8) returned 1 [0108.724] CloseHandle (hObject=0x1b8) returned 1 [0108.724] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.724] SetEndOfFile (hFile=0x1fc) returned 1 [0108.725] CloseHandle (hObject=0x1fc) returned 1 [0108.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 1 [0108.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.725] lstrlenW (lpString=".doc") returned 4 [0108.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.725] lstrlenW (lpString=".docx") returned 5 [0108.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.725] lstrlenW (lpString=".pdf") returned 4 [0108.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString=".xls") returned 4 [0108.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.726] lstrlenW (lpString=".xlsx") returned 5 [0108.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.726] lstrlenW (lpString=".ppt") returned 4 [0108.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.726] lstrlenW (lpString=".zip") returned 4 [0108.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.726] lstrlenW (lpString=".rar") returned 4 [0108.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString=".bz2") returned 4 [0108.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString=".7z") returned 3 [0108.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.726] lstrlenW (lpString=".dbf") returned 4 [0108.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.726] lstrlenW (lpString=".1cd") returned 4 [0108.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.726] lstrlenW (lpString=".jpg") returned 4 [0108.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString=".pdf") returned 4 [0108.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.726] lstrlenW (lpString=".xls") returned 4 [0108.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.726] lstrlenW (lpString=".xlsx") returned 5 [0108.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.726] lstrlenW (lpString=".ppt") returned 4 [0108.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.727] lstrlenW (lpString=".zip") returned 4 [0108.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.727] lstrlenW (lpString=".rar") returned 4 [0108.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString=".bz2") returned 4 [0108.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString=".7z") returned 3 [0108.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.727] lstrlenW (lpString=".dbf") returned 4 [0108.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.727] lstrlenW (lpString=".1cd") returned 4 [0108.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 63 [0108.727] lstrlenW (lpString=".jpg") returned 4 [0108.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.727] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") [0108.728] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=31236) returned 1 [0108.728] CloseHandle (hObject=0x1fc) returned 1 [0108.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 0x20 [0108.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.729] GetLastError () returned 0x0 [0108.729] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x7a04, lpOverlapped=0x0) returned 1 [0108.786] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7a10, lpOverlapped=0x0) returned 1 [0108.806] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.806] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.806] SetEndOfFile (hFile=0x1b8) returned 1 [0108.806] CloseHandle (hObject=0x1b8) returned 1 [0108.806] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.806] SetEndOfFile (hFile=0x1fc) returned 1 [0108.807] CloseHandle (hObject=0x1fc) returned 1 [0108.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.808] lstrlenW (lpString=".doc") returned 4 [0108.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString=".docx") returned 5 [0108.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.808] lstrlenW (lpString=".pdf") returned 4 [0108.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString=".xls") returned 4 [0108.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.808] lstrlenW (lpString=".xlsx") returned 5 [0108.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.808] lstrlenW (lpString=".ppt") returned 4 [0108.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.808] lstrlenW (lpString=".zip") returned 4 [0108.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.808] lstrlenW (lpString=".rar") returned 4 [0108.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString=".bz2") returned 4 [0108.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString=".7z") returned 3 [0108.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.808] lstrlenW (lpString=".dbf") returned 4 [0108.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.808] lstrlenW (lpString=".1cd") returned 4 [0108.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.808] lstrlenW (lpString=".jpg") returned 4 [0108.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.808] lstrlenW (lpString=".pdf") returned 4 [0108.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString=".xls") returned 4 [0108.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.809] lstrlenW (lpString=".xlsx") returned 5 [0108.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.809] lstrlenW (lpString=".ppt") returned 4 [0108.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.809] lstrlenW (lpString=".zip") returned 4 [0108.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.809] lstrlenW (lpString=".rar") returned 4 [0108.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString=".bz2") returned 4 [0108.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString=".7z") returned 3 [0108.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.809] lstrlenW (lpString=".dbf") returned 4 [0108.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.809] lstrlenW (lpString=".1cd") returned 4 [0108.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 63 [0108.809] lstrlenW (lpString=".jpg") returned 4 [0108.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.809] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") [0108.810] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2940) returned 1 [0108.810] CloseHandle (hObject=0x1fc) returned 1 [0108.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf")) returned 0x20 [0108.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.811] GetLastError () returned 0x0 [0108.811] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xb7c, lpOverlapped=0x0) returned 1 [0108.813] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xb80, lpOverlapped=0x0) returned 1 [0108.814] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.814] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.814] SetEndOfFile (hFile=0x1b8) returned 1 [0108.814] CloseHandle (hObject=0x1b8) returned 1 [0108.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.814] SetEndOfFile (hFile=0x1fc) returned 1 [0108.815] CloseHandle (hObject=0x1fc) returned 1 [0108.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf")) returned 1 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString=".doc") returned 4 [0108.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString=".docx") returned 5 [0108.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.816] lstrlenW (lpString=".pdf") returned 4 [0108.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString=".xls") returned 4 [0108.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.816] lstrlenW (lpString=".xlsx") returned 5 [0108.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.816] lstrlenW (lpString=".ppt") returned 4 [0108.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString=".zip") returned 4 [0108.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.816] lstrlenW (lpString=".rar") returned 4 [0108.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString=".bz2") returned 4 [0108.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString=".7z") returned 3 [0108.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString=".dbf") returned 4 [0108.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString=".1cd") returned 4 [0108.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.816] lstrlenW (lpString=".jpg") returned 4 [0108.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString=".pdf") returned 4 [0108.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString=".xls") returned 4 [0108.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.817] lstrlenW (lpString=".xlsx") returned 5 [0108.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.817] lstrlenW (lpString=".ppt") returned 4 [0108.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.817] lstrlenW (lpString=".zip") returned 4 [0108.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.817] lstrlenW (lpString=".rar") returned 4 [0108.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString=".bz2") returned 4 [0108.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString=".7z") returned 3 [0108.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.817] lstrlenW (lpString=".dbf") returned 4 [0108.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.817] lstrlenW (lpString=".1cd") returned 4 [0108.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 63 [0108.817] lstrlenW (lpString=".jpg") returned 4 [0108.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.817] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") [0108.818] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2088) returned 1 [0108.818] CloseHandle (hObject=0x1fc) returned 1 [0108.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf")) returned 0x20 [0108.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.819] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.819] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.819] GetLastError () returned 0x0 [0108.819] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x828, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x830, lpOverlapped=0x0) returned 1 [0108.822] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.822] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.822] SetEndOfFile (hFile=0x1b8) returned 1 [0108.822] CloseHandle (hObject=0x1b8) returned 1 [0108.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.822] SetEndOfFile (hFile=0x1fc) returned 1 [0108.823] CloseHandle (hObject=0x1fc) returned 1 [0108.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf")) returned 1 [0108.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.823] lstrlenW (lpString=".doc") returned 4 [0108.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".docx") returned 5 [0108.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.824] lstrlenW (lpString=".pdf") returned 4 [0108.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".xls") returned 4 [0108.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.824] lstrlenW (lpString=".xlsx") returned 5 [0108.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.824] lstrlenW (lpString=".ppt") returned 4 [0108.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.824] lstrlenW (lpString=".zip") returned 4 [0108.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.824] lstrlenW (lpString=".rar") returned 4 [0108.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".bz2") returned 4 [0108.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".7z") returned 3 [0108.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.824] lstrlenW (lpString=".dbf") returned 4 [0108.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.824] lstrlenW (lpString=".1cd") returned 4 [0108.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.824] lstrlenW (lpString=".jpg") returned 4 [0108.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".pdf") returned 4 [0108.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.824] lstrlenW (lpString=".xls") returned 4 [0108.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.825] lstrlenW (lpString=".xlsx") returned 5 [0108.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.825] lstrlenW (lpString=".ppt") returned 4 [0108.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.825] lstrlenW (lpString=".zip") returned 4 [0108.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.825] lstrlenW (lpString=".rar") returned 4 [0108.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.825] lstrlenW (lpString=".bz2") returned 4 [0108.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.825] lstrlenW (lpString=".7z") returned 3 [0108.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.825] lstrlenW (lpString=".dbf") returned 4 [0108.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.825] lstrlenW (lpString=".1cd") returned 4 [0108.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 63 [0108.825] lstrlenW (lpString=".jpg") returned 4 [0108.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.825] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") [0108.826] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=28750) returned 1 [0108.826] CloseHandle (hObject=0x1fc) returned 1 [0108.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 0x20 [0108.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.826] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.826] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.827] GetLastError () returned 0x0 [0108.827] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x704e, lpOverlapped=0x0) returned 1 [0108.829] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x7050, lpOverlapped=0x0) returned 1 [0108.831] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.831] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.831] SetEndOfFile (hFile=0x1b8) returned 1 [0108.831] CloseHandle (hObject=0x1b8) returned 1 [0108.831] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.831] SetEndOfFile (hFile=0x1fc) returned 1 [0108.832] CloseHandle (hObject=0x1fc) returned 1 [0108.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 1 [0108.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.832] lstrlenW (lpString=".doc") returned 4 [0108.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.832] lstrlenW (lpString=".docx") returned 5 [0108.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.832] lstrlenW (lpString=".pdf") returned 4 [0108.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.832] lstrlenW (lpString=".xls") returned 4 [0108.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.832] lstrlenW (lpString=".xlsx") returned 5 [0108.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.833] lstrlenW (lpString=".ppt") returned 4 [0108.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.833] lstrlenW (lpString=".zip") returned 4 [0108.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.833] lstrlenW (lpString=".rar") returned 4 [0108.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString=".bz2") returned 4 [0108.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString=".7z") returned 3 [0108.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.833] lstrlenW (lpString=".dbf") returned 4 [0108.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.833] lstrlenW (lpString=".1cd") returned 4 [0108.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.833] lstrlenW (lpString=".jpg") returned 4 [0108.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString=".pdf") returned 4 [0108.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString=".xls") returned 4 [0108.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.833] lstrlenW (lpString=".xlsx") returned 5 [0108.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.833] lstrlenW (lpString=".ppt") returned 4 [0108.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.833] lstrlenW (lpString=".zip") returned 4 [0108.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.833] lstrlenW (lpString=".rar") returned 4 [0108.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.834] lstrlenW (lpString=".bz2") returned 4 [0108.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.834] lstrlenW (lpString=".7z") returned 3 [0108.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.834] lstrlenW (lpString=".dbf") returned 4 [0108.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.834] lstrlenW (lpString=".1cd") returned 4 [0108.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 63 [0108.834] lstrlenW (lpString=".jpg") returned 4 [0108.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.834] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") [0108.835] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5180) returned 1 [0108.835] CloseHandle (hObject=0x1fc) returned 1 [0108.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 0x20 [0108.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.835] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.835] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.836] GetLastError () returned 0x0 [0108.836] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x143c, lpOverlapped=0x0) returned 1 [0108.837] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1440, lpOverlapped=0x0) returned 1 [0108.838] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0108.838] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.838] SetEndOfFile (hFile=0x1b8) returned 1 [0108.838] CloseHandle (hObject=0x1b8) returned 1 [0108.838] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.838] SetEndOfFile (hFile=0x1fc) returned 1 [0108.839] CloseHandle (hObject=0x1fc) returned 1 [0108.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString=".doc") returned 4 [0108.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString=".docx") returned 5 [0108.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.840] lstrlenW (lpString=".pdf") returned 4 [0108.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString=".xls") returned 4 [0108.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.840] lstrlenW (lpString=".xlsx") returned 5 [0108.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.840] lstrlenW (lpString=".ppt") returned 4 [0108.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString=".zip") returned 4 [0108.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.840] lstrlenW (lpString=".rar") returned 4 [0108.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString=".bz2") returned 4 [0108.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString=".7z") returned 3 [0108.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString=".dbf") returned 4 [0108.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString=".1cd") returned 4 [0108.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.840] lstrlenW (lpString=".jpg") returned 4 [0108.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString=".pdf") returned 4 [0108.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString=".xls") returned 4 [0108.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.841] lstrlenW (lpString=".xlsx") returned 5 [0108.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.841] lstrlenW (lpString=".ppt") returned 4 [0108.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.841] lstrlenW (lpString=".zip") returned 4 [0108.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.841] lstrlenW (lpString=".rar") returned 4 [0108.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString=".bz2") returned 4 [0108.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString=".7z") returned 3 [0108.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.841] lstrlenW (lpString=".dbf") returned 4 [0108.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.841] lstrlenW (lpString=".1cd") returned 4 [0108.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 63 [0108.841] lstrlenW (lpString=".jpg") returned 4 [0108.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.841] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") [0108.842] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5444) returned 1 [0108.842] CloseHandle (hObject=0x1fc) returned 1 [0108.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf")) returned 0x20 [0108.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0108.842] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.842] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0108.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.843] GetLastError () returned 0x0 [0108.843] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1544, lpOverlapped=0x0) returned 1 [0109.014] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1550, lpOverlapped=0x0) returned 1 [0109.015] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.015] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.015] SetEndOfFile (hFile=0x1b8) returned 1 [0109.115] CloseHandle (hObject=0x1b8) returned 1 [0109.116] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.116] SetEndOfFile (hFile=0x1fc) returned 1 [0109.207] CloseHandle (hObject=0x1fc) returned 1 [0109.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf")) returned 1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString=".doc") returned 4 [0109.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString=".docx") returned 5 [0109.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.208] lstrlenW (lpString=".pdf") returned 4 [0109.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString=".xls") returned 4 [0109.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.208] lstrlenW (lpString=".xlsx") returned 5 [0109.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.208] lstrlenW (lpString=".ppt") returned 4 [0109.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString=".zip") returned 4 [0109.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.208] lstrlenW (lpString=".rar") returned 4 [0109.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString=".bz2") returned 4 [0109.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString=".7z") returned 3 [0109.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString=".dbf") returned 4 [0109.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString=".1cd") returned 4 [0109.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.208] lstrlenW (lpString=".jpg") returned 4 [0109.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString=".pdf") returned 4 [0109.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString=".xls") returned 4 [0109.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.209] lstrlenW (lpString=".xlsx") returned 5 [0109.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.209] lstrlenW (lpString=".ppt") returned 4 [0109.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.209] lstrlenW (lpString=".zip") returned 4 [0109.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.209] lstrlenW (lpString=".rar") returned 4 [0109.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString=".bz2") returned 4 [0109.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString=".7z") returned 3 [0109.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.209] lstrlenW (lpString=".dbf") returned 4 [0109.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.209] lstrlenW (lpString=".1cd") returned 4 [0109.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 63 [0109.209] lstrlenW (lpString=".jpg") returned 4 [0109.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.209] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") [0109.210] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23304) returned 1 [0109.211] CloseHandle (hObject=0x1fc) returned 1 [0109.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf")) returned 0x20 [0109.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.211] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.211] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.212] GetLastError () returned 0x0 [0109.212] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5b08, lpOverlapped=0x0) returned 1 [0109.214] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0109.215] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.215] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.215] SetEndOfFile (hFile=0x158) returned 1 [0109.215] CloseHandle (hObject=0x158) returned 1 [0109.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.215] SetEndOfFile (hFile=0x1fc) returned 1 [0109.216] CloseHandle (hObject=0x1fc) returned 1 [0109.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf")) returned 1 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString=".doc") returned 4 [0109.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString=".docx") returned 5 [0109.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.217] lstrlenW (lpString=".pdf") returned 4 [0109.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString=".xls") returned 4 [0109.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.217] lstrlenW (lpString=".xlsx") returned 5 [0109.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.217] lstrlenW (lpString=".ppt") returned 4 [0109.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString=".zip") returned 4 [0109.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.217] lstrlenW (lpString=".rar") returned 4 [0109.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString=".bz2") returned 4 [0109.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString=".7z") returned 3 [0109.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString=".dbf") returned 4 [0109.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString=".1cd") returned 4 [0109.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.217] lstrlenW (lpString=".jpg") returned 4 [0109.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString=".pdf") returned 4 [0109.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString=".xls") returned 4 [0109.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.218] lstrlenW (lpString=".xlsx") returned 5 [0109.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.218] lstrlenW (lpString=".ppt") returned 4 [0109.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.218] lstrlenW (lpString=".zip") returned 4 [0109.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.218] lstrlenW (lpString=".rar") returned 4 [0109.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString=".bz2") returned 4 [0109.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString=".7z") returned 3 [0109.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.218] lstrlenW (lpString=".dbf") returned 4 [0109.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.218] lstrlenW (lpString=".1cd") returned 4 [0109.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 63 [0109.218] lstrlenW (lpString=".jpg") returned 4 [0109.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.218] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") [0109.219] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=11192) returned 1 [0109.219] CloseHandle (hObject=0x1fc) returned 1 [0109.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf")) returned 0x20 [0109.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.221] GetLastError () returned 0x0 [0109.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2bb8, lpOverlapped=0x0) returned 1 [0109.223] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0109.224] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.224] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.224] SetEndOfFile (hFile=0x158) returned 1 [0109.224] CloseHandle (hObject=0x158) returned 1 [0109.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.224] SetEndOfFile (hFile=0x1fc) returned 1 [0109.225] CloseHandle (hObject=0x1fc) returned 1 [0109.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf")) returned 1 [0109.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.225] lstrlenW (lpString=".doc") returned 4 [0109.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.225] lstrlenW (lpString=".docx") returned 5 [0109.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.225] lstrlenW (lpString=".pdf") returned 4 [0109.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.225] lstrlenW (lpString=".xls") returned 4 [0109.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.225] lstrlenW (lpString=".xlsx") returned 5 [0109.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.225] lstrlenW (lpString=".ppt") returned 4 [0109.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.226] lstrlenW (lpString=".zip") returned 4 [0109.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.226] lstrlenW (lpString=".rar") returned 4 [0109.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString=".bz2") returned 4 [0109.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString=".7z") returned 3 [0109.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.226] lstrlenW (lpString=".dbf") returned 4 [0109.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.226] lstrlenW (lpString=".1cd") returned 4 [0109.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.226] lstrlenW (lpString=".jpg") returned 4 [0109.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString=".pdf") returned 4 [0109.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.226] lstrlenW (lpString=".xls") returned 4 [0109.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.226] lstrlenW (lpString=".xlsx") returned 5 [0109.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.227] lstrlenW (lpString=".ppt") returned 4 [0109.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.227] lstrlenW (lpString=".zip") returned 4 [0109.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.227] lstrlenW (lpString=".rar") returned 4 [0109.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.227] lstrlenW (lpString=".bz2") returned 4 [0109.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.227] lstrlenW (lpString=".7z") returned 3 [0109.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.227] lstrlenW (lpString=".dbf") returned 4 [0109.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.227] lstrlenW (lpString=".1cd") returned 4 [0109.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 63 [0109.227] lstrlenW (lpString=".jpg") returned 4 [0109.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.227] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") [0109.228] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7768) returned 1 [0109.228] CloseHandle (hObject=0x1fc) returned 1 [0109.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf")) returned 0x20 [0109.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.229] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.229] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.230] GetLastError () returned 0x0 [0109.230] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1e58, lpOverlapped=0x0) returned 1 [0109.272] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0109.273] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.273] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.273] SetEndOfFile (hFile=0x158) returned 1 [0109.273] CloseHandle (hObject=0x158) returned 1 [0109.273] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.273] SetEndOfFile (hFile=0x1fc) returned 1 [0109.274] CloseHandle (hObject=0x1fc) returned 1 [0109.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf")) returned 1 [0109.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.275] lstrlenW (lpString=".doc") returned 4 [0109.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString=".docx") returned 5 [0109.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.275] lstrlenW (lpString=".pdf") returned 4 [0109.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString=".xls") returned 4 [0109.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.275] lstrlenW (lpString=".xlsx") returned 5 [0109.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.275] lstrlenW (lpString=".ppt") returned 4 [0109.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.275] lstrlenW (lpString=".zip") returned 4 [0109.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.275] lstrlenW (lpString=".rar") returned 4 [0109.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString=".bz2") returned 4 [0109.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString=".7z") returned 3 [0109.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.275] lstrlenW (lpString=".dbf") returned 4 [0109.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.275] lstrlenW (lpString=".1cd") returned 4 [0109.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.275] lstrlenW (lpString=".jpg") returned 4 [0109.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.275] lstrlenW (lpString=".pdf") returned 4 [0109.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString=".xls") returned 4 [0109.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.276] lstrlenW (lpString=".xlsx") returned 5 [0109.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.276] lstrlenW (lpString=".ppt") returned 4 [0109.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.276] lstrlenW (lpString=".zip") returned 4 [0109.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.276] lstrlenW (lpString=".rar") returned 4 [0109.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString=".bz2") returned 4 [0109.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString=".7z") returned 3 [0109.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.276] lstrlenW (lpString=".dbf") returned 4 [0109.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.276] lstrlenW (lpString=".1cd") returned 4 [0109.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 63 [0109.276] lstrlenW (lpString=".jpg") returned 4 [0109.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.276] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") [0109.277] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4070) returned 1 [0109.277] CloseHandle (hObject=0x1fc) returned 1 [0109.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf")) returned 0x20 [0109.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.277] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.277] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.278] GetLastError () returned 0x0 [0109.278] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xfe6, lpOverlapped=0x0) returned 1 [0109.279] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xff0, lpOverlapped=0x0) returned 1 [0109.280] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.280] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.280] SetEndOfFile (hFile=0x158) returned 1 [0109.281] CloseHandle (hObject=0x158) returned 1 [0109.281] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.281] SetEndOfFile (hFile=0x1fc) returned 1 [0109.281] CloseHandle (hObject=0x1fc) returned 1 [0109.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf")) returned 1 [0109.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.282] lstrlenW (lpString=".doc") returned 4 [0109.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.282] lstrlenW (lpString=".docx") returned 5 [0109.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.282] lstrlenW (lpString=".pdf") returned 4 [0109.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.282] lstrlenW (lpString=".xls") returned 4 [0109.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.282] lstrlenW (lpString=".xlsx") returned 5 [0109.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.282] lstrlenW (lpString=".ppt") returned 4 [0109.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.282] lstrlenW (lpString=".zip") returned 4 [0109.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.282] lstrlenW (lpString=".rar") returned 4 [0109.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.282] lstrlenW (lpString=".bz2") returned 4 [0109.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.282] lstrlenW (lpString=".7z") returned 3 [0109.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.283] lstrlenW (lpString=".dbf") returned 4 [0109.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.283] lstrlenW (lpString=".1cd") returned 4 [0109.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.283] lstrlenW (lpString=".jpg") returned 4 [0109.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString=".pdf") returned 4 [0109.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString=".xls") returned 4 [0109.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.283] lstrlenW (lpString=".xlsx") returned 5 [0109.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.283] lstrlenW (lpString=".ppt") returned 4 [0109.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.283] lstrlenW (lpString=".zip") returned 4 [0109.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.283] lstrlenW (lpString=".rar") returned 4 [0109.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString=".bz2") returned 4 [0109.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.283] lstrlenW (lpString=".7z") returned 3 [0109.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.284] lstrlenW (lpString=".dbf") returned 4 [0109.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.284] lstrlenW (lpString=".1cd") returned 4 [0109.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 63 [0109.284] lstrlenW (lpString=".jpg") returned 4 [0109.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.284] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") [0109.284] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=20486) returned 1 [0109.284] CloseHandle (hObject=0x1fc) returned 1 [0109.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf")) returned 0x20 [0109.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.285] GetLastError () returned 0x0 [0109.285] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5006, lpOverlapped=0x0) returned 1 [0109.297] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5010, lpOverlapped=0x0) returned 1 [0109.298] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.298] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.298] SetEndOfFile (hFile=0x158) returned 1 [0109.298] CloseHandle (hObject=0x158) returned 1 [0109.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.298] SetEndOfFile (hFile=0x1fc) returned 1 [0109.299] CloseHandle (hObject=0x1fc) returned 1 [0109.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf")) returned 1 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString=".doc") returned 4 [0109.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString=".docx") returned 5 [0109.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.300] lstrlenW (lpString=".pdf") returned 4 [0109.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString=".xls") returned 4 [0109.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.300] lstrlenW (lpString=".xlsx") returned 5 [0109.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.300] lstrlenW (lpString=".ppt") returned 4 [0109.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString=".zip") returned 4 [0109.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.300] lstrlenW (lpString=".rar") returned 4 [0109.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString=".bz2") returned 4 [0109.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString=".7z") returned 3 [0109.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString=".dbf") returned 4 [0109.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString=".1cd") returned 4 [0109.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.300] lstrlenW (lpString=".jpg") returned 4 [0109.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString=".pdf") returned 4 [0109.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString=".xls") returned 4 [0109.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.301] lstrlenW (lpString=".xlsx") returned 5 [0109.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.301] lstrlenW (lpString=".ppt") returned 4 [0109.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.301] lstrlenW (lpString=".zip") returned 4 [0109.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.301] lstrlenW (lpString=".rar") returned 4 [0109.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString=".bz2") returned 4 [0109.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString=".7z") returned 3 [0109.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.301] lstrlenW (lpString=".dbf") returned 4 [0109.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.301] lstrlenW (lpString=".1cd") returned 4 [0109.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 63 [0109.301] lstrlenW (lpString=".jpg") returned 4 [0109.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.301] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") [0109.303] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6842) returned 1 [0109.303] CloseHandle (hObject=0x1fc) returned 1 [0109.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf")) returned 0x20 [0109.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.304] GetLastError () returned 0x0 [0109.304] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1aba, lpOverlapped=0x0) returned 1 [0109.348] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1ac0, lpOverlapped=0x0) returned 1 [0109.349] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.349] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.349] SetEndOfFile (hFile=0x158) returned 1 [0109.363] CloseHandle (hObject=0x158) returned 1 [0109.363] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.363] SetEndOfFile (hFile=0x1fc) returned 1 [0109.364] CloseHandle (hObject=0x1fc) returned 1 [0109.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf")) returned 1 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.585] lstrlenW (lpString=".doc") returned 4 [0109.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.585] lstrlenW (lpString=".docx") returned 5 [0109.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.585] lstrlenW (lpString=".pdf") returned 4 [0109.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.585] lstrlenW (lpString=".xls") returned 4 [0109.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.586] lstrlenW (lpString=".xlsx") returned 5 [0109.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.586] lstrlenW (lpString=".ppt") returned 4 [0109.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.586] lstrlenW (lpString=".zip") returned 4 [0109.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.586] lstrlenW (lpString=".rar") returned 4 [0109.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString=".bz2") returned 4 [0109.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString=".7z") returned 3 [0109.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.586] lstrlenW (lpString=".dbf") returned 4 [0109.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.586] lstrlenW (lpString=".1cd") returned 4 [0109.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.586] lstrlenW (lpString=".jpg") returned 4 [0109.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString=".pdf") returned 4 [0109.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString=".xls") returned 4 [0109.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.586] lstrlenW (lpString=".xlsx") returned 5 [0109.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.586] lstrlenW (lpString=".ppt") returned 4 [0109.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.587] lstrlenW (lpString=".zip") returned 4 [0109.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.587] lstrlenW (lpString=".rar") returned 4 [0109.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.587] lstrlenW (lpString=".bz2") returned 4 [0109.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.587] lstrlenW (lpString=".7z") returned 3 [0109.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.587] lstrlenW (lpString=".dbf") returned 4 [0109.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.587] lstrlenW (lpString=".1cd") returned 4 [0109.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 63 [0109.587] lstrlenW (lpString=".jpg") returned 4 [0109.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.587] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") [0109.946] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6220) returned 1 [0109.946] CloseHandle (hObject=0x1f4) returned 1 [0109.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf")) returned 0x20 [0109.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.946] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.946] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0109.947] GetLastError () returned 0x0 [0109.947] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x184c, lpOverlapped=0x0) returned 1 [0109.949] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1850, lpOverlapped=0x0) returned 1 [0109.950] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.950] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.950] SetEndOfFile (hFile=0x19c) returned 1 [0109.950] CloseHandle (hObject=0x19c) returned 1 [0109.950] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.950] SetEndOfFile (hFile=0x1f4) returned 1 [0109.951] CloseHandle (hObject=0x1f4) returned 1 [0109.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf")) returned 1 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.952] lstrlenW (lpString=".doc") returned 4 [0109.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString=".docx") returned 5 [0109.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.952] lstrlenW (lpString=".pdf") returned 4 [0109.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString=".xls") returned 4 [0109.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.952] lstrlenW (lpString=".xlsx") returned 5 [0109.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.952] lstrlenW (lpString=".ppt") returned 4 [0109.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.952] lstrlenW (lpString=".zip") returned 4 [0109.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.952] lstrlenW (lpString=".rar") returned 4 [0109.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString=".bz2") returned 4 [0109.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString=".7z") returned 3 [0109.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.952] lstrlenW (lpString=".dbf") returned 4 [0109.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.952] lstrlenW (lpString=".1cd") returned 4 [0109.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.953] lstrlenW (lpString=".jpg") returned 4 [0109.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString=".pdf") returned 4 [0109.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString=".xls") returned 4 [0109.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.953] lstrlenW (lpString=".xlsx") returned 5 [0109.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.953] lstrlenW (lpString=".ppt") returned 4 [0109.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.953] lstrlenW (lpString=".zip") returned 4 [0109.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.953] lstrlenW (lpString=".rar") returned 4 [0109.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString=".bz2") returned 4 [0109.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString=".7z") returned 3 [0109.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.953] lstrlenW (lpString=".dbf") returned 4 [0109.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.953] lstrlenW (lpString=".1cd") returned 4 [0109.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 63 [0109.953] lstrlenW (lpString=".jpg") returned 4 [0109.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.953] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") [0109.954] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=16834) returned 1 [0109.954] CloseHandle (hObject=0x1f4) returned 1 [0109.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf")) returned 0x20 [0109.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0109.954] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.954] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0109.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0109.955] GetLastError () returned 0x0 [0109.955] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x41c2, lpOverlapped=0x0) returned 1 [0109.957] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x41d0, lpOverlapped=0x0) returned 1 [0109.967] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0109.967] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.967] SetEndOfFile (hFile=0x19c) returned 1 [0110.338] CloseHandle (hObject=0x19c) returned 1 [0110.338] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.362] SetEndOfFile (hFile=0x1f4) returned 1 [0110.363] CloseHandle (hObject=0x1f4) returned 1 [0110.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf")) returned 1 [0110.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.363] lstrlenW (lpString=".doc") returned 4 [0110.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.363] lstrlenW (lpString=".docx") returned 5 [0110.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.363] lstrlenW (lpString=".pdf") returned 4 [0110.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.363] lstrlenW (lpString=".xls") returned 4 [0110.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.363] lstrlenW (lpString=".xlsx") returned 5 [0110.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.363] lstrlenW (lpString=".ppt") returned 4 [0110.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.364] lstrlenW (lpString=".zip") returned 4 [0110.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.364] lstrlenW (lpString=".rar") returned 4 [0110.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.364] lstrlenW (lpString=".bz2") returned 4 [0110.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.364] lstrlenW (lpString=".7z") returned 3 [0110.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.364] lstrlenW (lpString=".dbf") returned 4 [0110.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.364] lstrlenW (lpString=".1cd") returned 4 [0110.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.415] lstrlenW (lpString=".jpg") returned 4 [0110.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString=".pdf") returned 4 [0110.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString=".xls") returned 4 [0110.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.415] lstrlenW (lpString=".xlsx") returned 5 [0110.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.415] lstrlenW (lpString=".ppt") returned 4 [0110.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.415] lstrlenW (lpString=".zip") returned 4 [0110.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.415] lstrlenW (lpString=".rar") returned 4 [0110.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString=".bz2") returned 4 [0110.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString=".7z") returned 3 [0110.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.415] lstrlenW (lpString=".dbf") returned 4 [0110.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.415] lstrlenW (lpString=".1cd") returned 4 [0110.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 63 [0110.415] lstrlenW (lpString=".jpg") returned 4 [0110.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.416] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") [0110.416] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4720) returned 1 [0110.417] CloseHandle (hObject=0x1c0) returned 1 [0110.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf")) returned 0x20 [0110.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.418] GetLastError () returned 0x0 [0110.418] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1270, lpOverlapped=0x0) returned 1 [0110.420] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1280, lpOverlapped=0x0) returned 1 [0110.420] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.421] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.421] SetEndOfFile (hFile=0x1b8) returned 1 [0110.421] CloseHandle (hObject=0x1b8) returned 1 [0110.421] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.421] SetEndOfFile (hFile=0x1c0) returned 1 [0110.422] CloseHandle (hObject=0x1c0) returned 1 [0110.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf")) returned 1 [0110.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.422] lstrlenW (lpString=".doc") returned 4 [0110.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.422] lstrlenW (lpString=".docx") returned 5 [0110.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.422] lstrlenW (lpString=".pdf") returned 4 [0110.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.422] lstrlenW (lpString=".xls") returned 4 [0110.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.422] lstrlenW (lpString=".xlsx") returned 5 [0110.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.422] lstrlenW (lpString=".ppt") returned 4 [0110.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.423] lstrlenW (lpString=".zip") returned 4 [0110.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.423] lstrlenW (lpString=".rar") returned 4 [0110.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString=".bz2") returned 4 [0110.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString=".7z") returned 3 [0110.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.423] lstrlenW (lpString=".dbf") returned 4 [0110.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.423] lstrlenW (lpString=".1cd") returned 4 [0110.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.423] lstrlenW (lpString=".jpg") returned 4 [0110.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString=".pdf") returned 4 [0110.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString=".xls") returned 4 [0110.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.423] lstrlenW (lpString=".xlsx") returned 5 [0110.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.423] lstrlenW (lpString=".ppt") returned 4 [0110.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.423] lstrlenW (lpString=".zip") returned 4 [0110.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.423] lstrlenW (lpString=".rar") returned 4 [0110.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.424] lstrlenW (lpString=".bz2") returned 4 [0110.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.424] lstrlenW (lpString=".7z") returned 3 [0110.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.424] lstrlenW (lpString=".dbf") returned 4 [0110.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.424] lstrlenW (lpString=".1cd") returned 4 [0110.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 63 [0110.424] lstrlenW (lpString=".jpg") returned 4 [0110.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.424] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") [0110.425] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9644) returned 1 [0110.425] CloseHandle (hObject=0x1c0) returned 1 [0110.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf")) returned 0x20 [0110.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.425] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.425] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.426] GetLastError () returned 0x0 [0110.426] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x25ac, lpOverlapped=0x0) returned 1 [0110.427] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x25b0, lpOverlapped=0x0) returned 1 [0110.428] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.428] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.429] SetEndOfFile (hFile=0x1b8) returned 1 [0110.429] CloseHandle (hObject=0x1b8) returned 1 [0110.429] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.429] SetEndOfFile (hFile=0x1c0) returned 1 [0110.430] CloseHandle (hObject=0x1c0) returned 1 [0110.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf")) returned 1 [0110.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.430] lstrlenW (lpString=".doc") returned 4 [0110.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.430] lstrlenW (lpString=".docx") returned 5 [0110.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.430] lstrlenW (lpString=".pdf") returned 4 [0110.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.430] lstrlenW (lpString=".xls") returned 4 [0110.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.430] lstrlenW (lpString=".xlsx") returned 5 [0110.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.430] lstrlenW (lpString=".ppt") returned 4 [0110.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.430] lstrlenW (lpString=".zip") returned 4 [0110.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.431] lstrlenW (lpString=".rar") returned 4 [0110.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".bz2") returned 4 [0110.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".7z") returned 3 [0110.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.431] lstrlenW (lpString=".dbf") returned 4 [0110.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.431] lstrlenW (lpString=".1cd") returned 4 [0110.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.431] lstrlenW (lpString=".jpg") returned 4 [0110.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".pdf") returned 4 [0110.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".xls") returned 4 [0110.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.431] lstrlenW (lpString=".xlsx") returned 5 [0110.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.431] lstrlenW (lpString=".ppt") returned 4 [0110.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.431] lstrlenW (lpString=".zip") returned 4 [0110.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.431] lstrlenW (lpString=".rar") returned 4 [0110.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".bz2") returned 4 [0110.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.431] lstrlenW (lpString=".7z") returned 3 [0110.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.432] lstrlenW (lpString=".dbf") returned 4 [0110.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.432] lstrlenW (lpString=".1cd") returned 4 [0110.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 63 [0110.432] lstrlenW (lpString=".jpg") returned 4 [0110.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.432] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") [0110.823] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8028) returned 1 [0110.841] CloseHandle (hObject=0x180) returned 1 [0110.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf")) returned 0x20 [0110.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.841] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.841] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.953] GetLastError () returned 0x0 [0110.953] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f5c, lpOverlapped=0x0) returned 1 [0110.955] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f60, lpOverlapped=0x0) returned 1 [0110.956] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.956] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.956] SetEndOfFile (hFile=0x1c8) returned 1 [0110.956] CloseHandle (hObject=0x1c8) returned 1 [0110.956] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.956] SetEndOfFile (hFile=0x180) returned 1 [0110.957] CloseHandle (hObject=0x180) returned 1 [0110.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf")) returned 1 [0110.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.958] lstrlenW (lpString=".doc") returned 4 [0110.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.958] lstrlenW (lpString=".docx") returned 5 [0110.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.958] lstrlenW (lpString=".pdf") returned 4 [0110.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.958] lstrlenW (lpString=".xls") returned 4 [0110.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.958] lstrlenW (lpString=".xlsx") returned 5 [0110.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.958] lstrlenW (lpString=".ppt") returned 4 [0110.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.958] lstrlenW (lpString=".zip") returned 4 [0110.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.958] lstrlenW (lpString=".rar") returned 4 [0110.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.958] lstrlenW (lpString=".bz2") returned 4 [0110.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.958] lstrlenW (lpString=".7z") returned 3 [0110.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".dbf") returned 4 [0110.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".1cd") returned 4 [0110.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".jpg") returned 4 [0110.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString=".pdf") returned 4 [0110.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString=".xls") returned 4 [0110.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.959] lstrlenW (lpString=".xlsx") returned 5 [0110.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.959] lstrlenW (lpString=".ppt") returned 4 [0110.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".zip") returned 4 [0110.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.959] lstrlenW (lpString=".rar") returned 4 [0110.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString=".bz2") returned 4 [0110.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString=".7z") returned 3 [0110.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".dbf") returned 4 [0110.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".1cd") returned 4 [0110.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 63 [0110.959] lstrlenW (lpString=".jpg") returned 4 [0110.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.960] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") [0110.962] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43174) returned 1 [0110.962] CloseHandle (hObject=0x180) returned 1 [0110.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf")) returned 0x20 [0110.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.962] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.962] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.963] GetLastError () returned 0x0 [0110.963] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xa8a6, lpOverlapped=0x0) returned 1 [0110.967] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa8b0, lpOverlapped=0x0) returned 1 [0110.969] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.969] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.969] SetEndOfFile (hFile=0x1c8) returned 1 [0110.969] CloseHandle (hObject=0x1c8) returned 1 [0110.969] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.969] SetEndOfFile (hFile=0x180) returned 1 [0110.970] CloseHandle (hObject=0x180) returned 1 [0110.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf")) returned 1 [0110.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.971] lstrlenW (lpString=".doc") returned 4 [0110.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.971] lstrlenW (lpString=".docx") returned 5 [0110.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.971] lstrlenW (lpString=".pdf") returned 4 [0110.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.971] lstrlenW (lpString=".xls") returned 4 [0110.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.971] lstrlenW (lpString=".xlsx") returned 5 [0110.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.971] lstrlenW (lpString=".ppt") returned 4 [0110.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.971] lstrlenW (lpString=".zip") returned 4 [0110.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.971] lstrlenW (lpString=".rar") returned 4 [0110.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.971] lstrlenW (lpString=".bz2") returned 4 [0110.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.971] lstrlenW (lpString=".7z") returned 3 [0110.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.971] lstrlenW (lpString=".dbf") returned 4 [0110.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.972] lstrlenW (lpString=".1cd") returned 4 [0110.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.972] lstrlenW (lpString=".jpg") returned 4 [0110.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString=".pdf") returned 4 [0110.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString=".xls") returned 4 [0110.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.972] lstrlenW (lpString=".xlsx") returned 5 [0110.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.972] lstrlenW (lpString=".ppt") returned 4 [0110.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.972] lstrlenW (lpString=".zip") returned 4 [0110.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.972] lstrlenW (lpString=".rar") returned 4 [0110.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString=".bz2") returned 4 [0110.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.972] lstrlenW (lpString=".7z") returned 3 [0110.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.973] lstrlenW (lpString=".dbf") returned 4 [0110.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.973] lstrlenW (lpString=".1cd") returned 4 [0110.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 63 [0110.973] lstrlenW (lpString=".jpg") returned 4 [0110.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.973] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") [0110.974] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=9574) returned 1 [0110.974] CloseHandle (hObject=0x180) returned 1 [0110.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf")) returned 0x20 [0110.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.974] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.974] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.975] GetLastError () returned 0x0 [0110.975] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2566, lpOverlapped=0x0) returned 1 [0110.976] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2570, lpOverlapped=0x0) returned 1 [0110.978] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.978] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.978] SetEndOfFile (hFile=0x1c8) returned 1 [0110.978] CloseHandle (hObject=0x1c8) returned 1 [0110.978] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.978] SetEndOfFile (hFile=0x180) returned 1 [0110.979] CloseHandle (hObject=0x180) returned 1 [0110.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf")) returned 1 [0110.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.979] lstrlenW (lpString=".doc") returned 4 [0110.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.979] lstrlenW (lpString=".docx") returned 5 [0110.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.979] lstrlenW (lpString=".pdf") returned 4 [0110.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.979] lstrlenW (lpString=".xls") returned 4 [0110.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.980] lstrlenW (lpString=".xlsx") returned 5 [0110.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.980] lstrlenW (lpString=".ppt") returned 4 [0110.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.980] lstrlenW (lpString=".zip") returned 4 [0110.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.980] lstrlenW (lpString=".rar") returned 4 [0110.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString=".bz2") returned 4 [0110.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString=".7z") returned 3 [0110.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.980] lstrlenW (lpString=".dbf") returned 4 [0110.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.980] lstrlenW (lpString=".1cd") returned 4 [0110.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.980] lstrlenW (lpString=".jpg") returned 4 [0110.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.980] lstrlenW (lpString=".pdf") returned 4 [0110.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString=".xls") returned 4 [0110.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.981] lstrlenW (lpString=".xlsx") returned 5 [0110.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.981] lstrlenW (lpString=".ppt") returned 4 [0110.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.981] lstrlenW (lpString=".zip") returned 4 [0110.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.981] lstrlenW (lpString=".rar") returned 4 [0110.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString=".bz2") returned 4 [0110.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString=".7z") returned 3 [0110.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.981] lstrlenW (lpString=".dbf") returned 4 [0110.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.981] lstrlenW (lpString=".1cd") returned 4 [0110.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 63 [0110.981] lstrlenW (lpString=".jpg") returned 4 [0110.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.981] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") [0110.982] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27816) returned 1 [0110.982] CloseHandle (hObject=0x180) returned 1 [0110.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf")) returned 0x20 [0110.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.983] GetLastError () returned 0x0 [0110.983] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x6ca8, lpOverlapped=0x0) returned 1 [0110.985] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6cb0, lpOverlapped=0x0) returned 1 [0110.986] ReadFile (in: hFile=0x180, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0110.986] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.986] SetEndOfFile (hFile=0x1c8) returned 1 [0110.986] CloseHandle (hObject=0x1c8) returned 1 [0110.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0110.986] SetEndOfFile (hFile=0x180) returned 1 [0110.987] CloseHandle (hObject=0x180) returned 1 [0110.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf")) returned 1 [0110.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.988] lstrlenW (lpString=".doc") returned 4 [0110.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.988] lstrlenW (lpString=".docx") returned 5 [0110.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.988] lstrlenW (lpString=".pdf") returned 4 [0110.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.988] lstrlenW (lpString=".xls") returned 4 [0110.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.988] lstrlenW (lpString=".xlsx") returned 5 [0110.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.988] lstrlenW (lpString=".ppt") returned 4 [0110.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.988] lstrlenW (lpString=".zip") returned 4 [0110.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.989] lstrlenW (lpString=".rar") returned 4 [0110.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString=".bz2") returned 4 [0110.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString=".7z") returned 3 [0110.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.989] lstrlenW (lpString=".dbf") returned 4 [0110.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.989] lstrlenW (lpString=".1cd") returned 4 [0110.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0110.989] lstrlenW (lpString=".jpg") returned 4 [0110.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.098] lstrlenW (lpString=".pdf") returned 4 [0111.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.098] lstrlenW (lpString=".xls") returned 4 [0111.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.098] lstrlenW (lpString=".xlsx") returned 5 [0111.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.099] lstrlenW (lpString=".ppt") returned 4 [0111.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0111.099] lstrlenW (lpString=".zip") returned 4 [0111.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.099] lstrlenW (lpString=".rar") returned 4 [0111.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".bz2") returned 4 [0111.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".7z") returned 3 [0111.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0111.099] lstrlenW (lpString=".dbf") returned 4 [0111.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0111.099] lstrlenW (lpString=".1cd") returned 4 [0111.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 63 [0111.099] lstrlenW (lpString=".jpg") returned 4 [0111.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.099] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") [0111.100] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=14378) returned 1 [0111.100] CloseHandle (hObject=0x22c) returned 1 [0111.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf")) returned 0x20 [0111.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.100] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.100] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.101] GetLastError () returned 0x0 [0111.101] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x382a, lpOverlapped=0x0) returned 1 [0111.103] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3830, lpOverlapped=0x0) returned 1 [0111.104] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0111.104] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.104] SetEndOfFile (hFile=0x19c) returned 1 [0111.104] CloseHandle (hObject=0x19c) returned 1 [0111.104] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.104] SetEndOfFile (hFile=0x22c) returned 1 [0111.105] CloseHandle (hObject=0x22c) returned 1 [0111.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf")) returned 1 [0111.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.105] lstrlenW (lpString=".doc") returned 4 [0111.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.105] lstrlenW (lpString=".docx") returned 5 [0111.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.105] lstrlenW (lpString=".pdf") returned 4 [0111.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.105] lstrlenW (lpString=".xls") returned 4 [0111.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.105] lstrlenW (lpString=".xlsx") returned 5 [0111.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.106] lstrlenW (lpString=".ppt") returned 4 [0111.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.106] lstrlenW (lpString=".zip") returned 4 [0111.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.106] lstrlenW (lpString=".rar") returned 4 [0111.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString=".bz2") returned 4 [0111.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString=".7z") returned 3 [0111.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.106] lstrlenW (lpString=".dbf") returned 4 [0111.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.106] lstrlenW (lpString=".1cd") returned 4 [0111.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.106] lstrlenW (lpString=".jpg") returned 4 [0111.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString=".pdf") returned 4 [0111.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString=".xls") returned 4 [0111.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.106] lstrlenW (lpString=".xlsx") returned 5 [0111.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.106] lstrlenW (lpString=".ppt") returned 4 [0111.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.106] lstrlenW (lpString=".zip") returned 4 [0111.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.107] lstrlenW (lpString=".rar") returned 4 [0111.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.107] lstrlenW (lpString=".bz2") returned 4 [0111.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.107] lstrlenW (lpString=".7z") returned 3 [0111.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.107] lstrlenW (lpString=".dbf") returned 4 [0111.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.107] lstrlenW (lpString=".1cd") returned 4 [0111.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 63 [0111.107] lstrlenW (lpString=".jpg") returned 4 [0111.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.107] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") [0111.108] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6986) returned 1 [0111.108] CloseHandle (hObject=0x22c) returned 1 [0111.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf")) returned 0x20 [0111.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.108] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.108] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.109] GetLastError () returned 0x0 [0111.109] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1b4a, lpOverlapped=0x0) returned 1 [0111.110] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0111.111] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0111.111] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.111] SetEndOfFile (hFile=0x19c) returned 1 [0111.112] CloseHandle (hObject=0x19c) returned 1 [0111.112] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.112] SetEndOfFile (hFile=0x22c) returned 1 [0111.112] CloseHandle (hObject=0x22c) returned 1 [0111.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf")) returned 1 [0111.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.113] lstrlenW (lpString=".doc") returned 4 [0111.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.113] lstrlenW (lpString=".docx") returned 5 [0111.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.113] lstrlenW (lpString=".pdf") returned 4 [0111.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.113] lstrlenW (lpString=".xls") returned 4 [0111.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.113] lstrlenW (lpString=".xlsx") returned 5 [0111.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.113] lstrlenW (lpString=".ppt") returned 4 [0111.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.113] lstrlenW (lpString=".zip") returned 4 [0111.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.113] lstrlenW (lpString=".rar") returned 4 [0111.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.113] lstrlenW (lpString=".bz2") returned 4 [0111.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.113] lstrlenW (lpString=".7z") returned 3 [0111.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.114] lstrlenW (lpString=".dbf") returned 4 [0111.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.114] lstrlenW (lpString=".1cd") returned 4 [0111.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.114] lstrlenW (lpString=".jpg") returned 4 [0111.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString=".pdf") returned 4 [0111.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString=".xls") returned 4 [0111.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.114] lstrlenW (lpString=".xlsx") returned 5 [0111.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.114] lstrlenW (lpString=".ppt") returned 4 [0111.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.114] lstrlenW (lpString=".zip") returned 4 [0111.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.114] lstrlenW (lpString=".rar") returned 4 [0111.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString=".bz2") returned 4 [0111.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.114] lstrlenW (lpString=".7z") returned 3 [0111.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.115] lstrlenW (lpString=".dbf") returned 4 [0111.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.115] lstrlenW (lpString=".1cd") returned 4 [0111.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 63 [0111.115] lstrlenW (lpString=".jpg") returned 4 [0111.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.115] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") [0111.115] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1344) returned 1 [0111.115] CloseHandle (hObject=0x22c) returned 1 [0111.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf")) returned 0x20 [0111.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.116] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.116] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.116] GetLastError () returned 0x0 [0111.116] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x540, lpOverlapped=0x0) returned 1 [0111.118] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x550, lpOverlapped=0x0) returned 1 [0111.119] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0111.119] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.119] SetEndOfFile (hFile=0x19c) returned 1 [0111.119] CloseHandle (hObject=0x19c) returned 1 [0111.119] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.119] SetEndOfFile (hFile=0x22c) returned 1 [0111.120] CloseHandle (hObject=0x22c) returned 1 [0111.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf")) returned 1 [0111.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.120] lstrlenW (lpString=".doc") returned 4 [0111.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.120] lstrlenW (lpString=".docx") returned 5 [0111.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.120] lstrlenW (lpString=".pdf") returned 4 [0111.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.120] lstrlenW (lpString=".xls") returned 4 [0111.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.120] lstrlenW (lpString=".xlsx") returned 5 [0111.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.121] lstrlenW (lpString=".ppt") returned 4 [0111.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.121] lstrlenW (lpString=".zip") returned 4 [0111.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.121] lstrlenW (lpString=".rar") returned 4 [0111.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString=".bz2") returned 4 [0111.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString=".7z") returned 3 [0111.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.121] lstrlenW (lpString=".dbf") returned 4 [0111.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.121] lstrlenW (lpString=".1cd") returned 4 [0111.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.121] lstrlenW (lpString=".jpg") returned 4 [0111.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString=".pdf") returned 4 [0111.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString=".xls") returned 4 [0111.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.121] lstrlenW (lpString=".xlsx") returned 5 [0111.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.121] lstrlenW (lpString=".ppt") returned 4 [0111.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.121] lstrlenW (lpString=".zip") returned 4 [0111.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.122] lstrlenW (lpString=".rar") returned 4 [0111.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.122] lstrlenW (lpString=".bz2") returned 4 [0111.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.122] lstrlenW (lpString=".7z") returned 3 [0111.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.122] lstrlenW (lpString=".dbf") returned 4 [0111.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.122] lstrlenW (lpString=".1cd") returned 4 [0111.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 63 [0111.122] lstrlenW (lpString=".jpg") returned 4 [0111.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.122] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") [0111.123] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=820) returned 1 [0111.123] CloseHandle (hObject=0x22c) returned 1 [0111.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf")) returned 0x20 [0111.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.123] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.123] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.124] GetLastError () returned 0x0 [0111.124] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x334, lpOverlapped=0x0) returned 1 [0111.125] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x340, lpOverlapped=0x0) returned 1 [0111.126] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0111.126] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.126] SetEndOfFile (hFile=0x19c) returned 1 [0111.126] CloseHandle (hObject=0x19c) returned 1 [0111.126] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.126] SetEndOfFile (hFile=0x22c) returned 1 [0111.127] CloseHandle (hObject=0x22c) returned 1 [0111.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf")) returned 1 [0111.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.127] lstrlenW (lpString=".doc") returned 4 [0111.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".docx") returned 5 [0111.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.128] lstrlenW (lpString=".pdf") returned 4 [0111.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".xls") returned 4 [0111.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.128] lstrlenW (lpString=".xlsx") returned 5 [0111.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.128] lstrlenW (lpString=".ppt") returned 4 [0111.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.128] lstrlenW (lpString=".zip") returned 4 [0111.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.128] lstrlenW (lpString=".rar") returned 4 [0111.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".bz2") returned 4 [0111.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".7z") returned 3 [0111.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.128] lstrlenW (lpString=".dbf") returned 4 [0111.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.128] lstrlenW (lpString=".1cd") returned 4 [0111.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.128] lstrlenW (lpString=".jpg") returned 4 [0111.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".pdf") returned 4 [0111.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".xls") returned 4 [0111.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.129] lstrlenW (lpString=".xlsx") returned 5 [0111.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.129] lstrlenW (lpString=".ppt") returned 4 [0111.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.129] lstrlenW (lpString=".zip") returned 4 [0111.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.129] lstrlenW (lpString=".rar") returned 4 [0111.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString=".bz2") returned 4 [0111.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString=".7z") returned 3 [0111.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.129] lstrlenW (lpString=".dbf") returned 4 [0111.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.129] lstrlenW (lpString=".1cd") returned 4 [0111.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 63 [0111.129] lstrlenW (lpString=".jpg") returned 4 [0111.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.129] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") [0111.136] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2304) returned 1 [0111.136] CloseHandle (hObject=0x22c) returned 1 [0111.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf")) returned 0x20 [0111.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0111.137] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.137] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.138] GetLastError () returned 0x0 [0111.138] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x900, lpOverlapped=0x0) returned 1 [0111.238] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x910, lpOverlapped=0x0) returned 1 [0111.239] ReadFile (in: hFile=0x22c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0111.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.239] SetEndOfFile (hFile=0x19c) returned 1 [0111.240] CloseHandle (hObject=0x19c) returned 1 [0111.240] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0111.240] SetEndOfFile (hFile=0x22c) returned 1 [0111.240] CloseHandle (hObject=0x22c) returned 1 [0111.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf")) returned 1 [0111.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.587] lstrlenW (lpString=".doc") returned 4 [0111.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.587] lstrlenW (lpString=".docx") returned 5 [0111.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.587] lstrlenW (lpString=".pdf") returned 4 [0111.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.596] lstrlenW (lpString=".xls") returned 4 [0111.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.596] lstrlenW (lpString=".xlsx") returned 5 [0111.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.596] lstrlenW (lpString=".ppt") returned 4 [0111.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.596] lstrlenW (lpString=".zip") returned 4 [0111.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.596] lstrlenW (lpString=".rar") returned 4 [0111.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.606] lstrlenW (lpString=".bz2") returned 4 [0111.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.606] lstrlenW (lpString=".7z") returned 3 [0111.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.606] lstrlenW (lpString=".dbf") returned 4 [0111.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".1cd") returned 4 [0111.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".jpg") returned 4 [0111.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString=".pdf") returned 4 [0111.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString=".xls") returned 4 [0111.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.607] lstrlenW (lpString=".xlsx") returned 5 [0111.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.607] lstrlenW (lpString=".ppt") returned 4 [0111.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".zip") returned 4 [0111.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.607] lstrlenW (lpString=".rar") returned 4 [0111.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString=".bz2") returned 4 [0111.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString=".7z") returned 3 [0111.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".dbf") returned 4 [0111.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".1cd") returned 4 [0111.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 63 [0111.607] lstrlenW (lpString=".jpg") returned 4 [0111.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.608] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") [0112.815] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23408) returned 1 [0112.815] CloseHandle (hObject=0x1b8) returned 1 [0112.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf")) returned 0x20 [0112.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.851] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0112.851] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0112.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.247] GetLastError () returned 0x0 [0113.247] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5b70, lpOverlapped=0x0) returned 1 [0113.261] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x5b80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5b80, lpOverlapped=0x0) returned 1 [0113.262] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.262] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.263] SetEndOfFile (hFile=0x1b8) returned 1 [0113.263] CloseHandle (hObject=0x1b8) returned 1 [0113.263] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.263] SetEndOfFile (hFile=0x158) returned 1 [0113.264] CloseHandle (hObject=0x158) returned 1 [0113.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf")) returned 1 [0113.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.264] lstrlenW (lpString=".doc") returned 4 [0113.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.264] lstrlenW (lpString=".docx") returned 5 [0113.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.264] lstrlenW (lpString=".pdf") returned 4 [0113.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.264] lstrlenW (lpString=".xls") returned 4 [0113.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.264] lstrlenW (lpString=".xlsx") returned 5 [0113.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.264] lstrlenW (lpString=".ppt") returned 4 [0113.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.265] lstrlenW (lpString=".zip") returned 4 [0113.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.265] lstrlenW (lpString=".rar") returned 4 [0113.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString=".bz2") returned 4 [0113.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString=".7z") returned 3 [0113.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.265] lstrlenW (lpString=".dbf") returned 4 [0113.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.265] lstrlenW (lpString=".1cd") returned 4 [0113.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.265] lstrlenW (lpString=".jpg") returned 4 [0113.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString=".pdf") returned 4 [0113.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString=".xls") returned 4 [0113.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.265] lstrlenW (lpString=".xlsx") returned 5 [0113.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.265] lstrlenW (lpString=".ppt") returned 4 [0113.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.265] lstrlenW (lpString=".zip") returned 4 [0113.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.265] lstrlenW (lpString=".rar") returned 4 [0113.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.265] lstrlenW (lpString=".bz2") returned 4 [0113.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.266] lstrlenW (lpString=".7z") returned 3 [0113.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.266] lstrlenW (lpString=".dbf") returned 4 [0113.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.266] lstrlenW (lpString=".1cd") returned 4 [0113.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 63 [0113.266] lstrlenW (lpString=".jpg") returned 4 [0113.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.266] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") [0113.267] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13198) returned 1 [0113.267] CloseHandle (hObject=0x158) returned 1 [0113.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf")) returned 0x20 [0113.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.268] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.268] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.269] GetLastError () returned 0x0 [0113.269] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x338e, lpOverlapped=0x0) returned 1 [0113.273] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3390, lpOverlapped=0x0) returned 1 [0113.274] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.274] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.274] SetEndOfFile (hFile=0x1b8) returned 1 [0113.275] CloseHandle (hObject=0x1b8) returned 1 [0113.275] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.275] SetEndOfFile (hFile=0x158) returned 1 [0113.275] CloseHandle (hObject=0x158) returned 1 [0113.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf")) returned 1 [0113.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.276] lstrlenW (lpString=".doc") returned 4 [0113.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.276] lstrlenW (lpString=".docx") returned 5 [0113.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.276] lstrlenW (lpString=".pdf") returned 4 [0113.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.276] lstrlenW (lpString=".xls") returned 4 [0113.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.276] lstrlenW (lpString=".xlsx") returned 5 [0113.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.276] lstrlenW (lpString=".ppt") returned 4 [0113.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.276] lstrlenW (lpString=".zip") returned 4 [0113.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.276] lstrlenW (lpString=".rar") returned 4 [0113.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.276] lstrlenW (lpString=".bz2") returned 4 [0113.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.276] lstrlenW (lpString=".7z") returned 3 [0113.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".dbf") returned 4 [0113.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".1cd") returned 4 [0113.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".jpg") returned 4 [0113.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString=".pdf") returned 4 [0113.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString=".xls") returned 4 [0113.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.277] lstrlenW (lpString=".xlsx") returned 5 [0113.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.277] lstrlenW (lpString=".ppt") returned 4 [0113.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".zip") returned 4 [0113.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.277] lstrlenW (lpString=".rar") returned 4 [0113.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString=".bz2") returned 4 [0113.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString=".7z") returned 3 [0113.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".dbf") returned 4 [0113.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.277] lstrlenW (lpString=".1cd") returned 4 [0113.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 63 [0113.278] lstrlenW (lpString=".jpg") returned 4 [0113.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.278] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") [0113.278] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2230) returned 1 [0113.278] CloseHandle (hObject=0x158) returned 1 [0113.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf")) returned 0x20 [0113.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.279] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.279] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.279] GetLastError () returned 0x0 [0113.279] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8b6, lpOverlapped=0x0) returned 1 [0113.285] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0113.286] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.286] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0113.286] SetEndOfFile (hFile=0x1b8) returned 1 [0113.286] CloseHandle (hObject=0x1b8) returned 1 [0113.287] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.287] SetEndOfFile (hFile=0x158) returned 1 [0113.287] CloseHandle (hObject=0x158) returned 1 [0113.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf")) returned 1 [0113.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.288] lstrlenW (lpString=".doc") returned 4 [0113.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.288] lstrlenW (lpString=".docx") returned 5 [0113.288] lstrcmpiW (lpString1=".docx", lpString2="L.WMF") returned -1 [0113.288] lstrlenW (lpString=".pdf") returned 4 [0113.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.288] lstrlenW (lpString=".xls") returned 4 [0113.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.288] lstrlenW (lpString=".xlsx") returned 5 [0113.288] lstrcmpiW (lpString1=".xlsx", lpString2="L.WMF") returned -1 [0113.288] lstrlenW (lpString=".ppt") returned 4 [0113.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.288] lstrlenW (lpString=".zip") returned 4 [0113.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.288] lstrlenW (lpString=".rar") returned 4 [0113.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.288] lstrlenW (lpString=".bz2") returned 4 [0113.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.288] lstrlenW (lpString=".7z") returned 3 [0113.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.288] lstrlenW (lpString=".dbf") returned 4 [0113.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.289] lstrlenW (lpString=".1cd") returned 4 [0113.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 59 [0113.289] lstrlenW (lpString=".jpg") returned 4 [0113.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.289] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") [0113.303] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=48610) returned 1 [0113.303] CloseHandle (hObject=0x158) returned 1 [0113.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf")) returned 0x20 [0113.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.304] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.304] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.305] GetLastError () returned 0x0 [0113.305] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xbde2, lpOverlapped=0x0) returned 1 [0113.307] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xbdf0, lpOverlapped=0x0) returned 1 [0113.309] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.309] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.309] SetEndOfFile (hFile=0x1b8) returned 1 [0113.309] CloseHandle (hObject=0x1b8) returned 1 [0113.309] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.309] SetEndOfFile (hFile=0x158) returned 1 [0113.310] CloseHandle (hObject=0x158) returned 1 [0113.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf")) returned 1 [0113.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString=".doc") returned 4 [0113.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString=".docx") returned 5 [0113.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.311] lstrlenW (lpString=".pdf") returned 4 [0113.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString=".xls") returned 4 [0113.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.311] lstrlenW (lpString=".xlsx") returned 5 [0113.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.311] lstrlenW (lpString=".ppt") returned 4 [0113.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString=".zip") returned 4 [0113.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.311] lstrlenW (lpString=".rar") returned 4 [0113.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString=".bz2") returned 4 [0113.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString=".7z") returned 3 [0113.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString=".dbf") returned 4 [0113.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString=".1cd") returned 4 [0113.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.311] lstrlenW (lpString=".jpg") returned 4 [0113.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.311] lstrlenW (lpString=".pdf") returned 4 [0113.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString=".xls") returned 4 [0113.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.312] lstrlenW (lpString=".xlsx") returned 5 [0113.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.312] lstrlenW (lpString=".ppt") returned 4 [0113.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.312] lstrlenW (lpString=".zip") returned 4 [0113.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.312] lstrlenW (lpString=".rar") returned 4 [0113.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString=".bz2") returned 4 [0113.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString=".7z") returned 3 [0113.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.312] lstrlenW (lpString=".dbf") returned 4 [0113.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.312] lstrlenW (lpString=".1cd") returned 4 [0113.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 63 [0113.312] lstrlenW (lpString=".jpg") returned 4 [0113.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.312] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") [0113.313] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7518) returned 1 [0113.313] CloseHandle (hObject=0x158) returned 1 [0113.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf")) returned 0x20 [0113.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.313] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.543] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0113.916] GetLastError () returned 0x0 [0113.916] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1d5e, lpOverlapped=0x0) returned 1 [0113.917] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1d60, lpOverlapped=0x0) returned 1 [0113.918] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.918] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.919] SetEndOfFile (hFile=0x22c) returned 1 [0113.919] CloseHandle (hObject=0x22c) returned 1 [0113.919] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.919] SetEndOfFile (hFile=0x158) returned 1 [0113.919] CloseHandle (hObject=0x158) returned 1 [0113.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf")) returned 1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.920] lstrlenW (lpString=".doc") returned 4 [0113.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString=".docx") returned 5 [0113.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.920] lstrlenW (lpString=".pdf") returned 4 [0113.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString=".xls") returned 4 [0113.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.920] lstrlenW (lpString=".xlsx") returned 5 [0113.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.920] lstrlenW (lpString=".ppt") returned 4 [0113.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.920] lstrlenW (lpString=".zip") returned 4 [0113.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.920] lstrlenW (lpString=".rar") returned 4 [0113.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".bz2") returned 4 [0113.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".7z") returned 3 [0113.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.921] lstrlenW (lpString=".dbf") returned 4 [0113.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.921] lstrlenW (lpString=".1cd") returned 4 [0113.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.921] lstrlenW (lpString=".jpg") returned 4 [0113.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".pdf") returned 4 [0113.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".xls") returned 4 [0113.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.921] lstrlenW (lpString=".xlsx") returned 5 [0113.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.921] lstrlenW (lpString=".ppt") returned 4 [0113.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.921] lstrlenW (lpString=".zip") returned 4 [0113.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.921] lstrlenW (lpString=".rar") returned 4 [0113.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".bz2") returned 4 [0113.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.921] lstrlenW (lpString=".7z") returned 3 [0113.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.922] lstrlenW (lpString=".dbf") returned 4 [0113.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.922] lstrlenW (lpString=".1cd") returned 4 [0113.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 63 [0113.922] lstrlenW (lpString=".jpg") returned 4 [0113.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.922] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") [0113.923] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2272) returned 1 [0113.923] CloseHandle (hObject=0x158) returned 1 [0113.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf")) returned 0x20 [0113.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.923] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.924] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0113.924] GetLastError () returned 0x0 [0113.924] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x8e0, lpOverlapped=0x0) returned 1 [0113.926] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0113.927] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.927] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.927] SetEndOfFile (hFile=0x22c) returned 1 [0113.927] CloseHandle (hObject=0x22c) returned 1 [0113.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.927] SetEndOfFile (hFile=0x158) returned 1 [0113.928] CloseHandle (hObject=0x158) returned 1 [0113.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf")) returned 1 [0113.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.928] lstrlenW (lpString=".doc") returned 4 [0113.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.928] lstrlenW (lpString=".docx") returned 5 [0113.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.928] lstrlenW (lpString=".pdf") returned 4 [0113.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.928] lstrlenW (lpString=".xls") returned 4 [0113.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.928] lstrlenW (lpString=".xlsx") returned 5 [0113.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.928] lstrlenW (lpString=".ppt") returned 4 [0113.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.929] lstrlenW (lpString=".zip") returned 4 [0113.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.929] lstrlenW (lpString=".rar") returned 4 [0113.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString=".bz2") returned 4 [0113.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString=".7z") returned 3 [0113.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.929] lstrlenW (lpString=".dbf") returned 4 [0113.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.929] lstrlenW (lpString=".1cd") returned 4 [0113.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.929] lstrlenW (lpString=".jpg") returned 4 [0113.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString=".pdf") returned 4 [0113.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString=".xls") returned 4 [0113.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.929] lstrlenW (lpString=".xlsx") returned 5 [0113.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.929] lstrlenW (lpString=".ppt") returned 4 [0113.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.929] lstrlenW (lpString=".zip") returned 4 [0113.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.929] lstrlenW (lpString=".rar") returned 4 [0113.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.929] lstrlenW (lpString=".bz2") returned 4 [0113.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.930] lstrlenW (lpString=".7z") returned 3 [0113.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.930] lstrlenW (lpString=".dbf") returned 4 [0113.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.930] lstrlenW (lpString=".1cd") returned 4 [0113.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 63 [0113.930] lstrlenW (lpString=".jpg") returned 4 [0113.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.930] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") [0113.930] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8276) returned 1 [0113.931] CloseHandle (hObject=0x158) returned 1 [0113.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf")) returned 0x20 [0113.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.931] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.931] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0113.932] GetLastError () returned 0x0 [0113.932] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2054, lpOverlapped=0x0) returned 1 [0113.991] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2060, lpOverlapped=0x0) returned 1 [0113.992] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.992] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.992] SetEndOfFile (hFile=0x22c) returned 1 [0113.993] CloseHandle (hObject=0x22c) returned 1 [0113.993] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.993] SetEndOfFile (hFile=0x158) returned 1 [0113.993] CloseHandle (hObject=0x158) returned 1 [0113.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf")) returned 1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.994] lstrlenW (lpString=".doc") returned 4 [0113.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".docx") returned 5 [0113.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.994] lstrlenW (lpString=".pdf") returned 4 [0113.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".xls") returned 4 [0113.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.994] lstrlenW (lpString=".xlsx") returned 5 [0113.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.994] lstrlenW (lpString=".ppt") returned 4 [0113.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.994] lstrlenW (lpString=".zip") returned 4 [0113.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.994] lstrlenW (lpString=".rar") returned 4 [0113.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".bz2") returned 4 [0113.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".7z") returned 3 [0113.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".dbf") returned 4 [0113.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".1cd") returned 4 [0113.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".jpg") returned 4 [0113.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString=".pdf") returned 4 [0113.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString=".xls") returned 4 [0113.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.995] lstrlenW (lpString=".xlsx") returned 5 [0113.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.995] lstrlenW (lpString=".ppt") returned 4 [0113.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".zip") returned 4 [0113.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.995] lstrlenW (lpString=".rar") returned 4 [0113.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString=".bz2") returned 4 [0113.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString=".7z") returned 3 [0113.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".dbf") returned 4 [0113.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".1cd") returned 4 [0113.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 63 [0113.995] lstrlenW (lpString=".jpg") returned 4 [0113.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.996] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") [0113.996] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=344) returned 1 [0113.996] CloseHandle (hObject=0x158) returned 1 [0113.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 0x20 [0113.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0113.997] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.997] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0113.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0113.997] GetLastError () returned 0x0 [0113.997] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x158, lpOverlapped=0x0) returned 1 [0113.998] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x160, lpOverlapped=0x0) returned 1 [0113.999] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0113.999] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.999] SetEndOfFile (hFile=0x22c) returned 1 [0113.999] CloseHandle (hObject=0x22c) returned 1 [0113.999] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.000] SetEndOfFile (hFile=0x158) returned 1 [0114.001] CloseHandle (hObject=0x158) returned 1 [0114.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 1 [0114.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.001] lstrlenW (lpString=".doc") returned 4 [0114.001] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.001] lstrlenW (lpString=".docx") returned 5 [0114.001] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.001] lstrlenW (lpString=".pdf") returned 4 [0114.001] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.001] lstrlenW (lpString=".xls") returned 4 [0114.001] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.001] lstrlenW (lpString=".xlsx") returned 5 [0114.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.001] lstrlenW (lpString=".ppt") returned 4 [0114.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.002] lstrlenW (lpString=".zip") returned 4 [0114.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString=".rar") returned 4 [0114.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString=".bz2") returned 4 [0114.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.002] lstrlenW (lpString=".7z") returned 3 [0114.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.002] lstrlenW (lpString=".dbf") returned 4 [0114.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.002] lstrlenW (lpString=".1cd") returned 4 [0114.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.002] lstrlenW (lpString=".jpg") returned 4 [0114.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString=".pdf") returned 4 [0114.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString=".xls") returned 4 [0114.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.002] lstrlenW (lpString=".xlsx") returned 5 [0114.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.002] lstrlenW (lpString=".ppt") returned 4 [0114.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.003] lstrlenW (lpString=".zip") returned 4 [0114.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.003] lstrlenW (lpString=".rar") returned 4 [0114.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.003] lstrlenW (lpString=".bz2") returned 4 [0114.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.003] lstrlenW (lpString=".7z") returned 3 [0114.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.003] lstrlenW (lpString=".dbf") returned 4 [0114.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.003] lstrlenW (lpString=".1cd") returned 4 [0114.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 63 [0114.003] lstrlenW (lpString=".jpg") returned 4 [0114.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.003] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") [0114.011] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=431) returned 1 [0114.011] CloseHandle (hObject=0x210) returned 1 [0114.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif")) returned 0x20 [0114.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.012] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.012] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.012] GetLastError () returned 0x0 [0114.012] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1af, lpOverlapped=0x0) returned 1 [0114.013] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b0, lpOverlapped=0x0) returned 1 [0114.014] ReadFile (in: hFile=0x210, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.014] WriteFile (in: hFile=0x1c8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.014] SetEndOfFile (hFile=0x1c8) returned 1 [0114.015] CloseHandle (hObject=0x1c8) returned 1 [0114.015] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.015] SetEndOfFile (hFile=0x210) returned 1 [0114.018] CloseHandle (hObject=0x210) returned 1 [0114.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif")) returned 1 [0114.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.018] lstrlenW (lpString=".doc") returned 4 [0114.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.018] lstrlenW (lpString=".docx") returned 5 [0114.018] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.019] lstrlenW (lpString=".pdf") returned 4 [0114.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".xls") returned 4 [0114.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".xlsx") returned 5 [0114.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.019] lstrlenW (lpString=".ppt") returned 4 [0114.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.019] lstrlenW (lpString=".zip") returned 4 [0114.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".rar") returned 4 [0114.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".bz2") returned 4 [0114.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.019] lstrlenW (lpString=".7z") returned 3 [0114.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.019] lstrlenW (lpString=".dbf") returned 4 [0114.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.019] lstrlenW (lpString=".1cd") returned 4 [0114.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.019] lstrlenW (lpString=".jpg") returned 4 [0114.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".pdf") returned 4 [0114.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".xls") returned 4 [0114.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.019] lstrlenW (lpString=".xlsx") returned 5 [0114.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.019] lstrlenW (lpString=".ppt") returned 4 [0114.020] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.020] lstrlenW (lpString=".zip") returned 4 [0114.020] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.020] lstrlenW (lpString=".rar") returned 4 [0114.020] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.020] lstrlenW (lpString=".bz2") returned 4 [0114.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.020] lstrlenW (lpString=".7z") returned 3 [0114.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.020] lstrlenW (lpString=".dbf") returned 4 [0114.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.020] lstrlenW (lpString=".1cd") returned 4 [0114.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 63 [0114.020] lstrlenW (lpString=".jpg") returned 4 [0114.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.020] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") [0114.039] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=341) returned 1 [0114.058] CloseHandle (hObject=0x158) returned 1 [0114.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif")) returned 0x20 [0114.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.090] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.090] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.091] GetLastError () returned 0x0 [0114.091] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x155, lpOverlapped=0x0) returned 1 [0114.092] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x160, lpOverlapped=0x0) returned 1 [0114.093] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.093] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.093] SetEndOfFile (hFile=0x22c) returned 1 [0114.093] CloseHandle (hObject=0x22c) returned 1 [0114.093] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.093] SetEndOfFile (hFile=0x1c8) returned 1 [0114.094] CloseHandle (hObject=0x1c8) returned 1 [0114.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif")) returned 1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.095] lstrlenW (lpString=".doc") returned 4 [0114.095] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.095] lstrlenW (lpString=".docx") returned 5 [0114.095] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.095] lstrlenW (lpString=".pdf") returned 4 [0114.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".xls") returned 4 [0114.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".xlsx") returned 5 [0114.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.095] lstrlenW (lpString=".ppt") returned 4 [0114.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.095] lstrlenW (lpString=".zip") returned 4 [0114.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".rar") returned 4 [0114.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".bz2") returned 4 [0114.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.095] lstrlenW (lpString=".7z") returned 3 [0114.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.095] lstrlenW (lpString=".dbf") returned 4 [0114.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.095] lstrlenW (lpString=".1cd") returned 4 [0114.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.095] lstrlenW (lpString=".jpg") returned 4 [0114.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".pdf") returned 4 [0114.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.095] lstrlenW (lpString=".xls") returned 4 [0114.096] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.096] lstrlenW (lpString=".xlsx") returned 5 [0114.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.096] lstrlenW (lpString=".ppt") returned 4 [0114.096] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.096] lstrlenW (lpString=".zip") returned 4 [0114.096] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.096] lstrlenW (lpString=".rar") returned 4 [0114.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.096] lstrlenW (lpString=".bz2") returned 4 [0114.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.096] lstrlenW (lpString=".7z") returned 3 [0114.096] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.096] lstrlenW (lpString=".dbf") returned 4 [0114.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.096] lstrlenW (lpString=".1cd") returned 4 [0114.096] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 63 [0114.096] lstrlenW (lpString=".jpg") returned 4 [0114.096] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.096] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") [0114.125] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=700) returned 1 [0114.126] CloseHandle (hObject=0x1c8) returned 1 [0114.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif")) returned 0x20 [0114.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.126] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.126] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.127] GetLastError () returned 0x0 [0114.127] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2bc, lpOverlapped=0x0) returned 1 [0114.128] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0114.128] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.129] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.129] SetEndOfFile (hFile=0x22c) returned 1 [0114.129] CloseHandle (hObject=0x22c) returned 1 [0114.129] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.129] SetEndOfFile (hFile=0x1c8) returned 1 [0114.130] CloseHandle (hObject=0x1c8) returned 1 [0114.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif")) returned 1 [0114.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.130] lstrlenW (lpString=".doc") returned 4 [0114.130] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.130] lstrlenW (lpString=".docx") returned 5 [0114.130] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.130] lstrlenW (lpString=".pdf") returned 4 [0114.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.130] lstrlenW (lpString=".xls") returned 4 [0114.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.130] lstrlenW (lpString=".xlsx") returned 5 [0114.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.130] lstrlenW (lpString=".ppt") returned 4 [0114.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.130] lstrlenW (lpString=".zip") returned 4 [0114.130] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".rar") returned 4 [0114.131] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".bz2") returned 4 [0114.131] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.131] lstrlenW (lpString=".7z") returned 3 [0114.131] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.131] lstrlenW (lpString=".dbf") returned 4 [0114.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.131] lstrlenW (lpString=".1cd") returned 4 [0114.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.131] lstrlenW (lpString=".jpg") returned 4 [0114.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".pdf") returned 4 [0114.131] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".xls") returned 4 [0114.131] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".xlsx") returned 5 [0114.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.131] lstrlenW (lpString=".ppt") returned 4 [0114.131] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.131] lstrlenW (lpString=".zip") returned 4 [0114.131] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".rar") returned 4 [0114.131] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.131] lstrlenW (lpString=".bz2") returned 4 [0114.131] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.131] lstrlenW (lpString=".7z") returned 3 [0114.131] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.132] lstrlenW (lpString=".dbf") returned 4 [0114.132] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.132] lstrlenW (lpString=".1cd") returned 4 [0114.132] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 63 [0114.132] lstrlenW (lpString=".jpg") returned 4 [0114.132] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.132] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") [0114.132] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8310) returned 1 [0114.133] CloseHandle (hObject=0x1c8) returned 1 [0114.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif")) returned 0x20 [0114.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0114.133] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.133] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.134] GetLastError () returned 0x0 [0114.134] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2076, lpOverlapped=0x0) returned 1 [0114.243] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2080, lpOverlapped=0x0) returned 1 [0114.244] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.244] WriteFile (in: hFile=0x22c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.244] SetEndOfFile (hFile=0x22c) returned 1 [0114.415] CloseHandle (hObject=0x22c) returned 1 [0114.415] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.415] SetEndOfFile (hFile=0x1c8) returned 1 [0114.646] CloseHandle (hObject=0x1c8) returned 1 [0114.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif")) returned 1 [0114.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.904] lstrlenW (lpString=".doc") returned 4 [0114.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.904] lstrlenW (lpString=".docx") returned 5 [0114.904] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0114.904] lstrlenW (lpString=".pdf") returned 4 [0114.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.905] lstrlenW (lpString=".xls") returned 4 [0114.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.905] lstrlenW (lpString=".xlsx") returned 5 [0114.905] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0114.905] lstrlenW (lpString=".ppt") returned 4 [0114.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.905] lstrlenW (lpString=".zip") returned 4 [0114.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.905] lstrlenW (lpString=".rar") returned 4 [0114.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.905] lstrlenW (lpString=".bz2") returned 4 [0114.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.905] lstrlenW (lpString=".7z") returned 3 [0114.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.905] lstrlenW (lpString=".dbf") returned 4 [0114.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.905] lstrlenW (lpString=".1cd") returned 4 [0114.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 63 [0114.905] lstrlenW (lpString=".jpg") returned 4 [0114.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.905] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") [0114.977] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=903) returned 1 [0114.977] CloseHandle (hObject=0x158) returned 1 [0114.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif")) returned 0x20 [0114.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.978] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.978] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0114.978] GetLastError () returned 0x0 [0114.978] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x387, lpOverlapped=0x0) returned 1 [0114.980] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x390, lpOverlapped=0x0) returned 1 [0114.981] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.981] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.981] SetEndOfFile (hFile=0x15c) returned 1 [0114.981] CloseHandle (hObject=0x15c) returned 1 [0114.981] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.981] SetEndOfFile (hFile=0x158) returned 1 [0114.982] CloseHandle (hObject=0x158) returned 1 [0114.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif")) returned 1 [0114.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.982] lstrlenW (lpString=".doc") returned 4 [0114.982] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.982] lstrlenW (lpString=".docx") returned 5 [0114.982] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.982] lstrlenW (lpString=".pdf") returned 4 [0114.982] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.982] lstrlenW (lpString=".xls") returned 4 [0114.982] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.982] lstrlenW (lpString=".xlsx") returned 5 [0114.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.982] lstrlenW (lpString=".ppt") returned 4 [0114.982] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.983] lstrlenW (lpString=".zip") returned 4 [0114.983] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.983] lstrlenW (lpString=".rar") returned 4 [0114.983] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.983] lstrlenW (lpString=".bz2") returned 4 [0114.983] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.983] lstrlenW (lpString=".7z") returned 3 [0114.983] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.983] lstrlenW (lpString=".dbf") returned 4 [0114.983] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.983] lstrlenW (lpString=".1cd") returned 4 [0114.983] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.983] lstrlenW (lpString=".jpg") returned 4 [0114.983] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.983] lstrlenW (lpString=".pdf") returned 4 [0114.983] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.983] lstrlenW (lpString=".xls") returned 4 [0114.984] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.984] lstrlenW (lpString=".xlsx") returned 5 [0114.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.984] lstrlenW (lpString=".ppt") returned 4 [0114.984] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.984] lstrlenW (lpString=".zip") returned 4 [0114.984] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.984] lstrlenW (lpString=".rar") returned 4 [0114.984] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.984] lstrlenW (lpString=".bz2") returned 4 [0114.984] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.984] lstrlenW (lpString=".7z") returned 3 [0114.984] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.984] lstrlenW (lpString=".dbf") returned 4 [0114.984] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.984] lstrlenW (lpString=".1cd") returned 4 [0114.984] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 63 [0114.984] lstrlenW (lpString=".jpg") returned 4 [0114.984] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.984] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") [0114.985] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=772) returned 1 [0114.985] CloseHandle (hObject=0x158) returned 1 [0114.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif")) returned 0x20 [0114.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.986] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.986] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0114.987] GetLastError () returned 0x0 [0114.987] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x304, lpOverlapped=0x0) returned 1 [0114.988] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x310, lpOverlapped=0x0) returned 1 [0114.989] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.989] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.989] SetEndOfFile (hFile=0x15c) returned 1 [0114.989] CloseHandle (hObject=0x15c) returned 1 [0114.989] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.989] SetEndOfFile (hFile=0x158) returned 1 [0114.990] CloseHandle (hObject=0x158) returned 1 [0114.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif")) returned 1 [0114.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.990] lstrlenW (lpString=".doc") returned 4 [0114.990] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.990] lstrlenW (lpString=".docx") returned 5 [0114.991] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.991] lstrlenW (lpString=".pdf") returned 4 [0114.991] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".xls") returned 4 [0114.991] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".xlsx") returned 5 [0114.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.991] lstrlenW (lpString=".ppt") returned 4 [0114.991] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.991] lstrlenW (lpString=".zip") returned 4 [0114.991] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".rar") returned 4 [0114.991] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".bz2") returned 4 [0114.991] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.991] lstrlenW (lpString=".7z") returned 3 [0114.991] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.991] lstrlenW (lpString=".dbf") returned 4 [0114.991] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.991] lstrlenW (lpString=".1cd") returned 4 [0114.991] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.991] lstrlenW (lpString=".jpg") returned 4 [0114.991] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".pdf") returned 4 [0114.991] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".xls") returned 4 [0114.991] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.991] lstrlenW (lpString=".xlsx") returned 5 [0114.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.991] lstrlenW (lpString=".ppt") returned 4 [0114.992] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.992] lstrlenW (lpString=".zip") returned 4 [0114.992] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.992] lstrlenW (lpString=".rar") returned 4 [0114.992] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.992] lstrlenW (lpString=".bz2") returned 4 [0114.992] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.992] lstrlenW (lpString=".7z") returned 3 [0114.992] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.992] lstrlenW (lpString=".dbf") returned 4 [0114.992] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.992] lstrlenW (lpString=".1cd") returned 4 [0114.992] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 63 [0114.992] lstrlenW (lpString=".jpg") returned 4 [0114.992] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.992] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") [0114.993] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3652) returned 1 [0114.993] CloseHandle (hObject=0x158) returned 1 [0114.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif")) returned 0x20 [0114.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0114.994] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.994] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0114.994] GetLastError () returned 0x0 [0114.994] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe44, lpOverlapped=0x0) returned 1 [0114.996] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe50, lpOverlapped=0x0) returned 1 [0114.997] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0114.997] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.997] SetEndOfFile (hFile=0x15c) returned 1 [0114.997] CloseHandle (hObject=0x15c) returned 1 [0114.997] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0114.997] SetEndOfFile (hFile=0x158) returned 1 [0114.998] CloseHandle (hObject=0x158) returned 1 [0114.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif")) returned 1 [0114.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.998] lstrlenW (lpString=".doc") returned 4 [0114.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.999] lstrlenW (lpString=".docx") returned 5 [0114.999] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.999] lstrlenW (lpString=".pdf") returned 4 [0114.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".xls") returned 4 [0114.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".xlsx") returned 5 [0114.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.999] lstrlenW (lpString=".ppt") returned 4 [0114.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.999] lstrlenW (lpString=".zip") returned 4 [0114.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".rar") returned 4 [0114.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".bz2") returned 4 [0114.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.999] lstrlenW (lpString=".7z") returned 3 [0114.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.999] lstrlenW (lpString=".dbf") returned 4 [0114.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.999] lstrlenW (lpString=".1cd") returned 4 [0114.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0114.999] lstrlenW (lpString=".jpg") returned 4 [0114.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".pdf") returned 4 [0114.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".xls") returned 4 [0114.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.999] lstrlenW (lpString=".xlsx") returned 5 [0114.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.000] lstrlenW (lpString=".ppt") returned 4 [0115.000] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0115.000] lstrlenW (lpString=".zip") returned 4 [0115.000] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.000] lstrlenW (lpString=".rar") returned 4 [0115.000] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.000] lstrlenW (lpString=".bz2") returned 4 [0115.000] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.000] lstrlenW (lpString=".7z") returned 3 [0115.000] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0115.000] lstrlenW (lpString=".dbf") returned 4 [0115.000] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0115.000] lstrlenW (lpString=".1cd") returned 4 [0115.000] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 63 [0115.000] lstrlenW (lpString=".jpg") returned 4 [0115.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.000] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") [0115.001] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1094) returned 1 [0115.001] CloseHandle (hObject=0x158) returned 1 [0115.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif")) returned 0x20 [0115.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.001] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.001] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.002] GetLastError () returned 0x0 [0115.002] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x446, lpOverlapped=0x0) returned 1 [0115.003] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x450, lpOverlapped=0x0) returned 1 [0115.004] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.004] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.004] SetEndOfFile (hFile=0x15c) returned 1 [0115.004] CloseHandle (hObject=0x15c) returned 1 [0115.004] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.004] SetEndOfFile (hFile=0x158) returned 1 [0115.005] CloseHandle (hObject=0x158) returned 1 [0115.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif")) returned 1 [0115.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.005] lstrlenW (lpString=".doc") returned 4 [0115.005] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.006] lstrlenW (lpString=".docx") returned 5 [0115.006] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.006] lstrlenW (lpString=".pdf") returned 4 [0115.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".xls") returned 4 [0115.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".xlsx") returned 5 [0115.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.006] lstrlenW (lpString=".ppt") returned 4 [0115.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.006] lstrlenW (lpString=".zip") returned 4 [0115.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".rar") returned 4 [0115.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".bz2") returned 4 [0115.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.006] lstrlenW (lpString=".7z") returned 3 [0115.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.006] lstrlenW (lpString=".dbf") returned 4 [0115.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.006] lstrlenW (lpString=".1cd") returned 4 [0115.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.006] lstrlenW (lpString=".jpg") returned 4 [0115.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".pdf") returned 4 [0115.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".xls") returned 4 [0115.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.006] lstrlenW (lpString=".xlsx") returned 5 [0115.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.007] lstrlenW (lpString=".ppt") returned 4 [0115.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.007] lstrlenW (lpString=".zip") returned 4 [0115.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.007] lstrlenW (lpString=".rar") returned 4 [0115.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.007] lstrlenW (lpString=".bz2") returned 4 [0115.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.007] lstrlenW (lpString=".7z") returned 3 [0115.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.007] lstrlenW (lpString=".dbf") returned 4 [0115.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.007] lstrlenW (lpString=".1cd") returned 4 [0115.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 63 [0115.007] lstrlenW (lpString=".jpg") returned 4 [0115.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.007] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") [0115.008] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=1534) returned 1 [0115.008] CloseHandle (hObject=0x158) returned 1 [0115.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif")) returned 0x20 [0115.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.008] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.008] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.009] GetLastError () returned 0x0 [0115.009] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x5fe, lpOverlapped=0x0) returned 1 [0115.185] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x600, lpOverlapped=0x0) returned 1 [0115.214] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.214] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.215] SetEndOfFile (hFile=0x15c) returned 1 [0115.215] CloseHandle (hObject=0x15c) returned 1 [0115.215] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.215] SetEndOfFile (hFile=0x158) returned 1 [0115.216] CloseHandle (hObject=0x158) returned 1 [0115.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif")) returned 1 [0115.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.216] lstrlenW (lpString=".doc") returned 4 [0115.216] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.216] lstrlenW (lpString=".docx") returned 5 [0115.216] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.216] lstrlenW (lpString=".pdf") returned 4 [0115.216] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.216] lstrlenW (lpString=".xls") returned 4 [0115.216] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.216] lstrlenW (lpString=".xlsx") returned 5 [0115.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.216] lstrlenW (lpString=".ppt") returned 4 [0115.216] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.216] lstrlenW (lpString=".zip") returned 4 [0115.216] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.216] lstrlenW (lpString=".rar") returned 4 [0115.216] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.217] lstrlenW (lpString=".bz2") returned 4 [0115.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.217] lstrlenW (lpString=".7z") returned 3 [0115.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.217] lstrlenW (lpString=".dbf") returned 4 [0115.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.217] lstrlenW (lpString=".1cd") returned 4 [0115.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.217] lstrlenW (lpString=".jpg") returned 4 [0115.217] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.217] lstrlenW (lpString=".pdf") returned 4 [0115.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.217] lstrlenW (lpString=".xls") returned 4 [0115.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.217] lstrlenW (lpString=".xlsx") returned 5 [0115.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.217] lstrlenW (lpString=".ppt") returned 4 [0115.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.217] lstrlenW (lpString=".zip") returned 4 [0115.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.218] lstrlenW (lpString=".rar") returned 4 [0115.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.218] lstrlenW (lpString=".bz2") returned 4 [0115.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.218] lstrlenW (lpString=".7z") returned 3 [0115.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.218] lstrlenW (lpString=".dbf") returned 4 [0115.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.218] lstrlenW (lpString=".1cd") returned 4 [0115.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 63 [0115.218] lstrlenW (lpString=".jpg") returned 4 [0115.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.218] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") [0115.219] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8430) returned 1 [0115.219] CloseHandle (hObject=0x158) returned 1 [0115.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 0x20 [0115.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.219] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.219] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.220] GetLastError () returned 0x0 [0115.220] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x20ee, lpOverlapped=0x0) returned 1 [0115.222] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0115.223] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.223] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.223] SetEndOfFile (hFile=0x15c) returned 1 [0115.223] CloseHandle (hObject=0x15c) returned 1 [0115.223] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.223] SetEndOfFile (hFile=0x158) returned 1 [0115.224] CloseHandle (hObject=0x158) returned 1 [0115.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 1 [0115.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.225] lstrlenW (lpString=".doc") returned 4 [0115.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.225] lstrlenW (lpString=".docx") returned 5 [0115.225] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.225] lstrlenW (lpString=".pdf") returned 4 [0115.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.225] lstrlenW (lpString=".xls") returned 4 [0115.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.225] lstrlenW (lpString=".xlsx") returned 5 [0115.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.225] lstrlenW (lpString=".ppt") returned 4 [0115.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.225] lstrlenW (lpString=".zip") returned 4 [0115.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.225] lstrlenW (lpString=".rar") returned 4 [0115.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.225] lstrlenW (lpString=".bz2") returned 4 [0115.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.225] lstrlenW (lpString=".7z") returned 3 [0115.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.225] lstrlenW (lpString=".dbf") returned 4 [0115.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.225] lstrlenW (lpString=".1cd") returned 4 [0115.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 76 [0115.225] lstrlenW (lpString=".jpg") returned 4 [0115.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.225] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") [0115.226] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8230) returned 1 [0115.226] CloseHandle (hObject=0x158) returned 1 [0115.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 0x20 [0115.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.227] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.227] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.227] GetLastError () returned 0x0 [0115.228] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2026, lpOverlapped=0x0) returned 1 [0115.229] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2030, lpOverlapped=0x0) returned 1 [0115.230] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.230] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.230] SetEndOfFile (hFile=0x15c) returned 1 [0115.230] CloseHandle (hObject=0x15c) returned 1 [0115.230] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.230] SetEndOfFile (hFile=0x158) returned 1 [0115.231] CloseHandle (hObject=0x158) returned 1 [0115.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.232] lstrlenW (lpString=".doc") returned 4 [0115.232] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.232] lstrlenW (lpString=".docx") returned 5 [0115.232] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.232] lstrlenW (lpString=".pdf") returned 4 [0115.232] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.232] lstrlenW (lpString=".xls") returned 4 [0115.232] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.232] lstrlenW (lpString=".xlsx") returned 5 [0115.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.232] lstrlenW (lpString=".ppt") returned 4 [0115.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.232] lstrlenW (lpString=".zip") returned 4 [0115.232] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.232] lstrlenW (lpString=".rar") returned 4 [0115.232] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.232] lstrlenW (lpString=".bz2") returned 4 [0115.232] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.232] lstrlenW (lpString=".7z") returned 3 [0115.232] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.232] lstrlenW (lpString=".dbf") returned 4 [0115.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.232] lstrlenW (lpString=".1cd") returned 4 [0115.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 76 [0115.233] lstrlenW (lpString=".jpg") returned 4 [0115.233] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.233] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") [0115.233] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8979) returned 1 [0115.233] CloseHandle (hObject=0x158) returned 1 [0115.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 0x20 [0115.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.234] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.234] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.234] GetLastError () returned 0x0 [0115.235] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x2313, lpOverlapped=0x0) returned 1 [0115.236] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x2320, lpOverlapped=0x0) returned 1 [0115.237] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.237] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.237] SetEndOfFile (hFile=0x15c) returned 1 [0115.237] CloseHandle (hObject=0x15c) returned 1 [0115.237] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.238] SetEndOfFile (hFile=0x158) returned 1 [0115.238] CloseHandle (hObject=0x158) returned 1 [0115.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 1 [0115.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.239] lstrlenW (lpString=".doc") returned 4 [0115.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.239] lstrlenW (lpString=".docx") returned 5 [0115.239] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.239] lstrlenW (lpString=".pdf") returned 4 [0115.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.239] lstrlenW (lpString=".xls") returned 4 [0115.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.239] lstrlenW (lpString=".xlsx") returned 5 [0115.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.239] lstrlenW (lpString=".ppt") returned 4 [0115.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.239] lstrlenW (lpString=".zip") returned 4 [0115.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.239] lstrlenW (lpString=".rar") returned 4 [0115.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.239] lstrlenW (lpString=".bz2") returned 4 [0115.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.239] lstrlenW (lpString=".7z") returned 3 [0115.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.239] lstrlenW (lpString=".dbf") returned 4 [0115.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.240] lstrlenW (lpString=".1cd") returned 4 [0115.240] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 76 [0115.240] lstrlenW (lpString=".jpg") returned 4 [0115.240] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.240] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") [0115.240] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=8079) returned 1 [0115.240] CloseHandle (hObject=0x158) returned 1 [0115.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 0x20 [0115.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.241] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.241] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.241] GetLastError () returned 0x0 [0115.241] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x1f8f, lpOverlapped=0x0) returned 1 [0115.243] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0115.244] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.244] WriteFile (in: hFile=0x15c, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.244] SetEndOfFile (hFile=0x15c) returned 1 [0115.245] CloseHandle (hObject=0x15c) returned 1 [0115.245] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.245] SetEndOfFile (hFile=0x158) returned 1 [0115.245] CloseHandle (hObject=0x158) returned 1 [0115.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 1 [0115.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.246] lstrlenW (lpString=".doc") returned 4 [0115.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.246] lstrlenW (lpString=".docx") returned 5 [0115.246] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.246] lstrlenW (lpString=".pdf") returned 4 [0115.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.246] lstrlenW (lpString=".xls") returned 4 [0115.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.246] lstrlenW (lpString=".xlsx") returned 5 [0115.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.246] lstrlenW (lpString=".ppt") returned 4 [0115.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.246] lstrlenW (lpString=".zip") returned 4 [0115.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.246] lstrlenW (lpString=".rar") returned 4 [0115.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.246] lstrlenW (lpString=".bz2") returned 4 [0115.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.246] lstrlenW (lpString=".7z") returned 3 [0115.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.246] lstrlenW (lpString=".dbf") returned 4 [0115.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.247] lstrlenW (lpString=".1cd") returned 4 [0115.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 76 [0115.247] lstrlenW (lpString=".jpg") returned 4 [0115.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.247] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") [0115.247] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3613) returned 1 [0115.247] CloseHandle (hObject=0x158) returned 1 [0115.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 0x20 [0115.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.248] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.248] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.889] GetLastError () returned 0x0 [0115.889] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xe1d, lpOverlapped=0x0) returned 1 [0115.923] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe20, lpOverlapped=0x0) returned 1 [0115.923] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.924] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.924] SetEndOfFile (hFile=0x1b8) returned 1 [0115.924] CloseHandle (hObject=0x1b8) returned 1 [0115.924] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.924] SetEndOfFile (hFile=0x158) returned 1 [0115.925] CloseHandle (hObject=0x158) returned 1 [0115.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 1 [0115.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.925] lstrlenW (lpString=".doc") returned 4 [0115.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.925] lstrlenW (lpString=".docx") returned 5 [0115.925] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.925] lstrlenW (lpString=".pdf") returned 4 [0115.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.925] lstrlenW (lpString=".xls") returned 4 [0115.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.925] lstrlenW (lpString=".xlsx") returned 5 [0115.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.925] lstrlenW (lpString=".ppt") returned 4 [0115.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.926] lstrlenW (lpString=".zip") returned 4 [0115.926] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.926] lstrlenW (lpString=".rar") returned 4 [0115.926] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.926] lstrlenW (lpString=".bz2") returned 4 [0115.926] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.926] lstrlenW (lpString=".7z") returned 3 [0115.926] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.926] lstrlenW (lpString=".dbf") returned 4 [0115.926] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.926] lstrlenW (lpString=".1cd") returned 4 [0115.926] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 76 [0115.926] lstrlenW (lpString=".jpg") returned 4 [0115.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.926] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") [0115.927] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=69784) returned 1 [0115.927] CloseHandle (hObject=0x158) returned 1 [0115.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 0x20 [0115.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.928] GetLastError () returned 0x0 [0115.928] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x11098, lpOverlapped=0x0) returned 1 [0115.953] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x110a0, lpOverlapped=0x0) returned 1 [0115.955] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0115.955] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.955] SetEndOfFile (hFile=0x1b8) returned 1 [0115.955] CloseHandle (hObject=0x1b8) returned 1 [0115.955] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.955] SetEndOfFile (hFile=0x158) returned 1 [0115.956] CloseHandle (hObject=0x158) returned 1 [0115.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString=".doc") returned 4 [0115.957] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".docx") returned 5 [0115.957] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0115.957] lstrlenW (lpString=".pdf") returned 4 [0115.957] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".xls") returned 4 [0115.957] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".xlsx") returned 5 [0115.957] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0115.957] lstrlenW (lpString=".ppt") returned 4 [0115.957] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString=".zip") returned 4 [0115.957] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".rar") returned 4 [0115.957] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".bz2") returned 4 [0115.957] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString=".7z") returned 3 [0115.957] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString=".dbf") returned 4 [0115.957] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString=".1cd") returned 4 [0115.957] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 64 [0115.957] lstrlenW (lpString=".jpg") returned 4 [0115.957] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0115.958] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") [0115.958] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=68069) returned 1 [0115.958] CloseHandle (hObject=0x158) returned 1 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) returned 0x20 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0115.958] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.958] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0115.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0115.959] GetLastError () returned 0x0 [0115.959] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x109e5, lpOverlapped=0x0) returned 1 [0116.037] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x109f0, lpOverlapped=0x0) returned 1 [0116.039] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0116.039] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.039] SetEndOfFile (hFile=0x1b8) returned 1 [0116.039] CloseHandle (hObject=0x1b8) returned 1 [0116.039] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.039] SetEndOfFile (hFile=0x158) returned 1 [0116.040] CloseHandle (hObject=0x158) returned 1 [0116.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) returned 1 [0116.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.040] lstrlenW (lpString=".doc") returned 4 [0116.041] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".docx") returned 5 [0116.041] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.041] lstrlenW (lpString=".pdf") returned 4 [0116.041] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".xls") returned 4 [0116.041] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".xlsx") returned 5 [0116.041] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.041] lstrlenW (lpString=".ppt") returned 4 [0116.041] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.041] lstrlenW (lpString=".zip") returned 4 [0116.041] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".rar") returned 4 [0116.041] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".bz2") returned 4 [0116.041] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString=".7z") returned 3 [0116.041] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.041] lstrlenW (lpString=".dbf") returned 4 [0116.041] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.041] lstrlenW (lpString=".1cd") returned 4 [0116.041] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 64 [0116.041] lstrlenW (lpString=".jpg") returned 4 [0116.041] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.041] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") [0116.042] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=101393) returned 1 [0116.042] CloseHandle (hObject=0x158) returned 1 [0116.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) returned 0x20 [0116.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0116.042] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.042] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0116.043] GetLastError () returned 0x0 [0116.043] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x18c11, lpOverlapped=0x0) returned 1 [0116.201] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x18c20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x18c20, lpOverlapped=0x0) returned 1 [0116.204] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0116.204] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.204] SetEndOfFile (hFile=0x1b8) returned 1 [0116.204] CloseHandle (hObject=0x1b8) returned 1 [0116.204] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.204] SetEndOfFile (hFile=0x158) returned 1 [0116.205] CloseHandle (hObject=0x158) returned 1 [0116.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) returned 1 [0116.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.206] lstrlenW (lpString=".doc") returned 4 [0116.206] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".docx") returned 5 [0116.206] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.206] lstrlenW (lpString=".pdf") returned 4 [0116.206] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".xls") returned 4 [0116.206] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".xlsx") returned 5 [0116.206] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.206] lstrlenW (lpString=".ppt") returned 4 [0116.206] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.206] lstrlenW (lpString=".zip") returned 4 [0116.206] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".rar") returned 4 [0116.206] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".bz2") returned 4 [0116.206] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.206] lstrlenW (lpString=".7z") returned 3 [0116.206] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.207] lstrlenW (lpString=".dbf") returned 4 [0116.207] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.207] lstrlenW (lpString=".1cd") returned 4 [0116.207] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 63 [0116.207] lstrlenW (lpString=".jpg") returned 4 [0116.207] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.207] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") [0116.208] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=67060) returned 1 [0116.208] CloseHandle (hObject=0x158) returned 1 [0116.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) returned 0x20 [0116.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0116.208] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.209] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0116.210] GetLastError () returned 0x0 [0116.210] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x105f4, lpOverlapped=0x0) returned 1 [0116.338] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x10600, lpOverlapped=0x0) returned 1 [0116.413] ReadFile (in: hFile=0x158, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0116.413] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.413] SetEndOfFile (hFile=0x1b8) returned 1 [0116.626] CloseHandle (hObject=0x1b8) returned 1 [0116.626] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.626] SetEndOfFile (hFile=0x158) returned 1 [0116.652] CloseHandle (hObject=0x158) returned 1 [0116.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) returned 1 [0116.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.656] lstrlenW (lpString=".doc") returned 4 [0116.656] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".docx") returned 5 [0116.656] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0116.656] lstrlenW (lpString=".pdf") returned 4 [0116.656] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".xls") returned 4 [0116.656] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".xlsx") returned 5 [0116.656] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0116.656] lstrlenW (lpString=".ppt") returned 4 [0116.656] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.656] lstrlenW (lpString=".zip") returned 4 [0116.656] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".rar") returned 4 [0116.656] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".bz2") returned 4 [0116.656] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString=".7z") returned 3 [0116.656] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0116.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.656] lstrlenW (lpString=".dbf") returned 4 [0116.656] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.656] lstrlenW (lpString=".1cd") returned 4 [0116.656] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0116.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 65 [0116.656] lstrlenW (lpString=".jpg") returned 4 [0116.656] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0116.656] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") [0116.657] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2003652) returned 1 [0116.657] CloseHandle (hObject=0x158) returned 1 [0116.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) returned 0x20 [0116.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0116.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0116.658] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc6c | out: lpNewFilePointer=0x0) returned 1 [0116.659] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc2c | out: lpNewFilePointer=0x0) returned 1 [0116.659] ReadFile (in: hFile=0x158, lpBuffer=0x3b30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fafc38, lpOverlapped=0x0 | out: lpBuffer=0x3b30058*, lpNumberOfBytesRead=0x2fafc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.675] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc2c | out: lpNewFilePointer=0x0) returned 1 [0116.675] ReadFile (in: hFile=0x158, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fafc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x2fafc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.796] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0116.796] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1a92c4, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc2c | out: lpNewFilePointer=0x0) returned 1 [0116.796] ReadFile (in: hFile=0x158, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fafc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x2fafc38*=0x40000, lpOverlapped=0x0) returned 1 [0116.853] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0116.853] WriteFile (in: hFile=0x158, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2fafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0117.250] SetEndOfFile (hFile=0x158) returned 1 [0117.259] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0117.259] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc7c | out: lpNewFilePointer=0x0) returned 1 [0117.259] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fafc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2fafc88*=0x40000, lpOverlapped=0x0) returned 1 [0117.261] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc7c | out: lpNewFilePointer=0x0) returned 1 [0117.261] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fafc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2fafc88*=0x40000, lpOverlapped=0x0) returned 1 [0117.263] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1a92c4, lpNewFilePointer=0x0, dwMoveMethod=0x2fafc7c | out: lpNewFilePointer=0x0) returned 1 [0117.263] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fafc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x2fafc88*=0x40000, lpOverlapped=0x0) returned 1 [0117.265] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0117.265] CloseHandle (hObject=0x158) returned 1 [0117.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.265] lstrlenW (lpString=".doc") returned 4 [0117.265] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".docx") returned 5 [0117.265] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.265] lstrlenW (lpString=".pdf") returned 4 [0117.265] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".xls") returned 4 [0117.265] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".xlsx") returned 5 [0117.265] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.265] lstrlenW (lpString=".ppt") returned 4 [0117.265] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.265] lstrlenW (lpString=".zip") returned 4 [0117.265] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".rar") returned 4 [0117.265] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".bz2") returned 4 [0117.265] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.265] lstrlenW (lpString=".7z") returned 3 [0117.266] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.266] lstrlenW (lpString=".dbf") returned 4 [0117.266] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.266] lstrlenW (lpString=".1cd") returned 4 [0117.266] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 65 [0117.266] lstrlenW (lpString=".jpg") returned 4 [0117.266] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.266] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") [0117.288] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=53984) returned 1 [0117.288] CloseHandle (hObject=0x1ec) returned 1 [0117.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx")) returned 0x20 [0117.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.289] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.289] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.289] GetLastError () returned 0x0 [0117.289] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0xd2e0, lpOverlapped=0x0) returned 1 [0117.293] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xd2f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xd2f0, lpOverlapped=0x0) returned 1 [0117.294] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.294] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0117.294] SetEndOfFile (hFile=0x210) returned 1 [0117.294] CloseHandle (hObject=0x210) returned 1 [0117.295] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.295] SetEndOfFile (hFile=0x1ec) returned 1 [0117.296] CloseHandle (hObject=0x1ec) returned 1 [0117.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx")) returned 1 [0117.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.296] lstrlenW (lpString=".doc") returned 4 [0117.296] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString=".docx") returned 5 [0117.296] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.296] lstrlenW (lpString=".pdf") returned 4 [0117.296] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString=".xls") returned 4 [0117.296] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString=".xlsx") returned 5 [0117.296] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.296] lstrlenW (lpString=".ppt") returned 4 [0117.296] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.296] lstrlenW (lpString=".zip") returned 4 [0117.296] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString=".rar") returned 4 [0117.296] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.296] lstrlenW (lpString=".bz2") returned 4 [0117.297] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.297] lstrlenW (lpString=".7z") returned 3 [0117.297] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.297] lstrlenW (lpString=".dbf") returned 4 [0117.297] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.297] lstrlenW (lpString=".1cd") returned 4 [0117.297] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 62 [0117.297] lstrlenW (lpString=".jpg") returned 4 [0117.297] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.297] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") [0117.298] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=393281) returned 1 [0117.298] CloseHandle (hObject=0x1ec) returned 1 [0117.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx")) returned 0x20 [0117.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.298] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.298] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.299] GetLastError () returned 0x0 [0117.299] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x60041, lpOverlapped=0x0) returned 1 [0117.452] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x60050, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x60050, lpOverlapped=0x0) returned 1 [0117.464] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.464] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.465] SetEndOfFile (hFile=0x210) returned 1 [0117.465] CloseHandle (hObject=0x210) returned 1 [0117.465] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.465] SetEndOfFile (hFile=0x1ec) returned 1 [0117.468] CloseHandle (hObject=0x1ec) returned 1 [0117.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx")) returned 1 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString=".doc") returned 4 [0117.469] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".docx") returned 5 [0117.469] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.469] lstrlenW (lpString=".pdf") returned 4 [0117.469] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".xls") returned 4 [0117.469] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".xlsx") returned 5 [0117.469] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.469] lstrlenW (lpString=".ppt") returned 4 [0117.469] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString=".zip") returned 4 [0117.469] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".rar") returned 4 [0117.469] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".bz2") returned 4 [0117.469] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString=".7z") returned 3 [0117.469] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString=".dbf") returned 4 [0117.469] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString=".1cd") returned 4 [0117.469] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 67 [0117.469] lstrlenW (lpString=".jpg") returned 4 [0117.470] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.470] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") [0117.470] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=78521) returned 1 [0117.470] CloseHandle (hObject=0x1ec) returned 1 [0117.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx")) returned 0x20 [0117.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.471] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.471] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.472] GetLastError () returned 0x0 [0117.472] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x132b9, lpOverlapped=0x0) returned 1 [0117.475] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x132c0, lpOverlapped=0x0) returned 1 [0117.479] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.479] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.479] SetEndOfFile (hFile=0x210) returned 1 [0117.479] CloseHandle (hObject=0x210) returned 1 [0117.479] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.479] SetEndOfFile (hFile=0x1ec) returned 1 [0117.480] CloseHandle (hObject=0x1ec) returned 1 [0117.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx")) returned 1 [0117.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.481] lstrlenW (lpString=".doc") returned 4 [0117.481] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString=".docx") returned 5 [0117.481] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.481] lstrlenW (lpString=".pdf") returned 4 [0117.481] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString=".xls") returned 4 [0117.481] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString=".xlsx") returned 5 [0117.481] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.481] lstrlenW (lpString=".ppt") returned 4 [0117.481] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.481] lstrlenW (lpString=".zip") returned 4 [0117.481] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString=".rar") returned 4 [0117.481] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.481] lstrlenW (lpString=".bz2") returned 4 [0117.481] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.482] lstrlenW (lpString=".7z") returned 3 [0117.482] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.482] lstrlenW (lpString=".dbf") returned 4 [0117.482] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.482] lstrlenW (lpString=".1cd") returned 4 [0117.482] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 65 [0117.482] lstrlenW (lpString=".jpg") returned 4 [0117.482] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.482] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") [0117.482] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=93940) returned 1 [0117.483] CloseHandle (hObject=0x1ec) returned 1 [0117.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx")) returned 0x20 [0117.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.483] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.483] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.484] GetLastError () returned 0x0 [0117.484] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x16ef4, lpOverlapped=0x0) returned 1 [0117.632] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x16f00, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x16f00, lpOverlapped=0x0) returned 1 [0117.634] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.634] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0117.635] SetEndOfFile (hFile=0x210) returned 1 [0117.635] CloseHandle (hObject=0x210) returned 1 [0117.635] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.635] SetEndOfFile (hFile=0x1ec) returned 1 [0117.636] CloseHandle (hObject=0x1ec) returned 1 [0117.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx")) returned 1 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString=".doc") returned 4 [0117.637] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".docx") returned 5 [0117.637] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.637] lstrlenW (lpString=".pdf") returned 4 [0117.637] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".xls") returned 4 [0117.637] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".xlsx") returned 5 [0117.637] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.637] lstrlenW (lpString=".ppt") returned 4 [0117.637] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString=".zip") returned 4 [0117.637] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".rar") returned 4 [0117.637] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".bz2") returned 4 [0117.637] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString=".7z") returned 3 [0117.637] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString=".dbf") returned 4 [0117.637] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString=".1cd") returned 4 [0117.637] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 63 [0117.637] lstrlenW (lpString=".jpg") returned 4 [0117.637] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.637] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") [0117.638] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=89461) returned 1 [0117.638] CloseHandle (hObject=0x1ec) returned 1 [0117.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx")) returned 0x20 [0117.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.638] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.638] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.639] GetLastError () returned 0x0 [0117.639] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x15d75, lpOverlapped=0x0) returned 1 [0117.642] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x15d80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x15d80, lpOverlapped=0x0) returned 1 [0117.645] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.645] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.645] SetEndOfFile (hFile=0x210) returned 1 [0117.645] CloseHandle (hObject=0x210) returned 1 [0117.645] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.645] SetEndOfFile (hFile=0x1ec) returned 1 [0117.646] CloseHandle (hObject=0x1ec) returned 1 [0117.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx")) returned 1 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString=".doc") returned 4 [0117.647] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".docx") returned 5 [0117.647] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.647] lstrlenW (lpString=".pdf") returned 4 [0117.647] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".xls") returned 4 [0117.647] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".xlsx") returned 5 [0117.647] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.647] lstrlenW (lpString=".ppt") returned 4 [0117.647] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString=".zip") returned 4 [0117.647] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".rar") returned 4 [0117.647] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".bz2") returned 4 [0117.647] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString=".7z") returned 3 [0117.647] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString=".dbf") returned 4 [0117.647] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString=".1cd") returned 4 [0117.647] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 64 [0117.647] lstrlenW (lpString=".jpg") returned 4 [0117.647] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.648] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") [0117.649] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=928) returned 1 [0117.649] CloseHandle (hObject=0x1ec) returned 1 [0117.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml")) returned 0x20 [0117.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.649] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.649] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.650] GetLastError () returned 0x0 [0117.650] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3a0, lpOverlapped=0x0) returned 1 [0117.652] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0117.653] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.653] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee, lpOverlapped=0x0) returned 1 [0117.653] SetEndOfFile (hFile=0x210) returned 1 [0117.653] CloseHandle (hObject=0x210) returned 1 [0117.653] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.653] SetEndOfFile (hFile=0x1ec) returned 1 [0117.654] CloseHandle (hObject=0x1ec) returned 1 [0117.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml")) returned 1 [0117.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.654] lstrlenW (lpString=".doc") returned 4 [0117.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString=".docx") returned 5 [0117.655] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0117.655] lstrlenW (lpString=".pdf") returned 4 [0117.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString=".xls") returned 4 [0117.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString=".xlsx") returned 5 [0117.655] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0117.655] lstrlenW (lpString=".ppt") returned 4 [0117.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.655] lstrlenW (lpString=".zip") returned 4 [0117.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.655] lstrlenW (lpString=".rar") returned 4 [0117.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString=".bz2") returned 4 [0117.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString=".7z") returned 3 [0117.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.655] lstrlenW (lpString=".dbf") returned 4 [0117.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.655] lstrlenW (lpString=".1cd") returned 4 [0117.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 79 [0117.655] lstrlenW (lpString=".jpg") returned 4 [0117.655] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.655] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") [0117.656] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=925) returned 1 [0117.656] CloseHandle (hObject=0x1ec) returned 1 [0117.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml")) returned 0x20 [0117.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.656] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.656] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0117.657] GetLastError () returned 0x0 [0117.657] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x39d, lpOverlapped=0x0) returned 1 [0117.658] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0117.659] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0117.659] WriteFile (in: hFile=0x210, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0117.659] SetEndOfFile (hFile=0x210) returned 1 [0117.660] CloseHandle (hObject=0x210) returned 1 [0117.660] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0117.660] SetEndOfFile (hFile=0x1ec) returned 1 [0117.660] CloseHandle (hObject=0x1ec) returned 1 [0117.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml")) returned 1 [0117.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.661] lstrlenW (lpString=".doc") returned 4 [0117.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString=".docx") returned 5 [0117.661] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0117.661] lstrlenW (lpString=".pdf") returned 4 [0117.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString=".xls") returned 4 [0117.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString=".xlsx") returned 5 [0117.661] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0117.661] lstrlenW (lpString=".ppt") returned 4 [0117.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.661] lstrlenW (lpString=".zip") returned 4 [0117.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.661] lstrlenW (lpString=".rar") returned 4 [0117.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString=".bz2") returned 4 [0117.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.661] lstrlenW (lpString=".7z") returned 3 [0117.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.662] lstrlenW (lpString=".dbf") returned 4 [0117.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.662] lstrlenW (lpString=".1cd") returned 4 [0117.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 76 [0117.662] lstrlenW (lpString=".jpg") returned 4 [0117.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.662] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") [0118.340] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=959) returned 1 [0118.340] CloseHandle (hObject=0x19c) returned 1 [0118.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml")) returned 0x20 [0118.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.341] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.341] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.342] GetLastError () returned 0x0 [0118.342] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3bf, lpOverlapped=0x0) returned 1 [0118.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0118.345] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.345] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0118.345] SetEndOfFile (hFile=0x1a0) returned 1 [0118.346] CloseHandle (hObject=0x1a0) returned 1 [0118.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.346] SetEndOfFile (hFile=0x19c) returned 1 [0118.347] CloseHandle (hObject=0x19c) returned 1 [0118.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml")) returned 1 [0118.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.347] lstrlenW (lpString=".doc") returned 4 [0118.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.347] lstrlenW (lpString=".docx") returned 5 [0118.347] lstrcmpiW (lpString1=".docx", lpString2="x.xml") returned -1 [0118.347] lstrlenW (lpString=".pdf") returned 4 [0118.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.347] lstrlenW (lpString=".xls") returned 4 [0118.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.347] lstrlenW (lpString=".xlsx") returned 5 [0118.347] lstrcmpiW (lpString1=".xlsx", lpString2="x.xml") returned -1 [0118.347] lstrlenW (lpString=".ppt") returned 4 [0118.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.347] lstrlenW (lpString=".zip") returned 4 [0118.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.347] lstrlenW (lpString=".rar") returned 4 [0118.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.348] lstrlenW (lpString=".bz2") returned 4 [0118.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.348] lstrlenW (lpString=".7z") returned 3 [0118.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.348] lstrlenW (lpString=".dbf") returned 4 [0118.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.348] lstrlenW (lpString=".1cd") returned 4 [0118.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 74 [0118.348] lstrlenW (lpString=".jpg") returned 4 [0118.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.348] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") [0118.349] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=959) returned 1 [0118.349] CloseHandle (hObject=0x19c) returned 1 [0118.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml")) returned 0x20 [0118.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.349] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.349] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.350] GetLastError () returned 0x0 [0118.350] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3bf, lpOverlapped=0x0) returned 1 [0118.352] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0118.353] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.353] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0118.353] SetEndOfFile (hFile=0x1a0) returned 1 [0118.353] CloseHandle (hObject=0x1a0) returned 1 [0118.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.353] SetEndOfFile (hFile=0x19c) returned 1 [0118.354] CloseHandle (hObject=0x19c) returned 1 [0118.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml")) returned 1 [0118.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.354] lstrlenW (lpString=".doc") returned 4 [0118.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.354] lstrlenW (lpString=".docx") returned 5 [0118.355] lstrcmpiW (lpString1=".docx", lpString2="w.xml") returned -1 [0118.355] lstrlenW (lpString=".pdf") returned 4 [0118.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString=".xls") returned 4 [0118.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString=".xlsx") returned 5 [0118.355] lstrcmpiW (lpString1=".xlsx", lpString2="w.xml") returned -1 [0118.355] lstrlenW (lpString=".ppt") returned 4 [0118.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.355] lstrlenW (lpString=".zip") returned 4 [0118.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.355] lstrlenW (lpString=".rar") returned 4 [0118.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString=".bz2") returned 4 [0118.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString=".7z") returned 3 [0118.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.355] lstrlenW (lpString=".dbf") returned 4 [0118.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.355] lstrlenW (lpString=".1cd") returned 4 [0118.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 74 [0118.355] lstrlenW (lpString=".jpg") returned 4 [0118.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.355] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") [0118.356] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=962) returned 1 [0118.356] CloseHandle (hObject=0x19c) returned 1 [0118.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml")) returned 0x20 [0118.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.356] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.357] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.357] GetLastError () returned 0x0 [0118.357] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3c2, lpOverlapped=0x0) returned 1 [0118.359] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.360] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.360] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.360] SetEndOfFile (hFile=0x1a0) returned 1 [0118.360] CloseHandle (hObject=0x1a0) returned 1 [0118.360] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.360] SetEndOfFile (hFile=0x19c) returned 1 [0118.361] CloseHandle (hObject=0x19c) returned 1 [0118.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml")) returned 1 [0118.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.361] lstrlenW (lpString=".doc") returned 4 [0118.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.361] lstrlenW (lpString=".docx") returned 5 [0118.361] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0118.361] lstrlenW (lpString=".pdf") returned 4 [0118.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.361] lstrlenW (lpString=".xls") returned 4 [0118.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.361] lstrlenW (lpString=".xlsx") returned 5 [0118.362] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0118.362] lstrlenW (lpString=".ppt") returned 4 [0118.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.362] lstrlenW (lpString=".zip") returned 4 [0118.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.362] lstrlenW (lpString=".rar") returned 4 [0118.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.362] lstrlenW (lpString=".bz2") returned 4 [0118.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.362] lstrlenW (lpString=".7z") returned 3 [0118.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.362] lstrlenW (lpString=".dbf") returned 4 [0118.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.362] lstrlenW (lpString=".1cd") returned 4 [0118.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 77 [0118.362] lstrlenW (lpString=".jpg") returned 4 [0118.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.362] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") [0118.363] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=928) returned 1 [0118.363] CloseHandle (hObject=0x19c) returned 1 [0118.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml")) returned 0x20 [0118.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.364] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.364] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.364] GetLastError () returned 0x0 [0118.364] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3a0, lpOverlapped=0x0) returned 1 [0118.366] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0118.367] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.367] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.367] SetEndOfFile (hFile=0x1a0) returned 1 [0118.367] CloseHandle (hObject=0x1a0) returned 1 [0118.367] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.367] SetEndOfFile (hFile=0x19c) returned 1 [0118.368] CloseHandle (hObject=0x19c) returned 1 [0118.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml")) returned 1 [0118.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.369] lstrlenW (lpString=".doc") returned 4 [0118.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString=".docx") returned 5 [0118.369] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.369] lstrlenW (lpString=".pdf") returned 4 [0118.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString=".xls") returned 4 [0118.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString=".xlsx") returned 5 [0118.369] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.369] lstrlenW (lpString=".ppt") returned 4 [0118.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.369] lstrlenW (lpString=".zip") returned 4 [0118.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.369] lstrlenW (lpString=".rar") returned 4 [0118.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString=".bz2") returned 4 [0118.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString=".7z") returned 3 [0118.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.369] lstrlenW (lpString=".dbf") returned 4 [0118.369] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.369] lstrlenW (lpString=".1cd") returned 4 [0118.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 79 [0118.370] lstrlenW (lpString=".jpg") returned 4 [0118.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.370] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") [0118.370] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=959) returned 1 [0118.370] CloseHandle (hObject=0x19c) returned 1 [0118.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml")) returned 0x20 [0118.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.371] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.371] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.371] GetLastError () returned 0x0 [0118.371] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3bf, lpOverlapped=0x0) returned 1 [0118.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0118.374] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.374] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0118.374] SetEndOfFile (hFile=0x1a0) returned 1 [0118.374] CloseHandle (hObject=0x1a0) returned 1 [0118.374] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.374] SetEndOfFile (hFile=0x19c) returned 1 [0118.375] CloseHandle (hObject=0x19c) returned 1 [0118.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml")) returned 1 [0118.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.375] lstrlenW (lpString=".doc") returned 4 [0118.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString=".docx") returned 5 [0118.376] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0118.376] lstrlenW (lpString=".pdf") returned 4 [0118.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString=".xls") returned 4 [0118.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString=".xlsx") returned 5 [0118.376] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0118.376] lstrlenW (lpString=".ppt") returned 4 [0118.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.376] lstrlenW (lpString=".zip") returned 4 [0118.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.376] lstrlenW (lpString=".rar") returned 4 [0118.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString=".bz2") returned 4 [0118.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString=".7z") returned 3 [0118.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.376] lstrlenW (lpString=".dbf") returned 4 [0118.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.376] lstrlenW (lpString=".1cd") returned 4 [0118.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 74 [0118.376] lstrlenW (lpString=".jpg") returned 4 [0118.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.376] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") [0118.377] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=964) returned 1 [0118.377] CloseHandle (hObject=0x19c) returned 1 [0118.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml")) returned 0x20 [0118.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.377] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.377] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.378] GetLastError () returned 0x0 [0118.378] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.381] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.382] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.382] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.382] SetEndOfFile (hFile=0x1a0) returned 1 [0118.382] CloseHandle (hObject=0x1a0) returned 1 [0118.382] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.382] SetEndOfFile (hFile=0x19c) returned 1 [0118.383] CloseHandle (hObject=0x19c) returned 1 [0118.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml")) returned 1 [0118.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.383] lstrlenW (lpString=".doc") returned 4 [0118.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.383] lstrlenW (lpString=".docx") returned 5 [0118.384] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0118.384] lstrlenW (lpString=".pdf") returned 4 [0118.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString=".xls") returned 4 [0118.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString=".xlsx") returned 5 [0118.384] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0118.384] lstrlenW (lpString=".ppt") returned 4 [0118.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.384] lstrlenW (lpString=".zip") returned 4 [0118.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.384] lstrlenW (lpString=".rar") returned 4 [0118.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString=".bz2") returned 4 [0118.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString=".7z") returned 3 [0118.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.384] lstrlenW (lpString=".dbf") returned 4 [0118.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.384] lstrlenW (lpString=".1cd") returned 4 [0118.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 79 [0118.384] lstrlenW (lpString=".jpg") returned 4 [0118.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.384] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") [0118.385] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=926) returned 1 [0118.385] CloseHandle (hObject=0x19c) returned 1 [0118.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml")) returned 0x20 [0118.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.385] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.385] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.386] GetLastError () returned 0x0 [0118.386] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x39e, lpOverlapped=0x0) returned 1 [0118.388] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0118.389] ReadFile (in: hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0118.389] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b30020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.389] SetEndOfFile (hFile=0x1a0) returned 1 [0118.389] CloseHandle (hObject=0x1a0) returned 1 [0118.389] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.389] SetEndOfFile (hFile=0x19c) returned 1 [0118.390] CloseHandle (hObject=0x19c) returned 1 [0118.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml")) returned 1 [0118.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.390] lstrlenW (lpString=".doc") returned 4 [0118.390] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.390] lstrlenW (lpString=".docx") returned 5 [0118.390] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0118.390] lstrlenW (lpString=".pdf") returned 4 [0118.390] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.390] lstrlenW (lpString=".xls") returned 4 [0118.390] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.390] lstrlenW (lpString=".xlsx") returned 5 [0118.390] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0118.390] lstrlenW (lpString=".ppt") returned 4 [0118.391] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.391] lstrlenW (lpString=".zip") returned 4 [0118.391] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.391] lstrlenW (lpString=".rar") returned 4 [0118.391] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.391] lstrlenW (lpString=".bz2") returned 4 [0118.391] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.391] lstrlenW (lpString=".7z") returned 3 [0118.391] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.391] lstrlenW (lpString=".dbf") returned 4 [0118.391] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.391] lstrlenW (lpString=".1cd") returned 4 [0118.391] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 77 [0118.391] lstrlenW (lpString=".jpg") returned 4 [0118.391] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.391] RtlInitUnicodeStringEx (DestinationString=0x2fafee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") [0118.392] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=961) returned 1 [0118.392] CloseHandle (hObject=0x19c) returned 1 [0118.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml")) returned 0x20 [0118.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.392] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.392] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0118.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0118.393] GetLastError () returned 0x0 [0118.393] ReadFile (hFile=0x19c, lpBuffer=0x3b30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0x9d8 [0033.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3770290 [0033.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3780298 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641210 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6416c0 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641228 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3c40020 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641240 [0033.723] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641240, Size=0x20) returned 0x629f70 [0033.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641240 [0033.723] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641240, Size=0x20) returned 0x629f48 [0033.723] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.723] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.723] Wow64DisableWow64FsRedirection (in: OldValue=0x30eff58 | out: OldValue=0x30eff58*=0x0) returned 1 [0033.723] lstrlenW (lpString="kernel32.dll") returned 12 [0033.724] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.724] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.724] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.724] Sleep (dwMilliseconds=0x64) [0033.918] lstrcmpiW (lpString1=".ttf", lpString2=".zoh") returned -1 [0033.918] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0033.918] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.431] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1984228) returned 1 [0034.431] CloseHandle (hObject=0x198) returned 1 [0034.432] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0034.439] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.439] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0034.440] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.440] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.440] lstrlenW (lpString=".doc") returned 4 [0034.452] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.452] lstrlenW (lpString=".docx") returned 5 [0034.452] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.452] lstrlenW (lpString=".pdf") returned 4 [0034.453] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.453] lstrlenW (lpString=".xls") returned 4 [0034.453] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.453] lstrlenW (lpString=".xlsx") returned 5 [0034.453] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.453] lstrlenW (lpString=".ppt") returned 4 [0034.453] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.453] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.453] lstrlenW (lpString=".zip") returned 4 [0034.453] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.453] lstrlenW (lpString=".rar") returned 4 [0034.471] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.471] lstrlenW (lpString=".bz2") returned 4 [0034.471] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.471] lstrlenW (lpString=".7z") returned 3 [0034.471] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.471] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.471] lstrlenW (lpString=".dbf") returned 4 [0034.472] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString=".1cd") returned 4 [0034.472] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString=".jpg") returned 4 [0034.472] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString=".doc") returned 4 [0034.472] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString=".docx") returned 5 [0034.472] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.472] lstrlenW (lpString=".pdf") returned 4 [0034.472] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString=".xls") returned 4 [0034.472] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.472] lstrlenW (lpString=".xlsx") returned 5 [0034.472] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.472] lstrlenW (lpString=".ppt") returned 4 [0034.472] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString=".zip") returned 4 [0034.472] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.472] lstrlenW (lpString=".rar") returned 4 [0034.472] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString=".bz2") returned 4 [0034.472] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString=".7z") returned 3 [0034.472] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.472] lstrlenW (lpString=".dbf") returned 4 [0034.472] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.472] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.473] lstrlenW (lpString=".1cd") returned 4 [0034.473] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.473] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0034.473] lstrlenW (lpString=".jpg") returned 4 [0034.473] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.473] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0034.473] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0034.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.473] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2503680) returned 1 [0034.473] CloseHandle (hObject=0x198) returned 1 [0034.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0034.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.473] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0034.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.474] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0034.474] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0034.474] ReadFile (in: hFile=0x198, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.596] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0034.596] ReadFile (in: hFile=0x198, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.610] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.610] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0034.610] ReadFile (in: hFile=0x198, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.403] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0035.403] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0035.422] SetEndOfFile (hFile=0x198) returned 1 [0035.422] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4008600 [0035.422] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0035.422] WriteFile (in: hFile=0x198, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.424] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0035.424] WriteFile (in: hFile=0x198, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.430] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0035.430] WriteFile (in: hFile=0x198, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.433] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.433] CloseHandle (hObject=0x198) returned 1 [0036.423] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.424] lstrlenW (lpString=".doc") returned 4 [0036.424] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.424] lstrlenW (lpString=".docx") returned 5 [0036.424] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.424] lstrlenW (lpString=".pdf") returned 4 [0036.424] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.424] lstrlenW (lpString=".xls") returned 4 [0036.424] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.424] lstrlenW (lpString=".xlsx") returned 5 [0036.424] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.424] lstrlenW (lpString=".ppt") returned 4 [0036.424] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.424] lstrlenW (lpString=".zip") returned 4 [0036.424] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.424] lstrlenW (lpString=".rar") returned 4 [0036.424] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.424] lstrlenW (lpString=".bz2") returned 4 [0036.424] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.424] lstrlenW (lpString=".7z") returned 3 [0036.424] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.424] lstrlenW (lpString=".dbf") returned 4 [0036.424] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.424] lstrlenW (lpString=".1cd") returned 4 [0036.424] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".jpg") returned 4 [0036.425] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".doc") returned 4 [0036.425] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.425] lstrlenW (lpString=".docx") returned 5 [0036.425] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.425] lstrlenW (lpString=".pdf") returned 4 [0036.425] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.425] lstrlenW (lpString=".xls") returned 4 [0036.425] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.425] lstrlenW (lpString=".xlsx") returned 5 [0036.425] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.425] lstrlenW (lpString=".ppt") returned 4 [0036.425] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".zip") returned 4 [0036.425] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.425] lstrlenW (lpString=".rar") returned 4 [0036.425] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.425] lstrlenW (lpString=".bz2") returned 4 [0036.425] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.425] lstrlenW (lpString=".7z") returned 3 [0036.425] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".dbf") returned 4 [0036.425] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".1cd") returned 4 [0036.425] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.425] lstrlenW (lpString=".jpg") returned 4 [0036.426] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.426] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0036.426] lstrlenW (lpString="PubLR.cab") returned 9 [0036.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.426] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9958388) returned 1 [0036.426] CloseHandle (hObject=0x198) returned 1 [0036.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0036.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.426] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0036.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.427] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0036.427] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0036.427] ReadFile (in: hFile=0x198, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.431] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0036.431] ReadFile (in: hFile=0x198, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.443] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.443] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0036.443] ReadFile (in: hFile=0x198, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.462] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0036.463] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.754] SetEndOfFile (hFile=0x198) returned 1 [0036.755] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0036.755] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0036.755] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.756] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0036.756] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.760] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0036.760] WriteFile (in: hFile=0x198, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.765] CloseHandle (hObject=0x198) returned 1 [0039.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString=".doc") returned 4 [0039.555] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString=".docx") returned 5 [0039.555] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.555] lstrlenW (lpString=".pdf") returned 4 [0039.555] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString=".xls") returned 4 [0039.555] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString=".xlsx") returned 5 [0039.555] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.555] lstrlenW (lpString=".ppt") returned 4 [0039.555] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString=".zip") returned 4 [0039.555] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString=".rar") returned 4 [0039.555] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString=".bz2") returned 4 [0039.555] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.555] lstrlenW (lpString=".7z") returned 3 [0039.555] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString=".dbf") returned 4 [0039.555] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString=".1cd") returned 4 [0039.555] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.555] lstrlenW (lpString=".jpg") returned 4 [0039.555] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString=".doc") returned 4 [0039.556] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString=".docx") returned 5 [0039.556] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.556] lstrlenW (lpString=".pdf") returned 4 [0039.556] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString=".xls") returned 4 [0039.556] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString=".xlsx") returned 5 [0039.556] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.556] lstrlenW (lpString=".ppt") returned 4 [0039.556] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString=".zip") returned 4 [0039.556] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString=".rar") returned 4 [0039.556] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString=".bz2") returned 4 [0039.556] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.556] lstrlenW (lpString=".7z") returned 3 [0039.556] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString=".dbf") returned 4 [0039.556] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString=".1cd") returned 4 [0039.556] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.556] lstrlenW (lpString=".jpg") returned 4 [0039.556] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.557] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0039.557] lstrlenW (lpString="Proof.cab") returned 9 [0039.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.557] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=11482605) returned 1 [0039.557] CloseHandle (hObject=0x198) returned 1 [0039.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0039.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.557] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0039.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.559] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0039.559] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0039.559] ReadFile (in: hFile=0x198, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.564] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0039.564] ReadFile (in: hFile=0x198, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.569] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.570] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0039.570] ReadFile (in: hFile=0x198, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.586] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0039.586] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.853] SetEndOfFile (hFile=0x198) returned 1 [0039.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x40b8628 [0039.869] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0039.869] WriteFile (in: hFile=0x198, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.870] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0039.870] WriteFile (in: hFile=0x198, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.872] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0039.872] WriteFile (in: hFile=0x198, lpBuffer=0x40b8628*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x40b8628*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.874] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40b8628 | out: hHeap=0x5c0000) returned 1 [0039.874] CloseHandle (hObject=0x198) returned 1 [0041.419] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0041.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".doc") returned 4 [0041.420] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString=".docx") returned 5 [0041.420] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.420] lstrlenW (lpString=".pdf") returned 4 [0041.420] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString=".xls") returned 4 [0041.420] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString=".xlsx") returned 5 [0041.420] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.420] lstrlenW (lpString=".ppt") returned 4 [0041.420] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".zip") returned 4 [0041.420] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString=".rar") returned 4 [0041.420] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString=".bz2") returned 4 [0041.420] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.420] lstrlenW (lpString=".7z") returned 3 [0041.420] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".dbf") returned 4 [0041.420] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".1cd") returned 4 [0041.420] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".jpg") returned 4 [0041.420] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.420] lstrlenW (lpString=".doc") returned 4 [0041.420] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString=".docx") returned 5 [0041.421] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.421] lstrlenW (lpString=".pdf") returned 4 [0041.421] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString=".xls") returned 4 [0041.421] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString=".xlsx") returned 5 [0041.421] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.421] lstrlenW (lpString=".ppt") returned 4 [0041.421] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.421] lstrlenW (lpString=".zip") returned 4 [0041.421] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString=".rar") returned 4 [0041.421] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString=".bz2") returned 4 [0041.421] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.421] lstrlenW (lpString=".7z") returned 3 [0041.421] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.421] lstrlenW (lpString=".dbf") returned 4 [0041.421] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.421] lstrlenW (lpString=".1cd") returned 4 [0041.421] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.421] lstrlenW (lpString=".jpg") returned 4 [0041.421] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.421] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0041.422] lstrlenW (lpString="Proof.msi") returned 9 [0041.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0041.852] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=885760) returned 1 [0041.852] CloseHandle (hObject=0x1f8) returned 1 [0041.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0041.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0041.853] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0041.853] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0041.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0041.853] GetLastError () returned 0x0 [0041.853] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd8400, lpOverlapped=0x0) returned 1 [0042.065] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0042.081] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0042.082] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.082] SetEndOfFile (hFile=0x1ec) returned 1 [0042.082] CloseHandle (hObject=0x1ec) returned 1 [0042.452] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0042.452] SetEndOfFile (hFile=0x1f8) returned 1 [0042.460] CloseHandle (hObject=0x1f8) returned 1 [0042.460] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0042.460] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0042.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.460] lstrlenW (lpString=".doc") returned 4 [0042.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.460] lstrlenW (lpString=".docx") returned 5 [0042.460] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.460] lstrlenW (lpString=".pdf") returned 4 [0042.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.460] lstrlenW (lpString=".xls") returned 4 [0042.461] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.461] lstrlenW (lpString=".xlsx") returned 5 [0042.461] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.461] lstrlenW (lpString=".ppt") returned 4 [0042.461] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString=".zip") returned 4 [0042.461] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.461] lstrlenW (lpString=".rar") returned 4 [0042.461] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.461] lstrlenW (lpString=".bz2") returned 4 [0042.461] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.461] lstrlenW (lpString=".7z") returned 3 [0042.461] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString=".dbf") returned 4 [0042.461] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString=".1cd") returned 4 [0042.461] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString=".jpg") returned 4 [0042.461] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.461] lstrlenW (lpString=".doc") returned 4 [0042.461] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.461] lstrlenW (lpString=".docx") returned 5 [0042.461] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.461] lstrlenW (lpString=".pdf") returned 4 [0042.461] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.461] lstrlenW (lpString=".xls") returned 4 [0042.462] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.462] lstrlenW (lpString=".xlsx") returned 5 [0042.462] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.462] lstrlenW (lpString=".ppt") returned 4 [0042.462] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.462] lstrlenW (lpString=".zip") returned 4 [0042.462] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.462] lstrlenW (lpString=".rar") returned 4 [0042.462] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.462] lstrlenW (lpString=".bz2") returned 4 [0042.462] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.462] lstrlenW (lpString=".7z") returned 3 [0042.462] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.462] lstrlenW (lpString=".dbf") returned 4 [0042.462] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.462] lstrlenW (lpString=".1cd") returned 4 [0042.462] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.462] lstrlenW (lpString=".jpg") returned 4 [0042.462] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.462] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0042.462] lstrlenW (lpString="InfLR.cab") returned 9 [0042.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.463] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=18874884) returned 1 [0042.463] CloseHandle (hObject=0x1f8) returned 1 [0042.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0042.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.463] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0042.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0042.464] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0042.464] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0042.464] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.467] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0042.467] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.476] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.477] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0042.477] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.791] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0042.791] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.867] SetEndOfFile (hFile=0x1f8) returned 1 [0042.867] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4078620 [0042.867] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0042.867] WriteFile (in: hFile=0x1f8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.869] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0042.869] WriteFile (in: hFile=0x1f8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.872] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0042.872] WriteFile (in: hFile=0x1f8, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.876] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4078620 | out: hHeap=0x5c0000) returned 1 [0042.876] CloseHandle (hObject=0x1f8) returned 1 [0045.344] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.345] lstrlenW (lpString=".doc") returned 4 [0045.345] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".docx") returned 5 [0045.345] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.345] lstrlenW (lpString=".pdf") returned 4 [0045.345] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".xls") returned 4 [0045.345] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".xlsx") returned 5 [0045.345] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.345] lstrlenW (lpString=".ppt") returned 4 [0045.345] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.345] lstrlenW (lpString=".zip") returned 4 [0045.345] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".rar") returned 4 [0045.345] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".bz2") returned 4 [0045.345] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.345] lstrlenW (lpString=".7z") returned 3 [0045.345] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString=".dbf") returned 4 [0045.346] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString=".1cd") returned 4 [0045.346] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString=".jpg") returned 4 [0045.346] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString=".doc") returned 4 [0045.346] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString=".docx") returned 5 [0045.346] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.346] lstrlenW (lpString=".pdf") returned 4 [0045.346] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString=".xls") returned 4 [0045.346] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString=".xlsx") returned 5 [0045.346] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.346] lstrlenW (lpString=".ppt") returned 4 [0045.346] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.346] lstrlenW (lpString=".zip") returned 4 [0045.346] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString=".rar") returned 4 [0045.346] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.346] lstrlenW (lpString=".bz2") returned 4 [0045.346] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.347] lstrlenW (lpString=".7z") returned 3 [0045.347] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.347] lstrlenW (lpString=".dbf") returned 4 [0045.347] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.347] lstrlenW (lpString=".1cd") returned 4 [0045.347] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0045.347] lstrlenW (lpString=".jpg") returned 4 [0045.347] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.347] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0045.347] lstrlenW (lpString="dwintl20.dll") returned 12 [0045.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.348] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=107912) returned 1 [0045.348] CloseHandle (hObject=0x1f8) returned 1 [0045.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0045.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.348] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0045.348] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0045.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.498] GetLastError () returned 0x0 [0045.498] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1a588, lpOverlapped=0x0) returned 1 [0045.502] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0045.504] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0045.504] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.504] SetEndOfFile (hFile=0x1fc) returned 1 [0045.504] CloseHandle (hObject=0x1fc) returned 1 [0045.504] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0045.504] SetEndOfFile (hFile=0x1f8) returned 1 [0045.506] CloseHandle (hObject=0x1f8) returned 1 [0045.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.506] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0045.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.506] lstrlenW (lpString=".doc") returned 4 [0045.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.506] lstrlenW (lpString=".docx") returned 5 [0045.506] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.506] lstrlenW (lpString=".pdf") returned 4 [0045.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.506] lstrlenW (lpString=".xls") returned 4 [0045.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString=".xlsx") returned 5 [0045.507] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.507] lstrlenW (lpString=".ppt") returned 4 [0045.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString=".zip") returned 4 [0045.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString=".rar") returned 4 [0045.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString=".bz2") returned 4 [0045.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.507] lstrlenW (lpString=".7z") returned 3 [0045.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString=".dbf") returned 4 [0045.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString=".1cd") returned 4 [0045.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString=".jpg") returned 4 [0045.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.507] lstrlenW (lpString=".doc") returned 4 [0045.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString=".docx") returned 5 [0045.507] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.507] lstrlenW (lpString=".pdf") returned 4 [0045.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.507] lstrlenW (lpString=".xls") returned 4 [0045.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.508] lstrlenW (lpString=".xlsx") returned 5 [0045.508] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.508] lstrlenW (lpString=".ppt") returned 4 [0045.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.508] lstrlenW (lpString=".zip") returned 4 [0045.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.508] lstrlenW (lpString=".rar") returned 4 [0045.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.508] lstrlenW (lpString=".bz2") returned 4 [0045.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.508] lstrlenW (lpString=".7z") returned 3 [0045.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.508] lstrlenW (lpString=".dbf") returned 4 [0045.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.508] lstrlenW (lpString=".1cd") returned 4 [0045.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0045.508] lstrlenW (lpString=".jpg") returned 4 [0045.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.508] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0045.508] lstrlenW (lpString="DW20.EXE") returned 8 [0045.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.509] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=838536) returned 1 [0045.509] CloseHandle (hObject=0x1f8) returned 1 [0045.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0045.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.510] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0045.510] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0045.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0045.510] GetLastError () returned 0x0 [0045.510] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xccb88, lpOverlapped=0x0) returned 1 [0045.527] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0045.758] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0045.758] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0045.758] SetEndOfFile (hFile=0x1fc) returned 1 [0046.443] CloseHandle (hObject=0x1fc) returned 1 [0046.443] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0046.443] SetEndOfFile (hFile=0x1f8) returned 1 [0046.450] CloseHandle (hObject=0x1f8) returned 1 [0046.450] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.451] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.451] lstrlenW (lpString=".doc") returned 4 [0046.451] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.451] lstrlenW (lpString=".docx") returned 5 [0046.451] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.451] lstrlenW (lpString=".pdf") returned 4 [0046.451] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.451] lstrlenW (lpString=".xls") returned 4 [0046.451] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.451] lstrlenW (lpString=".xlsx") returned 5 [0046.451] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.451] lstrlenW (lpString=".ppt") returned 4 [0046.451] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.451] lstrlenW (lpString=".zip") returned 4 [0046.451] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.451] lstrlenW (lpString=".rar") returned 4 [0046.451] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.451] lstrlenW (lpString=".bz2") returned 4 [0046.451] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.451] lstrlenW (lpString=".7z") returned 3 [0046.452] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.452] lstrlenW (lpString=".dbf") returned 4 [0046.452] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.452] lstrlenW (lpString=".1cd") returned 4 [0046.452] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.452] lstrlenW (lpString=".jpg") returned 4 [0046.452] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.452] lstrlenW (lpString=".doc") returned 4 [0046.452] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.452] lstrlenW (lpString=".docx") returned 5 [0046.452] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.452] lstrlenW (lpString=".pdf") returned 4 [0046.452] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.452] lstrlenW (lpString=".xls") returned 4 [0046.452] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.452] lstrlenW (lpString=".xlsx") returned 5 [0046.452] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.452] lstrlenW (lpString=".ppt") returned 4 [0046.453] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.453] lstrlenW (lpString=".zip") returned 4 [0046.453] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.453] lstrlenW (lpString=".rar") returned 4 [0046.453] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.453] lstrlenW (lpString=".bz2") returned 4 [0046.453] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.453] lstrlenW (lpString=".7z") returned 3 [0046.453] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.453] lstrlenW (lpString=".dbf") returned 4 [0046.453] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.453] lstrlenW (lpString=".1cd") returned 4 [0046.453] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.453] lstrlenW (lpString=".jpg") returned 4 [0046.453] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.453] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0046.453] lstrlenW (lpString="OfficeLR.cab") returned 12 [0046.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.454] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14127746) returned 1 [0046.454] CloseHandle (hObject=0x1f8) returned 1 [0046.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0046.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.454] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0046.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0046.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.455] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.531] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.531] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.635] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.635] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.635] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.668] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0046.668] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.758] SetEndOfFile (hFile=0x1f8) returned 1 [0046.759] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0046.763] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0046.763] WriteFile (in: hFile=0x1f8, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.867] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0046.867] WriteFile (in: hFile=0x1f8, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.868] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0046.868] WriteFile (in: hFile=0x1f8, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.870] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0046.870] CloseHandle (hObject=0x1f8) returned 1 [0046.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.871] lstrlenW (lpString=".doc") returned 4 [0046.871] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString=".docx") returned 5 [0046.871] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.871] lstrlenW (lpString=".pdf") returned 4 [0046.871] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString=".xls") returned 4 [0046.871] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString=".xlsx") returned 5 [0046.871] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.871] lstrlenW (lpString=".ppt") returned 4 [0046.871] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.871] lstrlenW (lpString=".zip") returned 4 [0046.871] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString=".rar") returned 4 [0046.871] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString=".bz2") returned 4 [0046.871] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.871] lstrlenW (lpString=".7z") returned 3 [0046.871] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.871] lstrlenW (lpString=".dbf") returned 4 [0046.871] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.871] lstrlenW (lpString=".1cd") returned 4 [0046.871] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.872] lstrlenW (lpString=".jpg") returned 4 [0046.872] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.872] lstrlenW (lpString=".doc") returned 4 [0046.872] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString=".docx") returned 5 [0046.872] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.872] lstrlenW (lpString=".pdf") returned 4 [0046.872] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString=".xls") returned 4 [0046.872] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString=".xlsx") returned 5 [0046.872] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.872] lstrlenW (lpString=".ppt") returned 4 [0046.872] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.872] lstrlenW (lpString=".zip") returned 4 [0046.872] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString=".rar") returned 4 [0046.872] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString=".bz2") returned 4 [0046.872] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.872] lstrlenW (lpString=".7z") returned 3 [0046.872] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.872] lstrlenW (lpString=".dbf") returned 4 [0046.872] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.873] lstrlenW (lpString=".1cd") returned 4 [0046.873] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.873] lstrlenW (lpString=".jpg") returned 4 [0046.873] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.873] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0046.873] lstrlenW (lpString="AccessMUI.msi") returned 13 [0046.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.907] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2517504) returned 1 [0046.907] CloseHandle (hObject=0x16c) returned 1 [0046.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0046.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.907] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0046.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.908] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0046.908] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.908] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.944] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.944] ReadFile (in: hFile=0x16c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.994] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.994] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0046.994] ReadFile (in: hFile=0x16c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.146] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0047.146] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.580] SetEndOfFile (hFile=0x16c) returned 1 [0047.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4118010 [0047.581] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0047.581] WriteFile (in: hFile=0x16c, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0047.582] WriteFile (in: hFile=0x16c, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.588] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0047.588] WriteFile (in: hFile=0x16c, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.591] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4118010 | out: hHeap=0x5c0000) returned 1 [0047.591] CloseHandle (hObject=0x16c) returned 1 [0047.592] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0047.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.592] lstrlenW (lpString=".doc") returned 4 [0047.592] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.592] lstrlenW (lpString=".docx") returned 5 [0047.592] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.592] lstrlenW (lpString=".pdf") returned 4 [0047.592] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.592] lstrlenW (lpString=".xls") returned 4 [0047.592] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.592] lstrlenW (lpString=".xlsx") returned 5 [0047.592] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.592] lstrlenW (lpString=".ppt") returned 4 [0047.592] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.592] lstrlenW (lpString=".zip") returned 4 [0047.592] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.592] lstrlenW (lpString=".rar") returned 4 [0047.593] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.593] lstrlenW (lpString=".bz2") returned 4 [0047.593] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.593] lstrlenW (lpString=".7z") returned 3 [0047.593] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.593] lstrlenW (lpString=".dbf") returned 4 [0047.593] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.593] lstrlenW (lpString=".1cd") returned 4 [0047.593] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.593] lstrlenW (lpString=".jpg") returned 4 [0047.593] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.593] lstrlenW (lpString=".doc") returned 4 [0047.593] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.593] lstrlenW (lpString=".docx") returned 5 [0047.593] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.593] lstrlenW (lpString=".pdf") returned 4 [0047.593] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.593] lstrlenW (lpString=".xls") returned 4 [0047.593] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.593] lstrlenW (lpString=".xlsx") returned 5 [0047.593] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.593] lstrlenW (lpString=".ppt") returned 4 [0047.593] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.594] lstrlenW (lpString=".zip") returned 4 [0047.594] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.594] lstrlenW (lpString=".rar") returned 4 [0047.594] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.594] lstrlenW (lpString=".bz2") returned 4 [0047.594] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.594] lstrlenW (lpString=".7z") returned 3 [0047.594] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.594] lstrlenW (lpString=".dbf") returned 4 [0047.594] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.594] lstrlenW (lpString=".1cd") returned 4 [0047.594] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.594] lstrlenW (lpString=".jpg") returned 4 [0047.594] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.594] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0047.594] lstrlenW (lpString="osetup.dll") returned 10 [0047.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.595] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7378792) returned 1 [0047.595] CloseHandle (hObject=0x16c) returned 1 [0047.595] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0047.595] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.595] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0047.595] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.596] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0047.596] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0047.596] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.114] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0048.114] ReadFile (in: hFile=0x16c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.446] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.446] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0048.446] ReadFile (in: hFile=0x16c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.547] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0048.547] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.832] SetEndOfFile (hFile=0x16c) returned 1 [0048.832] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0048.836] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0048.836] WriteFile (in: hFile=0x16c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.837] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0048.837] WriteFile (in: hFile=0x16c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.839] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0048.840] WriteFile (in: hFile=0x16c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0048.841] CloseHandle (hObject=0x16c) returned 1 [0048.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.841] lstrlenW (lpString=".doc") returned 4 [0048.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString=".docx") returned 5 [0048.842] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.842] lstrlenW (lpString=".pdf") returned 4 [0048.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString=".xls") returned 4 [0048.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString=".xlsx") returned 5 [0048.842] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.842] lstrlenW (lpString=".ppt") returned 4 [0048.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString=".zip") returned 4 [0048.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString=".rar") returned 4 [0048.842] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString=".bz2") returned 4 [0048.842] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.842] lstrlenW (lpString=".7z") returned 3 [0048.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString=".dbf") returned 4 [0048.842] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString=".1cd") returned 4 [0048.842] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString=".jpg") returned 4 [0048.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.842] lstrlenW (lpString=".doc") returned 4 [0048.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString=".docx") returned 5 [0048.843] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.843] lstrlenW (lpString=".pdf") returned 4 [0048.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString=".xls") returned 4 [0048.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString=".xlsx") returned 5 [0048.843] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.843] lstrlenW (lpString=".ppt") returned 4 [0048.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.843] lstrlenW (lpString=".zip") returned 4 [0048.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString=".rar") returned 4 [0048.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.843] lstrlenW (lpString=".bz2") returned 4 [0048.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.843] lstrlenW (lpString=".7z") returned 3 [0048.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.843] lstrlenW (lpString=".dbf") returned 4 [0048.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.843] lstrlenW (lpString=".1cd") returned 4 [0048.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.843] lstrlenW (lpString=".jpg") returned 4 [0048.843] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.843] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0048.843] lstrlenW (lpString="setup.exe") returned 9 [0048.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0048.844] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1377656) returned 1 [0048.844] CloseHandle (hObject=0x16c) returned 1 [0048.844] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0048.844] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0048.844] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0048.844] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0048.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.361] GetLastError () returned 0x0 [0049.361] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.387] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.870] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.883] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.892] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0049.892] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.892] SetEndOfFile (hFile=0x1f4) returned 1 [0049.893] CloseHandle (hObject=0x1f4) returned 1 [0049.893] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0049.893] SetEndOfFile (hFile=0x16c) returned 1 [0049.896] CloseHandle (hObject=0x16c) returned 1 [0049.896] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0049.896] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString=".doc") returned 4 [0049.897] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.897] lstrlenW (lpString=".docx") returned 5 [0049.897] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.897] lstrlenW (lpString=".pdf") returned 4 [0049.897] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.897] lstrlenW (lpString=".xls") returned 4 [0049.897] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.897] lstrlenW (lpString=".xlsx") returned 5 [0049.897] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.897] lstrlenW (lpString=".ppt") returned 4 [0049.897] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString=".zip") returned 4 [0049.897] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.897] lstrlenW (lpString=".rar") returned 4 [0049.897] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.897] lstrlenW (lpString=".bz2") returned 4 [0049.897] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.897] lstrlenW (lpString=".7z") returned 3 [0049.897] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString=".dbf") returned 4 [0049.897] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString=".1cd") returned 4 [0049.897] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.897] lstrlenW (lpString=".jpg") returned 4 [0049.898] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.898] lstrlenW (lpString=".doc") returned 4 [0049.898] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.898] lstrlenW (lpString=".docx") returned 5 [0049.898] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.898] lstrlenW (lpString=".pdf") returned 4 [0049.898] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString=".xls") returned 4 [0049.898] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString=".xlsx") returned 5 [0049.898] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.898] lstrlenW (lpString=".ppt") returned 4 [0049.898] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.898] lstrlenW (lpString=".zip") returned 4 [0049.898] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString=".rar") returned 4 [0049.898] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.898] lstrlenW (lpString=".bz2") returned 4 [0049.898] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.898] lstrlenW (lpString=".7z") returned 3 [0049.898] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.898] lstrlenW (lpString=".dbf") returned 4 [0049.898] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.898] lstrlenW (lpString=".1cd") returned 4 [0049.898] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.899] lstrlenW (lpString=".jpg") returned 4 [0049.899] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.899] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0049.899] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0049.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.194] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36233052) returned 1 [0050.194] CloseHandle (hObject=0x1f4) returned 1 [0050.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0050.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.194] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0050.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.243] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0050.243] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0050.243] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.248] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0050.248] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.254] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.254] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0050.254] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.274] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.594] SetEndOfFile (hFile=0x1f4) returned 1 [0050.594] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0050.597] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0050.597] WriteFile (in: hFile=0x1f4, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.598] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x1f4, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.599] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0050.599] WriteFile (in: hFile=0x1f4, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.601] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0050.601] CloseHandle (hObject=0x1f4) returned 1 [0050.601] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.602] lstrlenW (lpString=".doc") returned 4 [0050.602] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString=".docx") returned 5 [0050.602] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.602] lstrlenW (lpString=".pdf") returned 4 [0050.602] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString=".xls") returned 4 [0050.602] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString=".xlsx") returned 5 [0050.602] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.602] lstrlenW (lpString=".ppt") returned 4 [0050.602] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.602] lstrlenW (lpString=".zip") returned 4 [0050.602] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString=".rar") returned 4 [0050.602] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString=".bz2") returned 4 [0050.602] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.602] lstrlenW (lpString=".7z") returned 3 [0050.602] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.602] lstrlenW (lpString=".dbf") returned 4 [0050.602] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.602] lstrlenW (lpString=".1cd") returned 4 [0050.603] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString=".jpg") returned 4 [0050.603] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString=".doc") returned 4 [0050.603] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString=".docx") returned 5 [0050.603] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.603] lstrlenW (lpString=".pdf") returned 4 [0050.603] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString=".xls") returned 4 [0050.603] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString=".xlsx") returned 5 [0050.603] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.603] lstrlenW (lpString=".ppt") returned 4 [0050.603] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString=".zip") returned 4 [0050.603] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString=".rar") returned 4 [0050.603] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString=".bz2") returned 4 [0050.603] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.603] lstrlenW (lpString=".7z") returned 3 [0050.603] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString=".dbf") returned 4 [0050.603] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.603] lstrlenW (lpString=".1cd") returned 4 [0050.603] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0050.604] lstrlenW (lpString=".jpg") returned 4 [0050.604] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.604] lstrcmpiW (lpString1=".xrm-ms", lpString2=".zoh") returned -1 [0050.604] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0050.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.968] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=715834) returned 1 [0050.968] CloseHandle (hObject=0x1f0) returned 1 [0050.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0050.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.969] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0050.969] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0050.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.969] GetLastError () returned 0x0 [0050.969] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0051.060] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0051.076] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x214, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x104, lpOverlapped=0x0) returned 1 [0051.077] SetEndOfFile (hFile=0x214) returned 1 [0051.077] CloseHandle (hObject=0x214) returned 1 [0051.077] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0051.077] SetEndOfFile (hFile=0x1f0) returned 1 [0051.083] CloseHandle (hObject=0x1f0) returned 1 [0051.083] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.083] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0051.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.083] lstrlenW (lpString=".doc") returned 4 [0051.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".docx") returned 5 [0051.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.084] lstrlenW (lpString=".pdf") returned 4 [0051.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".xls") returned 4 [0051.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".xlsx") returned 5 [0051.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.084] lstrlenW (lpString=".ppt") returned 4 [0051.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString=".zip") returned 4 [0051.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".rar") returned 4 [0051.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".bz2") returned 4 [0051.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".7z") returned 3 [0051.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString=".dbf") returned 4 [0051.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString=".1cd") returned 4 [0051.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString=".jpg") returned 4 [0051.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.084] lstrlenW (lpString=".doc") returned 4 [0051.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.084] lstrlenW (lpString=".docx") returned 5 [0051.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.085] lstrlenW (lpString=".pdf") returned 4 [0051.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString=".xls") returned 4 [0051.085] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString=".xlsx") returned 5 [0051.085] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.085] lstrlenW (lpString=".ppt") returned 4 [0051.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.085] lstrlenW (lpString=".zip") returned 4 [0051.085] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString=".rar") returned 4 [0051.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString=".bz2") returned 4 [0051.085] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.085] lstrlenW (lpString=".7z") returned 3 [0051.085] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.334] lstrlenW (lpString=".dbf") returned 4 [0051.334] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.335] lstrlenW (lpString=".1cd") returned 4 [0051.335] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.335] lstrlenW (lpString=".jpg") returned 4 [0051.335] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.335] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0051.335] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0051.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0051.694] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36233052) returned 1 [0051.694] CloseHandle (hObject=0x180) returned 1 [0051.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0051.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.695] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0051.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0051.696] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0051.766] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0051.766] ReadFile (in: hFile=0x180, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.771] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0051.771] ReadFile (in: hFile=0x180, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.776] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.776] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0051.776] ReadFile (in: hFile=0x180, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.791] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.023] SetEndOfFile (hFile=0x180) returned 1 [0052.023] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0052.023] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x180, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.024] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x180, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.024] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0052.024] WriteFile (in: hFile=0x180, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.027] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0052.027] CloseHandle (hObject=0x180) returned 1 [0052.027] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0052.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.027] lstrlenW (lpString=".doc") returned 4 [0052.027] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.027] lstrlenW (lpString=".docx") returned 5 [0052.027] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.027] lstrlenW (lpString=".pdf") returned 4 [0052.027] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.027] lstrlenW (lpString=".xls") returned 4 [0052.027] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.027] lstrlenW (lpString=".xlsx") returned 5 [0052.027] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.027] lstrlenW (lpString=".ppt") returned 4 [0052.027] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.027] lstrlenW (lpString=".zip") returned 4 [0052.028] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString=".rar") returned 4 [0052.028] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString=".bz2") returned 4 [0052.028] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.028] lstrlenW (lpString=".7z") returned 3 [0052.028] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString=".dbf") returned 4 [0052.028] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString=".1cd") returned 4 [0052.028] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString=".jpg") returned 4 [0052.028] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString=".doc") returned 4 [0052.028] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString=".docx") returned 5 [0052.028] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.028] lstrlenW (lpString=".pdf") returned 4 [0052.028] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString=".xls") returned 4 [0052.028] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString=".xlsx") returned 5 [0052.028] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.028] lstrlenW (lpString=".ppt") returned 4 [0052.028] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.028] lstrlenW (lpString=".zip") returned 4 [0052.028] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.029] lstrlenW (lpString=".rar") returned 4 [0052.029] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.029] lstrlenW (lpString=".bz2") returned 4 [0052.029] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.029] lstrlenW (lpString=".7z") returned 3 [0052.029] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.029] lstrlenW (lpString=".dbf") returned 4 [0052.029] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.029] lstrlenW (lpString=".1cd") returned 4 [0052.029] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.029] lstrlenW (lpString=".jpg") returned 4 [0052.029] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.029] lstrcmpiW (lpString1=".sys", lpString2=".zoh") returned -1 [0052.029] lstrlenW (lpString="pagefile.sys") returned 12 [0052.029] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.029] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.029] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.029] lstrlenW (lpString=".doc") returned 4 [0052.029] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.029] lstrlenW (lpString=".docx") returned 5 [0052.029] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.029] lstrlenW (lpString=".pdf") returned 4 [0052.030] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString=".xls") returned 4 [0052.030] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.030] lstrlenW (lpString=".xlsx") returned 5 [0052.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.030] lstrlenW (lpString=".ppt") returned 4 [0052.030] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString=".zip") returned 4 [0052.030] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.030] lstrlenW (lpString=".rar") returned 4 [0052.030] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString=".bz2") returned 4 [0052.030] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString=".7z") returned 3 [0052.030] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString=".dbf") returned 4 [0052.030] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString=".1cd") returned 4 [0052.030] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString=".jpg") returned 4 [0052.030] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.030] lstrlenW (lpString=".doc") returned 4 [0052.030] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.030] lstrlenW (lpString=".docx") returned 5 [0052.030] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.030] lstrlenW (lpString=".pdf") returned 4 [0052.030] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString=".xls") returned 4 [0052.031] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.031] lstrlenW (lpString=".xlsx") returned 5 [0052.031] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.031] lstrlenW (lpString=".ppt") returned 4 [0052.031] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.031] lstrlenW (lpString=".zip") returned 4 [0052.031] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.031] lstrlenW (lpString=".rar") returned 4 [0052.031] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString=".bz2") returned 4 [0052.031] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString=".7z") returned 3 [0052.031] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.031] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.031] lstrlenW (lpString=".dbf") returned 4 [0052.031] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.031] lstrlenW (lpString=".1cd") returned 4 [0052.031] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.031] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.031] lstrlenW (lpString=".jpg") returned 4 [0052.031] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.031] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0052.031] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0052.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.214] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=99136) returned 1 [0052.214] CloseHandle (hObject=0x160) returned 1 [0052.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0052.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.240] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.240] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.240] GetLastError () returned 0x0 [0052.240] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x18340, lpOverlapped=0x0) returned 1 [0052.244] WriteFile (in: hFile=0x188, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x18350, lpOverlapped=0x0) returned 1 [0052.246] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0052.246] WriteFile (in: hFile=0x188, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.247] SetEndOfFile (hFile=0x188) returned 1 [0052.247] CloseHandle (hObject=0x188) returned 1 [0052.247] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.247] SetEndOfFile (hFile=0x160) returned 1 [0052.248] CloseHandle (hObject=0x160) returned 1 [0052.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.249] lstrlenW (lpString=".doc") returned 4 [0052.249] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString=".docx") returned 5 [0052.249] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.249] lstrlenW (lpString=".pdf") returned 4 [0052.249] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString=".xls") returned 4 [0052.249] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString=".xlsx") returned 5 [0052.249] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.249] lstrlenW (lpString=".ppt") returned 4 [0052.249] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.249] lstrlenW (lpString=".zip") returned 4 [0052.249] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString=".rar") returned 4 [0052.249] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.249] lstrlenW (lpString=".bz2") returned 4 [0052.249] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.249] lstrlenW (lpString=".7z") returned 3 [0052.249] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.249] lstrlenW (lpString=".dbf") returned 4 [0052.249] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.249] lstrlenW (lpString=".1cd") returned 4 [0052.249] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".jpg") returned 4 [0052.250] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".doc") returned 4 [0052.250] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString=".docx") returned 5 [0052.250] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.250] lstrlenW (lpString=".pdf") returned 4 [0052.250] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString=".xls") returned 4 [0052.250] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString=".xlsx") returned 5 [0052.250] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.250] lstrlenW (lpString=".ppt") returned 4 [0052.250] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".zip") returned 4 [0052.250] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString=".rar") returned 4 [0052.250] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.250] lstrlenW (lpString=".bz2") returned 4 [0052.250] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.250] lstrlenW (lpString=".7z") returned 3 [0052.250] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".dbf") returned 4 [0052.250] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".1cd") returned 4 [0052.250] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.250] lstrlenW (lpString=".jpg") returned 4 [0052.251] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.251] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0052.251] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0052.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.548] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=629664) returned 1 [0052.549] CloseHandle (hObject=0x160) returned 1 [0052.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0052.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.549] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.549] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.549] GetLastError () returned 0x0 [0052.549] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0052.564] WriteFile (in: hFile=0x220, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0052.576] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0052.576] WriteFile (in: hFile=0x220, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.576] SetEndOfFile (hFile=0x220) returned 1 [0052.576] CloseHandle (hObject=0x220) returned 1 [0052.576] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0052.576] SetEndOfFile (hFile=0x160) returned 1 [0052.582] CloseHandle (hObject=0x160) returned 1 [0052.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.582] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0052.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.582] lstrlenW (lpString=".doc") returned 4 [0052.582] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.582] lstrlenW (lpString=".docx") returned 5 [0052.582] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0052.582] lstrlenW (lpString=".pdf") returned 4 [0052.582] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.582] lstrlenW (lpString=".xls") returned 4 [0052.582] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.582] lstrlenW (lpString=".xlsx") returned 5 [0052.582] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0052.583] lstrlenW (lpString=".ppt") returned 4 [0052.583] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.583] lstrlenW (lpString=".zip") returned 4 [0052.674] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.674] lstrlenW (lpString=".rar") returned 4 [0052.674] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.674] lstrlenW (lpString=".bz2") returned 4 [0052.674] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.675] lstrlenW (lpString=".7z") returned 3 [0052.675] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString=".dbf") returned 4 [0052.675] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString=".1cd") returned 4 [0052.675] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString=".jpg") returned 4 [0052.675] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString=".doc") returned 4 [0052.675] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.675] lstrlenW (lpString=".docx") returned 5 [0052.675] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0052.675] lstrlenW (lpString=".pdf") returned 4 [0052.675] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString=".xls") returned 4 [0052.675] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString=".xlsx") returned 5 [0052.675] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0052.675] lstrlenW (lpString=".ppt") returned 4 [0052.675] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.675] lstrlenW (lpString=".zip") returned 4 [0052.675] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString=".rar") returned 4 [0052.675] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.675] lstrlenW (lpString=".bz2") returned 4 [0052.675] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.676] lstrlenW (lpString=".7z") returned 3 [0052.676] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.676] lstrlenW (lpString=".dbf") returned 4 [0052.676] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.676] lstrlenW (lpString=".1cd") returned 4 [0052.676] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0052.676] lstrlenW (lpString=".jpg") returned 4 [0052.676] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.676] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0052.676] lstrlenW (lpString="msgfilt.dll") returned 11 [0052.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.094] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=38768) returned 1 [0054.094] CloseHandle (hObject=0x218) returned 1 [0054.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0054.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.094] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.094] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.099] GetLastError () returned 0x0 [0054.099] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x9770, lpOverlapped=0x0) returned 1 [0054.191] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x9780, lpOverlapped=0x0) returned 1 [0054.193] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0054.193] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.193] SetEndOfFile (hFile=0x198) returned 1 [0054.193] CloseHandle (hObject=0x198) returned 1 [0054.193] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.193] SetEndOfFile (hFile=0x218) returned 1 [0054.194] CloseHandle (hObject=0x218) returned 1 [0054.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.195] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0054.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.195] lstrlenW (lpString=".doc") returned 4 [0054.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString=".docx") returned 5 [0054.195] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.195] lstrlenW (lpString=".pdf") returned 4 [0054.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString=".xls") returned 4 [0054.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString=".xlsx") returned 5 [0054.195] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.195] lstrlenW (lpString=".ppt") returned 4 [0054.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.195] lstrlenW (lpString=".zip") returned 4 [0054.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString=".rar") returned 4 [0054.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.195] lstrlenW (lpString=".bz2") returned 4 [0054.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.196] lstrlenW (lpString=".7z") returned 3 [0054.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString=".dbf") returned 4 [0054.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString=".1cd") returned 4 [0054.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString=".jpg") returned 4 [0054.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString=".doc") returned 4 [0054.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString=".docx") returned 5 [0054.196] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.196] lstrlenW (lpString=".pdf") returned 4 [0054.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString=".xls") returned 4 [0054.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString=".xlsx") returned 5 [0054.196] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.196] lstrlenW (lpString=".ppt") returned 4 [0054.196] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.196] lstrlenW (lpString=".zip") returned 4 [0054.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString=".rar") returned 4 [0054.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.196] lstrlenW (lpString=".bz2") returned 4 [0054.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.196] lstrlenW (lpString=".7z") returned 3 [0054.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.197] lstrlenW (lpString=".dbf") returned 4 [0054.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.197] lstrlenW (lpString=".1cd") returned 4 [0054.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.197] lstrlenW (lpString=".jpg") returned 4 [0054.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.197] lstrcmpiW (lpString1=".CFG", lpString2=".zoh") returned -1 [0054.197] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0054.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.197] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6811) returned 1 [0054.197] CloseHandle (hObject=0x218) returned 1 [0054.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0054.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.198] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.198] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.198] GetLastError () returned 0x0 [0054.198] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0054.200] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0054.201] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0054.201] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.201] SetEndOfFile (hFile=0x198) returned 1 [0054.201] CloseHandle (hObject=0x198) returned 1 [0054.201] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.201] SetEndOfFile (hFile=0x218) returned 1 [0054.202] CloseHandle (hObject=0x218) returned 1 [0054.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString=".doc") returned 4 [0054.203] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString=".docx") returned 5 [0054.203] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.203] lstrlenW (lpString=".pdf") returned 4 [0054.203] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString=".xls") returned 4 [0054.203] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString=".xlsx") returned 5 [0054.203] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.203] lstrlenW (lpString=".ppt") returned 4 [0054.203] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString=".zip") returned 4 [0054.203] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString=".rar") returned 4 [0054.203] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString=".bz2") returned 4 [0054.203] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.203] lstrlenW (lpString=".7z") returned 3 [0054.203] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString=".dbf") returned 4 [0054.203] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString=".1cd") returned 4 [0054.203] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.203] lstrlenW (lpString=".jpg") returned 4 [0054.203] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString=".doc") returned 4 [0054.204] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString=".docx") returned 5 [0054.204] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.204] lstrlenW (lpString=".pdf") returned 4 [0054.204] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString=".xls") returned 4 [0054.204] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString=".xlsx") returned 5 [0054.204] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.204] lstrlenW (lpString=".ppt") returned 4 [0054.204] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString=".zip") returned 4 [0054.204] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString=".rar") returned 4 [0054.204] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString=".bz2") returned 4 [0054.204] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.204] lstrlenW (lpString=".7z") returned 3 [0054.204] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString=".dbf") returned 4 [0054.204] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString=".1cd") returned 4 [0054.204] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.204] lstrlenW (lpString=".jpg") returned 4 [0054.204] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.205] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0054.205] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0054.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.206] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=323936) returned 1 [0054.206] CloseHandle (hObject=0x218) returned 1 [0054.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0054.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.206] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.207] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.207] GetLastError () returned 0x0 [0054.207] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4f160, lpOverlapped=0x0) returned 1 [0054.215] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0054.223] ReadFile (in: hFile=0x218, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0054.223] WriteFile (in: hFile=0x198, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.223] SetEndOfFile (hFile=0x198) returned 1 [0054.223] CloseHandle (hObject=0x198) returned 1 [0054.223] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.223] SetEndOfFile (hFile=0x218) returned 1 [0054.226] CloseHandle (hObject=0x218) returned 1 [0054.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0054.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.227] lstrlenW (lpString=".doc") returned 4 [0054.227] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.227] lstrlenW (lpString=".docx") returned 5 [0054.227] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.227] lstrlenW (lpString=".pdf") returned 4 [0054.227] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.227] lstrlenW (lpString=".xls") returned 4 [0054.227] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.227] lstrlenW (lpString=".xlsx") returned 5 [0054.227] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.227] lstrlenW (lpString=".ppt") returned 4 [0054.227] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.227] lstrlenW (lpString=".zip") returned 4 [0054.227] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.227] lstrlenW (lpString=".rar") returned 4 [0054.227] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.227] lstrlenW (lpString=".bz2") returned 4 [0054.227] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.227] lstrlenW (lpString=".7z") returned 3 [0054.227] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.227] lstrlenW (lpString=".dbf") returned 4 [0054.227] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.227] lstrlenW (lpString=".1cd") returned 4 [0054.228] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString=".jpg") returned 4 [0054.228] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString=".doc") returned 4 [0054.228] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.228] lstrlenW (lpString=".docx") returned 5 [0054.228] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.228] lstrlenW (lpString=".pdf") returned 4 [0054.228] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString=".xls") returned 4 [0054.228] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString=".xlsx") returned 5 [0054.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.228] lstrlenW (lpString=".ppt") returned 4 [0054.228] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString=".zip") returned 4 [0054.228] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString=".rar") returned 4 [0054.228] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.228] lstrlenW (lpString=".bz2") returned 4 [0054.228] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.228] lstrlenW (lpString=".7z") returned 3 [0054.228] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString=".dbf") returned 4 [0054.228] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.228] lstrlenW (lpString=".1cd") returned 4 [0054.228] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.229] lstrlenW (lpString=".jpg") returned 4 [0054.229] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.229] lstrcmpiW (lpString1=".FNT", lpString2=".zoh") returned -1 [0054.229] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0054.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.549] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=606062) returned 1 [0054.549] CloseHandle (hObject=0x21c) returned 1 [0054.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0054.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.549] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.549] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.549] GetLastError () returned 0x0 [0054.549] ReadFile (in: hFile=0x21c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0054.909] WriteFile (in: hFile=0x218, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0054.918] ReadFile (in: hFile=0x21c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0054.918] WriteFile (in: hFile=0x218, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.919] SetEndOfFile (hFile=0x218) returned 1 [0054.919] CloseHandle (hObject=0x218) returned 1 [0054.919] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0054.919] SetEndOfFile (hFile=0x21c) returned 1 [0054.924] CloseHandle (hObject=0x21c) returned 1 [0054.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0055.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.081] lstrlenW (lpString=".doc") returned 4 [0055.081] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0055.081] lstrlenW (lpString=".docx") returned 5 [0055.081] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0055.081] lstrlenW (lpString=".pdf") returned 4 [0055.081] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0055.081] lstrlenW (lpString=".xls") returned 4 [0055.081] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0055.081] lstrlenW (lpString=".xlsx") returned 5 [0055.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0055.081] lstrlenW (lpString=".ppt") returned 4 [0055.081] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0055.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.081] lstrlenW (lpString=".zip") returned 4 [0055.081] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString=".rar") returned 4 [0055.082] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString=".bz2") returned 4 [0055.082] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0055.082] lstrlenW (lpString=".7z") returned 3 [0055.082] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString=".dbf") returned 4 [0055.082] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString=".1cd") returned 4 [0055.082] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString=".jpg") returned 4 [0055.082] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString=".doc") returned 4 [0055.082] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0055.082] lstrlenW (lpString=".docx") returned 5 [0055.082] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0055.082] lstrlenW (lpString=".pdf") returned 4 [0055.082] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString=".xls") returned 4 [0055.082] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString=".xlsx") returned 5 [0055.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0055.082] lstrlenW (lpString=".ppt") returned 4 [0055.082] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.082] lstrlenW (lpString=".zip") returned 4 [0055.082] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0055.082] lstrlenW (lpString=".rar") returned 4 [0055.083] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0055.083] lstrlenW (lpString=".bz2") returned 4 [0055.083] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0055.083] lstrlenW (lpString=".7z") returned 3 [0055.083] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.083] lstrlenW (lpString=".dbf") returned 4 [0055.083] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.083] lstrlenW (lpString=".1cd") returned 4 [0055.083] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.083] lstrlenW (lpString=".jpg") returned 4 [0055.083] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0055.083] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0055.083] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0055.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0056.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=280448) returned 1 [0056.593] CloseHandle (hObject=0x17c) returned 1 [0056.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0056.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0056.594] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0056.594] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0056.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.669] GetLastError () returned 0x0 [0056.669] ReadFile (in: hFile=0x17c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x44780, lpOverlapped=0x0) returned 1 [0056.709] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x44790, lpOverlapped=0x0) returned 1 [0056.729] ReadFile (in: hFile=0x17c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0056.729] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.729] SetEndOfFile (hFile=0x1fc) returned 1 [0056.729] CloseHandle (hObject=0x1fc) returned 1 [0056.730] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0056.730] SetEndOfFile (hFile=0x17c) returned 1 [0056.871] CloseHandle (hObject=0x17c) returned 1 [0056.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.871] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0056.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.872] lstrlenW (lpString=".doc") returned 4 [0056.872] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.872] lstrlenW (lpString=".docx") returned 5 [0056.872] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.872] lstrlenW (lpString=".pdf") returned 4 [0056.872] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.872] lstrlenW (lpString=".xls") returned 4 [0056.872] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.872] lstrlenW (lpString=".xlsx") returned 5 [0056.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.872] lstrlenW (lpString=".ppt") returned 4 [0056.872] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.872] lstrlenW (lpString=".zip") returned 4 [0056.872] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.872] lstrlenW (lpString=".rar") returned 4 [0056.872] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.872] lstrlenW (lpString=".bz2") returned 4 [0056.872] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.872] lstrlenW (lpString=".7z") returned 3 [0056.872] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.872] lstrlenW (lpString=".dbf") returned 4 [0056.872] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.872] lstrlenW (lpString=".1cd") returned 4 [0056.873] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.873] lstrlenW (lpString=".jpg") returned 4 [0056.873] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.873] lstrlenW (lpString=".doc") returned 4 [0056.873] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.873] lstrlenW (lpString=".docx") returned 5 [0056.873] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.873] lstrlenW (lpString=".pdf") returned 4 [0056.873] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.873] lstrlenW (lpString=".xls") returned 4 [0056.873] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.873] lstrlenW (lpString=".xlsx") returned 5 [0056.873] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.873] lstrlenW (lpString=".ppt") returned 4 [0056.873] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.873] lstrlenW (lpString=".zip") returned 4 [0056.874] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.874] lstrlenW (lpString=".rar") returned 4 [0056.874] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.874] lstrlenW (lpString=".bz2") returned 4 [0056.874] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.874] lstrlenW (lpString=".7z") returned 3 [0056.874] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.874] lstrlenW (lpString=".dbf") returned 4 [0056.874] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.874] lstrlenW (lpString=".1cd") returned 4 [0056.874] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0056.874] lstrlenW (lpString=".jpg") returned 4 [0056.874] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.874] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.874] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.920] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.920] CloseHandle (hObject=0x150) returned 1 [0056.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0056.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.921] lstrlenW (lpString=".doc") returned 4 [0056.921] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.921] lstrlenW (lpString=".docx") returned 5 [0056.921] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.921] lstrlenW (lpString=".pdf") returned 4 [0056.921] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.921] lstrlenW (lpString=".xls") returned 4 [0056.921] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.921] lstrlenW (lpString=".xlsx") returned 5 [0056.921] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.921] lstrlenW (lpString=".ppt") returned 4 [0056.921] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.921] lstrlenW (lpString=".zip") returned 4 [0056.921] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.921] lstrlenW (lpString=".rar") returned 4 [0056.921] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.921] lstrlenW (lpString=".bz2") returned 4 [0056.921] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.921] lstrlenW (lpString=".7z") returned 3 [0056.921] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.921] lstrlenW (lpString=".dbf") returned 4 [0056.921] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.921] lstrlenW (lpString=".1cd") returned 4 [0056.921] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString=".jpg") returned 4 [0056.922] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString=".doc") returned 4 [0056.922] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.922] lstrlenW (lpString=".docx") returned 5 [0056.922] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.922] lstrlenW (lpString=".pdf") returned 4 [0056.922] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.922] lstrlenW (lpString=".xls") returned 4 [0056.922] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.922] lstrlenW (lpString=".xlsx") returned 5 [0056.922] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.922] lstrlenW (lpString=".ppt") returned 4 [0056.922] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString=".zip") returned 4 [0056.922] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.922] lstrlenW (lpString=".rar") returned 4 [0056.922] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.922] lstrlenW (lpString=".bz2") returned 4 [0056.922] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.922] lstrlenW (lpString=".7z") returned 3 [0056.922] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString=".dbf") returned 4 [0056.922] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.922] lstrlenW (lpString=".1cd") returned 4 [0056.922] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0056.923] lstrlenW (lpString=".jpg") returned 4 [0056.923] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.923] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.923] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.923] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.923] CloseHandle (hObject=0x150) returned 1 [0056.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0056.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.924] lstrlenW (lpString=".doc") returned 4 [0056.924] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.924] lstrlenW (lpString=".docx") returned 5 [0056.924] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.924] lstrlenW (lpString=".pdf") returned 4 [0056.924] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.924] lstrlenW (lpString=".xls") returned 4 [0056.924] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.924] lstrlenW (lpString=".xlsx") returned 5 [0056.924] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.924] lstrlenW (lpString=".ppt") returned 4 [0056.924] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.924] lstrlenW (lpString=".zip") returned 4 [0056.924] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.924] lstrlenW (lpString=".rar") returned 4 [0056.924] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.924] lstrlenW (lpString=".bz2") returned 4 [0056.924] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.924] lstrlenW (lpString=".7z") returned 3 [0056.924] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.924] lstrlenW (lpString=".dbf") returned 4 [0056.924] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.924] lstrlenW (lpString=".1cd") returned 4 [0056.924] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString=".jpg") returned 4 [0056.925] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString=".doc") returned 4 [0056.925] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.925] lstrlenW (lpString=".docx") returned 5 [0056.925] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.925] lstrlenW (lpString=".pdf") returned 4 [0056.925] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.925] lstrlenW (lpString=".xls") returned 4 [0056.925] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.925] lstrlenW (lpString=".xlsx") returned 5 [0056.925] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.925] lstrlenW (lpString=".ppt") returned 4 [0056.925] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString=".zip") returned 4 [0056.925] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.925] lstrlenW (lpString=".rar") returned 4 [0056.925] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.925] lstrlenW (lpString=".bz2") returned 4 [0056.925] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.925] lstrlenW (lpString=".7z") returned 3 [0056.925] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString=".dbf") returned 4 [0056.925] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.925] lstrlenW (lpString=".1cd") returned 4 [0056.925] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0056.926] lstrlenW (lpString=".jpg") returned 4 [0056.926] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.926] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0056.926] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0056.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.926] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=193024) returned 1 [0056.926] CloseHandle (hObject=0x150) returned 1 [0056.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0056.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString=".doc") returned 4 [0056.927] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.927] lstrlenW (lpString=".docx") returned 5 [0056.927] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0056.927] lstrlenW (lpString=".pdf") returned 4 [0056.927] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.927] lstrlenW (lpString=".xls") returned 4 [0056.927] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.927] lstrlenW (lpString=".xlsx") returned 5 [0056.927] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0056.927] lstrlenW (lpString=".ppt") returned 4 [0056.927] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString=".zip") returned 4 [0056.927] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.927] lstrlenW (lpString=".rar") returned 4 [0056.927] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.927] lstrlenW (lpString=".bz2") returned 4 [0056.927] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.927] lstrlenW (lpString=".7z") returned 3 [0056.927] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString=".dbf") returned 4 [0056.927] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString=".1cd") returned 4 [0056.927] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.927] lstrlenW (lpString=".jpg") returned 4 [0056.927] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString=".doc") returned 4 [0056.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.928] lstrlenW (lpString=".docx") returned 5 [0056.928] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0056.928] lstrlenW (lpString=".pdf") returned 4 [0056.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString=".xls") returned 4 [0056.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString=".xlsx") returned 5 [0056.928] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0056.928] lstrlenW (lpString=".ppt") returned 4 [0056.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString=".zip") returned 4 [0056.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString=".rar") returned 4 [0056.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.928] lstrlenW (lpString=".bz2") returned 4 [0056.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.928] lstrlenW (lpString=".7z") returned 3 [0056.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString=".dbf") returned 4 [0056.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString=".1cd") returned 4 [0056.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0056.928] lstrlenW (lpString=".jpg") returned 4 [0056.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.929] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.929] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.929] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.929] CloseHandle (hObject=0x150) returned 1 [0056.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0056.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.929] lstrlenW (lpString=".doc") returned 4 [0056.930] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.930] lstrlenW (lpString=".docx") returned 5 [0056.930] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.930] lstrlenW (lpString=".pdf") returned 4 [0056.930] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.930] lstrlenW (lpString=".xls") returned 4 [0056.930] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.930] lstrlenW (lpString=".xlsx") returned 5 [0056.930] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.930] lstrlenW (lpString=".ppt") returned 4 [0056.930] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString=".zip") returned 4 [0056.930] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.930] lstrlenW (lpString=".rar") returned 4 [0056.930] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.930] lstrlenW (lpString=".bz2") returned 4 [0056.930] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.930] lstrlenW (lpString=".7z") returned 3 [0056.930] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString=".dbf") returned 4 [0056.930] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString=".1cd") returned 4 [0056.930] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString=".jpg") returned 4 [0056.930] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.930] lstrlenW (lpString=".doc") returned 4 [0056.930] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.931] lstrlenW (lpString=".docx") returned 5 [0056.931] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.931] lstrlenW (lpString=".pdf") returned 4 [0056.931] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.931] lstrlenW (lpString=".xls") returned 4 [0056.931] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.931] lstrlenW (lpString=".xlsx") returned 5 [0056.931] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.931] lstrlenW (lpString=".ppt") returned 4 [0056.931] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.931] lstrlenW (lpString=".zip") returned 4 [0056.931] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.931] lstrlenW (lpString=".rar") returned 4 [0056.931] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.931] lstrlenW (lpString=".bz2") returned 4 [0056.931] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.931] lstrlenW (lpString=".7z") returned 3 [0056.931] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.931] lstrlenW (lpString=".dbf") returned 4 [0056.931] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.931] lstrlenW (lpString=".1cd") returned 4 [0056.931] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0056.931] lstrlenW (lpString=".jpg") returned 4 [0056.931] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.931] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.931] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.932] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.932] CloseHandle (hObject=0x150) returned 1 [0056.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0056.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.932] lstrlenW (lpString=".doc") returned 4 [0056.932] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.932] lstrlenW (lpString=".docx") returned 5 [0056.932] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.932] lstrlenW (lpString=".pdf") returned 4 [0056.932] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.932] lstrlenW (lpString=".xls") returned 4 [0056.933] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.933] lstrlenW (lpString=".xlsx") returned 5 [0056.933] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.933] lstrlenW (lpString=".ppt") returned 4 [0056.933] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString=".zip") returned 4 [0056.933] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.933] lstrlenW (lpString=".rar") returned 4 [0056.933] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.933] lstrlenW (lpString=".bz2") returned 4 [0056.933] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.933] lstrlenW (lpString=".7z") returned 3 [0056.933] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString=".dbf") returned 4 [0056.933] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString=".1cd") returned 4 [0056.933] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString=".jpg") returned 4 [0056.933] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.933] lstrlenW (lpString=".doc") returned 4 [0056.933] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.933] lstrlenW (lpString=".docx") returned 5 [0056.933] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.933] lstrlenW (lpString=".pdf") returned 4 [0056.933] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.933] lstrlenW (lpString=".xls") returned 4 [0056.933] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.934] lstrlenW (lpString=".xlsx") returned 5 [0056.934] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.934] lstrlenW (lpString=".ppt") returned 4 [0056.934] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.934] lstrlenW (lpString=".zip") returned 4 [0056.934] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.934] lstrlenW (lpString=".rar") returned 4 [0056.934] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.934] lstrlenW (lpString=".bz2") returned 4 [0056.934] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.934] lstrlenW (lpString=".7z") returned 3 [0056.934] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.934] lstrlenW (lpString=".dbf") returned 4 [0056.934] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.934] lstrlenW (lpString=".1cd") returned 4 [0056.934] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0056.934] lstrlenW (lpString=".jpg") returned 4 [0056.934] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.934] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.934] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.941] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.941] CloseHandle (hObject=0x1ec) returned 1 [0056.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0056.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.942] lstrlenW (lpString=".doc") returned 4 [0056.942] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.942] lstrlenW (lpString=".docx") returned 5 [0056.942] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.942] lstrlenW (lpString=".pdf") returned 4 [0056.942] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.942] lstrlenW (lpString=".xls") returned 4 [0056.942] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.942] lstrlenW (lpString=".xlsx") returned 5 [0056.942] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.942] lstrlenW (lpString=".ppt") returned 4 [0056.942] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.942] lstrlenW (lpString=".zip") returned 4 [0056.942] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.942] lstrlenW (lpString=".rar") returned 4 [0056.942] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.942] lstrlenW (lpString=".bz2") returned 4 [0056.942] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.942] lstrlenW (lpString=".7z") returned 3 [0056.942] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0056.942] lstrlenW (lpString=".dbf") returned 4 [0056.942] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.960] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=8704) returned 1 [0056.960] CloseHandle (hObject=0x1ec) returned 1 [0056.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0056.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.961] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0056.961] CloseHandle (hObject=0x1ec) returned 1 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.962] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=22528) returned 1 [0056.962] CloseHandle (hObject=0x1ec) returned 1 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.962] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0056.963] CloseHandle (hObject=0x1ec) returned 1 [0056.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0056.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.964] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=8704) returned 1 [0056.964] CloseHandle (hObject=0x1ec) returned 1 [0056.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0056.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.964] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10240) returned 1 [0056.964] CloseHandle (hObject=0x1ec) returned 1 [0056.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0056.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.965] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0056.965] CloseHandle (hObject=0x1ec) returned 1 [0056.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0056.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.966] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0056.966] CloseHandle (hObject=0x1ec) returned 1 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.967] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=43520) returned 1 [0056.967] CloseHandle (hObject=0x1ec) returned 1 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.968] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3072) returned 1 [0056.968] CloseHandle (hObject=0x1ec) returned 1 [0056.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0056.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.969] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3072) returned 1 [0056.969] CloseHandle (hObject=0x1ec) returned 1 [0056.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0056.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.970] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=32768) returned 1 [0056.970] CloseHandle (hObject=0x1ec) returned 1 [0056.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0056.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.970] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.970] CloseHandle (hObject=0x1ec) returned 1 [0056.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0056.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.971] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3072) returned 1 [0056.971] CloseHandle (hObject=0x1ec) returned 1 [0056.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0056.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.971] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.971] CloseHandle (hObject=0x1ec) returned 1 [0056.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0056.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.972] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.972] CloseHandle (hObject=0x1ec) returned 1 [0056.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0056.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.973] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.973] CloseHandle (hObject=0x1ec) returned 1 [0056.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0056.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.973] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=927744) returned 1 [0056.974] CloseHandle (hObject=0x1ec) returned 1 [0056.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0056.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.974] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.974] CloseHandle (hObject=0x1ec) returned 1 [0056.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0056.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.975] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.975] CloseHandle (hObject=0x1ec) returned 1 [0056.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0056.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.976] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0056.976] CloseHandle (hObject=0x1ec) returned 1 [0056.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0056.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.977] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0056.977] CloseHandle (hObject=0x1ec) returned 1 [0056.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0056.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.978] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=353280) returned 1 [0056.978] CloseHandle (hObject=0x1ec) returned 1 [0056.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0056.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.978] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2103296) returned 1 [0056.978] CloseHandle (hObject=0x1ec) returned 1 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0056.979] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=397312) returned 1 [0056.979] CloseHandle (hObject=0x1ec) returned 1 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.980] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=383488) returned 1 [0056.980] CloseHandle (hObject=0x1ec) returned 1 [0056.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0056.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.980] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2048) returned 1 [0056.980] CloseHandle (hObject=0x1ec) returned 1 [0057.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0057.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.112] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4096) returned 1 [0057.112] CloseHandle (hObject=0x1fc) returned 1 [0057.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0057.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.136] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3584) returned 1 [0057.136] CloseHandle (hObject=0x22c) returned 1 [0057.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0057.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.201] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=695296) returned 1 [0057.201] CloseHandle (hObject=0x1ec) returned 1 [0057.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0057.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.201] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=26624) returned 1 [0057.201] CloseHandle (hObject=0x1ec) returned 1 [0057.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0057.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.202] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=378880) returned 1 [0057.202] CloseHandle (hObject=0x1ec) returned 1 [0057.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0057.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.203] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=198056) returned 1 [0057.203] CloseHandle (hObject=0x1ec) returned 1 [0057.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0057.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.203] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.203] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.204] GetLastError () returned 0x0 [0057.204] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x305a8, lpOverlapped=0x0) returned 1 [0057.221] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0057.225] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0057.225] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.225] SetEndOfFile (hFile=0x190) returned 1 [0057.225] CloseHandle (hObject=0x190) returned 1 [0057.225] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.225] SetEndOfFile (hFile=0x1ec) returned 1 [0057.227] CloseHandle (hObject=0x1ec) returned 1 [0057.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.227] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.228] lstrlenW (lpString=".doc") returned 4 [0057.228] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString=".docx") returned 5 [0057.228] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.228] lstrlenW (lpString=".pdf") returned 4 [0057.228] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString=".xls") returned 4 [0057.228] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString=".xlsx") returned 5 [0057.228] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.228] lstrlenW (lpString=".ppt") returned 4 [0057.228] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.228] lstrlenW (lpString=".zip") returned 4 [0057.228] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString=".rar") returned 4 [0057.228] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.228] lstrlenW (lpString=".bz2") returned 4 [0057.228] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.228] lstrlenW (lpString=".7z") returned 3 [0057.228] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.228] lstrlenW (lpString=".dbf") returned 4 [0057.228] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.228] lstrlenW (lpString=".1cd") returned 4 [0057.228] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString=".jpg") returned 4 [0057.229] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString=".doc") returned 4 [0057.229] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString=".docx") returned 5 [0057.229] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.229] lstrlenW (lpString=".pdf") returned 4 [0057.229] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString=".xls") returned 4 [0057.229] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString=".xlsx") returned 5 [0057.229] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.229] lstrlenW (lpString=".ppt") returned 4 [0057.229] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString=".zip") returned 4 [0057.229] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString=".rar") returned 4 [0057.229] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.229] lstrlenW (lpString=".bz2") returned 4 [0057.229] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.229] lstrlenW (lpString=".7z") returned 3 [0057.229] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString=".dbf") returned 4 [0057.229] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.229] lstrlenW (lpString=".1cd") returned 4 [0057.229] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.230] lstrlenW (lpString=".jpg") returned 4 [0057.230] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.230] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.230] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0057.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.230] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=52656) returned 1 [0057.230] CloseHandle (hObject=0x1ec) returned 1 [0057.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0057.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.231] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.231] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.231] GetLastError () returned 0x0 [0057.231] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0057.239] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0057.241] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0057.241] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.241] SetEndOfFile (hFile=0x190) returned 1 [0057.241] CloseHandle (hObject=0x190) returned 1 [0057.241] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.241] SetEndOfFile (hFile=0x1ec) returned 1 [0057.242] CloseHandle (hObject=0x1ec) returned 1 [0057.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.242] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString=".doc") returned 4 [0057.243] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString=".docx") returned 5 [0057.243] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0057.243] lstrlenW (lpString=".pdf") returned 4 [0057.243] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString=".xls") returned 4 [0057.243] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString=".xlsx") returned 5 [0057.243] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0057.243] lstrlenW (lpString=".ppt") returned 4 [0057.243] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString=".zip") returned 4 [0057.243] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString=".rar") returned 4 [0057.243] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.243] lstrlenW (lpString=".bz2") returned 4 [0057.243] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.243] lstrlenW (lpString=".7z") returned 3 [0057.243] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString=".dbf") returned 4 [0057.243] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString=".1cd") returned 4 [0057.243] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.243] lstrlenW (lpString=".jpg") returned 4 [0057.243] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString=".doc") returned 4 [0057.244] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString=".docx") returned 5 [0057.244] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0057.244] lstrlenW (lpString=".pdf") returned 4 [0057.244] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString=".xls") returned 4 [0057.244] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString=".xlsx") returned 5 [0057.244] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0057.244] lstrlenW (lpString=".ppt") returned 4 [0057.244] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString=".zip") returned 4 [0057.244] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString=".rar") returned 4 [0057.244] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.244] lstrlenW (lpString=".bz2") returned 4 [0057.244] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.244] lstrlenW (lpString=".7z") returned 3 [0057.244] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString=".dbf") returned 4 [0057.244] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString=".1cd") returned 4 [0057.244] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.244] lstrlenW (lpString=".jpg") returned 4 [0057.244] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.245] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.245] lstrlenW (lpString="ACERECR.DLL") returned 11 [0057.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.245] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=20944) returned 1 [0057.245] CloseHandle (hObject=0x1ec) returned 1 [0057.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0057.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.245] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.245] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.246] GetLastError () returned 0x0 [0057.246] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x51d0, lpOverlapped=0x0) returned 1 [0057.255] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0057.256] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0057.256] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.256] SetEndOfFile (hFile=0x190) returned 1 [0057.256] CloseHandle (hObject=0x190) returned 1 [0057.256] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.256] SetEndOfFile (hFile=0x1ec) returned 1 [0057.257] CloseHandle (hObject=0x1ec) returned 1 [0057.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.257] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString=".doc") returned 4 [0057.258] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString=".docx") returned 5 [0057.258] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.258] lstrlenW (lpString=".pdf") returned 4 [0057.258] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString=".xls") returned 4 [0057.258] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString=".xlsx") returned 5 [0057.258] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.258] lstrlenW (lpString=".ppt") returned 4 [0057.258] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString=".zip") returned 4 [0057.258] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString=".rar") returned 4 [0057.258] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.258] lstrlenW (lpString=".bz2") returned 4 [0057.258] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.258] lstrlenW (lpString=".7z") returned 3 [0057.258] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString=".dbf") returned 4 [0057.258] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString=".1cd") returned 4 [0057.258] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.258] lstrlenW (lpString=".jpg") returned 4 [0057.259] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString=".doc") returned 4 [0057.259] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString=".docx") returned 5 [0057.259] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.259] lstrlenW (lpString=".pdf") returned 4 [0057.259] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString=".xls") returned 4 [0057.259] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString=".xlsx") returned 5 [0057.259] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.259] lstrlenW (lpString=".ppt") returned 4 [0057.259] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString=".zip") returned 4 [0057.259] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString=".rar") returned 4 [0057.259] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.259] lstrlenW (lpString=".bz2") returned 4 [0057.259] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.259] lstrlenW (lpString=".7z") returned 3 [0057.259] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString=".dbf") returned 4 [0057.259] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString=".1cd") returned 4 [0057.259] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.259] lstrlenW (lpString=".jpg") returned 4 [0057.259] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.260] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.260] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0057.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.260] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=862608) returned 1 [0057.260] CloseHandle (hObject=0x1ec) returned 1 [0057.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0057.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.260] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.261] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.261] GetLastError () returned 0x0 [0057.261] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd2990, lpOverlapped=0x0) returned 1 [0057.310] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0057.325] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0057.325] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.325] SetEndOfFile (hFile=0x190) returned 1 [0057.325] CloseHandle (hObject=0x190) returned 1 [0057.325] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.325] SetEndOfFile (hFile=0x1ec) returned 1 [0057.332] CloseHandle (hObject=0x1ec) returned 1 [0057.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.333] lstrlenW (lpString=".doc") returned 4 [0057.333] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString=".docx") returned 5 [0057.333] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.333] lstrlenW (lpString=".pdf") returned 4 [0057.333] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString=".xls") returned 4 [0057.333] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString=".xlsx") returned 5 [0057.333] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.333] lstrlenW (lpString=".ppt") returned 4 [0057.333] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.333] lstrlenW (lpString=".zip") returned 4 [0057.333] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString=".rar") returned 4 [0057.333] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.333] lstrlenW (lpString=".bz2") returned 4 [0057.333] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.333] lstrlenW (lpString=".7z") returned 3 [0057.333] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString=".dbf") returned 4 [0057.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString=".1cd") returned 4 [0057.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString=".jpg") returned 4 [0057.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString=".doc") returned 4 [0057.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString=".docx") returned 5 [0057.334] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.334] lstrlenW (lpString=".pdf") returned 4 [0057.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString=".xls") returned 4 [0057.334] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString=".xlsx") returned 5 [0057.334] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.334] lstrlenW (lpString=".ppt") returned 4 [0057.334] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.334] lstrlenW (lpString=".zip") returned 4 [0057.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString=".rar") returned 4 [0057.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.334] lstrlenW (lpString=".bz2") returned 4 [0057.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.334] lstrlenW (lpString=".7z") returned 3 [0057.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.335] lstrlenW (lpString=".dbf") returned 4 [0057.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.335] lstrlenW (lpString=".1cd") returned 4 [0057.335] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.335] lstrlenW (lpString=".jpg") returned 4 [0057.335] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.335] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.335] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0057.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.336] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=154448) returned 1 [0057.336] CloseHandle (hObject=0x1ec) returned 1 [0057.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0057.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.336] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.336] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0057.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.336] GetLastError () returned 0x0 [0057.337] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x25b50, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0057.901] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0057.901] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.901] SetEndOfFile (hFile=0x190) returned 1 [0058.452] CloseHandle (hObject=0x190) returned 1 [0058.475] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.475] SetEndOfFile (hFile=0x1ec) returned 1 [0058.496] CloseHandle (hObject=0x1ec) returned 1 [0058.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.500] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0058.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.500] lstrlenW (lpString=".doc") returned 4 [0058.500] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString=".docx") returned 5 [0058.511] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.511] lstrlenW (lpString=".pdf") returned 4 [0058.511] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString=".xls") returned 4 [0058.511] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString=".xlsx") returned 5 [0058.511] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.511] lstrlenW (lpString=".ppt") returned 4 [0058.511] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.511] lstrlenW (lpString=".zip") returned 4 [0058.511] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString=".rar") returned 4 [0058.511] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.511] lstrlenW (lpString=".bz2") returned 4 [0058.511] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.511] lstrlenW (lpString=".7z") returned 3 [0058.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.511] lstrlenW (lpString=".dbf") returned 4 [0058.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.511] lstrlenW (lpString=".1cd") returned 4 [0058.511] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.511] lstrlenW (lpString=".jpg") returned 4 [0058.511] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString=".doc") returned 4 [0058.512] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString=".docx") returned 5 [0058.512] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.512] lstrlenW (lpString=".pdf") returned 4 [0058.512] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString=".xls") returned 4 [0058.512] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString=".xlsx") returned 5 [0058.512] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.512] lstrlenW (lpString=".ppt") returned 4 [0058.512] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString=".zip") returned 4 [0058.512] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString=".rar") returned 4 [0058.512] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.512] lstrlenW (lpString=".bz2") returned 4 [0058.512] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.512] lstrlenW (lpString=".7z") returned 3 [0058.512] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString=".dbf") returned 4 [0058.512] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString=".1cd") returned 4 [0058.512] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.512] lstrlenW (lpString=".jpg") returned 4 [0058.512] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.513] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.513] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0058.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.513] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=744888) returned 1 [0058.513] CloseHandle (hObject=0x1ec) returned 1 [0058.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0058.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.514] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.514] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.514] GetLastError () returned 0x0 [0058.514] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0058.531] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0058.633] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0058.633] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.633] SetEndOfFile (hFile=0x1bc) returned 1 [0058.633] CloseHandle (hObject=0x1bc) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.634] SetEndOfFile (hFile=0x1ec) returned 1 [0058.641] CloseHandle (hObject=0x1ec) returned 1 [0058.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".doc") returned 4 [0058.642] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".docx") returned 5 [0058.642] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0058.642] lstrlenW (lpString=".pdf") returned 4 [0058.642] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".xls") returned 4 [0058.642] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".xlsx") returned 5 [0058.642] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0058.642] lstrlenW (lpString=".ppt") returned 4 [0058.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString=".zip") returned 4 [0058.643] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.643] lstrlenW (lpString=".rar") returned 4 [0058.643] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.643] lstrlenW (lpString=".bz2") returned 4 [0058.643] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.643] lstrlenW (lpString=".7z") returned 3 [0058.643] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString=".dbf") returned 4 [0058.643] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString=".1cd") returned 4 [0058.643] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString=".jpg") returned 4 [0058.643] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.643] lstrlenW (lpString=".doc") returned 4 [0058.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.643] lstrlenW (lpString=".docx") returned 5 [0058.643] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0058.644] lstrlenW (lpString=".pdf") returned 4 [0058.644] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.644] lstrlenW (lpString=".xls") returned 4 [0058.644] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.644] lstrlenW (lpString=".xlsx") returned 5 [0058.644] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0058.644] lstrlenW (lpString=".ppt") returned 4 [0058.644] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.644] lstrlenW (lpString=".zip") returned 4 [0058.644] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.644] lstrlenW (lpString=".rar") returned 4 [0058.644] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.644] lstrlenW (lpString=".bz2") returned 4 [0058.644] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.644] lstrlenW (lpString=".7z") returned 3 [0058.644] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.644] lstrlenW (lpString=".dbf") returned 4 [0058.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.644] lstrlenW (lpString=".1cd") returned 4 [0058.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.644] lstrlenW (lpString=".jpg") returned 4 [0058.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.645] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.645] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0058.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.645] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=899992) returned 1 [0058.646] CloseHandle (hObject=0x1ec) returned 1 [0058.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0058.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.647] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.647] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0058.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.648] GetLastError () returned 0x0 [0058.648] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0058.863] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0058.880] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0058.880] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.880] SetEndOfFile (hFile=0x1bc) returned 1 [0059.115] CloseHandle (hObject=0x1bc) returned 1 [0059.116] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0059.116] SetEndOfFile (hFile=0x1ec) returned 1 [0059.374] CloseHandle (hObject=0x1ec) returned 1 [0059.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.384] lstrlenW (lpString=".doc") returned 4 [0059.384] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.385] lstrlenW (lpString=".docx") returned 5 [0059.385] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.385] lstrlenW (lpString=".pdf") returned 4 [0059.385] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.385] lstrlenW (lpString=".xls") returned 4 [0059.385] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.385] lstrlenW (lpString=".xlsx") returned 5 [0059.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.385] lstrlenW (lpString=".ppt") returned 4 [0059.385] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString=".zip") returned 4 [0059.416] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString=".rar") returned 4 [0059.416] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString=".bz2") returned 4 [0059.416] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.416] lstrlenW (lpString=".7z") returned 3 [0059.416] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString=".dbf") returned 4 [0059.416] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString=".1cd") returned 4 [0059.416] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString=".jpg") returned 4 [0059.416] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.416] lstrlenW (lpString=".doc") returned 4 [0059.416] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString=".docx") returned 5 [0059.416] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.416] lstrlenW (lpString=".pdf") returned 4 [0059.416] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.416] lstrlenW (lpString=".xls") returned 4 [0059.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.417] lstrlenW (lpString=".xlsx") returned 5 [0059.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.417] lstrlenW (lpString=".ppt") returned 4 [0059.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.417] lstrlenW (lpString=".zip") returned 4 [0059.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.417] lstrlenW (lpString=".rar") returned 4 [0059.417] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.417] lstrlenW (lpString=".bz2") returned 4 [0059.417] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.417] lstrlenW (lpString=".7z") returned 3 [0059.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.417] lstrlenW (lpString=".dbf") returned 4 [0059.417] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.417] lstrlenW (lpString=".1cd") returned 4 [0059.417] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.417] lstrlenW (lpString=".jpg") returned 4 [0059.417] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.417] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.417] lstrlenW (lpString="ACETXT.DLL") returned 10 [0059.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.418] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=297360) returned 1 [0059.418] CloseHandle (hObject=0x154) returned 1 [0059.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0059.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.418] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0059.418] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0059.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.419] GetLastError () returned 0x0 [0059.419] ReadFile (in: hFile=0x154, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x48990, lpOverlapped=0x0) returned 1 [0059.443] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0059.448] ReadFile (in: hFile=0x154, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0059.448] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.448] SetEndOfFile (hFile=0x1f4) returned 1 [0059.448] CloseHandle (hObject=0x1f4) returned 1 [0059.448] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0059.448] SetEndOfFile (hFile=0x154) returned 1 [0059.451] CloseHandle (hObject=0x154) returned 1 [0059.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0059.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.452] lstrlenW (lpString=".doc") returned 4 [0059.452] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString=".docx") returned 5 [0059.452] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.452] lstrlenW (lpString=".pdf") returned 4 [0059.452] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString=".xls") returned 4 [0059.452] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString=".xlsx") returned 5 [0059.452] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.452] lstrlenW (lpString=".ppt") returned 4 [0059.452] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.452] lstrlenW (lpString=".zip") returned 4 [0059.452] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString=".rar") returned 4 [0059.452] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.452] lstrlenW (lpString=".bz2") returned 4 [0059.452] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.452] lstrlenW (lpString=".7z") returned 3 [0059.452] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.452] lstrlenW (lpString=".dbf") returned 4 [0059.452] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.452] lstrlenW (lpString=".1cd") returned 4 [0059.453] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString=".jpg") returned 4 [0059.453] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString=".doc") returned 4 [0059.453] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString=".docx") returned 5 [0059.453] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.453] lstrlenW (lpString=".pdf") returned 4 [0059.453] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString=".xls") returned 4 [0059.453] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString=".xlsx") returned 5 [0059.453] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.453] lstrlenW (lpString=".ppt") returned 4 [0059.453] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString=".zip") returned 4 [0059.453] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString=".rar") returned 4 [0059.453] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.453] lstrlenW (lpString=".bz2") returned 4 [0059.453] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.453] lstrlenW (lpString=".7z") returned 3 [0059.453] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString=".dbf") returned 4 [0059.453] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.453] lstrlenW (lpString=".1cd") returned 4 [0059.454] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.454] lstrlenW (lpString=".jpg") returned 4 [0059.454] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.454] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.454] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0059.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.454] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3050912) returned 1 [0059.454] CloseHandle (hObject=0x154) returned 1 [0059.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0059.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0059.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.455] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0059.455] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0059.455] ReadFile (in: hFile=0x154, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.458] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0059.458] ReadFile (in: hFile=0x154, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.936] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.942] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0059.942] ReadFile (in: hFile=0x154, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.437] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0060.437] WriteFile (in: hFile=0x154, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0060.456] SetEndOfFile (hFile=0x154) returned 1 [0060.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0060.457] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0060.457] WriteFile (in: hFile=0x154, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.458] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0060.459] WriteFile (in: hFile=0x154, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.738] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0060.738] WriteFile (in: hFile=0x154, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.740] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0060.740] CloseHandle (hObject=0x154) returned 1 [0060.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.740] lstrlenW (lpString=".doc") returned 4 [0060.740] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.740] lstrlenW (lpString=".docx") returned 5 [0060.740] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0060.740] lstrlenW (lpString=".pdf") returned 4 [0060.740] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.740] lstrlenW (lpString=".xls") returned 4 [0060.740] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.740] lstrlenW (lpString=".xlsx") returned 5 [0060.740] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0060.740] lstrlenW (lpString=".ppt") returned 4 [0060.740] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString=".zip") returned 4 [0060.741] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString=".rar") returned 4 [0060.741] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString=".bz2") returned 4 [0060.741] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.741] lstrlenW (lpString=".7z") returned 3 [0060.741] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString=".dbf") returned 4 [0060.741] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString=".1cd") returned 4 [0060.741] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString=".jpg") returned 4 [0060.741] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.741] lstrlenW (lpString=".doc") returned 4 [0060.741] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString=".docx") returned 5 [0060.741] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0060.741] lstrlenW (lpString=".pdf") returned 4 [0060.741] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.741] lstrlenW (lpString=".xls") returned 4 [0060.741] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.742] lstrlenW (lpString=".xlsx") returned 5 [0060.742] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0060.742] lstrlenW (lpString=".ppt") returned 4 [0060.742] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.742] lstrlenW (lpString=".zip") returned 4 [0060.742] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.742] lstrlenW (lpString=".rar") returned 4 [0060.742] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.742] lstrlenW (lpString=".bz2") returned 4 [0060.742] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.742] lstrlenW (lpString=".7z") returned 3 [0060.742] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.742] lstrlenW (lpString=".dbf") returned 4 [0060.742] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.742] lstrlenW (lpString=".1cd") returned 4 [0060.742] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0060.742] lstrlenW (lpString=".jpg") returned 4 [0060.742] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.742] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.743] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0060.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.746] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=138616) returned 1 [0061.746] CloseHandle (hObject=0x160) returned 1 [0061.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0061.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.746] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0061.746] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0061.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.747] GetLastError () returned 0x0 [0061.747] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x21d78, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x21d80, lpOverlapped=0x0) returned 1 [0061.836] ReadFile (in: hFile=0x160, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.837] SetEndOfFile (hFile=0x190) returned 1 [0061.837] CloseHandle (hObject=0x190) returned 1 [0061.837] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0061.837] SetEndOfFile (hFile=0x160) returned 1 [0061.839] CloseHandle (hObject=0x160) returned 1 [0061.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0061.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0061.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.839] lstrlenW (lpString=".doc") returned 4 [0061.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.839] lstrlenW (lpString=".docx") returned 5 [0061.839] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0061.839] lstrlenW (lpString=".pdf") returned 4 [0061.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.839] lstrlenW (lpString=".xls") returned 4 [0061.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.839] lstrlenW (lpString=".xlsx") returned 5 [0061.839] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0061.839] lstrlenW (lpString=".ppt") returned 4 [0061.839] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.839] lstrlenW (lpString=".zip") returned 4 [0061.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString=".rar") returned 4 [0061.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString=".bz2") returned 4 [0061.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.840] lstrlenW (lpString=".7z") returned 3 [0061.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString=".dbf") returned 4 [0061.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString=".1cd") returned 4 [0061.840] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString=".jpg") returned 4 [0061.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString=".doc") returned 4 [0061.840] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString=".docx") returned 5 [0061.840] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0061.840] lstrlenW (lpString=".pdf") returned 4 [0061.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString=".xls") returned 4 [0061.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString=".xlsx") returned 5 [0061.840] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0061.840] lstrlenW (lpString=".ppt") returned 4 [0061.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.840] lstrlenW (lpString=".zip") returned 4 [0061.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.841] lstrlenW (lpString=".rar") returned 4 [0061.841] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.841] lstrlenW (lpString=".bz2") returned 4 [0061.841] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.841] lstrlenW (lpString=".7z") returned 3 [0061.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.841] lstrlenW (lpString=".dbf") returned 4 [0061.841] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.841] lstrlenW (lpString=".1cd") returned 4 [0061.841] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0061.841] lstrlenW (lpString=".jpg") returned 4 [0061.841] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.841] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0061.841] lstrlenW (lpString="MSORES.DLL") returned 10 [0061.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.842] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=72521600) returned 1 [0061.842] CloseHandle (hObject=0x160) returned 1 [0061.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0061.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0061.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0061.843] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0061.843] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.843] ReadFile (in: hFile=0x160, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.904] ReadFile (in: hFile=0x160, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.949] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.949] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.949] ReadFile (in: hFile=0x160, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.003] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0062.164] SetEndOfFile (hFile=0x160) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0062.164] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0062.164] WriteFile (in: hFile=0x160, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.165] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0062.165] WriteFile (in: hFile=0x160, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.165] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0062.165] WriteFile (in: hFile=0x160, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.168] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0062.168] CloseHandle (hObject=0x160) returned 1 [0062.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.168] lstrlenW (lpString=".doc") returned 4 [0062.168] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.168] lstrlenW (lpString=".docx") returned 5 [0062.168] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.168] lstrlenW (lpString=".pdf") returned 4 [0062.168] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.168] lstrlenW (lpString=".xls") returned 4 [0062.169] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString=".xlsx") returned 5 [0062.169] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.169] lstrlenW (lpString=".ppt") returned 4 [0062.169] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString=".zip") returned 4 [0062.169] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString=".rar") returned 4 [0062.169] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString=".bz2") returned 4 [0062.169] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.169] lstrlenW (lpString=".7z") returned 3 [0062.169] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString=".dbf") returned 4 [0062.169] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString=".1cd") returned 4 [0062.169] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString=".jpg") returned 4 [0062.169] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.169] lstrlenW (lpString=".doc") returned 4 [0062.169] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.169] lstrlenW (lpString=".docx") returned 5 [0062.169] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.169] lstrlenW (lpString=".pdf") returned 4 [0062.169] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.170] lstrlenW (lpString=".xls") returned 4 [0062.170] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.170] lstrlenW (lpString=".xlsx") returned 5 [0062.170] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.170] lstrlenW (lpString=".ppt") returned 4 [0062.170] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.170] lstrlenW (lpString=".zip") returned 4 [0062.170] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.170] lstrlenW (lpString=".rar") returned 4 [0062.170] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.170] lstrlenW (lpString=".bz2") returned 4 [0062.170] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.170] lstrlenW (lpString=".7z") returned 3 [0062.170] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.170] lstrlenW (lpString=".dbf") returned 4 [0062.170] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.170] lstrlenW (lpString=".1cd") returned 4 [0062.170] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.170] lstrlenW (lpString=".jpg") returned 4 [0062.170] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.170] lstrcmpiW (lpString1=".CAB", lpString2=".zoh") returned -1 [0062.170] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0062.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.832] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6747) returned 1 [0062.833] CloseHandle (hObject=0x214) returned 1 [0062.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0062.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.833] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.833] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.834] GetLastError () returned 0x0 [0062.834] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1a5b, lpOverlapped=0x0) returned 1 [0062.837] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0062.838] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0062.838] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.838] SetEndOfFile (hFile=0x1c8) returned 1 [0062.838] CloseHandle (hObject=0x1c8) returned 1 [0062.838] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.838] SetEndOfFile (hFile=0x214) returned 1 [0062.839] CloseHandle (hObject=0x214) returned 1 [0062.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0062.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.839] lstrlenW (lpString=".doc") returned 4 [0062.840] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString=".docx") returned 5 [0062.840] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0062.840] lstrlenW (lpString=".pdf") returned 4 [0062.840] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString=".xls") returned 4 [0062.840] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString=".xlsx") returned 5 [0062.840] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0062.840] lstrlenW (lpString=".ppt") returned 4 [0062.840] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString=".zip") returned 4 [0062.840] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString=".rar") returned 4 [0062.840] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString=".bz2") returned 4 [0062.840] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0062.840] lstrlenW (lpString=".7z") returned 3 [0062.840] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString=".dbf") returned 4 [0062.840] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString=".1cd") returned 4 [0062.840] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString=".jpg") returned 4 [0062.840] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.840] lstrlenW (lpString=".doc") returned 4 [0062.840] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString=".docx") returned 5 [0062.841] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0062.841] lstrlenW (lpString=".pdf") returned 4 [0062.841] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString=".xls") returned 4 [0062.841] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString=".xlsx") returned 5 [0062.841] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0062.841] lstrlenW (lpString=".ppt") returned 4 [0062.841] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.841] lstrlenW (lpString=".zip") returned 4 [0062.841] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString=".rar") returned 4 [0062.841] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString=".bz2") returned 4 [0062.841] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0062.841] lstrlenW (lpString=".7z") returned 3 [0062.841] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0062.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.841] lstrlenW (lpString=".dbf") returned 4 [0062.841] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0062.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.841] lstrlenW (lpString=".1cd") returned 4 [0062.841] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0062.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0062.841] lstrlenW (lpString=".jpg") returned 4 [0062.841] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0062.842] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.842] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0062.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.843] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=30056) returned 1 [0062.843] CloseHandle (hObject=0x214) returned 1 [0062.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0062.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.843] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.843] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.844] GetLastError () returned 0x0 [0062.844] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x7568, lpOverlapped=0x0) returned 1 [0062.846] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x7570, lpOverlapped=0x0) returned 1 [0062.847] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0062.847] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.847] SetEndOfFile (hFile=0x1c8) returned 1 [0062.847] CloseHandle (hObject=0x1c8) returned 1 [0062.847] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.847] SetEndOfFile (hFile=0x214) returned 1 [0062.848] CloseHandle (hObject=0x214) returned 1 [0062.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0062.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.849] lstrlenW (lpString=".doc") returned 4 [0062.849] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString=".docx") returned 5 [0062.849] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0062.849] lstrlenW (lpString=".pdf") returned 4 [0062.849] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString=".xls") returned 4 [0062.849] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString=".xlsx") returned 5 [0062.849] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0062.849] lstrlenW (lpString=".ppt") returned 4 [0062.849] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.849] lstrlenW (lpString=".zip") returned 4 [0062.849] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString=".rar") returned 4 [0062.849] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.849] lstrlenW (lpString=".bz2") returned 4 [0062.849] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.849] lstrlenW (lpString=".7z") returned 3 [0062.849] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.849] lstrlenW (lpString=".dbf") returned 4 [0062.849] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.849] lstrlenW (lpString=".1cd") returned 4 [0062.850] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString=".jpg") returned 4 [0062.850] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString=".doc") returned 4 [0062.850] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString=".docx") returned 5 [0062.850] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0062.850] lstrlenW (lpString=".pdf") returned 4 [0062.850] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString=".xls") returned 4 [0062.850] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString=".xlsx") returned 5 [0062.850] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0062.850] lstrlenW (lpString=".ppt") returned 4 [0062.850] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString=".zip") returned 4 [0062.850] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString=".rar") returned 4 [0062.850] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.850] lstrlenW (lpString=".bz2") returned 4 [0062.850] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.850] lstrlenW (lpString=".7z") returned 3 [0062.850] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString=".dbf") returned 4 [0062.850] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.850] lstrlenW (lpString=".1cd") returned 4 [0062.851] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.851] lstrlenW (lpString=".jpg") returned 4 [0062.851] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.851] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.851] lstrlenW (lpString="BRANDING.DLL") returned 12 [0062.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.852] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=15224) returned 1 [0062.852] CloseHandle (hObject=0x214) returned 1 [0062.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0062.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.852] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.852] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.853] GetLastError () returned 0x0 [0062.853] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3b78, lpOverlapped=0x0) returned 1 [0062.861] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3b80, lpOverlapped=0x0) returned 1 [0062.862] ReadFile (in: hFile=0x214, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0062.864] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.864] SetEndOfFile (hFile=0x1c8) returned 1 [0062.865] CloseHandle (hObject=0x1c8) returned 1 [0062.865] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.865] SetEndOfFile (hFile=0x214) returned 1 [0062.866] CloseHandle (hObject=0x214) returned 1 [0062.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0062.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.866] lstrlenW (lpString=".doc") returned 4 [0062.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.866] lstrlenW (lpString=".docx") returned 5 [0062.866] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0062.866] lstrlenW (lpString=".pdf") returned 4 [0062.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.866] lstrlenW (lpString=".xls") returned 4 [0062.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString=".xlsx") returned 5 [0062.867] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0062.867] lstrlenW (lpString=".ppt") returned 4 [0062.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString=".zip") returned 4 [0062.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString=".rar") returned 4 [0062.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString=".bz2") returned 4 [0062.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.867] lstrlenW (lpString=".7z") returned 3 [0062.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString=".dbf") returned 4 [0062.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString=".1cd") returned 4 [0062.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString=".jpg") returned 4 [0062.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.867] lstrlenW (lpString=".doc") returned 4 [0062.867] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.867] lstrlenW (lpString=".docx") returned 5 [0062.867] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0062.867] lstrlenW (lpString=".pdf") returned 4 [0062.868] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.868] lstrlenW (lpString=".xls") returned 4 [0062.868] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.868] lstrlenW (lpString=".xlsx") returned 5 [0062.868] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0062.868] lstrlenW (lpString=".ppt") returned 4 [0062.868] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.868] lstrlenW (lpString=".zip") returned 4 [0062.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.868] lstrlenW (lpString=".rar") returned 4 [0062.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.868] lstrlenW (lpString=".bz2") returned 4 [0062.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.868] lstrlenW (lpString=".7z") returned 3 [0062.868] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.868] lstrlenW (lpString=".dbf") returned 4 [0062.868] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.868] lstrlenW (lpString=".1cd") returned 4 [0062.868] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.868] lstrlenW (lpString=".jpg") returned 4 [0062.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.868] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.869] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0062.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0063.408] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=191872) returned 1 [0063.408] CloseHandle (hObject=0x1ec) returned 1 [0063.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0063.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0063.409] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.409] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0063.409] GetLastError () returned 0x0 [0063.409] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0063.421] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0063.425] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0063.425] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.425] SetEndOfFile (hFile=0x1fc) returned 1 [0063.425] CloseHandle (hObject=0x1fc) returned 1 [0063.425] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.425] SetEndOfFile (hFile=0x1ec) returned 1 [0063.427] CloseHandle (hObject=0x1ec) returned 1 [0063.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0063.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.427] lstrlenW (lpString=".doc") returned 4 [0063.427] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.427] lstrlenW (lpString=".docx") returned 5 [0063.427] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0063.427] lstrlenW (lpString=".pdf") returned 4 [0063.427] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString=".xls") returned 4 [0063.428] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString=".xlsx") returned 5 [0063.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0063.428] lstrlenW (lpString=".ppt") returned 4 [0063.428] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString=".zip") returned 4 [0063.428] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString=".rar") returned 4 [0063.428] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString=".bz2") returned 4 [0063.428] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.428] lstrlenW (lpString=".7z") returned 3 [0063.428] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString=".dbf") returned 4 [0063.428] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString=".1cd") returned 4 [0063.428] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString=".jpg") returned 4 [0063.428] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.428] lstrlenW (lpString=".doc") returned 4 [0063.428] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.428] lstrlenW (lpString=".docx") returned 5 [0063.428] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0063.428] lstrlenW (lpString=".pdf") returned 4 [0063.428] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.429] lstrlenW (lpString=".xls") returned 4 [0063.429] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.429] lstrlenW (lpString=".xlsx") returned 5 [0063.429] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0063.429] lstrlenW (lpString=".ppt") returned 4 [0063.429] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.429] lstrlenW (lpString=".zip") returned 4 [0063.429] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.429] lstrlenW (lpString=".rar") returned 4 [0063.429] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.429] lstrlenW (lpString=".bz2") returned 4 [0063.429] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.429] lstrlenW (lpString=".7z") returned 3 [0063.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.429] lstrlenW (lpString=".dbf") returned 4 [0063.429] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.429] lstrlenW (lpString=".1cd") returned 4 [0063.429] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0063.429] lstrlenW (lpString=".jpg") returned 4 [0063.429] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.429] lstrcmpiW (lpString1=".xrm-ms", lpString2=".zoh") returned -1 [0063.429] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.625] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=715834) returned 1 [0063.625] CloseHandle (hObject=0x1c8) returned 1 [0063.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0063.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.626] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.626] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0063.626] GetLastError () returned 0x0 [0063.626] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0063.642] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0063.656] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0063.656] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.656] SetEndOfFile (hFile=0x16c) returned 1 [0063.656] CloseHandle (hObject=0x16c) returned 1 [0063.656] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.656] SetEndOfFile (hFile=0x1c8) returned 1 [0063.880] CloseHandle (hObject=0x1c8) returned 1 [0063.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0063.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.880] lstrlenW (lpString=".doc") returned 4 [0063.880] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.880] lstrlenW (lpString=".docx") returned 5 [0063.880] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.880] lstrlenW (lpString=".pdf") returned 4 [0063.880] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.880] lstrlenW (lpString=".xls") returned 4 [0063.880] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.880] lstrlenW (lpString=".xlsx") returned 5 [0063.880] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.881] lstrlenW (lpString=".ppt") returned 4 [0063.881] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString=".zip") returned 4 [0063.881] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".rar") returned 4 [0063.881] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".bz2") returned 4 [0063.881] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".7z") returned 3 [0063.881] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString=".dbf") returned 4 [0063.881] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString=".1cd") returned 4 [0063.881] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString=".jpg") returned 4 [0063.881] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.881] lstrlenW (lpString=".doc") returned 4 [0063.881] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".docx") returned 5 [0063.881] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.881] lstrlenW (lpString=".pdf") returned 4 [0063.881] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".xls") returned 4 [0063.881] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.881] lstrlenW (lpString=".xlsx") returned 5 [0063.881] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.882] lstrlenW (lpString=".ppt") returned 4 [0063.882] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.882] lstrlenW (lpString=".zip") returned 4 [0063.882] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString=".rar") returned 4 [0063.882] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString=".bz2") returned 4 [0063.882] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString=".7z") returned 3 [0063.882] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.882] lstrlenW (lpString=".dbf") returned 4 [0063.882] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.882] lstrlenW (lpString=".1cd") returned 4 [0063.882] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.882] lstrlenW (lpString=".jpg") returned 4 [0063.882] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.882] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.882] lstrlenW (lpString="PJRESC.DLL") returned 10 [0063.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.883] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=261008) returned 1 [0063.883] CloseHandle (hObject=0x1c8) returned 1 [0063.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0063.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.883] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.883] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0063.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.027] GetLastError () returned 0x0 [0065.027] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3fb90, lpOverlapped=0x0) returned 1 [0065.033] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3fba0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3fba0, lpOverlapped=0x0) returned 1 [0065.038] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0065.038] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.038] SetEndOfFile (hFile=0x150) returned 1 [0065.038] CloseHandle (hObject=0x150) returned 1 [0065.038] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0065.038] SetEndOfFile (hFile=0x1c8) returned 1 [0065.040] CloseHandle (hObject=0x1c8) returned 1 [0065.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.157] lstrlenW (lpString=".doc") returned 4 [0065.157] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString=".docx") returned 5 [0065.157] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0065.157] lstrlenW (lpString=".pdf") returned 4 [0065.157] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString=".xls") returned 4 [0065.157] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString=".xlsx") returned 5 [0065.157] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0065.157] lstrlenW (lpString=".ppt") returned 4 [0065.157] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.157] lstrlenW (lpString=".zip") returned 4 [0065.157] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString=".rar") returned 4 [0065.157] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.157] lstrlenW (lpString=".bz2") returned 4 [0065.158] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.158] lstrlenW (lpString=".7z") returned 3 [0065.158] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString=".dbf") returned 4 [0065.158] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString=".1cd") returned 4 [0065.158] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString=".jpg") returned 4 [0065.158] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString=".doc") returned 4 [0065.158] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString=".docx") returned 5 [0065.158] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0065.158] lstrlenW (lpString=".pdf") returned 4 [0065.158] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString=".xls") returned 4 [0065.158] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString=".xlsx") returned 5 [0065.158] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0065.158] lstrlenW (lpString=".ppt") returned 4 [0065.158] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.158] lstrlenW (lpString=".zip") returned 4 [0065.158] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString=".rar") returned 4 [0065.158] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.158] lstrlenW (lpString=".bz2") returned 4 [0065.159] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.159] lstrlenW (lpString=".7z") returned 3 [0065.159] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.159] lstrlenW (lpString=".dbf") returned 4 [0065.159] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.159] lstrlenW (lpString=".1cd") returned 4 [0065.159] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0065.159] lstrlenW (lpString=".jpg") returned 4 [0065.159] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.159] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0065.159] lstrlenW (lpString="WISC30.DLL") returned 10 [0065.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.196] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=147344) returned 1 [0066.210] CloseHandle (hObject=0x1c8) returned 1 [0066.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0066.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.211] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0066.221] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0066.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.222] GetLastError () returned 0x0 [0066.222] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x23f90, lpOverlapped=0x0) returned 1 [0066.227] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x23fa0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x23fa0, lpOverlapped=0x0) returned 1 [0066.230] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0066.230] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0066.230] SetEndOfFile (hFile=0x1f4) returned 1 [0066.230] CloseHandle (hObject=0x1f4) returned 1 [0066.230] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0066.230] SetEndOfFile (hFile=0x1c8) returned 1 [0066.232] CloseHandle (hObject=0x1c8) returned 1 [0066.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1 [0066.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.232] lstrlenW (lpString=".doc") returned 4 [0066.232] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.232] lstrlenW (lpString=".docx") returned 5 [0066.232] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0066.232] lstrlenW (lpString=".pdf") returned 4 [0066.232] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.232] lstrlenW (lpString=".xls") returned 4 [0066.232] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.232] lstrlenW (lpString=".xlsx") returned 5 [0066.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0066.233] lstrlenW (lpString=".ppt") returned 4 [0066.233] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.233] lstrlenW (lpString=".zip") returned 4 [0066.233] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.233] lstrlenW (lpString=".rar") returned 4 [0066.233] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.233] lstrlenW (lpString=".bz2") returned 4 [0066.233] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.233] lstrlenW (lpString=".7z") returned 3 [0066.233] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.233] lstrlenW (lpString=".dbf") returned 4 [0066.233] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.233] lstrlenW (lpString=".1cd") returned 4 [0066.233] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.233] lstrlenW (lpString=".jpg") returned 4 [0066.233] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.234] lstrlenW (lpString=".doc") returned 4 [0066.234] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString=".docx") returned 5 [0066.234] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0066.234] lstrlenW (lpString=".pdf") returned 4 [0066.234] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString=".xls") returned 4 [0066.234] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString=".xlsx") returned 5 [0066.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0066.234] lstrlenW (lpString=".ppt") returned 4 [0066.234] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.234] lstrlenW (lpString=".zip") returned 4 [0066.234] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString=".rar") returned 4 [0066.234] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.234] lstrlenW (lpString=".bz2") returned 4 [0066.234] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.234] lstrlenW (lpString=".7z") returned 3 [0066.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.234] lstrlenW (lpString=".dbf") returned 4 [0066.234] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.234] lstrlenW (lpString=".1cd") returned 4 [0066.234] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0066.234] lstrlenW (lpString=".jpg") returned 4 [0066.234] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.235] lstrcmpiW (lpString1=".LEX", lpString2=".zoh") returned -1 [0066.235] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0066.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.373] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=444027) returned 1 [0067.374] CloseHandle (hObject=0x22c) returned 1 [0067.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0067.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.396] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.396] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.405] GetLastError () returned 0x0 [0067.405] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6c67b, lpOverlapped=0x0) returned 1 [0067.415] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c680, lpOverlapped=0x0) returned 1 [0067.424] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0067.424] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.424] SetEndOfFile (hFile=0x1f4) returned 1 [0067.425] CloseHandle (hObject=0x1f4) returned 1 [0067.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.425] SetEndOfFile (hFile=0x22c) returned 1 [0067.428] CloseHandle (hObject=0x22c) returned 1 [0067.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.429] lstrlenW (lpString=".doc") returned 4 [0067.429] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0067.429] lstrlenW (lpString=".docx") returned 5 [0067.429] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0067.429] lstrlenW (lpString=".pdf") returned 4 [0067.429] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0067.429] lstrlenW (lpString=".xls") returned 4 [0067.429] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0067.429] lstrlenW (lpString=".xlsx") returned 5 [0067.429] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0067.429] lstrlenW (lpString=".ppt") returned 4 [0067.429] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.429] lstrlenW (lpString=".zip") returned 4 [0067.429] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0067.429] lstrlenW (lpString=".rar") returned 4 [0067.429] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0067.429] lstrlenW (lpString=".bz2") returned 4 [0067.429] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0067.429] lstrlenW (lpString=".7z") returned 3 [0067.429] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0067.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString=".dbf") returned 4 [0067.430] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString=".1cd") returned 4 [0067.430] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString=".jpg") returned 4 [0067.430] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString=".doc") returned 4 [0067.430] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0067.430] lstrlenW (lpString=".docx") returned 5 [0067.430] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0067.430] lstrlenW (lpString=".pdf") returned 4 [0067.430] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0067.430] lstrlenW (lpString=".xls") returned 4 [0067.430] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0067.430] lstrlenW (lpString=".xlsx") returned 5 [0067.430] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0067.430] lstrlenW (lpString=".ppt") returned 4 [0067.430] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.430] lstrlenW (lpString=".zip") returned 4 [0067.430] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0067.430] lstrlenW (lpString=".rar") returned 4 [0067.430] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0067.430] lstrlenW (lpString=".bz2") returned 4 [0067.430] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0067.430] lstrlenW (lpString=".7z") returned 3 [0067.430] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0067.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.431] lstrlenW (lpString=".dbf") returned 4 [0067.431] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.431] lstrlenW (lpString=".1cd") returned 4 [0067.431] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0067.431] lstrlenW (lpString=".jpg") returned 4 [0067.431] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0067.431] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.431] lstrlenW (lpString="FPLACE.DLL") returned 10 [0067.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.513] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=181120) returned 1 [0067.513] CloseHandle (hObject=0x22c) returned 1 [0067.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0067.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0067.527] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.527] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.527] GetLastError () returned 0x0 [0067.527] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2c380, lpOverlapped=0x0) returned 1 [0067.577] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2c390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2c390, lpOverlapped=0x0) returned 1 [0067.672] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0067.672] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0067.673] SetEndOfFile (hFile=0x1f4) returned 1 [0067.673] CloseHandle (hObject=0x1f4) returned 1 [0067.673] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.673] SetEndOfFile (hFile=0x22c) returned 1 [0067.675] CloseHandle (hObject=0x22c) returned 1 [0067.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.675] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1 [0067.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.677] lstrlenW (lpString=".doc") returned 4 [0067.677] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.677] lstrlenW (lpString=".docx") returned 5 [0067.677] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0067.677] lstrlenW (lpString=".pdf") returned 4 [0067.677] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString=".xls") returned 4 [0067.678] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString=".xlsx") returned 5 [0067.678] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0067.678] lstrlenW (lpString=".ppt") returned 4 [0067.678] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString=".zip") returned 4 [0067.678] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString=".rar") returned 4 [0067.678] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString=".bz2") returned 4 [0067.678] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.678] lstrlenW (lpString=".7z") returned 3 [0067.678] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString=".dbf") returned 4 [0067.678] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString=".1cd") returned 4 [0067.678] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString=".jpg") returned 4 [0067.678] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.678] lstrlenW (lpString=".doc") returned 4 [0067.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.678] lstrlenW (lpString=".docx") returned 5 [0067.679] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0067.679] lstrlenW (lpString=".pdf") returned 4 [0067.679] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.679] lstrlenW (lpString=".xls") returned 4 [0067.679] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.679] lstrlenW (lpString=".xlsx") returned 5 [0067.679] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0067.679] lstrlenW (lpString=".ppt") returned 4 [0067.679] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.679] lstrlenW (lpString=".zip") returned 4 [0067.679] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.679] lstrlenW (lpString=".rar") returned 4 [0067.679] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.679] lstrlenW (lpString=".bz2") returned 4 [0067.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.679] lstrlenW (lpString=".7z") returned 3 [0067.679] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.679] lstrlenW (lpString=".dbf") returned 4 [0067.679] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.679] lstrlenW (lpString=".1cd") returned 4 [0067.679] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0067.679] lstrlenW (lpString=".jpg") returned 4 [0067.679] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.680] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0067.680] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0067.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.717] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=15744) returned 1 [0067.717] CloseHandle (hObject=0x1f4) returned 1 [0067.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0067.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.717] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.717] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.718] GetLastError () returned 0x0 [0067.718] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3d80, lpOverlapped=0x0) returned 1 [0067.736] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3d90, lpOverlapped=0x0) returned 1 [0067.737] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0067.738] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0067.738] SetEndOfFile (hFile=0x1c8) returned 1 [0067.738] CloseHandle (hObject=0x1c8) returned 1 [0067.738] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.738] SetEndOfFile (hFile=0x1f4) returned 1 [0067.739] CloseHandle (hObject=0x1f4) returned 1 [0067.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.739] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1 [0067.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.739] lstrlenW (lpString=".doc") returned 4 [0067.739] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0067.739] lstrlenW (lpString=".docx") returned 5 [0067.739] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0067.739] lstrlenW (lpString=".pdf") returned 4 [0067.739] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0067.739] lstrlenW (lpString=".xls") returned 4 [0067.739] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0067.739] lstrlenW (lpString=".xlsx") returned 5 [0067.739] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0067.739] lstrlenW (lpString=".ppt") returned 4 [0067.739] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0067.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.739] lstrlenW (lpString=".zip") returned 4 [0067.739] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString=".rar") returned 4 [0067.740] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString=".bz2") returned 4 [0067.740] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0067.740] lstrlenW (lpString=".7z") returned 3 [0067.740] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString=".dbf") returned 4 [0067.740] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString=".1cd") returned 4 [0067.740] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString=".jpg") returned 4 [0067.740] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString=".doc") returned 4 [0067.740] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0067.740] lstrlenW (lpString=".docx") returned 5 [0067.740] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0067.740] lstrlenW (lpString=".pdf") returned 4 [0067.740] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString=".xls") returned 4 [0067.740] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString=".xlsx") returned 5 [0067.740] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0067.740] lstrlenW (lpString=".ppt") returned 4 [0067.740] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.740] lstrlenW (lpString=".zip") returned 4 [0067.740] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0067.740] lstrlenW (lpString=".rar") returned 4 [0067.741] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0067.741] lstrlenW (lpString=".bz2") returned 4 [0067.741] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0067.741] lstrlenW (lpString=".7z") returned 3 [0067.741] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0067.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.741] lstrlenW (lpString=".dbf") returned 4 [0067.741] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0067.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.741] lstrlenW (lpString=".1cd") returned 4 [0067.741] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0067.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0067.741] lstrlenW (lpString=".jpg") returned 4 [0067.741] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0067.741] lstrcmpiW (lpString1=".cnv", lpString2=".zoh") returned -1 [0067.741] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0067.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.748] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=57248) returned 1 [0067.748] CloseHandle (hObject=0x190) returned 1 [0067.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0067.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.748] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.748] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.749] GetLastError () returned 0x0 [0067.749] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0067.753] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0067.754] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0067.754] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0067.754] SetEndOfFile (hFile=0x1f4) returned 1 [0067.755] CloseHandle (hObject=0x1f4) returned 1 [0067.755] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.755] SetEndOfFile (hFile=0x190) returned 1 [0067.756] CloseHandle (hObject=0x190) returned 1 [0067.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.756] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1 [0067.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.756] lstrlenW (lpString=".doc") returned 4 [0067.756] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0067.756] lstrlenW (lpString=".docx") returned 5 [0067.756] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0067.756] lstrlenW (lpString=".pdf") returned 4 [0067.756] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0067.756] lstrlenW (lpString=".xls") returned 4 [0067.756] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0067.756] lstrlenW (lpString=".xlsx") returned 5 [0067.757] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0067.757] lstrlenW (lpString=".ppt") returned 4 [0067.757] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString=".zip") returned 4 [0067.757] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString=".rar") returned 4 [0067.757] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString=".bz2") returned 4 [0067.757] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0067.757] lstrlenW (lpString=".7z") returned 3 [0067.757] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString=".dbf") returned 4 [0067.757] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString=".1cd") returned 4 [0067.757] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString=".jpg") returned 4 [0067.757] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.757] lstrlenW (lpString=".doc") returned 4 [0067.757] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString=".docx") returned 5 [0067.757] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0067.757] lstrlenW (lpString=".pdf") returned 4 [0067.757] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString=".xls") returned 4 [0067.757] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0067.757] lstrlenW (lpString=".xlsx") returned 5 [0067.758] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0067.758] lstrlenW (lpString=".ppt") returned 4 [0067.758] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0067.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.758] lstrlenW (lpString=".zip") returned 4 [0067.758] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0067.758] lstrlenW (lpString=".rar") returned 4 [0067.758] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0067.758] lstrlenW (lpString=".bz2") returned 4 [0067.758] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0067.758] lstrlenW (lpString=".7z") returned 3 [0067.758] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0067.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.758] lstrlenW (lpString=".dbf") returned 4 [0067.758] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0067.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.758] lstrlenW (lpString=".1cd") returned 4 [0067.758] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0067.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0067.758] lstrlenW (lpString=".jpg") returned 4 [0067.758] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0067.758] lstrcmpiW (lpString1=".CNV", lpString2=".zoh") returned -1 [0067.758] lstrlenW (lpString="WPFT632.CNV") returned 11 [0067.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.759] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=289648) returned 1 [0067.759] CloseHandle (hObject=0x190) returned 1 [0067.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0067.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.759] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.759] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.760] GetLastError () returned 0x0 [0067.760] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x46b70, lpOverlapped=0x0) returned 1 [0067.767] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x46b80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x46b80, lpOverlapped=0x0) returned 1 [0067.772] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0067.772] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0067.772] SetEndOfFile (hFile=0x1f4) returned 1 [0067.775] CloseHandle (hObject=0x1f4) returned 1 [0067.775] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0067.775] SetEndOfFile (hFile=0x190) returned 1 [0068.245] CloseHandle (hObject=0x190) returned 1 [0068.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.246] lstrlenW (lpString=".doc") returned 4 [0068.246] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString=".docx") returned 5 [0068.246] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0068.246] lstrlenW (lpString=".pdf") returned 4 [0068.246] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString=".xls") returned 4 [0068.246] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString=".xlsx") returned 5 [0068.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0068.246] lstrlenW (lpString=".ppt") returned 4 [0068.246] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.246] lstrlenW (lpString=".zip") returned 4 [0068.246] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString=".rar") returned 4 [0068.246] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0068.246] lstrlenW (lpString=".bz2") returned 4 [0068.247] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0068.247] lstrlenW (lpString=".7z") returned 3 [0068.247] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString=".dbf") returned 4 [0068.247] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString=".1cd") returned 4 [0068.247] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString=".jpg") returned 4 [0068.247] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString=".doc") returned 4 [0068.247] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString=".docx") returned 5 [0068.247] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0068.247] lstrlenW (lpString=".pdf") returned 4 [0068.247] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString=".xls") returned 4 [0068.247] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString=".xlsx") returned 5 [0068.247] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0068.247] lstrlenW (lpString=".ppt") returned 4 [0068.247] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.247] lstrlenW (lpString=".zip") returned 4 [0068.247] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0068.247] lstrlenW (lpString=".rar") returned 4 [0068.247] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0068.248] lstrlenW (lpString=".bz2") returned 4 [0068.248] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0068.248] lstrlenW (lpString=".7z") returned 3 [0068.248] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0068.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.248] lstrlenW (lpString=".dbf") returned 4 [0068.248] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0068.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.248] lstrlenW (lpString=".1cd") returned 4 [0068.248] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0068.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0068.248] lstrlenW (lpString=".jpg") returned 4 [0068.248] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0068.248] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.248] lstrlenW (lpString="AXIS.INF") returned 8 [0068.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.304] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=529) returned 1 [0068.304] CloseHandle (hObject=0x22c) returned 1 [0068.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0068.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.304] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.304] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.305] GetLastError () returned 0x0 [0068.305] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x211, lpOverlapped=0x0) returned 1 [0068.306] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x220, lpOverlapped=0x0) returned 1 [0068.340] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.340] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0068.340] SetEndOfFile (hFile=0x1ec) returned 1 [0068.340] CloseHandle (hObject=0x1ec) returned 1 [0068.340] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.340] SetEndOfFile (hFile=0x22c) returned 1 [0068.341] CloseHandle (hObject=0x22c) returned 1 [0068.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 1 [0068.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.341] lstrlenW (lpString=".doc") returned 4 [0068.342] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.342] lstrlenW (lpString=".docx") returned 5 [0068.342] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.342] lstrlenW (lpString=".pdf") returned 4 [0068.342] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString=".xls") returned 4 [0068.342] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString=".xlsx") returned 5 [0068.342] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.342] lstrlenW (lpString=".ppt") returned 4 [0068.342] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString=".zip") returned 4 [0068.342] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString=".rar") returned 4 [0068.342] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString=".bz2") returned 4 [0068.342] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.342] lstrlenW (lpString=".7z") returned 3 [0068.342] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString=".dbf") returned 4 [0068.342] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString=".1cd") returned 4 [0068.342] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString=".jpg") returned 4 [0068.342] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.342] lstrlenW (lpString=".doc") returned 4 [0068.342] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.343] lstrlenW (lpString=".docx") returned 5 [0068.343] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.343] lstrlenW (lpString=".pdf") returned 4 [0068.343] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.343] lstrlenW (lpString=".xls") returned 4 [0068.343] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.343] lstrlenW (lpString=".xlsx") returned 5 [0068.343] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.343] lstrlenW (lpString=".ppt") returned 4 [0068.343] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.343] lstrlenW (lpString=".zip") returned 4 [0068.343] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.343] lstrlenW (lpString=".rar") returned 4 [0068.343] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.343] lstrlenW (lpString=".bz2") returned 4 [0068.343] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.343] lstrlenW (lpString=".7z") returned 3 [0068.343] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.343] lstrlenW (lpString=".dbf") returned 4 [0068.343] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.343] lstrlenW (lpString=".1cd") returned 4 [0068.343] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0068.343] lstrlenW (lpString=".jpg") returned 4 [0068.343] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.344] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.344] lstrlenW (lpString="BREEZE.INF") returned 10 [0068.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.354] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=450) returned 1 [0068.354] CloseHandle (hObject=0x22c) returned 1 [0068.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0068.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.354] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.355] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.355] GetLastError () returned 0x0 [0068.355] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1c2, lpOverlapped=0x0) returned 1 [0068.356] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0068.357] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.357] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.357] SetEndOfFile (hFile=0x1ec) returned 1 [0068.357] CloseHandle (hObject=0x1ec) returned 1 [0068.357] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.357] SetEndOfFile (hFile=0x22c) returned 1 [0068.358] CloseHandle (hObject=0x22c) returned 1 [0068.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.358] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1 [0068.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.358] lstrlenW (lpString=".doc") returned 4 [0068.358] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.359] lstrlenW (lpString=".docx") returned 5 [0068.359] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0068.359] lstrlenW (lpString=".pdf") returned 4 [0068.359] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString=".xls") returned 4 [0068.359] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString=".xlsx") returned 5 [0068.359] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0068.359] lstrlenW (lpString=".ppt") returned 4 [0068.359] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString=".zip") returned 4 [0068.359] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString=".rar") returned 4 [0068.359] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString=".bz2") returned 4 [0068.359] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.359] lstrlenW (lpString=".7z") returned 3 [0068.359] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString=".dbf") returned 4 [0068.359] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString=".1cd") returned 4 [0068.359] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString=".jpg") returned 4 [0068.359] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.359] lstrlenW (lpString=".doc") returned 4 [0068.359] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.360] lstrlenW (lpString=".docx") returned 5 [0068.360] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0068.360] lstrlenW (lpString=".pdf") returned 4 [0068.360] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.360] lstrlenW (lpString=".xls") returned 4 [0068.360] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.360] lstrlenW (lpString=".xlsx") returned 5 [0068.360] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0068.360] lstrlenW (lpString=".ppt") returned 4 [0068.360] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.360] lstrlenW (lpString=".zip") returned 4 [0068.360] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.360] lstrlenW (lpString=".rar") returned 4 [0068.360] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.360] lstrlenW (lpString=".bz2") returned 4 [0068.360] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.360] lstrlenW (lpString=".7z") returned 3 [0068.360] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.360] lstrlenW (lpString=".dbf") returned 4 [0068.360] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.360] lstrlenW (lpString=".1cd") returned 4 [0068.360] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0068.360] lstrlenW (lpString=".jpg") returned 4 [0068.360] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.360] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.361] lstrlenW (lpString="CANYON.INF") returned 10 [0068.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.370] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=465) returned 1 [0068.370] CloseHandle (hObject=0x22c) returned 1 [0068.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0068.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.371] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.371] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.419] GetLastError () returned 0x0 [0068.419] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1d1, lpOverlapped=0x0) returned 1 [0068.420] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0068.420] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.420] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.421] SetEndOfFile (hFile=0x190) returned 1 [0068.421] CloseHandle (hObject=0x190) returned 1 [0068.421] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.421] SetEndOfFile (hFile=0x22c) returned 1 [0068.422] CloseHandle (hObject=0x22c) returned 1 [0068.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.422] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 1 [0068.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.422] lstrlenW (lpString=".doc") returned 4 [0068.422] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.422] lstrlenW (lpString=".docx") returned 5 [0068.422] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0068.422] lstrlenW (lpString=".pdf") returned 4 [0068.422] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.422] lstrlenW (lpString=".xls") returned 4 [0068.422] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.422] lstrlenW (lpString=".xlsx") returned 5 [0068.422] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0068.422] lstrlenW (lpString=".ppt") returned 4 [0068.422] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.422] lstrlenW (lpString=".zip") returned 4 [0068.422] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.422] lstrlenW (lpString=".rar") returned 4 [0068.422] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString=".bz2") returned 4 [0068.423] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.423] lstrlenW (lpString=".7z") returned 3 [0068.423] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString=".dbf") returned 4 [0068.423] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString=".1cd") returned 4 [0068.423] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString=".jpg") returned 4 [0068.423] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString=".doc") returned 4 [0068.423] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.423] lstrlenW (lpString=".docx") returned 5 [0068.423] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0068.423] lstrlenW (lpString=".pdf") returned 4 [0068.423] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString=".xls") returned 4 [0068.423] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString=".xlsx") returned 5 [0068.423] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0068.423] lstrlenW (lpString=".ppt") returned 4 [0068.423] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.423] lstrlenW (lpString=".zip") returned 4 [0068.423] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.423] lstrlenW (lpString=".rar") returned 4 [0068.423] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.424] lstrlenW (lpString=".bz2") returned 4 [0068.424] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.424] lstrlenW (lpString=".7z") returned 3 [0068.424] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.424] lstrlenW (lpString=".dbf") returned 4 [0068.424] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.424] lstrlenW (lpString=".1cd") returned 4 [0068.424] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0068.424] lstrlenW (lpString=".jpg") returned 4 [0068.424] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.424] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.424] lstrlenW (lpString="CAPSULES.INF") returned 12 [0068.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.424] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=501) returned 1 [0068.425] CloseHandle (hObject=0x22c) returned 1 [0068.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0068.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.425] GetLastError () returned 0x0 [0068.425] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1f5, lpOverlapped=0x0) returned 1 [0068.426] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x200, lpOverlapped=0x0) returned 1 [0068.427] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.427] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.427] SetEndOfFile (hFile=0x190) returned 1 [0068.427] CloseHandle (hObject=0x190) returned 1 [0068.427] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.427] SetEndOfFile (hFile=0x22c) returned 1 [0068.428] CloseHandle (hObject=0x22c) returned 1 [0068.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 1 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.429] lstrlenW (lpString=".doc") returned 4 [0068.429] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.429] lstrlenW (lpString=".docx") returned 5 [0068.429] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.429] lstrlenW (lpString=".pdf") returned 4 [0068.429] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.429] lstrlenW (lpString=".xls") returned 4 [0068.429] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.429] lstrlenW (lpString=".xlsx") returned 5 [0068.429] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.429] lstrlenW (lpString=".ppt") returned 4 [0068.429] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.429] lstrlenW (lpString=".zip") returned 4 [0068.429] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.429] lstrlenW (lpString=".rar") returned 4 [0068.429] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.429] lstrlenW (lpString=".bz2") returned 4 [0068.429] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.429] lstrlenW (lpString=".7z") returned 3 [0068.429] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.429] lstrlenW (lpString=".dbf") returned 4 [0068.429] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.429] lstrlenW (lpString=".1cd") returned 4 [0068.429] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.430] lstrlenW (lpString=".jpg") returned 4 [0068.430] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.430] lstrlenW (lpString=".doc") returned 4 [0068.430] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.430] lstrlenW (lpString=".docx") returned 5 [0068.430] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.430] lstrlenW (lpString=".pdf") returned 4 [0068.430] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString=".xls") returned 4 [0068.430] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString=".xlsx") returned 5 [0068.430] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.430] lstrlenW (lpString=".ppt") returned 4 [0068.430] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.430] lstrlenW (lpString=".zip") returned 4 [0068.430] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString=".rar") returned 4 [0068.430] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.430] lstrlenW (lpString=".bz2") returned 4 [0068.430] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.430] lstrlenW (lpString=".7z") returned 3 [0068.430] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.430] lstrlenW (lpString=".dbf") returned 4 [0068.430] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.431] lstrlenW (lpString=".1cd") returned 4 [0068.431] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0068.431] lstrlenW (lpString=".jpg") returned 4 [0068.431] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.431] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.431] lstrlenW (lpString="CASCADE.ELM") returned 11 [0068.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.431] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=47684) returned 1 [0068.431] CloseHandle (hObject=0x22c) returned 1 [0068.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20 [0068.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.432] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.432] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.432] GetLastError () returned 0x0 [0068.432] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xba44, lpOverlapped=0x0) returned 1 [0068.659] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xba50, lpOverlapped=0x0) returned 1 [0068.660] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.660] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.660] SetEndOfFile (hFile=0x190) returned 1 [0068.660] CloseHandle (hObject=0x190) returned 1 [0068.661] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.661] SetEndOfFile (hFile=0x22c) returned 1 [0068.662] CloseHandle (hObject=0x22c) returned 1 [0068.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 1 [0068.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.662] lstrlenW (lpString=".doc") returned 4 [0068.662] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.662] lstrlenW (lpString=".docx") returned 5 [0068.662] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0068.662] lstrlenW (lpString=".pdf") returned 4 [0068.662] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.662] lstrlenW (lpString=".xls") returned 4 [0068.662] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.662] lstrlenW (lpString=".xlsx") returned 5 [0068.662] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0068.662] lstrlenW (lpString=".ppt") returned 4 [0068.662] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString=".zip") returned 4 [0068.663] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString=".rar") returned 4 [0068.663] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString=".bz2") returned 4 [0068.663] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.663] lstrlenW (lpString=".7z") returned 3 [0068.663] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString=".dbf") returned 4 [0068.663] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString=".1cd") returned 4 [0068.663] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString=".jpg") returned 4 [0068.663] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.663] lstrlenW (lpString=".doc") returned 4 [0068.663] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.663] lstrlenW (lpString=".docx") returned 5 [0068.663] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0068.663] lstrlenW (lpString=".pdf") returned 4 [0068.663] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString=".xls") returned 4 [0068.663] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString=".xlsx") returned 5 [0068.663] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0068.663] lstrlenW (lpString=".ppt") returned 4 [0068.663] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.664] lstrlenW (lpString=".zip") returned 4 [0068.664] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.664] lstrlenW (lpString=".rar") returned 4 [0068.664] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.664] lstrlenW (lpString=".bz2") returned 4 [0068.664] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.664] lstrlenW (lpString=".7z") returned 3 [0068.664] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.664] lstrlenW (lpString=".dbf") returned 4 [0068.664] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.664] lstrlenW (lpString=".1cd") returned 4 [0068.664] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0068.664] lstrlenW (lpString=".jpg") returned 4 [0068.664] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.664] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0068.664] lstrlenW (lpString="COMPASS.INF") returned 11 [0068.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.665] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=486) returned 1 [0068.665] CloseHandle (hObject=0x22c) returned 1 [0068.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0068.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.665] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.665] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.666] GetLastError () returned 0x0 [0068.666] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1e6, lpOverlapped=0x0) returned 1 [0068.667] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1f0, lpOverlapped=0x0) returned 1 [0068.668] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.668] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.668] SetEndOfFile (hFile=0x190) returned 1 [0068.668] CloseHandle (hObject=0x190) returned 1 [0068.668] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.668] SetEndOfFile (hFile=0x22c) returned 1 [0068.669] CloseHandle (hObject=0x22c) returned 1 [0068.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 1 [0068.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.669] lstrlenW (lpString=".doc") returned 4 [0068.669] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.669] lstrlenW (lpString=".docx") returned 5 [0068.669] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.669] lstrlenW (lpString=".pdf") returned 4 [0068.669] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.669] lstrlenW (lpString=".xls") returned 4 [0068.670] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString=".xlsx") returned 5 [0068.670] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.670] lstrlenW (lpString=".ppt") returned 4 [0068.670] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString=".zip") returned 4 [0068.670] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString=".rar") returned 4 [0068.670] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString=".bz2") returned 4 [0068.670] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.670] lstrlenW (lpString=".7z") returned 3 [0068.670] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString=".dbf") returned 4 [0068.670] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString=".1cd") returned 4 [0068.670] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString=".jpg") returned 4 [0068.670] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.670] lstrlenW (lpString=".doc") returned 4 [0068.670] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.670] lstrlenW (lpString=".docx") returned 5 [0068.670] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0068.670] lstrlenW (lpString=".pdf") returned 4 [0068.670] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.670] lstrlenW (lpString=".xls") returned 4 [0068.671] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.671] lstrlenW (lpString=".xlsx") returned 5 [0068.671] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0068.671] lstrlenW (lpString=".ppt") returned 4 [0068.671] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.671] lstrlenW (lpString=".zip") returned 4 [0068.671] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.671] lstrlenW (lpString=".rar") returned 4 [0068.671] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.671] lstrlenW (lpString=".bz2") returned 4 [0068.671] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.671] lstrlenW (lpString=".7z") returned 3 [0068.671] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.671] lstrlenW (lpString=".dbf") returned 4 [0068.671] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.671] lstrlenW (lpString=".1cd") returned 4 [0068.671] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0068.671] lstrlenW (lpString=".jpg") returned 4 [0068.671] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.671] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.671] lstrlenW (lpString="CONCRETE.ELM") returned 12 [0068.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.672] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=45528) returned 1 [0068.672] CloseHandle (hObject=0x22c) returned 1 [0068.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0068.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0068.672] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.672] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.673] GetLastError () returned 0x0 [0068.673] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb1d8, lpOverlapped=0x0) returned 1 [0068.772] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb1e0, lpOverlapped=0x0) returned 1 [0068.774] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.774] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.774] SetEndOfFile (hFile=0x190) returned 1 [0068.774] CloseHandle (hObject=0x190) returned 1 [0068.774] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.774] SetEndOfFile (hFile=0x22c) returned 1 [0068.775] CloseHandle (hObject=0x22c) returned 1 [0068.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.775] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.177] lstrlenW (lpString=".doc") returned 4 [0069.177] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.177] lstrlenW (lpString=".docx") returned 5 [0069.177] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.177] lstrlenW (lpString=".pdf") returned 4 [0069.177] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.177] lstrlenW (lpString=".xls") returned 4 [0069.177] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.177] lstrlenW (lpString=".xlsx") returned 5 [0069.177] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.177] lstrlenW (lpString=".ppt") returned 4 [0069.177] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.177] lstrlenW (lpString=".zip") returned 4 [0069.178] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString=".rar") returned 4 [0069.178] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString=".bz2") returned 4 [0069.178] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.178] lstrlenW (lpString=".7z") returned 3 [0069.178] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString=".dbf") returned 4 [0069.178] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString=".1cd") returned 4 [0069.178] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString=".jpg") returned 4 [0069.178] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString=".doc") returned 4 [0069.178] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.178] lstrlenW (lpString=".docx") returned 5 [0069.178] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.178] lstrlenW (lpString=".pdf") returned 4 [0069.178] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString=".xls") returned 4 [0069.178] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString=".xlsx") returned 5 [0069.178] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.178] lstrlenW (lpString=".ppt") returned 4 [0069.178] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.178] lstrlenW (lpString=".zip") returned 4 [0069.178] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.179] lstrlenW (lpString=".rar") returned 4 [0069.179] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.179] lstrlenW (lpString=".bz2") returned 4 [0069.179] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.179] lstrlenW (lpString=".7z") returned 3 [0069.179] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.179] lstrlenW (lpString=".dbf") returned 4 [0069.179] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.179] lstrlenW (lpString=".1cd") returned 4 [0069.179] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0069.179] lstrlenW (lpString=".jpg") returned 4 [0069.179] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.179] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0069.179] lstrlenW (lpString="EXPEDITN.INF") returned 12 [0069.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.226] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=597) returned 1 [0069.226] CloseHandle (hObject=0x180) returned 1 [0069.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0069.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.242] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.242] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.272] GetLastError () returned 0x0 [0069.272] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x255, lpOverlapped=0x0) returned 1 [0069.273] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x260, lpOverlapped=0x0) returned 1 [0069.287] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.287] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.287] SetEndOfFile (hFile=0x16c) returned 1 [0069.288] CloseHandle (hObject=0x16c) returned 1 [0069.288] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.288] SetEndOfFile (hFile=0x180) returned 1 [0069.288] CloseHandle (hObject=0x180) returned 1 [0069.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 1 [0069.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.289] lstrlenW (lpString=".doc") returned 4 [0069.289] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.289] lstrlenW (lpString=".docx") returned 5 [0069.289] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0069.289] lstrlenW (lpString=".pdf") returned 4 [0069.289] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.289] lstrlenW (lpString=".xls") returned 4 [0069.289] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.289] lstrlenW (lpString=".xlsx") returned 5 [0069.289] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0069.289] lstrlenW (lpString=".ppt") returned 4 [0069.289] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.289] lstrlenW (lpString=".zip") returned 4 [0069.289] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.289] lstrlenW (lpString=".rar") returned 4 [0069.289] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.289] lstrlenW (lpString=".bz2") returned 4 [0069.290] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.290] lstrlenW (lpString=".7z") returned 3 [0069.290] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.290] lstrlenW (lpString=".dbf") returned 4 [0069.290] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.290] lstrlenW (lpString=".1cd") returned 4 [0069.290] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.290] lstrlenW (lpString=".jpg") returned 4 [0069.290] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.290] lstrlenW (lpString=".doc") returned 4 [0069.290] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.290] lstrlenW (lpString=".docx") returned 5 [0069.290] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0069.290] lstrlenW (lpString=".pdf") returned 4 [0069.290] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.290] lstrlenW (lpString=".xls") returned 4 [0069.290] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.290] lstrlenW (lpString=".xlsx") returned 5 [0069.290] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0069.291] lstrlenW (lpString=".ppt") returned 4 [0069.291] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.291] lstrlenW (lpString=".zip") returned 4 [0069.291] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.291] lstrlenW (lpString=".rar") returned 4 [0069.291] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.291] lstrlenW (lpString=".bz2") returned 4 [0069.291] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.291] lstrlenW (lpString=".7z") returned 3 [0069.291] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.291] lstrlenW (lpString=".dbf") returned 4 [0069.291] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.291] lstrlenW (lpString=".1cd") returned 4 [0069.291] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0069.291] lstrlenW (lpString=".jpg") returned 4 [0069.291] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.291] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0069.291] lstrlenW (lpString="LEVEL.INF") returned 9 [0069.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.292] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=526) returned 1 [0069.292] CloseHandle (hObject=0x180) returned 1 [0069.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0069.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.292] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.292] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.293] GetLastError () returned 0x0 [0069.293] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x20e, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x210, lpOverlapped=0x0) returned 1 [0069.294] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.294] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.295] SetEndOfFile (hFile=0x16c) returned 1 [0069.295] CloseHandle (hObject=0x16c) returned 1 [0069.295] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.295] SetEndOfFile (hFile=0x180) returned 1 [0069.296] CloseHandle (hObject=0x180) returned 1 [0069.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 1 [0069.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.296] lstrlenW (lpString=".doc") returned 4 [0069.296] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.296] lstrlenW (lpString=".docx") returned 5 [0069.296] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0069.296] lstrlenW (lpString=".pdf") returned 4 [0069.296] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.296] lstrlenW (lpString=".xls") returned 4 [0069.296] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.296] lstrlenW (lpString=".xlsx") returned 5 [0069.296] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0069.296] lstrlenW (lpString=".ppt") returned 4 [0069.296] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.296] lstrlenW (lpString=".zip") returned 4 [0069.296] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.296] lstrlenW (lpString=".rar") returned 4 [0069.296] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.296] lstrlenW (lpString=".bz2") returned 4 [0069.297] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.297] lstrlenW (lpString=".7z") returned 3 [0069.297] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString=".dbf") returned 4 [0069.297] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString=".1cd") returned 4 [0069.297] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString=".jpg") returned 4 [0069.297] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString=".doc") returned 4 [0069.297] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.297] lstrlenW (lpString=".docx") returned 5 [0069.297] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0069.297] lstrlenW (lpString=".pdf") returned 4 [0069.297] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString=".xls") returned 4 [0069.297] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString=".xlsx") returned 5 [0069.297] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0069.297] lstrlenW (lpString=".ppt") returned 4 [0069.297] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.297] lstrlenW (lpString=".zip") returned 4 [0069.297] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString=".rar") returned 4 [0069.297] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.297] lstrlenW (lpString=".bz2") returned 4 [0069.298] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.298] lstrlenW (lpString=".7z") returned 3 [0069.298] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.298] lstrlenW (lpString=".dbf") returned 4 [0069.298] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.298] lstrlenW (lpString=".1cd") returned 4 [0069.298] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0069.298] lstrlenW (lpString=".jpg") returned 4 [0069.298] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.298] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0069.298] lstrlenW (lpString="NETWORK.ELM") returned 11 [0069.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.299] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=50761) returned 1 [0069.299] CloseHandle (hObject=0x180) returned 1 [0069.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20 [0069.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.299] GetLastError () returned 0x0 [0069.299] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xc649, lpOverlapped=0x0) returned 1 [0069.302] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xc650, lpOverlapped=0x0) returned 1 [0069.303] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.303] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.303] SetEndOfFile (hFile=0x16c) returned 1 [0069.304] CloseHandle (hObject=0x16c) returned 1 [0069.304] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.304] SetEndOfFile (hFile=0x180) returned 1 [0069.305] CloseHandle (hObject=0x180) returned 1 [0069.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 1 [0069.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.305] lstrlenW (lpString=".doc") returned 4 [0069.305] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.305] lstrlenW (lpString=".docx") returned 5 [0069.305] lstrcmpiW (lpString1=".docx", lpString2="K.ELM") returned -1 [0069.305] lstrlenW (lpString=".pdf") returned 4 [0069.305] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.305] lstrlenW (lpString=".xls") returned 4 [0069.305] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString=".xlsx") returned 5 [0069.306] lstrcmpiW (lpString1=".xlsx", lpString2="K.ELM") returned -1 [0069.306] lstrlenW (lpString=".ppt") returned 4 [0069.306] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString=".zip") returned 4 [0069.306] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString=".rar") returned 4 [0069.306] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString=".bz2") returned 4 [0069.306] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.306] lstrlenW (lpString=".7z") returned 3 [0069.306] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString=".dbf") returned 4 [0069.306] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString=".1cd") returned 4 [0069.306] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString=".jpg") returned 4 [0069.306] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.306] lstrlenW (lpString=".doc") returned 4 [0069.306] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.306] lstrlenW (lpString=".docx") returned 5 [0069.306] lstrcmpiW (lpString1=".docx", lpString2="K.ELM") returned -1 [0069.306] lstrlenW (lpString=".pdf") returned 4 [0069.306] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.306] lstrlenW (lpString=".xls") returned 4 [0069.306] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.307] lstrlenW (lpString=".xlsx") returned 5 [0069.307] lstrcmpiW (lpString1=".xlsx", lpString2="K.ELM") returned -1 [0069.307] lstrlenW (lpString=".ppt") returned 4 [0069.307] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.307] lstrlenW (lpString=".zip") returned 4 [0069.307] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.307] lstrlenW (lpString=".rar") returned 4 [0069.307] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.307] lstrlenW (lpString=".bz2") returned 4 [0069.307] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.307] lstrlenW (lpString=".7z") returned 3 [0069.307] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.307] lstrlenW (lpString=".dbf") returned 4 [0069.307] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.307] lstrlenW (lpString=".1cd") returned 4 [0069.307] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0069.307] lstrlenW (lpString=".jpg") returned 4 [0069.307] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.307] lstrcmpiW (lpString1=".INF", lpString2=".zoh") returned -1 [0069.307] lstrlenW (lpString="NETWORK.INF") returned 11 [0069.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.308] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=585) returned 1 [0069.308] CloseHandle (hObject=0x180) returned 1 [0069.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20 [0069.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.309] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.309] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.309] GetLastError () returned 0x0 [0069.309] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x249, lpOverlapped=0x0) returned 1 [0069.310] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x250, lpOverlapped=0x0) returned 1 [0069.311] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.311] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.311] SetEndOfFile (hFile=0x16c) returned 1 [0069.312] CloseHandle (hObject=0x16c) returned 1 [0069.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.312] SetEndOfFile (hFile=0x180) returned 1 [0069.312] CloseHandle (hObject=0x180) returned 1 [0069.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 1 [0069.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.313] lstrlenW (lpString=".doc") returned 4 [0069.313] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.313] lstrlenW (lpString=".docx") returned 5 [0069.313] lstrcmpiW (lpString1=".docx", lpString2="K.INF") returned -1 [0069.313] lstrlenW (lpString=".pdf") returned 4 [0069.313] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.313] lstrlenW (lpString=".xls") returned 4 [0069.313] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.313] lstrlenW (lpString=".xlsx") returned 5 [0069.313] lstrcmpiW (lpString1=".xlsx", lpString2="K.INF") returned -1 [0069.313] lstrlenW (lpString=".ppt") returned 4 [0069.313] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.313] lstrlenW (lpString=".zip") returned 4 [0069.313] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.313] lstrlenW (lpString=".rar") returned 4 [0069.313] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.313] lstrlenW (lpString=".bz2") returned 4 [0069.313] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.313] lstrlenW (lpString=".7z") returned 3 [0069.313] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.313] lstrlenW (lpString=".dbf") returned 4 [0069.313] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString=".1cd") returned 4 [0069.314] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString=".jpg") returned 4 [0069.314] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString=".doc") returned 4 [0069.314] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.314] lstrlenW (lpString=".docx") returned 5 [0069.314] lstrcmpiW (lpString1=".docx", lpString2="K.INF") returned -1 [0069.314] lstrlenW (lpString=".pdf") returned 4 [0069.314] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString=".xls") returned 4 [0069.314] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString=".xlsx") returned 5 [0069.314] lstrcmpiW (lpString1=".xlsx", lpString2="K.INF") returned -1 [0069.314] lstrlenW (lpString=".ppt") returned 4 [0069.314] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString=".zip") returned 4 [0069.314] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString=".rar") returned 4 [0069.314] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.314] lstrlenW (lpString=".bz2") returned 4 [0069.314] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.314] lstrlenW (lpString=".7z") returned 3 [0069.314] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.314] lstrlenW (lpString=".dbf") returned 4 [0069.314] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.315] lstrlenW (lpString=".1cd") returned 4 [0069.315] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0069.315] lstrlenW (lpString=".jpg") returned 4 [0069.315] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.315] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") [0069.315] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=91861) returned 1 [0069.315] CloseHandle (hObject=0x180) returned 1 [0069.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0069.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.316] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.316] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.316] GetLastError () returned 0x0 [0069.316] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x166d5, lpOverlapped=0x0) returned 1 [0069.340] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x166e0, lpOverlapped=0x0) returned 1 [0069.342] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.342] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.343] SetEndOfFile (hFile=0x16c) returned 1 [0069.343] CloseHandle (hObject=0x16c) returned 1 [0069.343] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.343] SetEndOfFile (hFile=0x180) returned 1 [0069.344] CloseHandle (hObject=0x180) returned 1 [0069.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.344] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 1 [0069.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString=".doc") returned 4 [0069.346] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.346] lstrlenW (lpString=".docx") returned 5 [0069.346] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0069.346] lstrlenW (lpString=".pdf") returned 4 [0069.346] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.346] lstrlenW (lpString=".xls") returned 4 [0069.346] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.346] lstrlenW (lpString=".xlsx") returned 5 [0069.346] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0069.346] lstrlenW (lpString=".ppt") returned 4 [0069.346] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString=".zip") returned 4 [0069.346] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.346] lstrlenW (lpString=".rar") returned 4 [0069.346] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.346] lstrlenW (lpString=".bz2") returned 4 [0069.346] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.346] lstrlenW (lpString=".7z") returned 3 [0069.346] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString=".dbf") returned 4 [0069.346] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString=".1cd") returned 4 [0069.346] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0069.346] lstrlenW (lpString=".jpg") returned 4 [0069.346] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.346] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") [0069.347] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=539) returned 1 [0069.347] CloseHandle (hObject=0x180) returned 1 [0069.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20 [0069.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0069.347] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.347] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.348] GetLastError () returned 0x0 [0069.348] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x21b, lpOverlapped=0x0) returned 1 [0069.349] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x220, lpOverlapped=0x0) returned 1 [0069.350] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.350] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.350] SetEndOfFile (hFile=0x16c) returned 1 [0069.351] CloseHandle (hObject=0x16c) returned 1 [0069.351] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.351] SetEndOfFile (hFile=0x180) returned 1 [0069.354] CloseHandle (hObject=0x180) returned 1 [0069.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 1 [0069.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.354] lstrlenW (lpString=".doc") returned 4 [0069.354] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.354] lstrlenW (lpString=".docx") returned 5 [0069.354] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0069.354] lstrlenW (lpString=".pdf") returned 4 [0069.354] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.354] lstrlenW (lpString=".xls") returned 4 [0069.354] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.355] lstrlenW (lpString=".xlsx") returned 5 [0069.355] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0069.355] lstrlenW (lpString=".ppt") returned 4 [0069.355] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.355] lstrlenW (lpString=".zip") returned 4 [0069.355] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.355] lstrlenW (lpString=".rar") returned 4 [0069.355] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.355] lstrlenW (lpString=".bz2") returned 4 [0069.355] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.355] lstrlenW (lpString=".7z") returned 3 [0069.355] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.355] lstrlenW (lpString=".dbf") returned 4 [0069.355] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.355] lstrlenW (lpString=".1cd") returned 4 [0069.355] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0069.355] lstrlenW (lpString=".jpg") returned 4 [0069.355] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.355] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") [0069.370] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=45582) returned 1 [0069.370] CloseHandle (hObject=0x1c0) returned 1 [0069.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20 [0069.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.371] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.372] GetLastError () returned 0x0 [0069.372] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb20e, lpOverlapped=0x0) returned 1 [0069.379] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb210, lpOverlapped=0x0) returned 1 [0069.380] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.380] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.381] SetEndOfFile (hFile=0x1f0) returned 1 [0069.381] CloseHandle (hObject=0x1f0) returned 1 [0069.381] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.381] SetEndOfFile (hFile=0x1c0) returned 1 [0069.382] CloseHandle (hObject=0x1c0) returned 1 [0069.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 1 [0069.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.382] lstrlenW (lpString=".doc") returned 4 [0069.382] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.382] lstrlenW (lpString=".docx") returned 5 [0069.382] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.382] lstrlenW (lpString=".pdf") returned 4 [0069.382] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.382] lstrlenW (lpString=".xls") returned 4 [0069.382] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.382] lstrlenW (lpString=".xlsx") returned 5 [0069.383] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.383] lstrlenW (lpString=".ppt") returned 4 [0069.383] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.383] lstrlenW (lpString=".zip") returned 4 [0069.383] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.383] lstrlenW (lpString=".rar") returned 4 [0069.383] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.383] lstrlenW (lpString=".bz2") returned 4 [0069.383] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.383] lstrlenW (lpString=".7z") returned 3 [0069.383] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.383] lstrlenW (lpString=".dbf") returned 4 [0069.383] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.383] lstrlenW (lpString=".1cd") returned 4 [0069.383] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0069.383] lstrlenW (lpString=".jpg") returned 4 [0069.383] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.383] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") [0069.384] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=46942) returned 1 [0069.384] CloseHandle (hObject=0x1c0) returned 1 [0069.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20 [0069.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.384] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.384] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.385] GetLastError () returned 0x0 [0069.385] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb75e, lpOverlapped=0x0) returned 1 [0069.400] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb760, lpOverlapped=0x0) returned 1 [0069.401] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.401] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.402] SetEndOfFile (hFile=0x1f0) returned 1 [0069.402] CloseHandle (hObject=0x1f0) returned 1 [0069.402] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.402] SetEndOfFile (hFile=0x1c0) returned 1 [0069.403] CloseHandle (hObject=0x1c0) returned 1 [0069.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 1 [0069.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.403] lstrlenW (lpString=".doc") returned 4 [0069.403] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.403] lstrlenW (lpString=".docx") returned 5 [0069.403] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0069.403] lstrlenW (lpString=".pdf") returned 4 [0069.403] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.403] lstrlenW (lpString=".xls") returned 4 [0069.404] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.404] lstrlenW (lpString=".xlsx") returned 5 [0069.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0069.404] lstrlenW (lpString=".ppt") returned 4 [0069.404] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.404] lstrlenW (lpString=".zip") returned 4 [0069.404] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.404] lstrlenW (lpString=".rar") returned 4 [0069.404] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.404] lstrlenW (lpString=".bz2") returned 4 [0069.404] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.404] lstrlenW (lpString=".7z") returned 3 [0069.404] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.404] lstrlenW (lpString=".dbf") returned 4 [0069.404] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.404] lstrlenW (lpString=".1cd") returned 4 [0069.404] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0069.404] lstrlenW (lpString=".jpg") returned 4 [0069.404] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.404] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") [0069.405] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=586) returned 1 [0069.405] CloseHandle (hObject=0x1c0) returned 1 [0069.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0069.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.405] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.405] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.405] GetLastError () returned 0x0 [0069.405] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x24a, lpOverlapped=0x0) returned 1 [0069.408] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x250, lpOverlapped=0x0) returned 1 [0069.409] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.409] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.410] SetEndOfFile (hFile=0x1f0) returned 1 [0069.410] CloseHandle (hObject=0x1f0) returned 1 [0069.410] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.410] SetEndOfFile (hFile=0x1c0) returned 1 [0069.411] CloseHandle (hObject=0x1c0) returned 1 [0069.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 1 [0069.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.411] lstrlenW (lpString=".doc") returned 4 [0069.411] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.411] lstrlenW (lpString=".docx") returned 5 [0069.411] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0069.411] lstrlenW (lpString=".pdf") returned 4 [0069.411] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.411] lstrlenW (lpString=".xls") returned 4 [0069.411] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.411] lstrlenW (lpString=".xlsx") returned 5 [0069.411] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0069.411] lstrlenW (lpString=".ppt") returned 4 [0069.411] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.411] lstrlenW (lpString=".zip") returned 4 [0069.411] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.411] lstrlenW (lpString=".rar") returned 4 [0069.411] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.412] lstrlenW (lpString=".bz2") returned 4 [0069.412] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.412] lstrlenW (lpString=".7z") returned 3 [0069.412] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.412] lstrlenW (lpString=".dbf") returned 4 [0069.412] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.412] lstrlenW (lpString=".1cd") returned 4 [0069.412] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0069.412] lstrlenW (lpString=".jpg") returned 4 [0069.412] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.412] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") [0069.419] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=73822) returned 1 [0069.419] CloseHandle (hObject=0x158) returned 1 [0069.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20 [0069.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.419] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.419] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.419] GetLastError () returned 0x0 [0069.419] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1205e, lpOverlapped=0x0) returned 1 [0069.422] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x12060, lpOverlapped=0x0) returned 1 [0069.424] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.424] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.424] SetEndOfFile (hFile=0x1ec) returned 1 [0069.425] CloseHandle (hObject=0x1ec) returned 1 [0069.425] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.425] SetEndOfFile (hFile=0x158) returned 1 [0069.426] CloseHandle (hObject=0x158) returned 1 [0069.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 1 [0069.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.426] lstrlenW (lpString=".doc") returned 4 [0069.426] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.426] lstrlenW (lpString=".docx") returned 5 [0069.426] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0069.426] lstrlenW (lpString=".pdf") returned 4 [0069.426] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.426] lstrlenW (lpString=".xls") returned 4 [0069.426] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.426] lstrlenW (lpString=".xlsx") returned 5 [0069.427] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0069.427] lstrlenW (lpString=".ppt") returned 4 [0069.427] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.427] lstrlenW (lpString=".zip") returned 4 [0069.427] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.427] lstrlenW (lpString=".rar") returned 4 [0069.427] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.427] lstrlenW (lpString=".bz2") returned 4 [0069.427] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.427] lstrlenW (lpString=".7z") returned 3 [0069.427] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.427] lstrlenW (lpString=".dbf") returned 4 [0069.427] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.427] lstrlenW (lpString=".1cd") returned 4 [0069.427] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0069.427] lstrlenW (lpString=".jpg") returned 4 [0069.427] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.427] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") [0069.428] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=66016) returned 1 [0069.428] CloseHandle (hObject=0x158) returned 1 [0069.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0069.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.428] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.428] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.428] GetLastError () returned 0x0 [0069.428] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x101e0, lpOverlapped=0x0) returned 1 [0069.431] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x101f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x101f0, lpOverlapped=0x0) returned 1 [0069.433] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.433] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.433] SetEndOfFile (hFile=0x1ec) returned 1 [0069.433] CloseHandle (hObject=0x1ec) returned 1 [0069.433] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.433] SetEndOfFile (hFile=0x158) returned 1 [0069.434] CloseHandle (hObject=0x158) returned 1 [0069.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 1 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.435] lstrlenW (lpString=".doc") returned 4 [0069.435] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.435] lstrlenW (lpString=".docx") returned 5 [0069.435] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.435] lstrlenW (lpString=".pdf") returned 4 [0069.435] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.435] lstrlenW (lpString=".xls") returned 4 [0069.435] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.435] lstrlenW (lpString=".xlsx") returned 5 [0069.435] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.435] lstrlenW (lpString=".ppt") returned 4 [0069.435] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.435] lstrlenW (lpString=".zip") returned 4 [0069.435] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.435] lstrlenW (lpString=".rar") returned 4 [0069.435] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.435] lstrlenW (lpString=".bz2") returned 4 [0069.435] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.435] lstrlenW (lpString=".7z") returned 3 [0069.435] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.435] lstrlenW (lpString=".dbf") returned 4 [0069.435] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.435] lstrlenW (lpString=".1cd") returned 4 [0069.435] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0069.436] lstrlenW (lpString=".jpg") returned 4 [0069.436] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.436] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") [0069.436] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=487) returned 1 [0069.436] CloseHandle (hObject=0x158) returned 1 [0069.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0069.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.436] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.436] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.437] GetLastError () returned 0x0 [0069.437] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1e7, lpOverlapped=0x0) returned 1 [0069.438] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1f0, lpOverlapped=0x0) returned 1 [0069.439] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.439] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.439] SetEndOfFile (hFile=0x1ec) returned 1 [0069.439] CloseHandle (hObject=0x1ec) returned 1 [0069.439] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.439] SetEndOfFile (hFile=0x158) returned 1 [0069.440] CloseHandle (hObject=0x158) returned 1 [0069.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.440] lstrlenW (lpString=".doc") returned 4 [0069.440] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.440] lstrlenW (lpString=".docx") returned 5 [0069.440] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.440] lstrlenW (lpString=".pdf") returned 4 [0069.440] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.440] lstrlenW (lpString=".xls") returned 4 [0069.440] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.440] lstrlenW (lpString=".xlsx") returned 5 [0069.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.441] lstrlenW (lpString=".ppt") returned 4 [0069.441] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.441] lstrlenW (lpString=".zip") returned 4 [0069.441] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.441] lstrlenW (lpString=".rar") returned 4 [0069.441] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.441] lstrlenW (lpString=".bz2") returned 4 [0069.441] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.441] lstrlenW (lpString=".7z") returned 3 [0069.441] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.441] lstrlenW (lpString=".dbf") returned 4 [0069.441] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.441] lstrlenW (lpString=".1cd") returned 4 [0069.441] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0069.441] lstrlenW (lpString=".jpg") returned 4 [0069.441] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.441] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") [0069.442] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=73271) returned 1 [0069.442] CloseHandle (hObject=0x158) returned 1 [0069.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0069.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.442] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.442] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.442] GetLastError () returned 0x0 [0069.442] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x11e37, lpOverlapped=0x0) returned 1 [0069.445] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x11e40, lpOverlapped=0x0) returned 1 [0069.447] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.447] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.448] SetEndOfFile (hFile=0x1ec) returned 1 [0069.448] CloseHandle (hObject=0x1ec) returned 1 [0069.448] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.448] SetEndOfFile (hFile=0x158) returned 1 [0069.449] CloseHandle (hObject=0x158) returned 1 [0069.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.449] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 1 [0069.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.449] lstrlenW (lpString=".doc") returned 4 [0069.449] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.449] lstrlenW (lpString=".docx") returned 5 [0069.449] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.450] lstrlenW (lpString=".pdf") returned 4 [0069.450] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.450] lstrlenW (lpString=".xls") returned 4 [0069.450] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.450] lstrlenW (lpString=".xlsx") returned 5 [0069.450] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.450] lstrlenW (lpString=".ppt") returned 4 [0069.450] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.450] lstrlenW (lpString=".zip") returned 4 [0069.450] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.450] lstrlenW (lpString=".rar") returned 4 [0069.450] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.450] lstrlenW (lpString=".bz2") returned 4 [0069.450] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.450] lstrlenW (lpString=".7z") returned 3 [0069.450] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.450] lstrlenW (lpString=".dbf") returned 4 [0069.450] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.450] lstrlenW (lpString=".1cd") returned 4 [0069.450] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0069.450] lstrlenW (lpString=".jpg") returned 4 [0069.450] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.450] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") [0069.530] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=613) returned 1 [0069.530] CloseHandle (hObject=0x158) returned 1 [0069.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0069.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.530] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.530] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.531] GetLastError () returned 0x0 [0069.531] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x265, lpOverlapped=0x0) returned 1 [0069.532] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x270, lpOverlapped=0x0) returned 1 [0069.533] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.533] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.533] SetEndOfFile (hFile=0x1ec) returned 1 [0069.533] CloseHandle (hObject=0x1ec) returned 1 [0069.533] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.533] SetEndOfFile (hFile=0x158) returned 1 [0069.534] CloseHandle (hObject=0x158) returned 1 [0069.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.534] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 1 [0069.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.534] lstrlenW (lpString=".doc") returned 4 [0069.534] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.534] lstrlenW (lpString=".docx") returned 5 [0069.534] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.534] lstrlenW (lpString=".pdf") returned 4 [0069.535] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.535] lstrlenW (lpString=".xls") returned 4 [0069.535] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.535] lstrlenW (lpString=".xlsx") returned 5 [0069.535] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.535] lstrlenW (lpString=".ppt") returned 4 [0069.535] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.535] lstrlenW (lpString=".zip") returned 4 [0069.535] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.535] lstrlenW (lpString=".rar") returned 4 [0069.535] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.535] lstrlenW (lpString=".bz2") returned 4 [0069.535] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.535] lstrlenW (lpString=".7z") returned 3 [0069.535] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.535] lstrlenW (lpString=".dbf") returned 4 [0069.535] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.535] lstrlenW (lpString=".1cd") returned 4 [0069.535] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0069.535] lstrlenW (lpString=".jpg") returned 4 [0069.535] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.535] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") [0069.988] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=68337) returned 1 [0069.988] CloseHandle (hObject=0x1c0) returned 1 [0069.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20 [0069.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.988] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.988] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.989] GetLastError () returned 0x0 [0069.989] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x10af1, lpOverlapped=0x0) returned 1 [0069.991] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x10b00, lpOverlapped=0x0) returned 1 [0069.993] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.993] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.993] SetEndOfFile (hFile=0x1f0) returned 1 [0069.993] CloseHandle (hObject=0x1f0) returned 1 [0069.993] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.993] SetEndOfFile (hFile=0x1c0) returned 1 [0069.994] CloseHandle (hObject=0x1c0) returned 1 [0069.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.995] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.995] lstrlenW (lpString=".doc") returned 4 [0069.995] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.995] lstrlenW (lpString=".docx") returned 5 [0069.995] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1 [0069.995] lstrlenW (lpString=".pdf") returned 4 [0069.995] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.995] lstrlenW (lpString=".xls") returned 4 [0069.995] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.995] lstrlenW (lpString=".xlsx") returned 5 [0069.995] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1 [0069.995] lstrlenW (lpString=".ppt") returned 4 [0069.995] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.995] lstrlenW (lpString=".zip") returned 4 [0069.995] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.995] lstrlenW (lpString=".rar") returned 4 [0069.995] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.995] lstrlenW (lpString=".bz2") returned 4 [0069.995] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.995] lstrlenW (lpString=".7z") returned 3 [0069.995] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.995] lstrlenW (lpString=".dbf") returned 4 [0069.995] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.996] lstrlenW (lpString=".1cd") returned 4 [0069.996] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0069.996] lstrlenW (lpString=".jpg") returned 4 [0069.996] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.996] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") [0069.996] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7276) returned 1 [0069.996] CloseHandle (hObject=0x1c0) returned 1 [0069.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0069.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0069.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.997] GetLastError () returned 0x0 [0069.997] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1c6c, lpOverlapped=0x0) returned 1 [0069.999] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1c70, lpOverlapped=0x0) returned 1 [0069.999] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0069.999] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0070.000] SetEndOfFile (hFile=0x1f0) returned 1 [0070.000] CloseHandle (hObject=0x1f0) returned 1 [0070.000] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.000] SetEndOfFile (hFile=0x1c0) returned 1 [0070.001] CloseHandle (hObject=0x1c0) returned 1 [0070.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.001] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 1 [0070.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.001] lstrlenW (lpString=".doc") returned 4 [0070.001] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0070.001] lstrlenW (lpString=".docx") returned 5 [0070.001] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0070.001] lstrlenW (lpString=".pdf") returned 4 [0070.001] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0070.001] lstrlenW (lpString=".xls") returned 4 [0070.001] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0070.001] lstrlenW (lpString=".xlsx") returned 5 [0070.001] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0070.001] lstrlenW (lpString=".ppt") returned 4 [0070.001] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0070.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.001] lstrlenW (lpString=".zip") returned 4 [0070.002] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0070.002] lstrlenW (lpString=".rar") returned 4 [0070.002] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0070.002] lstrlenW (lpString=".bz2") returned 4 [0070.002] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0070.002] lstrlenW (lpString=".7z") returned 3 [0070.002] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0070.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.002] lstrlenW (lpString=".dbf") returned 4 [0070.002] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0070.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.002] lstrlenW (lpString=".1cd") returned 4 [0070.002] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0070.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0070.002] lstrlenW (lpString=".jpg") returned 4 [0070.002] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0070.002] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") [0070.003] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=65996) returned 1 [0070.003] CloseHandle (hObject=0x1f0) returned 1 [0070.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0070.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.003] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.004] GetLastError () returned 0x0 [0070.004] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x101cc, lpOverlapped=0x0) returned 1 [0070.007] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x101d0, lpOverlapped=0x0) returned 1 [0070.009] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.009] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.009] SetEndOfFile (hFile=0x158) returned 1 [0070.010] CloseHandle (hObject=0x158) returned 1 [0070.010] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.010] SetEndOfFile (hFile=0x1f0) returned 1 [0070.011] CloseHandle (hObject=0x1f0) returned 1 [0070.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 1 [0070.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.011] lstrlenW (lpString=".doc") returned 4 [0070.011] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0070.011] lstrlenW (lpString=".docx") returned 5 [0070.011] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0070.011] lstrlenW (lpString=".pdf") returned 4 [0070.011] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0070.011] lstrlenW (lpString=".xls") returned 4 [0070.011] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0070.011] lstrlenW (lpString=".xlsx") returned 5 [0070.011] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0070.011] lstrlenW (lpString=".ppt") returned 4 [0070.011] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0070.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.012] lstrlenW (lpString=".zip") returned 4 [0070.012] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0070.012] lstrlenW (lpString=".rar") returned 4 [0070.012] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0070.012] lstrlenW (lpString=".bz2") returned 4 [0070.012] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0070.012] lstrlenW (lpString=".7z") returned 3 [0070.012] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0070.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.012] lstrlenW (lpString=".dbf") returned 4 [0070.012] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0070.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.012] lstrlenW (lpString=".1cd") returned 4 [0070.012] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0070.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0070.012] lstrlenW (lpString=".jpg") returned 4 [0070.012] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0070.012] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") [0070.013] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=417) returned 1 [0070.013] CloseHandle (hObject=0x1f0) returned 1 [0070.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0070.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.014] GetLastError () returned 0x0 [0070.014] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1a1, lpOverlapped=0x0) returned 1 [0070.015] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1b0, lpOverlapped=0x0) returned 1 [0070.015] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.016] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.016] SetEndOfFile (hFile=0x158) returned 1 [0070.016] CloseHandle (hObject=0x158) returned 1 [0070.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.016] SetEndOfFile (hFile=0x1f0) returned 1 [0070.017] CloseHandle (hObject=0x1f0) returned 1 [0070.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 1 [0070.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.017] lstrlenW (lpString=".doc") returned 4 [0070.017] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0070.017] lstrlenW (lpString=".docx") returned 5 [0070.017] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0070.017] lstrlenW (lpString=".pdf") returned 4 [0070.017] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0070.017] lstrlenW (lpString=".xls") returned 4 [0070.017] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0070.017] lstrlenW (lpString=".xlsx") returned 5 [0070.017] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0070.017] lstrlenW (lpString=".ppt") returned 4 [0070.017] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0070.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.017] lstrlenW (lpString=".zip") returned 4 [0070.018] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0070.018] lstrlenW (lpString=".rar") returned 4 [0070.018] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0070.018] lstrlenW (lpString=".bz2") returned 4 [0070.018] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0070.018] lstrlenW (lpString=".7z") returned 3 [0070.018] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0070.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.018] lstrlenW (lpString=".dbf") returned 4 [0070.018] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0070.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.018] lstrlenW (lpString=".1cd") returned 4 [0070.018] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0070.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0070.018] lstrlenW (lpString=".jpg") returned 4 [0070.018] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0070.018] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") [0070.018] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=49094) returned 1 [0070.018] CloseHandle (hObject=0x1f0) returned 1 [0070.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0070.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0070.019] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.019] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.019] GetLastError () returned 0x0 [0070.019] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbfc6, lpOverlapped=0x0) returned 1 [0070.022] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0070.023] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.023] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.023] SetEndOfFile (hFile=0x158) returned 1 [0070.119] CloseHandle (hObject=0x158) returned 1 [0070.120] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.120] SetEndOfFile (hFile=0x1f0) returned 1 [0070.122] CloseHandle (hObject=0x1f0) returned 1 [0070.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 1 [0070.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.164] lstrlenW (lpString=".doc") returned 4 [0070.164] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0070.164] lstrlenW (lpString=".docx") returned 5 [0070.164] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0070.164] lstrlenW (lpString=".pdf") returned 4 [0070.164] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0070.164] lstrlenW (lpString=".xls") returned 4 [0070.164] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0070.164] lstrlenW (lpString=".xlsx") returned 5 [0070.164] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0070.164] lstrlenW (lpString=".ppt") returned 4 [0070.164] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0070.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.164] lstrlenW (lpString=".zip") returned 4 [0070.164] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0070.165] lstrlenW (lpString=".rar") returned 4 [0070.165] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0070.165] lstrlenW (lpString=".bz2") returned 4 [0070.165] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0070.165] lstrlenW (lpString=".7z") returned 3 [0070.165] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0070.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.165] lstrlenW (lpString=".dbf") returned 4 [0070.165] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0070.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.165] lstrlenW (lpString=".1cd") returned 4 [0070.165] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0070.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0070.165] lstrlenW (lpString=".jpg") returned 4 [0070.165] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0070.165] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") [0070.166] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=683) returned 1 [0070.166] CloseHandle (hObject=0x1f4) returned 1 [0070.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0070.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.166] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.166] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0070.167] GetLastError () returned 0x0 [0070.167] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2ab, lpOverlapped=0x0) returned 1 [0070.168] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0070.168] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.168] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.169] SetEndOfFile (hFile=0x158) returned 1 [0070.169] CloseHandle (hObject=0x158) returned 1 [0070.169] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.169] SetEndOfFile (hFile=0x1f4) returned 1 [0070.170] CloseHandle (hObject=0x1f4) returned 1 [0070.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 1 [0070.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.170] lstrlenW (lpString=".doc") returned 4 [0070.170] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0070.170] lstrlenW (lpString=".docx") returned 5 [0070.170] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0070.170] lstrlenW (lpString=".pdf") returned 4 [0070.170] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0070.170] lstrlenW (lpString=".xls") returned 4 [0070.170] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0070.170] lstrlenW (lpString=".xlsx") returned 5 [0070.170] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0070.170] lstrlenW (lpString=".ppt") returned 4 [0070.170] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0070.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.170] lstrlenW (lpString=".zip") returned 4 [0070.170] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0070.171] lstrlenW (lpString=".rar") returned 4 [0070.171] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0070.171] lstrlenW (lpString=".bz2") returned 4 [0070.171] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0070.171] lstrlenW (lpString=".7z") returned 3 [0070.171] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0070.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.171] lstrlenW (lpString=".dbf") returned 4 [0070.171] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0070.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.171] lstrlenW (lpString=".1cd") returned 4 [0070.171] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0070.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0070.171] lstrlenW (lpString=".jpg") returned 4 [0070.171] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0070.171] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") [0070.172] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1658904) returned 1 [0070.172] CloseHandle (hObject=0x1f4) returned 1 [0070.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0070.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0070.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.173] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0070.173] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.173] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.177] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.177] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.183] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.183] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.183] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.199] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.199] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0070.816] SetEndOfFile (hFile=0x1f4) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0070.816] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0070.816] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.818] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0070.818] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.820] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0070.820] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.822] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0070.822] CloseHandle (hObject=0x1f4) returned 1 [0070.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.823] lstrlenW (lpString=".doc") returned 4 [0070.823] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0070.823] lstrlenW (lpString=".docx") returned 5 [0070.823] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0070.823] lstrlenW (lpString=".pdf") returned 4 [0070.823] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0070.823] lstrlenW (lpString=".xls") returned 4 [0070.823] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0070.823] lstrlenW (lpString=".xlsx") returned 5 [0070.823] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0070.823] lstrlenW (lpString=".ppt") returned 4 [0070.823] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0070.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.823] lstrlenW (lpString=".zip") returned 4 [0070.823] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0070.823] lstrlenW (lpString=".rar") returned 4 [0070.823] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0070.823] lstrlenW (lpString=".bz2") returned 4 [0070.823] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0070.823] lstrlenW (lpString=".7z") returned 3 [0070.823] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0070.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.823] lstrlenW (lpString=".dbf") returned 4 [0070.823] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0070.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.823] lstrlenW (lpString=".1cd") returned 4 [0070.823] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0070.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0070.823] lstrlenW (lpString=".jpg") returned 4 [0070.823] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0070.823] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") [0070.824] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=678912) returned 1 [0070.824] CloseHandle (hObject=0x1f4) returned 1 [0070.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0070.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0070.824] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.824] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.825] GetLastError () returned 0x0 [0070.825] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa5c00, lpOverlapped=0x0) returned 1 [0070.840] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa5c10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa5c10, lpOverlapped=0x0) returned 1 [0071.104] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0071.104] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.104] SetEndOfFile (hFile=0x210) returned 1 [0071.104] CloseHandle (hObject=0x210) returned 1 [0071.104] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.104] SetEndOfFile (hFile=0x1f4) returned 1 [0071.110] CloseHandle (hObject=0x1f4) returned 1 [0071.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.110] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 1 [0071.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.110] lstrlenW (lpString=".doc") returned 4 [0071.111] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0071.111] lstrlenW (lpString=".docx") returned 5 [0071.111] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0071.111] lstrlenW (lpString=".pdf") returned 4 [0071.111] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0071.111] lstrlenW (lpString=".xls") returned 4 [0071.111] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0071.111] lstrlenW (lpString=".xlsx") returned 5 [0071.111] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0071.111] lstrlenW (lpString=".ppt") returned 4 [0071.111] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0071.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.111] lstrlenW (lpString=".zip") returned 4 [0071.111] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0071.111] lstrlenW (lpString=".rar") returned 4 [0071.111] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0071.111] lstrlenW (lpString=".bz2") returned 4 [0071.111] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0071.111] lstrlenW (lpString=".7z") returned 3 [0071.111] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0071.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.111] lstrlenW (lpString=".dbf") returned 4 [0071.111] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0071.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.111] lstrlenW (lpString=".1cd") returned 4 [0071.111] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0071.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0071.111] lstrlenW (lpString=".jpg") returned 4 [0071.111] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0071.111] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") [0071.518] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=616960) returned 1 [0071.519] CloseHandle (hObject=0x150) returned 1 [0071.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20 [0071.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0071.520] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.520] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.520] GetLastError () returned 0x0 [0071.520] ReadFile (in: hFile=0x150, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x96a00, lpOverlapped=0x0) returned 1 [0071.549] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x96a10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x96a10, lpOverlapped=0x0) returned 1 [0071.561] ReadFile (in: hFile=0x150, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0071.561] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.562] SetEndOfFile (hFile=0x1ec) returned 1 [0071.562] CloseHandle (hObject=0x1ec) returned 1 [0071.562] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.562] SetEndOfFile (hFile=0x150) returned 1 [0071.567] CloseHandle (hObject=0x150) returned 1 [0071.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.567] lstrlenW (lpString=".doc") returned 4 [0071.567] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0071.567] lstrlenW (lpString=".docx") returned 5 [0071.567] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0071.567] lstrlenW (lpString=".pdf") returned 4 [0071.568] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0071.568] lstrlenW (lpString=".xls") returned 4 [0071.568] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0071.568] lstrlenW (lpString=".xlsx") returned 5 [0071.568] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0071.568] lstrlenW (lpString=".ppt") returned 4 [0071.568] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.568] lstrlenW (lpString=".zip") returned 4 [0071.568] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0071.568] lstrlenW (lpString=".rar") returned 4 [0071.568] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0071.635] lstrlenW (lpString=".bz2") returned 4 [0071.635] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0071.635] lstrlenW (lpString=".7z") returned 3 [0071.635] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0071.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.635] lstrlenW (lpString=".dbf") returned 4 [0071.635] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0071.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.635] lstrlenW (lpString=".1cd") returned 4 [0071.635] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0071.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 71 [0071.635] lstrlenW (lpString=".jpg") returned 4 [0071.635] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0071.635] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") [0071.698] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=990032) returned 1 [0071.698] CloseHandle (hObject=0x16c) returned 1 [0071.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0071.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.724] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.724] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.731] GetLastError () returned 0x0 [0071.731] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf1b50, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf1b60, lpOverlapped=0x0) returned 1 [0071.768] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0071.768] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.768] SetEndOfFile (hFile=0x1c0) returned 1 [0071.768] CloseHandle (hObject=0x1c0) returned 1 [0071.768] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.768] SetEndOfFile (hFile=0x16c) returned 1 [0071.943] CloseHandle (hObject=0x16c) returned 1 [0071.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.943] lstrlenW (lpString=".doc") returned 4 [0071.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".docx") returned 5 [0071.943] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.943] lstrlenW (lpString=".pdf") returned 4 [0071.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.944] lstrlenW (lpString=".xls") returned 4 [0071.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.944] lstrlenW (lpString=".xlsx") returned 5 [0071.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.944] lstrlenW (lpString=".ppt") returned 4 [0071.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.944] lstrlenW (lpString=".zip") returned 4 [0071.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.944] lstrlenW (lpString=".rar") returned 4 [0071.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.944] lstrlenW (lpString=".bz2") returned 4 [0071.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.944] lstrlenW (lpString=".7z") returned 3 [0071.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.944] lstrlenW (lpString=".dbf") returned 4 [0071.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.944] lstrlenW (lpString=".1cd") returned 4 [0071.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0071.944] lstrlenW (lpString=".jpg") returned 4 [0071.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.944] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") [0071.945] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=902841) returned 1 [0071.945] CloseHandle (hObject=0x16c) returned 1 [0071.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0071.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.945] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.945] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.945] GetLastError () returned 0x0 [0071.945] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xdc6b9, lpOverlapped=0x0) returned 1 [0071.992] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xdc6c0, lpOverlapped=0x0) returned 1 [0072.112] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0072.112] WriteFile (in: hFile=0x160, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.112] SetEndOfFile (hFile=0x160) returned 1 [0072.112] CloseHandle (hObject=0x160) returned 1 [0072.112] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.112] SetEndOfFile (hFile=0x16c) returned 1 [0072.119] CloseHandle (hObject=0x16c) returned 1 [0072.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.120] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 1 [0072.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.120] lstrlenW (lpString=".doc") returned 4 [0072.120] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.120] lstrlenW (lpString=".docx") returned 5 [0072.120] lstrcmpiW (lpString1=".docx", lpString2="G.SHX") returned -1 [0072.120] lstrlenW (lpString=".pdf") returned 4 [0072.120] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.120] lstrlenW (lpString=".xls") returned 4 [0072.120] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.120] lstrlenW (lpString=".xlsx") returned 5 [0072.120] lstrcmpiW (lpString1=".xlsx", lpString2="G.SHX") returned -1 [0072.120] lstrlenW (lpString=".ppt") returned 4 [0072.120] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.120] lstrlenW (lpString=".zip") returned 4 [0072.120] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.120] lstrlenW (lpString=".rar") returned 4 [0072.120] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.120] lstrlenW (lpString=".bz2") returned 4 [0072.120] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.120] lstrlenW (lpString=".7z") returned 3 [0072.120] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.121] lstrlenW (lpString=".dbf") returned 4 [0072.121] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.121] lstrlenW (lpString=".1cd") returned 4 [0072.121] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0072.121] lstrlenW (lpString=".jpg") returned 4 [0072.121] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.121] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") [0072.536] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=18264) returned 1 [0072.536] CloseHandle (hObject=0x1fc) returned 1 [0072.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0072.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.537] GetLastError () returned 0x0 [0072.537] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4758, lpOverlapped=0x0) returned 1 [0072.556] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4760, lpOverlapped=0x0) returned 1 [0072.560] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0072.560] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0072.560] SetEndOfFile (hFile=0x1f4) returned 1 [0072.560] CloseHandle (hObject=0x1f4) returned 1 [0072.560] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.560] SetEndOfFile (hFile=0x1fc) returned 1 [0072.561] CloseHandle (hObject=0x1fc) returned 1 [0072.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0072.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.561] lstrlenW (lpString=".doc") returned 4 [0072.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.561] lstrlenW (lpString=".docx") returned 5 [0072.561] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0072.561] lstrlenW (lpString=".pdf") returned 4 [0072.562] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.562] lstrlenW (lpString=".xls") returned 4 [0072.562] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.562] lstrlenW (lpString=".xlsx") returned 5 [0072.562] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0072.562] lstrlenW (lpString=".ppt") returned 4 [0072.562] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.562] lstrlenW (lpString=".zip") returned 4 [0072.562] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.562] lstrlenW (lpString=".rar") returned 4 [0072.562] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.562] lstrlenW (lpString=".bz2") returned 4 [0072.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.562] lstrlenW (lpString=".7z") returned 3 [0072.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.562] lstrlenW (lpString=".dbf") returned 4 [0072.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.562] lstrlenW (lpString=".1cd") returned 4 [0072.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0072.562] lstrlenW (lpString=".jpg") returned 4 [0072.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.562] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") [0072.563] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=373760) returned 1 [0072.563] CloseHandle (hObject=0x1fc) returned 1 [0072.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20 [0072.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.564] lstrlenW (lpString=".doc") returned 4 [0072.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString=".docx") returned 5 [0072.564] lstrcmpiW (lpString1=".docx", lpString2="U.dll") returned -1 [0072.564] lstrlenW (lpString=".pdf") returned 4 [0072.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString=".xls") returned 4 [0072.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString=".xlsx") returned 5 [0072.564] lstrcmpiW (lpString1=".xlsx", lpString2="U.dll") returned -1 [0072.564] lstrlenW (lpString=".ppt") returned 4 [0072.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.564] lstrlenW (lpString=".zip") returned 4 [0072.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString=".rar") returned 4 [0072.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.564] lstrlenW (lpString=".bz2") returned 4 [0072.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.564] lstrlenW (lpString=".7z") returned 3 [0072.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.564] lstrlenW (lpString=".dbf") returned 4 [0072.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.565] lstrlenW (lpString=".1cd") returned 4 [0072.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 86 [0072.565] lstrlenW (lpString=".jpg") returned 4 [0072.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.565] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") [0072.565] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0072.565] CloseHandle (hObject=0x1fc) returned 1 [0072.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20 [0072.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.566] lstrlenW (lpString=".doc") returned 4 [0072.566] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0072.566] lstrlenW (lpString=".docx") returned 5 [0072.566] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0072.566] lstrlenW (lpString=".pdf") returned 4 [0072.566] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0072.566] lstrlenW (lpString=".xls") returned 4 [0072.566] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0072.566] lstrlenW (lpString=".xlsx") returned 5 [0072.566] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0072.566] lstrlenW (lpString=".ppt") returned 4 [0072.566] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.566] lstrlenW (lpString=".zip") returned 4 [0072.566] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0072.566] lstrlenW (lpString=".rar") returned 4 [0072.566] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0072.566] lstrlenW (lpString=".bz2") returned 4 [0072.566] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0072.567] lstrlenW (lpString=".7z") returned 3 [0072.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0072.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.567] lstrlenW (lpString=".dbf") returned 4 [0072.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0072.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.567] lstrlenW (lpString=".1cd") returned 4 [0072.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0072.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 82 [0072.567] lstrlenW (lpString=".jpg") returned 4 [0072.567] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0072.567] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") [0072.568] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=41472) returned 1 [0072.568] CloseHandle (hObject=0x1fc) returned 1 [0072.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0x20 [0072.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.568] lstrlenW (lpString=".doc") returned 4 [0072.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.568] lstrlenW (lpString=".docx") returned 5 [0072.568] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0072.568] lstrlenW (lpString=".pdf") returned 4 [0072.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.568] lstrlenW (lpString=".xls") returned 4 [0072.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.568] lstrlenW (lpString=".xlsx") returned 5 [0072.568] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0072.568] lstrlenW (lpString=".ppt") returned 4 [0072.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.569] lstrlenW (lpString=".zip") returned 4 [0072.569] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.569] lstrlenW (lpString=".rar") returned 4 [0072.569] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.569] lstrlenW (lpString=".bz2") returned 4 [0072.569] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.569] lstrlenW (lpString=".7z") returned 3 [0072.569] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.569] lstrlenW (lpString=".dbf") returned 4 [0072.569] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.569] lstrlenW (lpString=".1cd") returned 4 [0072.569] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 75 [0072.569] lstrlenW (lpString=".jpg") returned 4 [0072.569] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.569] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") [0072.570] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=181248) returned 1 [0072.570] CloseHandle (hObject=0x1fc) returned 1 [0072.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0x20 [0072.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.570] lstrlenW (lpString=".doc") returned 4 [0072.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.570] lstrlenW (lpString=".docx") returned 5 [0072.570] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0072.570] lstrlenW (lpString=".pdf") returned 4 [0072.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.570] lstrlenW (lpString=".xls") returned 4 [0072.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.571] lstrlenW (lpString=".xlsx") returned 5 [0072.571] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0072.571] lstrlenW (lpString=".ppt") returned 4 [0072.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.571] lstrlenW (lpString=".zip") returned 4 [0072.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.571] lstrlenW (lpString=".rar") returned 4 [0072.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.571] lstrlenW (lpString=".bz2") returned 4 [0072.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.571] lstrlenW (lpString=".7z") returned 3 [0072.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.571] lstrlenW (lpString=".dbf") returned 4 [0072.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.571] lstrlenW (lpString=".1cd") returned 4 [0072.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 75 [0072.571] lstrlenW (lpString=".jpg") returned 4 [0072.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.571] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") [0072.572] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9728) returned 1 [0072.572] CloseHandle (hObject=0x1fc) returned 1 [0072.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20 [0072.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.572] lstrlenW (lpString=".doc") returned 4 [0072.573] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString=".docx") returned 5 [0072.573] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0072.573] lstrlenW (lpString=".pdf") returned 4 [0072.573] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString=".xls") returned 4 [0072.573] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString=".xlsx") returned 5 [0072.573] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0072.573] lstrlenW (lpString=".ppt") returned 4 [0072.573] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.573] lstrlenW (lpString=".zip") returned 4 [0072.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString=".rar") returned 4 [0072.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.573] lstrlenW (lpString=".bz2") returned 4 [0072.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.573] lstrlenW (lpString=".7z") returned 3 [0072.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.573] lstrlenW (lpString=".dbf") returned 4 [0072.573] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.573] lstrlenW (lpString=".1cd") returned 4 [0072.573] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 72 [0072.573] lstrlenW (lpString=".jpg") returned 4 [0072.573] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.574] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") [0072.575] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=17408) returned 1 [0072.576] CloseHandle (hObject=0x1fc) returned 1 [0072.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0072.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.576] lstrlenW (lpString=".doc") returned 4 [0072.576] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0072.576] lstrlenW (lpString=".docx") returned 5 [0072.576] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0072.576] lstrlenW (lpString=".pdf") returned 4 [0072.576] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0072.576] lstrlenW (lpString=".xls") returned 4 [0072.576] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0072.576] lstrlenW (lpString=".xlsx") returned 5 [0072.576] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0072.576] lstrlenW (lpString=".ppt") returned 4 [0072.576] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0072.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.576] lstrlenW (lpString=".zip") returned 4 [0072.576] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0072.577] lstrlenW (lpString=".rar") returned 4 [0072.577] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0072.577] lstrlenW (lpString=".bz2") returned 4 [0072.577] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0072.577] lstrlenW (lpString=".7z") returned 3 [0072.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0072.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.577] lstrlenW (lpString=".dbf") returned 4 [0072.577] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0072.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.577] lstrlenW (lpString=".1cd") returned 4 [0072.577] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0072.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0072.577] lstrlenW (lpString=".jpg") returned 4 [0072.577] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0072.577] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") [0072.578] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=8192) returned 1 [0072.578] CloseHandle (hObject=0x1fc) returned 1 [0072.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0072.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.579] lstrlenW (lpString=".doc") returned 4 [0072.579] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString=".docx") returned 5 [0072.579] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0072.579] lstrlenW (lpString=".pdf") returned 4 [0072.579] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString=".xls") returned 4 [0072.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString=".xlsx") returned 5 [0072.579] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0072.579] lstrlenW (lpString=".ppt") returned 4 [0072.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.579] lstrlenW (lpString=".zip") returned 4 [0072.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString=".rar") returned 4 [0072.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.579] lstrlenW (lpString=".bz2") returned 4 [0072.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.579] lstrlenW (lpString=".7z") returned 3 [0072.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.580] lstrlenW (lpString=".dbf") returned 4 [0072.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.580] lstrlenW (lpString=".1cd") returned 4 [0072.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0072.580] lstrlenW (lpString=".jpg") returned 4 [0072.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.580] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") [0072.581] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1499136) returned 1 [0072.581] CloseHandle (hObject=0x1fc) returned 1 [0072.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0072.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.581] lstrlenW (lpString=".doc") returned 4 [0072.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString=".docx") returned 5 [0072.582] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0072.582] lstrlenW (lpString=".pdf") returned 4 [0072.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString=".xls") returned 4 [0072.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString=".xlsx") returned 5 [0072.582] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0072.582] lstrlenW (lpString=".ppt") returned 4 [0072.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.582] lstrlenW (lpString=".zip") returned 4 [0072.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString=".rar") returned 4 [0072.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.582] lstrlenW (lpString=".bz2") returned 4 [0072.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.582] lstrlenW (lpString=".7z") returned 3 [0072.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.582] lstrlenW (lpString=".dbf") returned 4 [0072.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.583] lstrlenW (lpString=".1cd") returned 4 [0072.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0072.583] lstrlenW (lpString=".jpg") returned 4 [0072.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.583] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") [0072.583] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=69632) returned 1 [0072.583] CloseHandle (hObject=0x1fc) returned 1 [0072.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0072.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.584] lstrlenW (lpString=".doc") returned 4 [0072.584] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0072.584] lstrlenW (lpString=".docx") returned 5 [0072.584] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0072.584] lstrlenW (lpString=".pdf") returned 4 [0072.584] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0072.584] lstrlenW (lpString=".xls") returned 4 [0072.584] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0072.584] lstrlenW (lpString=".xlsx") returned 5 [0072.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0072.584] lstrlenW (lpString=".ppt") returned 4 [0072.584] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0072.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.584] lstrlenW (lpString=".zip") returned 4 [0072.584] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0072.584] lstrlenW (lpString=".rar") returned 4 [0072.584] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0072.584] lstrlenW (lpString=".bz2") returned 4 [0072.584] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0072.584] lstrlenW (lpString=".7z") returned 3 [0072.584] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0072.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.584] lstrlenW (lpString=".dbf") returned 4 [0072.585] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0072.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.585] lstrlenW (lpString=".1cd") returned 4 [0072.585] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0072.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0072.585] lstrlenW (lpString=".jpg") returned 4 [0072.585] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0072.585] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") [0072.585] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=73728) returned 1 [0072.585] CloseHandle (hObject=0x1fc) returned 1 [0072.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0072.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.586] lstrlenW (lpString=".doc") returned 4 [0072.586] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0072.586] lstrlenW (lpString=".docx") returned 5 [0072.586] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0072.586] lstrlenW (lpString=".pdf") returned 4 [0072.586] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0072.586] lstrlenW (lpString=".xls") returned 4 [0072.586] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0072.586] lstrlenW (lpString=".xlsx") returned 5 [0072.586] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0072.586] lstrlenW (lpString=".ppt") returned 4 [0072.586] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0072.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.586] lstrlenW (lpString=".zip") returned 4 [0072.586] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0072.586] lstrlenW (lpString=".rar") returned 4 [0072.586] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0072.586] lstrlenW (lpString=".bz2") returned 4 [0072.586] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0072.586] lstrlenW (lpString=".7z") returned 3 [0072.586] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0072.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.586] lstrlenW (lpString=".dbf") returned 4 [0072.586] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0072.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.587] lstrlenW (lpString=".1cd") returned 4 [0072.587] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0072.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0072.587] lstrlenW (lpString=".jpg") returned 4 [0072.587] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0072.587] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") [0072.587] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=94208) returned 1 [0072.587] CloseHandle (hObject=0x1fc) returned 1 [0072.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0072.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.588] lstrlenW (lpString=".doc") returned 4 [0072.588] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString=".docx") returned 5 [0072.588] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1 [0072.588] lstrlenW (lpString=".pdf") returned 4 [0072.588] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString=".xls") returned 4 [0072.588] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0072.588] lstrlenW (lpString=".xlsx") returned 5 [0072.588] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1 [0072.588] lstrlenW (lpString=".ppt") returned 4 [0072.588] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.588] lstrlenW (lpString=".zip") returned 4 [0072.588] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0072.588] lstrlenW (lpString=".rar") returned 4 [0072.588] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString=".bz2") returned 4 [0072.588] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString=".7z") returned 3 [0072.588] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0072.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.588] lstrlenW (lpString=".dbf") returned 4 [0072.588] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0072.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.588] lstrlenW (lpString=".1cd") returned 4 [0072.589] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0072.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0072.589] lstrlenW (lpString=".jpg") returned 4 [0072.589] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0072.589] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") [0074.052] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=98304) returned 1 [0074.052] CloseHandle (hObject=0x150) returned 1 [0074.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0074.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.053] lstrlenW (lpString=".doc") returned 4 [0074.053] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString=".docx") returned 5 [0074.053] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0074.053] lstrlenW (lpString=".pdf") returned 4 [0074.053] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString=".xls") returned 4 [0074.053] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0074.053] lstrlenW (lpString=".xlsx") returned 5 [0074.053] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0074.053] lstrlenW (lpString=".ppt") returned 4 [0074.053] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.053] lstrlenW (lpString=".zip") returned 4 [0074.053] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0074.053] lstrlenW (lpString=".rar") returned 4 [0074.053] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString=".bz2") returned 4 [0074.053] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString=".7z") returned 3 [0074.053] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0074.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.053] lstrlenW (lpString=".dbf") returned 4 [0074.053] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0074.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString=".1cd") returned 4 [0074.054] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString=".jpg") returned 4 [0074.054] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString=".doc") returned 4 [0074.054] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString=".docx") returned 5 [0074.054] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0074.054] lstrlenW (lpString=".pdf") returned 4 [0074.054] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString=".xls") returned 4 [0074.054] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0074.054] lstrlenW (lpString=".xlsx") returned 5 [0074.054] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0074.054] lstrlenW (lpString=".ppt") returned 4 [0074.054] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString=".zip") returned 4 [0074.054] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0074.054] lstrlenW (lpString=".rar") returned 4 [0074.054] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString=".bz2") returned 4 [0074.054] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString=".7z") returned 3 [0074.054] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.054] lstrlenW (lpString=".dbf") returned 4 [0074.054] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0074.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.055] lstrlenW (lpString=".1cd") returned 4 [0074.055] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0074.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0074.055] lstrlenW (lpString=".jpg") returned 4 [0074.055] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0074.055] lstrlenW (lpString="msdaosp.dll") returned 11 [0074.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.055] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=126976) returned 1 [0074.055] CloseHandle (hObject=0x150) returned 1 [0074.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0074.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.056] lstrlenW (lpString=".doc") returned 4 [0074.056] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString=".docx") returned 5 [0074.056] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0074.056] lstrlenW (lpString=".pdf") returned 4 [0074.056] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString=".xls") returned 4 [0074.056] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString=".xlsx") returned 5 [0074.056] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0074.056] lstrlenW (lpString=".ppt") returned 4 [0074.056] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.056] lstrlenW (lpString=".zip") returned 4 [0074.056] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString=".rar") returned 4 [0074.056] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.056] lstrlenW (lpString=".bz2") returned 4 [0074.056] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.056] lstrlenW (lpString=".7z") returned 3 [0074.056] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.056] lstrlenW (lpString=".dbf") returned 4 [0074.056] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.056] lstrlenW (lpString=".1cd") returned 4 [0074.056] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.056] lstrlenW (lpString=".jpg") returned 4 [0074.056] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString=".doc") returned 4 [0074.057] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString=".docx") returned 5 [0074.057] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0074.057] lstrlenW (lpString=".pdf") returned 4 [0074.057] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString=".xls") returned 4 [0074.057] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString=".xlsx") returned 5 [0074.057] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0074.057] lstrlenW (lpString=".ppt") returned 4 [0074.057] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString=".zip") returned 4 [0074.057] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString=".rar") returned 4 [0074.057] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.057] lstrlenW (lpString=".bz2") returned 4 [0074.057] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.057] lstrlenW (lpString=".7z") returned 3 [0074.057] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString=".dbf") returned 4 [0074.057] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString=".1cd") returned 4 [0074.057] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0074.057] lstrlenW (lpString=".jpg") returned 4 [0074.057] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.058] lstrlenW (lpString="msdaps.dll") returned 10 [0074.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.065] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=434176) returned 1 [0074.065] CloseHandle (hObject=0x210) returned 1 [0074.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0074.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString=".doc") returned 4 [0074.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString=".docx") returned 5 [0074.066] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0074.066] lstrlenW (lpString=".pdf") returned 4 [0074.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString=".xls") returned 4 [0074.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString=".xlsx") returned 5 [0074.066] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0074.066] lstrlenW (lpString=".ppt") returned 4 [0074.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString=".zip") returned 4 [0074.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString=".rar") returned 4 [0074.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.066] lstrlenW (lpString=".bz2") returned 4 [0074.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.066] lstrlenW (lpString=".7z") returned 3 [0074.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString=".dbf") returned 4 [0074.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString=".1cd") returned 4 [0074.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.066] lstrlenW (lpString=".jpg") returned 4 [0074.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString=".doc") returned 4 [0074.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString=".docx") returned 5 [0074.067] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0074.067] lstrlenW (lpString=".pdf") returned 4 [0074.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString=".xls") returned 4 [0074.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString=".xlsx") returned 5 [0074.067] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0074.067] lstrlenW (lpString=".ppt") returned 4 [0074.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString=".zip") returned 4 [0074.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString=".rar") returned 4 [0074.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.067] lstrlenW (lpString=".bz2") returned 4 [0074.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.067] lstrlenW (lpString=".7z") returned 3 [0074.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString=".dbf") returned 4 [0074.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString=".1cd") returned 4 [0074.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0074.067] lstrlenW (lpString=".jpg") returned 4 [0074.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.068] lstrlenW (lpString="msdasql.dll") returned 11 [0074.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.068] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=745472) returned 1 [0074.068] CloseHandle (hObject=0x210) returned 1 [0074.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0074.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.068] lstrlenW (lpString=".doc") returned 4 [0074.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.068] lstrlenW (lpString=".docx") returned 5 [0074.068] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0074.068] lstrlenW (lpString=".pdf") returned 4 [0074.069] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString=".xls") returned 4 [0074.069] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString=".xlsx") returned 5 [0074.069] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0074.069] lstrlenW (lpString=".ppt") returned 4 [0074.069] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString=".zip") returned 4 [0074.069] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString=".rar") returned 4 [0074.069] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString=".bz2") returned 4 [0074.069] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.069] lstrlenW (lpString=".7z") returned 3 [0074.069] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString=".dbf") returned 4 [0074.069] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString=".1cd") returned 4 [0074.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString=".jpg") returned 4 [0074.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.069] lstrlenW (lpString=".doc") returned 4 [0074.069] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.069] lstrlenW (lpString=".docx") returned 5 [0074.069] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0074.069] lstrlenW (lpString=".pdf") returned 4 [0074.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString=".xls") returned 4 [0074.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString=".xlsx") returned 5 [0074.070] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0074.070] lstrlenW (lpString=".ppt") returned 4 [0074.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.070] lstrlenW (lpString=".zip") returned 4 [0074.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString=".rar") returned 4 [0074.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString=".bz2") returned 4 [0074.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.070] lstrlenW (lpString=".7z") returned 3 [0074.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.070] lstrlenW (lpString=".dbf") returned 4 [0074.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.070] lstrlenW (lpString=".1cd") returned 4 [0074.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0074.070] lstrlenW (lpString=".jpg") returned 4 [0074.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.070] lstrlenW (lpString="msdasqlr.dll") returned 12 [0074.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.071] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=61440) returned 1 [0074.071] CloseHandle (hObject=0x210) returned 1 [0074.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0074.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.071] lstrlenW (lpString=".doc") returned 4 [0074.071] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.071] lstrlenW (lpString=".docx") returned 5 [0074.071] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.071] lstrlenW (lpString=".pdf") returned 4 [0074.071] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.071] lstrlenW (lpString=".xls") returned 4 [0074.071] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.071] lstrlenW (lpString=".xlsx") returned 5 [0074.071] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.071] lstrlenW (lpString=".ppt") returned 4 [0074.071] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.071] lstrlenW (lpString=".zip") returned 4 [0074.072] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString=".rar") returned 4 [0074.072] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString=".bz2") returned 4 [0074.072] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.072] lstrlenW (lpString=".7z") returned 3 [0074.072] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString=".dbf") returned 4 [0074.072] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString=".1cd") returned 4 [0074.072] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString=".jpg") returned 4 [0074.072] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString=".doc") returned 4 [0074.072] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString=".docx") returned 5 [0074.072] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.072] lstrlenW (lpString=".pdf") returned 4 [0074.072] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString=".xls") returned 4 [0074.072] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString=".xlsx") returned 5 [0074.072] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.072] lstrlenW (lpString=".ppt") returned 4 [0074.072] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.072] lstrlenW (lpString=".zip") returned 4 [0074.072] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.073] lstrlenW (lpString=".rar") returned 4 [0074.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.073] lstrlenW (lpString=".bz2") returned 4 [0074.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.073] lstrlenW (lpString=".7z") returned 3 [0074.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.073] lstrlenW (lpString=".dbf") returned 4 [0074.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.073] lstrlenW (lpString=".1cd") returned 4 [0074.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0074.073] lstrlenW (lpString=".jpg") returned 4 [0074.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.073] lstrlenW (lpString="msdatl3.dll") returned 11 [0074.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.073] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=131072) returned 1 [0074.073] CloseHandle (hObject=0x210) returned 1 [0074.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0074.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.074] lstrlenW (lpString=".doc") returned 4 [0074.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString=".docx") returned 5 [0074.074] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1 [0074.074] lstrlenW (lpString=".pdf") returned 4 [0074.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString=".xls") returned 4 [0074.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString=".xlsx") returned 5 [0074.074] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1 [0074.074] lstrlenW (lpString=".ppt") returned 4 [0074.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.074] lstrlenW (lpString=".zip") returned 4 [0074.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString=".rar") returned 4 [0074.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.074] lstrlenW (lpString=".bz2") returned 4 [0074.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.074] lstrlenW (lpString=".7z") returned 3 [0074.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.074] lstrlenW (lpString=".dbf") returned 4 [0074.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".1cd") returned 4 [0074.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".jpg") returned 4 [0074.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".doc") returned 4 [0074.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString=".docx") returned 5 [0074.075] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1 [0074.075] lstrlenW (lpString=".pdf") returned 4 [0074.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString=".xls") returned 4 [0074.075] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString=".xlsx") returned 5 [0074.075] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1 [0074.075] lstrlenW (lpString=".ppt") returned 4 [0074.075] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".zip") returned 4 [0074.075] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString=".rar") returned 4 [0074.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.075] lstrlenW (lpString=".bz2") returned 4 [0074.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.075] lstrlenW (lpString=".7z") returned 3 [0074.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".dbf") returned 4 [0074.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.075] lstrlenW (lpString=".1cd") returned 4 [0074.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0074.076] lstrlenW (lpString=".jpg") returned 4 [0074.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.076] lstrlenW (lpString="msxactps.dll") returned 12 [0074.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.103] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36864) returned 1 [0074.103] CloseHandle (hObject=0x210) returned 1 [0074.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0074.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0074.104] lstrlenW (lpString=".doc") returned 4 [0074.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString=".docx") returned 5 [0074.104] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0074.104] lstrlenW (lpString=".pdf") returned 4 [0074.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString=".xls") returned 4 [0074.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString=".xlsx") returned 5 [0074.104] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0074.104] lstrlenW (lpString=".ppt") returned 4 [0074.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0074.104] lstrlenW (lpString=".zip") returned 4 [0074.104] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString=".rar") returned 4 [0074.104] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.104] lstrlenW (lpString=".bz2") returned 4 [0074.104] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.104] lstrlenW (lpString=".7z") returned 3 [0074.104] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0074.104] lstrlenW (lpString=".dbf") returned 4 [0074.104] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.104] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") [0074.105] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=199192) returned 1 [0074.105] CloseHandle (hObject=0x210) returned 1 [0074.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 0x20 [0074.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.105] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.105] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.106] GetLastError () returned 0x0 [0074.106] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x30a18, lpOverlapped=0x0) returned 1 [0074.137] WriteFile (in: hFile=0x154, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x30a20, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x30a20, lpOverlapped=0x0) returned 1 [0074.140] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x154, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.140] SetEndOfFile (hFile=0x154) returned 1 [0074.140] CloseHandle (hObject=0x154) returned 1 [0074.140] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.140] SetEndOfFile (hFile=0x210) returned 1 [0074.142] CloseHandle (hObject=0x210) returned 1 [0074.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.143] lstrlenW (lpString=".doc") returned 4 [0074.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString=".docx") returned 5 [0074.143] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0074.143] lstrlenW (lpString=".pdf") returned 4 [0074.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString=".xls") returned 4 [0074.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString=".xlsx") returned 5 [0074.143] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0074.143] lstrlenW (lpString=".ppt") returned 4 [0074.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.143] lstrlenW (lpString=".zip") returned 4 [0074.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString=".rar") returned 4 [0074.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.143] lstrlenW (lpString=".bz2") returned 4 [0074.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.143] lstrlenW (lpString=".7z") returned 3 [0074.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.143] lstrlenW (lpString=".dbf") returned 4 [0074.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString=".1cd") returned 4 [0074.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString=".jpg") returned 4 [0074.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString=".doc") returned 4 [0074.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString=".docx") returned 5 [0074.144] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0074.144] lstrlenW (lpString=".pdf") returned 4 [0074.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString=".xls") returned 4 [0074.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString=".xlsx") returned 5 [0074.144] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0074.144] lstrlenW (lpString=".ppt") returned 4 [0074.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString=".zip") returned 4 [0074.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString=".rar") returned 4 [0074.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.144] lstrlenW (lpString=".bz2") returned 4 [0074.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.144] lstrlenW (lpString=".7z") returned 3 [0074.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.144] lstrlenW (lpString=".dbf") returned 4 [0074.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.145] lstrlenW (lpString=".1cd") returned 4 [0074.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 56 [0074.145] lstrlenW (lpString=".jpg") returned 4 [0074.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.145] lstrlenW (lpString="bod_r.TTF") returned 9 [0074.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.186] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=77884) returned 1 [0074.186] CloseHandle (hObject=0x150) returned 1 [0074.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0x20 [0074.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.186] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.186] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.186] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.186] lstrlenW (lpString=".doc") returned 4 [0074.186] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0074.186] lstrlenW (lpString=".docx") returned 5 [0074.186] lstrcmpiW (lpString1=".docx", lpString2="r.TTF") returned -1 [0074.186] lstrlenW (lpString=".pdf") returned 4 [0074.186] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0074.186] lstrlenW (lpString=".xls") returned 4 [0074.187] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0074.187] lstrlenW (lpString=".xlsx") returned 5 [0074.187] lstrcmpiW (lpString1=".xlsx", lpString2="r.TTF") returned -1 [0074.187] lstrlenW (lpString=".ppt") returned 4 [0074.187] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0074.187] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.187] lstrlenW (lpString=".zip") returned 4 [0074.187] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0074.187] lstrlenW (lpString=".rar") returned 4 [0074.187] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0074.187] lstrlenW (lpString=".bz2") returned 4 [0074.187] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0074.187] lstrlenW (lpString=".7z") returned 3 [0074.187] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0074.187] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.187] lstrlenW (lpString=".dbf") returned 4 [0074.187] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0074.187] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.187] lstrlenW (lpString=".1cd") returned 4 [0074.187] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0074.187] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 36 [0074.187] lstrlenW (lpString=".jpg") returned 4 [0074.187] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0074.187] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\offset.ax") [0074.187] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=43008) returned 1 [0074.188] CloseHandle (hObject=0x150) returned 1 [0074.188] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0074.188] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\offset.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.188] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.188] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.188] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.188] lstrlenW (lpString=".doc") returned 4 [0074.188] lstrcmpiW (lpString1=".doc", lpString2="t.ax") returned -1 [0074.188] lstrlenW (lpString=".docx") returned 5 [0074.188] lstrcmpiW (lpString1=".docx", lpString2="et.ax") returned -1 [0074.188] lstrlenW (lpString=".pdf") returned 4 [0074.188] lstrcmpiW (lpString1=".pdf", lpString2="t.ax") returned -1 [0074.188] lstrlenW (lpString=".xls") returned 4 [0074.188] lstrcmpiW (lpString1=".xls", lpString2="t.ax") returned -1 [0074.188] lstrlenW (lpString=".xlsx") returned 5 [0074.188] lstrcmpiW (lpString1=".xlsx", lpString2="et.ax") returned -1 [0074.188] lstrlenW (lpString=".ppt") returned 4 [0074.188] lstrcmpiW (lpString1=".ppt", lpString2="t.ax") returned -1 [0074.188] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.188] lstrlenW (lpString=".zip") returned 4 [0074.188] lstrcmpiW (lpString1=".zip", lpString2="t.ax") returned -1 [0074.188] lstrlenW (lpString=".rar") returned 4 [0074.188] lstrcmpiW (lpString1=".rar", lpString2="t.ax") returned -1 [0074.189] lstrlenW (lpString=".bz2") returned 4 [0074.189] lstrcmpiW (lpString1=".bz2", lpString2="t.ax") returned -1 [0074.189] lstrlenW (lpString=".7z") returned 3 [0074.189] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.189] lstrlenW (lpString=".dbf") returned 4 [0074.189] lstrcmpiW (lpString1=".dbf", lpString2="t.ax") returned -1 [0074.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.189] lstrlenW (lpString=".1cd") returned 4 [0074.189] lstrcmpiW (lpString1=".1cd", lpString2="t.ax") returned -1 [0074.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0074.189] lstrlenW (lpString=".jpg") returned 4 [0074.189] lstrcmpiW (lpString1=".jpg", lpString2="t.ax") returned -1 [0074.189] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\OmdBase.dll") [0074.190] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14967808) returned 1 [0074.190] CloseHandle (hObject=0x150) returned 1 [0074.190] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0x20 [0074.190] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.190] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0074.190] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString=".doc") returned 4 [0074.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString=".docx") returned 5 [0074.191] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0074.191] lstrlenW (lpString=".pdf") returned 4 [0074.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString=".xls") returned 4 [0074.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString=".xlsx") returned 5 [0074.191] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0074.191] lstrlenW (lpString=".ppt") returned 4 [0074.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString=".zip") returned 4 [0074.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString=".rar") returned 4 [0074.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.191] lstrlenW (lpString=".bz2") returned 4 [0074.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.191] lstrlenW (lpString=".7z") returned 3 [0074.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString=".dbf") returned 4 [0074.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString=".1cd") returned 4 [0074.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 38 [0074.191] lstrlenW (lpString=".jpg") returned 4 [0074.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.192] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\OmdProject.dll") [0074.192] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4400640) returned 1 [0074.192] CloseHandle (hObject=0x150) returned 1 [0074.192] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0x20 [0074.192] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.192] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0074.192] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.192] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.192] lstrlenW (lpString=".doc") returned 4 [0074.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.192] lstrlenW (lpString=".docx") returned 5 [0074.192] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0074.192] lstrlenW (lpString=".pdf") returned 4 [0074.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.192] lstrlenW (lpString=".xls") returned 4 [0074.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.193] lstrlenW (lpString=".xlsx") returned 5 [0074.193] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0074.193] lstrlenW (lpString=".ppt") returned 4 [0074.193] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.193] lstrlenW (lpString=".zip") returned 4 [0074.193] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.193] lstrlenW (lpString=".rar") returned 4 [0074.193] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.193] lstrlenW (lpString=".bz2") returned 4 [0074.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.193] lstrlenW (lpString=".7z") returned 3 [0074.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.193] lstrlenW (lpString=".dbf") returned 4 [0074.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.193] lstrlenW (lpString=".1cd") returned 4 [0074.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 41 [0074.193] lstrlenW (lpString=".jpg") returned 4 [0074.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.193] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\Pipeline.dll") [0074.194] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1852928) returned 1 [0074.194] CloseHandle (hObject=0x150) returned 1 [0074.194] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0x20 [0074.194] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.194] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0074.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.194] lstrlenW (lpString=".doc") returned 4 [0074.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.194] lstrlenW (lpString=".docx") returned 5 [0074.194] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0074.194] lstrlenW (lpString=".pdf") returned 4 [0074.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.194] lstrlenW (lpString=".xls") returned 4 [0074.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.194] lstrlenW (lpString=".xlsx") returned 5 [0074.194] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0074.194] lstrlenW (lpString=".ppt") returned 4 [0074.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.194] lstrlenW (lpString=".zip") returned 4 [0074.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.195] lstrlenW (lpString=".rar") returned 4 [0074.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.195] lstrlenW (lpString=".bz2") returned 4 [0074.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.195] lstrlenW (lpString=".7z") returned 3 [0074.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.195] lstrlenW (lpString=".dbf") returned 4 [0074.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.195] lstrlenW (lpString=".1cd") returned 4 [0074.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.195] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 39 [0074.195] lstrlenW (lpString=".jpg") returned 4 [0074.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.195] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\PipeTran.dll") [0074.195] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1884160) returned 1 [0074.195] CloseHandle (hObject=0x150) returned 1 [0074.195] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0x20 [0074.196] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.196] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0074.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.196] lstrlenW (lpString=".doc") returned 4 [0074.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString=".docx") returned 5 [0074.196] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0074.196] lstrlenW (lpString=".pdf") returned 4 [0074.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString=".xls") returned 4 [0074.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString=".xlsx") returned 5 [0074.196] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0074.196] lstrlenW (lpString=".ppt") returned 4 [0074.196] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.196] lstrlenW (lpString=".zip") returned 4 [0074.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString=".rar") returned 4 [0074.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.196] lstrlenW (lpString=".bz2") returned 4 [0074.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.196] lstrlenW (lpString=".7z") returned 3 [0074.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.196] lstrlenW (lpString=".dbf") returned 4 [0074.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.197] lstrlenW (lpString=".1cd") returned 4 [0074.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 39 [0074.197] lstrlenW (lpString=".jpg") returned 4 [0074.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.197] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") [0074.197] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=78848) returned 1 [0074.197] CloseHandle (hObject=0x150) returned 1 [0074.197] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0x20 [0074.197] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.197] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.198] lstrlenW (lpString=".doc") returned 4 [0074.198] lstrcmpiW (lpString1=".doc", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".docx") returned 5 [0074.198] lstrcmpiW (lpString1=".docx", lpString2="nk.ax") returned -1 [0074.198] lstrlenW (lpString=".pdf") returned 4 [0074.198] lstrcmpiW (lpString1=".pdf", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".xls") returned 4 [0074.198] lstrcmpiW (lpString1=".xls", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".xlsx") returned 5 [0074.198] lstrcmpiW (lpString1=".xlsx", lpString2="nk.ax") returned -1 [0074.198] lstrlenW (lpString=".ppt") returned 4 [0074.198] lstrcmpiW (lpString1=".ppt", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.198] lstrlenW (lpString=".zip") returned 4 [0074.198] lstrcmpiW (lpString1=".zip", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".rar") returned 4 [0074.198] lstrcmpiW (lpString1=".rar", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".bz2") returned 4 [0074.198] lstrcmpiW (lpString1=".bz2", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString=".7z") returned 3 [0074.198] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.198] lstrlenW (lpString=".dbf") returned 4 [0074.198] lstrcmpiW (lpString1=".dbf", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.198] lstrlenW (lpString=".1cd") returned 4 [0074.198] lstrcmpiW (lpString1=".1cd", lpString2="k.ax") returned -1 [0074.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 42 [0074.198] lstrlenW (lpString=".jpg") returned 4 [0074.198] lstrcmpiW (lpString1=".jpg", lpString2="k.ax") returned -1 [0074.198] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") [0074.199] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=52736) returned 1 [0074.199] CloseHandle (hObject=0x150) returned 1 [0074.199] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0x20 [0074.199] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.200] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.200] lstrlenW (lpString=".doc") returned 4 [0074.200] lstrcmpiW (lpString1=".doc", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".docx") returned 5 [0074.200] lstrcmpiW (lpString1=".docx", lpString2="ce.ax") returned -1 [0074.200] lstrlenW (lpString=".pdf") returned 4 [0074.200] lstrcmpiW (lpString1=".pdf", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".xls") returned 4 [0074.200] lstrcmpiW (lpString1=".xls", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".xlsx") returned 5 [0074.200] lstrcmpiW (lpString1=".xlsx", lpString2="ce.ax") returned -1 [0074.200] lstrlenW (lpString=".ppt") returned 4 [0074.200] lstrcmpiW (lpString1=".ppt", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.200] lstrlenW (lpString=".zip") returned 4 [0074.200] lstrcmpiW (lpString1=".zip", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".rar") returned 4 [0074.200] lstrcmpiW (lpString1=".rar", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".bz2") returned 4 [0074.200] lstrcmpiW (lpString1=".bz2", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString=".7z") returned 3 [0074.200] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.200] lstrlenW (lpString=".dbf") returned 4 [0074.200] lstrcmpiW (lpString1=".dbf", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.200] lstrlenW (lpString=".1cd") returned 4 [0074.200] lstrcmpiW (lpString1=".1cd", lpString2="e.ax") returned -1 [0074.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 44 [0074.201] lstrlenW (lpString=".jpg") returned 4 [0074.201] lstrcmpiW (lpString1=".jpg", lpString2="e.ax") returned -1 [0074.201] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\SecretST.TTF") [0074.201] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=98824) returned 1 [0074.201] CloseHandle (hObject=0x150) returned 1 [0074.201] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf")) returned 0x20 [0074.201] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.201] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.201] lstrlenW (lpString=".doc") returned 4 [0074.201] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0074.201] lstrlenW (lpString=".docx") returned 5 [0074.201] lstrcmpiW (lpString1=".docx", lpString2="T.TTF") returned -1 [0074.202] lstrlenW (lpString=".pdf") returned 4 [0074.202] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString=".xls") returned 4 [0074.202] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0074.202] lstrlenW (lpString=".xlsx") returned 5 [0074.202] lstrcmpiW (lpString1=".xlsx", lpString2="T.TTF") returned -1 [0074.202] lstrlenW (lpString=".ppt") returned 4 [0074.202] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.202] lstrlenW (lpString=".zip") returned 4 [0074.202] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0074.202] lstrlenW (lpString=".rar") returned 4 [0074.202] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString=".bz2") returned 4 [0074.202] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString=".7z") returned 3 [0074.202] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0074.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.202] lstrlenW (lpString=".dbf") returned 4 [0074.202] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.202] lstrlenW (lpString=".1cd") returned 4 [0074.202] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0074.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 39 [0074.202] lstrlenW (lpString=".jpg") returned 4 [0074.202] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0074.202] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") [0074.203] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12516) returned 1 [0074.203] CloseHandle (hObject=0x150) returned 1 [0074.203] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0x20 [0074.203] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.203] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.203] lstrlenW (lpString=".doc") returned 4 [0074.203] lstrcmpiW (lpString1=".doc", lpString2=".fxh") returned -1 [0074.203] lstrlenW (lpString=".docx") returned 5 [0074.203] lstrcmpiW (lpString1=".docx", lpString2="n.fxh") returned -1 [0074.203] lstrlenW (lpString=".pdf") returned 4 [0074.203] lstrcmpiW (lpString1=".pdf", lpString2=".fxh") returned 1 [0074.203] lstrlenW (lpString=".xls") returned 4 [0074.203] lstrcmpiW (lpString1=".xls", lpString2=".fxh") returned 1 [0074.203] lstrlenW (lpString=".xlsx") returned 5 [0074.203] lstrcmpiW (lpString1=".xlsx", lpString2="n.fxh") returned -1 [0074.203] lstrlenW (lpString=".ppt") returned 4 [0074.203] lstrcmpiW (lpString1=".ppt", lpString2=".fxh") returned 1 [0074.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.203] lstrlenW (lpString=".zip") returned 4 [0074.204] lstrcmpiW (lpString1=".zip", lpString2=".fxh") returned 1 [0074.204] lstrlenW (lpString=".rar") returned 4 [0074.204] lstrcmpiW (lpString1=".rar", lpString2=".fxh") returned 1 [0074.204] lstrlenW (lpString=".bz2") returned 4 [0074.204] lstrcmpiW (lpString1=".bz2", lpString2=".fxh") returned -1 [0074.204] lstrlenW (lpString=".7z") returned 3 [0074.204] lstrcmpiW (lpString1=".7z", lpString2="fxh") returned -1 [0074.204] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.204] lstrlenW (lpString=".dbf") returned 4 [0074.204] lstrcmpiW (lpString1=".dbf", lpString2=".fxh") returned -1 [0074.204] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.204] lstrlenW (lpString=".1cd") returned 4 [0074.204] lstrcmpiW (lpString1=".1cd", lpString2=".fxh") returned -1 [0074.204] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 44 [0074.204] lstrlenW (lpString=".jpg") returned 4 [0074.204] lstrcmpiW (lpString1=".jpg", lpString2=".fxh") returned 1 [0074.204] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") [0074.204] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=16940) returned 1 [0074.204] CloseHandle (hObject=0x150) returned 1 [0074.204] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0x20 [0074.205] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.205] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.205] lstrlenW (lpString=".doc") returned 4 [0074.205] lstrcmpiW (lpString1=".doc", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".docx") returned 5 [0074.205] lstrcmpiW (lpString1=".docx", lpString2="rm.fx") returned -1 [0074.205] lstrlenW (lpString=".pdf") returned 4 [0074.205] lstrcmpiW (lpString1=".pdf", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".xls") returned 4 [0074.205] lstrcmpiW (lpString1=".xls", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".xlsx") returned 5 [0074.205] lstrcmpiW (lpString1=".xlsx", lpString2="rm.fx") returned -1 [0074.205] lstrlenW (lpString=".ppt") returned 4 [0074.205] lstrcmpiW (lpString1=".ppt", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.205] lstrlenW (lpString=".zip") returned 4 [0074.205] lstrcmpiW (lpString1=".zip", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".rar") returned 4 [0074.205] lstrcmpiW (lpString1=".rar", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".bz2") returned 4 [0074.205] lstrcmpiW (lpString1=".bz2", lpString2="m.fx") returned -1 [0074.205] lstrlenW (lpString=".7z") returned 3 [0074.205] lstrcmpiW (lpString1=".7z", lpString2=".fx") returned -1 [0074.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.205] lstrlenW (lpString=".dbf") returned 4 [0074.205] lstrcmpiW (lpString1=".dbf", lpString2="m.fx") returned -1 [0074.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.206] lstrlenW (lpString=".1cd") returned 4 [0074.206] lstrcmpiW (lpString1=".1cd", lpString2="m.fx") returned -1 [0074.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 59 [0074.206] lstrlenW (lpString=".jpg") returned 4 [0074.206] lstrcmpiW (lpString1=".jpg", lpString2="m.fx") returned -1 [0074.206] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") [0074.206] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36575) returned 1 [0074.206] CloseHandle (hObject=0x150) returned 1 [0074.206] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0074.206] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.206] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 43 [0074.206] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") [0074.207] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=79360) returned 1 [0074.207] CloseHandle (hObject=0x150) returned 1 [0074.207] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20 [0074.207] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.207] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.207] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\sonicsptransform.ax") [0074.207] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=51712) returned 1 [0074.208] CloseHandle (hObject=0x150) returned 1 [0074.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20 [0074.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.208] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.208] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll") [0074.208] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=303104) returned 1 [0074.208] CloseHandle (hObject=0x150) returned 1 [0074.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0x20 [0074.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.209] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.209] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") [0074.448] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2560) returned 1 [0074.448] CloseHandle (hObject=0x190) returned 1 [0074.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0074.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.448] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.449] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") [0074.449] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=8154984) returned 1 [0074.449] CloseHandle (hObject=0x190) returned 1 [0074.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0x20 [0074.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0074.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0074.450] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0074.450] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0074.450] ReadFile (in: hFile=0x190, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.107] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0075.107] ReadFile (in: hFile=0x190, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.137] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.137] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x786f68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x190, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.183] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0075.183] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0075.242] SetEndOfFile (hFile=0x190) returned 1 [0075.242] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0075.242] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0075.242] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.244] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x297a78, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0075.244] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.246] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x786f68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0075.246] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.248] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0075.248] CloseHandle (hObject=0x190) returned 1 [0075.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.248] lstrlenW (lpString=".doc") returned 4 [0075.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.248] lstrlenW (lpString=".docx") returned 5 [0075.248] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.248] lstrlenW (lpString=".pdf") returned 4 [0075.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.248] lstrlenW (lpString=".xls") returned 4 [0075.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.248] lstrlenW (lpString=".xlsx") returned 5 [0075.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.249] lstrlenW (lpString=".ppt") returned 4 [0075.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.249] lstrlenW (lpString=".zip") returned 4 [0075.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.249] lstrlenW (lpString=".rar") returned 4 [0075.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.249] lstrlenW (lpString=".bz2") returned 4 [0075.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.249] lstrlenW (lpString=".7z") returned 3 [0075.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.249] lstrlenW (lpString=".dbf") returned 4 [0075.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.249] lstrlenW (lpString=".1cd") returned 4 [0075.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0075.249] lstrlenW (lpString=".jpg") returned 4 [0075.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.249] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") [0075.336] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6970) returned 1 [0075.336] CloseHandle (hObject=0x190) returned 1 [0075.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0075.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.338] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0075.338] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0075.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.713] GetLastError () returned 0x0 [0075.713] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0075.877] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0075.878] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0075.878] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.878] SetEndOfFile (hFile=0x1c8) returned 1 [0075.926] CloseHandle (hObject=0x1c8) returned 1 [0075.930] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0075.930] SetEndOfFile (hFile=0x1ec) returned 1 [0075.945] CloseHandle (hObject=0x1ec) returned 1 [0075.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.990] lstrlenW (lpString=".doc") returned 4 [0075.990] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.990] lstrlenW (lpString=".docx") returned 5 [0075.990] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.990] lstrlenW (lpString=".pdf") returned 4 [0075.990] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.990] lstrlenW (lpString=".xls") returned 4 [0075.990] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.990] lstrlenW (lpString=".xlsx") returned 5 [0075.990] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.990] lstrlenW (lpString=".ppt") returned 4 [0075.990] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.991] lstrlenW (lpString=".zip") returned 4 [0075.991] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.991] lstrlenW (lpString=".rar") returned 4 [0075.991] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.991] lstrlenW (lpString=".bz2") returned 4 [0075.991] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.991] lstrlenW (lpString=".7z") returned 3 [0075.991] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.991] lstrlenW (lpString=".dbf") returned 4 [0075.991] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.991] lstrlenW (lpString=".1cd") returned 4 [0075.991] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0075.991] lstrlenW (lpString=".jpg") returned 4 [0075.991] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.991] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") [0076.000] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7347) returned 1 [0076.000] CloseHandle (hObject=0x1fc) returned 1 [0076.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0076.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.000] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.000] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.000] GetLastError () returned 0x0 [0076.000] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0076.003] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0076.004] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.004] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.004] SetEndOfFile (hFile=0x22c) returned 1 [0076.004] CloseHandle (hObject=0x22c) returned 1 [0076.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.004] SetEndOfFile (hFile=0x1fc) returned 1 [0076.005] CloseHandle (hObject=0x1fc) returned 1 [0076.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.006] lstrlenW (lpString=".doc") returned 4 [0076.006] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.006] lstrlenW (lpString=".docx") returned 5 [0076.006] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0076.006] lstrlenW (lpString=".pdf") returned 4 [0076.006] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.006] lstrlenW (lpString=".xls") returned 4 [0076.006] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.006] lstrlenW (lpString=".xlsx") returned 5 [0076.006] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0076.006] lstrlenW (lpString=".ppt") returned 4 [0076.006] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.006] lstrlenW (lpString=".zip") returned 4 [0076.006] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.006] lstrlenW (lpString=".rar") returned 4 [0076.006] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.006] lstrlenW (lpString=".bz2") returned 4 [0076.006] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.006] lstrlenW (lpString=".7z") returned 3 [0076.006] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.006] lstrlenW (lpString=".dbf") returned 4 [0076.006] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.006] lstrlenW (lpString=".1cd") returned 4 [0076.006] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0076.007] lstrlenW (lpString=".jpg") returned 4 [0076.007] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.007] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") [0076.007] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6764) returned 1 [0076.007] CloseHandle (hObject=0x1fc) returned 1 [0076.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0076.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.008] GetLastError () returned 0x0 [0076.008] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0076.024] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.024] SetEndOfFile (hFile=0x22c) returned 1 [0076.025] CloseHandle (hObject=0x22c) returned 1 [0076.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.025] SetEndOfFile (hFile=0x1fc) returned 1 [0076.026] CloseHandle (hObject=0x1fc) returned 1 [0076.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.026] lstrlenW (lpString=".doc") returned 4 [0076.026] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.026] lstrlenW (lpString=".docx") returned 5 [0076.026] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0076.026] lstrlenW (lpString=".pdf") returned 4 [0076.026] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.026] lstrlenW (lpString=".xls") returned 4 [0076.026] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.026] lstrlenW (lpString=".xlsx") returned 5 [0076.026] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0076.026] lstrlenW (lpString=".ppt") returned 4 [0076.026] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.026] lstrlenW (lpString=".zip") returned 4 [0076.026] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.026] lstrlenW (lpString=".rar") returned 4 [0076.027] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.027] lstrlenW (lpString=".bz2") returned 4 [0076.027] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.027] lstrlenW (lpString=".7z") returned 3 [0076.027] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.027] lstrlenW (lpString=".dbf") returned 4 [0076.027] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.027] lstrlenW (lpString=".1cd") returned 4 [0076.027] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0076.027] lstrlenW (lpString=".jpg") returned 4 [0076.027] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.027] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") [0076.028] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5393) returned 1 [0076.028] CloseHandle (hObject=0x1fc) returned 1 [0076.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0076.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.028] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.028] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.028] GetLastError () returned 0x0 [0076.028] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1511, lpOverlapped=0x0) returned 1 [0076.043] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1520, lpOverlapped=0x0) returned 1 [0076.044] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.044] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.044] SetEndOfFile (hFile=0x22c) returned 1 [0076.044] CloseHandle (hObject=0x22c) returned 1 [0076.044] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.044] SetEndOfFile (hFile=0x1fc) returned 1 [0076.045] CloseHandle (hObject=0x1fc) returned 1 [0076.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0076.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.045] lstrlenW (lpString=".doc") returned 4 [0076.046] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.046] lstrlenW (lpString=".docx") returned 5 [0076.046] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0076.046] lstrlenW (lpString=".pdf") returned 4 [0076.046] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.046] lstrlenW (lpString=".xls") returned 4 [0076.046] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.046] lstrlenW (lpString=".xlsx") returned 5 [0076.046] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0076.046] lstrlenW (lpString=".ppt") returned 4 [0076.046] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.046] lstrlenW (lpString=".zip") returned 4 [0076.046] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.046] lstrlenW (lpString=".rar") returned 4 [0076.046] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.046] lstrlenW (lpString=".bz2") returned 4 [0076.046] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.046] lstrlenW (lpString=".7z") returned 3 [0076.046] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.046] lstrlenW (lpString=".dbf") returned 4 [0076.046] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.046] lstrlenW (lpString=".1cd") returned 4 [0076.046] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0076.046] lstrlenW (lpString=".jpg") returned 4 [0076.046] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.046] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") [0076.052] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5983) returned 1 [0076.054] CloseHandle (hObject=0x1fc) returned 1 [0076.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0076.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.054] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.054] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.055] GetLastError () returned 0x0 [0076.055] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x175f, lpOverlapped=0x0) returned 1 [0076.063] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1760, lpOverlapped=0x0) returned 1 [0076.063] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.064] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.064] SetEndOfFile (hFile=0x22c) returned 1 [0076.064] CloseHandle (hObject=0x22c) returned 1 [0076.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.064] SetEndOfFile (hFile=0x1fc) returned 1 [0076.065] CloseHandle (hObject=0x1fc) returned 1 [0076.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0076.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.065] lstrlenW (lpString=".doc") returned 4 [0076.065] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.065] lstrlenW (lpString=".docx") returned 5 [0076.065] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.065] lstrlenW (lpString=".pdf") returned 4 [0076.065] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.065] lstrlenW (lpString=".xls") returned 4 [0076.065] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.065] lstrlenW (lpString=".xlsx") returned 5 [0076.065] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.065] lstrlenW (lpString=".ppt") returned 4 [0076.065] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.065] lstrlenW (lpString=".zip") returned 4 [0076.065] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.066] lstrlenW (lpString=".rar") returned 4 [0076.066] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.066] lstrlenW (lpString=".bz2") returned 4 [0076.066] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.066] lstrlenW (lpString=".7z") returned 3 [0076.066] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.066] lstrlenW (lpString=".dbf") returned 4 [0076.066] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.066] lstrlenW (lpString=".1cd") returned 4 [0076.066] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0076.066] lstrlenW (lpString=".jpg") returned 4 [0076.066] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.066] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") [0076.068] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10122) returned 1 [0076.068] CloseHandle (hObject=0x1fc) returned 1 [0076.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0076.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.068] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.069] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.069] GetLastError () returned 0x0 [0076.069] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x278a, lpOverlapped=0x0) returned 1 [0076.074] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2790, lpOverlapped=0x0) returned 1 [0076.075] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.075] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.075] SetEndOfFile (hFile=0x22c) returned 1 [0076.090] CloseHandle (hObject=0x22c) returned 1 [0076.091] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.091] SetEndOfFile (hFile=0x1fc) returned 1 [0076.096] CloseHandle (hObject=0x1fc) returned 1 [0076.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0076.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.099] lstrlenW (lpString=".doc") returned 4 [0076.099] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.099] lstrlenW (lpString=".docx") returned 5 [0076.099] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.099] lstrlenW (lpString=".pdf") returned 4 [0076.099] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.099] lstrlenW (lpString=".xls") returned 4 [0076.099] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.099] lstrlenW (lpString=".xlsx") returned 5 [0076.099] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.099] lstrlenW (lpString=".ppt") returned 4 [0076.100] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.100] lstrlenW (lpString=".zip") returned 4 [0076.100] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.100] lstrlenW (lpString=".rar") returned 4 [0076.100] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.100] lstrlenW (lpString=".bz2") returned 4 [0076.100] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.100] lstrlenW (lpString=".7z") returned 3 [0076.100] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.100] lstrlenW (lpString=".dbf") returned 4 [0076.100] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.100] lstrlenW (lpString=".1cd") returned 4 [0076.100] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0076.100] lstrlenW (lpString=".jpg") returned 4 [0076.100] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.100] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") [0076.102] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5058) returned 1 [0076.102] CloseHandle (hObject=0x1fc) returned 1 [0076.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0076.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.103] GetLastError () returned 0x0 [0076.103] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x13c2, lpOverlapped=0x0) returned 1 [0076.157] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0076.157] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.158] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.158] SetEndOfFile (hFile=0x1c0) returned 1 [0076.158] CloseHandle (hObject=0x1c0) returned 1 [0076.158] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.158] SetEndOfFile (hFile=0x1fc) returned 1 [0076.159] CloseHandle (hObject=0x1fc) returned 1 [0076.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0076.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.159] lstrlenW (lpString=".doc") returned 4 [0076.159] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.159] lstrlenW (lpString=".docx") returned 5 [0076.159] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0076.159] lstrlenW (lpString=".pdf") returned 4 [0076.159] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.159] lstrlenW (lpString=".xls") returned 4 [0076.159] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.159] lstrlenW (lpString=".xlsx") returned 5 [0076.159] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0076.159] lstrlenW (lpString=".ppt") returned 4 [0076.159] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.159] lstrlenW (lpString=".zip") returned 4 [0076.160] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.160] lstrlenW (lpString=".rar") returned 4 [0076.160] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.160] lstrlenW (lpString=".bz2") returned 4 [0076.160] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.160] lstrlenW (lpString=".7z") returned 3 [0076.160] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.160] lstrlenW (lpString=".dbf") returned 4 [0076.160] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.160] lstrlenW (lpString=".1cd") returned 4 [0076.160] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0076.160] lstrlenW (lpString=".jpg") returned 4 [0076.160] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.160] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") [0076.160] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13358) returned 1 [0076.160] CloseHandle (hObject=0x1fc) returned 1 [0076.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0076.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.161] GetLastError () returned 0x0 [0076.161] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x342e, lpOverlapped=0x0) returned 1 [0076.216] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3430, lpOverlapped=0x0) returned 1 [0076.218] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.218] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.218] SetEndOfFile (hFile=0x1c0) returned 1 [0076.218] CloseHandle (hObject=0x1c0) returned 1 [0076.218] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.218] SetEndOfFile (hFile=0x1fc) returned 1 [0076.219] CloseHandle (hObject=0x1fc) returned 1 [0076.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0076.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.220] lstrlenW (lpString=".doc") returned 4 [0076.220] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.220] lstrlenW (lpString=".docx") returned 5 [0076.220] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.220] lstrlenW (lpString=".pdf") returned 4 [0076.220] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.220] lstrlenW (lpString=".xls") returned 4 [0076.220] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.220] lstrlenW (lpString=".xlsx") returned 5 [0076.220] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.220] lstrlenW (lpString=".ppt") returned 4 [0076.220] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.220] lstrlenW (lpString=".zip") returned 4 [0076.220] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.220] lstrlenW (lpString=".rar") returned 4 [0076.220] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.220] lstrlenW (lpString=".bz2") returned 4 [0076.220] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.220] lstrlenW (lpString=".7z") returned 3 [0076.220] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.220] lstrlenW (lpString=".dbf") returned 4 [0076.220] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.221] lstrlenW (lpString=".1cd") returned 4 [0076.221] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0076.221] lstrlenW (lpString=".jpg") returned 4 [0076.221] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.221] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") [0076.646] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=27365) returned 1 [0076.646] CloseHandle (hObject=0x1f0) returned 1 [0076.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0076.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.646] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.646] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.779] GetLastError () returned 0x0 [0076.779] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0076.808] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0076.810] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.810] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.810] SetEndOfFile (hFile=0x1fc) returned 1 [0076.811] CloseHandle (hObject=0x1fc) returned 1 [0076.811] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.811] SetEndOfFile (hFile=0x1f0) returned 1 [0076.812] CloseHandle (hObject=0x1f0) returned 1 [0076.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0076.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.812] lstrlenW (lpString=".doc") returned 4 [0076.812] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.812] lstrlenW (lpString=".docx") returned 5 [0076.812] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.812] lstrlenW (lpString=".pdf") returned 4 [0076.812] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.812] lstrlenW (lpString=".xls") returned 4 [0076.812] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.812] lstrlenW (lpString=".xlsx") returned 5 [0076.812] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.812] lstrlenW (lpString=".ppt") returned 4 [0076.812] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.812] lstrlenW (lpString=".zip") returned 4 [0076.813] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.813] lstrlenW (lpString=".rar") returned 4 [0076.813] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.813] lstrlenW (lpString=".bz2") returned 4 [0076.813] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.813] lstrlenW (lpString=".7z") returned 3 [0076.813] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.813] lstrlenW (lpString=".dbf") returned 4 [0076.813] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.813] lstrlenW (lpString=".1cd") returned 4 [0076.813] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0076.813] lstrlenW (lpString=".jpg") returned 4 [0076.813] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.813] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") [0076.930] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=533988) returned 1 [0076.930] CloseHandle (hObject=0x1fc) returned 1 [0076.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0076.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.931] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.931] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0076.932] GetLastError () returned 0x0 [0076.932] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x825e4, lpOverlapped=0x0) returned 1 [0076.987] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0076.998] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.998] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.998] SetEndOfFile (hFile=0x22c) returned 1 [0076.998] CloseHandle (hObject=0x22c) returned 1 [0076.998] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.998] SetEndOfFile (hFile=0x1fc) returned 1 [0077.004] CloseHandle (hObject=0x1fc) returned 1 [0077.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0077.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.026] lstrlenW (lpString=".doc") returned 4 [0077.026] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.026] lstrlenW (lpString=".docx") returned 5 [0077.026] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.027] lstrlenW (lpString=".pdf") returned 4 [0077.027] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString=".xls") returned 4 [0077.027] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString=".xlsx") returned 5 [0077.027] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.027] lstrlenW (lpString=".ppt") returned 4 [0077.027] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.027] lstrlenW (lpString=".zip") returned 4 [0077.027] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString=".rar") returned 4 [0077.027] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString=".bz2") returned 4 [0077.027] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString=".7z") returned 3 [0077.027] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.027] lstrlenW (lpString=".dbf") returned 4 [0077.027] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.027] lstrlenW (lpString=".1cd") returned 4 [0077.027] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0077.027] lstrlenW (lpString=".jpg") returned 4 [0077.027] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.027] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") [0077.221] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=18226) returned 1 [0077.221] CloseHandle (hObject=0x158) returned 1 [0077.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0077.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.222] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.222] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0077.222] GetLastError () returned 0x0 [0077.222] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4732, lpOverlapped=0x0) returned 1 [0077.227] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4740, lpOverlapped=0x0) returned 1 [0077.229] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0077.229] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.229] SetEndOfFile (hFile=0x22c) returned 1 [0077.229] CloseHandle (hObject=0x22c) returned 1 [0077.229] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.229] SetEndOfFile (hFile=0x158) returned 1 [0077.230] CloseHandle (hObject=0x158) returned 1 [0077.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0077.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.231] lstrlenW (lpString=".doc") returned 4 [0077.231] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".docx") returned 5 [0077.231] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.231] lstrlenW (lpString=".pdf") returned 4 [0077.231] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".xls") returned 4 [0077.231] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".xlsx") returned 5 [0077.231] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.231] lstrlenW (lpString=".ppt") returned 4 [0077.231] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.231] lstrlenW (lpString=".zip") returned 4 [0077.231] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".rar") returned 4 [0077.231] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".bz2") returned 4 [0077.231] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.231] lstrlenW (lpString=".7z") returned 3 [0077.231] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.232] lstrlenW (lpString=".dbf") returned 4 [0077.232] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.232] lstrlenW (lpString=".1cd") returned 4 [0077.232] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0077.232] lstrlenW (lpString=".jpg") returned 4 [0077.232] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.232] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") [0077.233] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=211090) returned 1 [0077.233] CloseHandle (hObject=0x190) returned 1 [0077.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0077.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0077.233] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.233] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0077.234] GetLastError () returned 0x0 [0077.234] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x33892, lpOverlapped=0x0) returned 1 [0077.245] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0077.470] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0077.470] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.470] SetEndOfFile (hFile=0x158) returned 1 [0077.619] CloseHandle (hObject=0x158) returned 1 [0077.619] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.619] SetEndOfFile (hFile=0x190) returned 1 [0077.621] CloseHandle (hObject=0x190) returned 1 [0077.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0077.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.622] lstrlenW (lpString=".doc") returned 4 [0077.622] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".docx") returned 5 [0077.622] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.622] lstrlenW (lpString=".pdf") returned 4 [0077.622] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".xls") returned 4 [0077.622] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".xlsx") returned 5 [0077.622] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.622] lstrlenW (lpString=".ppt") returned 4 [0077.622] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.622] lstrlenW (lpString=".zip") returned 4 [0077.622] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".rar") returned 4 [0077.622] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".bz2") returned 4 [0077.622] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString=".7z") returned 3 [0077.622] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.622] lstrlenW (lpString=".dbf") returned 4 [0077.622] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.622] lstrlenW (lpString=".1cd") returned 4 [0077.622] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0077.623] lstrlenW (lpString=".jpg") returned 4 [0077.623] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.623] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") [0077.633] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=32857) returned 1 [0077.633] CloseHandle (hObject=0x1f0) returned 1 [0077.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0077.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.633] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.633] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.634] GetLastError () returned 0x0 [0077.634] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x8059, lpOverlapped=0x0) returned 1 [0077.641] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x8060, lpOverlapped=0x0) returned 1 [0077.643] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0077.643] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.643] SetEndOfFile (hFile=0x15c) returned 1 [0077.643] CloseHandle (hObject=0x15c) returned 1 [0077.643] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.643] SetEndOfFile (hFile=0x1f0) returned 1 [0077.644] CloseHandle (hObject=0x1f0) returned 1 [0077.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.644] lstrlenW (lpString=".doc") returned 4 [0077.644] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.644] lstrlenW (lpString=".docx") returned 5 [0077.644] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.644] lstrlenW (lpString=".pdf") returned 4 [0077.644] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString=".xls") returned 4 [0077.645] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString=".xlsx") returned 5 [0077.645] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.645] lstrlenW (lpString=".ppt") returned 4 [0077.645] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.645] lstrlenW (lpString=".zip") returned 4 [0077.645] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString=".rar") returned 4 [0077.645] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString=".bz2") returned 4 [0077.645] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString=".7z") returned 3 [0077.645] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.645] lstrlenW (lpString=".dbf") returned 4 [0077.645] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.645] lstrlenW (lpString=".1cd") returned 4 [0077.645] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0077.645] lstrlenW (lpString=".jpg") returned 4 [0077.645] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.645] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") [0077.646] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=40941) returned 1 [0077.646] CloseHandle (hObject=0x1f0) returned 1 [0077.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0077.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.646] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.646] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.647] GetLastError () returned 0x0 [0077.647] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x9fed, lpOverlapped=0x0) returned 1 [0077.937] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0077.939] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0077.939] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0077.939] SetEndOfFile (hFile=0x15c) returned 1 [0078.127] CloseHandle (hObject=0x15c) returned 1 [0078.224] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0078.224] SetEndOfFile (hFile=0x1f0) returned 1 [0078.242] CloseHandle (hObject=0x1f0) returned 1 [0078.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.249] lstrlenW (lpString=".doc") returned 4 [0078.250] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".docx") returned 5 [0078.250] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0078.250] lstrlenW (lpString=".pdf") returned 4 [0078.250] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".xls") returned 4 [0078.250] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".xlsx") returned 5 [0078.250] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0078.250] lstrlenW (lpString=".ppt") returned 4 [0078.250] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.250] lstrlenW (lpString=".zip") returned 4 [0078.250] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".rar") returned 4 [0078.250] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".bz2") returned 4 [0078.250] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString=".7z") returned 3 [0078.250] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.250] lstrlenW (lpString=".dbf") returned 4 [0078.250] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.250] lstrlenW (lpString=".1cd") returned 4 [0078.250] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0078.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0078.250] lstrlenW (lpString=".jpg") returned 4 [0078.250] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0078.250] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") [0079.193] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=27789) returned 1 [0079.193] CloseHandle (hObject=0x1c8) returned 1 [0079.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0079.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.193] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.193] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.194] GetLastError () returned 0x0 [0079.194] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0079.197] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0079.198] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.198] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0079.198] SetEndOfFile (hFile=0x22c) returned 1 [0079.198] CloseHandle (hObject=0x22c) returned 1 [0079.198] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.198] SetEndOfFile (hFile=0x1c8) returned 1 [0079.199] CloseHandle (hObject=0x1c8) returned 1 [0079.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0079.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.200] lstrlenW (lpString=".doc") returned 4 [0079.200] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".docx") returned 5 [0079.200] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.200] lstrlenW (lpString=".pdf") returned 4 [0079.200] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".xls") returned 4 [0079.200] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".xlsx") returned 5 [0079.200] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.200] lstrlenW (lpString=".ppt") returned 4 [0079.200] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.200] lstrlenW (lpString=".zip") returned 4 [0079.200] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".rar") returned 4 [0079.200] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".bz2") returned 4 [0079.200] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.200] lstrlenW (lpString=".7z") returned 3 [0079.200] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.200] lstrlenW (lpString=".dbf") returned 4 [0079.200] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.201] lstrlenW (lpString=".1cd") returned 4 [0079.201] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0079.201] lstrlenW (lpString=".jpg") returned 4 [0079.201] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.201] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") [0079.202] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=129924) returned 1 [0079.202] CloseHandle (hObject=0x1c8) returned 1 [0079.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0079.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.202] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.202] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.203] GetLastError () returned 0x0 [0079.203] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0079.245] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0079.247] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.248] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.248] SetEndOfFile (hFile=0x22c) returned 1 [0079.248] CloseHandle (hObject=0x22c) returned 1 [0079.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.248] SetEndOfFile (hFile=0x1c8) returned 1 [0079.249] CloseHandle (hObject=0x1c8) returned 1 [0079.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0079.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.250] lstrlenW (lpString=".doc") returned 4 [0079.250] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.250] lstrlenW (lpString=".docx") returned 5 [0079.250] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.250] lstrlenW (lpString=".pdf") returned 4 [0079.250] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.250] lstrlenW (lpString=".xls") returned 4 [0079.250] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.250] lstrlenW (lpString=".xlsx") returned 5 [0079.250] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.250] lstrlenW (lpString=".ppt") returned 4 [0079.250] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.250] lstrlenW (lpString=".zip") returned 4 [0079.250] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.250] lstrlenW (lpString=".rar") returned 4 [0079.250] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.251] lstrlenW (lpString=".bz2") returned 4 [0079.251] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.251] lstrlenW (lpString=".7z") returned 3 [0079.251] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.251] lstrlenW (lpString=".dbf") returned 4 [0079.251] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.251] lstrlenW (lpString=".1cd") returned 4 [0079.251] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0079.251] lstrlenW (lpString=".jpg") returned 4 [0079.251] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.251] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") [0079.252] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=312400) returned 1 [0079.252] CloseHandle (hObject=0x1c8) returned 1 [0079.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0079.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.253] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.253] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.254] GetLastError () returned 0x0 [0079.254] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4c450, lpOverlapped=0x0) returned 1 [0079.261] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0079.267] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.267] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.267] SetEndOfFile (hFile=0x22c) returned 1 [0079.267] CloseHandle (hObject=0x22c) returned 1 [0079.267] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.267] SetEndOfFile (hFile=0x1c8) returned 1 [0079.270] CloseHandle (hObject=0x1c8) returned 1 [0079.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0079.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.271] lstrlenW (lpString=".doc") returned 4 [0079.271] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0079.271] lstrlenW (lpString=".docx") returned 5 [0079.271] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0079.271] lstrlenW (lpString=".pdf") returned 4 [0079.271] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0079.271] lstrlenW (lpString=".xls") returned 4 [0079.271] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0079.271] lstrlenW (lpString=".xlsx") returned 5 [0079.271] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0079.271] lstrlenW (lpString=".ppt") returned 4 [0079.271] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0079.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.271] lstrlenW (lpString=".zip") returned 4 [0079.271] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0079.271] lstrlenW (lpString=".rar") returned 4 [0079.271] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0079.272] lstrlenW (lpString=".bz2") returned 4 [0079.272] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0079.272] lstrlenW (lpString=".7z") returned 3 [0079.272] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0079.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.272] lstrlenW (lpString=".dbf") returned 4 [0079.272] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0079.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.272] lstrlenW (lpString=".1cd") returned 4 [0079.272] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0079.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0079.272] lstrlenW (lpString=".jpg") returned 4 [0079.272] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0079.272] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") [0079.272] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=15776) returned 1 [0079.273] CloseHandle (hObject=0x1c8) returned 1 [0079.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0079.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.273] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.273] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.274] GetLastError () returned 0x0 [0079.274] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3da0, lpOverlapped=0x0) returned 1 [0079.446] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0079.447] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.447] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.447] SetEndOfFile (hFile=0x22c) returned 1 [0079.447] CloseHandle (hObject=0x22c) returned 1 [0079.447] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.448] SetEndOfFile (hFile=0x1c8) returned 1 [0079.448] CloseHandle (hObject=0x1c8) returned 1 [0079.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 1 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.449] lstrlenW (lpString=".doc") returned 4 [0079.449] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString=".docx") returned 5 [0079.449] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0079.449] lstrlenW (lpString=".pdf") returned 4 [0079.449] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString=".xls") returned 4 [0079.449] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString=".xlsx") returned 5 [0079.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0079.449] lstrlenW (lpString=".ppt") returned 4 [0079.449] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.449] lstrlenW (lpString=".zip") returned 4 [0079.449] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString=".rar") returned 4 [0079.449] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.449] lstrlenW (lpString=".bz2") returned 4 [0079.449] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.449] lstrlenW (lpString=".7z") returned 3 [0079.450] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.450] lstrlenW (lpString=".dbf") returned 4 [0079.450] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.450] lstrlenW (lpString=".1cd") returned 4 [0079.450] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0079.450] lstrlenW (lpString=".jpg") returned 4 [0079.450] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.450] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") [0079.695] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=492624) returned 1 [0079.695] CloseHandle (hObject=0x190) returned 1 [0079.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0079.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.696] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.696] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.696] GetLastError () returned 0x0 [0079.696] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x78450, lpOverlapped=0x0) returned 1 [0079.707] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x78460, lpOverlapped=0x0) returned 1 [0079.716] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.716] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.717] SetEndOfFile (hFile=0x15c) returned 1 [0079.717] CloseHandle (hObject=0x15c) returned 1 [0079.717] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.717] SetEndOfFile (hFile=0x190) returned 1 [0079.721] CloseHandle (hObject=0x190) returned 1 [0079.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0079.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.721] lstrlenW (lpString=".doc") returned 4 [0079.721] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0079.721] lstrlenW (lpString=".docx") returned 5 [0079.722] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0079.722] lstrlenW (lpString=".pdf") returned 4 [0079.722] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0079.722] lstrlenW (lpString=".xls") returned 4 [0079.722] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0079.722] lstrlenW (lpString=".xlsx") returned 5 [0079.722] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0079.722] lstrlenW (lpString=".ppt") returned 4 [0079.722] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.722] lstrlenW (lpString=".zip") returned 4 [0079.722] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0079.722] lstrlenW (lpString=".rar") returned 4 [0079.722] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0079.722] lstrlenW (lpString=".bz2") returned 4 [0079.722] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0079.722] lstrlenW (lpString=".7z") returned 3 [0079.722] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.722] lstrlenW (lpString=".dbf") returned 4 [0079.722] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.722] lstrlenW (lpString=".1cd") returned 4 [0079.722] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0079.722] lstrlenW (lpString=".jpg") returned 4 [0079.722] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0079.722] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") [0079.756] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=343520) returned 1 [0079.756] CloseHandle (hObject=0x190) returned 1 [0079.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0079.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.757] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.757] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.856] GetLastError () returned 0x0 [0079.856] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x53de0, lpOverlapped=0x0) returned 1 [0079.892] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x53df0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x53df0, lpOverlapped=0x0) returned 1 [0079.898] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.898] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.898] SetEndOfFile (hFile=0x180) returned 1 [0079.899] CloseHandle (hObject=0x180) returned 1 [0079.899] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.899] SetEndOfFile (hFile=0x190) returned 1 [0079.902] CloseHandle (hObject=0x190) returned 1 [0079.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 1 [0079.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.902] lstrlenW (lpString=".doc") returned 4 [0079.902] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0079.902] lstrlenW (lpString=".docx") returned 5 [0079.902] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0079.902] lstrlenW (lpString=".pdf") returned 4 [0079.903] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0079.903] lstrlenW (lpString=".xls") returned 4 [0079.903] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0079.903] lstrlenW (lpString=".xlsx") returned 5 [0079.903] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0079.903] lstrlenW (lpString=".ppt") returned 4 [0079.903] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0079.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.903] lstrlenW (lpString=".zip") returned 4 [0079.903] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0079.903] lstrlenW (lpString=".rar") returned 4 [0079.903] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0079.903] lstrlenW (lpString=".bz2") returned 4 [0079.903] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0079.903] lstrlenW (lpString=".7z") returned 3 [0079.903] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0079.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.903] lstrlenW (lpString=".dbf") returned 4 [0079.903] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0079.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.903] lstrlenW (lpString=".1cd") returned 4 [0079.903] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0079.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0079.903] lstrlenW (lpString=".jpg") returned 4 [0079.903] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0079.903] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") [0079.905] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=35216) returned 1 [0079.905] CloseHandle (hObject=0x190) returned 1 [0079.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0079.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.905] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.905] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.906] GetLastError () returned 0x0 [0079.906] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x8990, lpOverlapped=0x0) returned 1 [0079.916] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x89a0, lpOverlapped=0x0) returned 1 [0079.917] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.917] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.917] SetEndOfFile (hFile=0x180) returned 1 [0079.917] CloseHandle (hObject=0x180) returned 1 [0079.918] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.918] SetEndOfFile (hFile=0x190) returned 1 [0079.919] CloseHandle (hObject=0x190) returned 1 [0079.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 1 [0079.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.919] lstrlenW (lpString=".doc") returned 4 [0079.919] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.919] lstrlenW (lpString=".docx") returned 5 [0079.919] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0079.919] lstrlenW (lpString=".pdf") returned 4 [0079.919] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.919] lstrlenW (lpString=".xls") returned 4 [0079.919] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.919] lstrlenW (lpString=".xlsx") returned 5 [0079.919] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0079.919] lstrlenW (lpString=".ppt") returned 4 [0079.919] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.919] lstrlenW (lpString=".zip") returned 4 [0079.919] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.919] lstrlenW (lpString=".rar") returned 4 [0079.919] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.920] lstrlenW (lpString=".bz2") returned 4 [0079.920] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.920] lstrlenW (lpString=".7z") returned 3 [0079.920] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.920] lstrlenW (lpString=".dbf") returned 4 [0079.920] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.920] lstrlenW (lpString=".1cd") returned 4 [0079.920] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0079.920] lstrlenW (lpString=".jpg") returned 4 [0079.920] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.920] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") [0079.921] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=16256) returned 1 [0079.921] CloseHandle (hObject=0x190) returned 1 [0079.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0079.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.922] GetLastError () returned 0x0 [0079.922] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3f80, lpOverlapped=0x0) returned 1 [0079.924] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3f90, lpOverlapped=0x0) returned 1 [0079.925] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.925] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0079.925] SetEndOfFile (hFile=0x180) returned 1 [0079.925] CloseHandle (hObject=0x180) returned 1 [0079.925] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.925] SetEndOfFile (hFile=0x190) returned 1 [0079.926] CloseHandle (hObject=0x190) returned 1 [0079.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 1 [0079.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.926] lstrlenW (lpString=".doc") returned 4 [0079.926] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString=".docx") returned 5 [0079.927] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0079.927] lstrlenW (lpString=".pdf") returned 4 [0079.927] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString=".xls") returned 4 [0079.927] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString=".xlsx") returned 5 [0079.927] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0079.927] lstrlenW (lpString=".ppt") returned 4 [0079.927] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.927] lstrlenW (lpString=".zip") returned 4 [0079.927] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString=".rar") returned 4 [0079.927] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.927] lstrlenW (lpString=".bz2") returned 4 [0079.927] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.927] lstrlenW (lpString=".7z") returned 3 [0079.927] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.927] lstrlenW (lpString=".dbf") returned 4 [0079.927] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.927] lstrlenW (lpString=".1cd") returned 4 [0079.927] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0079.927] lstrlenW (lpString=".jpg") returned 4 [0079.927] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.927] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") [0079.928] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4710) returned 1 [0079.929] CloseHandle (hObject=0x190) returned 1 [0079.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0079.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.929] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.929] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.929] GetLastError () returned 0x0 [0080.017] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1266, lpOverlapped=0x0) returned 1 [0080.018] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1270, lpOverlapped=0x0) returned 1 [0080.019] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0080.019] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0080.019] SetEndOfFile (hFile=0x180) returned 1 [0080.019] CloseHandle (hObject=0x180) returned 1 [0080.019] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.020] SetEndOfFile (hFile=0x190) returned 1 [0080.020] CloseHandle (hObject=0x190) returned 1 [0080.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0080.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.021] lstrlenW (lpString=".doc") returned 4 [0080.021] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0080.021] lstrlenW (lpString=".docx") returned 5 [0080.021] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0080.021] lstrlenW (lpString=".pdf") returned 4 [0080.021] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0080.021] lstrlenW (lpString=".xls") returned 4 [0080.021] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0080.021] lstrlenW (lpString=".xlsx") returned 5 [0080.021] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0080.021] lstrlenW (lpString=".ppt") returned 4 [0080.021] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0080.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.021] lstrlenW (lpString=".zip") returned 4 [0080.021] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0080.021] lstrlenW (lpString=".rar") returned 4 [0080.021] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0080.021] lstrlenW (lpString=".bz2") returned 4 [0080.021] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0080.021] lstrlenW (lpString=".7z") returned 3 [0080.021] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0080.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.021] lstrlenW (lpString=".dbf") returned 4 [0080.022] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0080.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.022] lstrlenW (lpString=".1cd") returned 4 [0080.022] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0080.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0080.023] lstrlenW (lpString=".jpg") returned 4 [0080.023] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0080.023] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") [0080.073] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1723) returned 1 [0080.073] CloseHandle (hObject=0x190) returned 1 [0080.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0080.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0080.080] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.081] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.979] GetLastError () returned 0x0 [0080.979] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6bb, lpOverlapped=0x0) returned 1 [0080.980] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0080.981] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0080.981] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0080.981] SetEndOfFile (hFile=0x22c) returned 1 [0080.982] CloseHandle (hObject=0x22c) returned 1 [0080.982] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.982] SetEndOfFile (hFile=0x190) returned 1 [0080.982] CloseHandle (hObject=0x190) returned 1 [0080.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1 [0080.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.983] lstrlenW (lpString=".doc") returned 4 [0080.983] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0080.983] lstrlenW (lpString=".docx") returned 5 [0080.983] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0080.983] lstrlenW (lpString=".pdf") returned 4 [0080.983] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0080.983] lstrlenW (lpString=".xls") returned 4 [0080.983] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0080.983] lstrlenW (lpString=".xlsx") returned 5 [0080.983] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0080.983] lstrlenW (lpString=".ppt") returned 4 [0080.983] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0080.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.983] lstrlenW (lpString=".zip") returned 4 [0080.983] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0080.983] lstrlenW (lpString=".rar") returned 4 [0080.983] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0080.983] lstrlenW (lpString=".bz2") returned 4 [0080.983] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0080.983] lstrlenW (lpString=".7z") returned 3 [0080.983] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0080.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.984] lstrlenW (lpString=".dbf") returned 4 [0080.984] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0080.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.984] lstrlenW (lpString=".1cd") returned 4 [0080.984] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0080.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0080.984] lstrlenW (lpString=".jpg") returned 4 [0080.984] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0080.984] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") [0080.985] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=641) returned 1 [0080.985] CloseHandle (hObject=0x190) returned 1 [0080.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0080.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0080.985] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.985] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.986] GetLastError () returned 0x0 [0080.986] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x281, lpOverlapped=0x0) returned 1 [0080.988] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x290, lpOverlapped=0x0) returned 1 [0080.989] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0080.989] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf6, lpOverlapped=0x0) returned 1 [0080.989] SetEndOfFile (hFile=0x22c) returned 1 [0080.989] CloseHandle (hObject=0x22c) returned 1 [0080.989] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.989] SetEndOfFile (hFile=0x190) returned 1 [0080.990] CloseHandle (hObject=0x190) returned 1 [0080.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.991] lstrlenW (lpString=".doc") returned 4 [0080.991] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0080.991] lstrlenW (lpString=".docx") returned 5 [0080.991] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0080.991] lstrlenW (lpString=".pdf") returned 4 [0080.991] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0080.991] lstrlenW (lpString=".xls") returned 4 [0080.991] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0080.991] lstrlenW (lpString=".xlsx") returned 5 [0080.991] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0080.991] lstrlenW (lpString=".ppt") returned 4 [0080.991] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.991] lstrlenW (lpString=".zip") returned 4 [0080.991] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0080.991] lstrlenW (lpString=".rar") returned 4 [0080.991] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0080.991] lstrlenW (lpString=".bz2") returned 4 [0080.991] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0080.991] lstrlenW (lpString=".7z") returned 3 [0080.991] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.991] lstrlenW (lpString=".dbf") returned 4 [0080.991] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0080.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.992] lstrlenW (lpString=".1cd") returned 4 [0080.992] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0080.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0080.992] lstrlenW (lpString=".jpg") returned 4 [0080.992] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0080.992] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") [0080.992] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=209) returned 1 [0080.992] CloseHandle (hObject=0x190) returned 1 [0080.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0080.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0080.993] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.993] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.993] GetLastError () returned 0x0 [0080.993] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd1, lpOverlapped=0x0) returned 1 [0080.994] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0080.995] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0080.995] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf6, lpOverlapped=0x0) returned 1 [0080.995] SetEndOfFile (hFile=0x22c) returned 1 [0080.995] CloseHandle (hObject=0x22c) returned 1 [0080.995] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.995] SetEndOfFile (hFile=0x190) returned 1 [0080.996] CloseHandle (hObject=0x190) returned 1 [0080.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0080.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.997] lstrlenW (lpString=".doc") returned 4 [0080.997] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0080.997] lstrlenW (lpString=".docx") returned 5 [0080.997] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0080.997] lstrlenW (lpString=".pdf") returned 4 [0080.997] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0080.997] lstrlenW (lpString=".xls") returned 4 [0080.997] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0080.997] lstrlenW (lpString=".xlsx") returned 5 [0080.997] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0080.997] lstrlenW (lpString=".ppt") returned 4 [0080.997] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.997] lstrlenW (lpString=".zip") returned 4 [0080.997] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0080.997] lstrlenW (lpString=".rar") returned 4 [0080.997] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0080.997] lstrlenW (lpString=".bz2") returned 4 [0080.997] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0080.997] lstrlenW (lpString=".7z") returned 3 [0080.997] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.997] lstrlenW (lpString=".dbf") returned 4 [0080.997] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.997] lstrlenW (lpString=".1cd") returned 4 [0080.997] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0080.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0080.998] lstrlenW (lpString=".jpg") returned 4 [0080.998] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0080.998] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") [0080.998] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0080.998] CloseHandle (hObject=0x190) returned 1 [0080.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0080.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0080.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0080.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.999] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0080.999] GetLastError () returned 0x0 [0080.999] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0081.000] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0081.001] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0081.001] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0081.001] SetEndOfFile (hFile=0x22c) returned 1 [0081.001] CloseHandle (hObject=0x22c) returned 1 [0081.001] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.001] SetEndOfFile (hFile=0x190) returned 1 [0081.002] CloseHandle (hObject=0x190) returned 1 [0081.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.003] lstrlenW (lpString=".doc") returned 4 [0081.003] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0081.003] lstrlenW (lpString=".docx") returned 5 [0081.003] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0081.003] lstrlenW (lpString=".pdf") returned 4 [0081.003] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0081.003] lstrlenW (lpString=".xls") returned 4 [0081.003] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0081.003] lstrlenW (lpString=".xlsx") returned 5 [0081.003] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0081.003] lstrlenW (lpString=".ppt") returned 4 [0081.003] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.003] lstrlenW (lpString=".zip") returned 4 [0081.003] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0081.003] lstrlenW (lpString=".rar") returned 4 [0081.003] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0081.003] lstrlenW (lpString=".bz2") returned 4 [0081.003] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0081.003] lstrlenW (lpString=".7z") returned 3 [0081.003] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.003] lstrlenW (lpString=".dbf") returned 4 [0081.003] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.003] lstrlenW (lpString=".1cd") returned 4 [0081.003] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0081.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0081.004] lstrlenW (lpString=".jpg") returned 4 [0081.004] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0081.004] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") [0081.004] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0081.004] CloseHandle (hObject=0x190) returned 1 [0081.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0081.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0081.004] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.004] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0081.005] GetLastError () returned 0x0 [0081.005] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0081.006] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0081.007] ReadFile (in: hFile=0x190, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0081.007] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0081.007] SetEndOfFile (hFile=0x22c) returned 1 [0081.007] CloseHandle (hObject=0x22c) returned 1 [0081.007] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.007] SetEndOfFile (hFile=0x190) returned 1 [0081.008] CloseHandle (hObject=0x190) returned 1 [0081.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1 [0081.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.008] lstrlenW (lpString=".doc") returned 4 [0081.008] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0081.008] lstrlenW (lpString=".docx") returned 5 [0081.009] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0081.009] lstrlenW (lpString=".pdf") returned 4 [0081.009] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0081.009] lstrlenW (lpString=".xls") returned 4 [0081.009] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0081.009] lstrlenW (lpString=".xlsx") returned 5 [0081.009] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0081.009] lstrlenW (lpString=".ppt") returned 4 [0081.009] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0081.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.009] lstrlenW (lpString=".zip") returned 4 [0081.009] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0081.009] lstrlenW (lpString=".rar") returned 4 [0081.009] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0081.009] lstrlenW (lpString=".bz2") returned 4 [0081.009] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0081.009] lstrlenW (lpString=".7z") returned 3 [0081.009] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0081.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.009] lstrlenW (lpString=".dbf") returned 4 [0081.009] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0081.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.009] lstrlenW (lpString=".1cd") returned 4 [0081.009] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0081.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0081.009] lstrlenW (lpString=".jpg") returned 4 [0081.009] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0081.009] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") [0081.012] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7827686) returned 1 [0081.012] CloseHandle (hObject=0x190) returned 1 [0081.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0081.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0081.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0081.013] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0081.013] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0081.013] ReadFile (in: hFile=0x190, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.081] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x27d04c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0081.082] ReadFile (in: hFile=0x190, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x7370e6, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0081.088] ReadFile (in: hFile=0x190, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.126] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.126] WriteFile (in: hFile=0x190, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0081.153] SetEndOfFile (hFile=0x190) returned 1 [0082.195] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0082.195] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0082.195] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.196] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x27d04c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0082.196] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.198] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x7370e6, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0082.198] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.205] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0082.205] CloseHandle (hObject=0x190) returned 1 [0082.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.225] lstrlenW (lpString=".doc") returned 4 [0082.225] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0082.225] lstrlenW (lpString=".docx") returned 5 [0082.232] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0082.232] lstrlenW (lpString=".pdf") returned 4 [0082.232] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0082.232] lstrlenW (lpString=".xls") returned 4 [0082.239] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0082.239] lstrlenW (lpString=".xlsx") returned 5 [0082.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0082.240] lstrlenW (lpString=".ppt") returned 4 [0082.240] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0082.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.240] lstrlenW (lpString=".zip") returned 4 [0082.240] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0082.240] lstrlenW (lpString=".rar") returned 4 [0082.240] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0082.240] lstrlenW (lpString=".bz2") returned 4 [0082.240] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0082.254] lstrlenW (lpString=".7z") returned 3 [0082.254] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0082.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.254] lstrlenW (lpString=".dbf") returned 4 [0082.254] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0082.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.254] lstrlenW (lpString=".1cd") returned 4 [0082.254] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0082.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0082.254] lstrlenW (lpString=".jpg") returned 4 [0082.254] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0082.254] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") [0082.255] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=186880) returned 1 [0082.255] CloseHandle (hObject=0x210) returned 1 [0082.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0082.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.255] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.256] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.256] GetLastError () returned 0x0 [0082.256] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2da00, lpOverlapped=0x0) returned 1 [0082.262] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2da10, lpOverlapped=0x0) returned 1 [0082.266] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.266] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.266] SetEndOfFile (hFile=0x150) returned 1 [0082.266] CloseHandle (hObject=0x150) returned 1 [0082.266] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.266] SetEndOfFile (hFile=0x210) returned 1 [0082.268] CloseHandle (hObject=0x210) returned 1 [0082.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1 [0082.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.269] lstrlenW (lpString=".doc") returned 4 [0082.269] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0082.269] lstrlenW (lpString=".docx") returned 5 [0082.269] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0082.269] lstrlenW (lpString=".pdf") returned 4 [0082.269] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0082.269] lstrlenW (lpString=".xls") returned 4 [0082.269] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0082.269] lstrlenW (lpString=".xlsx") returned 5 [0082.269] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0082.269] lstrlenW (lpString=".ppt") returned 4 [0082.269] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0082.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.269] lstrlenW (lpString=".zip") returned 4 [0082.269] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0082.269] lstrlenW (lpString=".rar") returned 4 [0082.269] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0082.269] lstrlenW (lpString=".bz2") returned 4 [0082.269] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0082.269] lstrlenW (lpString=".7z") returned 3 [0082.272] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0082.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.272] lstrlenW (lpString=".dbf") returned 4 [0082.272] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0082.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.272] lstrlenW (lpString=".1cd") returned 4 [0082.272] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0082.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0082.272] lstrlenW (lpString=".jpg") returned 4 [0082.272] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0082.273] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") [0082.273] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=610086) returned 1 [0082.273] CloseHandle (hObject=0x210) returned 1 [0082.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0082.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.274] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.274] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.274] GetLastError () returned 0x0 [0082.274] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x94f26, lpOverlapped=0x0) returned 1 [0082.302] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x94f30, lpOverlapped=0x0) returned 1 [0082.313] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.313] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.314] SetEndOfFile (hFile=0x150) returned 1 [0082.314] CloseHandle (hObject=0x150) returned 1 [0082.314] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.314] SetEndOfFile (hFile=0x210) returned 1 [0082.319] CloseHandle (hObject=0x210) returned 1 [0082.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.320] lstrlenW (lpString=".doc") returned 4 [0082.320] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0082.320] lstrlenW (lpString=".docx") returned 5 [0082.320] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0082.320] lstrlenW (lpString=".pdf") returned 4 [0082.320] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0082.320] lstrlenW (lpString=".xls") returned 4 [0082.320] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0082.320] lstrlenW (lpString=".xlsx") returned 5 [0082.320] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0082.320] lstrlenW (lpString=".ppt") returned 4 [0082.320] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.320] lstrlenW (lpString=".zip") returned 4 [0082.320] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0082.320] lstrlenW (lpString=".rar") returned 4 [0082.320] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0082.320] lstrlenW (lpString=".bz2") returned 4 [0082.320] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0082.320] lstrlenW (lpString=".7z") returned 3 [0082.320] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.320] lstrlenW (lpString=".dbf") returned 4 [0082.320] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.320] lstrlenW (lpString=".1cd") returned 4 [0082.320] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0082.321] lstrlenW (lpString=".jpg") returned 4 [0082.321] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0082.321] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") [0082.322] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=621) returned 1 [0082.322] CloseHandle (hObject=0x210) returned 1 [0082.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0082.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.322] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.322] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.323] GetLastError () returned 0x0 [0082.323] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x26d, lpOverlapped=0x0) returned 1 [0082.325] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x270, lpOverlapped=0x0) returned 1 [0082.326] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.326] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.326] SetEndOfFile (hFile=0x150) returned 1 [0082.326] CloseHandle (hObject=0x150) returned 1 [0082.326] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.326] SetEndOfFile (hFile=0x210) returned 1 [0082.327] CloseHandle (hObject=0x210) returned 1 [0082.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1 [0082.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.328] lstrlenW (lpString=".doc") returned 4 [0082.328] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0082.328] lstrlenW (lpString=".docx") returned 5 [0082.328] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0082.328] lstrlenW (lpString=".pdf") returned 4 [0082.328] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0082.328] lstrlenW (lpString=".xls") returned 4 [0082.328] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0082.328] lstrlenW (lpString=".xlsx") returned 5 [0082.328] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0082.328] lstrlenW (lpString=".ppt") returned 4 [0082.328] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0082.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.328] lstrlenW (lpString=".zip") returned 4 [0082.328] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0082.328] lstrlenW (lpString=".rar") returned 4 [0082.328] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0082.328] lstrlenW (lpString=".bz2") returned 4 [0082.328] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0082.328] lstrlenW (lpString=".7z") returned 3 [0082.328] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0082.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.328] lstrlenW (lpString=".dbf") returned 4 [0082.328] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0082.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.328] lstrlenW (lpString=".1cd") returned 4 [0082.328] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0082.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0082.328] lstrlenW (lpString=".jpg") returned 4 [0082.328] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0082.328] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") [0082.329] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0082.329] CloseHandle (hObject=0x210) returned 1 [0082.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0082.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.330] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.330] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.330] GetLastError () returned 0x0 [0082.330] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0082.331] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0082.332] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.332] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0082.332] SetEndOfFile (hFile=0x150) returned 1 [0082.333] CloseHandle (hObject=0x150) returned 1 [0082.333] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.333] SetEndOfFile (hFile=0x210) returned 1 [0082.333] CloseHandle (hObject=0x210) returned 1 [0082.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1 [0082.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.334] lstrlenW (lpString=".doc") returned 4 [0082.334] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0082.334] lstrlenW (lpString=".docx") returned 5 [0082.334] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0082.334] lstrlenW (lpString=".pdf") returned 4 [0082.334] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0082.334] lstrlenW (lpString=".xls") returned 4 [0082.334] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0082.334] lstrlenW (lpString=".xlsx") returned 5 [0082.334] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0082.334] lstrlenW (lpString=".ppt") returned 4 [0082.334] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0082.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.334] lstrlenW (lpString=".zip") returned 4 [0082.334] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0082.334] lstrlenW (lpString=".rar") returned 4 [0082.334] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0082.334] lstrlenW (lpString=".bz2") returned 4 [0082.334] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0082.334] lstrlenW (lpString=".7z") returned 3 [0082.334] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0082.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.335] lstrlenW (lpString=".dbf") returned 4 [0082.335] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.335] lstrlenW (lpString=".1cd") returned 4 [0082.335] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0082.335] lstrlenW (lpString=".jpg") returned 4 [0082.335] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0082.335] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") [0082.335] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0082.335] CloseHandle (hObject=0x210) returned 1 [0082.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0082.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.336] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.336] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.336] GetLastError () returned 0x0 [0082.336] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0082.337] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0082.338] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.338] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0082.338] SetEndOfFile (hFile=0x150) returned 1 [0082.339] CloseHandle (hObject=0x150) returned 1 [0082.339] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.339] SetEndOfFile (hFile=0x210) returned 1 [0082.339] CloseHandle (hObject=0x210) returned 1 [0082.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.340] lstrlenW (lpString=".doc") returned 4 [0082.340] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0082.340] lstrlenW (lpString=".docx") returned 5 [0082.340] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0082.340] lstrlenW (lpString=".pdf") returned 4 [0082.340] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0082.340] lstrlenW (lpString=".xls") returned 4 [0082.340] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0082.340] lstrlenW (lpString=".xlsx") returned 5 [0082.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0082.340] lstrlenW (lpString=".ppt") returned 4 [0082.340] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.340] lstrlenW (lpString=".zip") returned 4 [0082.340] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0082.340] lstrlenW (lpString=".rar") returned 4 [0082.340] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0082.340] lstrlenW (lpString=".bz2") returned 4 [0082.340] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0082.340] lstrlenW (lpString=".7z") returned 3 [0082.340] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.340] lstrlenW (lpString=".dbf") returned 4 [0082.340] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0082.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.341] lstrlenW (lpString=".1cd") returned 4 [0082.341] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0082.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0082.341] lstrlenW (lpString=".jpg") returned 4 [0082.341] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0082.341] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") [0082.342] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=208256) returned 1 [0082.342] CloseHandle (hObject=0x210) returned 1 [0082.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20 [0082.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.342] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.342] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.343] GetLastError () returned 0x0 [0082.343] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x32d80, lpOverlapped=0x0) returned 1 [0082.348] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x32d90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x32d90, lpOverlapped=0x0) returned 1 [0082.352] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.352] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.352] SetEndOfFile (hFile=0x150) returned 1 [0082.352] CloseHandle (hObject=0x150) returned 1 [0082.352] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.352] SetEndOfFile (hFile=0x210) returned 1 [0082.354] CloseHandle (hObject=0x210) returned 1 [0082.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 1 [0082.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.355] lstrlenW (lpString=".doc") returned 4 [0082.355] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString=".docx") returned 5 [0082.355] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0082.355] lstrlenW (lpString=".pdf") returned 4 [0082.355] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString=".xls") returned 4 [0082.355] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString=".xlsx") returned 5 [0082.355] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0082.355] lstrlenW (lpString=".ppt") returned 4 [0082.355] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.355] lstrlenW (lpString=".zip") returned 4 [0082.355] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString=".rar") returned 4 [0082.355] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0082.355] lstrlenW (lpString=".bz2") returned 4 [0082.355] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0082.355] lstrlenW (lpString=".7z") returned 3 [0082.355] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.356] lstrlenW (lpString=".dbf") returned 4 [0082.356] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0082.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.356] lstrlenW (lpString=".1cd") returned 4 [0082.356] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0082.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0082.356] lstrlenW (lpString=".jpg") returned 4 [0082.356] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0082.356] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") [0082.356] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=37760) returned 1 [0082.356] CloseHandle (hObject=0x210) returned 1 [0082.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0082.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.357] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.357] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.357] GetLastError () returned 0x0 [0082.357] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x9380, lpOverlapped=0x0) returned 1 [0082.360] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x9390, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.361] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0082.361] SetEndOfFile (hFile=0x150) returned 1 [0082.361] CloseHandle (hObject=0x150) returned 1 [0082.361] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.361] SetEndOfFile (hFile=0x210) returned 1 [0082.362] CloseHandle (hObject=0x210) returned 1 [0082.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1 [0082.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.363] lstrlenW (lpString=".doc") returned 4 [0082.363] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0082.363] lstrlenW (lpString=".docx") returned 5 [0082.363] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0082.363] lstrlenW (lpString=".pdf") returned 4 [0082.363] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0082.363] lstrlenW (lpString=".xls") returned 4 [0082.363] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0082.363] lstrlenW (lpString=".xlsx") returned 5 [0082.363] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0082.363] lstrlenW (lpString=".ppt") returned 4 [0082.363] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0082.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.363] lstrlenW (lpString=".zip") returned 4 [0082.363] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".rar") returned 4 [0082.364] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".bz2") returned 4 [0082.364] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".7z") returned 3 [0082.364] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.364] lstrlenW (lpString=".dbf") returned 4 [0082.364] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.364] lstrlenW (lpString=".1cd") returned 4 [0082.364] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.364] lstrlenW (lpString=".jpg") returned 4 [0082.364] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".docx") returned 5 [0082.364] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0082.364] lstrlenW (lpString=".pdf") returned 4 [0082.364] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".xls") returned 4 [0082.364] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".xlsx") returned 5 [0082.364] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0082.364] lstrlenW (lpString=".ppt") returned 4 [0082.364] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.364] lstrlenW (lpString=".zip") returned 4 [0082.364] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".rar") returned 4 [0082.364] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0082.364] lstrlenW (lpString=".bz2") returned 4 [0082.364] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0082.365] lstrlenW (lpString=".7z") returned 3 [0082.365] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.365] lstrlenW (lpString=".dbf") returned 4 [0082.365] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0082.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.365] lstrlenW (lpString=".1cd") returned 4 [0082.365] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0082.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0082.365] lstrlenW (lpString=".jpg") returned 4 [0082.365] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0082.365] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") [0082.366] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=100224) returned 1 [0082.366] CloseHandle (hObject=0x210) returned 1 [0082.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0082.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.366] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.366] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.367] GetLastError () returned 0x0 [0082.367] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x18780, lpOverlapped=0x0) returned 1 [0082.371] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x18790, lpOverlapped=0x0) returned 1 [0082.373] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.373] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0082.373] SetEndOfFile (hFile=0x150) returned 1 [0082.373] CloseHandle (hObject=0x150) returned 1 [0082.373] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.373] SetEndOfFile (hFile=0x210) returned 1 [0082.375] CloseHandle (hObject=0x210) returned 1 [0082.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1 [0082.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.375] lstrlenW (lpString=".doc") returned 4 [0082.375] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0082.375] lstrlenW (lpString=".docx") returned 5 [0082.375] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0082.375] lstrlenW (lpString=".pdf") returned 4 [0082.375] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0082.375] lstrlenW (lpString=".xls") returned 4 [0082.375] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0082.375] lstrlenW (lpString=".xlsx") returned 5 [0082.375] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0082.375] lstrlenW (lpString=".ppt") returned 4 [0082.375] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0082.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.375] lstrlenW (lpString=".zip") returned 4 [0082.375] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0082.375] lstrlenW (lpString=".rar") returned 4 [0082.376] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".bz2") returned 4 [0082.376] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".7z") returned 3 [0082.376] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.376] lstrlenW (lpString=".dbf") returned 4 [0082.376] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.376] lstrlenW (lpString=".1cd") returned 4 [0082.376] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.376] lstrlenW (lpString=".jpg") returned 4 [0082.376] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".docx") returned 5 [0082.376] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0082.376] lstrlenW (lpString=".pdf") returned 4 [0082.376] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".xls") returned 4 [0082.376] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".xlsx") returned 5 [0082.376] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0082.376] lstrlenW (lpString=".ppt") returned 4 [0082.376] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.376] lstrlenW (lpString=".zip") returned 4 [0082.376] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".rar") returned 4 [0082.376] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".bz2") returned 4 [0082.376] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0082.376] lstrlenW (lpString=".7z") returned 3 [0082.376] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.377] lstrlenW (lpString=".dbf") returned 4 [0082.377] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0082.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.377] lstrlenW (lpString=".1cd") returned 4 [0082.377] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0082.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0082.377] lstrlenW (lpString=".jpg") returned 4 [0082.377] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0082.377] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") [0082.378] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12672) returned 1 [0082.378] CloseHandle (hObject=0x210) returned 1 [0082.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20 [0082.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.378] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.378] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.412] GetLastError () returned 0x0 [0082.412] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3180, lpOverlapped=0x0) returned 1 [0082.414] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3190, lpOverlapped=0x0) returned 1 [0082.415] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.415] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.415] SetEndOfFile (hFile=0x150) returned 1 [0082.420] CloseHandle (hObject=0x150) returned 1 [0082.420] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.420] SetEndOfFile (hFile=0x210) returned 1 [0082.420] CloseHandle (hObject=0x210) returned 1 [0082.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 1 [0082.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.421] lstrlenW (lpString=".doc") returned 4 [0082.421] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0082.421] lstrlenW (lpString=".docx") returned 5 [0082.421] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0082.421] lstrlenW (lpString=".pdf") returned 4 [0082.421] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0082.421] lstrlenW (lpString=".xls") returned 4 [0082.421] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0082.421] lstrlenW (lpString=".xlsx") returned 5 [0082.421] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0082.421] lstrlenW (lpString=".ppt") returned 4 [0082.421] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0082.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.421] lstrlenW (lpString=".zip") returned 4 [0082.422] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0082.422] lstrlenW (lpString=".rar") returned 4 [0082.422] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0082.422] lstrlenW (lpString=".bz2") returned 4 [0082.422] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0082.422] lstrlenW (lpString=".7z") returned 3 [0082.422] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0082.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.422] lstrlenW (lpString=".dbf") returned 4 [0082.422] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0082.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.422] lstrlenW (lpString=".1cd") returned 4 [0082.422] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0082.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0082.422] lstrlenW (lpString=".jpg") returned 4 [0082.422] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0082.422] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") [0082.423] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=8794976) returned 1 [0082.423] CloseHandle (hObject=0x210) returned 1 [0082.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20 [0082.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0082.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 1 [0082.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.425] lstrlenW (lpString=".doc") returned 4 [0082.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString=".docx") returned 5 [0082.425] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0082.425] lstrlenW (lpString=".pdf") returned 4 [0082.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString=".xls") returned 4 [0082.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString=".xlsx") returned 5 [0082.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0082.425] lstrlenW (lpString=".ppt") returned 4 [0082.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.425] lstrlenW (lpString=".zip") returned 4 [0082.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString=".rar") returned 4 [0082.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.425] lstrlenW (lpString=".bz2") returned 4 [0082.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.425] lstrlenW (lpString=".7z") returned 3 [0082.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.426] lstrlenW (lpString=".dbf") returned 4 [0082.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.426] lstrlenW (lpString=".1cd") returned 4 [0082.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0082.426] lstrlenW (lpString=".jpg") returned 4 [0082.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.426] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") [0082.427] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=626) returned 1 [0082.427] CloseHandle (hObject=0x210) returned 1 [0082.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0082.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.427] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.427] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.428] GetLastError () returned 0x0 [0082.428] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x272, lpOverlapped=0x0) returned 1 [0082.429] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x280, lpOverlapped=0x0) returned 1 [0082.430] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0082.431] SetEndOfFile (hFile=0x150) returned 1 [0082.431] CloseHandle (hObject=0x150) returned 1 [0082.431] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.431] SetEndOfFile (hFile=0x210) returned 1 [0082.434] CloseHandle (hObject=0x210) returned 1 [0082.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1 [0082.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.434] lstrlenW (lpString=".doc") returned 4 [0082.434] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0082.434] lstrlenW (lpString=".docx") returned 5 [0082.434] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0082.434] lstrlenW (lpString=".pdf") returned 4 [0082.434] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0082.434] lstrlenW (lpString=".xls") returned 4 [0082.434] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0082.434] lstrlenW (lpString=".xlsx") returned 5 [0082.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0082.435] lstrlenW (lpString=".ppt") returned 4 [0082.435] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0082.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.435] lstrlenW (lpString=".zip") returned 4 [0082.435] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0082.435] lstrlenW (lpString=".rar") returned 4 [0082.435] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0082.435] lstrlenW (lpString=".bz2") returned 4 [0082.435] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0082.435] lstrlenW (lpString=".7z") returned 3 [0082.435] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0082.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.435] lstrlenW (lpString=".dbf") returned 4 [0082.435] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0082.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.435] lstrlenW (lpString=".1cd") returned 4 [0082.435] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0082.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0082.435] lstrlenW (lpString=".jpg") returned 4 [0082.435] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0082.435] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") [0082.436] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=218) returned 1 [0082.436] CloseHandle (hObject=0x210) returned 1 [0082.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0082.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.436] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.436] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.437] GetLastError () returned 0x0 [0082.437] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xda, lpOverlapped=0x0) returned 1 [0082.438] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0082.438] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.438] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0082.439] SetEndOfFile (hFile=0x150) returned 1 [0082.439] CloseHandle (hObject=0x150) returned 1 [0082.439] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.439] SetEndOfFile (hFile=0x210) returned 1 [0082.440] CloseHandle (hObject=0x210) returned 1 [0082.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1 [0082.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.440] lstrlenW (lpString=".doc") returned 4 [0082.440] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0082.440] lstrlenW (lpString=".docx") returned 5 [0082.440] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0082.440] lstrlenW (lpString=".pdf") returned 4 [0082.440] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0082.440] lstrlenW (lpString=".xls") returned 4 [0082.440] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0082.440] lstrlenW (lpString=".xlsx") returned 5 [0082.440] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0082.440] lstrlenW (lpString=".ppt") returned 4 [0082.440] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0082.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.440] lstrlenW (lpString=".zip") returned 4 [0082.440] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0082.440] lstrlenW (lpString=".rar") returned 4 [0082.440] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0082.440] lstrlenW (lpString=".bz2") returned 4 [0082.441] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0082.441] lstrlenW (lpString=".7z") returned 3 [0082.441] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0082.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.441] lstrlenW (lpString=".dbf") returned 4 [0082.441] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0082.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.441] lstrlenW (lpString=".1cd") returned 4 [0082.441] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0082.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0082.441] lstrlenW (lpString=".jpg") returned 4 [0082.441] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0082.441] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") [0082.441] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=111) returned 1 [0082.441] CloseHandle (hObject=0x210) returned 1 [0082.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0082.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.442] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.442] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.442] GetLastError () returned 0x0 [0082.442] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6f, lpOverlapped=0x0) returned 1 [0082.443] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x70, lpOverlapped=0x0) returned 1 [0082.444] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.444] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0082.444] SetEndOfFile (hFile=0x150) returned 1 [0082.444] CloseHandle (hObject=0x150) returned 1 [0082.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.445] SetEndOfFile (hFile=0x210) returned 1 [0082.445] CloseHandle (hObject=0x210) returned 1 [0082.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1 [0082.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.446] lstrlenW (lpString=".doc") returned 4 [0082.446] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0082.446] lstrlenW (lpString=".docx") returned 5 [0082.446] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0082.446] lstrlenW (lpString=".pdf") returned 4 [0082.446] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0082.446] lstrlenW (lpString=".xls") returned 4 [0082.446] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0082.446] lstrlenW (lpString=".xlsx") returned 5 [0082.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0082.446] lstrlenW (lpString=".ppt") returned 4 [0082.446] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0082.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.446] lstrlenW (lpString=".zip") returned 4 [0082.446] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0082.446] lstrlenW (lpString=".rar") returned 4 [0082.446] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0082.446] lstrlenW (lpString=".bz2") returned 4 [0082.446] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0082.446] lstrlenW (lpString=".7z") returned 3 [0082.446] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0082.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.446] lstrlenW (lpString=".dbf") returned 4 [0082.446] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0082.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.446] lstrlenW (lpString=".1cd") returned 4 [0082.447] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0082.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0082.447] lstrlenW (lpString=".jpg") returned 4 [0082.447] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0082.447] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") [0082.447] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=110) returned 1 [0082.447] CloseHandle (hObject=0x210) returned 1 [0082.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0082.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.448] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.448] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.448] GetLastError () returned 0x0 [0082.448] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6e, lpOverlapped=0x0) returned 1 [0082.449] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x70, lpOverlapped=0x0) returned 1 [0082.450] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.450] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0082.450] SetEndOfFile (hFile=0x150) returned 1 [0082.450] CloseHandle (hObject=0x150) returned 1 [0082.450] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.450] SetEndOfFile (hFile=0x210) returned 1 [0082.451] CloseHandle (hObject=0x210) returned 1 [0082.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString=".doc") returned 4 [0082.452] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0082.452] lstrlenW (lpString=".docx") returned 5 [0082.452] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0082.452] lstrlenW (lpString=".pdf") returned 4 [0082.452] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0082.452] lstrlenW (lpString=".xls") returned 4 [0082.452] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0082.452] lstrlenW (lpString=".xlsx") returned 5 [0082.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0082.452] lstrlenW (lpString=".ppt") returned 4 [0082.452] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString=".zip") returned 4 [0082.452] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0082.452] lstrlenW (lpString=".rar") returned 4 [0082.452] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0082.452] lstrlenW (lpString=".bz2") returned 4 [0082.452] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0082.452] lstrlenW (lpString=".7z") returned 3 [0082.452] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString=".dbf") returned 4 [0082.452] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString=".1cd") returned 4 [0082.452] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0082.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0082.452] lstrlenW (lpString=".jpg") returned 4 [0082.452] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0082.453] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") [0082.646] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36200) returned 1 [0082.648] CloseHandle (hObject=0x210) returned 1 [0082.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0082.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.690] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.698] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.739] GetLastError () returned 0x0 [0082.739] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x8d68, lpOverlapped=0x0) returned 1 [0082.755] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x8d70, lpOverlapped=0x0) returned 1 [0082.757] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.757] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0082.757] SetEndOfFile (hFile=0x150) returned 1 [0082.757] CloseHandle (hObject=0x150) returned 1 [0082.757] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.757] SetEndOfFile (hFile=0x210) returned 1 [0082.758] CloseHandle (hObject=0x210) returned 1 [0082.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1 [0082.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.759] lstrlenW (lpString=".doc") returned 4 [0082.759] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString=".docx") returned 5 [0082.759] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0082.759] lstrlenW (lpString=".pdf") returned 4 [0082.759] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString=".xls") returned 4 [0082.759] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0082.759] lstrlenW (lpString=".xlsx") returned 5 [0082.759] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0082.759] lstrlenW (lpString=".ppt") returned 4 [0082.759] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.759] lstrlenW (lpString=".zip") returned 4 [0082.759] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0082.759] lstrlenW (lpString=".rar") returned 4 [0082.759] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString=".bz2") returned 4 [0082.759] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString=".7z") returned 3 [0082.759] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0082.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.759] lstrlenW (lpString=".dbf") returned 4 [0082.759] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0082.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.759] lstrlenW (lpString=".1cd") returned 4 [0082.759] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0082.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0082.760] lstrlenW (lpString=".jpg") returned 4 [0082.760] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0082.760] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") [0082.761] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1919) returned 1 [0082.761] CloseHandle (hObject=0x210) returned 1 [0082.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0082.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.762] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.762] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0082.762] GetLastError () returned 0x0 [0082.762] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x77f, lpOverlapped=0x0) returned 1 [0082.764] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x780, lpOverlapped=0x0) returned 1 [0082.765] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0082.765] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.765] SetEndOfFile (hFile=0x150) returned 1 [0082.765] CloseHandle (hObject=0x150) returned 1 [0082.765] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.765] SetEndOfFile (hFile=0x210) returned 1 [0082.766] CloseHandle (hObject=0x210) returned 1 [0082.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1 [0082.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.766] lstrlenW (lpString=".doc") returned 4 [0082.766] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0082.766] lstrlenW (lpString=".docx") returned 5 [0082.766] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0082.766] lstrlenW (lpString=".pdf") returned 4 [0082.767] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString=".xls") returned 4 [0082.767] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0082.767] lstrlenW (lpString=".xlsx") returned 5 [0082.767] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0082.767] lstrlenW (lpString=".ppt") returned 4 [0082.767] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.767] lstrlenW (lpString=".zip") returned 4 [0082.767] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0082.767] lstrlenW (lpString=".rar") returned 4 [0082.767] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString=".bz2") returned 4 [0082.767] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString=".7z") returned 3 [0082.767] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0082.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.767] lstrlenW (lpString=".dbf") returned 4 [0082.767] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.767] lstrlenW (lpString=".1cd") returned 4 [0082.767] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0082.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0082.767] lstrlenW (lpString=".jpg") returned 4 [0082.767] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0082.767] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") [0082.768] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1309) returned 1 [0082.768] CloseHandle (hObject=0x210) returned 1 [0082.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0082.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.768] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.768] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.188] GetLastError () returned 0x0 [0083.188] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x51d, lpOverlapped=0x0) returned 1 [0083.190] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x520, lpOverlapped=0x0) returned 1 [0083.191] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0083.191] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.191] SetEndOfFile (hFile=0x150) returned 1 [0083.192] CloseHandle (hObject=0x150) returned 1 [0083.192] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.192] SetEndOfFile (hFile=0x210) returned 1 [0083.193] CloseHandle (hObject=0x210) returned 1 [0083.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.194] lstrlenW (lpString=".doc") returned 4 [0083.194] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString=".docx") returned 5 [0083.194] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0083.194] lstrlenW (lpString=".pdf") returned 4 [0083.194] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString=".xls") returned 4 [0083.194] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0083.194] lstrlenW (lpString=".xlsx") returned 5 [0083.194] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0083.194] lstrlenW (lpString=".ppt") returned 4 [0083.194] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.194] lstrlenW (lpString=".zip") returned 4 [0083.194] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0083.194] lstrlenW (lpString=".rar") returned 4 [0083.194] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString=".bz2") returned 4 [0083.194] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString=".7z") returned 3 [0083.194] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.194] lstrlenW (lpString=".dbf") returned 4 [0083.194] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.194] lstrlenW (lpString=".1cd") returned 4 [0083.194] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0083.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0083.195] lstrlenW (lpString=".jpg") returned 4 [0083.195] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0083.195] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") [0083.195] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1527046) returned 1 [0083.196] CloseHandle (hObject=0x210) returned 1 [0083.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0083.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.196] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.196] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0083.197] GetLastError () returned 0x0 [0083.197] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0083.220] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0083.367] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x74d16, lpOverlapped=0x0) returned 1 [0083.384] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x74d20, lpOverlapped=0x0) returned 1 [0083.434] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0083.434] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.434] SetEndOfFile (hFile=0x150) returned 1 [0083.435] CloseHandle (hObject=0x150) returned 1 [0083.435] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.435] SetEndOfFile (hFile=0x210) returned 1 [0083.439] CloseHandle (hObject=0x210) returned 1 [0083.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1 [0083.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.439] lstrlenW (lpString=".doc") returned 4 [0083.439] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0083.439] lstrlenW (lpString=".docx") returned 5 [0083.439] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0083.439] lstrlenW (lpString=".pdf") returned 4 [0083.439] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0083.439] lstrlenW (lpString=".xls") returned 4 [0083.439] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0083.439] lstrlenW (lpString=".xlsx") returned 5 [0083.439] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0083.610] lstrlenW (lpString=".ppt") returned 4 [0083.610] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0083.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.610] lstrlenW (lpString=".zip") returned 4 [0083.610] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0083.610] lstrlenW (lpString=".rar") returned 4 [0083.610] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0083.610] lstrlenW (lpString=".bz2") returned 4 [0083.610] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0083.610] lstrlenW (lpString=".7z") returned 3 [0083.610] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0083.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.610] lstrlenW (lpString=".dbf") returned 4 [0083.611] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0083.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.611] lstrlenW (lpString=".1cd") returned 4 [0083.611] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0083.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0083.611] lstrlenW (lpString=".jpg") returned 4 [0083.614] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0083.615] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") [0083.812] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1124720) returned 1 [0083.812] CloseHandle (hObject=0x1fc) returned 1 [0083.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20 [0083.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0083.813] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.813] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0083.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0083.814] GetLastError () returned 0x0 [0083.814] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0083.836] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0083.855] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x12980, lpOverlapped=0x0) returned 1 [0083.906] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x12990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x12990, lpOverlapped=0x0) returned 1 [0083.910] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0083.910] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.911] SetEndOfFile (hFile=0x1c0) returned 1 [0084.067] CloseHandle (hObject=0x1c0) returned 1 [0084.067] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.067] SetEndOfFile (hFile=0x1fc) returned 1 [0084.080] CloseHandle (hObject=0x1fc) returned 1 [0084.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 1 [0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.302] lstrlenW (lpString=".doc") returned 4 [0084.302] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString=".docx") returned 5 [0084.302] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0084.302] lstrlenW (lpString=".pdf") returned 4 [0084.302] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString=".xls") returned 4 [0084.302] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString=".xlsx") returned 5 [0084.302] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0084.302] lstrlenW (lpString=".ppt") returned 4 [0084.302] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.302] lstrlenW (lpString=".zip") returned 4 [0084.302] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString=".rar") returned 4 [0084.302] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0084.302] lstrlenW (lpString=".bz2") returned 4 [0084.302] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0084.302] lstrlenW (lpString=".7z") returned 3 [0084.302] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.303] lstrlenW (lpString=".dbf") returned 4 [0084.303] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.303] lstrlenW (lpString=".1cd") returned 4 [0084.303] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0084.303] lstrlenW (lpString=".jpg") returned 4 [0084.303] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0084.303] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") [0084.304] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=446312) returned 1 [0084.304] CloseHandle (hObject=0x1fc) returned 1 [0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20 [0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.305] GetLastError () returned 0x0 [0084.305] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6cf68, lpOverlapped=0x0) returned 1 [0084.314] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6cf70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6cf70, lpOverlapped=0x0) returned 1 [0084.322] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0084.322] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0084.322] SetEndOfFile (hFile=0x1f0) returned 1 [0084.322] CloseHandle (hObject=0x1f0) returned 1 [0084.322] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.322] SetEndOfFile (hFile=0x1fc) returned 1 [0084.326] CloseHandle (hObject=0x1fc) returned 1 [0084.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 1 [0084.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.327] lstrlenW (lpString=".doc") returned 4 [0084.327] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString=".docx") returned 5 [0084.327] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0084.327] lstrlenW (lpString=".pdf") returned 4 [0084.327] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString=".xls") returned 4 [0084.327] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString=".xlsx") returned 5 [0084.327] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0084.327] lstrlenW (lpString=".ppt") returned 4 [0084.327] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.327] lstrlenW (lpString=".zip") returned 4 [0084.327] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString=".rar") returned 4 [0084.327] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0084.327] lstrlenW (lpString=".bz2") returned 4 [0084.327] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0084.327] lstrlenW (lpString=".7z") returned 3 [0084.327] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.327] lstrlenW (lpString=".dbf") returned 4 [0084.327] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0084.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.328] lstrlenW (lpString=".1cd") returned 4 [0084.328] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0084.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0084.328] lstrlenW (lpString=".jpg") returned 4 [0084.328] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0084.328] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") [0084.328] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=39808) returned 1 [0084.328] CloseHandle (hObject=0x1fc) returned 1 [0084.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 0x20 [0084.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.330] GetLastError () returned 0x0 [0084.330] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x9b80, lpOverlapped=0x0) returned 1 [0084.332] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x9b90, lpOverlapped=0x0) returned 1 [0084.333] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0084.333] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0084.334] SetEndOfFile (hFile=0x1f0) returned 1 [0084.334] CloseHandle (hObject=0x1f0) returned 1 [0084.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.334] SetEndOfFile (hFile=0x1fc) returned 1 [0084.335] CloseHandle (hObject=0x1fc) returned 1 [0084.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1 [0084.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.335] lstrlenW (lpString=".doc") returned 4 [0084.335] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0084.335] lstrlenW (lpString=".docx") returned 5 [0084.335] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0084.335] lstrlenW (lpString=".pdf") returned 4 [0084.335] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0084.335] lstrlenW (lpString=".xls") returned 4 [0084.335] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".xlsx") returned 5 [0084.336] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0084.336] lstrlenW (lpString=".ppt") returned 4 [0084.336] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.336] lstrlenW (lpString=".zip") returned 4 [0084.336] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".rar") returned 4 [0084.336] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".bz2") returned 4 [0084.336] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".7z") returned 3 [0084.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.336] lstrlenW (lpString=".dbf") returned 4 [0084.336] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.336] lstrlenW (lpString=".1cd") returned 4 [0084.336] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.336] lstrlenW (lpString=".jpg") returned 4 [0084.336] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".docx") returned 5 [0084.336] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0084.336] lstrlenW (lpString=".pdf") returned 4 [0084.336] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".xls") returned 4 [0084.336] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0084.336] lstrlenW (lpString=".xlsx") returned 5 [0084.336] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0084.336] lstrlenW (lpString=".ppt") returned 4 [0084.336] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.337] lstrlenW (lpString=".zip") returned 4 [0084.337] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString=".rar") returned 4 [0084.337] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString=".bz2") returned 4 [0084.337] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString=".7z") returned 3 [0084.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0084.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.337] lstrlenW (lpString=".dbf") returned 4 [0084.337] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.337] lstrlenW (lpString=".1cd") returned 4 [0084.337] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0084.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0084.337] lstrlenW (lpString=".jpg") returned 4 [0084.337] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0084.337] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") [0085.013] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1420) returned 1 [0085.013] CloseHandle (hObject=0x1c0) returned 1 [0085.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20 [0085.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.014] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.014] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0085.014] GetLastError () returned 0x0 [0085.014] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x58c, lpOverlapped=0x0) returned 1 [0085.030] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x590, lpOverlapped=0x0) returned 1 [0085.037] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.037] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0085.038] SetEndOfFile (hFile=0x150) returned 1 [0085.038] CloseHandle (hObject=0x150) returned 1 [0085.038] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.038] SetEndOfFile (hFile=0x1c0) returned 1 [0085.039] CloseHandle (hObject=0x1c0) returned 1 [0085.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1 [0085.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.039] lstrlenW (lpString=".doc") returned 4 [0085.039] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0085.039] lstrlenW (lpString=".docx") returned 5 [0085.039] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0085.039] lstrlenW (lpString=".pdf") returned 4 [0085.039] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0085.039] lstrlenW (lpString=".xls") returned 4 [0085.039] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0085.039] lstrlenW (lpString=".xlsx") returned 5 [0085.039] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0085.039] lstrlenW (lpString=".ppt") returned 4 [0085.039] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0085.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.039] lstrlenW (lpString=".zip") returned 4 [0085.039] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0085.039] lstrlenW (lpString=".rar") returned 4 [0085.039] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0085.040] lstrlenW (lpString=".bz2") returned 4 [0085.040] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0085.040] lstrlenW (lpString=".7z") returned 3 [0085.040] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0085.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.040] lstrlenW (lpString=".dbf") returned 4 [0085.040] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0085.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.040] lstrlenW (lpString=".1cd") returned 4 [0085.040] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0085.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0085.040] lstrlenW (lpString=".jpg") returned 4 [0085.040] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0085.040] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") [0085.040] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=212) returned 1 [0085.041] CloseHandle (hObject=0x1c0) returned 1 [0085.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20 [0085.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.041] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.041] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0085.041] GetLastError () returned 0x0 [0085.041] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd4, lpOverlapped=0x0) returned 1 [0085.042] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0085.043] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.043] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0085.043] SetEndOfFile (hFile=0x150) returned 1 [0085.044] CloseHandle (hObject=0x150) returned 1 [0085.044] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.044] SetEndOfFile (hFile=0x1c0) returned 1 [0085.044] CloseHandle (hObject=0x1c0) returned 1 [0085.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1 [0085.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.045] lstrlenW (lpString=".doc") returned 4 [0085.045] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0085.045] lstrlenW (lpString=".docx") returned 5 [0085.045] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0085.045] lstrlenW (lpString=".pdf") returned 4 [0085.045] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0085.045] lstrlenW (lpString=".xls") returned 4 [0085.045] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0085.045] lstrlenW (lpString=".xlsx") returned 5 [0085.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0085.045] lstrlenW (lpString=".ppt") returned 4 [0085.045] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0085.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.045] lstrlenW (lpString=".zip") returned 4 [0085.045] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0085.045] lstrlenW (lpString=".rar") returned 4 [0085.045] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0085.045] lstrlenW (lpString=".bz2") returned 4 [0085.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0085.045] lstrlenW (lpString=".7z") returned 3 [0085.045] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0085.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.045] lstrlenW (lpString=".dbf") returned 4 [0085.045] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0085.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.046] lstrlenW (lpString=".1cd") returned 4 [0085.046] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0085.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0085.046] lstrlenW (lpString=".jpg") returned 4 [0085.046] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0085.046] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") [0085.047] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0085.047] CloseHandle (hObject=0x1c0) returned 1 [0085.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0085.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.047] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.047] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0085.048] GetLastError () returned 0x0 [0085.048] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0085.049] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.050] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.050] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x100, lpOverlapped=0x0) returned 1 [0085.050] SetEndOfFile (hFile=0x150) returned 1 [0085.050] CloseHandle (hObject=0x150) returned 1 [0085.050] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.050] SetEndOfFile (hFile=0x1c0) returned 1 [0085.051] CloseHandle (hObject=0x1c0) returned 1 [0085.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1 [0085.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString=".doc") returned 4 [0085.052] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.052] lstrlenW (lpString=".docx") returned 5 [0085.052] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.052] lstrlenW (lpString=".pdf") returned 4 [0085.052] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.052] lstrlenW (lpString=".xls") returned 4 [0085.052] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.052] lstrlenW (lpString=".xlsx") returned 5 [0085.052] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.052] lstrlenW (lpString=".ppt") returned 4 [0085.052] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString=".zip") returned 4 [0085.052] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.052] lstrlenW (lpString=".rar") returned 4 [0085.052] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.052] lstrlenW (lpString=".bz2") returned 4 [0085.052] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.052] lstrlenW (lpString=".7z") returned 3 [0085.052] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString=".dbf") returned 4 [0085.052] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString=".1cd") returned 4 [0085.052] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0085.052] lstrlenW (lpString=".jpg") returned 4 [0085.052] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.052] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") [0085.053] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0085.053] CloseHandle (hObject=0x1c0) returned 1 [0085.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0085.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.053] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.053] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0085.054] GetLastError () returned 0x0 [0085.054] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0085.055] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.056] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.056] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x100, lpOverlapped=0x0) returned 1 [0085.056] SetEndOfFile (hFile=0x150) returned 1 [0085.056] CloseHandle (hObject=0x150) returned 1 [0085.056] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.056] SetEndOfFile (hFile=0x1c0) returned 1 [0085.057] CloseHandle (hObject=0x1c0) returned 1 [0085.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1 [0085.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.057] lstrlenW (lpString=".doc") returned 4 [0085.057] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.057] lstrlenW (lpString=".docx") returned 5 [0085.057] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.057] lstrlenW (lpString=".pdf") returned 4 [0085.057] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.058] lstrlenW (lpString=".xls") returned 4 [0085.058] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.058] lstrlenW (lpString=".xlsx") returned 5 [0085.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.058] lstrlenW (lpString=".ppt") returned 4 [0085.058] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.058] lstrlenW (lpString=".zip") returned 4 [0085.058] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.058] lstrlenW (lpString=".rar") returned 4 [0085.058] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.058] lstrlenW (lpString=".bz2") returned 4 [0085.058] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.058] lstrlenW (lpString=".7z") returned 3 [0085.058] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.058] lstrlenW (lpString=".dbf") returned 4 [0085.058] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.058] lstrlenW (lpString=".1cd") returned 4 [0085.058] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0085.058] lstrlenW (lpString=".jpg") returned 4 [0085.058] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.058] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") [0085.059] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3877906) returned 1 [0085.059] CloseHandle (hObject=0x1c0) returned 1 [0085.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20 [0085.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0085.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.060] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0085.060] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0085.060] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.066] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x13b95b, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0085.066] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.085] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.086] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x372c12, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0085.086] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.102] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.102] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0085.123] SetEndOfFile (hFile=0x1c0) returned 1 [0085.123] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0085.123] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0085.123] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.345] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x13b95b, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0085.345] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.349] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x372c12, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0085.349] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.351] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0085.355] CloseHandle (hObject=0x1c0) returned 1 [0085.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.355] lstrlenW (lpString=".doc") returned 4 [0085.355] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.355] lstrlenW (lpString=".docx") returned 5 [0085.355] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0085.355] lstrlenW (lpString=".pdf") returned 4 [0085.355] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.355] lstrlenW (lpString=".xls") returned 4 [0085.355] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.355] lstrlenW (lpString=".xlsx") returned 5 [0085.355] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0085.355] lstrlenW (lpString=".ppt") returned 4 [0085.355] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.356] lstrlenW (lpString=".zip") returned 4 [0085.356] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.356] lstrlenW (lpString=".rar") returned 4 [0085.356] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.356] lstrlenW (lpString=".bz2") returned 4 [0085.356] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.356] lstrlenW (lpString=".7z") returned 3 [0085.356] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.356] lstrlenW (lpString=".dbf") returned 4 [0085.356] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.356] lstrlenW (lpString=".1cd") returned 4 [0085.356] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0085.356] lstrlenW (lpString=".jpg") returned 4 [0085.356] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.356] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") [0085.357] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=621) returned 1 [0085.357] CloseHandle (hObject=0x1c0) returned 1 [0085.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20 [0085.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.357] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.357] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.359] GetLastError () returned 0x0 [0085.359] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x26d, lpOverlapped=0x0) returned 1 [0085.404] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x270, lpOverlapped=0x0) returned 1 [0085.405] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.405] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0085.405] SetEndOfFile (hFile=0x15c) returned 1 [0085.405] CloseHandle (hObject=0x15c) returned 1 [0085.405] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.405] SetEndOfFile (hFile=0x1c0) returned 1 [0085.406] CloseHandle (hObject=0x1c0) returned 1 [0085.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1 [0085.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.406] lstrlenW (lpString=".doc") returned 4 [0085.406] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.406] lstrlenW (lpString=".docx") returned 5 [0085.406] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.407] lstrlenW (lpString=".pdf") returned 4 [0085.407] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.407] lstrlenW (lpString=".xls") returned 4 [0085.407] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.407] lstrlenW (lpString=".xlsx") returned 5 [0085.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.407] lstrlenW (lpString=".ppt") returned 4 [0085.407] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.407] lstrlenW (lpString=".zip") returned 4 [0085.407] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.407] lstrlenW (lpString=".rar") returned 4 [0085.407] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.407] lstrlenW (lpString=".bz2") returned 4 [0085.407] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.407] lstrlenW (lpString=".7z") returned 3 [0085.407] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.407] lstrlenW (lpString=".dbf") returned 4 [0085.407] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.407] lstrlenW (lpString=".1cd") returned 4 [0085.407] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0085.407] lstrlenW (lpString=".jpg") returned 4 [0085.407] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.407] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") [0085.408] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=209) returned 1 [0085.408] CloseHandle (hObject=0x1c0) returned 1 [0085.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20 [0085.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.408] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.408] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.409] GetLastError () returned 0x0 [0085.409] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd1, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0085.411] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf6, lpOverlapped=0x0) returned 1 [0085.411] SetEndOfFile (hFile=0x15c) returned 1 [0085.411] CloseHandle (hObject=0x15c) returned 1 [0085.411] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.411] SetEndOfFile (hFile=0x1c0) returned 1 [0085.412] CloseHandle (hObject=0x1c0) returned 1 [0085.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1 [0085.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.412] lstrlenW (lpString=".doc") returned 4 [0085.412] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0085.412] lstrlenW (lpString=".docx") returned 5 [0085.412] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0085.412] lstrlenW (lpString=".pdf") returned 4 [0085.412] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0085.412] lstrlenW (lpString=".xls") returned 4 [0085.412] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0085.412] lstrlenW (lpString=".xlsx") returned 5 [0085.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0085.413] lstrlenW (lpString=".ppt") returned 4 [0085.413] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0085.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.413] lstrlenW (lpString=".zip") returned 4 [0085.413] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0085.413] lstrlenW (lpString=".rar") returned 4 [0085.413] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0085.413] lstrlenW (lpString=".bz2") returned 4 [0085.413] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0085.413] lstrlenW (lpString=".7z") returned 3 [0085.413] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0085.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.413] lstrlenW (lpString=".dbf") returned 4 [0085.413] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0085.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.413] lstrlenW (lpString=".1cd") returned 4 [0085.413] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0085.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0085.413] lstrlenW (lpString=".jpg") returned 4 [0085.413] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0085.413] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") [0085.414] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0085.414] CloseHandle (hObject=0x1c0) returned 1 [0085.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20 [0085.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.414] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.414] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.415] GetLastError () returned 0x0 [0085.415] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.416] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0085.417] SetEndOfFile (hFile=0x15c) returned 1 [0085.417] CloseHandle (hObject=0x15c) returned 1 [0085.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.417] SetEndOfFile (hFile=0x1c0) returned 1 [0085.417] CloseHandle (hObject=0x1c0) returned 1 [0085.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1 [0085.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.418] lstrlenW (lpString=".doc") returned 4 [0085.418] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.418] lstrlenW (lpString=".docx") returned 5 [0085.418] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.418] lstrlenW (lpString=".pdf") returned 4 [0085.418] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.418] lstrlenW (lpString=".xls") returned 4 [0085.418] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.418] lstrlenW (lpString=".xlsx") returned 5 [0085.418] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.418] lstrlenW (lpString=".ppt") returned 4 [0085.418] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.418] lstrlenW (lpString=".zip") returned 4 [0085.418] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.418] lstrlenW (lpString=".rar") returned 4 [0085.418] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.418] lstrlenW (lpString=".bz2") returned 4 [0085.418] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.418] lstrlenW (lpString=".7z") returned 3 [0085.418] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.419] lstrlenW (lpString=".dbf") returned 4 [0085.419] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.419] lstrlenW (lpString=".1cd") returned 4 [0085.419] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0085.419] lstrlenW (lpString=".jpg") returned 4 [0085.419] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.419] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") [0085.419] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0085.419] CloseHandle (hObject=0x1c0) returned 1 [0085.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20 [0085.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.420] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.420] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.420] GetLastError () returned 0x0 [0085.420] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0085.613] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.623] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.623] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0085.623] SetEndOfFile (hFile=0x15c) returned 1 [0085.623] CloseHandle (hObject=0x15c) returned 1 [0085.623] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.623] SetEndOfFile (hFile=0x1c0) returned 1 [0085.624] CloseHandle (hObject=0x1c0) returned 1 [0085.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1 [0085.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.772] lstrlenW (lpString=".doc") returned 4 [0085.772] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.772] lstrlenW (lpString=".docx") returned 5 [0085.772] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.772] lstrlenW (lpString=".pdf") returned 4 [0085.772] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.772] lstrlenW (lpString=".xls") returned 4 [0085.772] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.772] lstrlenW (lpString=".xlsx") returned 5 [0085.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.773] lstrlenW (lpString=".ppt") returned 4 [0085.773] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.773] lstrlenW (lpString=".zip") returned 4 [0085.773] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.773] lstrlenW (lpString=".rar") returned 4 [0085.773] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.773] lstrlenW (lpString=".bz2") returned 4 [0085.773] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.773] lstrlenW (lpString=".7z") returned 3 [0085.773] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.773] lstrlenW (lpString=".dbf") returned 4 [0085.773] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.773] lstrlenW (lpString=".1cd") returned 4 [0085.773] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0085.773] lstrlenW (lpString=".jpg") returned 4 [0085.773] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.773] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") [0086.478] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=205) returned 1 [0086.479] CloseHandle (hObject=0x1c0) returned 1 [0086.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20 [0086.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0086.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0086.956] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0086.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0087.218] GetLastError () returned 0x0 [0087.218] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xcd, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd0, lpOverlapped=0x0) returned 1 [0087.220] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0087.220] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0087.220] SetEndOfFile (hFile=0x1ec) returned 1 [0087.220] CloseHandle (hObject=0x1ec) returned 1 [0087.220] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0087.220] SetEndOfFile (hFile=0x180) returned 1 [0087.221] CloseHandle (hObject=0x180) returned 1 [0087.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString=".doc") returned 4 [0087.222] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0087.222] lstrlenW (lpString=".docx") returned 5 [0087.222] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0087.222] lstrlenW (lpString=".pdf") returned 4 [0087.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0087.222] lstrlenW (lpString=".xls") returned 4 [0087.222] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0087.222] lstrlenW (lpString=".xlsx") returned 5 [0087.222] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0087.222] lstrlenW (lpString=".ppt") returned 4 [0087.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString=".zip") returned 4 [0087.222] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0087.222] lstrlenW (lpString=".rar") returned 4 [0087.222] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0087.222] lstrlenW (lpString=".bz2") returned 4 [0087.222] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0087.222] lstrlenW (lpString=".7z") returned 3 [0087.222] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString=".dbf") returned 4 [0087.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString=".1cd") returned 4 [0087.222] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0087.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0087.222] lstrlenW (lpString=".jpg") returned 4 [0087.222] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0087.223] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") [0088.204] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1608) returned 1 [0088.204] CloseHandle (hObject=0x1c0) returned 1 [0088.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20 [0088.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.498] GetLastError () returned 0x0 [0088.498] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x648, lpOverlapped=0x0) returned 1 [0088.541] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x650, lpOverlapped=0x0) returned 1 [0088.542] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.542] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0088.542] SetEndOfFile (hFile=0x16c) returned 1 [0088.542] CloseHandle (hObject=0x16c) returned 1 [0088.543] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.543] SetEndOfFile (hFile=0x1fc) returned 1 [0088.543] CloseHandle (hObject=0x1fc) returned 1 [0088.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1 [0088.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.544] lstrlenW (lpString=".doc") returned 4 [0088.544] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0088.544] lstrlenW (lpString=".docx") returned 5 [0088.544] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0088.544] lstrlenW (lpString=".pdf") returned 4 [0088.544] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0088.544] lstrlenW (lpString=".xls") returned 4 [0088.544] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0088.544] lstrlenW (lpString=".xlsx") returned 5 [0088.544] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0088.544] lstrlenW (lpString=".ppt") returned 4 [0088.544] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0088.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.544] lstrlenW (lpString=".zip") returned 4 [0088.544] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0088.544] lstrlenW (lpString=".rar") returned 4 [0088.544] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0088.544] lstrlenW (lpString=".bz2") returned 4 [0088.544] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0088.544] lstrlenW (lpString=".7z") returned 3 [0088.544] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0088.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.544] lstrlenW (lpString=".dbf") returned 4 [0088.544] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0088.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.545] lstrlenW (lpString=".1cd") returned 4 [0088.545] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0088.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0088.545] lstrlenW (lpString=".jpg") returned 4 [0088.545] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0088.545] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") [0088.546] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=651) returned 1 [0088.546] CloseHandle (hObject=0x1fc) returned 1 [0088.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 0x20 [0088.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.547] GetLastError () returned 0x0 [0088.547] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x28b, lpOverlapped=0x0) returned 1 [0088.549] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x290, lpOverlapped=0x0) returned 1 [0088.549] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.549] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0088.550] SetEndOfFile (hFile=0x16c) returned 1 [0088.550] CloseHandle (hObject=0x16c) returned 1 [0088.550] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.550] SetEndOfFile (hFile=0x1fc) returned 1 [0088.551] CloseHandle (hObject=0x1fc) returned 1 [0088.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1 [0088.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.551] lstrlenW (lpString=".doc") returned 4 [0088.551] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0088.551] lstrlenW (lpString=".docx") returned 5 [0088.551] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0088.551] lstrlenW (lpString=".pdf") returned 4 [0088.551] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0088.551] lstrlenW (lpString=".xls") returned 4 [0088.551] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0088.551] lstrlenW (lpString=".xlsx") returned 5 [0088.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0088.551] lstrlenW (lpString=".ppt") returned 4 [0088.551] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0088.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.551] lstrlenW (lpString=".zip") returned 4 [0088.551] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0088.551] lstrlenW (lpString=".rar") returned 4 [0088.551] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0088.551] lstrlenW (lpString=".bz2") returned 4 [0088.552] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0088.552] lstrlenW (lpString=".7z") returned 3 [0088.552] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0088.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.552] lstrlenW (lpString=".dbf") returned 4 [0088.552] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0088.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.552] lstrlenW (lpString=".1cd") returned 4 [0088.552] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0088.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0088.552] lstrlenW (lpString=".jpg") returned 4 [0088.552] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0088.552] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") [0088.552] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=211) returned 1 [0088.553] CloseHandle (hObject=0x1fc) returned 1 [0088.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20 [0088.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.553] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.553] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.554] GetLastError () returned 0x0 [0088.554] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd3, lpOverlapped=0x0) returned 1 [0088.554] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0088.555] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.555] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0088.555] SetEndOfFile (hFile=0x16c) returned 1 [0088.556] CloseHandle (hObject=0x16c) returned 1 [0088.556] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.556] SetEndOfFile (hFile=0x1fc) returned 1 [0088.557] CloseHandle (hObject=0x1fc) returned 1 [0088.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1 [0088.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.557] lstrlenW (lpString=".doc") returned 4 [0088.557] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0088.557] lstrlenW (lpString=".docx") returned 5 [0088.557] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0088.557] lstrlenW (lpString=".pdf") returned 4 [0088.557] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0088.557] lstrlenW (lpString=".xls") returned 4 [0088.557] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0088.557] lstrlenW (lpString=".xlsx") returned 5 [0088.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0088.557] lstrlenW (lpString=".ppt") returned 4 [0088.557] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0088.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.557] lstrlenW (lpString=".zip") returned 4 [0088.558] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0088.558] lstrlenW (lpString=".rar") returned 4 [0088.558] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0088.558] lstrlenW (lpString=".bz2") returned 4 [0088.558] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0088.558] lstrlenW (lpString=".7z") returned 3 [0088.558] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0088.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.558] lstrlenW (lpString=".dbf") returned 4 [0088.558] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0088.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.558] lstrlenW (lpString=".1cd") returned 4 [0088.558] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0088.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0088.558] lstrlenW (lpString=".jpg") returned 4 [0088.558] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0088.558] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") [0088.558] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0088.559] CloseHandle (hObject=0x1fc) returned 1 [0088.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20 [0088.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.559] GetLastError () returned 0x0 [0088.560] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0088.560] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0088.561] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.561] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0088.561] SetEndOfFile (hFile=0x16c) returned 1 [0088.562] CloseHandle (hObject=0x16c) returned 1 [0088.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.562] SetEndOfFile (hFile=0x1fc) returned 1 [0088.562] CloseHandle (hObject=0x1fc) returned 1 [0088.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1 [0088.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.563] lstrlenW (lpString=".doc") returned 4 [0088.563] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0088.563] lstrlenW (lpString=".docx") returned 5 [0088.563] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0088.563] lstrlenW (lpString=".pdf") returned 4 [0088.563] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0088.563] lstrlenW (lpString=".xls") returned 4 [0088.563] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0088.563] lstrlenW (lpString=".xlsx") returned 5 [0088.563] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0088.563] lstrlenW (lpString=".ppt") returned 4 [0088.563] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0088.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.563] lstrlenW (lpString=".zip") returned 4 [0088.563] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0088.563] lstrlenW (lpString=".rar") returned 4 [0088.563] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0088.563] lstrlenW (lpString=".bz2") returned 4 [0088.564] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0088.564] lstrlenW (lpString=".7z") returned 3 [0088.564] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0088.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.564] lstrlenW (lpString=".dbf") returned 4 [0088.564] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0088.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.564] lstrlenW (lpString=".1cd") returned 4 [0088.564] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0088.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0088.564] lstrlenW (lpString=".jpg") returned 4 [0088.564] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0088.564] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") [0088.564] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0088.564] CloseHandle (hObject=0x1fc) returned 1 [0088.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20 [0088.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.565] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.565] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.565] GetLastError () returned 0x0 [0088.565] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0088.566] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0088.567] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.567] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0088.567] SetEndOfFile (hFile=0x16c) returned 1 [0088.567] CloseHandle (hObject=0x16c) returned 1 [0088.567] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.568] SetEndOfFile (hFile=0x1fc) returned 1 [0088.568] CloseHandle (hObject=0x1fc) returned 1 [0088.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1 [0088.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.569] lstrlenW (lpString=".doc") returned 4 [0088.569] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0088.569] lstrlenW (lpString=".docx") returned 5 [0088.569] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0088.569] lstrlenW (lpString=".pdf") returned 4 [0088.569] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0088.569] lstrlenW (lpString=".xls") returned 4 [0088.569] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0088.569] lstrlenW (lpString=".xlsx") returned 5 [0088.569] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0088.569] lstrlenW (lpString=".ppt") returned 4 [0088.569] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0088.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.569] lstrlenW (lpString=".zip") returned 4 [0088.569] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0088.569] lstrlenW (lpString=".rar") returned 4 [0088.569] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0088.569] lstrlenW (lpString=".bz2") returned 4 [0088.569] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0088.569] lstrlenW (lpString=".7z") returned 3 [0088.569] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0088.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.569] lstrlenW (lpString=".dbf") returned 4 [0088.569] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0088.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.570] lstrlenW (lpString=".1cd") returned 4 [0088.570] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0088.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0088.570] lstrlenW (lpString=".jpg") returned 4 [0088.570] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0088.570] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") [0088.570] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1287548) returned 1 [0088.570] CloseHandle (hObject=0x1fc) returned 1 [0088.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20 [0088.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0088.571] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.571] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.571] GetLastError () returned 0x0 [0088.571] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0088.761] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0089.065] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3a58c, lpOverlapped=0x0) returned 1 [0089.076] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3a590, lpOverlapped=0x0) returned 1 [0089.092] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.092] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0089.092] SetEndOfFile (hFile=0x16c) returned 1 [0089.123] CloseHandle (hObject=0x16c) returned 1 [0089.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.123] SetEndOfFile (hFile=0x1fc) returned 1 [0089.211] CloseHandle (hObject=0x1fc) returned 1 [0089.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1 [0089.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.212] lstrlenW (lpString=".doc") returned 4 [0089.212] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0089.212] lstrlenW (lpString=".docx") returned 5 [0089.212] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0089.212] lstrlenW (lpString=".pdf") returned 4 [0089.212] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0089.212] lstrlenW (lpString=".xls") returned 4 [0089.212] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0089.212] lstrlenW (lpString=".xlsx") returned 5 [0089.212] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0089.212] lstrlenW (lpString=".ppt") returned 4 [0089.212] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0089.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.212] lstrlenW (lpString=".zip") returned 4 [0089.212] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0089.212] lstrlenW (lpString=".rar") returned 4 [0089.212] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0089.212] lstrlenW (lpString=".bz2") returned 4 [0089.212] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0089.212] lstrlenW (lpString=".7z") returned 3 [0089.212] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0089.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.212] lstrlenW (lpString=".dbf") returned 4 [0089.213] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0089.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.213] lstrlenW (lpString=".1cd") returned 4 [0089.213] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0089.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0089.213] lstrlenW (lpString=".jpg") returned 4 [0089.213] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0089.213] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") [0089.214] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=212) returned 1 [0089.214] CloseHandle (hObject=0x1fc) returned 1 [0089.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20 [0089.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0089.215] GetLastError () returned 0x0 [0089.215] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd4, lpOverlapped=0x0) returned 1 [0089.216] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe0, lpOverlapped=0x0) returned 1 [0089.217] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.217] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0089.217] SetEndOfFile (hFile=0x150) returned 1 [0089.217] CloseHandle (hObject=0x150) returned 1 [0089.217] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.217] SetEndOfFile (hFile=0x1fc) returned 1 [0089.218] CloseHandle (hObject=0x1fc) returned 1 [0089.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1 [0089.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.218] lstrlenW (lpString=".doc") returned 4 [0089.218] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0089.219] lstrlenW (lpString=".docx") returned 5 [0089.219] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0089.219] lstrlenW (lpString=".pdf") returned 4 [0089.219] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0089.219] lstrlenW (lpString=".xls") returned 4 [0089.219] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0089.219] lstrlenW (lpString=".xlsx") returned 5 [0089.219] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0089.219] lstrlenW (lpString=".ppt") returned 4 [0089.219] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.219] lstrlenW (lpString=".zip") returned 4 [0089.219] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0089.219] lstrlenW (lpString=".rar") returned 4 [0089.219] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0089.219] lstrlenW (lpString=".bz2") returned 4 [0089.219] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0089.219] lstrlenW (lpString=".7z") returned 3 [0089.219] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.219] lstrlenW (lpString=".dbf") returned 4 [0089.219] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.219] lstrlenW (lpString=".1cd") returned 4 [0089.219] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0089.219] lstrlenW (lpString=".jpg") returned 4 [0089.219] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0089.219] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") [0089.220] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0089.220] CloseHandle (hObject=0x1fc) returned 1 [0089.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20 [0089.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0089.221] GetLastError () returned 0x0 [0089.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0089.222] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0089.223] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.223] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x100, lpOverlapped=0x0) returned 1 [0089.223] SetEndOfFile (hFile=0x150) returned 1 [0089.223] CloseHandle (hObject=0x150) returned 1 [0089.223] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.223] SetEndOfFile (hFile=0x1fc) returned 1 [0089.224] CloseHandle (hObject=0x1fc) returned 1 [0089.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString=".doc") returned 4 [0089.225] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0089.225] lstrlenW (lpString=".docx") returned 5 [0089.225] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0089.225] lstrlenW (lpString=".pdf") returned 4 [0089.225] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0089.225] lstrlenW (lpString=".xls") returned 4 [0089.225] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0089.225] lstrlenW (lpString=".xlsx") returned 5 [0089.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0089.225] lstrlenW (lpString=".ppt") returned 4 [0089.225] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString=".zip") returned 4 [0089.225] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0089.225] lstrlenW (lpString=".rar") returned 4 [0089.225] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0089.225] lstrlenW (lpString=".bz2") returned 4 [0089.225] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0089.225] lstrlenW (lpString=".7z") returned 3 [0089.225] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString=".dbf") returned 4 [0089.225] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString=".1cd") returned 4 [0089.225] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0089.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0089.225] lstrlenW (lpString=".jpg") returned 4 [0089.225] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0089.226] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") [0089.226] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113) returned 1 [0089.226] CloseHandle (hObject=0x1fc) returned 1 [0089.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 0x20 [0089.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.227] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.227] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0089.228] GetLastError () returned 0x0 [0089.228] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71, lpOverlapped=0x0) returned 1 [0089.229] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0089.230] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.230] WriteFile (in: hFile=0x150, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x100, lpOverlapped=0x0) returned 1 [0089.230] SetEndOfFile (hFile=0x150) returned 1 [0089.230] CloseHandle (hObject=0x150) returned 1 [0089.230] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.230] SetEndOfFile (hFile=0x1fc) returned 1 [0089.231] CloseHandle (hObject=0x1fc) returned 1 [0089.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1 [0089.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.231] lstrlenW (lpString=".doc") returned 4 [0089.231] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0089.231] lstrlenW (lpString=".docx") returned 5 [0089.231] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0089.231] lstrlenW (lpString=".pdf") returned 4 [0089.231] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0089.231] lstrlenW (lpString=".xls") returned 4 [0089.231] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0089.232] lstrlenW (lpString=".xlsx") returned 5 [0089.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0089.232] lstrlenW (lpString=".ppt") returned 4 [0089.232] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.232] lstrlenW (lpString=".zip") returned 4 [0089.232] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0089.232] lstrlenW (lpString=".rar") returned 4 [0089.232] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0089.232] lstrlenW (lpString=".bz2") returned 4 [0089.232] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0089.232] lstrlenW (lpString=".7z") returned 3 [0089.232] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.232] lstrlenW (lpString=".dbf") returned 4 [0089.232] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.232] lstrlenW (lpString=".1cd") returned 4 [0089.232] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0089.232] lstrlenW (lpString=".jpg") returned 4 [0089.232] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0089.232] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") [0089.233] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6816061) returned 1 [0089.233] CloseHandle (hObject=0x1fc) returned 1 [0089.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20 [0089.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0089.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0089.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.234] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.252] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x22ab14, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.252] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.443] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0089.443] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x64013d, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.443] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.458] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0089.571] SetEndOfFile (hFile=0x1fc) returned 1 [0089.571] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0089.575] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.575] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.576] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x22ab14, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.576] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x64013d, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.580] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.582] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0089.582] CloseHandle (hObject=0x1fc) returned 1 [0089.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.583] lstrlenW (lpString=".doc") returned 4 [0089.583] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0089.583] lstrlenW (lpString=".docx") returned 5 [0089.583] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0089.583] lstrlenW (lpString=".pdf") returned 4 [0089.583] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0089.583] lstrlenW (lpString=".xls") returned 4 [0089.583] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0089.583] lstrlenW (lpString=".xlsx") returned 5 [0089.583] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0089.583] lstrlenW (lpString=".ppt") returned 4 [0089.583] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0089.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.583] lstrlenW (lpString=".zip") returned 4 [0089.583] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0089.583] lstrlenW (lpString=".rar") returned 4 [0089.583] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0089.583] lstrlenW (lpString=".bz2") returned 4 [0089.583] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0089.583] lstrlenW (lpString=".7z") returned 3 [0089.583] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0089.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.583] lstrlenW (lpString=".dbf") returned 4 [0089.583] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0089.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.584] lstrlenW (lpString=".1cd") returned 4 [0089.584] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0089.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0089.584] lstrlenW (lpString=".jpg") returned 4 [0089.584] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0089.584] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") [0089.595] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=137096) returned 1 [0089.595] CloseHandle (hObject=0x158) returned 1 [0089.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20 [0089.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0089.596] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.596] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0089.597] GetLastError () returned 0x0 [0089.597] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x21788, lpOverlapped=0x0) returned 1 [0089.601] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x21790, lpOverlapped=0x0) returned 1 [0089.604] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.604] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0089.604] SetEndOfFile (hFile=0x22c) returned 1 [0089.604] CloseHandle (hObject=0x22c) returned 1 [0089.604] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.604] SetEndOfFile (hFile=0x158) returned 1 [0089.606] CloseHandle (hObject=0x158) returned 1 [0089.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1 [0089.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.606] lstrlenW (lpString=".doc") returned 4 [0089.606] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0089.606] lstrlenW (lpString=".docx") returned 5 [0089.606] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0089.607] lstrlenW (lpString=".pdf") returned 4 [0089.607] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString=".xls") returned 4 [0089.607] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0089.607] lstrlenW (lpString=".xlsx") returned 5 [0089.607] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0089.607] lstrlenW (lpString=".ppt") returned 4 [0089.607] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.607] lstrlenW (lpString=".zip") returned 4 [0089.607] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0089.607] lstrlenW (lpString=".rar") returned 4 [0089.607] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString=".bz2") returned 4 [0089.607] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString=".7z") returned 3 [0089.607] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0089.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.607] lstrlenW (lpString=".dbf") returned 4 [0089.607] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.607] lstrlenW (lpString=".1cd") returned 4 [0089.607] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0089.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0089.607] lstrlenW (lpString=".jpg") returned 4 [0089.607] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0089.607] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") [0089.609] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6982504) returned 1 [0089.609] CloseHandle (hObject=0x158) returned 1 [0089.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20 [0089.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0089.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0089.610] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0089.610] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.610] ReadFile (in: hFile=0x158, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.613] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2383cd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.613] ReadFile (in: hFile=0x158, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.623] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0089.623] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x668b68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0089.623] ReadFile (in: hFile=0x158, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.640] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.640] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0089.658] SetEndOfFile (hFile=0x158) returned 1 [0089.658] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0089.659] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.659] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.660] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2383cd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.660] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.781] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x668b68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0089.781] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0089.783] CloseHandle (hObject=0x158) returned 1 [0089.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.001] lstrlenW (lpString=".doc") returned 4 [0090.001] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.001] lstrlenW (lpString=".docx") returned 5 [0090.001] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0090.001] lstrlenW (lpString=".pdf") returned 4 [0090.001] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.001] lstrlenW (lpString=".xls") returned 4 [0090.001] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.001] lstrlenW (lpString=".xlsx") returned 5 [0090.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0090.002] lstrlenW (lpString=".ppt") returned 4 [0090.016] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.016] lstrlenW (lpString=".zip") returned 4 [0090.016] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.016] lstrlenW (lpString=".rar") returned 4 [0090.016] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.016] lstrlenW (lpString=".bz2") returned 4 [0090.016] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.016] lstrlenW (lpString=".7z") returned 3 [0090.016] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.016] lstrlenW (lpString=".dbf") returned 4 [0090.017] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.017] lstrlenW (lpString=".1cd") returned 4 [0090.017] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0090.017] lstrlenW (lpString=".jpg") returned 4 [0090.017] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.017] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") [0090.347] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=83808) returned 1 [0090.347] CloseHandle (hObject=0x1c0) returned 1 [0090.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20 [0090.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.348] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.348] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.348] GetLastError () returned 0x0 [0090.348] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x14760, lpOverlapped=0x0) returned 1 [0090.393] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x14770, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x14770, lpOverlapped=0x0) returned 1 [0090.395] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.395] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.396] SetEndOfFile (hFile=0x180) returned 1 [0090.396] CloseHandle (hObject=0x180) returned 1 [0090.396] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.396] SetEndOfFile (hFile=0x1c0) returned 1 [0090.397] CloseHandle (hObject=0x1c0) returned 1 [0090.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 1 [0090.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.487] lstrlenW (lpString=".doc") returned 4 [0090.487] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString=".docx") returned 5 [0090.487] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0090.487] lstrlenW (lpString=".pdf") returned 4 [0090.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString=".xls") returned 4 [0090.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString=".xlsx") returned 5 [0090.487] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0090.487] lstrlenW (lpString=".ppt") returned 4 [0090.487] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.487] lstrlenW (lpString=".zip") returned 4 [0090.487] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString=".rar") returned 4 [0090.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.487] lstrlenW (lpString=".bz2") returned 4 [0090.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.487] lstrlenW (lpString=".7z") returned 3 [0090.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.487] lstrlenW (lpString=".dbf") returned 4 [0090.487] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.487] lstrlenW (lpString=".1cd") returned 4 [0090.487] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0090.488] lstrlenW (lpString=".jpg") returned 4 [0090.488] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.488] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") [0090.497] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=88464) returned 1 [0090.497] CloseHandle (hObject=0x16c) returned 1 [0090.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20 [0090.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.518] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.518] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.623] GetLastError () returned 0x0 [0090.629] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x15990, lpOverlapped=0x0) returned 1 [0090.668] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x159a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x159a0, lpOverlapped=0x0) returned 1 [0090.670] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.670] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.670] SetEndOfFile (hFile=0x22c) returned 1 [0090.670] CloseHandle (hObject=0x22c) returned 1 [0090.670] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.670] SetEndOfFile (hFile=0x158) returned 1 [0090.672] CloseHandle (hObject=0x158) returned 1 [0090.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 1 [0090.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.672] lstrlenW (lpString=".doc") returned 4 [0090.672] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.672] lstrlenW (lpString=".docx") returned 5 [0090.672] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0090.672] lstrlenW (lpString=".pdf") returned 4 [0090.672] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.672] lstrlenW (lpString=".xls") returned 4 [0090.672] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.672] lstrlenW (lpString=".xlsx") returned 5 [0090.672] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0090.672] lstrlenW (lpString=".ppt") returned 4 [0090.672] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.672] lstrlenW (lpString=".zip") returned 4 [0090.673] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.673] lstrlenW (lpString=".rar") returned 4 [0090.673] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.673] lstrlenW (lpString=".bz2") returned 4 [0090.673] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.673] lstrlenW (lpString=".7z") returned 3 [0090.673] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.673] lstrlenW (lpString=".dbf") returned 4 [0090.673] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.673] lstrlenW (lpString=".1cd") returned 4 [0090.673] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0090.673] lstrlenW (lpString=".jpg") returned 4 [0090.673] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.673] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") [0090.674] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=240000) returned 1 [0090.674] CloseHandle (hObject=0x158) returned 1 [0090.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 0x20 [0090.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.674] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.674] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.675] GetLastError () returned 0x0 [0090.675] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3a980, lpOverlapped=0x0) returned 1 [0090.682] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3a990, lpOverlapped=0x0) returned 1 [0090.686] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.686] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0090.686] SetEndOfFile (hFile=0x22c) returned 1 [0090.686] CloseHandle (hObject=0x22c) returned 1 [0090.686] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.686] SetEndOfFile (hFile=0x158) returned 1 [0090.688] CloseHandle (hObject=0x158) returned 1 [0090.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString=".doc") returned 4 [0090.689] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".docx") returned 5 [0090.689] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.689] lstrlenW (lpString=".pdf") returned 4 [0090.689] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".xls") returned 4 [0090.689] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".xlsx") returned 5 [0090.689] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.689] lstrlenW (lpString=".ppt") returned 4 [0090.689] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString=".zip") returned 4 [0090.689] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".rar") returned 4 [0090.689] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".bz2") returned 4 [0090.689] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString=".7z") returned 3 [0090.689] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString=".dbf") returned 4 [0090.689] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString=".1cd") returned 4 [0090.689] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.689] lstrlenW (lpString=".jpg") returned 4 [0090.689] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".docx") returned 5 [0090.690] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.690] lstrlenW (lpString=".pdf") returned 4 [0090.690] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".xls") returned 4 [0090.690] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".xlsx") returned 5 [0090.690] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.690] lstrlenW (lpString=".ppt") returned 4 [0090.690] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.690] lstrlenW (lpString=".zip") returned 4 [0090.690] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".rar") returned 4 [0090.690] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".bz2") returned 4 [0090.690] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString=".7z") returned 3 [0090.690] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.690] lstrlenW (lpString=".dbf") returned 4 [0090.690] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.690] lstrlenW (lpString=".1cd") returned 4 [0090.690] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0090.690] lstrlenW (lpString=".jpg") returned 4 [0090.690] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.690] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") [0090.691] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5802528) returned 1 [0090.691] CloseHandle (hObject=0x158) returned 1 [0090.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20 [0090.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0090.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.692] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0090.693] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0090.693] ReadFile (in: hFile=0x158, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.697] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1d8360, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0090.697] ReadFile (in: hFile=0x158, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.708] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0090.708] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x548a20, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0090.708] ReadFile (in: hFile=0x158, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0090.724] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.724] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0090.946] SetEndOfFile (hFile=0x158) returned 1 [0090.946] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0090.946] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0090.946] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0090.947] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1d8360, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0090.947] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0090.953] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x548a20, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0090.953] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0090.955] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0090.955] CloseHandle (hObject=0x158) returned 1 [0090.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.955] lstrlenW (lpString=".doc") returned 4 [0090.955] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0090.955] lstrlenW (lpString=".docx") returned 5 [0090.955] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0090.955] lstrlenW (lpString=".pdf") returned 4 [0090.955] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0090.955] lstrlenW (lpString=".xls") returned 4 [0090.955] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0090.955] lstrlenW (lpString=".xlsx") returned 5 [0090.955] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0090.955] lstrlenW (lpString=".ppt") returned 4 [0090.956] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0090.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.956] lstrlenW (lpString=".zip") returned 4 [0090.956] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0090.956] lstrlenW (lpString=".rar") returned 4 [0090.956] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0090.956] lstrlenW (lpString=".bz2") returned 4 [0090.956] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0090.956] lstrlenW (lpString=".7z") returned 3 [0090.956] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0090.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.956] lstrlenW (lpString=".dbf") returned 4 [0090.956] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0090.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.956] lstrlenW (lpString=".1cd") returned 4 [0090.956] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0090.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0090.956] lstrlenW (lpString=".jpg") returned 4 [0090.956] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0090.956] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") [0090.957] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=205) returned 1 [0090.957] CloseHandle (hObject=0x158) returned 1 [0090.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20 [0090.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.957] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.958] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.958] GetLastError () returned 0x0 [0090.958] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xcd, lpOverlapped=0x0) returned 1 [0090.960] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd0, lpOverlapped=0x0) returned 1 [0090.961] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.961] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0090.961] SetEndOfFile (hFile=0x22c) returned 1 [0090.961] CloseHandle (hObject=0x22c) returned 1 [0090.961] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.961] SetEndOfFile (hFile=0x158) returned 1 [0090.962] CloseHandle (hObject=0x158) returned 1 [0090.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1 [0090.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.962] lstrlenW (lpString=".doc") returned 4 [0090.962] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0090.962] lstrlenW (lpString=".docx") returned 5 [0090.962] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0090.962] lstrlenW (lpString=".pdf") returned 4 [0090.962] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0090.962] lstrlenW (lpString=".xls") returned 4 [0090.962] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0090.962] lstrlenW (lpString=".xlsx") returned 5 [0090.963] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0090.963] lstrlenW (lpString=".ppt") returned 4 [0090.963] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0090.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.963] lstrlenW (lpString=".zip") returned 4 [0090.963] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0090.963] lstrlenW (lpString=".rar") returned 4 [0090.963] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0090.963] lstrlenW (lpString=".bz2") returned 4 [0090.963] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0090.963] lstrlenW (lpString=".7z") returned 3 [0090.963] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0090.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.963] lstrlenW (lpString=".dbf") returned 4 [0090.963] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0090.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.963] lstrlenW (lpString=".1cd") returned 4 [0090.963] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0090.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0090.963] lstrlenW (lpString=".jpg") returned 4 [0090.963] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0090.963] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") [0090.964] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=114) returned 1 [0090.964] CloseHandle (hObject=0x158) returned 1 [0090.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 0x20 [0090.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.964] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.964] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0090.965] GetLastError () returned 0x0 [0090.965] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x72, lpOverlapped=0x0) returned 1 [0090.971] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.100] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0091.100] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0091.101] SetEndOfFile (hFile=0x22c) returned 1 [0091.101] CloseHandle (hObject=0x22c) returned 1 [0091.101] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.101] SetEndOfFile (hFile=0x158) returned 1 [0091.106] CloseHandle (hObject=0x158) returned 1 [0091.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1 [0091.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.106] lstrlenW (lpString=".doc") returned 4 [0091.106] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.106] lstrlenW (lpString=".docx") returned 5 [0091.107] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.107] lstrlenW (lpString=".pdf") returned 4 [0091.107] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.107] lstrlenW (lpString=".xls") returned 4 [0091.107] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.107] lstrlenW (lpString=".xlsx") returned 5 [0091.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.107] lstrlenW (lpString=".ppt") returned 4 [0091.107] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.107] lstrlenW (lpString=".zip") returned 4 [0091.107] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.107] lstrlenW (lpString=".rar") returned 4 [0091.107] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.107] lstrlenW (lpString=".bz2") returned 4 [0091.107] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.107] lstrlenW (lpString=".7z") returned 3 [0091.107] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.107] lstrlenW (lpString=".dbf") returned 4 [0091.107] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.107] lstrlenW (lpString=".1cd") returned 4 [0091.107] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0091.107] lstrlenW (lpString=".jpg") returned 4 [0091.107] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.107] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") [0091.108] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2520158) returned 1 [0091.108] CloseHandle (hObject=0x158) returned 1 [0091.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20 [0091.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0091.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.110] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0091.110] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0091.110] ReadFile (in: hFile=0x158, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.113] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xcd174, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0091.114] ReadFile (in: hFile=0x158, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.125] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.125] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x22745e, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0091.125] ReadFile (in: hFile=0x158, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.148] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.148] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0091.350] SetEndOfFile (hFile=0x158) returned 1 [0091.350] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0091.350] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0091.350] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.382] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xcd174, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0091.382] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.388] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x22745e, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0091.388] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.391] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0091.391] CloseHandle (hObject=0x158) returned 1 [0091.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.391] lstrlenW (lpString=".doc") returned 4 [0091.391] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0091.391] lstrlenW (lpString=".docx") returned 5 [0091.391] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0091.391] lstrlenW (lpString=".pdf") returned 4 [0091.391] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0091.391] lstrlenW (lpString=".xls") returned 4 [0091.391] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0091.391] lstrlenW (lpString=".xlsx") returned 5 [0091.391] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0091.391] lstrlenW (lpString=".ppt") returned 4 [0091.391] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.391] lstrlenW (lpString=".zip") returned 4 [0091.391] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0091.391] lstrlenW (lpString=".rar") returned 4 [0091.391] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0091.391] lstrlenW (lpString=".bz2") returned 4 [0091.391] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0091.392] lstrlenW (lpString=".7z") returned 3 [0091.392] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0091.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.392] lstrlenW (lpString=".dbf") returned 4 [0091.392] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0091.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.392] lstrlenW (lpString=".1cd") returned 4 [0091.392] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0091.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0091.392] lstrlenW (lpString=".jpg") returned 4 [0091.392] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0091.392] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") [0091.393] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=651) returned 1 [0091.393] CloseHandle (hObject=0x158) returned 1 [0091.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 0x20 [0091.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.393] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.393] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0091.394] GetLastError () returned 0x0 [0091.394] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x28b, lpOverlapped=0x0) returned 1 [0091.419] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x290, lpOverlapped=0x0) returned 1 [0091.420] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0091.420] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.420] SetEndOfFile (hFile=0x210) returned 1 [0091.441] CloseHandle (hObject=0x210) returned 1 [0091.441] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.442] SetEndOfFile (hFile=0x158) returned 1 [0091.490] CloseHandle (hObject=0x158) returned 1 [0091.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString=".doc") returned 4 [0091.491] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0091.491] lstrlenW (lpString=".docx") returned 5 [0091.491] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0091.491] lstrlenW (lpString=".pdf") returned 4 [0091.491] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0091.491] lstrlenW (lpString=".xls") returned 4 [0091.491] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0091.491] lstrlenW (lpString=".xlsx") returned 5 [0091.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0091.491] lstrlenW (lpString=".ppt") returned 4 [0091.491] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString=".zip") returned 4 [0091.491] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0091.491] lstrlenW (lpString=".rar") returned 4 [0091.491] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0091.491] lstrlenW (lpString=".bz2") returned 4 [0091.491] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0091.491] lstrlenW (lpString=".7z") returned 3 [0091.491] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString=".dbf") returned 4 [0091.491] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString=".1cd") returned 4 [0091.491] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0091.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0091.491] lstrlenW (lpString=".jpg") returned 4 [0091.491] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0091.492] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") [0091.561] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=631) returned 1 [0091.561] CloseHandle (hObject=0x158) returned 1 [0091.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20 [0091.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.566] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.566] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.571] GetLastError () returned 0x0 [0091.571] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x277, lpOverlapped=0x0) returned 1 [0092.001] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x280, lpOverlapped=0x0) returned 1 [0092.002] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0092.002] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0092.002] SetEndOfFile (hFile=0x1f0) returned 1 [0092.002] CloseHandle (hObject=0x1f0) returned 1 [0092.002] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.002] SetEndOfFile (hFile=0x158) returned 1 [0092.003] CloseHandle (hObject=0x158) returned 1 [0092.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1 [0092.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.122] lstrlenW (lpString=".doc") returned 4 [0092.122] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0092.122] lstrlenW (lpString=".docx") returned 5 [0092.122] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0092.122] lstrlenW (lpString=".pdf") returned 4 [0092.123] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0092.123] lstrlenW (lpString=".xls") returned 4 [0092.123] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0092.123] lstrlenW (lpString=".xlsx") returned 5 [0092.123] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0092.123] lstrlenW (lpString=".ppt") returned 4 [0092.123] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0092.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.123] lstrlenW (lpString=".zip") returned 4 [0092.123] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0092.123] lstrlenW (lpString=".rar") returned 4 [0092.123] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0092.123] lstrlenW (lpString=".bz2") returned 4 [0092.123] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0092.123] lstrlenW (lpString=".7z") returned 3 [0092.123] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0092.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.143] lstrlenW (lpString=".dbf") returned 4 [0092.143] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0092.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.143] lstrlenW (lpString=".1cd") returned 4 [0092.143] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0092.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0092.143] lstrlenW (lpString=".jpg") returned 4 [0092.143] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0092.143] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") [0092.161] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=16776) returned 1 [0092.161] CloseHandle (hObject=0x158) returned 1 [0092.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20 [0092.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.161] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.161] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.162] GetLastError () returned 0x0 [0092.162] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4188, lpOverlapped=0x0) returned 1 [0092.167] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4190, lpOverlapped=0x0) returned 1 [0092.169] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0092.169] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0092.169] SetEndOfFile (hFile=0x1f0) returned 1 [0092.169] CloseHandle (hObject=0x1f0) returned 1 [0092.169] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.169] SetEndOfFile (hFile=0x158) returned 1 [0092.170] CloseHandle (hObject=0x158) returned 1 [0092.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 1 [0092.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString=".doc") returned 4 [0092.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString=".docx") returned 5 [0092.171] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0092.171] lstrlenW (lpString=".pdf") returned 4 [0092.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString=".xls") returned 4 [0092.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString=".xlsx") returned 5 [0092.171] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0092.171] lstrlenW (lpString=".ppt") returned 4 [0092.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString=".zip") returned 4 [0092.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString=".rar") returned 4 [0092.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.171] lstrlenW (lpString=".bz2") returned 4 [0092.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.171] lstrlenW (lpString=".7z") returned 3 [0092.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString=".dbf") returned 4 [0092.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString=".1cd") returned 4 [0092.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0092.171] lstrlenW (lpString=".jpg") returned 4 [0092.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.172] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") [0092.180] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=52624) returned 1 [0092.180] CloseHandle (hObject=0x158) returned 1 [0092.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20 [0092.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.180] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.181] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.181] GetLastError () returned 0x0 [0092.181] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xcd90, lpOverlapped=0x0) returned 1 [0092.193] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xcda0, lpOverlapped=0x0) returned 1 [0092.194] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0092.194] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0092.194] SetEndOfFile (hFile=0x1f0) returned 1 [0092.195] CloseHandle (hObject=0x1f0) returned 1 [0092.195] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.195] SetEndOfFile (hFile=0x158) returned 1 [0092.196] CloseHandle (hObject=0x158) returned 1 [0092.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1 [0092.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.196] lstrlenW (lpString=".doc") returned 4 [0092.196] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0092.196] lstrlenW (lpString=".docx") returned 5 [0092.196] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0092.196] lstrlenW (lpString=".pdf") returned 4 [0092.196] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0092.196] lstrlenW (lpString=".xls") returned 4 [0092.196] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0092.196] lstrlenW (lpString=".xlsx") returned 5 [0092.196] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0092.196] lstrlenW (lpString=".ppt") returned 4 [0092.197] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0092.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.197] lstrlenW (lpString=".zip") returned 4 [0092.197] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0092.197] lstrlenW (lpString=".rar") returned 4 [0092.197] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0092.197] lstrlenW (lpString=".bz2") returned 4 [0092.197] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0092.197] lstrlenW (lpString=".7z") returned 3 [0092.197] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0092.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.197] lstrlenW (lpString=".dbf") returned 4 [0092.197] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0092.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.197] lstrlenW (lpString=".1cd") returned 4 [0092.197] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0092.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0092.197] lstrlenW (lpString=".jpg") returned 4 [0092.197] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0092.197] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") [0092.205] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2362752) returned 1 [0092.205] CloseHandle (hObject=0x158) returned 1 [0092.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0x20 [0092.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0092.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.206] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0092.206] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.206] ReadFile (in: hFile=0x158, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.214] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xc0480, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.214] ReadFile (in: hFile=0x158, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.225] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0092.225] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x200d80, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.225] ReadFile (in: hFile=0x158, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.458] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.458] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0092.479] SetEndOfFile (hFile=0x158) returned 1 [0092.527] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0092.527] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0092.527] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.529] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xc0480, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0092.529] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.537] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x200d80, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0092.537] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.540] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0092.540] CloseHandle (hObject=0x158) returned 1 [0092.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.540] lstrlenW (lpString=".doc") returned 4 [0092.540] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.540] lstrlenW (lpString=".docx") returned 5 [0092.540] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0092.540] lstrlenW (lpString=".pdf") returned 4 [0092.540] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.540] lstrlenW (lpString=".xls") returned 4 [0092.540] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.540] lstrlenW (lpString=".xlsx") returned 5 [0092.540] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0092.541] lstrlenW (lpString=".ppt") returned 4 [0092.541] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.541] lstrlenW (lpString=".zip") returned 4 [0092.541] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.541] lstrlenW (lpString=".rar") returned 4 [0092.541] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.541] lstrlenW (lpString=".bz2") returned 4 [0092.541] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.541] lstrlenW (lpString=".7z") returned 3 [0092.541] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.541] lstrlenW (lpString=".dbf") returned 4 [0092.541] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.541] lstrlenW (lpString=".1cd") returned 4 [0092.541] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0092.541] lstrlenW (lpString=".jpg") returned 4 [0092.541] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.541] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") [0092.655] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12672) returned 1 [0092.655] CloseHandle (hObject=0x15c) returned 1 [0092.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 0x20 [0092.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.655] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.655] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.656] GetLastError () returned 0x0 [0092.656] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3180, lpOverlapped=0x0) returned 1 [0092.658] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3190, lpOverlapped=0x0) returned 1 [0092.660] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0092.660] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc, lpOverlapped=0x0) returned 1 [0092.660] SetEndOfFile (hFile=0x1fc) returned 1 [0092.660] CloseHandle (hObject=0x1fc) returned 1 [0092.660] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.660] SetEndOfFile (hFile=0x15c) returned 1 [0092.661] CloseHandle (hObject=0x15c) returned 1 [0092.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1 [0092.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString=".doc") returned 4 [0092.662] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".docx") returned 5 [0092.662] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.662] lstrlenW (lpString=".pdf") returned 4 [0092.662] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".xls") returned 4 [0092.662] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".xlsx") returned 5 [0092.662] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.662] lstrlenW (lpString=".ppt") returned 4 [0092.662] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString=".zip") returned 4 [0092.662] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".rar") returned 4 [0092.662] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".bz2") returned 4 [0092.662] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".7z") returned 3 [0092.662] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString=".dbf") returned 4 [0092.662] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString=".1cd") returned 4 [0092.662] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.662] lstrlenW (lpString=".jpg") returned 4 [0092.662] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.662] lstrlenW (lpString=".docx") returned 5 [0092.663] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0092.663] lstrlenW (lpString=".pdf") returned 4 [0092.663] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString=".xls") returned 4 [0092.663] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString=".xlsx") returned 5 [0092.663] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0092.663] lstrlenW (lpString=".ppt") returned 4 [0092.663] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.663] lstrlenW (lpString=".zip") returned 4 [0092.663] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString=".rar") returned 4 [0092.663] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString=".bz2") returned 4 [0092.663] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString=".7z") returned 3 [0092.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.663] lstrlenW (lpString=".dbf") returned 4 [0092.663] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.663] lstrlenW (lpString=".1cd") returned 4 [0092.663] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0092.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0092.663] lstrlenW (lpString=".jpg") returned 4 [0092.663] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0092.663] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") [0092.664] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=579488) returned 1 [0092.664] CloseHandle (hObject=0x15c) returned 1 [0092.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 0x20 [0092.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0092.665] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.665] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.665] GetLastError () returned 0x0 [0092.665] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x8d7a0, lpOverlapped=0x0) returned 1 [0092.678] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x8d7b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x8d7b0, lpOverlapped=0x0) returned 1 [0092.687] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0092.687] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0092.687] SetEndOfFile (hFile=0x1fc) returned 1 [0092.687] CloseHandle (hObject=0x1fc) returned 1 [0092.688] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.688] SetEndOfFile (hFile=0x15c) returned 1 [0092.817] CloseHandle (hObject=0x15c) returned 1 [0092.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 1 [0092.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.818] lstrlenW (lpString=".doc") returned 4 [0092.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString=".docx") returned 5 [0092.818] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0092.818] lstrlenW (lpString=".pdf") returned 4 [0092.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString=".xls") returned 4 [0092.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString=".xlsx") returned 5 [0092.818] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0092.818] lstrlenW (lpString=".ppt") returned 4 [0092.818] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.818] lstrlenW (lpString=".zip") returned 4 [0092.818] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString=".rar") returned 4 [0092.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.818] lstrlenW (lpString=".bz2") returned 4 [0092.818] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.818] lstrlenW (lpString=".7z") returned 3 [0092.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.818] lstrlenW (lpString=".dbf") returned 4 [0092.818] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.818] lstrlenW (lpString=".1cd") returned 4 [0092.819] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0092.819] lstrlenW (lpString=".jpg") returned 4 [0092.819] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.819] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") [0092.889] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3440640) returned 1 [0092.889] CloseHandle (hObject=0x158) returned 1 [0092.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0092.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0092.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0092.890] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0092.890] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.890] ReadFile (in: hFile=0x158, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.893] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x118000, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.893] ReadFile (in: hFile=0x158, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.902] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0092.902] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x308000, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0092.902] ReadFile (in: hFile=0x158, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.920] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0092.920] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0093.015] SetEndOfFile (hFile=0x158) returned 1 [0093.016] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0093.016] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0093.016] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.022] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x118000, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0093.022] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.068] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x308000, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0093.068] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0093.072] CloseHandle (hObject=0x158) returned 1 [0093.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.073] lstrlenW (lpString=".doc") returned 4 [0093.073] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".docx") returned 5 [0093.073] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0093.073] lstrlenW (lpString=".pdf") returned 4 [0093.073] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".xls") returned 4 [0093.073] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".xlsx") returned 5 [0093.073] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0093.073] lstrlenW (lpString=".ppt") returned 4 [0093.073] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.073] lstrlenW (lpString=".zip") returned 4 [0093.073] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".rar") returned 4 [0093.073] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".bz2") returned 4 [0093.073] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0093.073] lstrlenW (lpString=".7z") returned 3 [0093.073] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0093.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.073] lstrlenW (lpString=".dbf") returned 4 [0093.073] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0093.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.074] lstrlenW (lpString=".1cd") returned 4 [0093.074] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0093.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0093.074] lstrlenW (lpString=".jpg") returned 4 [0093.074] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0093.074] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") [0093.075] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=95104) returned 1 [0093.075] CloseHandle (hObject=0x158) returned 1 [0093.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll")) returned 0x20 [0093.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.075] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.075] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.076] GetLastError () returned 0x0 [0093.076] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x17380, lpOverlapped=0x0) returned 1 [0093.346] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x17390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x17390, lpOverlapped=0x0) returned 1 [0093.370] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0093.370] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0093.370] SetEndOfFile (hFile=0x1fc) returned 1 [0093.503] CloseHandle (hObject=0x1fc) returned 1 [0093.503] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.503] SetEndOfFile (hFile=0x158) returned 1 [0093.504] CloseHandle (hObject=0x158) returned 1 [0093.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll")) returned 1 [0093.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.747] lstrlenW (lpString=".doc") returned 4 [0093.747] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.747] lstrlenW (lpString=".docx") returned 5 [0093.747] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0093.747] lstrlenW (lpString=".pdf") returned 4 [0093.747] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.747] lstrlenW (lpString=".xls") returned 4 [0093.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.747] lstrlenW (lpString=".xlsx") returned 5 [0093.747] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0093.747] lstrlenW (lpString=".ppt") returned 4 [0093.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.748] lstrlenW (lpString=".zip") returned 4 [0093.748] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.748] lstrlenW (lpString=".rar") returned 4 [0093.748] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.748] lstrlenW (lpString=".bz2") returned 4 [0093.748] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.748] lstrlenW (lpString=".7z") returned 3 [0093.748] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.748] lstrlenW (lpString=".dbf") returned 4 [0093.748] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.748] lstrlenW (lpString=".1cd") returned 4 [0093.748] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0093.748] lstrlenW (lpString=".jpg") returned 4 [0093.748] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.748] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") [0093.783] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=152392) returned 1 [0093.785] CloseHandle (hObject=0x1f0) returned 1 [0093.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20 [0093.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.799] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.799] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.023] GetLastError () returned 0x0 [0094.023] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x25348, lpOverlapped=0x0) returned 1 [0094.051] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x25350, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x25350, lpOverlapped=0x0) returned 1 [0094.056] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.056] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0094.056] SetEndOfFile (hFile=0x1c8) returned 1 [0094.056] CloseHandle (hObject=0x1c8) returned 1 [0094.056] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.056] SetEndOfFile (hFile=0x1f0) returned 1 [0094.058] CloseHandle (hObject=0x1f0) returned 1 [0094.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 1 [0094.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.058] lstrlenW (lpString=".doc") returned 4 [0094.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.058] lstrlenW (lpString=".docx") returned 5 [0094.058] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0094.058] lstrlenW (lpString=".pdf") returned 4 [0094.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.058] lstrlenW (lpString=".xls") returned 4 [0094.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.058] lstrlenW (lpString=".xlsx") returned 5 [0094.058] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0094.059] lstrlenW (lpString=".ppt") returned 4 [0094.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.059] lstrlenW (lpString=".zip") returned 4 [0094.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.059] lstrlenW (lpString=".rar") returned 4 [0094.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.059] lstrlenW (lpString=".bz2") returned 4 [0094.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.059] lstrlenW (lpString=".7z") returned 3 [0094.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.059] lstrlenW (lpString=".dbf") returned 4 [0094.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.059] lstrlenW (lpString=".1cd") returned 4 [0094.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0094.059] lstrlenW (lpString=".jpg") returned 4 [0094.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.059] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") [0094.346] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=286848) returned 1 [0094.346] CloseHandle (hObject=0x1f0) returned 1 [0094.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0094.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.348] GetLastError () returned 0x0 [0094.348] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x46080, lpOverlapped=0x0) returned 1 [0094.355] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x46090, lpOverlapped=0x0) returned 1 [0094.361] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.361] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.361] SetEndOfFile (hFile=0x1c8) returned 1 [0094.362] CloseHandle (hObject=0x1c8) returned 1 [0094.362] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.362] SetEndOfFile (hFile=0x1f0) returned 1 [0094.365] CloseHandle (hObject=0x1f0) returned 1 [0094.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1 [0094.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.365] lstrlenW (lpString=".doc") returned 4 [0094.365] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0094.365] lstrlenW (lpString=".docx") returned 5 [0094.365] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0094.365] lstrlenW (lpString=".pdf") returned 4 [0094.365] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0094.365] lstrlenW (lpString=".xls") returned 4 [0094.365] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0094.365] lstrlenW (lpString=".xlsx") returned 5 [0094.365] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0094.366] lstrlenW (lpString=".ppt") returned 4 [0094.366] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0094.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.366] lstrlenW (lpString=".zip") returned 4 [0094.366] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0094.366] lstrlenW (lpString=".rar") returned 4 [0094.366] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0094.366] lstrlenW (lpString=".bz2") returned 4 [0094.366] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0094.366] lstrlenW (lpString=".7z") returned 3 [0094.366] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0094.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.366] lstrlenW (lpString=".dbf") returned 4 [0094.366] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0094.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.366] lstrlenW (lpString=".1cd") returned 4 [0094.366] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0094.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0094.366] lstrlenW (lpString=".jpg") returned 4 [0094.366] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0094.366] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") [0094.367] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=50048) returned 1 [0094.367] CloseHandle (hObject=0x1f0) returned 1 [0094.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 0x20 [0094.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.368] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.368] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.369] GetLastError () returned 0x0 [0094.369] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xc380, lpOverlapped=0x0) returned 1 [0094.399] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xc390, lpOverlapped=0x0) returned 1 [0094.401] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.401] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0094.401] SetEndOfFile (hFile=0x1c8) returned 1 [0094.401] CloseHandle (hObject=0x1c8) returned 1 [0094.401] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.401] SetEndOfFile (hFile=0x1f0) returned 1 [0094.402] CloseHandle (hObject=0x1f0) returned 1 [0094.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 1 [0094.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.406] lstrlenW (lpString=".doc") returned 4 [0094.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.406] lstrlenW (lpString=".docx") returned 5 [0094.406] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0094.406] lstrlenW (lpString=".pdf") returned 4 [0094.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.407] lstrlenW (lpString=".xls") returned 4 [0094.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.407] lstrlenW (lpString=".xlsx") returned 5 [0094.407] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0094.407] lstrlenW (lpString=".ppt") returned 4 [0094.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.407] lstrlenW (lpString=".zip") returned 4 [0094.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.407] lstrlenW (lpString=".rar") returned 4 [0094.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.407] lstrlenW (lpString=".bz2") returned 4 [0094.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.407] lstrlenW (lpString=".7z") returned 3 [0094.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.407] lstrlenW (lpString=".dbf") returned 4 [0094.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.407] lstrlenW (lpString=".1cd") returned 4 [0094.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0094.408] lstrlenW (lpString=".jpg") returned 4 [0094.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.408] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") [0094.409] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=36177) returned 1 [0094.409] CloseHandle (hObject=0x1f0) returned 1 [0094.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0094.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.410] GetLastError () returned 0x0 [0094.410] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x8d51, lpOverlapped=0x0) returned 1 [0094.412] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x8d60, lpOverlapped=0x0) returned 1 [0094.414] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.414] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0094.414] SetEndOfFile (hFile=0x1c8) returned 1 [0094.414] CloseHandle (hObject=0x1c8) returned 1 [0094.414] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.414] SetEndOfFile (hFile=0x1f0) returned 1 [0094.415] CloseHandle (hObject=0x1f0) returned 1 [0094.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1 [0094.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.416] lstrlenW (lpString=".doc") returned 4 [0094.416] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0094.416] lstrlenW (lpString=".docx") returned 5 [0094.416] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0094.416] lstrlenW (lpString=".pdf") returned 4 [0094.416] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0094.416] lstrlenW (lpString=".xls") returned 4 [0094.416] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0094.416] lstrlenW (lpString=".xlsx") returned 5 [0094.416] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0094.416] lstrlenW (lpString=".ppt") returned 4 [0094.416] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0094.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.416] lstrlenW (lpString=".zip") returned 4 [0094.416] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0094.416] lstrlenW (lpString=".rar") returned 4 [0094.416] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0094.416] lstrlenW (lpString=".bz2") returned 4 [0094.416] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0094.416] lstrlenW (lpString=".7z") returned 3 [0094.416] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0094.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.416] lstrlenW (lpString=".dbf") returned 4 [0094.416] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0094.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.417] lstrlenW (lpString=".1cd") returned 4 [0094.417] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0094.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0094.417] lstrlenW (lpString=".jpg") returned 4 [0094.417] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0094.417] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") [0094.418] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=70528) returned 1 [0094.418] CloseHandle (hObject=0x1f0) returned 1 [0094.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20 [0094.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.419] GetLastError () returned 0x0 [0094.419] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x11380, lpOverlapped=0x0) returned 1 [0094.422] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x11390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x11390, lpOverlapped=0x0) returned 1 [0094.424] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.424] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0094.424] SetEndOfFile (hFile=0x1c8) returned 1 [0094.424] CloseHandle (hObject=0x1c8) returned 1 [0094.424] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.424] SetEndOfFile (hFile=0x1f0) returned 1 [0094.426] CloseHandle (hObject=0x1f0) returned 1 [0094.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 1 [0094.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.426] lstrlenW (lpString=".doc") returned 4 [0094.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.426] lstrlenW (lpString=".docx") returned 5 [0094.426] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0094.426] lstrlenW (lpString=".pdf") returned 4 [0094.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.426] lstrlenW (lpString=".xls") returned 4 [0094.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.426] lstrlenW (lpString=".xlsx") returned 5 [0094.426] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0094.426] lstrlenW (lpString=".ppt") returned 4 [0094.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.427] lstrlenW (lpString=".zip") returned 4 [0094.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.427] lstrlenW (lpString=".rar") returned 4 [0094.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.427] lstrlenW (lpString=".bz2") returned 4 [0094.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.427] lstrlenW (lpString=".7z") returned 3 [0094.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.427] lstrlenW (lpString=".dbf") returned 4 [0094.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.427] lstrlenW (lpString=".1cd") returned 4 [0094.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0094.427] lstrlenW (lpString=".jpg") returned 4 [0094.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.427] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") [0094.428] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=137600) returned 1 [0094.428] CloseHandle (hObject=0x1f0) returned 1 [0094.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 0x20 [0094.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.429] GetLastError () returned 0x0 [0094.429] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x21980, lpOverlapped=0x0) returned 1 [0094.502] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x21990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x21990, lpOverlapped=0x0) returned 1 [0094.505] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.505] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.506] SetEndOfFile (hFile=0x1c8) returned 1 [0094.506] CloseHandle (hObject=0x1c8) returned 1 [0094.506] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.506] SetEndOfFile (hFile=0x1f0) returned 1 [0094.508] CloseHandle (hObject=0x1f0) returned 1 [0094.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 1 [0094.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.508] lstrlenW (lpString=".doc") returned 4 [0094.508] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.508] lstrlenW (lpString=".docx") returned 5 [0094.508] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0094.508] lstrlenW (lpString=".pdf") returned 4 [0094.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.508] lstrlenW (lpString=".xls") returned 4 [0094.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.508] lstrlenW (lpString=".xlsx") returned 5 [0094.509] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0094.509] lstrlenW (lpString=".ppt") returned 4 [0094.509] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.509] lstrlenW (lpString=".zip") returned 4 [0094.509] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.509] lstrlenW (lpString=".rar") returned 4 [0094.509] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.509] lstrlenW (lpString=".bz2") returned 4 [0094.509] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.509] lstrlenW (lpString=".7z") returned 3 [0094.509] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.509] lstrlenW (lpString=".dbf") returned 4 [0094.509] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.509] lstrlenW (lpString=".1cd") returned 4 [0094.509] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0094.509] lstrlenW (lpString=".jpg") returned 4 [0094.509] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.509] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") [0094.510] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14208) returned 1 [0094.510] CloseHandle (hObject=0x1f0) returned 1 [0094.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 0x20 [0094.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.510] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.511] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.511] GetLastError () returned 0x0 [0094.511] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3780, lpOverlapped=0x0) returned 1 [0094.565] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3790, lpOverlapped=0x0) returned 1 [0094.566] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.566] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0094.566] SetEndOfFile (hFile=0x1c8) returned 1 [0094.566] CloseHandle (hObject=0x1c8) returned 1 [0094.566] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.566] SetEndOfFile (hFile=0x1f0) returned 1 [0094.567] CloseHandle (hObject=0x1f0) returned 1 [0094.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.567] lstrlenW (lpString=".doc") returned 4 [0094.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString=".docx") returned 5 [0094.568] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0094.568] lstrlenW (lpString=".pdf") returned 4 [0094.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString=".xls") returned 4 [0094.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString=".xlsx") returned 5 [0094.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0094.568] lstrlenW (lpString=".ppt") returned 4 [0094.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.568] lstrlenW (lpString=".zip") returned 4 [0094.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString=".rar") returned 4 [0094.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.568] lstrlenW (lpString=".bz2") returned 4 [0094.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.568] lstrlenW (lpString=".7z") returned 3 [0094.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.568] lstrlenW (lpString=".dbf") returned 4 [0094.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.568] lstrlenW (lpString=".1cd") returned 4 [0094.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0094.568] lstrlenW (lpString=".jpg") returned 4 [0094.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.568] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") [0094.569] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=112512) returned 1 [0094.569] CloseHandle (hObject=0x1f0) returned 1 [0094.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe")) returned 0x20 [0094.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.569] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.569] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.570] GetLastError () returned 0x0 [0094.570] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1b780, lpOverlapped=0x0) returned 1 [0094.631] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1b790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1b790, lpOverlapped=0x0) returned 1 [0094.633] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.633] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.633] SetEndOfFile (hFile=0x1c8) returned 1 [0094.633] CloseHandle (hObject=0x1c8) returned 1 [0094.633] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.634] SetEndOfFile (hFile=0x1f0) returned 1 [0094.635] CloseHandle (hObject=0x1f0) returned 1 [0094.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe")) returned 1 [0094.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.635] lstrlenW (lpString=".doc") returned 4 [0094.635] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0094.635] lstrlenW (lpString=".docx") returned 5 [0094.635] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0094.635] lstrlenW (lpString=".pdf") returned 4 [0094.636] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0094.636] lstrlenW (lpString=".xls") returned 4 [0094.636] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0094.636] lstrlenW (lpString=".xlsx") returned 5 [0094.636] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0094.636] lstrlenW (lpString=".ppt") returned 4 [0094.636] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.636] lstrlenW (lpString=".zip") returned 4 [0094.636] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0094.636] lstrlenW (lpString=".rar") returned 4 [0094.636] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0094.636] lstrlenW (lpString=".bz2") returned 4 [0094.636] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0094.636] lstrlenW (lpString=".7z") returned 3 [0094.636] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.636] lstrlenW (lpString=".dbf") returned 4 [0094.636] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.636] lstrlenW (lpString=".1cd") returned 4 [0094.636] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0094.636] lstrlenW (lpString=".jpg") returned 4 [0094.636] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0094.636] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") [0094.637] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9292) returned 1 [0094.637] CloseHandle (hObject=0x1f0) returned 1 [0094.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0094.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.637] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.637] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.640] GetLastError () returned 0x0 [0094.640] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x244c, lpOverlapped=0x0) returned 1 [0094.649] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2450, lpOverlapped=0x0) returned 1 [0094.650] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.650] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.651] SetEndOfFile (hFile=0x1c8) returned 1 [0094.651] CloseHandle (hObject=0x1c8) returned 1 [0094.651] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.651] SetEndOfFile (hFile=0x1f0) returned 1 [0094.660] CloseHandle (hObject=0x1f0) returned 1 [0094.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.660] lstrlenW (lpString=".doc") returned 4 [0094.660] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString=".docx") returned 5 [0094.660] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0094.660] lstrlenW (lpString=".pdf") returned 4 [0094.660] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString=".xls") returned 4 [0094.660] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString=".xlsx") returned 5 [0094.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0094.660] lstrlenW (lpString=".ppt") returned 4 [0094.660] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.660] lstrlenW (lpString=".zip") returned 4 [0094.660] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString=".rar") returned 4 [0094.660] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.660] lstrlenW (lpString=".bz2") returned 4 [0094.661] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.661] lstrlenW (lpString=".7z") returned 3 [0094.661] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.661] lstrlenW (lpString=".dbf") returned 4 [0094.661] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.661] lstrlenW (lpString=".1cd") returned 4 [0094.661] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0094.661] lstrlenW (lpString=".jpg") returned 4 [0094.661] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.661] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") [0094.661] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=58756) returned 1 [0094.661] CloseHandle (hObject=0x1f0) returned 1 [0094.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0094.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.662] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.662] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.662] GetLastError () returned 0x0 [0094.662] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xe584, lpOverlapped=0x0) returned 1 [0094.672] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe590, lpOverlapped=0x0) returned 1 [0094.674] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.674] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.674] SetEndOfFile (hFile=0x1fc) returned 1 [0094.674] CloseHandle (hObject=0x1fc) returned 1 [0094.674] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.674] SetEndOfFile (hFile=0x1f0) returned 1 [0094.675] CloseHandle (hObject=0x1f0) returned 1 [0094.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString=".doc") returned 4 [0094.676] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".docx") returned 5 [0094.676] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0094.676] lstrlenW (lpString=".pdf") returned 4 [0094.676] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".xls") returned 4 [0094.676] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".xlsx") returned 5 [0094.676] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0094.676] lstrlenW (lpString=".ppt") returned 4 [0094.676] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString=".zip") returned 4 [0094.676] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".rar") returned 4 [0094.676] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".bz2") returned 4 [0094.676] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString=".7z") returned 3 [0094.676] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString=".dbf") returned 4 [0094.676] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString=".1cd") returned 4 [0094.676] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0094.676] lstrlenW (lpString=".jpg") returned 4 [0094.676] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.677] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") [0094.677] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=51388) returned 1 [0094.677] CloseHandle (hObject=0x1f0) returned 1 [0094.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0094.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.677] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.677] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.678] GetLastError () returned 0x0 [0094.678] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0094.681] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xc8c0, lpOverlapped=0x0) returned 1 [0094.682] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.682] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.682] SetEndOfFile (hFile=0x1fc) returned 1 [0094.683] CloseHandle (hObject=0x1fc) returned 1 [0094.683] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.683] SetEndOfFile (hFile=0x1f0) returned 1 [0094.684] CloseHandle (hObject=0x1f0) returned 1 [0094.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1 [0094.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.684] lstrlenW (lpString=".doc") returned 4 [0094.684] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.684] lstrlenW (lpString=".docx") returned 5 [0094.684] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0094.684] lstrlenW (lpString=".pdf") returned 4 [0094.684] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.684] lstrlenW (lpString=".xls") returned 4 [0094.684] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.684] lstrlenW (lpString=".xlsx") returned 5 [0094.684] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0094.684] lstrlenW (lpString=".ppt") returned 4 [0094.684] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.685] lstrlenW (lpString=".zip") returned 4 [0094.685] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.685] lstrlenW (lpString=".rar") returned 4 [0094.685] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.685] lstrlenW (lpString=".bz2") returned 4 [0094.685] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.685] lstrlenW (lpString=".7z") returned 3 [0094.685] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.685] lstrlenW (lpString=".dbf") returned 4 [0094.685] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.685] lstrlenW (lpString=".1cd") returned 4 [0094.685] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0094.685] lstrlenW (lpString=".jpg") returned 4 [0094.685] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.685] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") [0094.685] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=27412) returned 1 [0094.686] CloseHandle (hObject=0x1f0) returned 1 [0094.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0094.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.686] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.686] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.687] GetLastError () returned 0x0 [0094.687] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6b14, lpOverlapped=0x0) returned 1 [0094.697] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6b20, lpOverlapped=0x0) returned 1 [0094.699] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.699] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.699] SetEndOfFile (hFile=0x1fc) returned 1 [0094.699] CloseHandle (hObject=0x1fc) returned 1 [0094.699] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.699] SetEndOfFile (hFile=0x1f0) returned 1 [0094.700] CloseHandle (hObject=0x1f0) returned 1 [0094.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1 [0094.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.700] lstrlenW (lpString=".doc") returned 4 [0094.700] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.700] lstrlenW (lpString=".docx") returned 5 [0094.700] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0094.700] lstrlenW (lpString=".pdf") returned 4 [0094.700] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.700] lstrlenW (lpString=".xls") returned 4 [0094.700] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.700] lstrlenW (lpString=".xlsx") returned 5 [0094.700] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0094.700] lstrlenW (lpString=".ppt") returned 4 [0094.700] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.701] lstrlenW (lpString=".zip") returned 4 [0094.701] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.701] lstrlenW (lpString=".rar") returned 4 [0094.701] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.701] lstrlenW (lpString=".bz2") returned 4 [0094.701] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.701] lstrlenW (lpString=".7z") returned 3 [0094.701] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.701] lstrlenW (lpString=".dbf") returned 4 [0094.701] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.701] lstrlenW (lpString=".1cd") returned 4 [0094.701] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0094.701] lstrlenW (lpString=".jpg") returned 4 [0094.701] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.701] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") [0094.702] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=47188) returned 1 [0094.702] CloseHandle (hObject=0x1f0) returned 1 [0094.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0094.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0094.702] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.702] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.702] GetLastError () returned 0x0 [0094.703] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb854, lpOverlapped=0x0) returned 1 [0094.706] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb860, lpOverlapped=0x0) returned 1 [0094.708] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.708] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0094.708] SetEndOfFile (hFile=0x1fc) returned 1 [0094.708] CloseHandle (hObject=0x1fc) returned 1 [0094.708] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.708] SetEndOfFile (hFile=0x1f0) returned 1 [0094.709] CloseHandle (hObject=0x1f0) returned 1 [0094.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1 [0094.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.710] lstrlenW (lpString=".doc") returned 4 [0094.710] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".docx") returned 5 [0094.710] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0094.710] lstrlenW (lpString=".pdf") returned 4 [0094.710] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".xls") returned 4 [0094.710] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".xlsx") returned 5 [0094.710] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0094.710] lstrlenW (lpString=".ppt") returned 4 [0094.710] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.710] lstrlenW (lpString=".zip") returned 4 [0094.710] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".rar") returned 4 [0094.710] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".bz2") returned 4 [0094.710] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString=".7z") returned 3 [0094.710] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.710] lstrlenW (lpString=".dbf") returned 4 [0094.710] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.710] lstrlenW (lpString=".1cd") returned 4 [0094.710] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0094.710] lstrlenW (lpString=".jpg") returned 4 [0094.710] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.710] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") [0095.229] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=57646) returned 1 [0095.229] CloseHandle (hObject=0x1f4) returned 1 [0095.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0095.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.230] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.230] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.333] GetLastError () returned 0x0 [0095.333] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xe12e, lpOverlapped=0x0) returned 1 [0095.359] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe130, lpOverlapped=0x0) returned 1 [0095.360] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.360] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.360] SetEndOfFile (hFile=0x210) returned 1 [0095.361] CloseHandle (hObject=0x210) returned 1 [0095.361] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.361] SetEndOfFile (hFile=0x1f4) returned 1 [0095.362] CloseHandle (hObject=0x1f4) returned 1 [0095.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.362] lstrlenW (lpString=".doc") returned 4 [0095.362] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.362] lstrlenW (lpString=".docx") returned 5 [0095.362] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0095.362] lstrlenW (lpString=".pdf") returned 4 [0095.362] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.362] lstrlenW (lpString=".xls") returned 4 [0095.362] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.362] lstrlenW (lpString=".xlsx") returned 5 [0095.362] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0095.362] lstrlenW (lpString=".ppt") returned 4 [0095.362] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.362] lstrlenW (lpString=".zip") returned 4 [0095.363] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.363] lstrlenW (lpString=".rar") returned 4 [0095.363] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.363] lstrlenW (lpString=".bz2") returned 4 [0095.363] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.363] lstrlenW (lpString=".7z") returned 3 [0095.363] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.363] lstrlenW (lpString=".dbf") returned 4 [0095.363] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.363] lstrlenW (lpString=".1cd") returned 4 [0095.363] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0095.363] lstrlenW (lpString=".jpg") returned 4 [0095.363] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.363] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") [0095.546] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=56514) returned 1 [0095.546] CloseHandle (hObject=0x1f4) returned 1 [0095.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0095.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.547] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.547] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.547] GetLastError () returned 0x0 [0095.547] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xdcc2, lpOverlapped=0x0) returned 1 [0095.552] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xdcd0, lpOverlapped=0x0) returned 1 [0095.554] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.554] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0095.555] SetEndOfFile (hFile=0x1c0) returned 1 [0095.555] CloseHandle (hObject=0x1c0) returned 1 [0095.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.555] SetEndOfFile (hFile=0x1f4) returned 1 [0095.556] CloseHandle (hObject=0x1f4) returned 1 [0095.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1 [0095.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.556] lstrlenW (lpString=".doc") returned 4 [0095.556] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0095.556] lstrlenW (lpString=".docx") returned 5 [0095.556] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0095.556] lstrlenW (lpString=".pdf") returned 4 [0095.556] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0095.556] lstrlenW (lpString=".xls") returned 4 [0095.556] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0095.556] lstrlenW (lpString=".xlsx") returned 5 [0095.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0095.556] lstrlenW (lpString=".ppt") returned 4 [0095.557] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0095.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.557] lstrlenW (lpString=".zip") returned 4 [0095.557] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0095.557] lstrlenW (lpString=".rar") returned 4 [0095.557] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0095.557] lstrlenW (lpString=".bz2") returned 4 [0095.557] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0095.557] lstrlenW (lpString=".7z") returned 3 [0095.557] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0095.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.557] lstrlenW (lpString=".dbf") returned 4 [0095.557] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0095.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.557] lstrlenW (lpString=".1cd") returned 4 [0095.557] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0095.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0095.557] lstrlenW (lpString=".jpg") returned 4 [0095.557] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0095.557] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") [0095.558] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=222592) returned 1 [0095.558] CloseHandle (hObject=0x1f4) returned 1 [0095.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 0x20 [0095.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.559] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.559] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.559] GetLastError () returned 0x0 [0095.559] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x36580, lpOverlapped=0x0) returned 1 [0095.565] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x36590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x36590, lpOverlapped=0x0) returned 1 [0095.569] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.570] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf6, lpOverlapped=0x0) returned 1 [0095.570] SetEndOfFile (hFile=0x1c0) returned 1 [0095.570] CloseHandle (hObject=0x1c0) returned 1 [0095.570] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.570] SetEndOfFile (hFile=0x1f4) returned 1 [0095.572] CloseHandle (hObject=0x1f4) returned 1 [0095.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 1 [0095.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.572] lstrlenW (lpString=".doc") returned 4 [0095.572] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0095.572] lstrlenW (lpString=".docx") returned 5 [0095.572] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0095.572] lstrlenW (lpString=".pdf") returned 4 [0095.572] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0095.572] lstrlenW (lpString=".xls") returned 4 [0095.572] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0095.572] lstrlenW (lpString=".xlsx") returned 5 [0095.572] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0095.573] lstrlenW (lpString=".ppt") returned 4 [0095.573] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0095.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.573] lstrlenW (lpString=".zip") returned 4 [0095.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0095.573] lstrlenW (lpString=".rar") returned 4 [0095.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0095.573] lstrlenW (lpString=".bz2") returned 4 [0095.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0095.573] lstrlenW (lpString=".7z") returned 3 [0095.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0095.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.573] lstrlenW (lpString=".dbf") returned 4 [0095.573] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0095.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.573] lstrlenW (lpString=".1cd") returned 4 [0095.573] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0095.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0095.573] lstrlenW (lpString=".jpg") returned 4 [0095.573] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0095.573] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") [0095.574] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13192) returned 1 [0095.574] CloseHandle (hObject=0x1f4) returned 1 [0095.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 0x20 [0095.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.575] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.575] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.575] GetLastError () returned 0x0 [0095.576] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3388, lpOverlapped=0x0) returned 1 [0095.578] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3390, lpOverlapped=0x0) returned 1 [0095.580] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.580] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.580] SetEndOfFile (hFile=0x1c0) returned 1 [0095.580] CloseHandle (hObject=0x1c0) returned 1 [0095.580] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.580] SetEndOfFile (hFile=0x1f4) returned 1 [0095.581] CloseHandle (hObject=0x1f4) returned 1 [0095.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1 [0095.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.581] lstrlenW (lpString=".doc") returned 4 [0095.581] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0095.581] lstrlenW (lpString=".docx") returned 5 [0095.581] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0095.581] lstrlenW (lpString=".pdf") returned 4 [0095.581] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0095.581] lstrlenW (lpString=".xls") returned 4 [0095.581] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0095.581] lstrlenW (lpString=".xlsx") returned 5 [0095.581] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0095.581] lstrlenW (lpString=".ppt") returned 4 [0095.581] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0095.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.582] lstrlenW (lpString=".zip") returned 4 [0095.582] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0095.582] lstrlenW (lpString=".rar") returned 4 [0095.582] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0095.582] lstrlenW (lpString=".bz2") returned 4 [0095.582] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0095.582] lstrlenW (lpString=".7z") returned 3 [0095.582] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0095.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.582] lstrlenW (lpString=".dbf") returned 4 [0095.582] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0095.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.582] lstrlenW (lpString=".1cd") returned 4 [0095.582] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0095.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0095.582] lstrlenW (lpString=".jpg") returned 4 [0095.582] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0095.582] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") [0095.583] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10144) returned 1 [0095.583] CloseHandle (hObject=0x1f4) returned 1 [0095.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0095.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.584] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.584] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.584] GetLastError () returned 0x0 [0095.584] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x27a0, lpOverlapped=0x0) returned 1 [0095.723] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0095.724] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.724] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.724] SetEndOfFile (hFile=0x1c0) returned 1 [0095.724] CloseHandle (hObject=0x1c0) returned 1 [0095.724] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.724] SetEndOfFile (hFile=0x1f4) returned 1 [0095.725] CloseHandle (hObject=0x1f4) returned 1 [0095.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.738] lstrlenW (lpString=".doc") returned 4 [0095.738] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.738] lstrlenW (lpString=".docx") returned 5 [0095.738] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.738] lstrlenW (lpString=".pdf") returned 4 [0095.738] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.738] lstrlenW (lpString=".xls") returned 4 [0095.739] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.739] lstrlenW (lpString=".xlsx") returned 5 [0095.739] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.739] lstrlenW (lpString=".ppt") returned 4 [0095.739] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.739] lstrlenW (lpString=".zip") returned 4 [0095.739] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.739] lstrlenW (lpString=".rar") returned 4 [0095.739] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.739] lstrlenW (lpString=".bz2") returned 4 [0095.739] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.739] lstrlenW (lpString=".7z") returned 3 [0095.739] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.739] lstrlenW (lpString=".dbf") returned 4 [0095.739] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.739] lstrlenW (lpString=".1cd") returned 4 [0095.739] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0095.739] lstrlenW (lpString=".jpg") returned 4 [0095.739] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.739] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") [0095.740] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10160) returned 1 [0095.740] CloseHandle (hObject=0x16c) returned 1 [0095.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0095.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.740] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.740] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.741] GetLastError () returned 0x0 [0095.741] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x27b0, lpOverlapped=0x0) returned 1 [0095.841] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0095.842] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.842] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.842] SetEndOfFile (hFile=0x19c) returned 1 [0095.842] CloseHandle (hObject=0x19c) returned 1 [0095.843] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.843] SetEndOfFile (hFile=0x16c) returned 1 [0095.843] CloseHandle (hObject=0x16c) returned 1 [0095.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1 [0095.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.844] lstrlenW (lpString=".doc") returned 4 [0095.844] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.844] lstrlenW (lpString=".docx") returned 5 [0095.844] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.844] lstrlenW (lpString=".pdf") returned 4 [0095.844] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.844] lstrlenW (lpString=".xls") returned 4 [0095.844] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.844] lstrlenW (lpString=".xlsx") returned 5 [0095.844] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.844] lstrlenW (lpString=".ppt") returned 4 [0095.844] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.844] lstrlenW (lpString=".zip") returned 4 [0095.844] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.844] lstrlenW (lpString=".rar") returned 4 [0095.844] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.844] lstrlenW (lpString=".bz2") returned 4 [0095.844] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.844] lstrlenW (lpString=".7z") returned 3 [0095.844] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.845] lstrlenW (lpString=".dbf") returned 4 [0095.845] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.845] lstrlenW (lpString=".1cd") returned 4 [0095.845] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0095.845] lstrlenW (lpString=".jpg") returned 4 [0095.845] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.845] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") [0095.845] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10672) returned 1 [0095.845] CloseHandle (hObject=0x16c) returned 1 [0095.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0095.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.846] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.846] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.898] GetLastError () returned 0x0 [0095.898] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x29b0, lpOverlapped=0x0) returned 1 [0095.900] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x29c0, lpOverlapped=0x0) returned 1 [0095.901] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.901] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.901] SetEndOfFile (hFile=0x210) returned 1 [0095.901] CloseHandle (hObject=0x210) returned 1 [0095.901] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.901] SetEndOfFile (hFile=0x16c) returned 1 [0095.902] CloseHandle (hObject=0x16c) returned 1 [0095.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.902] lstrlenW (lpString=".doc") returned 4 [0095.902] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.903] lstrlenW (lpString=".docx") returned 5 [0095.903] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.903] lstrlenW (lpString=".pdf") returned 4 [0095.903] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.903] lstrlenW (lpString=".xls") returned 4 [0095.903] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.903] lstrlenW (lpString=".xlsx") returned 5 [0095.903] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.903] lstrlenW (lpString=".ppt") returned 4 [0095.903] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.903] lstrlenW (lpString=".zip") returned 4 [0095.903] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.903] lstrlenW (lpString=".rar") returned 4 [0095.903] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.903] lstrlenW (lpString=".bz2") returned 4 [0095.903] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.903] lstrlenW (lpString=".7z") returned 3 [0095.903] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.903] lstrlenW (lpString=".dbf") returned 4 [0095.903] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.903] lstrlenW (lpString=".1cd") returned 4 [0095.903] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0095.903] lstrlenW (lpString=".jpg") returned 4 [0095.903] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.903] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") [0095.904] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=11144) returned 1 [0095.904] CloseHandle (hObject=0x16c) returned 1 [0095.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0095.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.905] GetLastError () returned 0x0 [0095.905] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2b88, lpOverlapped=0x0) returned 1 [0095.907] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0095.908] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.908] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0095.908] SetEndOfFile (hFile=0x210) returned 1 [0095.908] CloseHandle (hObject=0x210) returned 1 [0095.908] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.908] SetEndOfFile (hFile=0x16c) returned 1 [0095.909] CloseHandle (hObject=0x16c) returned 1 [0095.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1 [0095.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.909] lstrlenW (lpString=".doc") returned 4 [0095.909] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0095.909] lstrlenW (lpString=".docx") returned 5 [0095.909] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0095.909] lstrlenW (lpString=".pdf") returned 4 [0095.909] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0095.909] lstrlenW (lpString=".xls") returned 4 [0095.910] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0095.910] lstrlenW (lpString=".xlsx") returned 5 [0095.910] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0095.910] lstrlenW (lpString=".ppt") returned 4 [0095.910] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0095.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.910] lstrlenW (lpString=".zip") returned 4 [0095.910] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0095.910] lstrlenW (lpString=".rar") returned 4 [0095.910] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0095.910] lstrlenW (lpString=".bz2") returned 4 [0095.910] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0095.910] lstrlenW (lpString=".7z") returned 3 [0095.910] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0095.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.910] lstrlenW (lpString=".dbf") returned 4 [0095.910] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0095.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.910] lstrlenW (lpString=".1cd") returned 4 [0095.910] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0095.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0095.910] lstrlenW (lpString=".jpg") returned 4 [0095.910] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0095.910] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") [0095.911] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13712) returned 1 [0095.911] CloseHandle (hObject=0x16c) returned 1 [0095.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20 [0095.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.912] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.912] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.912] GetLastError () returned 0x0 [0095.912] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3590, lpOverlapped=0x0) returned 1 [0095.914] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x35a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x35a0, lpOverlapped=0x0) returned 1 [0095.915] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.915] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.915] SetEndOfFile (hFile=0x210) returned 1 [0095.915] CloseHandle (hObject=0x210) returned 1 [0095.915] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.915] SetEndOfFile (hFile=0x16c) returned 1 [0095.916] CloseHandle (hObject=0x16c) returned 1 [0095.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 1 [0095.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.917] lstrlenW (lpString=".doc") returned 4 [0095.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString=".docx") returned 5 [0095.917] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0095.917] lstrlenW (lpString=".pdf") returned 4 [0095.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString=".xls") returned 4 [0095.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString=".xlsx") returned 5 [0095.917] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0095.917] lstrlenW (lpString=".ppt") returned 4 [0095.917] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.917] lstrlenW (lpString=".zip") returned 4 [0095.917] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString=".rar") returned 4 [0095.917] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.917] lstrlenW (lpString=".bz2") returned 4 [0095.917] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.917] lstrlenW (lpString=".7z") returned 3 [0095.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.917] lstrlenW (lpString=".dbf") returned 4 [0095.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.917] lstrlenW (lpString=".1cd") returned 4 [0095.917] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0095.918] lstrlenW (lpString=".jpg") returned 4 [0095.918] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.918] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") [0095.918] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=90488) returned 1 [0095.918] CloseHandle (hObject=0x16c) returned 1 [0095.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0095.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.918] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.919] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.919] GetLastError () returned 0x0 [0095.919] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x16178, lpOverlapped=0x0) returned 1 [0095.922] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x16180, lpOverlapped=0x0) returned 1 [0095.924] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0095.925] SetEndOfFile (hFile=0x210) returned 1 [0095.925] CloseHandle (hObject=0x210) returned 1 [0095.925] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.925] SetEndOfFile (hFile=0x16c) returned 1 [0095.926] CloseHandle (hObject=0x16c) returned 1 [0095.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1 [0095.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.927] lstrlenW (lpString=".doc") returned 4 [0095.927] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString=".docx") returned 5 [0095.927] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0095.927] lstrlenW (lpString=".pdf") returned 4 [0095.927] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString=".xls") returned 4 [0095.927] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0095.927] lstrlenW (lpString=".xlsx") returned 5 [0095.927] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0095.927] lstrlenW (lpString=".ppt") returned 4 [0095.927] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.927] lstrlenW (lpString=".zip") returned 4 [0095.927] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0095.927] lstrlenW (lpString=".rar") returned 4 [0095.927] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString=".bz2") returned 4 [0095.927] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString=".7z") returned 3 [0095.927] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.927] lstrlenW (lpString=".dbf") returned 4 [0095.927] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.927] lstrlenW (lpString=".1cd") returned 4 [0095.927] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0095.927] lstrlenW (lpString=".jpg") returned 4 [0095.927] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0095.927] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") [0095.928] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=31120) returned 1 [0095.928] CloseHandle (hObject=0x16c) returned 1 [0095.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0095.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.928] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.928] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.929] GetLastError () returned 0x0 [0095.929] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x7990, lpOverlapped=0x0) returned 1 [0095.931] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0095.933] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.933] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.933] SetEndOfFile (hFile=0x210) returned 1 [0095.933] CloseHandle (hObject=0x210) returned 1 [0095.933] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.933] SetEndOfFile (hFile=0x16c) returned 1 [0095.934] CloseHandle (hObject=0x16c) returned 1 [0095.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1 [0095.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0095.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0095.934] lstrlenW (lpString=".doc") returned 4 [0095.934] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.934] lstrlenW (lpString=".docx") returned 5 [0095.934] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0095.934] lstrlenW (lpString=".pdf") returned 4 [0095.934] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.934] lstrlenW (lpString=".xls") returned 4 [0095.934] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.934] lstrlenW (lpString=".xlsx") returned 5 [0095.934] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0095.935] lstrlenW (lpString=".ppt") returned 4 [0095.935] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0095.935] lstrlenW (lpString=".zip") returned 4 [0095.935] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.935] lstrlenW (lpString=".rar") returned 4 [0095.935] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.935] lstrlenW (lpString=".bz2") returned 4 [0095.935] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.935] lstrlenW (lpString=".7z") returned 3 [0095.935] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0095.935] lstrlenW (lpString=".dbf") returned 4 [0095.935] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0095.935] lstrlenW (lpString=".1cd") returned 4 [0095.935] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0096.009] lstrlenW (lpString=".jpg") returned 4 [0096.009] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.009] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") [0096.041] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=133024) returned 1 [0096.041] CloseHandle (hObject=0x1f4) returned 1 [0096.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0096.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.048] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.048] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.057] GetLastError () returned 0x0 [0096.057] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x207a0, lpOverlapped=0x0) returned 1 [0096.061] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x207b0, lpOverlapped=0x0) returned 1 [0096.064] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.064] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.064] SetEndOfFile (hFile=0x19c) returned 1 [0096.064] CloseHandle (hObject=0x19c) returned 1 [0096.064] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.064] SetEndOfFile (hFile=0x1f4) returned 1 [0096.066] CloseHandle (hObject=0x1f4) returned 1 [0096.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1 [0096.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.066] lstrlenW (lpString=".doc") returned 4 [0096.066] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.066] lstrlenW (lpString=".docx") returned 5 [0096.066] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0096.066] lstrlenW (lpString=".pdf") returned 4 [0096.066] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.066] lstrlenW (lpString=".xls") returned 4 [0096.066] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.066] lstrlenW (lpString=".xlsx") returned 5 [0096.066] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0096.067] lstrlenW (lpString=".ppt") returned 4 [0096.067] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.067] lstrlenW (lpString=".zip") returned 4 [0096.067] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.067] lstrlenW (lpString=".rar") returned 4 [0096.067] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.067] lstrlenW (lpString=".bz2") returned 4 [0096.067] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.067] lstrlenW (lpString=".7z") returned 3 [0096.067] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.067] lstrlenW (lpString=".dbf") returned 4 [0096.067] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.067] lstrlenW (lpString=".1cd") returned 4 [0096.067] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0096.067] lstrlenW (lpString=".jpg") returned 4 [0096.067] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.067] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") [0096.068] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=63384) returned 1 [0096.068] CloseHandle (hObject=0x1f4) returned 1 [0096.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0096.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.069] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.069] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.069] GetLastError () returned 0x0 [0096.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf798, lpOverlapped=0x0) returned 1 [0096.074] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf7a0, lpOverlapped=0x0) returned 1 [0096.076] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.076] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.077] SetEndOfFile (hFile=0x19c) returned 1 [0096.077] CloseHandle (hObject=0x19c) returned 1 [0096.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.077] SetEndOfFile (hFile=0x1f4) returned 1 [0096.078] CloseHandle (hObject=0x1f4) returned 1 [0096.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1 [0096.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.078] lstrlenW (lpString=".doc") returned 4 [0096.078] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.078] lstrlenW (lpString=".docx") returned 5 [0096.078] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0096.079] lstrlenW (lpString=".pdf") returned 4 [0096.079] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.079] lstrlenW (lpString=".xls") returned 4 [0096.079] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.079] lstrlenW (lpString=".xlsx") returned 5 [0096.079] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0096.079] lstrlenW (lpString=".ppt") returned 4 [0096.079] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.079] lstrlenW (lpString=".zip") returned 4 [0096.079] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.079] lstrlenW (lpString=".rar") returned 4 [0096.079] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.079] lstrlenW (lpString=".bz2") returned 4 [0096.079] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.079] lstrlenW (lpString=".7z") returned 3 [0096.079] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.079] lstrlenW (lpString=".dbf") returned 4 [0096.079] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.079] lstrlenW (lpString=".1cd") returned 4 [0096.079] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0096.079] lstrlenW (lpString=".jpg") returned 4 [0096.079] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.079] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") [0096.081] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=52120) returned 1 [0096.081] CloseHandle (hObject=0x1ec) returned 1 [0096.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0096.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.081] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.081] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.082] GetLastError () returned 0x0 [0096.082] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xcb98, lpOverlapped=0x0) returned 1 [0096.085] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xcba0, lpOverlapped=0x0) returned 1 [0096.086] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.086] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.086] SetEndOfFile (hFile=0x1f4) returned 1 [0096.086] CloseHandle (hObject=0x1f4) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.087] SetEndOfFile (hFile=0x1ec) returned 1 [0096.088] CloseHandle (hObject=0x1ec) returned 1 [0096.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.088] lstrlenW (lpString=".doc") returned 4 [0096.088] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.088] lstrlenW (lpString=".docx") returned 5 [0096.088] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0096.088] lstrlenW (lpString=".pdf") returned 4 [0096.088] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.088] lstrlenW (lpString=".xls") returned 4 [0096.088] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.088] lstrlenW (lpString=".xlsx") returned 5 [0096.088] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0096.088] lstrlenW (lpString=".ppt") returned 4 [0096.088] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.088] lstrlenW (lpString=".zip") returned 4 [0096.088] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.088] lstrlenW (lpString=".rar") returned 4 [0096.089] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.089] lstrlenW (lpString=".bz2") returned 4 [0096.089] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.089] lstrlenW (lpString=".7z") returned 3 [0096.089] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.089] lstrlenW (lpString=".dbf") returned 4 [0096.089] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.089] lstrlenW (lpString=".1cd") returned 4 [0096.089] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0096.089] lstrlenW (lpString=".jpg") returned 4 [0096.089] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.089] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") [0096.090] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=115608) returned 1 [0096.090] CloseHandle (hObject=0x1ec) returned 1 [0096.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0096.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.090] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.090] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.098] GetLastError () returned 0x0 [0096.098] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1c398, lpOverlapped=0x0) returned 1 [0096.103] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1c3a0, lpOverlapped=0x0) returned 1 [0096.106] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.106] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.106] SetEndOfFile (hFile=0x1f4) returned 1 [0096.106] CloseHandle (hObject=0x1f4) returned 1 [0096.106] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.106] SetEndOfFile (hFile=0x1ec) returned 1 [0096.108] CloseHandle (hObject=0x1ec) returned 1 [0096.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1 [0096.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.108] lstrlenW (lpString=".doc") returned 4 [0096.108] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0096.108] lstrlenW (lpString=".docx") returned 5 [0096.108] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0096.108] lstrlenW (lpString=".pdf") returned 4 [0096.108] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0096.108] lstrlenW (lpString=".xls") returned 4 [0096.108] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0096.108] lstrlenW (lpString=".xlsx") returned 5 [0096.108] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0096.108] lstrlenW (lpString=".ppt") returned 4 [0096.108] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0096.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.108] lstrlenW (lpString=".zip") returned 4 [0096.109] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0096.109] lstrlenW (lpString=".rar") returned 4 [0096.109] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0096.109] lstrlenW (lpString=".bz2") returned 4 [0096.109] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0096.109] lstrlenW (lpString=".7z") returned 3 [0096.109] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0096.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.109] lstrlenW (lpString=".dbf") returned 4 [0096.109] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0096.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.109] lstrlenW (lpString=".1cd") returned 4 [0096.109] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0096.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0096.109] lstrlenW (lpString=".jpg") returned 4 [0096.109] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0096.109] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") [0096.124] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=63864) returned 1 [0096.124] CloseHandle (hObject=0x1c8) returned 1 [0096.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0096.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0096.124] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.124] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0096.134] GetLastError () returned 0x0 [0096.134] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf978, lpOverlapped=0x0) returned 1 [0096.156] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf980, lpOverlapped=0x0) returned 1 [0096.161] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.161] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe2, lpOverlapped=0x0) returned 1 [0096.161] SetEndOfFile (hFile=0x158) returned 1 [0096.162] CloseHandle (hObject=0x158) returned 1 [0096.162] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.162] SetEndOfFile (hFile=0x1c8) returned 1 [0096.163] CloseHandle (hObject=0x1c8) returned 1 [0096.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1 [0096.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.164] lstrlenW (lpString=".doc") returned 4 [0096.164] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.164] lstrlenW (lpString=".docx") returned 5 [0096.164] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0096.164] lstrlenW (lpString=".pdf") returned 4 [0096.164] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.164] lstrlenW (lpString=".xls") returned 4 [0096.164] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.164] lstrlenW (lpString=".xlsx") returned 5 [0096.164] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0096.164] lstrlenW (lpString=".ppt") returned 4 [0096.164] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.164] lstrlenW (lpString=".zip") returned 4 [0096.164] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.164] lstrlenW (lpString=".rar") returned 4 [0096.164] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.165] lstrlenW (lpString=".bz2") returned 4 [0096.165] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.165] lstrlenW (lpString=".7z") returned 3 [0096.165] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.165] lstrlenW (lpString=".dbf") returned 4 [0096.165] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.165] lstrlenW (lpString=".1cd") returned 4 [0096.165] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0096.165] lstrlenW (lpString=".jpg") returned 4 [0096.165] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.165] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") [0096.166] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=766384) returned 1 [0096.166] CloseHandle (hObject=0x1c8) returned 1 [0096.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 0x20 [0096.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0096.167] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.167] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0096.168] GetLastError () returned 0x0 [0096.168] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb1b0, lpOverlapped=0x0) returned 1 [0096.376] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbb1c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbb1c0, lpOverlapped=0x0) returned 1 [0096.390] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.390] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0096.390] SetEndOfFile (hFile=0x158) returned 1 [0096.390] CloseHandle (hObject=0x158) returned 1 [0096.390] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.390] SetEndOfFile (hFile=0x1c8) returned 1 [0096.396] CloseHandle (hObject=0x1c8) returned 1 [0096.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 1 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString=".doc") returned 4 [0096.397] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString=".docx") returned 5 [0096.397] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0096.397] lstrlenW (lpString=".pdf") returned 4 [0096.397] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString=".xls") returned 4 [0096.397] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString=".xlsx") returned 5 [0096.397] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0096.397] lstrlenW (lpString=".ppt") returned 4 [0096.397] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString=".zip") returned 4 [0096.397] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString=".rar") returned 4 [0096.397] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.397] lstrlenW (lpString=".bz2") returned 4 [0096.397] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.397] lstrlenW (lpString=".7z") returned 3 [0096.397] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString=".dbf") returned 4 [0096.397] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString=".1cd") returned 4 [0096.397] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0096.397] lstrlenW (lpString=".jpg") returned 4 [0096.398] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.398] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") [0096.399] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1197432) returned 1 [0096.399] CloseHandle (hObject=0x1c8) returned 1 [0096.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 0x20 [0096.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0096.399] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.399] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0096.400] GetLastError () returned 0x0 [0096.400] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0096.445] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x24588, lpOverlapped=0x0) returned 1 [0096.687] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x24590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x24590, lpOverlapped=0x0) returned 1 [0096.692] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.692] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.692] SetEndOfFile (hFile=0x158) returned 1 [0096.692] CloseHandle (hObject=0x158) returned 1 [0096.692] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.692] SetEndOfFile (hFile=0x1c8) returned 1 [0096.694] CloseHandle (hObject=0x1c8) returned 1 [0096.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 1 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString=".doc") returned 4 [0096.695] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString=".docx") returned 5 [0096.695] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0096.695] lstrlenW (lpString=".pdf") returned 4 [0096.695] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString=".xls") returned 4 [0096.695] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString=".xlsx") returned 5 [0096.695] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0096.695] lstrlenW (lpString=".ppt") returned 4 [0096.695] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString=".zip") returned 4 [0096.695] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString=".rar") returned 4 [0096.695] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.695] lstrlenW (lpString=".bz2") returned 4 [0096.695] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.695] lstrlenW (lpString=".7z") returned 3 [0096.695] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString=".dbf") returned 4 [0096.695] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString=".1cd") returned 4 [0096.695] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0096.695] lstrlenW (lpString=".jpg") returned 4 [0096.695] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.696] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") [0096.697] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=221536) returned 1 [0096.697] CloseHandle (hObject=0x1c8) returned 1 [0096.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll")) returned 0x20 [0096.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0096.697] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.697] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0096.698] GetLastError () returned 0x0 [0096.698] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x36160, lpOverlapped=0x0) returned 1 [0096.703] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x36170, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x36170, lpOverlapped=0x0) returned 1 [0096.707] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0096.707] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.707] SetEndOfFile (hFile=0x158) returned 1 [0096.707] CloseHandle (hObject=0x158) returned 1 [0096.708] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.708] SetEndOfFile (hFile=0x1c8) returned 1 [0096.710] CloseHandle (hObject=0x1c8) returned 1 [0096.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll")) returned 1 [0096.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.710] lstrlenW (lpString=".doc") returned 4 [0096.710] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.710] lstrlenW (lpString=".docx") returned 5 [0096.710] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0096.710] lstrlenW (lpString=".pdf") returned 4 [0096.710] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.710] lstrlenW (lpString=".xls") returned 4 [0096.710] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.710] lstrlenW (lpString=".xlsx") returned 5 [0096.710] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0096.710] lstrlenW (lpString=".ppt") returned 4 [0096.710] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.710] lstrlenW (lpString=".zip") returned 4 [0096.710] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.710] lstrlenW (lpString=".rar") returned 4 [0096.710] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.711] lstrlenW (lpString=".bz2") returned 4 [0096.711] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.711] lstrlenW (lpString=".7z") returned 3 [0096.711] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.711] lstrlenW (lpString=".dbf") returned 4 [0096.711] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.711] lstrlenW (lpString=".1cd") returned 4 [0096.711] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 53 [0096.711] lstrlenW (lpString=".jpg") returned 4 [0096.711] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.711] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") [0096.712] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9387368) returned 1 [0096.712] CloseHandle (hObject=0x1c8) returned 1 [0096.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll")) returned 0x20 [0096.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0096.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0096.714] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0096.715] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0096.715] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.844] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x2fbf22, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0096.844] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.855] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0096.855] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x8b3d68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0096.855] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.872] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0096.872] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0097.008] SetEndOfFile (hFile=0x1c8) returned 1 [0097.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0097.045] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0097.045] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.046] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x2fbf22, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0097.046] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.051] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x8b3d68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0097.051] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.053] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0097.053] CloseHandle (hObject=0x1c8) returned 1 [0097.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.053] lstrlenW (lpString=".doc") returned 4 [0097.053] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.053] lstrlenW (lpString=".docx") returned 5 [0097.053] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0097.053] lstrlenW (lpString=".pdf") returned 4 [0097.053] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.053] lstrlenW (lpString=".xls") returned 4 [0097.054] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.054] lstrlenW (lpString=".xlsx") returned 5 [0097.054] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0097.054] lstrlenW (lpString=".ppt") returned 4 [0097.054] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.054] lstrlenW (lpString=".zip") returned 4 [0097.054] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.054] lstrlenW (lpString=".rar") returned 4 [0097.054] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.054] lstrlenW (lpString=".bz2") returned 4 [0097.054] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.054] lstrlenW (lpString=".7z") returned 3 [0097.054] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.054] lstrlenW (lpString=".dbf") returned 4 [0097.054] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.054] lstrlenW (lpString=".1cd") returned 4 [0097.054] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0097.054] lstrlenW (lpString=".jpg") returned 4 [0097.054] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.054] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") [0097.089] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=62336) returned 1 [0097.089] CloseHandle (hObject=0x1c0) returned 1 [0097.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 0x20 [0097.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.089] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.089] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.090] GetLastError () returned 0x0 [0097.090] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf380, lpOverlapped=0x0) returned 1 [0097.228] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf390, lpOverlapped=0x0) returned 1 [0097.230] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0097.230] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0097.231] SetEndOfFile (hFile=0x19c) returned 1 [0097.231] CloseHandle (hObject=0x19c) returned 1 [0097.231] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.231] SetEndOfFile (hFile=0x1c0) returned 1 [0097.232] CloseHandle (hObject=0x1c0) returned 1 [0097.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 1 [0097.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.233] lstrlenW (lpString=".doc") returned 4 [0097.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString=".docx") returned 5 [0097.233] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0097.233] lstrlenW (lpString=".pdf") returned 4 [0097.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString=".xls") returned 4 [0097.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString=".xlsx") returned 5 [0097.233] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0097.233] lstrlenW (lpString=".ppt") returned 4 [0097.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.233] lstrlenW (lpString=".zip") returned 4 [0097.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString=".rar") returned 4 [0097.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.233] lstrlenW (lpString=".bz2") returned 4 [0097.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.234] lstrlenW (lpString=".7z") returned 3 [0097.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.234] lstrlenW (lpString=".dbf") returned 4 [0097.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.234] lstrlenW (lpString=".1cd") returned 4 [0097.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0097.234] lstrlenW (lpString=".jpg") returned 4 [0097.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.234] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") [0097.235] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1196) returned 1 [0097.235] CloseHandle (hObject=0x1c0) returned 1 [0097.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 0x20 [0097.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.235] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.235] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.236] GetLastError () returned 0x0 [0097.236] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4ac, lpOverlapped=0x0) returned 1 [0097.284] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0097.284] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0097.285] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf8, lpOverlapped=0x0) returned 1 [0097.285] SetEndOfFile (hFile=0x19c) returned 1 [0097.291] CloseHandle (hObject=0x19c) returned 1 [0097.292] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.292] SetEndOfFile (hFile=0x1c0) returned 1 [0097.297] CloseHandle (hObject=0x1c0) returned 1 [0097.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1 [0097.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.371] lstrlenW (lpString=".doc") returned 4 [0097.371] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0097.371] lstrlenW (lpString=".docx") returned 5 [0097.371] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0097.371] lstrlenW (lpString=".pdf") returned 4 [0097.372] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0097.372] lstrlenW (lpString=".xls") returned 4 [0097.372] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0097.401] lstrlenW (lpString=".xlsx") returned 5 [0097.401] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0097.401] lstrlenW (lpString=".ppt") returned 4 [0097.401] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.401] lstrlenW (lpString=".zip") returned 4 [0097.401] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0097.401] lstrlenW (lpString=".rar") returned 4 [0097.401] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0097.401] lstrlenW (lpString=".bz2") returned 4 [0097.401] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0097.401] lstrlenW (lpString=".7z") returned 3 [0097.401] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0097.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.402] lstrlenW (lpString=".dbf") returned 4 [0097.402] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0097.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.417] lstrlenW (lpString=".1cd") returned 4 [0097.417] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0097.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0097.417] lstrlenW (lpString=".jpg") returned 4 [0097.417] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0097.417] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") [0097.418] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1621864) returned 1 [0097.418] CloseHandle (hObject=0x1c0) returned 1 [0097.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0x20 [0097.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0097.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.420] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0097.420] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0097.420] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.459] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x83fcd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0097.459] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.519] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0097.520] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x14bf68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0097.520] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.543] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0097.543] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0098.069] SetEndOfFile (hFile=0x1c0) returned 1 [0098.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0098.069] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0098.070] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x83fcd, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0098.073] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x14bf68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0098.073] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0098.075] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0098.075] CloseHandle (hObject=0x1c0) returned 1 [0098.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.075] lstrlenW (lpString=".doc") returned 4 [0098.075] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString=".docx") returned 5 [0098.075] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0098.075] lstrlenW (lpString=".pdf") returned 4 [0098.075] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString=".xls") returned 4 [0098.075] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString=".xlsx") returned 5 [0098.075] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0098.075] lstrlenW (lpString=".ppt") returned 4 [0098.075] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.075] lstrlenW (lpString=".zip") returned 4 [0098.075] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString=".rar") returned 4 [0098.075] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.075] lstrlenW (lpString=".bz2") returned 4 [0098.075] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.075] lstrlenW (lpString=".7z") returned 3 [0098.075] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.076] lstrlenW (lpString=".dbf") returned 4 [0098.076] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.076] lstrlenW (lpString=".1cd") returned 4 [0098.076] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0098.076] lstrlenW (lpString=".jpg") returned 4 [0098.076] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.076] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") [0098.076] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.076] CloseHandle (hObject=0x1c0) returned 1 [0098.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 0x20 [0098.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.077] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.077] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.077] GetLastError () returned 0x0 [0098.078] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.079] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.080] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.080] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.080] SetEndOfFile (hFile=0x210) returned 1 [0098.080] CloseHandle (hObject=0x210) returned 1 [0098.080] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.080] SetEndOfFile (hFile=0x1c0) returned 1 [0098.081] CloseHandle (hObject=0x1c0) returned 1 [0098.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 1 [0098.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.082] lstrlenW (lpString=".doc") returned 4 [0098.082] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.082] lstrlenW (lpString=".docx") returned 5 [0098.082] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.082] lstrlenW (lpString=".pdf") returned 4 [0098.082] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.082] lstrlenW (lpString=".xls") returned 4 [0098.082] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.082] lstrlenW (lpString=".xlsx") returned 5 [0098.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.082] lstrlenW (lpString=".ppt") returned 4 [0098.082] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.082] lstrlenW (lpString=".zip") returned 4 [0098.082] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.082] lstrlenW (lpString=".rar") returned 4 [0098.082] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.082] lstrlenW (lpString=".bz2") returned 4 [0098.082] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.082] lstrlenW (lpString=".7z") returned 3 [0098.082] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.082] lstrlenW (lpString=".dbf") returned 4 [0098.082] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.082] lstrlenW (lpString=".1cd") returned 4 [0098.082] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0098.082] lstrlenW (lpString=".jpg") returned 4 [0098.082] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.082] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") [0098.083] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.083] CloseHandle (hObject=0x1c0) returned 1 [0098.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 0x20 [0098.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.084] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.084] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.085] GetLastError () returned 0x0 [0098.085] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.086] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.087] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.087] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.087] SetEndOfFile (hFile=0x210) returned 1 [0098.088] CloseHandle (hObject=0x210) returned 1 [0098.088] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.088] SetEndOfFile (hFile=0x1c0) returned 1 [0098.089] CloseHandle (hObject=0x1c0) returned 1 [0098.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 1 [0098.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.089] lstrlenW (lpString=".doc") returned 4 [0098.089] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.089] lstrlenW (lpString=".docx") returned 5 [0098.089] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.089] lstrlenW (lpString=".pdf") returned 4 [0098.089] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.089] lstrlenW (lpString=".xls") returned 4 [0098.089] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.089] lstrlenW (lpString=".xlsx") returned 5 [0098.089] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.089] lstrlenW (lpString=".ppt") returned 4 [0098.089] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.090] lstrlenW (lpString=".zip") returned 4 [0098.090] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.090] lstrlenW (lpString=".rar") returned 4 [0098.090] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.090] lstrlenW (lpString=".bz2") returned 4 [0098.090] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.090] lstrlenW (lpString=".7z") returned 3 [0098.090] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.090] lstrlenW (lpString=".dbf") returned 4 [0098.090] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.090] lstrlenW (lpString=".1cd") returned 4 [0098.090] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0098.090] lstrlenW (lpString=".jpg") returned 4 [0098.090] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.090] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") [0098.091] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=838) returned 1 [0098.091] CloseHandle (hObject=0x1c0) returned 1 [0098.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20 [0098.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.091] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.091] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.092] GetLastError () returned 0x0 [0098.092] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x346, lpOverlapped=0x0) returned 1 [0098.208] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x350, lpOverlapped=0x0) returned 1 [0098.209] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.209] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.209] SetEndOfFile (hFile=0x210) returned 1 [0098.216] CloseHandle (hObject=0x210) returned 1 [0098.216] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.216] SetEndOfFile (hFile=0x1c0) returned 1 [0098.217] CloseHandle (hObject=0x1c0) returned 1 [0098.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 1 [0098.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.286] lstrlenW (lpString=".doc") returned 4 [0098.286] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.286] lstrlenW (lpString=".docx") returned 5 [0098.286] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0098.286] lstrlenW (lpString=".pdf") returned 4 [0098.286] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.286] lstrlenW (lpString=".xls") returned 4 [0098.286] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.286] lstrlenW (lpString=".xlsx") returned 5 [0098.286] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0098.292] lstrlenW (lpString=".ppt") returned 4 [0098.294] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.294] lstrlenW (lpString=".zip") returned 4 [0098.294] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.294] lstrlenW (lpString=".rar") returned 4 [0098.294] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.295] lstrlenW (lpString=".bz2") returned 4 [0098.295] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.295] lstrlenW (lpString=".7z") returned 3 [0098.295] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.295] lstrlenW (lpString=".dbf") returned 4 [0098.295] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.295] lstrlenW (lpString=".1cd") returned 4 [0098.295] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0098.295] lstrlenW (lpString=".jpg") returned 4 [0098.295] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.295] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") [0098.392] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10134) returned 1 [0098.392] CloseHandle (hObject=0x210) returned 1 [0098.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 0x20 [0098.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.392] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.392] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.393] GetLastError () returned 0x0 [0098.393] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2796, lpOverlapped=0x0) returned 1 [0098.394] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0098.395] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.395] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.396] SetEndOfFile (hFile=0x1ec) returned 1 [0098.396] CloseHandle (hObject=0x1ec) returned 1 [0098.396] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.396] SetEndOfFile (hFile=0x210) returned 1 [0098.397] CloseHandle (hObject=0x210) returned 1 [0098.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 1 [0098.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.397] lstrlenW (lpString=".doc") returned 4 [0098.397] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.397] lstrlenW (lpString=".docx") returned 5 [0098.397] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.397] lstrlenW (lpString=".pdf") returned 4 [0098.397] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.397] lstrlenW (lpString=".xls") returned 4 [0098.397] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.397] lstrlenW (lpString=".xlsx") returned 5 [0098.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.397] lstrlenW (lpString=".ppt") returned 4 [0098.397] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.397] lstrlenW (lpString=".zip") returned 4 [0098.397] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.397] lstrlenW (lpString=".rar") returned 4 [0098.397] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.397] lstrlenW (lpString=".bz2") returned 4 [0098.397] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.398] lstrlenW (lpString=".7z") returned 3 [0098.398] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.398] lstrlenW (lpString=".dbf") returned 4 [0098.398] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.398] lstrlenW (lpString=".1cd") returned 4 [0098.398] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0098.398] lstrlenW (lpString=".jpg") returned 4 [0098.398] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.398] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") [0098.398] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.398] CloseHandle (hObject=0x210) returned 1 [0098.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 0x20 [0098.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.399] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.399] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.399] GetLastError () returned 0x0 [0098.399] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.401] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.402] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.402] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.402] SetEndOfFile (hFile=0x1ec) returned 1 [0098.402] CloseHandle (hObject=0x1ec) returned 1 [0098.402] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.402] SetEndOfFile (hFile=0x210) returned 1 [0098.403] CloseHandle (hObject=0x210) returned 1 [0098.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 1 [0098.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString=".doc") returned 4 [0098.404] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.404] lstrlenW (lpString=".docx") returned 5 [0098.404] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.404] lstrlenW (lpString=".pdf") returned 4 [0098.404] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.404] lstrlenW (lpString=".xls") returned 4 [0098.404] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.404] lstrlenW (lpString=".xlsx") returned 5 [0098.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.404] lstrlenW (lpString=".ppt") returned 4 [0098.404] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString=".zip") returned 4 [0098.404] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.404] lstrlenW (lpString=".rar") returned 4 [0098.404] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.404] lstrlenW (lpString=".bz2") returned 4 [0098.404] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.404] lstrlenW (lpString=".7z") returned 3 [0098.404] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString=".dbf") returned 4 [0098.404] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString=".1cd") returned 4 [0098.404] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0098.404] lstrlenW (lpString=".jpg") returned 4 [0098.404] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.404] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") [0098.405] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.405] CloseHandle (hObject=0x210) returned 1 [0098.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 0x20 [0098.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.405] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.405] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.406] GetLastError () returned 0x0 [0098.406] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.408] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.408] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.408] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.409] SetEndOfFile (hFile=0x1ec) returned 1 [0098.409] CloseHandle (hObject=0x1ec) returned 1 [0098.409] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.409] SetEndOfFile (hFile=0x210) returned 1 [0098.410] CloseHandle (hObject=0x210) returned 1 [0098.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 1 [0098.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.410] lstrlenW (lpString=".doc") returned 4 [0098.410] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.410] lstrlenW (lpString=".docx") returned 5 [0098.410] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.410] lstrlenW (lpString=".pdf") returned 4 [0098.410] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.410] lstrlenW (lpString=".xls") returned 4 [0098.410] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.410] lstrlenW (lpString=".xlsx") returned 5 [0098.410] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.410] lstrlenW (lpString=".ppt") returned 4 [0098.410] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.410] lstrlenW (lpString=".zip") returned 4 [0098.410] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.410] lstrlenW (lpString=".rar") returned 4 [0098.410] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.411] lstrlenW (lpString=".bz2") returned 4 [0098.411] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.411] lstrlenW (lpString=".7z") returned 3 [0098.411] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.411] lstrlenW (lpString=".dbf") returned 4 [0098.411] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.411] lstrlenW (lpString=".1cd") returned 4 [0098.411] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0098.411] lstrlenW (lpString=".jpg") returned 4 [0098.411] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.411] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") [0098.411] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=615) returned 1 [0098.411] CloseHandle (hObject=0x210) returned 1 [0098.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 0x20 [0098.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.412] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.412] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.412] GetLastError () returned 0x0 [0098.412] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x267, lpOverlapped=0x0) returned 1 [0098.413] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x270, lpOverlapped=0x0) returned 1 [0098.414] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.414] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.414] SetEndOfFile (hFile=0x1ec) returned 1 [0098.414] CloseHandle (hObject=0x1ec) returned 1 [0098.414] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.414] SetEndOfFile (hFile=0x210) returned 1 [0098.415] CloseHandle (hObject=0x210) returned 1 [0098.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 1 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString=".doc") returned 4 [0098.416] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString=".docx") returned 5 [0098.416] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0098.416] lstrlenW (lpString=".pdf") returned 4 [0098.416] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString=".xls") returned 4 [0098.416] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString=".xlsx") returned 5 [0098.416] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0098.416] lstrlenW (lpString=".ppt") returned 4 [0098.416] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString=".zip") returned 4 [0098.416] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString=".rar") returned 4 [0098.416] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString=".bz2") returned 4 [0098.416] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.416] lstrlenW (lpString=".7z") returned 3 [0098.416] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString=".dbf") returned 4 [0098.416] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString=".1cd") returned 4 [0098.416] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0098.416] lstrlenW (lpString=".jpg") returned 4 [0098.417] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.417] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") [0098.417] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=603) returned 1 [0098.417] CloseHandle (hObject=0x210) returned 1 [0098.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0098.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.417] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.417] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.418] GetLastError () returned 0x0 [0098.418] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x25b, lpOverlapped=0x0) returned 1 [0098.419] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x260, lpOverlapped=0x0) returned 1 [0098.420] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.420] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.420] SetEndOfFile (hFile=0x1ec) returned 1 [0098.420] CloseHandle (hObject=0x1ec) returned 1 [0098.420] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.420] SetEndOfFile (hFile=0x210) returned 1 [0098.421] CloseHandle (hObject=0x210) returned 1 [0098.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 1 [0098.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.421] lstrlenW (lpString=".doc") returned 4 [0098.421] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.421] lstrlenW (lpString=".docx") returned 5 [0098.421] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0098.421] lstrlenW (lpString=".pdf") returned 4 [0098.421] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.421] lstrlenW (lpString=".xls") returned 4 [0098.422] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.422] lstrlenW (lpString=".xlsx") returned 5 [0098.422] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0098.422] lstrlenW (lpString=".ppt") returned 4 [0098.422] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.422] lstrlenW (lpString=".zip") returned 4 [0098.422] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.422] lstrlenW (lpString=".rar") returned 4 [0098.422] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.422] lstrlenW (lpString=".bz2") returned 4 [0098.422] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.422] lstrlenW (lpString=".7z") returned 3 [0098.422] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.422] lstrlenW (lpString=".dbf") returned 4 [0098.422] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.422] lstrlenW (lpString=".1cd") returned 4 [0098.422] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0098.422] lstrlenW (lpString=".jpg") returned 4 [0098.422] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.422] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") [0098.423] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.423] CloseHandle (hObject=0x210) returned 1 [0098.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 0x20 [0098.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.423] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.423] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.423] GetLastError () returned 0x0 [0098.424] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.455] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.456] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.456] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.456] SetEndOfFile (hFile=0x1ec) returned 1 [0098.465] CloseHandle (hObject=0x1ec) returned 1 [0098.465] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.465] SetEndOfFile (hFile=0x210) returned 1 [0098.466] CloseHandle (hObject=0x210) returned 1 [0098.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 1 [0098.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.466] lstrlenW (lpString=".doc") returned 4 [0098.466] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.466] lstrlenW (lpString=".docx") returned 5 [0098.466] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.466] lstrlenW (lpString=".pdf") returned 4 [0098.466] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.466] lstrlenW (lpString=".xls") returned 4 [0098.466] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.466] lstrlenW (lpString=".xlsx") returned 5 [0098.466] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.466] lstrlenW (lpString=".ppt") returned 4 [0098.466] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.466] lstrlenW (lpString=".zip") returned 4 [0098.466] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.466] lstrlenW (lpString=".rar") returned 4 [0098.466] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.467] lstrlenW (lpString=".bz2") returned 4 [0098.467] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.467] lstrlenW (lpString=".7z") returned 3 [0098.467] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.467] lstrlenW (lpString=".dbf") returned 4 [0098.467] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.467] lstrlenW (lpString=".1cd") returned 4 [0098.467] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0098.467] lstrlenW (lpString=".jpg") returned 4 [0098.467] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.467] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") [0098.467] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.467] CloseHandle (hObject=0x210) returned 1 [0098.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 0x20 [0098.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.468] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.468] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.468] GetLastError () returned 0x0 [0098.468] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.470] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.471] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.471] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.471] SetEndOfFile (hFile=0x1ec) returned 1 [0098.471] CloseHandle (hObject=0x1ec) returned 1 [0098.471] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.471] SetEndOfFile (hFile=0x210) returned 1 [0098.472] CloseHandle (hObject=0x210) returned 1 [0098.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 1 [0098.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.472] lstrlenW (lpString=".doc") returned 4 [0098.472] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.472] lstrlenW (lpString=".docx") returned 5 [0098.472] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.472] lstrlenW (lpString=".pdf") returned 4 [0098.472] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.472] lstrlenW (lpString=".xls") returned 4 [0098.472] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.472] lstrlenW (lpString=".xlsx") returned 5 [0098.472] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.472] lstrlenW (lpString=".ppt") returned 4 [0098.472] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.473] lstrlenW (lpString=".zip") returned 4 [0098.473] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.473] lstrlenW (lpString=".rar") returned 4 [0098.473] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.473] lstrlenW (lpString=".bz2") returned 4 [0098.473] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.473] lstrlenW (lpString=".7z") returned 3 [0098.473] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.473] lstrlenW (lpString=".dbf") returned 4 [0098.473] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.473] lstrlenW (lpString=".1cd") returned 4 [0098.473] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0098.473] lstrlenW (lpString=".jpg") returned 4 [0098.473] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.473] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") [0098.474] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.474] CloseHandle (hObject=0x210) returned 1 [0098.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 0x20 [0098.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0098.474] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.474] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.475] GetLastError () returned 0x0 [0098.475] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.481] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.481] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.481] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.482] SetEndOfFile (hFile=0x1ec) returned 1 [0098.482] CloseHandle (hObject=0x1ec) returned 1 [0098.482] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.482] SetEndOfFile (hFile=0x210) returned 1 [0098.483] CloseHandle (hObject=0x210) returned 1 [0098.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 1 [0098.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.483] lstrlenW (lpString=".doc") returned 4 [0098.483] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.483] lstrlenW (lpString=".docx") returned 5 [0098.483] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.483] lstrlenW (lpString=".pdf") returned 4 [0098.483] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.483] lstrlenW (lpString=".xls") returned 4 [0098.483] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.483] lstrlenW (lpString=".xlsx") returned 5 [0098.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.483] lstrlenW (lpString=".ppt") returned 4 [0098.483] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.483] lstrlenW (lpString=".zip") returned 4 [0098.483] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.483] lstrlenW (lpString=".rar") returned 4 [0098.483] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.484] lstrlenW (lpString=".bz2") returned 4 [0098.484] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.484] lstrlenW (lpString=".7z") returned 3 [0098.484] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.484] lstrlenW (lpString=".dbf") returned 4 [0098.484] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.484] lstrlenW (lpString=".1cd") returned 4 [0098.484] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0098.484] lstrlenW (lpString=".jpg") returned 4 [0098.484] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.484] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") [0098.510] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.510] CloseHandle (hObject=0x19c) returned 1 [0098.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 0x20 [0098.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.511] GetLastError () returned 0x0 [0098.511] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.513] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.514] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.514] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.514] SetEndOfFile (hFile=0x15c) returned 1 [0098.514] CloseHandle (hObject=0x15c) returned 1 [0098.514] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.514] SetEndOfFile (hFile=0x19c) returned 1 [0098.515] CloseHandle (hObject=0x19c) returned 1 [0098.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.515] lstrlenW (lpString=".doc") returned 4 [0098.516] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.516] lstrlenW (lpString=".docx") returned 5 [0098.516] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.516] lstrlenW (lpString=".pdf") returned 4 [0098.516] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.516] lstrlenW (lpString=".xls") returned 4 [0098.516] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.516] lstrlenW (lpString=".xlsx") returned 5 [0098.516] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.516] lstrlenW (lpString=".ppt") returned 4 [0098.516] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.516] lstrlenW (lpString=".zip") returned 4 [0098.516] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.516] lstrlenW (lpString=".rar") returned 4 [0098.516] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.516] lstrlenW (lpString=".bz2") returned 4 [0098.516] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.516] lstrlenW (lpString=".7z") returned 3 [0098.516] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.516] lstrlenW (lpString=".dbf") returned 4 [0098.516] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.516] lstrlenW (lpString=".1cd") returned 4 [0098.516] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0098.516] lstrlenW (lpString=".jpg") returned 4 [0098.516] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.516] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") [0098.517] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.517] CloseHandle (hObject=0x19c) returned 1 [0098.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 0x20 [0098.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.517] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.517] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.518] GetLastError () returned 0x0 [0098.518] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.519] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.520] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.520] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.520] SetEndOfFile (hFile=0x15c) returned 1 [0098.521] CloseHandle (hObject=0x15c) returned 1 [0098.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.521] SetEndOfFile (hFile=0x19c) returned 1 [0098.521] CloseHandle (hObject=0x19c) returned 1 [0098.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.522] lstrlenW (lpString=".doc") returned 4 [0098.522] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.522] lstrlenW (lpString=".docx") returned 5 [0098.522] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.522] lstrlenW (lpString=".pdf") returned 4 [0098.522] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.522] lstrlenW (lpString=".xls") returned 4 [0098.522] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.522] lstrlenW (lpString=".xlsx") returned 5 [0098.522] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.522] lstrlenW (lpString=".ppt") returned 4 [0098.522] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.522] lstrlenW (lpString=".zip") returned 4 [0098.522] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.522] lstrlenW (lpString=".rar") returned 4 [0098.522] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.522] lstrlenW (lpString=".bz2") returned 4 [0098.522] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.522] lstrlenW (lpString=".7z") returned 3 [0098.522] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.523] lstrlenW (lpString=".dbf") returned 4 [0098.523] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.523] lstrlenW (lpString=".1cd") returned 4 [0098.523] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0098.523] lstrlenW (lpString=".jpg") returned 4 [0098.523] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.523] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") [0098.523] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.523] CloseHandle (hObject=0x19c) returned 1 [0098.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 0x20 [0098.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.524] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.524] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.524] GetLastError () returned 0x0 [0098.524] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.526] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.527] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.527] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.527] SetEndOfFile (hFile=0x15c) returned 1 [0098.527] CloseHandle (hObject=0x15c) returned 1 [0098.527] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.527] SetEndOfFile (hFile=0x19c) returned 1 [0098.528] CloseHandle (hObject=0x19c) returned 1 [0098.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 1 [0098.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.528] lstrlenW (lpString=".doc") returned 4 [0098.528] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.528] lstrlenW (lpString=".docx") returned 5 [0098.529] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.529] lstrlenW (lpString=".pdf") returned 4 [0098.529] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.529] lstrlenW (lpString=".xls") returned 4 [0098.529] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.529] lstrlenW (lpString=".xlsx") returned 5 [0098.529] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.529] lstrlenW (lpString=".ppt") returned 4 [0098.529] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.529] lstrlenW (lpString=".zip") returned 4 [0098.529] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.529] lstrlenW (lpString=".rar") returned 4 [0098.529] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.529] lstrlenW (lpString=".bz2") returned 4 [0098.529] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.529] lstrlenW (lpString=".7z") returned 3 [0098.529] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.529] lstrlenW (lpString=".dbf") returned 4 [0098.529] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.529] lstrlenW (lpString=".1cd") returned 4 [0098.529] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0098.529] lstrlenW (lpString=".jpg") returned 4 [0098.529] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.529] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") [0098.530] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=779) returned 1 [0098.530] CloseHandle (hObject=0x19c) returned 1 [0098.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 0x20 [0098.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.530] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.530] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.531] GetLastError () returned 0x0 [0098.531] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x30b, lpOverlapped=0x0) returned 1 [0098.715] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x310, lpOverlapped=0x0) returned 1 [0098.742] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.742] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.742] SetEndOfFile (hFile=0x15c) returned 1 [0098.778] CloseHandle (hObject=0x15c) returned 1 [0098.778] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.778] SetEndOfFile (hFile=0x19c) returned 1 [0098.778] CloseHandle (hObject=0x19c) returned 1 [0098.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 1 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.785] lstrlenW (lpString=".doc") returned 4 [0098.785] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString=".docx") returned 5 [0098.785] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0098.785] lstrlenW (lpString=".pdf") returned 4 [0098.785] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString=".xls") returned 4 [0098.785] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString=".xlsx") returned 5 [0098.785] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0098.785] lstrlenW (lpString=".ppt") returned 4 [0098.785] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.785] lstrlenW (lpString=".zip") returned 4 [0098.785] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString=".rar") returned 4 [0098.785] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString=".bz2") returned 4 [0098.785] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.785] lstrlenW (lpString=".7z") returned 3 [0098.785] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.785] lstrlenW (lpString=".dbf") returned 4 [0098.785] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.785] lstrlenW (lpString=".1cd") returned 4 [0098.785] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0098.786] lstrlenW (lpString=".jpg") returned 4 [0098.786] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.786] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") [0098.879] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.879] CloseHandle (hObject=0x15c) returned 1 [0098.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 0x20 [0098.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.880] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.880] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.880] GetLastError () returned 0x0 [0098.880] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.889] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.890] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.890] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.890] SetEndOfFile (hFile=0x16c) returned 1 [0098.890] CloseHandle (hObject=0x16c) returned 1 [0098.890] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.891] SetEndOfFile (hFile=0x15c) returned 1 [0098.891] CloseHandle (hObject=0x15c) returned 1 [0098.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 1 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.892] lstrlenW (lpString=".doc") returned 4 [0098.892] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.892] lstrlenW (lpString=".docx") returned 5 [0098.892] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.892] lstrlenW (lpString=".pdf") returned 4 [0098.892] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.892] lstrlenW (lpString=".xls") returned 4 [0098.892] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.892] lstrlenW (lpString=".xlsx") returned 5 [0098.892] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.892] lstrlenW (lpString=".ppt") returned 4 [0098.892] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.892] lstrlenW (lpString=".zip") returned 4 [0098.892] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.892] lstrlenW (lpString=".rar") returned 4 [0098.892] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.892] lstrlenW (lpString=".bz2") returned 4 [0098.892] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.892] lstrlenW (lpString=".7z") returned 3 [0098.892] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.892] lstrlenW (lpString=".dbf") returned 4 [0098.892] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.892] lstrlenW (lpString=".1cd") returned 4 [0098.892] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0098.893] lstrlenW (lpString=".jpg") returned 4 [0098.893] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.893] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") [0098.893] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.893] CloseHandle (hObject=0x15c) returned 1 [0098.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 0x20 [0098.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.894] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.894] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.894] GetLastError () returned 0x0 [0098.894] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.906] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.907] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.907] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.908] SetEndOfFile (hFile=0x16c) returned 1 [0098.908] CloseHandle (hObject=0x16c) returned 1 [0098.908] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.908] SetEndOfFile (hFile=0x15c) returned 1 [0098.908] CloseHandle (hObject=0x15c) returned 1 [0098.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 1 [0098.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.909] lstrlenW (lpString=".doc") returned 4 [0098.909] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.909] lstrlenW (lpString=".docx") returned 5 [0098.909] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.909] lstrlenW (lpString=".pdf") returned 4 [0098.909] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.909] lstrlenW (lpString=".xls") returned 4 [0098.909] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.909] lstrlenW (lpString=".xlsx") returned 5 [0098.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.909] lstrlenW (lpString=".ppt") returned 4 [0098.909] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.909] lstrlenW (lpString=".zip") returned 4 [0098.909] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.909] lstrlenW (lpString=".rar") returned 4 [0098.909] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.909] lstrlenW (lpString=".bz2") returned 4 [0098.909] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.910] lstrlenW (lpString=".7z") returned 3 [0098.910] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.910] lstrlenW (lpString=".dbf") returned 4 [0098.910] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.910] lstrlenW (lpString=".1cd") returned 4 [0098.910] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0098.910] lstrlenW (lpString=".jpg") returned 4 [0098.910] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.910] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") [0098.910] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.911] CloseHandle (hObject=0x15c) returned 1 [0098.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 0x20 [0098.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.911] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.911] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.912] GetLastError () returned 0x0 [0098.912] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.922] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.922] SetEndOfFile (hFile=0x16c) returned 1 [0098.923] CloseHandle (hObject=0x16c) returned 1 [0098.923] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.923] SetEndOfFile (hFile=0x15c) returned 1 [0098.923] CloseHandle (hObject=0x15c) returned 1 [0098.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 1 [0098.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.924] lstrlenW (lpString=".doc") returned 4 [0098.924] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.924] lstrlenW (lpString=".docx") returned 5 [0098.924] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.924] lstrlenW (lpString=".pdf") returned 4 [0098.924] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.924] lstrlenW (lpString=".xls") returned 4 [0098.924] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.924] lstrlenW (lpString=".xlsx") returned 5 [0098.924] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.924] lstrlenW (lpString=".ppt") returned 4 [0098.924] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.924] lstrlenW (lpString=".zip") returned 4 [0098.924] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.924] lstrlenW (lpString=".rar") returned 4 [0098.924] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.924] lstrlenW (lpString=".bz2") returned 4 [0098.924] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.924] lstrlenW (lpString=".7z") returned 3 [0098.924] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.925] lstrlenW (lpString=".dbf") returned 4 [0098.925] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.925] lstrlenW (lpString=".1cd") returned 4 [0098.925] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0098.925] lstrlenW (lpString=".jpg") returned 4 [0098.925] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.925] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") [0098.926] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0098.926] CloseHandle (hObject=0x15c) returned 1 [0098.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 0x20 [0098.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.926] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.926] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.927] GetLastError () returned 0x0 [0098.927] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0098.931] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.932] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0098.932] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.932] SetEndOfFile (hFile=0x16c) returned 1 [0098.932] CloseHandle (hObject=0x16c) returned 1 [0098.933] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.933] SetEndOfFile (hFile=0x15c) returned 1 [0098.933] CloseHandle (hObject=0x15c) returned 1 [0098.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 1 [0098.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.934] lstrlenW (lpString=".doc") returned 4 [0098.934] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.934] lstrlenW (lpString=".docx") returned 5 [0098.934] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.934] lstrlenW (lpString=".pdf") returned 4 [0098.934] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.934] lstrlenW (lpString=".xls") returned 4 [0098.934] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.934] lstrlenW (lpString=".xlsx") returned 5 [0098.934] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.934] lstrlenW (lpString=".ppt") returned 4 [0098.934] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.934] lstrlenW (lpString=".zip") returned 4 [0098.934] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.934] lstrlenW (lpString=".rar") returned 4 [0098.934] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.934] lstrlenW (lpString=".bz2") returned 4 [0098.934] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.934] lstrlenW (lpString=".7z") returned 3 [0098.934] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.934] lstrlenW (lpString=".dbf") returned 4 [0098.934] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.935] lstrlenW (lpString=".1cd") returned 4 [0098.935] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0098.935] lstrlenW (lpString=".jpg") returned 4 [0098.935] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.935] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") [0098.946] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0098.946] CloseHandle (hObject=0x15c) returned 1 [0098.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 0x20 [0098.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.946] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.946] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0098.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.017] GetLastError () returned 0x0 [0099.017] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.018] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.019] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.019] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.019] SetEndOfFile (hFile=0x180) returned 1 [0099.019] CloseHandle (hObject=0x180) returned 1 [0099.020] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.020] SetEndOfFile (hFile=0x15c) returned 1 [0099.020] CloseHandle (hObject=0x15c) returned 1 [0099.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 1 [0099.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.021] lstrlenW (lpString=".doc") returned 4 [0099.021] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.021] lstrlenW (lpString=".docx") returned 5 [0099.021] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.021] lstrlenW (lpString=".pdf") returned 4 [0099.021] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.021] lstrlenW (lpString=".xls") returned 4 [0099.021] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.021] lstrlenW (lpString=".xlsx") returned 5 [0099.021] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.021] lstrlenW (lpString=".ppt") returned 4 [0099.021] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.021] lstrlenW (lpString=".zip") returned 4 [0099.021] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.021] lstrlenW (lpString=".rar") returned 4 [0099.021] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.021] lstrlenW (lpString=".bz2") returned 4 [0099.021] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.021] lstrlenW (lpString=".7z") returned 3 [0099.021] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.021] lstrlenW (lpString=".dbf") returned 4 [0099.022] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.022] lstrlenW (lpString=".1cd") returned 4 [0099.022] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0099.022] lstrlenW (lpString=".jpg") returned 4 [0099.022] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.022] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") [0099.022] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0099.022] CloseHandle (hObject=0x15c) returned 1 [0099.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 0x20 [0099.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.023] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.023] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.023] GetLastError () returned 0x0 [0099.023] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0099.026] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.027] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.027] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.027] SetEndOfFile (hFile=0x180) returned 1 [0099.027] CloseHandle (hObject=0x180) returned 1 [0099.027] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.027] SetEndOfFile (hFile=0x15c) returned 1 [0099.028] CloseHandle (hObject=0x15c) returned 1 [0099.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 1 [0099.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString=".doc") returned 4 [0099.029] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.029] lstrlenW (lpString=".docx") returned 5 [0099.029] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.029] lstrlenW (lpString=".pdf") returned 4 [0099.029] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.029] lstrlenW (lpString=".xls") returned 4 [0099.029] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.029] lstrlenW (lpString=".xlsx") returned 5 [0099.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.029] lstrlenW (lpString=".ppt") returned 4 [0099.029] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString=".zip") returned 4 [0099.029] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.029] lstrlenW (lpString=".rar") returned 4 [0099.029] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.029] lstrlenW (lpString=".bz2") returned 4 [0099.029] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.029] lstrlenW (lpString=".7z") returned 3 [0099.029] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString=".dbf") returned 4 [0099.029] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString=".1cd") returned 4 [0099.029] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0099.029] lstrlenW (lpString=".jpg") returned 4 [0099.029] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.029] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") [0099.030] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0099.030] CloseHandle (hObject=0x15c) returned 1 [0099.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 0x20 [0099.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.030] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.030] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.031] GetLastError () returned 0x0 [0099.031] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.033] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.034] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.034] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.034] SetEndOfFile (hFile=0x180) returned 1 [0099.034] CloseHandle (hObject=0x180) returned 1 [0099.034] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.034] SetEndOfFile (hFile=0x15c) returned 1 [0099.035] CloseHandle (hObject=0x15c) returned 1 [0099.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 1 [0099.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.035] lstrlenW (lpString=".doc") returned 4 [0099.035] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.035] lstrlenW (lpString=".docx") returned 5 [0099.035] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.035] lstrlenW (lpString=".pdf") returned 4 [0099.035] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.035] lstrlenW (lpString=".xls") returned 4 [0099.035] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.035] lstrlenW (lpString=".xlsx") returned 5 [0099.035] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.035] lstrlenW (lpString=".ppt") returned 4 [0099.036] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.036] lstrlenW (lpString=".zip") returned 4 [0099.036] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.036] lstrlenW (lpString=".rar") returned 4 [0099.036] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.036] lstrlenW (lpString=".bz2") returned 4 [0099.036] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.036] lstrlenW (lpString=".7z") returned 3 [0099.036] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.036] lstrlenW (lpString=".dbf") returned 4 [0099.036] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.036] lstrlenW (lpString=".1cd") returned 4 [0099.036] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0099.036] lstrlenW (lpString=".jpg") returned 4 [0099.036] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.036] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") [0099.037] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0099.037] CloseHandle (hObject=0x15c) returned 1 [0099.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 0x20 [0099.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.037] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.037] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.038] GetLastError () returned 0x0 [0099.038] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0099.039] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.040] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.040] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.040] SetEndOfFile (hFile=0x180) returned 1 [0099.040] CloseHandle (hObject=0x180) returned 1 [0099.041] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.041] SetEndOfFile (hFile=0x15c) returned 1 [0099.041] CloseHandle (hObject=0x15c) returned 1 [0099.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 1 [0099.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.042] lstrlenW (lpString=".doc") returned 4 [0099.042] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.042] lstrlenW (lpString=".docx") returned 5 [0099.042] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.042] lstrlenW (lpString=".pdf") returned 4 [0099.042] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.042] lstrlenW (lpString=".xls") returned 4 [0099.042] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.042] lstrlenW (lpString=".xlsx") returned 5 [0099.042] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.042] lstrlenW (lpString=".ppt") returned 4 [0099.042] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.042] lstrlenW (lpString=".zip") returned 4 [0099.042] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.042] lstrlenW (lpString=".rar") returned 4 [0099.042] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.042] lstrlenW (lpString=".bz2") returned 4 [0099.042] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.042] lstrlenW (lpString=".7z") returned 3 [0099.042] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.042] lstrlenW (lpString=".dbf") returned 4 [0099.042] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.043] lstrlenW (lpString=".1cd") returned 4 [0099.043] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0099.043] lstrlenW (lpString=".jpg") returned 4 [0099.043] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.043] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") [0099.044] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0099.044] CloseHandle (hObject=0x15c) returned 1 [0099.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 0x20 [0099.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.045] GetLastError () returned 0x0 [0099.045] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.046] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.047] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.047] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.047] SetEndOfFile (hFile=0x180) returned 1 [0099.047] CloseHandle (hObject=0x180) returned 1 [0099.047] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.047] SetEndOfFile (hFile=0x15c) returned 1 [0099.048] CloseHandle (hObject=0x15c) returned 1 [0099.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 1 [0099.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.048] lstrlenW (lpString=".doc") returned 4 [0099.048] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.048] lstrlenW (lpString=".docx") returned 5 [0099.048] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.049] lstrlenW (lpString=".pdf") returned 4 [0099.049] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.049] lstrlenW (lpString=".xls") returned 4 [0099.049] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.049] lstrlenW (lpString=".xlsx") returned 5 [0099.049] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.049] lstrlenW (lpString=".ppt") returned 4 [0099.049] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.049] lstrlenW (lpString=".zip") returned 4 [0099.049] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.049] lstrlenW (lpString=".rar") returned 4 [0099.049] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.049] lstrlenW (lpString=".bz2") returned 4 [0099.049] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.049] lstrlenW (lpString=".7z") returned 3 [0099.049] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.049] lstrlenW (lpString=".dbf") returned 4 [0099.049] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.049] lstrlenW (lpString=".1cd") returned 4 [0099.049] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0099.049] lstrlenW (lpString=".jpg") returned 4 [0099.049] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.049] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") [0099.050] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=821) returned 1 [0099.050] CloseHandle (hObject=0x15c) returned 1 [0099.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 0x20 [0099.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.050] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.050] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.051] GetLastError () returned 0x0 [0099.051] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x335, lpOverlapped=0x0) returned 1 [0099.167] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x340, lpOverlapped=0x0) returned 1 [0099.167] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.168] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.168] SetEndOfFile (hFile=0x180) returned 1 [0099.168] CloseHandle (hObject=0x180) returned 1 [0099.168] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.168] SetEndOfFile (hFile=0x15c) returned 1 [0099.169] CloseHandle (hObject=0x15c) returned 1 [0099.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 1 [0099.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.169] lstrlenW (lpString=".doc") returned 4 [0099.169] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.169] lstrlenW (lpString=".docx") returned 5 [0099.169] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0099.169] lstrlenW (lpString=".pdf") returned 4 [0099.169] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.169] lstrlenW (lpString=".xls") returned 4 [0099.169] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.169] lstrlenW (lpString=".xlsx") returned 5 [0099.169] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0099.169] lstrlenW (lpString=".ppt") returned 4 [0099.169] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.169] lstrlenW (lpString=".zip") returned 4 [0099.169] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.169] lstrlenW (lpString=".rar") returned 4 [0099.170] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.170] lstrlenW (lpString=".bz2") returned 4 [0099.170] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.170] lstrlenW (lpString=".7z") returned 3 [0099.170] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.170] lstrlenW (lpString=".dbf") returned 4 [0099.170] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.170] lstrlenW (lpString=".1cd") returned 4 [0099.170] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0099.170] lstrlenW (lpString=".jpg") returned 4 [0099.170] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.170] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") [0099.170] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=771) returned 1 [0099.171] CloseHandle (hObject=0x15c) returned 1 [0099.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 0x20 [0099.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.171] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.171] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.172] GetLastError () returned 0x0 [0099.172] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x303, lpOverlapped=0x0) returned 1 [0099.179] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x310, lpOverlapped=0x0) returned 1 [0099.180] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.180] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.180] SetEndOfFile (hFile=0x180) returned 1 [0099.180] CloseHandle (hObject=0x180) returned 1 [0099.180] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.180] SetEndOfFile (hFile=0x15c) returned 1 [0099.181] CloseHandle (hObject=0x15c) returned 1 [0099.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 1 [0099.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.182] lstrlenW (lpString=".doc") returned 4 [0099.182] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString=".docx") returned 5 [0099.182] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0099.182] lstrlenW (lpString=".pdf") returned 4 [0099.182] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString=".xls") returned 4 [0099.182] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString=".xlsx") returned 5 [0099.182] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0099.182] lstrlenW (lpString=".ppt") returned 4 [0099.182] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.182] lstrlenW (lpString=".zip") returned 4 [0099.182] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString=".rar") returned 4 [0099.182] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.182] lstrlenW (lpString=".bz2") returned 4 [0099.182] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.182] lstrlenW (lpString=".7z") returned 3 [0099.182] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.183] lstrlenW (lpString=".dbf") returned 4 [0099.183] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.183] lstrlenW (lpString=".1cd") returned 4 [0099.183] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0099.183] lstrlenW (lpString=".jpg") returned 4 [0099.183] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.183] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") [0099.183] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1078) returned 1 [0099.183] CloseHandle (hObject=0x15c) returned 1 [0099.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 0x20 [0099.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.184] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.184] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.184] GetLastError () returned 0x0 [0099.184] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x436, lpOverlapped=0x0) returned 1 [0099.186] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.187] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.187] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0099.187] SetEndOfFile (hFile=0x180) returned 1 [0099.187] CloseHandle (hObject=0x180) returned 1 [0099.187] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.187] SetEndOfFile (hFile=0x15c) returned 1 [0099.188] CloseHandle (hObject=0x15c) returned 1 [0099.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 1 [0099.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.188] lstrlenW (lpString=".doc") returned 4 [0099.188] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.188] lstrlenW (lpString=".docx") returned 5 [0099.188] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.188] lstrlenW (lpString=".pdf") returned 4 [0099.189] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.189] lstrlenW (lpString=".xls") returned 4 [0099.189] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.189] lstrlenW (lpString=".xlsx") returned 5 [0099.189] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.189] lstrlenW (lpString=".ppt") returned 4 [0099.189] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.189] lstrlenW (lpString=".zip") returned 4 [0099.189] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.189] lstrlenW (lpString=".rar") returned 4 [0099.189] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.189] lstrlenW (lpString=".bz2") returned 4 [0099.189] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.189] lstrlenW (lpString=".7z") returned 3 [0099.189] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.189] lstrlenW (lpString=".dbf") returned 4 [0099.189] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.189] lstrlenW (lpString=".1cd") returned 4 [0099.189] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0099.189] lstrlenW (lpString=".jpg") returned 4 [0099.189] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.189] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") [0099.190] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2998) returned 1 [0099.190] CloseHandle (hObject=0x15c) returned 1 [0099.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 0x20 [0099.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.190] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.190] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.191] GetLastError () returned 0x0 [0099.191] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.192] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.193] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.194] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0099.194] SetEndOfFile (hFile=0x180) returned 1 [0099.194] CloseHandle (hObject=0x180) returned 1 [0099.194] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.194] SetEndOfFile (hFile=0x15c) returned 1 [0099.195] CloseHandle (hObject=0x15c) returned 1 [0099.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 1 [0099.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.195] lstrlenW (lpString=".doc") returned 4 [0099.195] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.195] lstrlenW (lpString=".docx") returned 5 [0099.195] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.195] lstrlenW (lpString=".pdf") returned 4 [0099.195] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.195] lstrlenW (lpString=".xls") returned 4 [0099.195] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.195] lstrlenW (lpString=".xlsx") returned 5 [0099.195] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.195] lstrlenW (lpString=".ppt") returned 4 [0099.195] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.196] lstrlenW (lpString=".zip") returned 4 [0099.196] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.196] lstrlenW (lpString=".rar") returned 4 [0099.196] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.196] lstrlenW (lpString=".bz2") returned 4 [0099.196] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.196] lstrlenW (lpString=".7z") returned 3 [0099.196] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.196] lstrlenW (lpString=".dbf") returned 4 [0099.196] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.196] lstrlenW (lpString=".1cd") returned 4 [0099.196] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0099.196] lstrlenW (lpString=".jpg") returned 4 [0099.196] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.196] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") [0099.197] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=640) returned 1 [0099.197] CloseHandle (hObject=0x15c) returned 1 [0099.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 0x20 [0099.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.197] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.197] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.198] GetLastError () returned 0x0 [0099.198] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x280, lpOverlapped=0x0) returned 1 [0099.199] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x290, lpOverlapped=0x0) returned 1 [0099.200] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.200] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.200] SetEndOfFile (hFile=0x180) returned 1 [0099.200] CloseHandle (hObject=0x180) returned 1 [0099.200] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.200] SetEndOfFile (hFile=0x15c) returned 1 [0099.201] CloseHandle (hObject=0x15c) returned 1 [0099.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 1 [0099.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.201] lstrlenW (lpString=".doc") returned 4 [0099.201] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.201] lstrlenW (lpString=".docx") returned 5 [0099.201] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0099.201] lstrlenW (lpString=".pdf") returned 4 [0099.201] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.201] lstrlenW (lpString=".xls") returned 4 [0099.201] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.202] lstrlenW (lpString=".xlsx") returned 5 [0099.202] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0099.202] lstrlenW (lpString=".ppt") returned 4 [0099.202] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.202] lstrlenW (lpString=".zip") returned 4 [0099.202] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.202] lstrlenW (lpString=".rar") returned 4 [0099.202] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.202] lstrlenW (lpString=".bz2") returned 4 [0099.202] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.202] lstrlenW (lpString=".7z") returned 3 [0099.202] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.202] lstrlenW (lpString=".dbf") returned 4 [0099.202] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.202] lstrlenW (lpString=".1cd") returned 4 [0099.202] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0099.202] lstrlenW (lpString=".jpg") returned 4 [0099.202] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.202] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") [0099.203] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=668) returned 1 [0099.203] CloseHandle (hObject=0x15c) returned 1 [0099.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 0x20 [0099.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.204] GetLastError () returned 0x0 [0099.204] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x29c, lpOverlapped=0x0) returned 1 [0099.205] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0099.206] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.206] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.206] SetEndOfFile (hFile=0x180) returned 1 [0099.206] CloseHandle (hObject=0x180) returned 1 [0099.206] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.206] SetEndOfFile (hFile=0x15c) returned 1 [0099.207] CloseHandle (hObject=0x15c) returned 1 [0099.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 1 [0099.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.207] lstrlenW (lpString=".doc") returned 4 [0099.207] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.207] lstrlenW (lpString=".docx") returned 5 [0099.207] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0099.207] lstrlenW (lpString=".pdf") returned 4 [0099.207] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.207] lstrlenW (lpString=".xls") returned 4 [0099.207] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.207] lstrlenW (lpString=".xlsx") returned 5 [0099.207] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0099.207] lstrlenW (lpString=".ppt") returned 4 [0099.208] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.208] lstrlenW (lpString=".zip") returned 4 [0099.208] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.208] lstrlenW (lpString=".rar") returned 4 [0099.208] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.208] lstrlenW (lpString=".bz2") returned 4 [0099.208] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.208] lstrlenW (lpString=".7z") returned 3 [0099.208] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.208] lstrlenW (lpString=".dbf") returned 4 [0099.208] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.208] lstrlenW (lpString=".1cd") returned 4 [0099.208] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0099.208] lstrlenW (lpString=".jpg") returned 4 [0099.208] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.208] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") [0099.209] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10134) returned 1 [0099.209] CloseHandle (hObject=0x15c) returned 1 [0099.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 0x20 [0099.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0099.209] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.209] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0099.210] GetLastError () returned 0x0 [0099.210] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2796, lpOverlapped=0x0) returned 1 [0099.272] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0099.274] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0099.274] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0099.275] SetEndOfFile (hFile=0x180) returned 1 [0099.374] CloseHandle (hObject=0x180) returned 1 [0099.374] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0099.375] SetEndOfFile (hFile=0x15c) returned 1 [0099.385] CloseHandle (hObject=0x15c) returned 1 [0099.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 1 [0099.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.528] lstrlenW (lpString=".doc") returned 4 [0099.528] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.528] lstrlenW (lpString=".docx") returned 5 [0099.528] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.528] lstrlenW (lpString=".pdf") returned 4 [0099.529] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.529] lstrlenW (lpString=".xls") returned 4 [0099.529] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.533] lstrlenW (lpString=".xlsx") returned 5 [0099.533] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.533] lstrlenW (lpString=".ppt") returned 4 [0099.533] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.533] lstrlenW (lpString=".zip") returned 4 [0099.533] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.533] lstrlenW (lpString=".rar") returned 4 [0099.533] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.533] lstrlenW (lpString=".bz2") returned 4 [0099.534] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.534] lstrlenW (lpString=".7z") returned 3 [0099.534] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.570] lstrlenW (lpString=".dbf") returned 4 [0099.570] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.570] lstrlenW (lpString=".1cd") returned 4 [0099.570] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0099.570] lstrlenW (lpString=".jpg") returned 4 [0099.570] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.570] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") [0099.973] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4563328) returned 1 [0099.973] CloseHandle (hObject=0x168) returned 1 [0099.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll")) returned 0x20 [0099.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0099.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.975] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0099.975] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0099.975] ReadFile (in: hFile=0x168, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.979] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x1735d5, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0099.979] ReadFile (in: hFile=0x168, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.985] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0099.985] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x41a180, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0099.985] ReadFile (in: hFile=0x168, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.007] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.007] WriteFile (in: hFile=0x168, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0100.119] SetEndOfFile (hFile=0x168) returned 1 [0100.119] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0100.119] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0100.119] WriteFile (in: hFile=0x168, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.121] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x1735d5, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0100.121] WriteFile (in: hFile=0x168, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.123] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x41a180, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0100.123] WriteFile (in: hFile=0x168, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0100.130] CloseHandle (hObject=0x168) returned 1 [0100.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.130] lstrlenW (lpString=".doc") returned 4 [0100.130] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString=".docx") returned 5 [0100.130] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0100.130] lstrlenW (lpString=".pdf") returned 4 [0100.130] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString=".xls") returned 4 [0100.130] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString=".xlsx") returned 5 [0100.130] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0100.130] lstrlenW (lpString=".ppt") returned 4 [0100.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.130] lstrlenW (lpString=".zip") returned 4 [0100.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString=".rar") returned 4 [0100.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.130] lstrlenW (lpString=".bz2") returned 4 [0100.131] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.131] lstrlenW (lpString=".7z") returned 3 [0100.131] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.131] lstrlenW (lpString=".dbf") returned 4 [0100.131] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.131] lstrlenW (lpString=".1cd") returned 4 [0100.131] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0100.131] lstrlenW (lpString=".jpg") returned 4 [0100.131] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.131] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") [0100.465] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=960) returned 1 [0100.465] CloseHandle (hObject=0x1fc) returned 1 [0100.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) returned 0x20 [0100.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.465] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.465] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.466] GetLastError () returned 0x0 [0100.466] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3c0, lpOverlapped=0x0) returned 1 [0100.467] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0100.468] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.468] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf8, lpOverlapped=0x0) returned 1 [0100.468] SetEndOfFile (hFile=0x158) returned 1 [0100.469] CloseHandle (hObject=0x158) returned 1 [0100.469] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.469] SetEndOfFile (hFile=0x1fc) returned 1 [0100.470] CloseHandle (hObject=0x1fc) returned 1 [0100.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) returned 1 [0100.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.470] lstrlenW (lpString=".doc") returned 4 [0100.470] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0100.470] lstrlenW (lpString=".docx") returned 5 [0100.470] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0100.470] lstrlenW (lpString=".pdf") returned 4 [0100.470] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0100.470] lstrlenW (lpString=".xls") returned 4 [0100.470] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0100.470] lstrlenW (lpString=".xlsx") returned 5 [0100.470] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0100.470] lstrlenW (lpString=".ppt") returned 4 [0100.470] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0100.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.470] lstrlenW (lpString=".zip") returned 4 [0100.470] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0100.470] lstrlenW (lpString=".rar") returned 4 [0100.470] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0100.471] lstrlenW (lpString=".bz2") returned 4 [0100.471] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0100.471] lstrlenW (lpString=".7z") returned 3 [0100.471] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0100.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.471] lstrlenW (lpString=".dbf") returned 4 [0100.471] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0100.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.471] lstrlenW (lpString=".1cd") returned 4 [0100.471] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0100.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0100.471] lstrlenW (lpString=".jpg") returned 4 [0100.471] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0100.471] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") [0100.677] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=124518) returned 1 [0100.677] CloseHandle (hObject=0x15c) returned 1 [0100.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt")) returned 0x20 [0100.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.677] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.677] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.678] GetLastError () returned 0x0 [0100.678] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1e666, lpOverlapped=0x0) returned 1 [0100.688] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1e670, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1e670, lpOverlapped=0x0) returned 1 [0100.691] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.691] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0100.691] SetEndOfFile (hFile=0x16c) returned 1 [0100.691] CloseHandle (hObject=0x16c) returned 1 [0100.691] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.691] SetEndOfFile (hFile=0x15c) returned 1 [0100.692] CloseHandle (hObject=0x15c) returned 1 [0100.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt")) returned 1 [0100.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.693] lstrlenW (lpString=".doc") returned 4 [0100.693] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.693] lstrlenW (lpString=".docx") returned 5 [0100.693] lstrcmpiW (lpString1=".docx", lpString2="s.fdt") returned -1 [0100.693] lstrlenW (lpString=".pdf") returned 4 [0100.693] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.693] lstrlenW (lpString=".xls") returned 4 [0100.693] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.693] lstrlenW (lpString=".xlsx") returned 5 [0100.693] lstrcmpiW (lpString1=".xlsx", lpString2="s.fdt") returned -1 [0100.693] lstrlenW (lpString=".ppt") returned 4 [0100.693] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.693] lstrlenW (lpString=".zip") returned 4 [0100.693] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.693] lstrlenW (lpString=".rar") returned 4 [0100.693] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.693] lstrlenW (lpString=".bz2") returned 4 [0100.693] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.694] lstrlenW (lpString=".7z") returned 3 [0100.694] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.694] lstrlenW (lpString=".dbf") returned 4 [0100.694] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.694] lstrlenW (lpString=".1cd") returned 4 [0100.694] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0100.694] lstrlenW (lpString=".jpg") returned 4 [0100.694] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.694] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") [0100.696] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2606) returned 1 [0100.696] CloseHandle (hObject=0x15c) returned 1 [0100.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico")) returned 0x20 [0100.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.696] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.696] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.697] GetLastError () returned 0x0 [0100.697] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa2e, lpOverlapped=0x0) returned 1 [0100.699] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa30, lpOverlapped=0x0) returned 1 [0100.700] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.700] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0100.700] SetEndOfFile (hFile=0x16c) returned 1 [0100.700] CloseHandle (hObject=0x16c) returned 1 [0100.700] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.700] SetEndOfFile (hFile=0x15c) returned 1 [0100.701] CloseHandle (hObject=0x15c) returned 1 [0100.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico")) returned 1 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString=".doc") returned 4 [0100.702] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.702] lstrlenW (lpString=".docx") returned 5 [0100.702] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0100.702] lstrlenW (lpString=".pdf") returned 4 [0100.702] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.702] lstrlenW (lpString=".xls") returned 4 [0100.702] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.702] lstrlenW (lpString=".xlsx") returned 5 [0100.702] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0100.702] lstrlenW (lpString=".ppt") returned 4 [0100.702] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString=".zip") returned 4 [0100.702] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.702] lstrlenW (lpString=".rar") returned 4 [0100.702] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.702] lstrlenW (lpString=".bz2") returned 4 [0100.702] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.702] lstrlenW (lpString=".7z") returned 3 [0100.702] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString=".dbf") returned 4 [0100.702] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString=".1cd") returned 4 [0100.702] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0100.702] lstrlenW (lpString=".jpg") returned 4 [0100.703] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.703] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") [0100.703] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2862) returned 1 [0100.703] CloseHandle (hObject=0x15c) returned 1 [0100.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico")) returned 0x20 [0100.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.703] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.703] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.704] GetLastError () returned 0x0 [0100.704] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb2e, lpOverlapped=0x0) returned 1 [0100.706] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb30, lpOverlapped=0x0) returned 1 [0100.706] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.706] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0100.707] SetEndOfFile (hFile=0x16c) returned 1 [0100.707] CloseHandle (hObject=0x16c) returned 1 [0100.707] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.707] SetEndOfFile (hFile=0x15c) returned 1 [0100.708] CloseHandle (hObject=0x15c) returned 1 [0100.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico")) returned 1 [0100.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.708] lstrlenW (lpString=".doc") returned 4 [0100.708] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.708] lstrlenW (lpString=".docx") returned 5 [0100.708] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0100.708] lstrlenW (lpString=".pdf") returned 4 [0100.708] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.708] lstrlenW (lpString=".xls") returned 4 [0100.708] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.708] lstrlenW (lpString=".xlsx") returned 5 [0100.708] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0100.708] lstrlenW (lpString=".ppt") returned 4 [0100.708] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.708] lstrlenW (lpString=".zip") returned 4 [0100.708] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.708] lstrlenW (lpString=".rar") returned 4 [0100.709] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.709] lstrlenW (lpString=".bz2") returned 4 [0100.709] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.709] lstrlenW (lpString=".7z") returned 3 [0100.709] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.709] lstrlenW (lpString=".dbf") returned 4 [0100.709] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.709] lstrlenW (lpString=".1cd") returned 4 [0100.709] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0100.709] lstrlenW (lpString=".jpg") returned 4 [0100.709] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.709] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") [0100.710] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2606) returned 1 [0100.710] CloseHandle (hObject=0x15c) returned 1 [0100.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico")) returned 0x20 [0100.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.711] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.711] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.711] GetLastError () returned 0x0 [0100.711] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa2e, lpOverlapped=0x0) returned 1 [0100.713] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa30, lpOverlapped=0x0) returned 1 [0100.714] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.714] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.714] SetEndOfFile (hFile=0x16c) returned 1 [0100.714] CloseHandle (hObject=0x16c) returned 1 [0100.714] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.714] SetEndOfFile (hFile=0x15c) returned 1 [0100.715] CloseHandle (hObject=0x15c) returned 1 [0100.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico")) returned 1 [0100.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.715] lstrlenW (lpString=".doc") returned 4 [0100.715] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.715] lstrlenW (lpString=".docx") returned 5 [0100.715] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0100.715] lstrlenW (lpString=".pdf") returned 4 [0100.715] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.715] lstrlenW (lpString=".xls") returned 4 [0100.715] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.715] lstrlenW (lpString=".xlsx") returned 5 [0100.715] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0100.715] lstrlenW (lpString=".ppt") returned 4 [0100.715] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.715] lstrlenW (lpString=".zip") returned 4 [0100.715] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.715] lstrlenW (lpString=".rar") returned 4 [0100.715] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.716] lstrlenW (lpString=".bz2") returned 4 [0100.716] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.716] lstrlenW (lpString=".7z") returned 3 [0100.716] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.716] lstrlenW (lpString=".dbf") returned 4 [0100.716] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.716] lstrlenW (lpString=".1cd") returned 4 [0100.716] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0100.716] lstrlenW (lpString=".jpg") returned 4 [0100.716] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.716] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") [0100.716] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3750) returned 1 [0100.716] CloseHandle (hObject=0x15c) returned 1 [0100.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico")) returned 0x20 [0100.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0100.717] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.717] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.717] GetLastError () returned 0x0 [0100.717] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xea6, lpOverlapped=0x0) returned 1 [0100.738] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0100.739] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0100.739] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0100.739] SetEndOfFile (hFile=0x16c) returned 1 [0100.748] CloseHandle (hObject=0x16c) returned 1 [0100.748] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0100.748] SetEndOfFile (hFile=0x15c) returned 1 [0100.787] CloseHandle (hObject=0x15c) returned 1 [0100.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico")) returned 1 [0100.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.970] lstrlenW (lpString=".doc") returned 4 [0100.970] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0100.970] lstrlenW (lpString=".docx") returned 5 [0100.974] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0100.974] lstrlenW (lpString=".pdf") returned 4 [0100.974] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0100.974] lstrlenW (lpString=".xls") returned 4 [0100.974] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0100.974] lstrlenW (lpString=".xlsx") returned 5 [0100.974] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0100.974] lstrlenW (lpString=".ppt") returned 4 [0100.974] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0100.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.974] lstrlenW (lpString=".zip") returned 4 [0100.974] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0100.974] lstrlenW (lpString=".rar") returned 4 [0100.974] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0100.974] lstrlenW (lpString=".bz2") returned 4 [0100.974] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0100.974] lstrlenW (lpString=".7z") returned 3 [0100.975] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0100.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.975] lstrlenW (lpString=".dbf") returned 4 [0100.975] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0100.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.975] lstrlenW (lpString=".1cd") returned 4 [0100.975] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0100.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0100.975] lstrlenW (lpString=".jpg") returned 4 [0100.975] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0100.975] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") [0101.059] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3438) returned 1 [0101.059] CloseHandle (hObject=0x1a0) returned 1 [0101.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico")) returned 0x20 [0101.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.059] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.059] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.060] GetLastError () returned 0x0 [0101.060] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd6e, lpOverlapped=0x0) returned 1 [0101.062] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd70, lpOverlapped=0x0) returned 1 [0101.063] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.063] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0101.063] SetEndOfFile (hFile=0x19c) returned 1 [0101.063] CloseHandle (hObject=0x19c) returned 1 [0101.063] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.063] SetEndOfFile (hFile=0x1a0) returned 1 [0101.064] CloseHandle (hObject=0x1a0) returned 1 [0101.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico")) returned 1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.064] lstrlenW (lpString=".doc") returned 4 [0101.064] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.064] lstrlenW (lpString=".docx") returned 5 [0101.064] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0101.064] lstrlenW (lpString=".pdf") returned 4 [0101.064] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.064] lstrlenW (lpString=".xls") returned 4 [0101.064] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.064] lstrlenW (lpString=".xlsx") returned 5 [0101.064] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0101.065] lstrlenW (lpString=".ppt") returned 4 [0101.065] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.065] lstrlenW (lpString=".zip") returned 4 [0101.065] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.065] lstrlenW (lpString=".rar") returned 4 [0101.065] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.065] lstrlenW (lpString=".bz2") returned 4 [0101.065] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.065] lstrlenW (lpString=".7z") returned 3 [0101.065] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.065] lstrlenW (lpString=".dbf") returned 4 [0101.065] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.065] lstrlenW (lpString=".1cd") returned 4 [0101.065] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0101.065] lstrlenW (lpString=".jpg") returned 4 [0101.065] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.065] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") [0101.066] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=318) returned 1 [0101.066] CloseHandle (hObject=0x1a0) returned 1 [0101.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico")) returned 0x20 [0101.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.066] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.066] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.067] GetLastError () returned 0x0 [0101.067] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x13e, lpOverlapped=0x0) returned 1 [0101.068] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x140, lpOverlapped=0x0) returned 1 [0101.069] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.069] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.069] SetEndOfFile (hFile=0x19c) returned 1 [0101.069] CloseHandle (hObject=0x19c) returned 1 [0101.069] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.069] SetEndOfFile (hFile=0x1a0) returned 1 [0101.070] CloseHandle (hObject=0x1a0) returned 1 [0101.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico")) returned 1 [0101.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.070] lstrlenW (lpString=".doc") returned 4 [0101.070] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.071] lstrlenW (lpString=".docx") returned 5 [0101.071] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0101.071] lstrlenW (lpString=".pdf") returned 4 [0101.071] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.071] lstrlenW (lpString=".xls") returned 4 [0101.071] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.071] lstrlenW (lpString=".xlsx") returned 5 [0101.071] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0101.071] lstrlenW (lpString=".ppt") returned 4 [0101.071] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.071] lstrlenW (lpString=".zip") returned 4 [0101.071] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.071] lstrlenW (lpString=".rar") returned 4 [0101.071] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.071] lstrlenW (lpString=".bz2") returned 4 [0101.071] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.071] lstrlenW (lpString=".7z") returned 3 [0101.071] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.071] lstrlenW (lpString=".dbf") returned 4 [0101.071] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.071] lstrlenW (lpString=".1cd") returned 4 [0101.071] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0101.071] lstrlenW (lpString=".jpg") returned 4 [0101.071] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.071] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") [0101.072] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1718) returned 1 [0101.072] CloseHandle (hObject=0x1a0) returned 1 [0101.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico")) returned 0x20 [0101.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.072] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.072] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.073] GetLastError () returned 0x0 [0101.073] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6b6, lpOverlapped=0x0) returned 1 [0101.074] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0101.075] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.075] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.076] SetEndOfFile (hFile=0x19c) returned 1 [0101.076] CloseHandle (hObject=0x19c) returned 1 [0101.076] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.076] SetEndOfFile (hFile=0x1a0) returned 1 [0101.077] CloseHandle (hObject=0x1a0) returned 1 [0101.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico")) returned 1 [0101.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.077] lstrlenW (lpString=".doc") returned 4 [0101.077] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0101.077] lstrlenW (lpString=".docx") returned 5 [0101.077] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0101.077] lstrlenW (lpString=".pdf") returned 4 [0101.077] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0101.077] lstrlenW (lpString=".xls") returned 4 [0101.077] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0101.077] lstrlenW (lpString=".xlsx") returned 5 [0101.077] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0101.077] lstrlenW (lpString=".ppt") returned 4 [0101.077] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0101.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.077] lstrlenW (lpString=".zip") returned 4 [0101.077] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0101.077] lstrlenW (lpString=".rar") returned 4 [0101.077] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0101.077] lstrlenW (lpString=".bz2") returned 4 [0101.078] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0101.078] lstrlenW (lpString=".7z") returned 3 [0101.078] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0101.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.078] lstrlenW (lpString=".dbf") returned 4 [0101.078] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0101.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.078] lstrlenW (lpString=".1cd") returned 4 [0101.078] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0101.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0101.078] lstrlenW (lpString=".jpg") returned 4 [0101.078] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0101.078] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") [0101.078] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=318) returned 1 [0101.078] CloseHandle (hObject=0x1a0) returned 1 [0101.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico")) returned 0x20 [0101.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.079] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.079] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.079] GetLastError () returned 0x0 [0101.079] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x13e, lpOverlapped=0x0) returned 1 [0101.080] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x140, lpOverlapped=0x0) returned 1 [0101.081] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.081] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.082] SetEndOfFile (hFile=0x19c) returned 1 [0101.082] CloseHandle (hObject=0x19c) returned 1 [0101.082] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.082] SetEndOfFile (hFile=0x1a0) returned 1 [0101.082] CloseHandle (hObject=0x1a0) returned 1 [0101.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico")) returned 1 [0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.083] lstrlenW (lpString=".doc") returned 4 [0101.083] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.083] lstrlenW (lpString=".docx") returned 5 [0101.083] lstrcmpiW (lpString1=".docx", lpString2="C.ico") returned -1 [0101.083] lstrlenW (lpString=".pdf") returned 4 [0101.083] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.083] lstrlenW (lpString=".xls") returned 4 [0101.083] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.084] lstrlenW (lpString=".xlsx") returned 5 [0101.084] lstrcmpiW (lpString1=".xlsx", lpString2="C.ico") returned -1 [0101.084] lstrlenW (lpString=".ppt") returned 4 [0101.084] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.084] lstrlenW (lpString=".zip") returned 4 [0101.084] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.084] lstrlenW (lpString=".rar") returned 4 [0101.084] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.084] lstrlenW (lpString=".bz2") returned 4 [0101.084] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.084] lstrlenW (lpString=".7z") returned 3 [0101.084] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.084] lstrlenW (lpString=".dbf") returned 4 [0101.084] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.084] lstrlenW (lpString=".1cd") returned 4 [0101.084] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0101.084] lstrlenW (lpString=".jpg") returned 4 [0101.084] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.084] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") [0101.085] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1718) returned 1 [0101.085] CloseHandle (hObject=0x1a0) returned 1 [0101.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico")) returned 0x20 [0101.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.085] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.085] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.086] GetLastError () returned 0x0 [0101.086] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x6b6, lpOverlapped=0x0) returned 1 [0101.132] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0101.141] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.141] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0101.141] SetEndOfFile (hFile=0x19c) returned 1 [0101.168] CloseHandle (hObject=0x19c) returned 1 [0101.168] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.168] SetEndOfFile (hFile=0x1a0) returned 1 [0101.169] CloseHandle (hObject=0x1a0) returned 1 [0101.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico")) returned 1 [0101.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.214] lstrlenW (lpString=".doc") returned 4 [0101.214] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.214] lstrlenW (lpString=".docx") returned 5 [0101.214] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0101.214] lstrlenW (lpString=".pdf") returned 4 [0101.214] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.214] lstrlenW (lpString=".xls") returned 4 [0101.215] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.215] lstrlenW (lpString=".xlsx") returned 5 [0101.215] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0101.215] lstrlenW (lpString=".ppt") returned 4 [0101.215] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.215] lstrlenW (lpString=".zip") returned 4 [0101.215] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.215] lstrlenW (lpString=".rar") returned 4 [0101.215] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.215] lstrlenW (lpString=".bz2") returned 4 [0101.215] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.215] lstrlenW (lpString=".7z") returned 3 [0101.215] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.215] lstrlenW (lpString=".dbf") returned 4 [0101.215] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.215] lstrlenW (lpString=".1cd") returned 4 [0101.215] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0101.215] lstrlenW (lpString=".jpg") returned 4 [0101.215] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.215] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") [0101.216] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2862) returned 1 [0101.216] CloseHandle (hObject=0x180) returned 1 [0101.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico")) returned 0x20 [0101.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.216] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.216] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0101.217] GetLastError () returned 0x0 [0101.217] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.218] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.219] ReadFile (in: hFile=0x180, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.219] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0101.220] SetEndOfFile (hFile=0x1f4) returned 1 [0101.220] CloseHandle (hObject=0x1f4) returned 1 [0101.220] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.220] SetEndOfFile (hFile=0x180) returned 1 [0101.221] CloseHandle (hObject=0x180) returned 1 [0101.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico")) returned 1 [0101.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.221] lstrlenW (lpString=".doc") returned 4 [0101.221] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.221] lstrlenW (lpString=".docx") returned 5 [0101.221] lstrcmpiW (lpString1=".docx", lpString2="b.ico") returned -1 [0101.221] lstrlenW (lpString=".pdf") returned 4 [0101.221] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.221] lstrlenW (lpString=".xls") returned 4 [0101.221] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.221] lstrlenW (lpString=".xlsx") returned 5 [0101.221] lstrcmpiW (lpString1=".xlsx", lpString2="b.ico") returned -1 [0101.221] lstrlenW (lpString=".ppt") returned 4 [0101.221] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.221] lstrlenW (lpString=".zip") returned 4 [0101.222] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.222] lstrlenW (lpString=".rar") returned 4 [0101.222] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.222] lstrlenW (lpString=".bz2") returned 4 [0101.222] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.222] lstrlenW (lpString=".7z") returned 3 [0101.222] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.222] lstrlenW (lpString=".dbf") returned 4 [0101.222] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.222] lstrlenW (lpString=".1cd") returned 4 [0101.222] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 74 [0101.222] lstrlenW (lpString=".jpg") returned 4 [0101.222] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.222] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") [0101.223] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=51456888) returned 1 [0101.223] CloseHandle (hObject=0x180) returned 1 [0101.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe")) returned 0x20 [0101.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0101.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0101.224] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0101.224] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.224] ReadFile (in: hFile=0x180, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.308] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x105b928, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.308] ReadFile (in: hFile=0x180, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0101.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x30d2b78, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.361] ReadFile (in: hFile=0x180, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.386] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.386] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0101.510] SetEndOfFile (hFile=0x180) returned 1 [0101.511] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0101.511] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.511] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.511] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x105b928, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.511] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.512] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x30d2b78, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.512] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.513] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0101.514] CloseHandle (hObject=0x180) returned 1 [0101.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.514] lstrlenW (lpString=".doc") returned 4 [0101.514] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0101.514] lstrlenW (lpString=".docx") returned 5 [0101.514] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0101.514] lstrlenW (lpString=".pdf") returned 4 [0101.514] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0101.514] lstrlenW (lpString=".xls") returned 4 [0101.514] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0101.514] lstrlenW (lpString=".xlsx") returned 5 [0101.514] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0101.514] lstrlenW (lpString=".ppt") returned 4 [0101.514] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0101.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.514] lstrlenW (lpString=".zip") returned 4 [0101.514] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0101.514] lstrlenW (lpString=".rar") returned 4 [0101.514] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0101.514] lstrlenW (lpString=".bz2") returned 4 [0101.514] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0101.514] lstrlenW (lpString=".7z") returned 3 [0101.514] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0101.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.514] lstrlenW (lpString=".dbf") returned 4 [0101.514] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0101.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.515] lstrlenW (lpString=".1cd") returned 4 [0101.515] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0101.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0101.515] lstrlenW (lpString=".jpg") returned 4 [0101.515] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0101.515] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") [0101.683] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=230280) returned 1 [0101.684] CloseHandle (hObject=0x22c) returned 1 [0101.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll")) returned 0x20 [0101.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.684] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.684] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.685] GetLastError () returned 0x0 [0101.685] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x38388, lpOverlapped=0x0) returned 1 [0101.692] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x38390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x38390, lpOverlapped=0x0) returned 1 [0101.696] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.696] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.696] SetEndOfFile (hFile=0x158) returned 1 [0101.696] CloseHandle (hObject=0x158) returned 1 [0101.696] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.696] SetEndOfFile (hFile=0x22c) returned 1 [0101.698] CloseHandle (hObject=0x22c) returned 1 [0101.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll")) returned 1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString=".doc") returned 4 [0101.699] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString=".docx") returned 5 [0101.699] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0101.699] lstrlenW (lpString=".pdf") returned 4 [0101.699] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString=".xls") returned 4 [0101.699] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString=".xlsx") returned 5 [0101.699] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0101.699] lstrlenW (lpString=".ppt") returned 4 [0101.699] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString=".zip") returned 4 [0101.699] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString=".rar") returned 4 [0101.699] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.699] lstrlenW (lpString=".bz2") returned 4 [0101.699] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.699] lstrlenW (lpString=".7z") returned 3 [0101.699] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString=".dbf") returned 4 [0101.699] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString=".1cd") returned 4 [0101.699] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0101.699] lstrlenW (lpString=".jpg") returned 4 [0101.699] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.700] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") [0101.701] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=16272) returned 1 [0101.701] CloseHandle (hObject=0x22c) returned 1 [0101.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll")) returned 0x20 [0101.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.702] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.702] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.702] GetLastError () returned 0x0 [0101.703] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3f90, lpOverlapped=0x0) returned 1 [0101.704] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3fa0, lpOverlapped=0x0) returned 1 [0101.705] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.705] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.706] SetEndOfFile (hFile=0x158) returned 1 [0101.706] CloseHandle (hObject=0x158) returned 1 [0101.706] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.706] SetEndOfFile (hFile=0x22c) returned 1 [0101.707] CloseHandle (hObject=0x22c) returned 1 [0101.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll")) returned 1 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.707] lstrlenW (lpString=".doc") returned 4 [0101.707] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.707] lstrlenW (lpString=".docx") returned 5 [0101.707] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0101.707] lstrlenW (lpString=".pdf") returned 4 [0101.707] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.707] lstrlenW (lpString=".xls") returned 4 [0101.707] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.707] lstrlenW (lpString=".xlsx") returned 5 [0101.707] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0101.707] lstrlenW (lpString=".ppt") returned 4 [0101.707] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.708] lstrlenW (lpString=".zip") returned 4 [0101.708] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.708] lstrlenW (lpString=".rar") returned 4 [0101.708] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.708] lstrlenW (lpString=".bz2") returned 4 [0101.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.708] lstrlenW (lpString=".7z") returned 3 [0101.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.708] lstrlenW (lpString=".dbf") returned 4 [0101.708] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.708] lstrlenW (lpString=".1cd") returned 4 [0101.708] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0101.708] lstrlenW (lpString=".jpg") returned 4 [0101.708] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.708] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") [0101.709] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2578288) returned 1 [0101.709] CloseHandle (hObject=0x22c) returned 1 [0101.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe")) returned 0x20 [0101.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0101.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.710] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0101.710] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.710] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.714] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd1d25, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.714] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.728] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0101.728] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x235770, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0101.728] ReadFile (in: hFile=0x22c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0101.807] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.807] WriteFile (in: hFile=0x22c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0101.825] SetEndOfFile (hFile=0x22c) returned 1 [0101.826] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0101.826] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.827] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd1d25, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.890] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x235770, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0101.890] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.912] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0101.912] CloseHandle (hObject=0x22c) returned 1 [0101.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.912] lstrlenW (lpString=".doc") returned 4 [0101.912] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0101.912] lstrlenW (lpString=".docx") returned 5 [0101.912] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0101.912] lstrlenW (lpString=".pdf") returned 4 [0101.912] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0101.912] lstrlenW (lpString=".xls") returned 4 [0101.912] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0101.912] lstrlenW (lpString=".xlsx") returned 5 [0101.912] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0101.912] lstrlenW (lpString=".ppt") returned 4 [0101.912] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0101.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.912] lstrlenW (lpString=".zip") returned 4 [0101.912] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0101.912] lstrlenW (lpString=".rar") returned 4 [0101.913] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0101.913] lstrlenW (lpString=".bz2") returned 4 [0101.913] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0101.913] lstrlenW (lpString=".7z") returned 3 [0101.913] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0101.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.913] lstrlenW (lpString=".dbf") returned 4 [0101.913] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0101.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.913] lstrlenW (lpString=".1cd") returned 4 [0101.913] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0101.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0101.913] lstrlenW (lpString=".jpg") returned 4 [0101.913] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0101.913] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") [0101.914] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=544768) returned 1 [0101.914] CloseHandle (hObject=0x22c) returned 1 [0101.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss")) returned 0x20 [0101.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.915] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.915] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.916] GetLastError () returned 0x0 [0101.916] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x85000, lpOverlapped=0x0) returned 1 [0101.929] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x85010, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x85010, lpOverlapped=0x0) returned 1 [0101.940] ReadFile (in: hFile=0x22c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0101.940] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x102, lpOverlapped=0x0) returned 1 [0101.940] SetEndOfFile (hFile=0x1c0) returned 1 [0101.940] CloseHandle (hObject=0x1c0) returned 1 [0101.940] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0101.940] SetEndOfFile (hFile=0x22c) returned 1 [0102.162] CloseHandle (hObject=0x22c) returned 1 [0102.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss")) returned 1 [0102.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString=".doc") returned 4 [0102.286] lstrcmpiW (lpString1=".doc", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString=".docx") returned 5 [0102.286] lstrcmpiW (lpString1=".docx", lpString2="4.xss") returned -1 [0102.286] lstrlenW (lpString=".pdf") returned 4 [0102.286] lstrcmpiW (lpString1=".pdf", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString=".xls") returned 4 [0102.286] lstrcmpiW (lpString1=".xls", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString=".xlsx") returned 5 [0102.286] lstrcmpiW (lpString1=".xlsx", lpString2="4.xss") returned -1 [0102.286] lstrlenW (lpString=".ppt") returned 4 [0102.286] lstrcmpiW (lpString1=".ppt", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString=".zip") returned 4 [0102.286] lstrcmpiW (lpString1=".zip", lpString2=".xss") returned 1 [0102.286] lstrlenW (lpString=".rar") returned 4 [0102.286] lstrcmpiW (lpString1=".rar", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString=".bz2") returned 4 [0102.286] lstrcmpiW (lpString1=".bz2", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString=".7z") returned 3 [0102.286] lstrcmpiW (lpString1=".7z", lpString2="xss") returned -1 [0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString=".dbf") returned 4 [0102.286] lstrcmpiW (lpString1=".dbf", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString=".1cd") returned 4 [0102.286] lstrcmpiW (lpString1=".1cd", lpString2=".xss") returned -1 [0102.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 66 [0102.286] lstrlenW (lpString=".jpg") returned 4 [0102.286] lstrcmpiW (lpString1=".jpg", lpString2=".xss") returned -1 [0102.287] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") [0102.339] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=175520) returned 1 [0102.339] CloseHandle (hObject=0x158) returned 1 [0102.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl")) returned 0x20 [0102.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.339] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.339] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.340] GetLastError () returned 0x0 [0102.340] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2ada0, lpOverlapped=0x0) returned 1 [0102.347] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2adb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2adb0, lpOverlapped=0x0) returned 1 [0102.351] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0102.351] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0102.351] SetEndOfFile (hFile=0x16c) returned 1 [0102.351] CloseHandle (hObject=0x16c) returned 1 [0102.351] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.351] SetEndOfFile (hFile=0x158) returned 1 [0102.353] CloseHandle (hObject=0x158) returned 1 [0102.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl")) returned 1 [0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.353] lstrlenW (lpString=".doc") returned 4 [0102.353] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.353] lstrlenW (lpString=".docx") returned 5 [0102.353] lstrcmpiW (lpString1=".docx", lpString2="B.PDL") returned -1 [0102.353] lstrlenW (lpString=".pdf") returned 4 [0102.353] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.353] lstrlenW (lpString=".xls") returned 4 [0102.353] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.353] lstrlenW (lpString=".xlsx") returned 5 [0102.353] lstrcmpiW (lpString1=".xlsx", lpString2="B.PDL") returned -1 [0102.353] lstrlenW (lpString=".ppt") returned 4 [0102.353] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.353] lstrlenW (lpString=".zip") returned 4 [0102.354] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.354] lstrlenW (lpString=".rar") returned 4 [0102.354] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.354] lstrlenW (lpString=".bz2") returned 4 [0102.354] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.354] lstrlenW (lpString=".7z") returned 3 [0102.354] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.354] lstrlenW (lpString=".dbf") returned 4 [0102.354] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.354] lstrlenW (lpString=".1cd") returned 4 [0102.354] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 54 [0102.354] lstrlenW (lpString=".jpg") returned 4 [0102.354] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.354] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") [0102.355] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=196008) returned 1 [0102.355] CloseHandle (hObject=0x158) returned 1 [0102.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl")) returned 0x20 [0102.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.355] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.355] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.356] GetLastError () returned 0x0 [0102.356] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2fda8, lpOverlapped=0x0) returned 1 [0102.361] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2fdb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2fdb0, lpOverlapped=0x0) returned 1 [0102.365] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0102.366] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0102.366] SetEndOfFile (hFile=0x16c) returned 1 [0102.366] CloseHandle (hObject=0x16c) returned 1 [0102.366] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.366] SetEndOfFile (hFile=0x158) returned 1 [0102.368] CloseHandle (hObject=0x158) returned 1 [0102.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl")) returned 1 [0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.368] lstrlenW (lpString=".doc") returned 4 [0102.368] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.368] lstrlenW (lpString=".docx") returned 5 [0102.368] lstrcmpiW (lpString1=".docx", lpString2="V.PDL") returned -1 [0102.368] lstrlenW (lpString=".pdf") returned 4 [0102.368] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.368] lstrlenW (lpString=".xls") returned 4 [0102.368] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.368] lstrlenW (lpString=".xlsx") returned 5 [0102.368] lstrcmpiW (lpString1=".xlsx", lpString2="V.PDL") returned -1 [0102.368] lstrlenW (lpString=".ppt") returned 4 [0102.368] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.368] lstrlenW (lpString=".zip") returned 4 [0102.368] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.368] lstrlenW (lpString=".rar") returned 4 [0102.368] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.369] lstrlenW (lpString=".bz2") returned 4 [0102.369] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.369] lstrlenW (lpString=".7z") returned 3 [0102.369] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.369] lstrlenW (lpString=".dbf") returned 4 [0102.369] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.369] lstrlenW (lpString=".1cd") returned 4 [0102.369] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 53 [0102.369] lstrlenW (lpString=".jpg") returned 4 [0102.369] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.369] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") [0102.370] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=318336) returned 1 [0102.370] CloseHandle (hObject=0x158) returned 1 [0102.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll")) returned 0x20 [0102.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.370] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.370] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.371] GetLastError () returned 0x0 [0102.371] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4db80, lpOverlapped=0x0) returned 1 [0102.570] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4db90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4db90, lpOverlapped=0x0) returned 1 [0102.576] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0102.576] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0102.576] SetEndOfFile (hFile=0x16c) returned 1 [0102.576] CloseHandle (hObject=0x16c) returned 1 [0102.576] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.576] SetEndOfFile (hFile=0x158) returned 1 [0102.580] CloseHandle (hObject=0x158) returned 1 [0102.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll")) returned 1 [0102.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.580] lstrlenW (lpString=".doc") returned 4 [0102.580] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.580] lstrlenW (lpString=".docx") returned 5 [0102.580] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.580] lstrlenW (lpString=".pdf") returned 4 [0102.580] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.580] lstrlenW (lpString=".xls") returned 4 [0102.580] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.580] lstrlenW (lpString=".xlsx") returned 5 [0102.580] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.580] lstrlenW (lpString=".ppt") returned 4 [0102.580] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.581] lstrlenW (lpString=".zip") returned 4 [0102.581] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.581] lstrlenW (lpString=".rar") returned 4 [0102.581] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.581] lstrlenW (lpString=".bz2") returned 4 [0102.581] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.581] lstrlenW (lpString=".7z") returned 3 [0102.581] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.581] lstrlenW (lpString=".dbf") returned 4 [0102.581] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.581] lstrlenW (lpString=".1cd") returned 4 [0102.581] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 53 [0102.581] lstrlenW (lpString=".jpg") returned 4 [0102.581] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.581] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") [0102.583] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=244576) returned 1 [0102.583] CloseHandle (hObject=0x158) returned 1 [0102.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll")) returned 0x20 [0102.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.584] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.584] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.585] GetLastError () returned 0x0 [0102.585] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3bb60, lpOverlapped=0x0) returned 1 [0102.625] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3bb70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3bb70, lpOverlapped=0x0) returned 1 [0102.629] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0102.630] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.630] SetEndOfFile (hFile=0x16c) returned 1 [0102.630] CloseHandle (hObject=0x16c) returned 1 [0102.632] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.632] SetEndOfFile (hFile=0x158) returned 1 [0102.634] CloseHandle (hObject=0x158) returned 1 [0102.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll")) returned 1 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.635] lstrlenW (lpString=".doc") returned 4 [0102.635] lstrcmpiW (lpString1=".doc", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString=".docx") returned 5 [0102.635] lstrcmpiW (lpString1=".docx", lpString2="2.XLL") returned -1 [0102.635] lstrlenW (lpString=".pdf") returned 4 [0102.635] lstrcmpiW (lpString1=".pdf", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString=".xls") returned 4 [0102.635] lstrcmpiW (lpString1=".xls", lpString2=".XLL") returned 1 [0102.635] lstrlenW (lpString=".xlsx") returned 5 [0102.635] lstrcmpiW (lpString1=".xlsx", lpString2="2.XLL") returned -1 [0102.635] lstrlenW (lpString=".ppt") returned 4 [0102.635] lstrcmpiW (lpString1=".ppt", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.635] lstrlenW (lpString=".zip") returned 4 [0102.635] lstrcmpiW (lpString1=".zip", lpString2=".XLL") returned 1 [0102.635] lstrlenW (lpString=".rar") returned 4 [0102.635] lstrcmpiW (lpString1=".rar", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString=".bz2") returned 4 [0102.635] lstrcmpiW (lpString1=".bz2", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString=".7z") returned 3 [0102.635] lstrcmpiW (lpString1=".7z", lpString2="XLL") returned -1 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.635] lstrlenW (lpString=".dbf") returned 4 [0102.635] lstrcmpiW (lpString1=".dbf", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.635] lstrlenW (lpString=".1cd") returned 4 [0102.635] lstrcmpiW (lpString1=".1cd", lpString2=".XLL") returned -1 [0102.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 72 [0102.636] lstrlenW (lpString=".jpg") returned 4 [0102.636] lstrcmpiW (lpString1=".jpg", lpString2=".XLL") returned -1 [0102.636] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") [0102.636] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1028000) returned 1 [0102.637] CloseHandle (hObject=0x158) returned 1 [0102.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll")) returned 0x20 [0102.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0102.637] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.637] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0102.638] GetLastError () returned 0x0 [0102.638] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xfafa0, lpOverlapped=0x0) returned 1 [0102.696] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfafb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfafb0, lpOverlapped=0x0) returned 1 [0102.903] ReadFile (in: hFile=0x158, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0102.903] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.903] SetEndOfFile (hFile=0x16c) returned 1 [0102.903] CloseHandle (hObject=0x16c) returned 1 [0102.903] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0102.903] SetEndOfFile (hFile=0x158) returned 1 [0102.911] CloseHandle (hObject=0x158) returned 1 [0102.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll")) returned 1 [0102.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.970] lstrlenW (lpString=".doc") returned 4 [0102.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.970] lstrlenW (lpString=".docx") returned 5 [0102.970] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0102.970] lstrlenW (lpString=".pdf") returned 4 [0102.970] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.971] lstrlenW (lpString=".xls") returned 4 [0102.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.971] lstrlenW (lpString=".xlsx") returned 5 [0102.971] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0102.971] lstrlenW (lpString=".ppt") returned 4 [0102.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.971] lstrlenW (lpString=".zip") returned 4 [0102.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.971] lstrlenW (lpString=".rar") returned 4 [0102.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.971] lstrlenW (lpString=".bz2") returned 4 [0102.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.971] lstrlenW (lpString=".7z") returned 3 [0102.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.971] lstrlenW (lpString=".dbf") returned 4 [0102.971] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.971] lstrlenW (lpString=".1cd") returned 4 [0102.971] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 55 [0102.971] lstrlenW (lpString=".jpg") returned 4 [0102.971] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.971] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") [0103.069] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=144752) returned 1 [0103.069] CloseHandle (hObject=0x1f4) returned 1 [0103.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll")) returned 0x20 [0103.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.070] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.070] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.070] GetLastError () returned 0x0 [0103.070] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x23570, lpOverlapped=0x0) returned 1 [0103.253] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x23580, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x23580, lpOverlapped=0x0) returned 1 [0103.256] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0103.256] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0103.256] SetEndOfFile (hFile=0x1b8) returned 1 [0103.256] CloseHandle (hObject=0x1b8) returned 1 [0103.256] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.256] SetEndOfFile (hFile=0x1f4) returned 1 [0103.258] CloseHandle (hObject=0x1f4) returned 1 [0103.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll")) returned 1 [0103.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.258] lstrlenW (lpString=".doc") returned 4 [0103.258] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.258] lstrlenW (lpString=".docx") returned 5 [0103.258] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0103.258] lstrlenW (lpString=".pdf") returned 4 [0103.258] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.259] lstrlenW (lpString=".xls") returned 4 [0103.259] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.259] lstrlenW (lpString=".xlsx") returned 5 [0103.259] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0103.259] lstrlenW (lpString=".ppt") returned 4 [0103.259] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.259] lstrlenW (lpString=".zip") returned 4 [0103.259] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.259] lstrlenW (lpString=".rar") returned 4 [0103.259] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.259] lstrlenW (lpString=".bz2") returned 4 [0103.259] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.259] lstrlenW (lpString=".7z") returned 3 [0103.259] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.259] lstrlenW (lpString=".dbf") returned 4 [0103.259] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.259] lstrlenW (lpString=".1cd") returned 4 [0103.259] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 51 [0103.259] lstrlenW (lpString=".jpg") returned 4 [0103.259] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.259] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") [0103.260] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=42880) returned 1 [0103.260] CloseHandle (hObject=0x1f4) returned 1 [0103.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll")) returned 0x20 [0103.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.261] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.261] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.262] GetLastError () returned 0x0 [0103.262] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa780, lpOverlapped=0x0) returned 1 [0103.362] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa790, lpOverlapped=0x0) returned 1 [0103.363] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0103.363] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x126, lpOverlapped=0x0) returned 1 [0103.363] SetEndOfFile (hFile=0x1b8) returned 1 [0103.363] CloseHandle (hObject=0x1b8) returned 1 [0103.363] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.363] SetEndOfFile (hFile=0x1f4) returned 1 [0103.364] CloseHandle (hObject=0x1f4) returned 1 [0103.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll")) returned 1 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.365] lstrlenW (lpString=".doc") returned 4 [0103.365] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.365] lstrlenW (lpString=".docx") returned 5 [0103.365] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0103.365] lstrlenW (lpString=".pdf") returned 4 [0103.365] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.365] lstrlenW (lpString=".xls") returned 4 [0103.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.365] lstrlenW (lpString=".xlsx") returned 5 [0103.365] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0103.365] lstrlenW (lpString=".ppt") returned 4 [0103.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.365] lstrlenW (lpString=".zip") returned 4 [0103.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.365] lstrlenW (lpString=".rar") returned 4 [0103.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.366] lstrlenW (lpString=".bz2") returned 4 [0103.366] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.366] lstrlenW (lpString=".7z") returned 3 [0103.366] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.366] lstrlenW (lpString=".dbf") returned 4 [0103.366] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.366] lstrlenW (lpString=".1cd") returned 4 [0103.366] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 84 [0103.366] lstrlenW (lpString=".jpg") returned 4 [0103.366] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.366] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") [0103.367] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=407440) returned 1 [0103.367] CloseHandle (hObject=0x1f4) returned 1 [0103.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll")) returned 0x20 [0103.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0103.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0103.368] GetLastError () returned 0x0 [0103.368] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x63790, lpOverlapped=0x0) returned 1 [0103.543] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x637a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x637a0, lpOverlapped=0x0) returned 1 [0103.550] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0103.550] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x132, lpOverlapped=0x0) returned 1 [0103.550] SetEndOfFile (hFile=0x1b8) returned 1 [0103.726] CloseHandle (hObject=0x1b8) returned 1 [0103.726] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.726] SetEndOfFile (hFile=0x1f4) returned 1 [0103.729] CloseHandle (hObject=0x1f4) returned 1 [0103.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll")) returned 1 [0103.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.741] lstrlenW (lpString=".doc") returned 4 [0103.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.741] lstrlenW (lpString=".docx") returned 5 [0103.741] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0103.741] lstrlenW (lpString=".pdf") returned 4 [0103.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.741] lstrlenW (lpString=".xls") returned 4 [0103.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.741] lstrlenW (lpString=".xlsx") returned 5 [0103.741] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0103.741] lstrlenW (lpString=".ppt") returned 4 [0103.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.742] lstrlenW (lpString=".zip") returned 4 [0103.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.742] lstrlenW (lpString=".rar") returned 4 [0103.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.742] lstrlenW (lpString=".bz2") returned 4 [0103.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.742] lstrlenW (lpString=".7z") returned 3 [0103.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.742] lstrlenW (lpString=".dbf") returned 4 [0103.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.742] lstrlenW (lpString=".1cd") returned 4 [0103.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 90 [0103.742] lstrlenW (lpString=".jpg") returned 4 [0103.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.742] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") [0103.938] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=22912) returned 1 [0103.938] CloseHandle (hObject=0x16c) returned 1 [0103.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll")) returned 0x20 [0103.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.939] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.939] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0103.940] GetLastError () returned 0x0 [0103.940] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x5980, lpOverlapped=0x0) returned 1 [0103.942] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x5990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x5990, lpOverlapped=0x0) returned 1 [0103.944] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0103.944] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0103.944] SetEndOfFile (hFile=0x1fc) returned 1 [0103.944] CloseHandle (hObject=0x1fc) returned 1 [0103.944] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0103.944] SetEndOfFile (hFile=0x16c) returned 1 [0103.945] CloseHandle (hObject=0x16c) returned 1 [0103.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll")) returned 1 [0103.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString=".doc") returned 4 [0103.946] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString=".docx") returned 5 [0103.946] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0103.946] lstrlenW (lpString=".pdf") returned 4 [0103.946] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString=".xls") returned 4 [0103.946] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString=".xlsx") returned 5 [0103.946] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0103.946] lstrlenW (lpString=".ppt") returned 4 [0103.946] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString=".zip") returned 4 [0103.946] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString=".rar") returned 4 [0103.946] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.946] lstrlenW (lpString=".bz2") returned 4 [0103.946] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.946] lstrlenW (lpString=".7z") returned 3 [0103.946] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString=".dbf") returned 4 [0103.946] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString=".1cd") returned 4 [0103.946] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 54 [0103.946] lstrlenW (lpString=".jpg") returned 4 [0103.946] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.946] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") [0103.947] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=20106080) returned 1 [0103.947] CloseHandle (hObject=0x16c) returned 1 [0103.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe")) returned 0x20 [0103.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0103.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.948] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0103.948] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0103.948] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0103.993] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6643ca, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0103.994] ReadFile (in: hFile=0x16c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x12ecb60, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0104.002] ReadFile (in: hFile=0x16c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.024] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.024] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0104.085] SetEndOfFile (hFile=0x16c) returned 1 [0104.085] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0104.085] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0104.085] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.201] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6643ca, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0104.201] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.202] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x12ecb60, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0104.202] WriteFile (in: hFile=0x16c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.204] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0104.204] CloseHandle (hObject=0x16c) returned 1 [0104.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.284] lstrlenW (lpString=".doc") returned 4 [0104.284] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0104.285] lstrlenW (lpString=".docx") returned 5 [0104.285] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0104.285] lstrlenW (lpString=".pdf") returned 4 [0104.285] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0104.285] lstrlenW (lpString=".xls") returned 4 [0104.285] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0104.285] lstrlenW (lpString=".xlsx") returned 5 [0104.285] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0104.285] lstrlenW (lpString=".ppt") returned 4 [0104.285] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0104.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.285] lstrlenW (lpString=".zip") returned 4 [0104.285] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0104.285] lstrlenW (lpString=".rar") returned 4 [0104.285] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0104.285] lstrlenW (lpString=".bz2") returned 4 [0104.285] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0104.285] lstrlenW (lpString=".7z") returned 3 [0104.285] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0104.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.285] lstrlenW (lpString=".dbf") returned 4 [0104.285] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0104.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.285] lstrlenW (lpString=".1cd") returned 4 [0104.285] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0104.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 55 [0104.285] lstrlenW (lpString=".jpg") returned 4 [0104.285] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0104.285] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") [0104.502] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2636) returned 1 [0104.502] CloseHandle (hObject=0x15c) returned 1 [0104.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf")) returned 0x20 [0104.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.503] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.503] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0104.503] GetLastError () returned 0x0 [0104.503] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa4c, lpOverlapped=0x0) returned 1 [0104.505] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa50, lpOverlapped=0x0) returned 1 [0104.506] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0104.506] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0104.506] SetEndOfFile (hFile=0x1c0) returned 1 [0104.506] CloseHandle (hObject=0x1c0) returned 1 [0104.506] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.506] SetEndOfFile (hFile=0x15c) returned 1 [0104.507] CloseHandle (hObject=0x15c) returned 1 [0104.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf")) returned 1 [0104.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.507] lstrlenW (lpString=".doc") returned 4 [0104.507] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0104.507] lstrlenW (lpString=".docx") returned 5 [0104.507] lstrcmpiW (lpString1=".docx", lpString2="1.INF") returned -1 [0104.508] lstrlenW (lpString=".pdf") returned 4 [0104.508] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0104.508] lstrlenW (lpString=".xls") returned 4 [0104.508] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0104.508] lstrlenW (lpString=".xlsx") returned 5 [0104.508] lstrcmpiW (lpString1=".xlsx", lpString2="1.INF") returned -1 [0104.508] lstrlenW (lpString=".ppt") returned 4 [0104.508] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0104.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.508] lstrlenW (lpString=".zip") returned 4 [0104.508] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0104.508] lstrlenW (lpString=".rar") returned 4 [0104.508] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0104.508] lstrlenW (lpString=".bz2") returned 4 [0104.508] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0104.508] lstrlenW (lpString=".7z") returned 3 [0104.508] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0104.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.508] lstrlenW (lpString=".dbf") returned 4 [0104.508] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0104.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.508] lstrlenW (lpString=".1cd") returned 4 [0104.508] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0104.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 54 [0104.508] lstrlenW (lpString=".jpg") returned 4 [0104.508] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0104.508] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") [0104.509] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3072) returned 1 [0104.509] CloseHandle (hObject=0x15c) returned 1 [0104.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub")) returned 0x20 [0104.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.509] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.509] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0104.510] GetLastError () returned 0x0 [0104.510] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xc00, lpOverlapped=0x0) returned 1 [0104.511] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xc10, lpOverlapped=0x0) returned 1 [0104.512] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0104.512] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0104.512] SetEndOfFile (hFile=0x1c0) returned 1 [0104.513] CloseHandle (hObject=0x1c0) returned 1 [0104.513] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.513] SetEndOfFile (hFile=0x15c) returned 1 [0104.513] CloseHandle (hObject=0x15c) returned 1 [0104.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub")) returned 1 [0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.514] lstrlenW (lpString=".doc") returned 4 [0104.514] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.514] lstrlenW (lpString=".docx") returned 5 [0104.514] lstrcmpiW (lpString1=".docx", lpString2="r.dub") returned -1 [0104.514] lstrlenW (lpString=".pdf") returned 4 [0104.514] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.514] lstrlenW (lpString=".xls") returned 4 [0104.514] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.514] lstrlenW (lpString=".xlsx") returned 5 [0104.514] lstrcmpiW (lpString1=".xlsx", lpString2="r.dub") returned -1 [0104.514] lstrlenW (lpString=".ppt") returned 4 [0104.514] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.514] lstrlenW (lpString=".zip") returned 4 [0104.514] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.514] lstrlenW (lpString=".rar") returned 4 [0104.514] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.514] lstrlenW (lpString=".bz2") returned 4 [0104.514] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.515] lstrlenW (lpString=".7z") returned 3 [0104.515] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.515] lstrlenW (lpString=".dbf") returned 4 [0104.515] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.515] lstrlenW (lpString=".1cd") returned 4 [0104.515] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 59 [0104.515] lstrlenW (lpString=".jpg") returned 4 [0104.515] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.515] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") [0104.516] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=977320) returned 1 [0104.516] CloseHandle (hObject=0x15c) returned 1 [0104.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll")) returned 0x20 [0104.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.516] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.516] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0104.517] GetLastError () returned 0x0 [0104.517] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xee9a8, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee9b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee9b0, lpOverlapped=0x0) returned 1 [0104.811] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0104.811] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0104.811] SetEndOfFile (hFile=0x1c0) returned 1 [0104.811] CloseHandle (hObject=0x1c0) returned 1 [0104.812] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.812] SetEndOfFile (hFile=0x15c) returned 1 [0104.819] CloseHandle (hObject=0x15c) returned 1 [0104.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll")) returned 1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.820] lstrlenW (lpString=".doc") returned 4 [0104.820] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString=".docx") returned 5 [0104.820] lstrcmpiW (lpString1=".docx", lpString2="7.dll") returned -1 [0104.820] lstrlenW (lpString=".pdf") returned 4 [0104.820] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString=".xls") returned 4 [0104.820] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString=".xlsx") returned 5 [0104.820] lstrcmpiW (lpString1=".xlsx", lpString2="7.dll") returned -1 [0104.820] lstrlenW (lpString=".ppt") returned 4 [0104.820] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.820] lstrlenW (lpString=".zip") returned 4 [0104.820] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString=".rar") returned 4 [0104.820] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.820] lstrlenW (lpString=".bz2") returned 4 [0104.820] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.820] lstrlenW (lpString=".7z") returned 3 [0104.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.821] lstrlenW (lpString=".dbf") returned 4 [0104.821] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.821] lstrlenW (lpString=".1cd") returned 4 [0104.821] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 52 [0104.821] lstrlenW (lpString=".jpg") returned 4 [0104.821] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.821] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") [0104.821] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1854492) returned 1 [0104.822] CloseHandle (hObject=0x15c) returned 1 [0104.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic")) returned 0x20 [0104.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0104.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.823] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0104.823] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0104.823] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.826] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x96eb4, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0104.826] ReadFile (in: hFile=0x15c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.831] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.832] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x184c1c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0104.832] ReadFile (in: hFile=0x15c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.988] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0104.988] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0105.010] SetEndOfFile (hFile=0x15c) returned 1 [0105.101] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0105.108] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0105.108] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.133] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x96eb4, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0105.134] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.136] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x184c1c, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0105.136] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.138] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0105.138] CloseHandle (hObject=0x15c) returned 1 [0105.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.237] lstrlenW (lpString=".doc") returned 4 [0105.237] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0105.237] lstrlenW (lpString=".docx") returned 5 [0105.237] lstrcmpiW (lpString1=".docx", lpString2="r.kic") returned -1 [0105.237] lstrlenW (lpString=".pdf") returned 4 [0105.237] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0105.237] lstrlenW (lpString=".xls") returned 4 [0105.237] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0105.237] lstrlenW (lpString=".xlsx") returned 5 [0105.237] lstrcmpiW (lpString1=".xlsx", lpString2="r.kic") returned -1 [0105.237] lstrlenW (lpString=".ppt") returned 4 [0105.237] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.237] lstrlenW (lpString=".zip") returned 4 [0105.237] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0105.238] lstrlenW (lpString=".rar") returned 4 [0105.238] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0105.238] lstrlenW (lpString=".bz2") returned 4 [0105.247] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0105.247] lstrlenW (lpString=".7z") returned 3 [0105.247] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0105.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.247] lstrlenW (lpString=".dbf") returned 4 [0105.247] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0105.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.247] lstrlenW (lpString=".1cd") returned 4 [0105.247] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0105.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 54 [0105.247] lstrlenW (lpString=".jpg") returned 4 [0105.247] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0105.247] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") [0105.287] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1111960) returned 1 [0105.289] CloseHandle (hObject=0x1b8) returned 1 [0105.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll")) returned 0x20 [0105.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.289] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.289] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.291] GetLastError () returned 0x0 [0105.291] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0105.314] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0105.581] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf7a8, lpOverlapped=0x0) returned 1 [0105.589] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf7b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf7b0, lpOverlapped=0x0) returned 1 [0105.594] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0105.594] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0105.594] SetEndOfFile (hFile=0x1c8) returned 1 [0105.594] CloseHandle (hObject=0x1c8) returned 1 [0105.594] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.594] SetEndOfFile (hFile=0x1b8) returned 1 [0105.595] CloseHandle (hObject=0x1b8) returned 1 [0105.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll")) returned 1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.596] lstrlenW (lpString=".doc") returned 4 [0105.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString=".docx") returned 5 [0105.596] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0105.596] lstrlenW (lpString=".pdf") returned 4 [0105.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString=".xls") returned 4 [0105.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString=".xlsx") returned 5 [0105.596] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0105.596] lstrlenW (lpString=".ppt") returned 4 [0105.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.596] lstrlenW (lpString=".zip") returned 4 [0105.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString=".rar") returned 4 [0105.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0105.596] lstrlenW (lpString=".bz2") returned 4 [0105.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0105.596] lstrlenW (lpString=".7z") returned 3 [0105.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.596] lstrlenW (lpString=".dbf") returned 4 [0105.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.596] lstrlenW (lpString=".1cd") returned 4 [0105.597] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0105.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 56 [0105.597] lstrlenW (lpString=".jpg") returned 4 [0105.597] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0105.597] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") [0105.607] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=221560) returned 1 [0105.633] CloseHandle (hObject=0x1b8) returned 1 [0105.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll")) returned 0x20 [0105.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0105.634] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.634] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0105.635] GetLastError () returned 0x0 [0105.635] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x36178, lpOverlapped=0x0) returned 1 [0105.640] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x36180, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x36180, lpOverlapped=0x0) returned 1 [0105.644] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0105.645] SetEndOfFile (hFile=0x1c8) returned 1 [0105.645] CloseHandle (hObject=0x1c8) returned 1 [0105.645] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0105.645] SetEndOfFile (hFile=0x1b8) returned 1 [0105.647] CloseHandle (hObject=0x1b8) returned 1 [0105.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll")) returned 1 [0105.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.647] lstrlenW (lpString=".doc") returned 4 [0105.647] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.647] lstrlenW (lpString=".docx") returned 5 [0105.647] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0105.647] lstrlenW (lpString=".pdf") returned 4 [0105.647] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.647] lstrlenW (lpString=".xls") returned 4 [0105.647] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.647] lstrlenW (lpString=".xlsx") returned 5 [0105.648] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0105.648] lstrlenW (lpString=".ppt") returned 4 [0105.648] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.648] lstrlenW (lpString=".zip") returned 4 [0105.648] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.648] lstrlenW (lpString=".rar") returned 4 [0105.648] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.648] lstrlenW (lpString=".bz2") returned 4 [0105.648] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.648] lstrlenW (lpString=".7z") returned 3 [0105.648] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.648] lstrlenW (lpString=".dbf") returned 4 [0105.648] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.648] lstrlenW (lpString=".1cd") returned 4 [0105.648] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 52 [0105.648] lstrlenW (lpString=".jpg") returned 4 [0105.648] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.648] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") [0106.218] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=687968) returned 1 [0106.218] CloseHandle (hObject=0x1c0) returned 1 [0106.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll")) returned 0x20 [0106.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0106.220] GetLastError () returned 0x0 [0106.220] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa7f60, lpOverlapped=0x0) returned 1 [0106.234] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa7f70, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa7f70, lpOverlapped=0x0) returned 1 [0106.248] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0106.248] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0106.248] SetEndOfFile (hFile=0x16c) returned 1 [0106.248] CloseHandle (hObject=0x16c) returned 1 [0106.249] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.249] SetEndOfFile (hFile=0x1c0) returned 1 [0106.254] CloseHandle (hObject=0x1c0) returned 1 [0106.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll")) returned 1 [0106.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.255] lstrlenW (lpString=".doc") returned 4 [0106.255] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString=".docx") returned 5 [0106.255] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0106.255] lstrlenW (lpString=".pdf") returned 4 [0106.255] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString=".xls") returned 4 [0106.255] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString=".xlsx") returned 5 [0106.255] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0106.255] lstrlenW (lpString=".ppt") returned 4 [0106.255] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.255] lstrlenW (lpString=".zip") returned 4 [0106.255] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString=".rar") returned 4 [0106.255] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.255] lstrlenW (lpString=".bz2") returned 4 [0106.255] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.255] lstrlenW (lpString=".7z") returned 3 [0106.255] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.255] lstrlenW (lpString=".dbf") returned 4 [0106.255] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.256] lstrlenW (lpString=".1cd") returned 4 [0106.256] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 53 [0106.256] lstrlenW (lpString=".jpg") returned 4 [0106.256] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.256] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") [0106.389] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=71008) returned 1 [0106.434] CloseHandle (hObject=0x1a0) returned 1 [0106.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll")) returned 0x20 [0106.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.435] GetLastError () returned 0x0 [0106.435] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x11560, lpOverlapped=0x0) returned 1 [0106.438] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x11570, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x11570, lpOverlapped=0x0) returned 1 [0106.440] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0106.440] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.440] SetEndOfFile (hFile=0x158) returned 1 [0106.440] CloseHandle (hObject=0x158) returned 1 [0106.440] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.440] SetEndOfFile (hFile=0x1a0) returned 1 [0106.441] CloseHandle (hObject=0x1a0) returned 1 [0106.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll")) returned 1 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString=".doc") returned 4 [0106.442] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString=".docx") returned 5 [0106.442] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0106.442] lstrlenW (lpString=".pdf") returned 4 [0106.442] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString=".xls") returned 4 [0106.442] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString=".xlsx") returned 5 [0106.442] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0106.442] lstrlenW (lpString=".ppt") returned 4 [0106.442] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString=".zip") returned 4 [0106.442] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString=".rar") returned 4 [0106.442] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.442] lstrlenW (lpString=".bz2") returned 4 [0106.442] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.442] lstrlenW (lpString=".7z") returned 3 [0106.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString=".dbf") returned 4 [0106.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString=".1cd") returned 4 [0106.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 55 [0106.442] lstrlenW (lpString=".jpg") returned 4 [0106.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.443] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") [0106.443] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14371688) returned 1 [0106.443] CloseHandle (hObject=0x1a0) returned 1 [0106.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe")) returned 0x20 [0106.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0106.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.444] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0106.444] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0106.445] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.448] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x491922, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0106.448] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0106.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xd74b68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0106.453] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0106.469] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.469] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0106.742] SetEndOfFile (hFile=0x1a0) returned 1 [0106.742] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0106.742] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0106.742] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0106.743] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x491922, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0106.743] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0106.744] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xd74b68, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0106.744] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0106.746] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0106.746] CloseHandle (hObject=0x1a0) returned 1 [0106.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.746] lstrlenW (lpString=".doc") returned 4 [0106.746] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.747] lstrlenW (lpString=".docx") returned 5 [0106.747] lstrcmpiW (lpString1=".docx", lpString2="B.EXE") returned -1 [0106.747] lstrlenW (lpString=".pdf") returned 4 [0106.747] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.747] lstrlenW (lpString=".xls") returned 4 [0106.747] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.747] lstrlenW (lpString=".xlsx") returned 5 [0106.747] lstrcmpiW (lpString1=".xlsx", lpString2="B.EXE") returned -1 [0106.747] lstrlenW (lpString=".ppt") returned 4 [0106.747] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.747] lstrlenW (lpString=".zip") returned 4 [0106.747] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.747] lstrlenW (lpString=".rar") returned 4 [0106.747] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.747] lstrlenW (lpString=".bz2") returned 4 [0106.747] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.747] lstrlenW (lpString=".7z") returned 3 [0106.747] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.747] lstrlenW (lpString=".dbf") returned 4 [0106.747] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.747] lstrlenW (lpString=".1cd") returned 4 [0106.747] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 52 [0106.747] lstrlenW (lpString=".jpg") returned 4 [0106.747] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.747] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") [0106.749] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=124240) returned 1 [0106.749] CloseHandle (hObject=0x1a0) returned 1 [0106.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll")) returned 0x20 [0106.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.749] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.749] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.750] GetLastError () returned 0x0 [0106.750] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1e550, lpOverlapped=0x0) returned 1 [0106.754] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1e560, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1e560, lpOverlapped=0x0) returned 1 [0106.757] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0106.757] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.757] SetEndOfFile (hFile=0x210) returned 1 [0106.757] CloseHandle (hObject=0x210) returned 1 [0106.757] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.757] SetEndOfFile (hFile=0x1a0) returned 1 [0106.759] CloseHandle (hObject=0x1a0) returned 1 [0106.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll")) returned 1 [0106.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.759] lstrlenW (lpString=".doc") returned 4 [0106.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.759] lstrlenW (lpString=".docx") returned 5 [0106.759] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0106.759] lstrlenW (lpString=".pdf") returned 4 [0106.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.760] lstrlenW (lpString=".xls") returned 4 [0106.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.760] lstrlenW (lpString=".xlsx") returned 5 [0106.760] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0106.760] lstrlenW (lpString=".ppt") returned 4 [0106.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.760] lstrlenW (lpString=".zip") returned 4 [0106.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.760] lstrlenW (lpString=".rar") returned 4 [0106.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.760] lstrlenW (lpString=".bz2") returned 4 [0106.760] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.760] lstrlenW (lpString=".7z") returned 3 [0106.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.760] lstrlenW (lpString=".dbf") returned 4 [0106.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.760] lstrlenW (lpString=".1cd") returned 4 [0106.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 55 [0106.760] lstrlenW (lpString=".jpg") returned 4 [0106.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.760] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") [0106.761] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1045352) returned 1 [0106.761] CloseHandle (hObject=0x1a0) returned 1 [0106.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe")) returned 0x20 [0106.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0106.761] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.761] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.762] GetLastError () returned 0x0 [0106.762] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xff368, lpOverlapped=0x0) returned 1 [0106.783] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xff370, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xff370, lpOverlapped=0x0) returned 1 [0106.804] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0106.804] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.804] SetEndOfFile (hFile=0x210) returned 1 [0106.804] CloseHandle (hObject=0x210) returned 1 [0106.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0106.805] SetEndOfFile (hFile=0x1a0) returned 1 [0107.334] CloseHandle (hObject=0x1a0) returned 1 [0107.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe")) returned 1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.341] lstrlenW (lpString=".doc") returned 4 [0107.341] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0107.341] lstrlenW (lpString=".docx") returned 5 [0107.341] lstrcmpiW (lpString1=".docx", lpString2="B.EXE") returned -1 [0107.341] lstrlenW (lpString=".pdf") returned 4 [0107.341] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0107.341] lstrlenW (lpString=".xls") returned 4 [0107.341] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0107.341] lstrlenW (lpString=".xlsx") returned 5 [0107.341] lstrcmpiW (lpString1=".xlsx", lpString2="B.EXE") returned -1 [0107.341] lstrlenW (lpString=".ppt") returned 4 [0107.341] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.341] lstrlenW (lpString=".zip") returned 4 [0107.341] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0107.341] lstrlenW (lpString=".rar") returned 4 [0107.341] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0107.341] lstrlenW (lpString=".bz2") returned 4 [0107.341] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0107.341] lstrlenW (lpString=".7z") returned 3 [0107.341] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.341] lstrlenW (lpString=".dbf") returned 4 [0107.341] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.341] lstrlenW (lpString=".1cd") returned 4 [0107.341] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 54 [0107.341] lstrlenW (lpString=".jpg") returned 4 [0107.341] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0107.341] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") [0107.437] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=113000) returned 1 [0107.437] CloseHandle (hObject=0x1a0) returned 1 [0107.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll")) returned 0x20 [0107.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.438] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0107.438] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0107.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0107.439] GetLastError () returned 0x0 [0107.439] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1b968, lpOverlapped=0x0) returned 1 [0107.502] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1b970, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1b970, lpOverlapped=0x0) returned 1 [0107.505] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0107.505] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0107.505] SetEndOfFile (hFile=0x15c) returned 1 [0107.505] CloseHandle (hObject=0x15c) returned 1 [0107.505] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0107.505] SetEndOfFile (hFile=0x1a0) returned 1 [0107.507] CloseHandle (hObject=0x1a0) returned 1 [0107.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll")) returned 1 [0107.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.507] lstrlenW (lpString=".doc") returned 4 [0107.507] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.507] lstrlenW (lpString=".docx") returned 5 [0107.507] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0107.507] lstrlenW (lpString=".pdf") returned 4 [0107.507] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.507] lstrlenW (lpString=".xls") returned 4 [0107.507] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.507] lstrlenW (lpString=".xlsx") returned 5 [0107.507] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0107.507] lstrlenW (lpString=".ppt") returned 4 [0107.507] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.507] lstrlenW (lpString=".zip") returned 4 [0107.507] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.508] lstrlenW (lpString=".rar") returned 4 [0107.508] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.508] lstrlenW (lpString=".bz2") returned 4 [0107.508] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.508] lstrlenW (lpString=".7z") returned 3 [0107.508] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.508] lstrlenW (lpString=".dbf") returned 4 [0107.508] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.508] lstrlenW (lpString=".1cd") returned 4 [0107.508] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 51 [0107.508] lstrlenW (lpString=".jpg") returned 4 [0107.508] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.508] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") [0107.549] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6222768) returned 1 [0107.549] CloseHandle (hObject=0x1a0) returned 1 [0107.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll")) returned 0x20 [0107.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.551] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0107.551] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0107.551] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.568] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1fa690, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0107.568] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x5af3b0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0107.892] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.081] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0108.081] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0108.237] SetEndOfFile (hFile=0x1a0) returned 1 [0108.237] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0108.237] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0108.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1fa690, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0108.239] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.256] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x5af3b0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0108.256] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0108.258] CloseHandle (hObject=0x1a0) returned 1 [0108.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.258] lstrlenW (lpString=".doc") returned 4 [0108.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0108.258] lstrlenW (lpString=".docx") returned 5 [0108.258] lstrcmpiW (lpString1=".docx", lpString2="A.dll") returned -1 [0108.258] lstrlenW (lpString=".pdf") returned 4 [0108.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0108.258] lstrlenW (lpString=".xls") returned 4 [0108.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0108.259] lstrlenW (lpString=".xlsx") returned 5 [0108.259] lstrcmpiW (lpString1=".xlsx", lpString2="A.dll") returned -1 [0108.259] lstrlenW (lpString=".ppt") returned 4 [0108.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0108.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.259] lstrlenW (lpString=".zip") returned 4 [0108.259] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0108.259] lstrlenW (lpString=".rar") returned 4 [0108.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0108.259] lstrlenW (lpString=".bz2") returned 4 [0108.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0108.259] lstrlenW (lpString=".7z") returned 3 [0108.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0108.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.259] lstrlenW (lpString=".dbf") returned 4 [0108.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0108.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.259] lstrlenW (lpString=".1cd") returned 4 [0108.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0108.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.259] lstrlenW (lpString=".jpg") returned 4 [0108.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0108.259] @NlsCompareInvariantNoCase@16 () [0108.259] lstrlenW (lpString=".docx") returned 5 [0108.259] lstrcmpiW (lpString1=".docx", lpString2="A.dll") returned -1 [0108.259] lstrlenW (lpString=".pdf") returned 4 [0108.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0108.260] lstrlenW (lpString=".xls") returned 4 [0108.260] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0108.260] lstrlenW (lpString=".xlsx") returned 5 [0108.260] lstrcmpiW (lpString1=".xlsx", lpString2="A.dll") returned -1 [0108.260] lstrlenW (lpString=".ppt") returned 4 [0108.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0108.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.260] lstrlenW (lpString=".zip") returned 4 [0108.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0108.260] lstrlenW (lpString=".rar") returned 4 [0108.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0108.260] lstrlenW (lpString=".bz2") returned 4 [0108.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0108.260] lstrlenW (lpString=".7z") returned 3 [0108.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0108.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.260] lstrlenW (lpString=".dbf") returned 4 [0108.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0108.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.260] lstrlenW (lpString=".1cd") returned 4 [0108.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0108.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 60 [0108.260] lstrlenW (lpString=".jpg") returned 4 [0108.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0108.260] @NlsCompareInvariantNoCase@16 () [0108.260] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0108.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.851] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=18336) returned 1 [0108.851] CloseHandle (hObject=0x1f4) returned 1 [0108.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll")) returned 0x20 [0108.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0108.851] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0108.851] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0108.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0108.852] GetLastError () returned 0x0 [0108.852] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x47a0, lpOverlapped=0x0) returned 1 [0108.855] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x47b0, lpOverlapped=0x0) returned 1 [0108.856] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0108.856] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0108.856] SetEndOfFile (hFile=0x158) returned 1 [0108.856] CloseHandle (hObject=0x158) returned 1 [0108.856] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0108.856] SetEndOfFile (hFile=0x1f4) returned 1 [0108.857] CloseHandle (hObject=0x1f4) returned 1 [0108.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll")) returned 1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.858] lstrlenW (lpString=".doc") returned 4 [0108.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString=".docx") returned 5 [0108.858] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0108.858] lstrlenW (lpString=".pdf") returned 4 [0108.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString=".xls") returned 4 [0108.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString=".xlsx") returned 5 [0108.858] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0108.858] lstrlenW (lpString=".ppt") returned 4 [0108.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.858] lstrlenW (lpString=".zip") returned 4 [0108.858] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString=".rar") returned 4 [0108.858] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.858] lstrlenW (lpString=".bz2") returned 4 [0108.858] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.858] lstrlenW (lpString=".7z") returned 3 [0108.858] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.858] lstrlenW (lpString=".dbf") returned 4 [0108.858] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.859] lstrlenW (lpString=".1cd") returned 4 [0108.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 54 [0108.859] lstrlenW (lpString=".jpg") returned 4 [0108.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.859] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") [0108.860] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9835392) returned 1 [0108.860] CloseHandle (hObject=0x15c) returned 1 [0108.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll")) returned 0x20 [0108.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0108.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0108.861] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0108.861] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0108.861] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.868] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x320680, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0108.868] ReadFile (in: hFile=0x15c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.887] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0108.887] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x921380, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0108.887] ReadFile (in: hFile=0x15c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.020] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.020] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0109.039] SetEndOfFile (hFile=0x15c) returned 1 [0109.039] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0109.043] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0109.043] WriteFile (in: hFile=0x15c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.045] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x320680, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0109.045] WriteFile (in: hFile=0x15c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.051] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x921380, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0109.051] WriteFile (in: hFile=0x15c, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.295] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0109.296] CloseHandle (hObject=0x15c) returned 1 [0109.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString=".doc") returned 4 [0109.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString=".docx") returned 5 [0109.357] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0109.357] lstrlenW (lpString=".pdf") returned 4 [0109.357] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString=".xls") returned 4 [0109.357] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString=".xlsx") returned 5 [0109.357] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0109.357] lstrlenW (lpString=".ppt") returned 4 [0109.357] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString=".zip") returned 4 [0109.357] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString=".rar") returned 4 [0109.357] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.357] lstrlenW (lpString=".bz2") returned 4 [0109.357] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.357] lstrlenW (lpString=".7z") returned 3 [0109.357] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString=".dbf") returned 4 [0109.357] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString=".1cd") returned 4 [0109.357] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 53 [0109.357] lstrlenW (lpString=".jpg") returned 4 [0109.357] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.358] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") [0109.366] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1530224) returned 1 [0109.366] CloseHandle (hObject=0x1fc) returned 1 [0109.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll")) returned 0x20 [0109.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.367] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.368] GetLastError () returned 0x0 [0109.368] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0109.473] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0109.638] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x75980, lpOverlapped=0x0) returned 1 [0109.653] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x75990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x75990, lpOverlapped=0x0) returned 1 [0109.680] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0109.680] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0109.681] SetEndOfFile (hFile=0x158) returned 1 [0109.681] CloseHandle (hObject=0x158) returned 1 [0109.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.681] SetEndOfFile (hFile=0x1fc) returned 1 [0109.685] CloseHandle (hObject=0x1fc) returned 1 [0109.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll")) returned 1 [0109.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.686] lstrlenW (lpString=".doc") returned 4 [0109.686] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString=".docx") returned 5 [0109.686] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0109.686] lstrlenW (lpString=".pdf") returned 4 [0109.686] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString=".xls") returned 4 [0109.686] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString=".xlsx") returned 5 [0109.686] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0109.686] lstrlenW (lpString=".ppt") returned 4 [0109.686] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.686] lstrlenW (lpString=".zip") returned 4 [0109.686] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString=".rar") returned 4 [0109.686] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.686] lstrlenW (lpString=".bz2") returned 4 [0109.686] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.686] lstrlenW (lpString=".7z") returned 3 [0109.686] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.687] lstrlenW (lpString=".dbf") returned 4 [0109.687] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.687] lstrlenW (lpString=".1cd") returned 4 [0109.687] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 53 [0109.687] lstrlenW (lpString=".jpg") returned 4 [0109.687] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.687] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") [0109.688] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=368016) returned 1 [0109.688] CloseHandle (hObject=0x1fc) returned 1 [0109.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll")) returned 0x20 [0109.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0109.689] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.689] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0109.690] GetLastError () returned 0x0 [0109.690] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x59d90, lpOverlapped=0x0) returned 1 [0109.765] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x59da0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x59da0, lpOverlapped=0x0) returned 1 [0109.772] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0109.773] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0109.773] SetEndOfFile (hFile=0x158) returned 1 [0109.773] CloseHandle (hObject=0x158) returned 1 [0109.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.774] SetEndOfFile (hFile=0x1fc) returned 1 [0109.777] CloseHandle (hObject=0x1fc) returned 1 [0109.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll")) returned 1 [0109.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.907] lstrlenW (lpString=".doc") returned 4 [0109.907] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.907] lstrlenW (lpString=".docx") returned 5 [0109.907] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0109.907] lstrlenW (lpString=".pdf") returned 4 [0109.907] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.907] lstrlenW (lpString=".xls") returned 4 [0109.907] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.907] lstrlenW (lpString=".xlsx") returned 5 [0109.908] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0109.908] lstrlenW (lpString=".ppt") returned 4 [0109.908] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.908] lstrlenW (lpString=".zip") returned 4 [0109.908] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.908] lstrlenW (lpString=".rar") returned 4 [0109.908] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.908] lstrlenW (lpString=".bz2") returned 4 [0109.908] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.908] lstrlenW (lpString=".7z") returned 3 [0109.908] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.908] lstrlenW (lpString=".dbf") returned 4 [0109.908] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.908] lstrlenW (lpString=".1cd") returned 4 [0109.908] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 54 [0109.908] lstrlenW (lpString=".jpg") returned 4 [0109.908] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.908] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") [0109.909] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=644480) returned 1 [0109.909] CloseHandle (hObject=0x1a0) returned 1 [0109.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll")) returned 0x20 [0109.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.909] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.910] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0109.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.910] GetLastError () returned 0x0 [0109.910] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x9d580, lpOverlapped=0x0) returned 1 [0110.203] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x9d590, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x9d590, lpOverlapped=0x0) returned 1 [0110.215] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0110.215] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xee, lpOverlapped=0x0) returned 1 [0110.215] SetEndOfFile (hFile=0x15c) returned 1 [0110.215] CloseHandle (hObject=0x15c) returned 1 [0110.215] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.215] SetEndOfFile (hFile=0x1a0) returned 1 [0110.221] CloseHandle (hObject=0x1a0) returned 1 [0110.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll")) returned 1 [0110.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.221] lstrlenW (lpString=".doc") returned 4 [0110.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.221] lstrlenW (lpString=".docx") returned 5 [0110.221] lstrcmpiW (lpString1=".docx", lpString2="T.dll") returned -1 [0110.221] lstrlenW (lpString=".pdf") returned 4 [0110.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.221] lstrlenW (lpString=".xls") returned 4 [0110.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.221] lstrlenW (lpString=".xlsx") returned 5 [0110.221] lstrcmpiW (lpString1=".xlsx", lpString2="T.dll") returned -1 [0110.221] lstrlenW (lpString=".ppt") returned 4 [0110.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.222] lstrlenW (lpString=".zip") returned 4 [0110.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.222] lstrlenW (lpString=".rar") returned 4 [0110.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.222] lstrlenW (lpString=".bz2") returned 4 [0110.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.222] lstrlenW (lpString=".7z") returned 3 [0110.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.222] lstrlenW (lpString=".dbf") returned 4 [0110.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.222] lstrlenW (lpString=".1cd") returned 4 [0110.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 56 [0110.222] lstrlenW (lpString=".jpg") returned 4 [0110.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.222] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") [0110.267] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=81) returned 1 [0110.267] CloseHandle (hObject=0x1a0) returned 1 [0110.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd")) returned 0x20 [0110.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.267] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.267] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.268] GetLastError () returned 0x0 [0110.268] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x51, lpOverlapped=0x0) returned 1 [0110.269] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x60, lpOverlapped=0x0) returned 1 [0110.270] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0110.270] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x102, lpOverlapped=0x0) returned 1 [0110.270] SetEndOfFile (hFile=0x15c) returned 1 [0110.270] CloseHandle (hObject=0x15c) returned 1 [0110.270] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.270] SetEndOfFile (hFile=0x1a0) returned 1 [0110.271] CloseHandle (hObject=0x1a0) returned 1 [0110.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd")) returned 1 [0110.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.272] lstrlenW (lpString=".doc") returned 4 [0110.272] lstrcmpiW (lpString1=".doc", lpString2=".gpd") returned -1 [0110.272] lstrlenW (lpString=".docx") returned 5 [0110.272] lstrcmpiW (lpString1=".docx", lpString2="r.gpd") returned -1 [0110.272] lstrlenW (lpString=".pdf") returned 4 [0110.272] lstrcmpiW (lpString1=".pdf", lpString2=".gpd") returned 1 [0110.272] lstrlenW (lpString=".xls") returned 4 [0110.272] lstrcmpiW (lpString1=".xls", lpString2=".gpd") returned 1 [0110.272] lstrlenW (lpString=".xlsx") returned 5 [0110.272] lstrcmpiW (lpString1=".xlsx", lpString2="r.gpd") returned -1 [0110.272] lstrlenW (lpString=".ppt") returned 4 [0110.272] lstrcmpiW (lpString1=".ppt", lpString2=".gpd") returned 1 [0110.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.272] lstrlenW (lpString=".zip") returned 4 [0110.272] lstrcmpiW (lpString1=".zip", lpString2=".gpd") returned 1 [0110.272] lstrlenW (lpString=".rar") returned 4 [0110.272] lstrcmpiW (lpString1=".rar", lpString2=".gpd") returned 1 [0110.272] lstrlenW (lpString=".bz2") returned 4 [0110.272] lstrcmpiW (lpString1=".bz2", lpString2=".gpd") returned -1 [0110.272] lstrlenW (lpString=".7z") returned 3 [0110.272] lstrcmpiW (lpString1=".7z", lpString2="gpd") returned -1 [0110.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.272] lstrlenW (lpString=".dbf") returned 4 [0110.272] lstrcmpiW (lpString1=".dbf", lpString2=".gpd") returned -1 [0110.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.272] lstrlenW (lpString=".1cd") returned 4 [0110.273] lstrcmpiW (lpString1=".1cd", lpString2=".gpd") returned -1 [0110.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 74 [0110.273] lstrlenW (lpString=".jpg") returned 4 [0110.273] lstrcmpiW (lpString1=".jpg", lpString2=".gpd") returned 1 [0110.273] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") [0110.274] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7330) returned 1 [0110.274] CloseHandle (hObject=0x1a0) returned 1 [0110.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd")) returned 0x20 [0110.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.274] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.274] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.275] GetLastError () returned 0x0 [0110.275] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1ca2, lpOverlapped=0x0) returned 1 [0110.283] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0110.284] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0110.284] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x100, lpOverlapped=0x0) returned 1 [0110.284] SetEndOfFile (hFile=0x15c) returned 1 [0110.284] CloseHandle (hObject=0x15c) returned 1 [0110.284] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.284] SetEndOfFile (hFile=0x1a0) returned 1 [0110.285] CloseHandle (hObject=0x1a0) returned 1 [0110.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd")) returned 1 [0110.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.285] lstrlenW (lpString=".doc") returned 4 [0110.285] lstrcmpiW (lpString1=".doc", lpString2=".gpd") returned -1 [0110.286] lstrlenW (lpString=".docx") returned 5 [0110.286] lstrcmpiW (lpString1=".docx", lpString2="s.gpd") returned -1 [0110.286] lstrlenW (lpString=".pdf") returned 4 [0110.286] lstrcmpiW (lpString1=".pdf", lpString2=".gpd") returned 1 [0110.286] lstrlenW (lpString=".xls") returned 4 [0110.286] lstrcmpiW (lpString1=".xls", lpString2=".gpd") returned 1 [0110.286] lstrlenW (lpString=".xlsx") returned 5 [0110.286] lstrcmpiW (lpString1=".xlsx", lpString2="s.gpd") returned -1 [0110.286] lstrlenW (lpString=".ppt") returned 4 [0110.286] lstrcmpiW (lpString1=".ppt", lpString2=".gpd") returned 1 [0110.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.286] lstrlenW (lpString=".zip") returned 4 [0110.286] lstrcmpiW (lpString1=".zip", lpString2=".gpd") returned 1 [0110.286] lstrlenW (lpString=".rar") returned 4 [0110.286] lstrcmpiW (lpString1=".rar", lpString2=".gpd") returned 1 [0110.286] lstrlenW (lpString=".bz2") returned 4 [0110.286] lstrcmpiW (lpString1=".bz2", lpString2=".gpd") returned -1 [0110.286] lstrlenW (lpString=".7z") returned 3 [0110.286] lstrcmpiW (lpString1=".7z", lpString2="gpd") returned -1 [0110.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.286] lstrlenW (lpString=".dbf") returned 4 [0110.286] lstrcmpiW (lpString1=".dbf", lpString2=".gpd") returned -1 [0110.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.286] lstrlenW (lpString=".1cd") returned 4 [0110.286] lstrcmpiW (lpString1=".1cd", lpString2=".gpd") returned -1 [0110.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 73 [0110.286] lstrlenW (lpString=".jpg") returned 4 [0110.286] lstrcmpiW (lpString1=".jpg", lpString2=".gpd") returned 1 [0110.286] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") [0110.510] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=60288) returned 1 [0110.510] CloseHandle (hObject=0x1f4) returned 1 [0110.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll")) returned 0x20 [0110.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0110.510] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.510] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.511] GetLastError () returned 0x0 [0110.511] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xeb80, lpOverlapped=0x0) returned 1 [0110.517] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xeb90, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xeb90, lpOverlapped=0x0) returned 1 [0110.519] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0110.519] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfa, lpOverlapped=0x0) returned 1 [0110.519] SetEndOfFile (hFile=0x19c) returned 1 [0110.519] CloseHandle (hObject=0x19c) returned 1 [0110.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.519] SetEndOfFile (hFile=0x1f4) returned 1 [0110.520] CloseHandle (hObject=0x1f4) returned 1 [0110.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll")) returned 1 [0110.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.521] lstrlenW (lpString=".doc") returned 4 [0110.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString=".docx") returned 5 [0110.521] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0110.521] lstrlenW (lpString=".pdf") returned 4 [0110.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString=".xls") returned 4 [0110.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString=".xlsx") returned 5 [0110.521] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0110.521] lstrlenW (lpString=".ppt") returned 4 [0110.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.521] lstrlenW (lpString=".zip") returned 4 [0110.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString=".rar") returned 4 [0110.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.521] lstrlenW (lpString=".bz2") returned 4 [0110.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.521] lstrlenW (lpString=".7z") returned 3 [0110.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.521] lstrlenW (lpString=".dbf") returned 4 [0110.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.521] lstrlenW (lpString=".1cd") returned 4 [0110.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 70 [0110.522] lstrlenW (lpString=".jpg") returned 4 [0110.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.522] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") [0110.522] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13886312) returned 1 [0110.522] CloseHandle (hObject=0x1f4) returned 1 [0110.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll")) returned 0x20 [0110.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0110.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0110.527] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0110.527] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0110.527] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.563] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x46a122, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0110.563] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0110.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcfe368, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0110.679] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.736] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0110.736] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0110.749] SetEndOfFile (hFile=0x1f4) returned 1 [0110.928] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0110.928] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0110.928] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x46a122, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0110.929] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.930] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcfe368, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0110.930] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.931] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0110.931] CloseHandle (hObject=0x1f4) returned 1 [0110.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.931] lstrlenW (lpString=".doc") returned 4 [0110.931] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.931] lstrlenW (lpString=".docx") returned 5 [0110.931] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0110.932] lstrlenW (lpString=".pdf") returned 4 [0110.932] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.932] lstrlenW (lpString=".xls") returned 4 [0110.932] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.932] lstrlenW (lpString=".xlsx") returned 5 [0110.932] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0110.932] lstrlenW (lpString=".ppt") returned 4 [0110.932] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.932] lstrlenW (lpString=".zip") returned 4 [0110.932] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.932] lstrlenW (lpString=".rar") returned 4 [0110.932] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.932] lstrlenW (lpString=".bz2") returned 4 [0110.932] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.932] lstrlenW (lpString=".7z") returned 3 [0110.932] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.932] lstrlenW (lpString=".dbf") returned 4 [0110.932] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.932] lstrlenW (lpString=".1cd") returned 4 [0110.932] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 53 [0110.932] lstrlenW (lpString=".jpg") returned 4 [0110.932] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.932] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") [0111.233] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1817480) returned 1 [0111.233] CloseHandle (hObject=0x1b8) returned 1 [0111.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll")) returned 0x20 [0111.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0111.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0111.234] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0111.234] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0111.234] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.360] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x93e82, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0111.360] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.415] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0111.415] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x17bb88, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0111.415] ReadFile (in: hFile=0x1b8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.482] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0111.482] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0111.643] SetEndOfFile (hFile=0x1b8) returned 1 [0111.656] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0111.656] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0111.656] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0111.667] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x93e82, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0111.667] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0111.708] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x17bb88, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0111.708] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0111.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0111.711] CloseHandle (hObject=0x1b8) returned 1 [0111.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.711] lstrlenW (lpString=".doc") returned 4 [0111.711] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString=".docx") returned 5 [0111.711] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0111.711] lstrlenW (lpString=".pdf") returned 4 [0111.711] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString=".xls") returned 4 [0111.711] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString=".xlsx") returned 5 [0111.711] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0111.711] lstrlenW (lpString=".ppt") returned 4 [0111.711] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.711] lstrlenW (lpString=".zip") returned 4 [0111.711] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString=".rar") returned 4 [0111.711] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.711] lstrlenW (lpString=".bz2") returned 4 [0111.711] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.711] lstrlenW (lpString=".7z") returned 3 [0111.711] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.712] lstrlenW (lpString=".dbf") returned 4 [0111.712] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.712] lstrlenW (lpString=".1cd") returned 4 [0111.712] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 55 [0111.712] lstrlenW (lpString=".jpg") returned 4 [0111.712] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.712] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") [0111.713] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=99744) returned 1 [0111.713] CloseHandle (hObject=0x1b8) returned 1 [0111.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll")) returned 0x20 [0111.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0111.713] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0111.714] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0111.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0111.715] GetLastError () returned 0x0 [0111.715] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x185a0, lpOverlapped=0x0) returned 1 [0112.009] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x185b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x185b0, lpOverlapped=0x0) returned 1 [0112.011] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0112.011] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xfe, lpOverlapped=0x0) returned 1 [0112.011] SetEndOfFile (hFile=0x15c) returned 1 [0112.012] CloseHandle (hObject=0x15c) returned 1 [0112.012] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.012] SetEndOfFile (hFile=0x1b8) returned 1 [0112.013] CloseHandle (hObject=0x1b8) returned 1 [0112.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll")) returned 1 [0112.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.013] lstrlenW (lpString=".doc") returned 4 [0112.013] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString=".docx") returned 5 [0112.014] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0112.014] lstrlenW (lpString=".pdf") returned 4 [0112.014] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString=".xls") returned 4 [0112.014] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString=".xlsx") returned 5 [0112.014] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0112.014] lstrlenW (lpString=".ppt") returned 4 [0112.014] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.014] lstrlenW (lpString=".zip") returned 4 [0112.014] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString=".rar") returned 4 [0112.014] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.014] lstrlenW (lpString=".bz2") returned 4 [0112.014] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.014] lstrlenW (lpString=".7z") returned 3 [0112.014] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.014] lstrlenW (lpString=".dbf") returned 4 [0112.014] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.014] lstrlenW (lpString=".1cd") returned 4 [0112.014] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 64 [0112.014] lstrlenW (lpString=".jpg") returned 4 [0112.014] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.014] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") [0112.017] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=190816) returned 1 [0112.017] CloseHandle (hObject=0x1b8) returned 1 [0112.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll")) returned 0x20 [0112.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.017] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.017] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0112.018] GetLastError () returned 0x0 [0112.018] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2e960, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2e970, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2e970, lpOverlapped=0x0) returned 1 [0112.027] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0112.027] WriteFile (in: hFile=0x15c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.027] SetEndOfFile (hFile=0x15c) returned 1 [0112.027] CloseHandle (hObject=0x15c) returned 1 [0112.027] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.027] SetEndOfFile (hFile=0x1b8) returned 1 [0112.029] CloseHandle (hObject=0x1b8) returned 1 [0112.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll")) returned 1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.030] lstrlenW (lpString=".doc") returned 4 [0112.030] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString=".docx") returned 5 [0112.030] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0112.030] lstrlenW (lpString=".pdf") returned 4 [0112.030] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString=".xls") returned 4 [0112.030] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString=".xlsx") returned 5 [0112.030] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0112.030] lstrlenW (lpString=".ppt") returned 4 [0112.030] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.030] lstrlenW (lpString=".zip") returned 4 [0112.030] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString=".rar") returned 4 [0112.030] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.030] lstrlenW (lpString=".bz2") returned 4 [0112.030] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.030] lstrlenW (lpString=".7z") returned 3 [0112.030] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.030] lstrlenW (lpString=".dbf") returned 4 [0112.030] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.030] lstrlenW (lpString=".1cd") returned 4 [0112.030] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 55 [0112.030] lstrlenW (lpString=".jpg") returned 4 [0112.031] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.031] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") [0112.032] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2163560) returned 1 [0112.032] CloseHandle (hObject=0x1b8) returned 1 [0112.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe")) returned 0x20 [0112.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.033] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0112.033] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.033] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.114] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb0122, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.114] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.123] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.123] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x1d0368, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.124] ReadFile (in: hFile=0x1b8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.160] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.160] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0112.233] SetEndOfFile (hFile=0x1b8) returned 1 [0112.233] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0112.233] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.233] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.249] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb0122, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.249] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.251] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x1d0368, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.252] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.253] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0112.253] CloseHandle (hObject=0x1b8) returned 1 [0112.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.253] lstrlenW (lpString=".doc") returned 4 [0112.253] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.253] lstrlenW (lpString=".docx") returned 5 [0112.253] lstrcmpiW (lpString1=".docx", lpString2="T.EXE") returned -1 [0112.253] lstrlenW (lpString=".pdf") returned 4 [0112.254] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.254] lstrlenW (lpString=".xls") returned 4 [0112.254] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.254] lstrlenW (lpString=".xlsx") returned 5 [0112.254] lstrcmpiW (lpString1=".xlsx", lpString2="T.EXE") returned -1 [0112.254] lstrlenW (lpString=".ppt") returned 4 [0112.254] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.254] lstrlenW (lpString=".zip") returned 4 [0112.254] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.254] lstrlenW (lpString=".rar") returned 4 [0112.254] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.254] lstrlenW (lpString=".bz2") returned 4 [0112.254] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.254] lstrlenW (lpString=".7z") returned 3 [0112.254] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.254] lstrlenW (lpString=".dbf") returned 4 [0112.254] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.254] lstrlenW (lpString=".1cd") returned 4 [0112.254] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 55 [0112.254] lstrlenW (lpString=".jpg") returned 4 [0112.254] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.254] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") [0112.255] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=84360) returned 1 [0112.255] CloseHandle (hObject=0x1b8) returned 1 [0112.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe")) returned 0x20 [0112.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.255] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.256] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0112.256] GetLastError () returned 0x0 [0112.256] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x14988, lpOverlapped=0x0) returned 1 [0112.278] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x14990, lpOverlapped=0x0) returned 1 [0112.280] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0112.280] WriteFile (in: hFile=0x158, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.280] SetEndOfFile (hFile=0x158) returned 1 [0112.280] CloseHandle (hObject=0x158) returned 1 [0112.280] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.280] SetEndOfFile (hFile=0x1b8) returned 1 [0112.281] CloseHandle (hObject=0x1b8) returned 1 [0112.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe")) returned 1 [0112.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.282] lstrlenW (lpString=".doc") returned 4 [0112.282] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.282] lstrlenW (lpString=".docx") returned 5 [0112.282] lstrcmpiW (lpString1=".docx", lpString2="T.EXE") returned -1 [0112.282] lstrlenW (lpString=".pdf") returned 4 [0112.282] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.282] lstrlenW (lpString=".xls") returned 4 [0112.282] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.282] lstrlenW (lpString=".xlsx") returned 5 [0112.282] lstrcmpiW (lpString1=".xlsx", lpString2="T.EXE") returned -1 [0112.282] lstrlenW (lpString=".ppt") returned 4 [0112.282] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.282] lstrlenW (lpString=".zip") returned 4 [0112.282] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.282] lstrlenW (lpString=".rar") returned 4 [0112.282] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.282] lstrlenW (lpString=".bz2") returned 4 [0112.282] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.282] lstrlenW (lpString=".7z") returned 3 [0112.282] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.283] lstrlenW (lpString=".dbf") returned 4 [0112.283] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.283] lstrlenW (lpString=".1cd") returned 4 [0112.283] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 55 [0112.283] lstrlenW (lpString=".jpg") returned 4 [0112.283] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.283] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") [0112.285] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5339136) returned 1 [0112.285] CloseHandle (hObject=0x1b8) returned 1 [0112.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll")) returned 0x20 [0112.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.287] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0112.287] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.287] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.290] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x1b2800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.290] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.300] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.300] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x4d7800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.301] ReadFile (in: hFile=0x1b8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.323] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.323] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.338] SetEndOfFile (hFile=0x1b8) returned 1 [0112.339] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0112.339] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.339] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.340] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x1b2800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.340] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.342] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x4d7800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.342] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0112.344] CloseHandle (hObject=0x1b8) returned 1 [0112.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.344] lstrlenW (lpString=".doc") returned 4 [0112.344] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString=".docx") returned 5 [0112.344] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0112.344] lstrlenW (lpString=".pdf") returned 4 [0112.344] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString=".xls") returned 4 [0112.344] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString=".xlsx") returned 5 [0112.344] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0112.344] lstrlenW (lpString=".ppt") returned 4 [0112.344] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.344] lstrlenW (lpString=".zip") returned 4 [0112.344] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString=".rar") returned 4 [0112.344] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.344] lstrlenW (lpString=".bz2") returned 4 [0112.344] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.344] lstrlenW (lpString=".7z") returned 3 [0112.345] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.345] lstrlenW (lpString=".dbf") returned 4 [0112.345] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.345] lstrlenW (lpString=".1cd") returned 4 [0112.345] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 65 [0112.345] lstrlenW (lpString=".jpg") returned 4 [0112.345] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.345] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") [0112.447] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13038480) returned 1 [0112.447] CloseHandle (hObject=0x1b8) returned 1 [0112.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll")) returned 0x20 [0112.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.449] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0112.449] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.454] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x425130, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.454] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.464] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.464] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xc2f390, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0112.464] ReadFile (in: hFile=0x1b8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.482] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.482] WriteFile (in: hFile=0x1b8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.652] SetEndOfFile (hFile=0x1b8) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0112.656] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.656] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.658] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x425130, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.658] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.777] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xc2f390, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0112.777] WriteFile (in: hFile=0x1b8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.782] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0112.785] CloseHandle (hObject=0x1b8) returned 1 [0112.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.785] lstrlenW (lpString=".doc") returned 4 [0112.785] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.785] lstrlenW (lpString=".docx") returned 5 [0112.785] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0112.785] lstrlenW (lpString=".pdf") returned 4 [0112.785] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.785] lstrlenW (lpString=".xls") returned 4 [0112.785] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.786] lstrlenW (lpString=".xlsx") returned 5 [0112.786] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0112.786] lstrlenW (lpString=".ppt") returned 4 [0112.786] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.786] lstrlenW (lpString=".zip") returned 4 [0112.786] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.786] lstrlenW (lpString=".rar") returned 4 [0112.786] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.786] lstrlenW (lpString=".bz2") returned 4 [0112.786] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.786] lstrlenW (lpString=".7z") returned 3 [0112.786] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.786] lstrlenW (lpString=".dbf") returned 4 [0112.786] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.786] lstrlenW (lpString=".1cd") returned 4 [0112.786] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 65 [0112.786] lstrlenW (lpString=".jpg") returned 4 [0112.786] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.786] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") [0112.999] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=223624) returned 1 [0112.999] CloseHandle (hObject=0x1c8) returned 1 [0112.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll")) returned 0x20 [0112.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0112.999] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.999] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0112.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.000] GetLastError () returned 0x0 [0113.000] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x36988, lpOverlapped=0x0) returned 1 [0113.006] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x36990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x36990, lpOverlapped=0x0) returned 1 [0113.012] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0113.012] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.012] SetEndOfFile (hFile=0x1c0) returned 1 [0113.013] CloseHandle (hObject=0x1c0) returned 1 [0113.013] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.013] SetEndOfFile (hFile=0x1c8) returned 1 [0113.015] CloseHandle (hObject=0x1c8) returned 1 [0113.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll")) returned 1 [0113.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.015] lstrlenW (lpString=".doc") returned 4 [0113.015] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0113.015] lstrlenW (lpString=".docx") returned 5 [0113.015] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0113.015] lstrlenW (lpString=".pdf") returned 4 [0113.015] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0113.015] lstrlenW (lpString=".xls") returned 4 [0113.015] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0113.015] lstrlenW (lpString=".xlsx") returned 5 [0113.015] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0113.015] lstrlenW (lpString=".ppt") returned 4 [0113.015] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0113.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.015] lstrlenW (lpString=".zip") returned 4 [0113.015] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0113.015] lstrlenW (lpString=".rar") returned 4 [0113.015] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0113.016] lstrlenW (lpString=".bz2") returned 4 [0113.016] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0113.016] lstrlenW (lpString=".7z") returned 3 [0113.016] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0113.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.016] lstrlenW (lpString=".dbf") returned 4 [0113.016] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0113.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.016] lstrlenW (lpString=".1cd") returned 4 [0113.016] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0113.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 60 [0113.016] lstrlenW (lpString=".jpg") returned 4 [0113.016] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0113.016] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") [0113.016] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=278016) returned 1 [0113.017] CloseHandle (hObject=0x1c8) returned 1 [0113.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex")) returned 0x20 [0113.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.017] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.017] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.018] GetLastError () returned 0x0 [0113.018] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x43e00, lpOverlapped=0x0) returned 1 [0113.026] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x43e10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x43e10, lpOverlapped=0x0) returned 1 [0113.031] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0113.031] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.031] SetEndOfFile (hFile=0x1c0) returned 1 [0113.032] CloseHandle (hObject=0x1c0) returned 1 [0113.032] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.032] SetEndOfFile (hFile=0x1c8) returned 1 [0113.044] CloseHandle (hObject=0x1c8) returned 1 [0113.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex")) returned 1 [0113.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.044] lstrlenW (lpString=".doc") returned 4 [0113.048] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0113.048] lstrlenW (lpString=".docx") returned 5 [0113.048] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0113.048] lstrlenW (lpString=".pdf") returned 4 [0113.048] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0113.049] lstrlenW (lpString=".xls") returned 4 [0113.049] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0113.049] lstrlenW (lpString=".xlsx") returned 5 [0113.049] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0113.049] lstrlenW (lpString=".ppt") returned 4 [0113.049] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0113.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.052] lstrlenW (lpString=".zip") returned 4 [0113.052] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0113.052] lstrlenW (lpString=".rar") returned 4 [0113.052] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0113.052] lstrlenW (lpString=".bz2") returned 4 [0113.052] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0113.052] lstrlenW (lpString=".7z") returned 3 [0113.052] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0113.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.052] lstrlenW (lpString=".dbf") returned 4 [0113.052] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0113.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.052] lstrlenW (lpString=".1cd") returned 4 [0113.052] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 60 [0113.080] lstrlenW (lpString=".jpg") returned 4 [0113.080] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0113.080] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") [0113.080] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4866) returned 1 [0113.080] CloseHandle (hObject=0x1c8) returned 1 [0113.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub")) returned 0x20 [0113.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.082] GetLastError () returned 0x0 [0113.082] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1302, lpOverlapped=0x0) returned 1 [0113.084] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1310, lpOverlapped=0x0) returned 1 [0113.084] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0113.085] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.085] SetEndOfFile (hFile=0x19c) returned 1 [0113.085] CloseHandle (hObject=0x19c) returned 1 [0113.085] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.085] SetEndOfFile (hFile=0x1c8) returned 1 [0113.086] CloseHandle (hObject=0x1c8) returned 1 [0113.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub")) returned 1 [0113.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.086] lstrlenW (lpString=".doc") returned 4 [0113.086] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0113.086] lstrlenW (lpString=".docx") returned 5 [0113.086] lstrcmpiW (lpString1=".docx", lpString2="N.dub") returned -1 [0113.086] lstrlenW (lpString=".pdf") returned 4 [0113.086] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0113.086] lstrlenW (lpString=".xls") returned 4 [0113.086] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0113.086] lstrlenW (lpString=".xlsx") returned 5 [0113.086] lstrcmpiW (lpString1=".xlsx", lpString2="N.dub") returned -1 [0113.086] lstrlenW (lpString=".ppt") returned 4 [0113.086] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0113.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.086] lstrlenW (lpString=".zip") returned 4 [0113.086] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0113.087] lstrlenW (lpString=".rar") returned 4 [0113.087] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0113.087] lstrlenW (lpString=".bz2") returned 4 [0113.087] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0113.087] lstrlenW (lpString=".7z") returned 3 [0113.087] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0113.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.087] lstrlenW (lpString=".dbf") returned 4 [0113.087] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0113.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.087] lstrlenW (lpString=".1cd") returned 4 [0113.087] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0113.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 60 [0113.087] lstrlenW (lpString=".jpg") returned 4 [0113.087] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0113.087] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") [0113.088] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1334784) returned 1 [0113.088] CloseHandle (hObject=0x1c8) returned 1 [0113.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex")) returned 0x20 [0113.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0113.088] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.088] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0113.089] GetLastError () returned 0x0 [0113.089] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xffff0, lpOverlapped=0x0) returned 1 [0113.114] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0113.513] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x45e10, lpOverlapped=0x0) returned 1 [0113.524] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x45e20, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x45e20, lpOverlapped=0x0) returned 1 [0113.533] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0113.533] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.533] SetEndOfFile (hFile=0x19c) returned 1 [0113.536] CloseHandle (hObject=0x19c) returned 1 [0113.536] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0113.536] SetEndOfFile (hFile=0x1c8) returned 1 [0113.539] CloseHandle (hObject=0x1c8) returned 1 [0113.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex")) returned 1 [0113.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.913] lstrlenW (lpString=".doc") returned 4 [0113.913] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0113.913] lstrlenW (lpString=".docx") returned 5 [0113.913] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0113.913] lstrlenW (lpString=".pdf") returned 4 [0113.913] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0113.913] lstrlenW (lpString=".xls") returned 4 [0113.913] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0113.913] lstrlenW (lpString=".xlsx") returned 5 [0113.913] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0113.913] lstrlenW (lpString=".ppt") returned 4 [0113.913] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0113.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.913] lstrlenW (lpString=".zip") returned 4 [0113.913] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0113.913] lstrlenW (lpString=".rar") returned 4 [0113.913] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0113.913] lstrlenW (lpString=".bz2") returned 4 [0113.913] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0113.913] lstrlenW (lpString=".7z") returned 3 [0113.913] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0113.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.913] lstrlenW (lpString=".dbf") returned 4 [0113.913] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0113.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.913] lstrlenW (lpString=".1cd") returned 4 [0113.914] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0113.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 60 [0113.914] lstrlenW (lpString=".jpg") returned 4 [0113.914] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0113.914] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") [0114.207] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1775616) returned 1 [0114.234] CloseHandle (hObject=0x1f4) returned 1 [0114.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex")) returned 0x20 [0114.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0114.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.334] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0114.334] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0114.334] ReadFile (in: hFile=0x210, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.352] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x90800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0114.352] ReadFile (in: hFile=0x210, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.358] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.359] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x171800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0114.359] ReadFile (in: hFile=0x210, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.374] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.375] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0114.614] SetEndOfFile (hFile=0x210) returned 1 [0114.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0114.614] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0114.614] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.615] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x90800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0114.616] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.618] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x171800, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0114.618] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.620] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0114.620] CloseHandle (hObject=0x210) returned 1 [0114.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.620] lstrlenW (lpString=".doc") returned 4 [0114.620] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0114.620] lstrlenW (lpString=".docx") returned 5 [0114.620] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0114.620] lstrlenW (lpString=".pdf") returned 4 [0114.620] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0114.620] lstrlenW (lpString=".xls") returned 4 [0114.620] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0114.620] lstrlenW (lpString=".xlsx") returned 5 [0114.620] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0114.620] lstrlenW (lpString=".ppt") returned 4 [0114.620] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0114.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.620] lstrlenW (lpString=".zip") returned 4 [0114.620] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0114.620] lstrlenW (lpString=".rar") returned 4 [0114.620] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0114.620] lstrlenW (lpString=".bz2") returned 4 [0114.620] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0114.620] lstrlenW (lpString=".7z") returned 3 [0114.620] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0114.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.620] lstrlenW (lpString=".dbf") returned 4 [0114.621] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0114.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.621] lstrlenW (lpString=".1cd") returned 4 [0114.621] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0114.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 60 [0114.621] lstrlenW (lpString=".jpg") returned 4 [0114.621] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0114.621] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") [0114.622] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=170368) returned 1 [0114.622] CloseHandle (hObject=0x210) returned 1 [0114.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll")) returned 0x20 [0114.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.623] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.623] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.624] GetLastError () returned 0x0 [0114.624] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x29980, lpOverlapped=0x0) returned 1 [0114.720] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x29990, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x29990, lpOverlapped=0x0) returned 1 [0114.724] ReadFile (in: hFile=0x210, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.724] WriteFile (in: hFile=0x180, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0114.724] SetEndOfFile (hFile=0x180) returned 1 [0114.724] CloseHandle (hObject=0x180) returned 1 [0114.724] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.724] SetEndOfFile (hFile=0x210) returned 1 [0114.726] CloseHandle (hObject=0x210) returned 1 [0114.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll")) returned 1 [0114.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.726] lstrlenW (lpString=".doc") returned 4 [0114.726] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.726] lstrlenW (lpString=".docx") returned 5 [0114.727] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0114.727] lstrlenW (lpString=".pdf") returned 4 [0114.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.727] lstrlenW (lpString=".xls") returned 4 [0114.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.727] lstrlenW (lpString=".xlsx") returned 5 [0114.727] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0114.727] lstrlenW (lpString=".ppt") returned 4 [0114.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.727] lstrlenW (lpString=".zip") returned 4 [0114.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.727] lstrlenW (lpString=".rar") returned 4 [0114.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.727] lstrlenW (lpString=".bz2") returned 4 [0114.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.727] lstrlenW (lpString=".7z") returned 3 [0114.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.727] lstrlenW (lpString=".dbf") returned 4 [0114.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.727] lstrlenW (lpString=".1cd") returned 4 [0114.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 52 [0114.727] lstrlenW (lpString=".jpg") returned 4 [0114.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.727] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") [0114.766] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=27104) returned 1 [0114.766] CloseHandle (hObject=0x1b8) returned 1 [0114.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr")) returned 0x20 [0114.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.766] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.766] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.768] GetLastError () returned 0x0 [0114.768] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x69e0, lpOverlapped=0x0) returned 1 [0114.770] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x69f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x69f0, lpOverlapped=0x0) returned 1 [0114.772] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.772] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.772] SetEndOfFile (hFile=0x210) returned 1 [0114.772] CloseHandle (hObject=0x210) returned 1 [0114.772] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.772] SetEndOfFile (hFile=0x1b8) returned 1 [0114.773] CloseHandle (hObject=0x1b8) returned 1 [0114.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr")) returned 1 [0114.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.773] lstrlenW (lpString=".doc") returned 4 [0114.774] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".docx") returned 5 [0114.774] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0114.774] lstrlenW (lpString=".pdf") returned 4 [0114.774] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".xls") returned 4 [0114.774] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".xlsx") returned 5 [0114.774] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0114.774] lstrlenW (lpString=".ppt") returned 4 [0114.774] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.774] lstrlenW (lpString=".zip") returned 4 [0114.774] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".rar") returned 4 [0114.774] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".bz2") returned 4 [0114.774] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString=".7z") returned 3 [0114.774] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.774] lstrlenW (lpString=".dbf") returned 4 [0114.774] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.774] lstrlenW (lpString=".1cd") returned 4 [0114.774] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 60 [0114.774] lstrlenW (lpString=".jpg") returned 4 [0114.774] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.774] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") [0114.775] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=62036) returned 1 [0114.775] CloseHandle (hObject=0x1b8) returned 1 [0114.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr")) returned 0x20 [0114.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.775] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.776] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.776] GetLastError () returned 0x0 [0114.776] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf254, lpOverlapped=0x0) returned 1 [0114.779] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf260, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf260, lpOverlapped=0x0) returned 1 [0114.781] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.782] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.782] SetEndOfFile (hFile=0x210) returned 1 [0114.782] CloseHandle (hObject=0x210) returned 1 [0114.782] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.782] SetEndOfFile (hFile=0x1b8) returned 1 [0114.783] CloseHandle (hObject=0x1b8) returned 1 [0114.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr")) returned 1 [0114.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.783] lstrlenW (lpString=".doc") returned 4 [0114.783] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.783] lstrlenW (lpString=".docx") returned 5 [0114.783] lstrcmpiW (lpString1=".docx", lpString2="A.BDR") returned -1 [0114.783] lstrlenW (lpString=".pdf") returned 4 [0114.784] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString=".xls") returned 4 [0114.784] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString=".xlsx") returned 5 [0114.784] lstrcmpiW (lpString1=".xlsx", lpString2="A.BDR") returned -1 [0114.784] lstrlenW (lpString=".ppt") returned 4 [0114.784] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.784] lstrlenW (lpString=".zip") returned 4 [0114.784] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString=".rar") returned 4 [0114.784] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString=".bz2") returned 4 [0114.784] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString=".7z") returned 3 [0114.784] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.784] lstrlenW (lpString=".dbf") returned 4 [0114.784] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.784] lstrlenW (lpString=".1cd") returned 4 [0114.784] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 60 [0114.784] lstrlenW (lpString=".jpg") returned 4 [0114.784] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.784] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") [0114.785] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13684) returned 1 [0114.785] CloseHandle (hObject=0x1b8) returned 1 [0114.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr")) returned 0x20 [0114.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.785] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.785] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.786] GetLastError () returned 0x0 [0114.786] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3574, lpOverlapped=0x0) returned 1 [0114.788] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3580, lpOverlapped=0x0) returned 1 [0114.789] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.789] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.790] SetEndOfFile (hFile=0x210) returned 1 [0114.790] CloseHandle (hObject=0x210) returned 1 [0114.790] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.790] SetEndOfFile (hFile=0x1b8) returned 1 [0114.791] CloseHandle (hObject=0x1b8) returned 1 [0114.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr")) returned 1 [0114.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.791] lstrlenW (lpString=".doc") returned 4 [0114.791] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.791] lstrlenW (lpString=".docx") returned 5 [0114.791] lstrcmpiW (lpString1=".docx", lpString2="B.BDR") returned -1 [0114.791] lstrlenW (lpString=".pdf") returned 4 [0114.791] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.791] lstrlenW (lpString=".xls") returned 4 [0114.791] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.791] lstrlenW (lpString=".xlsx") returned 5 [0114.791] lstrcmpiW (lpString1=".xlsx", lpString2="B.BDR") returned -1 [0114.791] lstrlenW (lpString=".ppt") returned 4 [0114.792] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.792] lstrlenW (lpString=".zip") returned 4 [0114.792] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.792] lstrlenW (lpString=".rar") returned 4 [0114.792] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.792] lstrlenW (lpString=".bz2") returned 4 [0114.792] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.792] lstrlenW (lpString=".7z") returned 3 [0114.792] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.792] lstrlenW (lpString=".dbf") returned 4 [0114.792] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.792] lstrlenW (lpString=".1cd") returned 4 [0114.792] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 60 [0114.792] lstrlenW (lpString=".jpg") returned 4 [0114.792] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.792] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") [0114.793] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=51448) returned 1 [0114.793] CloseHandle (hObject=0x1b8) returned 1 [0114.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr")) returned 0x20 [0114.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.793] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.793] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.794] GetLastError () returned 0x0 [0114.794] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xc8f8, lpOverlapped=0x0) returned 1 [0114.799] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc900, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xc900, lpOverlapped=0x0) returned 1 [0114.801] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.801] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.801] SetEndOfFile (hFile=0x210) returned 1 [0114.801] CloseHandle (hObject=0x210) returned 1 [0114.801] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.801] SetEndOfFile (hFile=0x1b8) returned 1 [0114.802] CloseHandle (hObject=0x1b8) returned 1 [0114.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr")) returned 1 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString=".doc") returned 4 [0114.803] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".docx") returned 5 [0114.803] lstrcmpiW (lpString1=".docx", lpString2="A.BDR") returned -1 [0114.803] lstrlenW (lpString=".pdf") returned 4 [0114.803] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".xls") returned 4 [0114.803] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".xlsx") returned 5 [0114.803] lstrcmpiW (lpString1=".xlsx", lpString2="A.BDR") returned -1 [0114.803] lstrlenW (lpString=".ppt") returned 4 [0114.803] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString=".zip") returned 4 [0114.803] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".rar") returned 4 [0114.803] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".bz2") returned 4 [0114.803] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString=".7z") returned 3 [0114.803] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString=".dbf") returned 4 [0114.803] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString=".1cd") returned 4 [0114.803] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0114.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 60 [0114.803] lstrlenW (lpString=".jpg") returned 4 [0114.803] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0114.804] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") [0114.804] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=15872) returned 1 [0114.804] CloseHandle (hObject=0x1b8) returned 1 [0114.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr")) returned 0x20 [0114.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0114.805] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.805] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0114.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.805] GetLastError () returned 0x0 [0114.805] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3e00, lpOverlapped=0x0) returned 1 [0114.918] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3e10, lpOverlapped=0x0) returned 1 [0114.920] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0114.920] WriteFile (in: hFile=0x210, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.920] SetEndOfFile (hFile=0x210) returned 1 [0115.070] CloseHandle (hObject=0x210) returned 1 [0115.070] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.070] SetEndOfFile (hFile=0x1b8) returned 1 [0115.093] CloseHandle (hObject=0x1b8) returned 1 [0115.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr")) returned 1 [0115.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.093] lstrlenW (lpString=".doc") returned 4 [0115.093] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0115.093] lstrlenW (lpString=".docx") returned 5 [0115.093] lstrcmpiW (lpString1=".docx", lpString2="B.BDR") returned -1 [0115.093] lstrlenW (lpString=".pdf") returned 4 [0115.093] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0115.093] lstrlenW (lpString=".xls") returned 4 [0115.093] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0115.093] lstrlenW (lpString=".xlsx") returned 5 [0115.093] lstrcmpiW (lpString1=".xlsx", lpString2="B.BDR") returned -1 [0115.093] lstrlenW (lpString=".ppt") returned 4 [0115.093] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0115.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.093] lstrlenW (lpString=".zip") returned 4 [0115.093] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0115.093] lstrlenW (lpString=".rar") returned 4 [0115.093] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0115.094] lstrlenW (lpString=".bz2") returned 4 [0115.094] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0115.094] lstrlenW (lpString=".7z") returned 3 [0115.094] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0115.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.094] lstrlenW (lpString=".dbf") returned 4 [0115.094] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0115.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.094] lstrlenW (lpString=".1cd") returned 4 [0115.094] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0115.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 60 [0115.094] lstrlenW (lpString=".jpg") returned 4 [0115.094] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0115.094] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") [0115.280] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=59256) returned 1 [0115.280] CloseHandle (hObject=0x19c) returned 1 [0115.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll")) returned 0x20 [0115.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.281] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.281] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.284] GetLastError () returned 0x0 [0115.284] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xe778, lpOverlapped=0x0) returned 1 [0115.289] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe780, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe780, lpOverlapped=0x0) returned 1 [0115.291] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.291] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.292] SetEndOfFile (hFile=0x1f4) returned 1 [0115.292] CloseHandle (hObject=0x1f4) returned 1 [0115.292] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.292] SetEndOfFile (hFile=0x19c) returned 1 [0115.293] CloseHandle (hObject=0x19c) returned 1 [0115.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll")) returned 1 [0115.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.293] lstrlenW (lpString=".doc") returned 4 [0115.293] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.293] lstrlenW (lpString=".docx") returned 5 [0115.293] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0115.293] lstrlenW (lpString=".pdf") returned 4 [0115.293] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.293] lstrlenW (lpString=".xls") returned 4 [0115.293] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.293] lstrlenW (lpString=".xlsx") returned 5 [0115.293] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0115.294] lstrlenW (lpString=".ppt") returned 4 [0115.294] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.294] lstrlenW (lpString=".zip") returned 4 [0115.294] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.294] lstrlenW (lpString=".rar") returned 4 [0115.294] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.294] lstrlenW (lpString=".bz2") returned 4 [0115.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.294] lstrlenW (lpString=".7z") returned 3 [0115.294] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.294] lstrlenW (lpString=".dbf") returned 4 [0115.294] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.294] lstrlenW (lpString=".1cd") returned 4 [0115.294] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 54 [0115.294] lstrlenW (lpString=".jpg") returned 4 [0115.294] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.294] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") [0115.295] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=47450) returned 1 [0115.295] CloseHandle (hObject=0x19c) returned 1 [0115.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc")) returned 0x20 [0115.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.295] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.295] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.296] GetLastError () returned 0x0 [0115.296] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xb95a, lpOverlapped=0x0) returned 1 [0115.315] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xb960, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xb960, lpOverlapped=0x0) returned 1 [0115.317] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.317] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0115.317] SetEndOfFile (hFile=0x1f4) returned 1 [0115.317] CloseHandle (hObject=0x1f4) returned 1 [0115.317] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.317] SetEndOfFile (hFile=0x19c) returned 1 [0115.325] CloseHandle (hObject=0x19c) returned 1 [0115.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc")) returned 1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.326] lstrlenW (lpString=".doc") returned 4 [0115.326] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.326] lstrlenW (lpString=".docx") returned 5 [0115.326] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0115.326] lstrlenW (lpString=".pdf") returned 4 [0115.326] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.326] lstrlenW (lpString=".xls") returned 4 [0115.326] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.326] lstrlenW (lpString=".xlsx") returned 5 [0115.326] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0115.326] lstrlenW (lpString=".ppt") returned 4 [0115.326] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.326] lstrlenW (lpString=".zip") returned 4 [0115.326] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.326] lstrlenW (lpString=".rar") returned 4 [0115.326] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.327] lstrlenW (lpString=".bz2") returned 4 [0115.327] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.327] lstrlenW (lpString=".7z") returned 3 [0115.327] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.327] lstrlenW (lpString=".dbf") returned 4 [0115.327] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.327] lstrlenW (lpString=".1cd") returned 4 [0115.327] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 58 [0115.327] lstrlenW (lpString=".jpg") returned 4 [0115.327] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.327] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") [0115.328] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=41986) returned 1 [0115.328] CloseHandle (hObject=0x19c) returned 1 [0115.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc")) returned 0x20 [0115.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.328] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.328] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.329] GetLastError () returned 0x0 [0115.329] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xa402, lpOverlapped=0x0) returned 1 [0115.331] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xa410, lpOverlapped=0x0) returned 1 [0115.333] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.333] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.333] SetEndOfFile (hFile=0x1f4) returned 1 [0115.333] CloseHandle (hObject=0x1f4) returned 1 [0115.333] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.333] SetEndOfFile (hFile=0x19c) returned 1 [0115.334] CloseHandle (hObject=0x19c) returned 1 [0115.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc")) returned 1 [0115.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.335] lstrlenW (lpString=".doc") returned 4 [0115.335] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.335] lstrlenW (lpString=".docx") returned 5 [0115.335] lstrcmpiW (lpString1=".docx", lpString2="M.POC") returned -1 [0115.335] lstrlenW (lpString=".pdf") returned 4 [0115.335] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.335] lstrlenW (lpString=".xls") returned 4 [0115.335] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.335] lstrlenW (lpString=".xlsx") returned 5 [0115.335] lstrcmpiW (lpString1=".xlsx", lpString2="M.POC") returned -1 [0115.335] lstrlenW (lpString=".ppt") returned 4 [0115.335] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.335] lstrlenW (lpString=".zip") returned 4 [0115.335] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.335] lstrlenW (lpString=".rar") returned 4 [0115.335] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.335] lstrlenW (lpString=".bz2") returned 4 [0115.335] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.335] lstrlenW (lpString=".7z") returned 3 [0115.335] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.335] lstrlenW (lpString=".dbf") returned 4 [0115.335] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.335] lstrlenW (lpString=".1cd") returned 4 [0115.335] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 61 [0115.335] lstrlenW (lpString=".jpg") returned 4 [0115.335] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.335] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") [0115.337] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=37324) returned 1 [0115.337] CloseHandle (hObject=0x19c) returned 1 [0115.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc")) returned 0x20 [0115.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.337] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.337] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.338] GetLastError () returned 0x0 [0115.338] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x91cc, lpOverlapped=0x0) returned 1 [0115.340] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x91d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x91d0, lpOverlapped=0x0) returned 1 [0115.341] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.341] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.341] SetEndOfFile (hFile=0x1f4) returned 1 [0115.341] CloseHandle (hObject=0x1f4) returned 1 [0115.341] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.341] SetEndOfFile (hFile=0x19c) returned 1 [0115.342] CloseHandle (hObject=0x19c) returned 1 [0115.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc")) returned 1 [0115.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.343] lstrlenW (lpString=".doc") returned 4 [0115.343] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.343] lstrlenW (lpString=".docx") returned 5 [0115.343] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0115.343] lstrlenW (lpString=".pdf") returned 4 [0115.343] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.343] lstrlenW (lpString=".xls") returned 4 [0115.343] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.343] lstrlenW (lpString=".xlsx") returned 5 [0115.343] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0115.343] lstrlenW (lpString=".ppt") returned 4 [0115.343] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.343] lstrlenW (lpString=".zip") returned 4 [0115.343] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.343] lstrlenW (lpString=".rar") returned 4 [0115.343] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.343] lstrlenW (lpString=".bz2") returned 4 [0115.343] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.343] lstrlenW (lpString=".7z") returned 3 [0115.343] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.343] lstrlenW (lpString=".dbf") returned 4 [0115.343] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.344] lstrlenW (lpString=".1cd") returned 4 [0115.344] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 59 [0115.344] lstrlenW (lpString=".jpg") returned 4 [0115.344] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.344] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") [0115.344] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=53987) returned 1 [0115.344] CloseHandle (hObject=0x19c) returned 1 [0115.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv")) returned 0x20 [0115.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.345] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.345] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.346] GetLastError () returned 0x0 [0115.346] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xd2e3, lpOverlapped=0x0) returned 1 [0115.348] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xd2f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xd2f0, lpOverlapped=0x0) returned 1 [0115.349] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.349] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.349] SetEndOfFile (hFile=0x1f4) returned 1 [0115.350] CloseHandle (hObject=0x1f4) returned 1 [0115.350] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.350] SetEndOfFile (hFile=0x19c) returned 1 [0115.351] CloseHandle (hObject=0x19c) returned 1 [0115.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv")) returned 1 [0115.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.351] lstrlenW (lpString=".doc") returned 4 [0115.351] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.351] lstrlenW (lpString=".docx") returned 5 [0115.351] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0115.351] lstrlenW (lpString=".pdf") returned 4 [0115.351] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.351] lstrlenW (lpString=".xls") returned 4 [0115.351] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.351] lstrlenW (lpString=".xlsx") returned 5 [0115.351] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0115.351] lstrlenW (lpString=".ppt") returned 4 [0115.351] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.351] lstrlenW (lpString=".zip") returned 4 [0115.352] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.352] lstrlenW (lpString=".rar") returned 4 [0115.352] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.352] lstrlenW (lpString=".bz2") returned 4 [0115.352] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.352] lstrlenW (lpString=".7z") returned 3 [0115.352] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.352] lstrlenW (lpString=".dbf") returned 4 [0115.352] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.352] lstrlenW (lpString=".1cd") returned 4 [0115.352] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 60 [0115.352] lstrlenW (lpString=".jpg") returned 4 [0115.352] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.352] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") [0115.353] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=19856) returned 1 [0115.353] CloseHandle (hObject=0x19c) returned 1 [0115.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc")) returned 0x20 [0115.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.354] GetLastError () returned 0x0 [0115.354] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4d90, lpOverlapped=0x0) returned 1 [0115.369] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4da0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4da0, lpOverlapped=0x0) returned 1 [0115.370] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.370] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.371] SetEndOfFile (hFile=0x1f4) returned 1 [0115.483] CloseHandle (hObject=0x1f4) returned 1 [0115.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.520] SetEndOfFile (hFile=0x19c) returned 1 [0115.538] CloseHandle (hObject=0x19c) returned 1 [0115.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc")) returned 1 [0115.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.544] lstrlenW (lpString=".doc") returned 4 [0115.544] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.547] lstrlenW (lpString=".docx") returned 5 [0115.547] lstrcmpiW (lpString1=".docx", lpString2="L.POC") returned -1 [0115.547] lstrlenW (lpString=".pdf") returned 4 [0115.547] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.547] lstrlenW (lpString=".xls") returned 4 [0115.547] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.547] lstrlenW (lpString=".xlsx") returned 5 [0115.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.POC") returned -1 [0115.547] lstrlenW (lpString=".ppt") returned 4 [0115.591] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.591] lstrlenW (lpString=".zip") returned 4 [0115.591] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.591] lstrlenW (lpString=".rar") returned 4 [0115.591] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.591] lstrlenW (lpString=".bz2") returned 4 [0115.591] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.591] lstrlenW (lpString=".7z") returned 3 [0115.591] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.592] lstrlenW (lpString=".dbf") returned 4 [0115.592] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.592] lstrlenW (lpString=".1cd") returned 4 [0115.592] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 62 [0115.592] lstrlenW (lpString=".jpg") returned 4 [0115.592] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.592] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") [0115.593] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=61676) returned 1 [0115.593] CloseHandle (hObject=0x19c) returned 1 [0115.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv")) returned 0x20 [0115.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.593] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.594] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.595] GetLastError () returned 0x0 [0115.595] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xf0ec, lpOverlapped=0x0) returned 1 [0115.598] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xf0f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xf0f0, lpOverlapped=0x0) returned 1 [0115.599] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.600] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.600] SetEndOfFile (hFile=0x1c8) returned 1 [0115.600] CloseHandle (hObject=0x1c8) returned 1 [0115.600] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.600] SetEndOfFile (hFile=0x19c) returned 1 [0115.601] CloseHandle (hObject=0x19c) returned 1 [0115.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv")) returned 1 [0115.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.601] lstrlenW (lpString=".doc") returned 4 [0115.601] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.601] lstrlenW (lpString=".docx") returned 5 [0115.601] lstrcmpiW (lpString1=".docx", lpString2="B.DPV") returned -1 [0115.601] lstrlenW (lpString=".pdf") returned 4 [0115.602] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.602] lstrlenW (lpString=".xls") returned 4 [0115.602] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.602] lstrlenW (lpString=".xlsx") returned 5 [0115.602] lstrcmpiW (lpString1=".xlsx", lpString2="B.DPV") returned -1 [0115.602] lstrlenW (lpString=".ppt") returned 4 [0115.602] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.602] lstrlenW (lpString=".zip") returned 4 [0115.602] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.602] lstrlenW (lpString=".rar") returned 4 [0115.602] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.602] lstrlenW (lpString=".bz2") returned 4 [0115.602] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.602] lstrlenW (lpString=".7z") returned 3 [0115.602] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.602] lstrlenW (lpString=".dbf") returned 4 [0115.602] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.602] lstrlenW (lpString=".1cd") returned 4 [0115.602] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 62 [0115.602] lstrlenW (lpString=".jpg") returned 4 [0115.602] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.602] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") [0115.603] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=20034) returned 1 [0115.603] CloseHandle (hObject=0x19c) returned 1 [0115.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc")) returned 0x20 [0115.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.603] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.603] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.604] GetLastError () returned 0x0 [0115.604] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x4e42, lpOverlapped=0x0) returned 1 [0115.607] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x4e50, lpOverlapped=0x0) returned 1 [0115.608] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.608] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.608] SetEndOfFile (hFile=0x1c8) returned 1 [0115.608] CloseHandle (hObject=0x1c8) returned 1 [0115.608] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.609] SetEndOfFile (hFile=0x19c) returned 1 [0115.609] CloseHandle (hObject=0x19c) returned 1 [0115.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc")) returned 1 [0115.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.610] lstrlenW (lpString=".doc") returned 4 [0115.610] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.610] lstrlenW (lpString=".docx") returned 5 [0115.610] lstrcmpiW (lpString1=".docx", lpString2="B.POC") returned -1 [0115.610] lstrlenW (lpString=".pdf") returned 4 [0115.610] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.610] lstrlenW (lpString=".xls") returned 4 [0115.610] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.610] lstrlenW (lpString=".xlsx") returned 5 [0115.610] lstrcmpiW (lpString1=".xlsx", lpString2="B.POC") returned -1 [0115.610] lstrlenW (lpString=".ppt") returned 4 [0115.610] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.610] lstrlenW (lpString=".zip") returned 4 [0115.610] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.610] lstrlenW (lpString=".rar") returned 4 [0115.610] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.610] lstrlenW (lpString=".bz2") returned 4 [0115.610] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.610] lstrlenW (lpString=".7z") returned 3 [0115.610] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.610] lstrlenW (lpString=".dbf") returned 4 [0115.611] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.611] lstrlenW (lpString=".1cd") returned 4 [0115.611] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 62 [0115.611] lstrlenW (lpString=".jpg") returned 4 [0115.611] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.611] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") [0115.611] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=258118) returned 1 [0115.611] CloseHandle (hObject=0x19c) returned 1 [0115.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc")) returned 0x20 [0115.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.612] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.612] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.612] GetLastError () returned 0x0 [0115.612] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x3f046, lpOverlapped=0x0) returned 1 [0115.619] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x3f050, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x3f050, lpOverlapped=0x0) returned 1 [0115.624] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0115.624] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.624] SetEndOfFile (hFile=0x1c8) returned 1 [0115.624] CloseHandle (hObject=0x1c8) returned 1 [0115.624] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.624] SetEndOfFile (hFile=0x19c) returned 1 [0115.626] CloseHandle (hObject=0x19c) returned 1 [0115.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc")) returned 1 [0115.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.627] lstrlenW (lpString=".doc") returned 4 [0115.627] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.627] lstrlenW (lpString=".docx") returned 5 [0115.627] lstrcmpiW (lpString1=".docx", lpString2="P.POC") returned -1 [0115.627] lstrlenW (lpString=".pdf") returned 4 [0115.627] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.627] lstrlenW (lpString=".xls") returned 4 [0115.627] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.627] lstrlenW (lpString=".xlsx") returned 5 [0115.627] lstrcmpiW (lpString1=".xlsx", lpString2="P.POC") returned -1 [0115.627] lstrlenW (lpString=".ppt") returned 4 [0115.627] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.627] lstrlenW (lpString=".zip") returned 4 [0115.627] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.627] lstrlenW (lpString=".rar") returned 4 [0115.627] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.627] lstrlenW (lpString=".bz2") returned 4 [0115.627] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.628] lstrlenW (lpString=".7z") returned 3 [0115.628] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.628] lstrlenW (lpString=".dbf") returned 4 [0115.628] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.628] lstrlenW (lpString=".1cd") returned 4 [0115.628] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 62 [0115.628] lstrlenW (lpString=".jpg") returned 4 [0115.628] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.628] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") [0115.629] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2375450) returned 1 [0115.629] CloseHandle (hObject=0x19c) returned 1 [0115.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc")) returned 0x20 [0115.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0115.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.630] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0x0) returned 1 [0115.630] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0115.630] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.847] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xc1508, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0115.847] ReadFile (in: hFile=0x19c, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.857] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0115.857] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x203f1a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc2c | out: lpNewFilePointer=0x0) returned 1 [0115.858] ReadFile (in: hFile=0x19c, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30efc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x30efc38*=0x40000, lpOverlapped=0x0) returned 1 [0115.873] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0115.874] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0116.249] SetEndOfFile (hFile=0x19c) returned 1 [0116.249] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0116.249] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0116.249] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.250] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xc1508, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0116.250] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.256] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x203f1a, lpNewFilePointer=0x0, dwMoveMethod=0x30efc7c | out: lpNewFilePointer=0x0) returned 1 [0116.256] WriteFile (in: hFile=0x19c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30efc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x30efc88*=0x40000, lpOverlapped=0x0) returned 1 [0116.259] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0116.259] CloseHandle (hObject=0x19c) returned 1 [0116.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString=".doc") returned 4 [0116.260] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.260] lstrlenW (lpString=".docx") returned 5 [0116.260] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0116.260] lstrlenW (lpString=".pdf") returned 4 [0116.260] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.260] lstrlenW (lpString=".xls") returned 4 [0116.260] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.260] lstrlenW (lpString=".xlsx") returned 5 [0116.260] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0116.260] lstrlenW (lpString=".ppt") returned 4 [0116.260] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString=".zip") returned 4 [0116.260] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.260] lstrlenW (lpString=".rar") returned 4 [0116.260] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.260] lstrlenW (lpString=".bz2") returned 4 [0116.260] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.260] lstrlenW (lpString=".7z") returned 3 [0116.260] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString=".dbf") returned 4 [0116.260] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString=".1cd") returned 4 [0116.260] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 62 [0116.260] lstrlenW (lpString=".jpg") returned 4 [0116.260] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.261] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") [0116.262] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=112836) returned 1 [0116.262] CloseHandle (hObject=0x19c) returned 1 [0116.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc")) returned 0x20 [0116.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.263] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.263] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.264] GetLastError () returned 0x0 [0116.264] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1b8c4, lpOverlapped=0x0) returned 1 [0116.351] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1b8d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1b8d0, lpOverlapped=0x0) returned 1 [0116.354] ReadFile (in: hFile=0x19c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0116.354] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.354] SetEndOfFile (hFile=0x1fc) returned 1 [0116.354] CloseHandle (hObject=0x1fc) returned 1 [0116.354] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.354] SetEndOfFile (hFile=0x19c) returned 1 [0116.356] CloseHandle (hObject=0x19c) returned 1 [0116.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc")) returned 1 [0116.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.357] lstrlenW (lpString=".doc") returned 4 [0116.357] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.357] lstrlenW (lpString=".docx") returned 5 [0116.357] lstrcmpiW (lpString1=".docx", lpString2="1.POC") returned -1 [0116.357] lstrlenW (lpString=".pdf") returned 4 [0116.357] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.357] lstrlenW (lpString=".xls") returned 4 [0116.357] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.357] lstrlenW (lpString=".xlsx") returned 5 [0116.357] lstrcmpiW (lpString1=".xlsx", lpString2="1.POC") returned -1 [0116.357] lstrlenW (lpString=".ppt") returned 4 [0116.357] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.357] lstrlenW (lpString=".zip") returned 4 [0116.357] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.357] lstrlenW (lpString=".rar") returned 4 [0116.357] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.357] lstrlenW (lpString=".bz2") returned 4 [0116.357] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.357] lstrlenW (lpString=".7z") returned 3 [0116.357] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.357] lstrlenW (lpString=".dbf") returned 4 [0116.357] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.357] lstrlenW (lpString=".1cd") returned 4 [0116.357] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 61 [0116.357] lstrlenW (lpString=".jpg") returned 4 [0116.357] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.357] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") [0116.393] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=405398) returned 1 [0116.393] CloseHandle (hObject=0x15c) returned 1 [0116.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc")) returned 0x20 [0116.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0116.393] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.393] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.394] GetLastError () returned 0x0 [0116.395] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x62f96, lpOverlapped=0x0) returned 1 [0116.469] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x62fa0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x62fa0, lpOverlapped=0x0) returned 1 [0116.477] ReadFile (in: hFile=0x15c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0116.478] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.478] SetEndOfFile (hFile=0x1f4) returned 1 [0116.478] CloseHandle (hObject=0x1f4) returned 1 [0116.478] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.478] SetEndOfFile (hFile=0x15c) returned 1 [0116.482] CloseHandle (hObject=0x15c) returned 1 [0116.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc")) returned 1 [0116.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.482] lstrlenW (lpString=".doc") returned 4 [0116.482] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.482] lstrlenW (lpString=".docx") returned 5 [0116.483] lstrcmpiW (lpString1=".docx", lpString2="Z.POC") returned -1 [0116.483] lstrlenW (lpString=".pdf") returned 4 [0116.483] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.483] lstrlenW (lpString=".xls") returned 4 [0116.483] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.483] lstrlenW (lpString=".xlsx") returned 5 [0116.483] lstrcmpiW (lpString1=".xlsx", lpString2="Z.POC") returned -1 [0116.483] lstrlenW (lpString=".ppt") returned 4 [0116.483] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.483] lstrlenW (lpString=".zip") returned 4 [0116.483] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.483] lstrlenW (lpString=".rar") returned 4 [0116.483] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.483] lstrlenW (lpString=".bz2") returned 4 [0116.483] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.483] lstrlenW (lpString=".7z") returned 3 [0116.483] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.483] lstrlenW (lpString=".dbf") returned 4 [0116.483] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.483] lstrlenW (lpString=".1cd") returned 4 [0116.483] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 60 [0116.483] lstrlenW (lpString=".jpg") returned 4 [0116.483] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.483] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") [0116.624] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5902) returned 1 [0116.624] CloseHandle (hObject=0x1fc) returned 1 [0116.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc")) returned 0x20 [0116.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.643] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.643] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.644] GetLastError () returned 0x0 [0116.644] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x170e, lpOverlapped=0x0) returned 1 [0116.645] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1710, lpOverlapped=0x0) returned 1 [0116.646] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0116.646] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.646] SetEndOfFile (hFile=0x16c) returned 1 [0116.646] CloseHandle (hObject=0x16c) returned 1 [0116.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.646] SetEndOfFile (hFile=0x1fc) returned 1 [0116.647] CloseHandle (hObject=0x1fc) returned 1 [0116.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc")) returned 1 [0116.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.647] lstrlenW (lpString=".doc") returned 4 [0116.648] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.648] lstrlenW (lpString=".docx") returned 5 [0116.648] lstrcmpiW (lpString1=".docx", lpString2="R.POC") returned -1 [0116.648] lstrlenW (lpString=".pdf") returned 4 [0116.648] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.648] lstrlenW (lpString=".xls") returned 4 [0116.648] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.648] lstrlenW (lpString=".xlsx") returned 5 [0116.648] lstrcmpiW (lpString1=".xlsx", lpString2="R.POC") returned -1 [0116.648] lstrlenW (lpString=".ppt") returned 4 [0116.648] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.648] lstrlenW (lpString=".zip") returned 4 [0116.648] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.648] lstrlenW (lpString=".rar") returned 4 [0116.648] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.648] lstrlenW (lpString=".bz2") returned 4 [0116.648] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.648] lstrlenW (lpString=".7z") returned 3 [0116.648] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.648] lstrlenW (lpString=".dbf") returned 4 [0116.648] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.648] lstrlenW (lpString=".1cd") returned 4 [0116.648] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 61 [0116.648] lstrlenW (lpString=".jpg") returned 4 [0116.648] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.648] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") [0116.649] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6144) returned 1 [0116.650] CloseHandle (hObject=0x1fc) returned 1 [0116.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv")) returned 0x20 [0116.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.651] GetLastError () returned 0x0 [0116.651] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x1800, lpOverlapped=0x0) returned 1 [0116.690] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x1810, lpOverlapped=0x0) returned 1 [0116.691] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0116.691] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.691] SetEndOfFile (hFile=0x16c) returned 1 [0116.691] CloseHandle (hObject=0x16c) returned 1 [0116.691] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.691] SetEndOfFile (hFile=0x1fc) returned 1 [0116.692] CloseHandle (hObject=0x1fc) returned 1 [0116.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv")) returned 1 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString=".doc") returned 4 [0116.693] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.693] lstrlenW (lpString=".docx") returned 5 [0116.693] lstrcmpiW (lpString1=".docx", lpString2="S.DPV") returned -1 [0116.693] lstrlenW (lpString=".pdf") returned 4 [0116.693] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.693] lstrlenW (lpString=".xls") returned 4 [0116.693] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.693] lstrlenW (lpString=".xlsx") returned 5 [0116.693] lstrcmpiW (lpString1=".xlsx", lpString2="S.DPV") returned -1 [0116.693] lstrlenW (lpString=".ppt") returned 4 [0116.693] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString=".zip") returned 4 [0116.693] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.693] lstrlenW (lpString=".rar") returned 4 [0116.693] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.693] lstrlenW (lpString=".bz2") returned 4 [0116.693] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.693] lstrlenW (lpString=".7z") returned 3 [0116.693] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString=".dbf") returned 4 [0116.693] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString=".1cd") returned 4 [0116.693] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 60 [0116.693] lstrlenW (lpString=".jpg") returned 4 [0116.693] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.694] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") [0116.702] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=11264) returned 1 [0116.702] CloseHandle (hObject=0x1fc) returned 1 [0116.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv")) returned 0x20 [0116.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.702] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.702] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.703] GetLastError () returned 0x0 [0116.703] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2c00, lpOverlapped=0x0) returned 1 [0116.704] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2c10, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2c10, lpOverlapped=0x0) returned 1 [0116.705] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0116.705] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.706] SetEndOfFile (hFile=0x16c) returned 1 [0116.706] CloseHandle (hObject=0x16c) returned 1 [0116.706] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.706] SetEndOfFile (hFile=0x1fc) returned 1 [0116.707] CloseHandle (hObject=0x1fc) returned 1 [0116.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv")) returned 1 [0116.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.707] lstrlenW (lpString=".doc") returned 4 [0116.707] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.707] lstrlenW (lpString=".docx") returned 5 [0116.707] lstrcmpiW (lpString1=".docx", lpString2="Q.DPV") returned -1 [0116.707] lstrlenW (lpString=".pdf") returned 4 [0116.707] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.707] lstrlenW (lpString=".xls") returned 4 [0116.707] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.707] lstrlenW (lpString=".xlsx") returned 5 [0116.707] lstrcmpiW (lpString1=".xlsx", lpString2="Q.DPV") returned -1 [0116.707] lstrlenW (lpString=".ppt") returned 4 [0116.707] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.707] lstrlenW (lpString=".zip") returned 4 [0116.708] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.708] lstrlenW (lpString=".rar") returned 4 [0116.708] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.708] lstrlenW (lpString=".bz2") returned 4 [0116.708] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.708] lstrlenW (lpString=".7z") returned 3 [0116.708] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.708] lstrlenW (lpString=".dbf") returned 4 [0116.708] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.708] lstrlenW (lpString=".1cd") returned 4 [0116.708] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 60 [0116.708] lstrlenW (lpString=".jpg") returned 4 [0116.708] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.708] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") [0116.709] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=29092) returned 1 [0116.709] CloseHandle (hObject=0x1fc) returned 1 [0116.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv")) returned 0x20 [0116.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.710] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.710] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0116.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.710] GetLastError () returned 0x0 [0116.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x71a4, lpOverlapped=0x0) returned 1 [0117.175] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x71b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x71b0, lpOverlapped=0x0) returned 1 [0117.176] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0117.177] WriteFile (in: hFile=0x16c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.177] SetEndOfFile (hFile=0x16c) returned 1 [0117.219] CloseHandle (hObject=0x16c) returned 1 [0117.219] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.219] SetEndOfFile (hFile=0x1fc) returned 1 [0117.252] CloseHandle (hObject=0x1fc) returned 1 [0117.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv")) returned 1 [0117.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString=".doc") returned 4 [0117.287] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.287] lstrlenW (lpString=".docx") returned 5 [0117.287] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0117.287] lstrlenW (lpString=".pdf") returned 4 [0117.287] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.287] lstrlenW (lpString=".xls") returned 4 [0117.287] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.287] lstrlenW (lpString=".xlsx") returned 5 [0117.287] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0117.287] lstrlenW (lpString=".ppt") returned 4 [0117.287] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString=".zip") returned 4 [0117.287] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.287] lstrlenW (lpString=".rar") returned 4 [0117.287] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.287] lstrlenW (lpString=".bz2") returned 4 [0117.287] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.287] lstrlenW (lpString=".7z") returned 3 [0117.287] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString=".dbf") returned 4 [0117.287] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString=".1cd") returned 4 [0117.287] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 62 [0117.287] lstrlenW (lpString=".jpg") returned 4 [0117.287] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.288] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") [0117.323] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=58638) returned 1 [0117.323] CloseHandle (hObject=0x16c) returned 1 [0117.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv")) returned 0x20 [0117.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0117.324] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.324] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0117.324] GetLastError () returned 0x0 [0117.325] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0xe50e, lpOverlapped=0x0) returned 1 [0117.327] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe510, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe510, lpOverlapped=0x0) returned 1 [0117.329] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0117.329] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0117.329] SetEndOfFile (hFile=0x19c) returned 1 [0117.329] CloseHandle (hObject=0x19c) returned 1 [0117.329] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.329] SetEndOfFile (hFile=0x16c) returned 1 [0117.331] CloseHandle (hObject=0x16c) returned 1 [0117.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv")) returned 1 [0117.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.331] lstrlenW (lpString=".doc") returned 4 [0117.331] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.331] lstrlenW (lpString=".docx") returned 5 [0117.331] lstrcmpiW (lpString1=".docx", lpString2="C.DPV") returned -1 [0117.331] lstrlenW (lpString=".pdf") returned 4 [0117.331] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.331] lstrlenW (lpString=".xls") returned 4 [0117.331] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.331] lstrlenW (lpString=".xlsx") returned 5 [0117.332] lstrcmpiW (lpString1=".xlsx", lpString2="C.DPV") returned -1 [0117.332] lstrlenW (lpString=".ppt") returned 4 [0117.332] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.332] lstrlenW (lpString=".zip") returned 4 [0117.332] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.332] lstrlenW (lpString=".rar") returned 4 [0117.332] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.332] lstrlenW (lpString=".bz2") returned 4 [0117.332] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.332] lstrlenW (lpString=".7z") returned 3 [0117.332] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.332] lstrlenW (lpString=".dbf") returned 4 [0117.332] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.332] lstrlenW (lpString=".1cd") returned 4 [0117.332] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 59 [0117.332] lstrlenW (lpString=".jpg") returned 4 [0117.332] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.332] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") [0117.333] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10240) returned 1 [0117.333] CloseHandle (hObject=0x16c) returned 1 [0117.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv")) returned 0x20 [0117.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0117.333] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.333] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0117.334] GetLastError () returned 0x0 [0117.334] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2800, lpOverlapped=0x0) returned 1 [0117.336] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2810, lpOverlapped=0x0) returned 1 [0117.337] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0117.337] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.337] SetEndOfFile (hFile=0x19c) returned 1 [0117.337] CloseHandle (hObject=0x19c) returned 1 [0117.337] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.337] SetEndOfFile (hFile=0x16c) returned 1 [0117.338] CloseHandle (hObject=0x16c) returned 1 [0117.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv")) returned 1 [0117.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.338] lstrlenW (lpString=".doc") returned 4 [0117.338] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.338] lstrlenW (lpString=".docx") returned 5 [0117.338] lstrcmpiW (lpString1=".docx", lpString2="N.DPV") returned -1 [0117.338] lstrlenW (lpString=".pdf") returned 4 [0117.338] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.338] lstrlenW (lpString=".xls") returned 4 [0117.338] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.338] lstrlenW (lpString=".xlsx") returned 5 [0117.338] lstrcmpiW (lpString1=".xlsx", lpString2="N.DPV") returned -1 [0117.339] lstrlenW (lpString=".ppt") returned 4 [0117.339] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.339] lstrlenW (lpString=".zip") returned 4 [0117.339] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.339] lstrlenW (lpString=".rar") returned 4 [0117.339] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.339] lstrlenW (lpString=".bz2") returned 4 [0117.339] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.339] lstrlenW (lpString=".7z") returned 3 [0117.339] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.339] lstrlenW (lpString=".dbf") returned 4 [0117.339] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.339] lstrlenW (lpString=".1cd") returned 4 [0117.339] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 62 [0117.339] lstrlenW (lpString=".jpg") returned 4 [0117.339] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.339] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") [0117.340] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=197054) returned 1 [0117.340] CloseHandle (hObject=0x16c) returned 1 [0117.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv")) returned 0x20 [0117.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0117.340] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.340] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0117.341] GetLastError () returned 0x0 [0117.341] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x301be, lpOverlapped=0x0) returned 1 [0117.346] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x301c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x301c0, lpOverlapped=0x0) returned 1 [0117.350] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0117.350] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.350] SetEndOfFile (hFile=0x19c) returned 1 [0117.351] CloseHandle (hObject=0x19c) returned 1 [0117.351] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.351] SetEndOfFile (hFile=0x16c) returned 1 [0117.352] CloseHandle (hObject=0x16c) returned 1 [0117.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv")) returned 1 [0117.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.353] lstrlenW (lpString=".doc") returned 4 [0117.353] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.353] lstrlenW (lpString=".docx") returned 5 [0117.353] lstrcmpiW (lpString1=".docx", lpString2="L.DPV") returned -1 [0117.353] lstrlenW (lpString=".pdf") returned 4 [0117.353] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.353] lstrlenW (lpString=".xls") returned 4 [0117.353] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.353] lstrlenW (lpString=".xlsx") returned 5 [0117.353] lstrcmpiW (lpString1=".xlsx", lpString2="L.DPV") returned -1 [0117.353] lstrlenW (lpString=".ppt") returned 4 [0117.353] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.353] lstrlenW (lpString=".zip") returned 4 [0117.353] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.353] lstrlenW (lpString=".rar") returned 4 [0117.353] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.353] lstrlenW (lpString=".bz2") returned 4 [0117.353] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.353] lstrlenW (lpString=".7z") returned 3 [0117.353] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.354] lstrlenW (lpString=".dbf") returned 4 [0117.354] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.354] lstrlenW (lpString=".1cd") returned 4 [0117.354] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 62 [0117.354] lstrlenW (lpString=".jpg") returned 4 [0117.354] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.354] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") [0117.355] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=194580) returned 1 [0117.355] CloseHandle (hObject=0x16c) returned 1 [0117.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv")) returned 0x20 [0117.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0117.356] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.356] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0117.356] GetLastError () returned 0x0 [0117.356] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x2f814, lpOverlapped=0x0) returned 1 [0117.522] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0x2f820, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0x2f820, lpOverlapped=0x0) returned 1 [0117.527] ReadFile (in: hFile=0x16c, lpBuffer=0x3c40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0117.527] WriteFile (in: hFile=0x19c, lpBuffer=0x3c40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c40020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.527] SetEndOfFile (hFile=0x19c) returned 1 [0117.893] CloseHandle (hObject=0x19c) returned 1 [0117.893] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0117.893] SetEndOfFile (hFile=0x16c) returned 1 [0117.895] CloseHandle (hObject=0x16c) returned 1 [0117.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv")) returned 1 [0118.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.436] lstrlenW (lpString=".doc") returned 4 [0118.439] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0118.439] lstrlenW (lpString=".docx") returned 5 [0118.439] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0118.439] lstrlenW (lpString=".pdf") returned 4 [0118.439] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0118.446] lstrlenW (lpString=".xls") returned 4 [0118.446] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0118.446] lstrlenW (lpString=".xlsx") returned 5 [0118.446] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0118.446] lstrlenW (lpString=".ppt") returned 4 [0118.446] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0118.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.446] lstrlenW (lpString=".zip") returned 4 [0118.446] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0118.446] lstrlenW (lpString=".rar") returned 4 [0118.446] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0118.446] lstrlenW (lpString=".bz2") returned 4 [0118.446] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0118.452] lstrlenW (lpString=".7z") returned 3 [0118.452] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0118.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.453] lstrlenW (lpString=".dbf") returned 4 [0118.453] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0118.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.453] lstrlenW (lpString=".1cd") returned 4 [0118.453] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0118.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 61 [0118.453] lstrlenW (lpString=".jpg") returned 4 [0118.453] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0118.453] RtlInitUnicodeStringEx (DestinationString=0x30efee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV") Thread: id = 16 os_tid = 0x9dc [0033.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x37902a0 [0033.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x37a02a8 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641240 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6416d0 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641258 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3d50020 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641270 [0033.725] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641270, Size=0x20) returned 0x629f48 [0033.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641270 [0033.725] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x641270, Size=0x20) returned 0x629f70 [0033.725] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.725] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.725] Wow64DisableWow64FsRedirection (in: OldValue=0x322ff58 | out: OldValue=0x322ff58*=0x0) returned 1 [0033.725] lstrlenW (lpString="kernel32.dll") returned 12 [0033.725] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.725] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.725] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.725] Sleep (dwMilliseconds=0x64) [0033.918] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0033.918] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0033.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.002] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1565) returned 1 [0034.002] CloseHandle (hObject=0x170) returned 1 [0034.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0034.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.019] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.019] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.019] GetLastError () returned 0x0 [0034.019] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x61d, lpOverlapped=0x0) returned 1 [0034.041] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x620, lpOverlapped=0x0) returned 1 [0034.042] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.042] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.042] SetEndOfFile (hFile=0x174) returned 1 [0034.042] CloseHandle (hObject=0x174) returned 1 [0034.043] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.043] SetEndOfFile (hFile=0x180) returned 1 [0034.044] CloseHandle (hObject=0x180) returned 1 [0034.044] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.044] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0034.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.044] lstrlenW (lpString=".doc") returned 4 [0034.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.044] lstrlenW (lpString=".docx") returned 5 [0034.044] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.044] lstrlenW (lpString=".pdf") returned 4 [0034.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.044] lstrlenW (lpString=".xls") returned 4 [0034.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.044] lstrlenW (lpString=".xlsx") returned 5 [0034.044] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.045] lstrlenW (lpString=".ppt") returned 4 [0034.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString=".zip") returned 4 [0034.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.045] lstrlenW (lpString=".rar") returned 4 [0034.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString=".bz2") returned 4 [0034.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString=".7z") returned 3 [0034.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString=".dbf") returned 4 [0034.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString=".1cd") returned 4 [0034.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString=".jpg") returned 4 [0034.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.045] lstrlenW (lpString=".doc") returned 4 [0034.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString=".docx") returned 5 [0034.045] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.045] lstrlenW (lpString=".pdf") returned 4 [0034.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString=".xls") returned 4 [0034.045] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.045] lstrlenW (lpString=".xlsx") returned 5 [0034.045] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.046] lstrlenW (lpString=".ppt") returned 4 [0034.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.046] lstrlenW (lpString=".zip") returned 4 [0034.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.046] lstrlenW (lpString=".rar") returned 4 [0034.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.046] lstrlenW (lpString=".bz2") returned 4 [0034.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.046] lstrlenW (lpString=".7z") returned 3 [0034.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.046] lstrlenW (lpString=".dbf") returned 4 [0034.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.046] lstrlenW (lpString=".1cd") returned 4 [0034.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.046] lstrlenW (lpString=".jpg") returned 4 [0034.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.046] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.046] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0034.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.047] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3186) returned 1 [0034.047] CloseHandle (hObject=0x180) returned 1 [0034.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0034.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.047] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.047] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.048] GetLastError () returned 0x0 [0034.048] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc72, lpOverlapped=0x0) returned 1 [0034.054] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0034.056] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.056] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.056] SetEndOfFile (hFile=0x174) returned 1 [0034.056] CloseHandle (hObject=0x174) returned 1 [0034.057] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.057] SetEndOfFile (hFile=0x180) returned 1 [0034.058] CloseHandle (hObject=0x180) returned 1 [0034.058] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.058] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString=".doc") returned 4 [0034.059] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString=".docx") returned 5 [0034.059] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.059] lstrlenW (lpString=".pdf") returned 4 [0034.059] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString=".xls") returned 4 [0034.059] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString=".xlsx") returned 5 [0034.059] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.059] lstrlenW (lpString=".ppt") returned 4 [0034.059] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString=".zip") returned 4 [0034.059] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.059] lstrlenW (lpString=".rar") returned 4 [0034.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString=".bz2") returned 4 [0034.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString=".7z") returned 3 [0034.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString=".dbf") returned 4 [0034.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString=".1cd") returned 4 [0034.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.059] lstrlenW (lpString=".jpg") returned 4 [0034.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString=".doc") returned 4 [0034.060] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString=".docx") returned 5 [0034.060] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.060] lstrlenW (lpString=".pdf") returned 4 [0034.060] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString=".xls") returned 4 [0034.060] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString=".xlsx") returned 5 [0034.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.060] lstrlenW (lpString=".ppt") returned 4 [0034.060] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString=".zip") returned 4 [0034.060] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.060] lstrlenW (lpString=".rar") returned 4 [0034.060] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString=".bz2") returned 4 [0034.060] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString=".7z") returned 3 [0034.060] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString=".dbf") returned 4 [0034.060] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString=".1cd") returned 4 [0034.060] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.060] lstrlenW (lpString=".jpg") returned 4 [0034.060] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.061] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.061] lstrlenW (lpString="Setup.xml") returned 9 [0034.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.061] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4207) returned 1 [0034.061] CloseHandle (hObject=0x180) returned 1 [0034.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.062] GetLastError () returned 0x0 [0034.062] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x106f, lpOverlapped=0x0) returned 1 [0034.320] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0034.344] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.344] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.344] SetEndOfFile (hFile=0x174) returned 1 [0034.344] CloseHandle (hObject=0x174) returned 1 [0034.345] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.345] SetEndOfFile (hFile=0x180) returned 1 [0034.346] CloseHandle (hObject=0x180) returned 1 [0034.346] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.347] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.347] lstrlenW (lpString=".doc") returned 4 [0034.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString=".docx") returned 5 [0034.347] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.347] lstrlenW (lpString=".pdf") returned 4 [0034.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString=".xls") returned 4 [0034.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString=".xlsx") returned 5 [0034.347] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.347] lstrlenW (lpString=".ppt") returned 4 [0034.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.347] lstrlenW (lpString=".zip") returned 4 [0034.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.347] lstrlenW (lpString=".rar") returned 4 [0034.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString=".bz2") returned 4 [0034.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.347] lstrlenW (lpString=".7z") returned 3 [0034.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.347] lstrlenW (lpString=".dbf") returned 4 [0034.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString=".1cd") returned 4 [0034.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString=".jpg") returned 4 [0034.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString=".doc") returned 4 [0034.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString=".docx") returned 5 [0034.348] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.348] lstrlenW (lpString=".pdf") returned 4 [0034.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString=".xls") returned 4 [0034.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString=".xlsx") returned 5 [0034.348] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.348] lstrlenW (lpString=".ppt") returned 4 [0034.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString=".zip") returned 4 [0034.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.348] lstrlenW (lpString=".rar") returned 4 [0034.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString=".bz2") returned 4 [0034.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString=".7z") returned 3 [0034.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.348] lstrlenW (lpString=".dbf") returned 4 [0034.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.349] lstrlenW (lpString=".1cd") returned 4 [0034.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.349] lstrlenW (lpString=".jpg") returned 4 [0034.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.349] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.349] lstrlenW (lpString="Setup.xml") returned 9 [0034.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.349] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5884) returned 1 [0034.349] CloseHandle (hObject=0x180) returned 1 [0034.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.349] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.349] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.350] GetLastError () returned 0x0 [0034.350] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.351] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0034.352] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.352] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.352] SetEndOfFile (hFile=0x174) returned 1 [0034.353] CloseHandle (hObject=0x174) returned 1 [0034.353] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.353] SetEndOfFile (hFile=0x180) returned 1 [0034.354] CloseHandle (hObject=0x180) returned 1 [0034.354] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.354] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.354] lstrlenW (lpString=".doc") returned 4 [0034.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.354] lstrlenW (lpString=".docx") returned 5 [0034.354] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.355] lstrlenW (lpString=".pdf") returned 4 [0034.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString=".xls") returned 4 [0034.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString=".xlsx") returned 5 [0034.355] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.355] lstrlenW (lpString=".ppt") returned 4 [0034.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString=".zip") returned 4 [0034.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.355] lstrlenW (lpString=".rar") returned 4 [0034.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString=".bz2") returned 4 [0034.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString=".7z") returned 3 [0034.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString=".dbf") returned 4 [0034.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString=".1cd") returned 4 [0034.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString=".jpg") returned 4 [0034.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.355] lstrlenW (lpString=".doc") returned 4 [0034.355] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.355] lstrlenW (lpString=".docx") returned 5 [0034.355] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.355] lstrlenW (lpString=".pdf") returned 4 [0034.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString=".xls") returned 4 [0034.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString=".xlsx") returned 5 [0034.356] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.356] lstrlenW (lpString=".ppt") returned 4 [0034.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.356] lstrlenW (lpString=".zip") returned 4 [0034.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.356] lstrlenW (lpString=".rar") returned 4 [0034.356] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString=".bz2") returned 4 [0034.356] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString=".7z") returned 3 [0034.356] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.356] lstrlenW (lpString=".dbf") returned 4 [0034.356] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.356] lstrlenW (lpString=".1cd") returned 4 [0034.356] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.356] lstrlenW (lpString=".jpg") returned 4 [0034.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.356] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.356] lstrlenW (lpString="Office32MUI.xml") returned 15 [0034.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.357] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1383) returned 1 [0034.357] CloseHandle (hObject=0x180) returned 1 [0034.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0034.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.358] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.358] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.358] GetLastError () returned 0x0 [0034.358] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x567, lpOverlapped=0x0) returned 1 [0034.359] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x570, lpOverlapped=0x0) returned 1 [0034.360] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.360] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.360] SetEndOfFile (hFile=0x174) returned 1 [0034.363] CloseHandle (hObject=0x174) returned 1 [0034.364] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.364] SetEndOfFile (hFile=0x180) returned 1 [0034.364] CloseHandle (hObject=0x180) returned 1 [0034.364] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.365] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0034.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.365] lstrlenW (lpString=".doc") returned 4 [0034.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.365] lstrlenW (lpString=".docx") returned 5 [0034.365] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.365] lstrlenW (lpString=".pdf") returned 4 [0034.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.365] lstrlenW (lpString=".xls") returned 4 [0034.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.365] lstrlenW (lpString=".xlsx") returned 5 [0034.365] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.365] lstrlenW (lpString=".ppt") returned 4 [0034.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.365] lstrlenW (lpString=".zip") returned 4 [0034.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.365] lstrlenW (lpString=".rar") returned 4 [0034.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.365] lstrlenW (lpString=".bz2") returned 4 [0034.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".7z") returned 3 [0034.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString=".dbf") returned 4 [0034.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString=".1cd") returned 4 [0034.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString=".jpg") returned 4 [0034.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString=".doc") returned 4 [0034.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".docx") returned 5 [0034.366] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.366] lstrlenW (lpString=".pdf") returned 4 [0034.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".xls") returned 4 [0034.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".xlsx") returned 5 [0034.366] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.366] lstrlenW (lpString=".ppt") returned 4 [0034.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.366] lstrlenW (lpString=".zip") returned 4 [0034.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.366] lstrlenW (lpString=".rar") returned 4 [0034.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".bz2") returned 4 [0034.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.366] lstrlenW (lpString=".7z") returned 3 [0034.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.367] lstrlenW (lpString=".dbf") returned 4 [0034.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.367] lstrlenW (lpString=".1cd") returned 4 [0034.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.367] lstrlenW (lpString=".jpg") returned 4 [0034.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.367] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.367] lstrlenW (lpString="Setup.xml") returned 9 [0034.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.367] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2362) returned 1 [0034.367] CloseHandle (hObject=0x180) returned 1 [0034.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.368] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.368] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.368] GetLastError () returned 0x0 [0034.368] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x93a, lpOverlapped=0x0) returned 1 [0034.369] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x940, lpOverlapped=0x0) returned 1 [0034.370] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.370] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.370] SetEndOfFile (hFile=0x174) returned 1 [0034.371] CloseHandle (hObject=0x174) returned 1 [0034.371] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.371] SetEndOfFile (hFile=0x180) returned 1 [0034.372] CloseHandle (hObject=0x180) returned 1 [0034.372] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.372] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString=".doc") returned 4 [0034.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".docx") returned 5 [0034.373] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.373] lstrlenW (lpString=".pdf") returned 4 [0034.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".xls") returned 4 [0034.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".xlsx") returned 5 [0034.373] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.373] lstrlenW (lpString=".ppt") returned 4 [0034.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString=".zip") returned 4 [0034.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.373] lstrlenW (lpString=".rar") returned 4 [0034.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".bz2") returned 4 [0034.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".7z") returned 3 [0034.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString=".dbf") returned 4 [0034.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString=".1cd") returned 4 [0034.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.373] lstrlenW (lpString=".jpg") returned 4 [0034.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString=".doc") returned 4 [0034.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".docx") returned 5 [0034.374] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.374] lstrlenW (lpString=".pdf") returned 4 [0034.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".xls") returned 4 [0034.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".xlsx") returned 5 [0034.374] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.374] lstrlenW (lpString=".ppt") returned 4 [0034.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString=".zip") returned 4 [0034.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.374] lstrlenW (lpString=".rar") returned 4 [0034.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".bz2") returned 4 [0034.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".7z") returned 3 [0034.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString=".dbf") returned 4 [0034.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString=".1cd") returned 4 [0034.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.374] lstrlenW (lpString=".jpg") returned 4 [0034.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.375] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.375] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0034.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.376] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1231) returned 1 [0034.376] CloseHandle (hObject=0x180) returned 1 [0034.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0034.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0034.376] GetLastError () returned 0x0 [0034.376] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0034.735] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0034.736] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x174, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.736] SetEndOfFile (hFile=0x174) returned 1 [0034.736] CloseHandle (hObject=0x174) returned 1 [0034.737] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.737] SetEndOfFile (hFile=0x180) returned 1 [0034.738] CloseHandle (hObject=0x180) returned 1 [0034.738] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0034.738] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.738] lstrlenW (lpString=".doc") returned 4 [0034.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".docx") returned 5 [0034.738] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.738] lstrlenW (lpString=".pdf") returned 4 [0034.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".xls") returned 4 [0034.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".xlsx") returned 5 [0034.738] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.739] lstrlenW (lpString=".ppt") returned 4 [0034.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString=".zip") returned 4 [0034.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.739] lstrlenW (lpString=".rar") returned 4 [0034.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".bz2") returned 4 [0034.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".7z") returned 3 [0034.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString=".dbf") returned 4 [0034.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString=".1cd") returned 4 [0034.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString=".jpg") returned 4 [0034.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.739] lstrlenW (lpString=".doc") returned 4 [0034.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".docx") returned 5 [0034.739] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.739] lstrlenW (lpString=".pdf") returned 4 [0034.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".xls") returned 4 [0034.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".xlsx") returned 5 [0034.739] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.739] lstrlenW (lpString=".ppt") returned 4 [0034.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.740] lstrlenW (lpString=".zip") returned 4 [0034.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.740] lstrlenW (lpString=".rar") returned 4 [0034.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString=".bz2") returned 4 [0034.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString=".7z") returned 3 [0034.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.740] lstrlenW (lpString=".dbf") returned 4 [0034.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.740] lstrlenW (lpString=".1cd") returned 4 [0034.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.740] lstrlenW (lpString=".jpg") returned 4 [0034.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.740] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0034.740] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0034.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.459] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1452) returned 1 [0035.459] CloseHandle (hObject=0x16c) returned 1 [0035.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0035.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0035.459] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.459] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0035.459] GetLastError () returned 0x0 [0035.459] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.495] WriteFile (in: hFile=0x164, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.496] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.496] WriteFile (in: hFile=0x164, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.496] SetEndOfFile (hFile=0x164) returned 1 [0035.496] CloseHandle (hObject=0x164) returned 1 [0035.497] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.497] SetEndOfFile (hFile=0x16c) returned 1 [0035.497] CloseHandle (hObject=0x16c) returned 1 [0035.498] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.498] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0035.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.498] lstrlenW (lpString=".doc") returned 4 [0035.498] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.498] lstrlenW (lpString=".docx") returned 5 [0035.498] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.498] lstrlenW (lpString=".pdf") returned 4 [0035.498] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.498] lstrlenW (lpString=".xls") returned 4 [0035.498] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.498] lstrlenW (lpString=".xlsx") returned 5 [0035.498] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.498] lstrlenW (lpString=".ppt") returned 4 [0035.498] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.498] lstrlenW (lpString=".zip") returned 4 [0035.498] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.498] lstrlenW (lpString=".rar") returned 4 [0035.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.498] lstrlenW (lpString=".bz2") returned 4 [0035.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".7z") returned 3 [0035.499] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString=".dbf") returned 4 [0035.499] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString=".1cd") returned 4 [0035.499] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString=".jpg") returned 4 [0035.499] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString=".doc") returned 4 [0035.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".docx") returned 5 [0035.499] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.499] lstrlenW (lpString=".pdf") returned 4 [0035.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".xls") returned 4 [0035.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".xlsx") returned 5 [0035.499] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.499] lstrlenW (lpString=".ppt") returned 4 [0035.499] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.499] lstrlenW (lpString=".zip") returned 4 [0035.499] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.499] lstrlenW (lpString=".rar") returned 4 [0035.499] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".bz2") returned 4 [0035.499] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.499] lstrlenW (lpString=".7z") returned 3 [0035.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.500] lstrlenW (lpString=".dbf") returned 4 [0035.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.500] lstrlenW (lpString=".1cd") returned 4 [0035.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.500] lstrlenW (lpString=".jpg") returned 4 [0035.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.500] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.500] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0035.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.507] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=819) returned 1 [0035.507] CloseHandle (hObject=0x168) returned 1 [0035.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0035.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.507] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.507] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.508] GetLastError () returned 0x0 [0035.508] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.509] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.510] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.510] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.510] SetEndOfFile (hFile=0x1a4) returned 1 [0035.511] CloseHandle (hObject=0x1a4) returned 1 [0035.512] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.512] SetEndOfFile (hFile=0x168) returned 1 [0035.513] CloseHandle (hObject=0x168) returned 1 [0035.513] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.513] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0035.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.513] lstrlenW (lpString=".doc") returned 4 [0035.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.513] lstrlenW (lpString=".docx") returned 5 [0035.513] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.513] lstrlenW (lpString=".pdf") returned 4 [0035.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString=".xls") returned 4 [0035.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString=".xlsx") returned 5 [0035.514] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.514] lstrlenW (lpString=".ppt") returned 4 [0035.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString=".zip") returned 4 [0035.514] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.514] lstrlenW (lpString=".rar") returned 4 [0035.514] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString=".bz2") returned 4 [0035.514] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString=".7z") returned 3 [0035.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString=".dbf") returned 4 [0035.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString=".1cd") returned 4 [0035.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString=".jpg") returned 4 [0035.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.514] lstrlenW (lpString=".doc") returned 4 [0035.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.514] lstrlenW (lpString=".docx") returned 5 [0035.514] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.514] lstrlenW (lpString=".pdf") returned 4 [0035.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString=".xls") returned 4 [0035.515] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString=".xlsx") returned 5 [0035.515] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.515] lstrlenW (lpString=".ppt") returned 4 [0035.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.515] lstrlenW (lpString=".zip") returned 4 [0035.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.515] lstrlenW (lpString=".rar") returned 4 [0035.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString=".bz2") returned 4 [0035.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString=".7z") returned 3 [0035.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.515] lstrlenW (lpString=".dbf") returned 4 [0035.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.515] lstrlenW (lpString=".1cd") returned 4 [0035.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.515] lstrlenW (lpString=".jpg") returned 4 [0035.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.515] lstrcmpiW (lpString1=".chm", lpString2=".zoh") returned -1 [0035.515] lstrlenW (lpString="setup.chm") returned 9 [0035.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.516] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=67190) returned 1 [0035.516] CloseHandle (hObject=0x168) returned 1 [0035.516] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0035.516] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.516] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.516] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.517] GetLastError () returned 0x0 [0035.517] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10676, lpOverlapped=0x0) returned 1 [0035.519] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0035.521] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.521] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.522] SetEndOfFile (hFile=0x1a4) returned 1 [0035.522] CloseHandle (hObject=0x1a4) returned 1 [0035.523] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.523] SetEndOfFile (hFile=0x168) returned 1 [0035.524] CloseHandle (hObject=0x168) returned 1 [0035.524] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.524] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString=".doc") returned 4 [0035.525] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString=".docx") returned 5 [0035.525] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.525] lstrlenW (lpString=".pdf") returned 4 [0035.525] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString=".xls") returned 4 [0035.525] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString=".xlsx") returned 5 [0035.525] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.525] lstrlenW (lpString=".ppt") returned 4 [0035.525] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString=".zip") returned 4 [0035.525] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString=".rar") returned 4 [0035.525] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString=".bz2") returned 4 [0035.525] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.525] lstrlenW (lpString=".7z") returned 3 [0035.525] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString=".dbf") returned 4 [0035.525] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString=".1cd") returned 4 [0035.525] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.525] lstrlenW (lpString=".jpg") returned 4 [0035.526] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString=".doc") returned 4 [0035.526] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString=".docx") returned 5 [0035.526] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.526] lstrlenW (lpString=".pdf") returned 4 [0035.526] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString=".xls") returned 4 [0035.526] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString=".xlsx") returned 5 [0035.526] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.526] lstrlenW (lpString=".ppt") returned 4 [0035.526] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString=".zip") returned 4 [0035.526] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString=".rar") returned 4 [0035.526] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString=".bz2") returned 4 [0035.526] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.526] lstrlenW (lpString=".7z") returned 3 [0035.526] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString=".dbf") returned 4 [0035.526] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString=".1cd") returned 4 [0035.526] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.526] lstrlenW (lpString=".jpg") returned 4 [0035.526] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.527] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.527] lstrlenW (lpString="Setup.xml") returned 9 [0035.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.528] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9352) returned 1 [0035.528] CloseHandle (hObject=0x168) returned 1 [0035.528] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.528] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.529] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.529] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.529] GetLastError () returned 0x0 [0035.529] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2488, lpOverlapped=0x0) returned 1 [0035.561] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0035.562] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.562] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.562] SetEndOfFile (hFile=0x1a4) returned 1 [0035.562] CloseHandle (hObject=0x1a4) returned 1 [0035.563] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.563] SetEndOfFile (hFile=0x168) returned 1 [0035.564] CloseHandle (hObject=0x168) returned 1 [0035.564] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.564] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString=".doc") returned 4 [0035.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString=".docx") returned 5 [0035.565] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.565] lstrlenW (lpString=".pdf") returned 4 [0035.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString=".xls") returned 4 [0035.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString=".xlsx") returned 5 [0035.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.565] lstrlenW (lpString=".ppt") returned 4 [0035.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString=".zip") returned 4 [0035.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.565] lstrlenW (lpString=".rar") returned 4 [0035.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString=".bz2") returned 4 [0035.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString=".7z") returned 3 [0035.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString=".dbf") returned 4 [0035.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString=".1cd") returned 4 [0035.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString=".jpg") returned 4 [0035.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.566] lstrlenW (lpString=".doc") returned 4 [0035.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString=".docx") returned 5 [0035.566] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.566] lstrlenW (lpString=".pdf") returned 4 [0035.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString=".xls") returned 4 [0035.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString=".xlsx") returned 5 [0035.566] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.566] lstrlenW (lpString=".ppt") returned 4 [0035.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.566] lstrlenW (lpString=".zip") returned 4 [0035.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.566] lstrlenW (lpString=".rar") returned 4 [0035.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString=".bz2") returned 4 [0035.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString=".7z") returned 3 [0035.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.566] lstrlenW (lpString=".dbf") returned 4 [0035.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.566] lstrlenW (lpString=".1cd") returned 4 [0035.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.566] lstrlenW (lpString=".jpg") returned 4 [0035.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.567] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.567] lstrlenW (lpString="AccessMUI.xml") returned 13 [0035.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.605] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1349) returned 1 [0035.605] CloseHandle (hObject=0x168) returned 1 [0035.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0035.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.606] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.606] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.642] GetLastError () returned 0x0 [0035.642] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x545, lpOverlapped=0x0) returned 1 [0035.643] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x550, lpOverlapped=0x0) returned 1 [0035.644] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.644] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.644] SetEndOfFile (hFile=0x1a4) returned 1 [0035.644] CloseHandle (hObject=0x1a4) returned 1 [0035.645] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.645] SetEndOfFile (hFile=0x168) returned 1 [0035.646] CloseHandle (hObject=0x168) returned 1 [0035.646] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.646] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0035.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.646] lstrlenW (lpString=".doc") returned 4 [0035.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.646] lstrlenW (lpString=".docx") returned 5 [0035.647] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.647] lstrlenW (lpString=".pdf") returned 4 [0035.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString=".xls") returned 4 [0035.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString=".xlsx") returned 5 [0035.647] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.647] lstrlenW (lpString=".ppt") returned 4 [0035.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString=".zip") returned 4 [0035.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.647] lstrlenW (lpString=".rar") returned 4 [0035.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString=".bz2") returned 4 [0035.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString=".7z") returned 3 [0035.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString=".dbf") returned 4 [0035.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString=".1cd") returned 4 [0035.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString=".jpg") returned 4 [0035.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.647] lstrlenW (lpString=".doc") returned 4 [0035.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.647] lstrlenW (lpString=".docx") returned 5 [0035.647] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.648] lstrlenW (lpString=".pdf") returned 4 [0035.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString=".xls") returned 4 [0035.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString=".xlsx") returned 5 [0035.648] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.648] lstrlenW (lpString=".ppt") returned 4 [0035.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.648] lstrlenW (lpString=".zip") returned 4 [0035.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.648] lstrlenW (lpString=".rar") returned 4 [0035.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString=".bz2") returned 4 [0035.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString=".7z") returned 3 [0035.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.648] lstrlenW (lpString=".dbf") returned 4 [0035.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.648] lstrlenW (lpString=".1cd") returned 4 [0035.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.648] lstrlenW (lpString=".jpg") returned 4 [0035.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.648] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.648] lstrlenW (lpString="Setup.xml") returned 9 [0035.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.649] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2624) returned 1 [0035.649] CloseHandle (hObject=0x168) returned 1 [0035.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.649] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.649] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.656] GetLastError () returned 0x0 [0035.656] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa40, lpOverlapped=0x0) returned 1 [0035.659] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0035.660] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.660] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.660] SetEndOfFile (hFile=0x1a4) returned 1 [0035.660] CloseHandle (hObject=0x1a4) returned 1 [0035.661] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.661] SetEndOfFile (hFile=0x168) returned 1 [0035.662] CloseHandle (hObject=0x168) returned 1 [0035.662] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0035.662] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.662] lstrlenW (lpString=".doc") returned 4 [0035.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString=".docx") returned 5 [0035.663] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.663] lstrlenW (lpString=".pdf") returned 4 [0035.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".xls") returned 4 [0035.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".xlsx") returned 5 [0035.663] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.663] lstrlenW (lpString=".ppt") returned 4 [0035.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString=".zip") returned 4 [0035.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.663] lstrlenW (lpString=".rar") returned 4 [0035.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".bz2") returned 4 [0035.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".7z") returned 3 [0035.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString=".dbf") returned 4 [0035.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString=".1cd") returned 4 [0035.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString=".jpg") returned 4 [0035.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.663] lstrlenW (lpString=".doc") returned 4 [0035.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".docx") returned 5 [0035.663] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.664] lstrlenW (lpString=".pdf") returned 4 [0035.664] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString=".xls") returned 4 [0035.664] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString=".xlsx") returned 5 [0035.664] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.664] lstrlenW (lpString=".ppt") returned 4 [0035.664] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.664] lstrlenW (lpString=".zip") returned 4 [0035.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.664] lstrlenW (lpString=".rar") returned 4 [0035.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString=".bz2") returned 4 [0035.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString=".7z") returned 3 [0035.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.664] lstrlenW (lpString=".dbf") returned 4 [0035.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.664] lstrlenW (lpString=".1cd") returned 4 [0035.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.664] lstrlenW (lpString=".jpg") returned 4 [0035.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.664] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0035.664] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.666] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4274) returned 1 [0035.666] CloseHandle (hObject=0x168) returned 1 [0035.666] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.666] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0035.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0035.666] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.666] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.667] GetLastError () returned 0x0 [0035.667] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0036.155] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0036.156] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.156] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.156] SetEndOfFile (hFile=0x1a4) returned 1 [0036.157] CloseHandle (hObject=0x1a4) returned 1 [0036.157] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.157] SetEndOfFile (hFile=0x168) returned 1 [0036.165] CloseHandle (hObject=0x168) returned 1 [0036.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0036.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.617] lstrlenW (lpString=".doc") returned 4 [0036.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.617] lstrlenW (lpString=".docx") returned 5 [0036.618] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.627] lstrlenW (lpString=".pdf") returned 4 [0036.627] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.627] lstrlenW (lpString=".xls") returned 4 [0036.627] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.627] lstrlenW (lpString=".xlsx") returned 5 [0036.627] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.627] lstrlenW (lpString=".ppt") returned 4 [0036.628] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.637] lstrlenW (lpString=".zip") returned 4 [0036.637] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.637] lstrlenW (lpString=".rar") returned 4 [0036.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString=".bz2") returned 4 [0036.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString=".7z") returned 3 [0036.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString=".dbf") returned 4 [0036.651] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString=".1cd") returned 4 [0036.651] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString=".jpg") returned 4 [0036.651] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString=".doc") returned 4 [0036.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString=".docx") returned 5 [0036.651] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.651] lstrlenW (lpString=".pdf") returned 4 [0036.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString=".xls") returned 4 [0036.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString=".xlsx") returned 5 [0036.651] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.651] lstrlenW (lpString=".ppt") returned 4 [0036.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.651] lstrlenW (lpString=".zip") returned 4 [0036.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.652] lstrlenW (lpString=".rar") returned 4 [0036.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.652] lstrlenW (lpString=".bz2") returned 4 [0036.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.652] lstrlenW (lpString=".7z") returned 3 [0036.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.652] lstrlenW (lpString=".dbf") returned 4 [0036.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.652] lstrlenW (lpString=".1cd") returned 4 [0036.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0036.652] lstrlenW (lpString=".jpg") returned 4 [0036.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.652] lstrcmpiW (lpString1=".avi", lpString2=".zoh") returned -1 [0036.652] lstrlenW (lpString="boxed-delete.avi") returned 16 [0036.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0037.688] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31744) returned 1 [0037.688] CloseHandle (hObject=0x188) returned 1 [0037.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0037.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.689] lstrlenW (lpString=".doc") returned 4 [0037.689] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".docx") returned 5 [0037.689] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.689] lstrlenW (lpString=".pdf") returned 4 [0037.689] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".xls") returned 4 [0037.689] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".xlsx") returned 5 [0037.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.689] lstrlenW (lpString=".ppt") returned 4 [0037.689] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.689] lstrlenW (lpString=".zip") returned 4 [0037.689] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".rar") returned 4 [0037.689] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".bz2") returned 4 [0037.689] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.689] lstrlenW (lpString=".7z") returned 3 [0037.689] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.689] lstrlenW (lpString=".dbf") returned 4 [0037.690] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString=".1cd") returned 4 [0037.690] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString=".jpg") returned 4 [0037.690] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString=".doc") returned 4 [0037.690] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".docx") returned 5 [0037.690] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.690] lstrlenW (lpString=".pdf") returned 4 [0037.690] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".xls") returned 4 [0037.690] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".xlsx") returned 5 [0037.690] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.690] lstrlenW (lpString=".ppt") returned 4 [0037.690] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString=".zip") returned 4 [0037.690] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".rar") returned 4 [0037.690] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".bz2") returned 4 [0037.690] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.690] lstrlenW (lpString=".7z") returned 3 [0037.690] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.690] lstrlenW (lpString=".dbf") returned 4 [0037.690] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.691] lstrlenW (lpString=".1cd") returned 4 [0037.691] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.691] lstrlenW (lpString=".jpg") returned 4 [0037.691] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.691] lstrcmpiW (lpString1=".xml", lpString2=".zoh") returned -1 [0037.691] lstrlenW (lpString="symbols.xml") returned 11 [0037.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0038.119] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=591) returned 1 [0038.119] CloseHandle (hObject=0x16c) returned 1 [0038.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0038.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0038.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.120] lstrlenW (lpString=".doc") returned 4 [0038.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString=".docx") returned 5 [0038.120] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0038.120] lstrlenW (lpString=".pdf") returned 4 [0038.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString=".xls") returned 4 [0038.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString=".xlsx") returned 5 [0038.120] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0038.120] lstrlenW (lpString=".ppt") returned 4 [0038.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.120] lstrlenW (lpString=".zip") returned 4 [0038.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.120] lstrlenW (lpString=".rar") returned 4 [0038.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString=".bz2") returned 4 [0038.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.120] lstrlenW (lpString=".7z") returned 3 [0038.120] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString=".dbf") returned 4 [0038.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString=".1cd") returned 4 [0038.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString=".jpg") returned 4 [0038.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString=".doc") returned 4 [0038.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".docx") returned 5 [0038.121] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0038.121] lstrlenW (lpString=".pdf") returned 4 [0038.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".xls") returned 4 [0038.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".xlsx") returned 5 [0038.121] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0038.121] lstrlenW (lpString=".ppt") returned 4 [0038.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.121] lstrlenW (lpString=".zip") returned 4 [0038.121] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.121] lstrlenW (lpString=".rar") returned 4 [0038.121] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".bz2") returned 4 [0038.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString=".7z") returned 3 [0038.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.122] lstrlenW (lpString=".dbf") returned 4 [0038.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.122] lstrlenW (lpString=".1cd") returned 4 [0038.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0038.122] lstrlenW (lpString=".jpg") returned 4 [0038.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.122] lstrcmpiW (lpString1=".dat", lpString2=".zoh") returned -1 [0038.122] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0038.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.948] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1100368) returned 1 [0039.948] CloseHandle (hObject=0x1c8) returned 1 [0039.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0039.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.948] lstrlenW (lpString=".doc") returned 4 [0039.948] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.948] lstrlenW (lpString=".docx") returned 5 [0039.948] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0039.948] lstrlenW (lpString=".pdf") returned 4 [0039.948] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.948] lstrlenW (lpString=".xls") returned 4 [0039.948] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.948] lstrlenW (lpString=".xlsx") returned 5 [0039.948] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0039.948] lstrlenW (lpString=".ppt") returned 4 [0039.948] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.948] lstrlenW (lpString=".zip") returned 4 [0039.948] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString=".rar") returned 4 [0039.949] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString=".bz2") returned 4 [0039.949] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.949] lstrlenW (lpString=".7z") returned 3 [0039.949] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString=".dbf") returned 4 [0039.949] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString=".1cd") returned 4 [0039.949] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString=".jpg") returned 4 [0039.949] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString=".doc") returned 4 [0039.949] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString=".docx") returned 5 [0039.949] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0039.949] lstrlenW (lpString=".pdf") returned 4 [0039.949] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString=".xls") returned 4 [0039.949] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString=".xlsx") returned 5 [0039.949] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0039.949] lstrlenW (lpString=".ppt") returned 4 [0039.949] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0039.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.949] lstrlenW (lpString=".zip") returned 4 [0039.949] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0039.950] lstrlenW (lpString=".rar") returned 4 [0039.950] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0039.950] lstrlenW (lpString=".bz2") returned 4 [0039.950] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0039.950] lstrlenW (lpString=".7z") returned 3 [0039.950] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0039.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.950] lstrlenW (lpString=".dbf") returned 4 [0039.950] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0039.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.950] lstrlenW (lpString=".1cd") returned 4 [0039.950] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0039.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0039.950] lstrlenW (lpString=".jpg") returned 4 [0039.950] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0039.950] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0039.950] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0039.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.950] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1231) returned 1 [0039.950] CloseHandle (hObject=0x1c8) returned 1 [0039.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0039.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0039.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.951] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.951] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.556] GetLastError () returned 0x0 [0040.556] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0040.567] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0040.568] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.568] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.569] SetEndOfFile (hFile=0x1c0) returned 1 [0040.570] CloseHandle (hObject=0x1c0) returned 1 [0040.570] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.571] SetEndOfFile (hFile=0x1c8) returned 1 [0040.572] CloseHandle (hObject=0x1c8) returned 1 [0040.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.572] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0040.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.572] lstrlenW (lpString=".doc") returned 4 [0040.572] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.572] lstrlenW (lpString=".docx") returned 5 [0040.572] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.572] lstrlenW (lpString=".pdf") returned 4 [0040.572] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.572] lstrlenW (lpString=".xls") returned 4 [0040.572] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.572] lstrlenW (lpString=".xlsx") returned 5 [0040.572] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.572] lstrlenW (lpString=".ppt") returned 4 [0040.572] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString=".zip") returned 4 [0040.573] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.573] lstrlenW (lpString=".rar") returned 4 [0040.573] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString=".bz2") returned 4 [0040.573] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString=".7z") returned 3 [0040.573] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString=".dbf") returned 4 [0040.573] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString=".1cd") returned 4 [0040.573] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString=".jpg") returned 4 [0040.573] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.573] lstrlenW (lpString=".doc") returned 4 [0040.573] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString=".docx") returned 5 [0040.573] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.573] lstrlenW (lpString=".pdf") returned 4 [0040.573] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString=".xls") returned 4 [0040.573] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.573] lstrlenW (lpString=".xlsx") returned 5 [0040.573] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.573] lstrlenW (lpString=".ppt") returned 4 [0040.574] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.574] lstrlenW (lpString=".zip") returned 4 [0040.574] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.574] lstrlenW (lpString=".rar") returned 4 [0040.574] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.574] lstrlenW (lpString=".bz2") returned 4 [0040.574] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.574] lstrlenW (lpString=".7z") returned 3 [0040.574] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.574] lstrlenW (lpString=".dbf") returned 4 [0040.574] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.574] lstrlenW (lpString=".1cd") returned 4 [0040.574] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.574] lstrlenW (lpString=".jpg") returned 4 [0040.574] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.574] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.574] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0040.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.578] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5557) returned 1 [0040.578] CloseHandle (hObject=0x1f0) returned 1 [0040.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0040.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.578] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.578] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.579] GetLastError () returned 0x0 [0040.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0040.580] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0040.581] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.581] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.581] SetEndOfFile (hFile=0x1f4) returned 1 [0040.582] CloseHandle (hObject=0x1f4) returned 1 [0040.582] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.582] SetEndOfFile (hFile=0x1f0) returned 1 [0040.583] CloseHandle (hObject=0x1f0) returned 1 [0040.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString=".doc") returned 4 [0040.584] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString=".docx") returned 5 [0040.584] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.584] lstrlenW (lpString=".pdf") returned 4 [0040.584] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString=".xls") returned 4 [0040.584] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString=".xlsx") returned 5 [0040.584] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.584] lstrlenW (lpString=".ppt") returned 4 [0040.584] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString=".zip") returned 4 [0040.584] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.584] lstrlenW (lpString=".rar") returned 4 [0040.584] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString=".bz2") returned 4 [0040.584] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString=".7z") returned 3 [0040.584] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString=".dbf") returned 4 [0040.584] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString=".1cd") returned 4 [0040.584] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.584] lstrlenW (lpString=".jpg") returned 4 [0040.585] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.585] lstrlenW (lpString=".doc") returned 4 [0040.585] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString=".docx") returned 5 [0040.585] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.585] lstrlenW (lpString=".pdf") returned 4 [0040.585] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString=".xls") returned 4 [0040.585] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString=".xlsx") returned 5 [0040.585] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.585] lstrlenW (lpString=".ppt") returned 4 [0040.585] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.585] lstrlenW (lpString=".zip") returned 4 [0040.585] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.585] lstrlenW (lpString=".rar") returned 4 [0040.585] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString=".bz2") returned 4 [0040.585] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString=".7z") returned 3 [0040.585] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.585] lstrlenW (lpString=".dbf") returned 4 [0040.585] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.585] lstrlenW (lpString=".1cd") returned 4 [0040.585] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0040.586] lstrlenW (lpString=".jpg") returned 4 [0040.586] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.586] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0040.586] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0040.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.586] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=819) returned 1 [0040.586] CloseHandle (hObject=0x1f0) returned 1 [0040.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0040.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.586] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.586] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.587] GetLastError () returned 0x0 [0040.587] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x333, lpOverlapped=0x0) returned 1 [0040.588] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x340, lpOverlapped=0x0) returned 1 [0040.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.589] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.589] SetEndOfFile (hFile=0x1f4) returned 1 [0040.589] CloseHandle (hObject=0x1f4) returned 1 [0040.590] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.590] SetEndOfFile (hFile=0x1f0) returned 1 [0040.591] CloseHandle (hObject=0x1f0) returned 1 [0040.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0040.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.591] lstrlenW (lpString=".doc") returned 4 [0040.591] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.591] lstrlenW (lpString=".docx") returned 5 [0040.592] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.592] lstrlenW (lpString=".pdf") returned 4 [0040.592] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString=".xls") returned 4 [0040.592] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString=".xlsx") returned 5 [0040.592] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.592] lstrlenW (lpString=".ppt") returned 4 [0040.592] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString=".zip") returned 4 [0040.592] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.592] lstrlenW (lpString=".rar") returned 4 [0040.592] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString=".bz2") returned 4 [0040.592] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString=".7z") returned 3 [0040.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString=".dbf") returned 4 [0040.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString=".1cd") returned 4 [0040.592] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString=".jpg") returned 4 [0040.592] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.592] lstrlenW (lpString=".doc") returned 4 [0040.592] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString=".docx") returned 5 [0040.593] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.593] lstrlenW (lpString=".pdf") returned 4 [0040.593] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString=".xls") returned 4 [0040.593] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString=".xlsx") returned 5 [0040.593] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.593] lstrlenW (lpString=".ppt") returned 4 [0040.593] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.593] lstrlenW (lpString=".zip") returned 4 [0040.593] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.593] lstrlenW (lpString=".rar") returned 4 [0040.593] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString=".bz2") returned 4 [0040.593] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString=".7z") returned 3 [0040.593] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.593] lstrlenW (lpString=".dbf") returned 4 [0040.593] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.593] lstrlenW (lpString=".1cd") returned 4 [0040.593] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.593] lstrlenW (lpString=".jpg") returned 4 [0040.593] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.594] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0040.594] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0040.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.594] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=37689) returned 1 [0040.594] CloseHandle (hObject=0x1f0) returned 1 [0040.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0040.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.595] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.595] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.595] GetLastError () returned 0x0 [0040.595] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9339, lpOverlapped=0x0) returned 1 [0040.598] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0040.599] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.599] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.599] SetEndOfFile (hFile=0x1f4) returned 1 [0040.599] CloseHandle (hObject=0x1f4) returned 1 [0040.600] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.600] SetEndOfFile (hFile=0x1f0) returned 1 [0040.601] CloseHandle (hObject=0x1f0) returned 1 [0040.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0040.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0040.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.684] lstrlenW (lpString=".doc") returned 4 [0040.684] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.684] lstrlenW (lpString=".docx") returned 5 [0040.684] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0040.684] lstrlenW (lpString=".pdf") returned 4 [0040.684] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.684] lstrlenW (lpString=".xls") returned 4 [0040.684] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString=".xlsx") returned 5 [0040.685] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0040.685] lstrlenW (lpString=".ppt") returned 4 [0040.685] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString=".zip") returned 4 [0040.685] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString=".rar") returned 4 [0040.685] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString=".bz2") returned 4 [0040.685] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.685] lstrlenW (lpString=".7z") returned 3 [0040.685] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString=".dbf") returned 4 [0040.685] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString=".1cd") returned 4 [0040.685] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString=".jpg") returned 4 [0040.685] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.685] lstrlenW (lpString=".doc") returned 4 [0040.685] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString=".docx") returned 5 [0040.685] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0040.685] lstrlenW (lpString=".pdf") returned 4 [0040.685] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.685] lstrlenW (lpString=".xls") returned 4 [0040.685] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.686] lstrlenW (lpString=".xlsx") returned 5 [0040.686] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0040.686] lstrlenW (lpString=".ppt") returned 4 [0040.686] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.686] lstrlenW (lpString=".zip") returned 4 [0040.686] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.686] lstrlenW (lpString=".rar") returned 4 [0040.686] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.686] lstrlenW (lpString=".bz2") returned 4 [0040.686] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.686] lstrlenW (lpString=".7z") returned 3 [0040.686] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.686] lstrlenW (lpString=".dbf") returned 4 [0040.686] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.686] lstrlenW (lpString=".1cd") returned 4 [0040.686] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.686] lstrlenW (lpString=".jpg") returned 4 [0040.686] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.686] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0040.686] lstrlenW (lpString="PSS10O.CHM") returned 10 [0040.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.687] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=26929) returned 1 [0040.687] CloseHandle (hObject=0x1f0) returned 1 [0040.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0040.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0040.687] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.687] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.687] GetLastError () returned 0x0 [0040.687] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6931, lpOverlapped=0x0) returned 1 [0041.039] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0041.372] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.373] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.373] SetEndOfFile (hFile=0x1e8) returned 1 [0041.373] CloseHandle (hObject=0x1e8) returned 1 [0041.374] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.374] SetEndOfFile (hFile=0x1f0) returned 1 [0041.375] CloseHandle (hObject=0x1f0) returned 1 [0041.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.375] lstrlenW (lpString=".doc") returned 4 [0041.375] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.375] lstrlenW (lpString=".docx") returned 5 [0041.375] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0041.375] lstrlenW (lpString=".pdf") returned 4 [0041.375] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.375] lstrlenW (lpString=".xls") returned 4 [0041.376] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString=".xlsx") returned 5 [0041.376] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0041.376] lstrlenW (lpString=".ppt") returned 4 [0041.376] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString=".zip") returned 4 [0041.376] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString=".rar") returned 4 [0041.376] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString=".bz2") returned 4 [0041.376] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.376] lstrlenW (lpString=".7z") returned 3 [0041.376] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString=".dbf") returned 4 [0041.376] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString=".1cd") returned 4 [0041.376] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString=".jpg") returned 4 [0041.376] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.376] lstrlenW (lpString=".doc") returned 4 [0041.376] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString=".docx") returned 5 [0041.376] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0041.376] lstrlenW (lpString=".pdf") returned 4 [0041.376] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.376] lstrlenW (lpString=".xls") returned 4 [0041.376] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.377] lstrlenW (lpString=".xlsx") returned 5 [0041.377] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0041.377] lstrlenW (lpString=".ppt") returned 4 [0041.377] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.377] lstrlenW (lpString=".zip") returned 4 [0041.377] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.377] lstrlenW (lpString=".rar") returned 4 [0041.377] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.377] lstrlenW (lpString=".bz2") returned 4 [0041.377] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.377] lstrlenW (lpString=".7z") returned 3 [0041.377] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.377] lstrlenW (lpString=".dbf") returned 4 [0041.377] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.377] lstrlenW (lpString=".1cd") returned 4 [0041.377] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0041.377] lstrlenW (lpString=".jpg") returned 4 [0041.377] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.377] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.377] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0041.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.378] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1450) returned 1 [0041.378] CloseHandle (hObject=0x1f0) returned 1 [0041.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0041.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.378] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.378] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.910] GetLastError () returned 0x0 [0041.910] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0041.911] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0041.912] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.913] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0041.913] SetEndOfFile (hFile=0x1f4) returned 1 [0041.913] CloseHandle (hObject=0x1f4) returned 1 [0041.914] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.914] SetEndOfFile (hFile=0x1f0) returned 1 [0041.914] CloseHandle (hObject=0x1f0) returned 1 [0041.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0041.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.915] lstrlenW (lpString=".doc") returned 4 [0041.915] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString=".docx") returned 5 [0041.915] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.915] lstrlenW (lpString=".pdf") returned 4 [0041.915] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString=".xls") returned 4 [0041.915] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString=".xlsx") returned 5 [0041.915] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.915] lstrlenW (lpString=".ppt") returned 4 [0041.915] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.915] lstrlenW (lpString=".zip") returned 4 [0041.915] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.915] lstrlenW (lpString=".rar") returned 4 [0041.915] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString=".bz2") returned 4 [0041.915] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.915] lstrlenW (lpString=".7z") returned 3 [0041.915] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".dbf") returned 4 [0041.916] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".1cd") returned 4 [0041.916] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".jpg") returned 4 [0041.916] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".doc") returned 4 [0041.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString=".docx") returned 5 [0041.916] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.916] lstrlenW (lpString=".pdf") returned 4 [0041.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString=".xls") returned 4 [0041.916] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString=".xlsx") returned 5 [0041.916] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.916] lstrlenW (lpString=".ppt") returned 4 [0041.916] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".zip") returned 4 [0041.916] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.916] lstrlenW (lpString=".rar") returned 4 [0041.916] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString=".bz2") returned 4 [0041.916] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.916] lstrlenW (lpString=".7z") returned 3 [0041.916] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.916] lstrlenW (lpString=".dbf") returned 4 [0041.917] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.917] lstrlenW (lpString=".1cd") returned 4 [0041.917] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.917] lstrlenW (lpString=".jpg") returned 4 [0041.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.917] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.917] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0041.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.918] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6421) returned 1 [0041.918] CloseHandle (hObject=0x1f0) returned 1 [0041.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0041.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.918] GetLastError () returned 0x0 [0041.919] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1915, lpOverlapped=0x0) returned 1 [0041.920] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0041.921] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.921] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.921] SetEndOfFile (hFile=0x1f4) returned 1 [0041.921] CloseHandle (hObject=0x1f4) returned 1 [0041.922] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.922] SetEndOfFile (hFile=0x1f0) returned 1 [0041.923] CloseHandle (hObject=0x1f0) returned 1 [0041.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.923] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0041.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.923] lstrlenW (lpString=".doc") returned 4 [0041.923] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.923] lstrlenW (lpString=".docx") returned 5 [0041.923] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.923] lstrlenW (lpString=".pdf") returned 4 [0041.924] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".xls") returned 4 [0041.924] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".xlsx") returned 5 [0041.924] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.924] lstrlenW (lpString=".ppt") returned 4 [0041.924] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString=".zip") returned 4 [0041.924] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.924] lstrlenW (lpString=".rar") returned 4 [0041.924] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".bz2") returned 4 [0041.924] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".7z") returned 3 [0041.924] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString=".dbf") returned 4 [0041.924] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString=".1cd") returned 4 [0041.924] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString=".jpg") returned 4 [0041.924] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.924] lstrlenW (lpString=".doc") returned 4 [0041.924] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".docx") returned 5 [0041.924] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.924] lstrlenW (lpString=".pdf") returned 4 [0041.924] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.924] lstrlenW (lpString=".xls") returned 4 [0041.925] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString=".xlsx") returned 5 [0041.925] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.925] lstrlenW (lpString=".ppt") returned 4 [0041.925] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.925] lstrlenW (lpString=".zip") returned 4 [0041.925] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.925] lstrlenW (lpString=".rar") returned 4 [0041.925] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString=".bz2") returned 4 [0041.925] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString=".7z") returned 3 [0041.925] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.925] lstrlenW (lpString=".dbf") returned 4 [0041.925] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.925] lstrlenW (lpString=".1cd") returned 4 [0041.925] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.925] lstrlenW (lpString=".jpg") returned 4 [0041.925] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.925] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.925] lstrlenW (lpString="SETUP.XML") returned 9 [0041.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.926] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16683) returned 1 [0041.926] CloseHandle (hObject=0x1f0) returned 1 [0041.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0041.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.926] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.927] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.929] GetLastError () returned 0x0 [0041.929] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x412b, lpOverlapped=0x0) returned 1 [0041.930] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0041.931] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.931] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.932] SetEndOfFile (hFile=0x1c4) returned 1 [0041.932] CloseHandle (hObject=0x1c4) returned 1 [0041.932] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.932] SetEndOfFile (hFile=0x1f0) returned 1 [0041.933] CloseHandle (hObject=0x1f0) returned 1 [0041.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0041.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.934] lstrlenW (lpString=".doc") returned 4 [0041.934] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString=".docx") returned 5 [0041.934] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.934] lstrlenW (lpString=".pdf") returned 4 [0041.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString=".xls") returned 4 [0041.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString=".xlsx") returned 5 [0041.934] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.934] lstrlenW (lpString=".ppt") returned 4 [0041.934] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.934] lstrlenW (lpString=".zip") returned 4 [0041.934] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.934] lstrlenW (lpString=".rar") returned 4 [0041.934] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString=".bz2") returned 4 [0041.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.934] lstrlenW (lpString=".7z") returned 3 [0041.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.934] lstrlenW (lpString=".dbf") returned 4 [0041.935] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString=".1cd") returned 4 [0041.935] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString=".jpg") returned 4 [0041.935] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString=".doc") returned 4 [0041.935] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString=".docx") returned 5 [0041.935] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.935] lstrlenW (lpString=".pdf") returned 4 [0041.935] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString=".xls") returned 4 [0041.935] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString=".xlsx") returned 5 [0041.935] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.935] lstrlenW (lpString=".ppt") returned 4 [0041.935] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString=".zip") returned 4 [0041.935] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.935] lstrlenW (lpString=".rar") returned 4 [0041.935] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString=".bz2") returned 4 [0041.935] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.935] lstrlenW (lpString=".7z") returned 3 [0041.935] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.935] lstrlenW (lpString=".dbf") returned 4 [0041.935] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.936] lstrlenW (lpString=".1cd") returned 4 [0041.936] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.936] lstrlenW (lpString=".jpg") returned 4 [0041.936] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.936] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.936] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0041.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.936] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1452) returned 1 [0041.936] CloseHandle (hObject=0x1f0) returned 1 [0041.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0041.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.937] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.937] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.938] GetLastError () returned 0x0 [0041.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0041.940] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0041.941] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.941] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.941] SetEndOfFile (hFile=0x1c4) returned 1 [0041.941] CloseHandle (hObject=0x1c4) returned 1 [0041.941] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.942] SetEndOfFile (hFile=0x1f0) returned 1 [0041.942] CloseHandle (hObject=0x1f0) returned 1 [0041.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0041.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0041.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.943] lstrlenW (lpString=".doc") returned 4 [0041.943] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.943] lstrlenW (lpString=".docx") returned 5 [0041.943] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.943] lstrlenW (lpString=".pdf") returned 4 [0041.943] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.943] lstrlenW (lpString=".xls") returned 4 [0041.943] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.943] lstrlenW (lpString=".xlsx") returned 5 [0041.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.943] lstrlenW (lpString=".ppt") returned 4 [0041.943] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.943] lstrlenW (lpString=".zip") returned 4 [0041.943] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.943] lstrlenW (lpString=".rar") returned 4 [0041.943] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.943] lstrlenW (lpString=".bz2") returned 4 [0041.943] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString=".7z") returned 3 [0041.944] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString=".dbf") returned 4 [0041.944] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString=".1cd") returned 4 [0041.944] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString=".jpg") returned 4 [0041.944] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString=".doc") returned 4 [0041.944] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString=".docx") returned 5 [0041.944] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.944] lstrlenW (lpString=".pdf") returned 4 [0041.944] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString=".xls") returned 4 [0041.944] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString=".xlsx") returned 5 [0041.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.944] lstrlenW (lpString=".ppt") returned 4 [0041.944] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.944] lstrlenW (lpString=".zip") returned 4 [0041.944] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.944] lstrlenW (lpString=".rar") returned 4 [0041.944] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.944] lstrlenW (lpString=".bz2") returned 4 [0041.945] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.945] lstrlenW (lpString=".7z") returned 3 [0041.945] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.945] lstrlenW (lpString=".dbf") returned 4 [0041.945] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.945] lstrlenW (lpString=".1cd") returned 4 [0041.945] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.945] lstrlenW (lpString=".jpg") returned 4 [0041.945] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.945] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0041.945] lstrlenW (lpString="SETUP.XML") returned 9 [0041.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.945] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1872) returned 1 [0041.945] CloseHandle (hObject=0x1f0) returned 1 [0041.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0041.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0041.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.946] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.946] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.946] GetLastError () returned 0x0 [0041.946] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x750, lpOverlapped=0x0) returned 1 [0042.227] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x760, lpOverlapped=0x0) returned 1 [0042.228] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.228] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.228] SetEndOfFile (hFile=0x1c4) returned 1 [0042.228] CloseHandle (hObject=0x1c4) returned 1 [0042.229] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.229] SetEndOfFile (hFile=0x1f0) returned 1 [0042.230] CloseHandle (hObject=0x1f0) returned 1 [0042.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.230] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0042.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.230] lstrlenW (lpString=".doc") returned 4 [0042.230] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.230] lstrlenW (lpString=".docx") returned 5 [0042.230] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.230] lstrlenW (lpString=".pdf") returned 4 [0042.230] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.230] lstrlenW (lpString=".xls") returned 4 [0042.230] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.230] lstrlenW (lpString=".xlsx") returned 5 [0042.230] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.230] lstrlenW (lpString=".ppt") returned 4 [0042.230] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.230] lstrlenW (lpString=".zip") returned 4 [0042.230] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.231] lstrlenW (lpString=".rar") returned 4 [0042.231] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString=".bz2") returned 4 [0042.231] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString=".7z") returned 3 [0042.231] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString=".dbf") returned 4 [0042.231] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString=".1cd") returned 4 [0042.231] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString=".jpg") returned 4 [0042.231] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString=".doc") returned 4 [0042.231] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString=".docx") returned 5 [0042.231] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.231] lstrlenW (lpString=".pdf") returned 4 [0042.231] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString=".xls") returned 4 [0042.231] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString=".xlsx") returned 5 [0042.231] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.231] lstrlenW (lpString=".ppt") returned 4 [0042.231] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.231] lstrlenW (lpString=".zip") returned 4 [0042.231] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.231] lstrlenW (lpString=".rar") returned 4 [0042.232] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.232] lstrlenW (lpString=".bz2") returned 4 [0042.232] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.232] lstrlenW (lpString=".7z") returned 3 [0042.232] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.232] lstrlenW (lpString=".dbf") returned 4 [0042.232] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.232] lstrlenW (lpString=".1cd") returned 4 [0042.232] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.232] lstrlenW (lpString=".jpg") returned 4 [0042.232] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.232] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.232] lstrlenW (lpString="SETUP.XML") returned 9 [0042.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.277] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31094) returned 1 [0042.277] CloseHandle (hObject=0x1f0) returned 1 [0042.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0042.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0042.277] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.277] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0042.278] GetLastError () returned 0x0 [0042.278] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7976, lpOverlapped=0x0) returned 1 [0042.280] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0042.282] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.282] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.282] SetEndOfFile (hFile=0x1c8) returned 1 [0042.282] CloseHandle (hObject=0x1c8) returned 1 [0042.283] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.283] SetEndOfFile (hFile=0x1f0) returned 1 [0042.284] CloseHandle (hObject=0x1f0) returned 1 [0042.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0042.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.285] lstrlenW (lpString=".doc") returned 4 [0042.285] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.285] lstrlenW (lpString=".docx") returned 5 [0042.285] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.285] lstrlenW (lpString=".pdf") returned 4 [0042.285] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.285] lstrlenW (lpString=".xls") returned 4 [0042.285] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.285] lstrlenW (lpString=".xlsx") returned 5 [0042.285] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.285] lstrlenW (lpString=".ppt") returned 4 [0042.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.285] lstrlenW (lpString=".zip") returned 4 [0042.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.285] lstrlenW (lpString=".rar") returned 4 [0042.285] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.285] lstrlenW (lpString=".bz2") returned 4 [0042.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString=".7z") returned 3 [0042.286] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString=".dbf") returned 4 [0042.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString=".1cd") returned 4 [0042.286] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString=".jpg") returned 4 [0042.286] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString=".doc") returned 4 [0042.286] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString=".docx") returned 5 [0042.286] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.286] lstrlenW (lpString=".pdf") returned 4 [0042.286] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString=".xls") returned 4 [0042.286] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString=".xlsx") returned 5 [0042.286] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.286] lstrlenW (lpString=".ppt") returned 4 [0042.286] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.286] lstrlenW (lpString=".zip") returned 4 [0042.286] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.286] lstrlenW (lpString=".rar") returned 4 [0042.286] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.286] lstrlenW (lpString=".bz2") returned 4 [0042.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.287] lstrlenW (lpString=".7z") returned 3 [0042.287] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.287] lstrlenW (lpString=".dbf") returned 4 [0042.287] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.287] lstrlenW (lpString=".1cd") returned 4 [0042.287] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0042.287] lstrlenW (lpString=".jpg") returned 4 [0042.287] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.287] lstrcmpiW (lpString1=".XML", lpString2=".zoh") returned -1 [0042.287] lstrlenW (lpString="VisioMUI.XML") returned 12 [0042.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.804] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9503) returned 1 [0042.804] CloseHandle (hObject=0x188) returned 1 [0042.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0042.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.805] GetLastError () returned 0x0 [0042.805] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x251f, lpOverlapped=0x0) returned 1 [0042.807] WriteFile (in: hFile=0x200, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0042.808] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.808] WriteFile (in: hFile=0x200, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.808] SetEndOfFile (hFile=0x200) returned 1 [0042.808] CloseHandle (hObject=0x200) returned 1 [0042.809] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.809] SetEndOfFile (hFile=0x188) returned 1 [0042.809] CloseHandle (hObject=0x188) returned 1 [0042.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0042.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0042.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.812] lstrlenW (lpString=".doc") returned 4 [0042.812] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.812] lstrlenW (lpString=".docx") returned 5 [0042.812] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.812] lstrlenW (lpString=".pdf") returned 4 [0042.812] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.812] lstrlenW (lpString=".xls") returned 4 [0042.812] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".xlsx") returned 5 [0042.813] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.813] lstrlenW (lpString=".ppt") returned 4 [0042.813] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString=".zip") returned 4 [0042.813] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.813] lstrlenW (lpString=".rar") returned 4 [0042.813] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".bz2") returned 4 [0042.813] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".7z") returned 3 [0042.813] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString=".dbf") returned 4 [0042.813] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString=".1cd") returned 4 [0042.813] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString=".jpg") returned 4 [0042.813] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.813] lstrlenW (lpString=".doc") returned 4 [0042.813] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".docx") returned 5 [0042.813] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.813] lstrlenW (lpString=".pdf") returned 4 [0042.813] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".xls") returned 4 [0042.813] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.813] lstrlenW (lpString=".xlsx") returned 5 [0042.814] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.814] lstrlenW (lpString=".ppt") returned 4 [0042.814] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.814] lstrlenW (lpString=".zip") returned 4 [0042.814] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.814] lstrlenW (lpString=".rar") returned 4 [0042.814] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".bz2") returned 4 [0042.814] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".7z") returned 3 [0042.814] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.814] lstrlenW (lpString=".dbf") returned 4 [0042.814] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.814] lstrlenW (lpString=".1cd") returned 4 [0042.814] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.814] lstrlenW (lpString=".jpg") returned 4 [0042.814] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.814] lstrcmpiW (lpString1=".TXT", lpString2=".zoh") returned -1 [0042.814] lstrlenW (lpString="METCONV.TXT") returned 11 [0042.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.815] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1183416) returned 1 [0042.815] CloseHandle (hObject=0x188) returned 1 [0042.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0042.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0042.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.815] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.816] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.816] GetLastError () returned 0x0 [0042.816] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0042.840] WriteFile (in: hFile=0x200, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0043.159] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0043.168] WriteFile (in: hFile=0x200, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0043.174] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.174] WriteFile (in: hFile=0x200, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.174] SetEndOfFile (hFile=0x200) returned 1 [0043.174] CloseHandle (hObject=0x200) returned 1 [0043.187] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.187] SetEndOfFile (hFile=0x188) returned 1 [0043.189] CloseHandle (hObject=0x188) returned 1 [0043.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0043.189] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0043.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".doc") returned 4 [0043.190] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString=".docx") returned 5 [0043.190] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.190] lstrlenW (lpString=".pdf") returned 4 [0043.190] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString=".xls") returned 4 [0043.190] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.190] lstrlenW (lpString=".xlsx") returned 5 [0043.190] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.190] lstrlenW (lpString=".ppt") returned 4 [0043.190] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".zip") returned 4 [0043.190] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.190] lstrlenW (lpString=".rar") returned 4 [0043.190] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString=".bz2") returned 4 [0043.190] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString=".7z") returned 3 [0043.190] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".dbf") returned 4 [0043.190] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".1cd") returned 4 [0043.190] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".jpg") returned 4 [0043.190] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.190] lstrlenW (lpString=".doc") returned 4 [0043.191] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString=".docx") returned 5 [0043.191] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.191] lstrlenW (lpString=".pdf") returned 4 [0043.191] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString=".xls") returned 4 [0043.191] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.191] lstrlenW (lpString=".xlsx") returned 5 [0043.191] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.191] lstrlenW (lpString=".ppt") returned 4 [0043.191] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.191] lstrlenW (lpString=".zip") returned 4 [0043.191] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.191] lstrlenW (lpString=".rar") returned 4 [0043.191] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString=".bz2") returned 4 [0043.191] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString=".7z") returned 3 [0043.191] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.191] lstrlenW (lpString=".dbf") returned 4 [0043.191] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.191] lstrlenW (lpString=".1cd") returned 4 [0043.191] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.191] lstrlenW (lpString=".jpg") returned 4 [0043.191] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.537] lstrcmpiW (lpString1=".htm", lpString2=".zoh") returned -1 [0043.543] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0043.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.564] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=237) returned 1 [0044.565] CloseHandle (hObject=0x16c) returned 1 [0044.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0044.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.565] lstrlenW (lpString=".doc") returned 4 [0044.565] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.565] lstrlenW (lpString=".docx") returned 5 [0044.565] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.565] lstrlenW (lpString=".pdf") returned 4 [0044.565] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.565] lstrlenW (lpString=".xls") returned 4 [0044.565] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.565] lstrlenW (lpString=".xlsx") returned 5 [0044.565] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.565] lstrlenW (lpString=".ppt") returned 4 [0044.565] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.565] lstrlenW (lpString=".zip") returned 4 [0044.565] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.565] lstrlenW (lpString=".rar") returned 4 [0044.565] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.565] lstrlenW (lpString=".bz2") returned 4 [0044.565] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.565] lstrlenW (lpString=".7z") returned 3 [0044.566] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString=".dbf") returned 4 [0044.566] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString=".1cd") returned 4 [0044.566] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString=".jpg") returned 4 [0044.566] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString=".doc") returned 4 [0044.566] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.566] lstrlenW (lpString=".docx") returned 5 [0044.566] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.566] lstrlenW (lpString=".pdf") returned 4 [0044.566] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString=".xls") returned 4 [0044.566] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString=".xlsx") returned 5 [0044.566] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.566] lstrlenW (lpString=".ppt") returned 4 [0044.566] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.566] lstrlenW (lpString=".zip") returned 4 [0044.566] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString=".rar") returned 4 [0044.566] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.566] lstrlenW (lpString=".bz2") returned 4 [0044.566] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.566] lstrlenW (lpString=".7z") returned 3 [0044.566] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.567] lstrlenW (lpString=".dbf") returned 4 [0044.567] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.567] lstrlenW (lpString=".1cd") returned 4 [0044.567] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.567] lstrlenW (lpString=".jpg") returned 4 [0044.567] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.567] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0044.567] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.673] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19780) returned 1 [0045.673] CloseHandle (hObject=0x188) returned 1 [0045.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0045.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.673] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.673] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.674] GetLastError () returned 0x0 [0045.674] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0045.676] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0045.677] ReadFile (in: hFile=0x188, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.677] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.677] SetEndOfFile (hFile=0x16c) returned 1 [0045.678] CloseHandle (hObject=0x16c) returned 1 [0045.678] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.678] SetEndOfFile (hFile=0x188) returned 1 [0045.679] CloseHandle (hObject=0x188) returned 1 [0045.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.679] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0045.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.679] lstrlenW (lpString=".doc") returned 4 [0045.679] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.679] lstrlenW (lpString=".docx") returned 5 [0045.679] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.679] lstrlenW (lpString=".pdf") returned 4 [0045.679] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.679] lstrlenW (lpString=".xls") returned 4 [0045.679] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.679] lstrlenW (lpString=".xlsx") returned 5 [0045.680] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.680] lstrlenW (lpString=".ppt") returned 4 [0045.680] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString=".zip") returned 4 [0045.680] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.680] lstrlenW (lpString=".rar") returned 4 [0045.680] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.680] lstrlenW (lpString=".bz2") returned 4 [0045.680] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.680] lstrlenW (lpString=".7z") returned 3 [0045.680] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString=".dbf") returned 4 [0045.680] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString=".1cd") returned 4 [0045.680] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString=".jpg") returned 4 [0045.680] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.680] lstrlenW (lpString=".doc") returned 4 [0045.680] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.680] lstrlenW (lpString=".docx") returned 5 [0045.680] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.680] lstrlenW (lpString=".pdf") returned 4 [0045.680] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.681] lstrlenW (lpString=".xls") returned 4 [0045.681] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.681] lstrlenW (lpString=".xlsx") returned 5 [0045.681] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.681] lstrlenW (lpString=".ppt") returned 4 [0045.681] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.681] lstrlenW (lpString=".zip") returned 4 [0045.681] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.681] lstrlenW (lpString=".rar") returned 4 [0045.681] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.681] lstrlenW (lpString=".bz2") returned 4 [0045.681] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.681] lstrlenW (lpString=".7z") returned 3 [0045.681] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.681] lstrlenW (lpString=".dbf") returned 4 [0045.681] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.681] lstrlenW (lpString=".1cd") returned 4 [0045.681] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0045.681] lstrlenW (lpString=".jpg") returned 4 [0045.681] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.681] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.681] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.690] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20575) returned 1 [0045.690] CloseHandle (hObject=0x200) returned 1 [0045.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0045.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.690] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.690] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.690] GetLastError () returned 0x0 [0045.690] ReadFile (in: hFile=0x200, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x505f, lpOverlapped=0x0) returned 1 [0045.692] WriteFile (in: hFile=0x188, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0045.693] ReadFile (in: hFile=0x200, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.693] WriteFile (in: hFile=0x188, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.693] SetEndOfFile (hFile=0x188) returned 1 [0045.694] CloseHandle (hObject=0x188) returned 1 [0045.694] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.694] SetEndOfFile (hFile=0x200) returned 1 [0045.695] CloseHandle (hObject=0x200) returned 1 [0045.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0045.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.695] lstrlenW (lpString=".doc") returned 4 [0045.695] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.695] lstrlenW (lpString=".docx") returned 5 [0045.695] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.695] lstrlenW (lpString=".pdf") returned 4 [0045.695] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.695] lstrlenW (lpString=".xls") returned 4 [0045.695] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.695] lstrlenW (lpString=".xlsx") returned 5 [0045.695] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.696] lstrlenW (lpString=".ppt") returned 4 [0045.696] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString=".zip") returned 4 [0045.696] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.696] lstrlenW (lpString=".rar") returned 4 [0045.696] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.696] lstrlenW (lpString=".bz2") returned 4 [0045.696] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString=".7z") returned 3 [0045.696] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString=".dbf") returned 4 [0045.696] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString=".1cd") returned 4 [0045.696] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString=".jpg") returned 4 [0045.696] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.696] lstrlenW (lpString=".doc") returned 4 [0045.696] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString=".docx") returned 5 [0045.696] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.696] lstrlenW (lpString=".pdf") returned 4 [0045.696] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.696] lstrlenW (lpString=".xls") returned 4 [0045.697] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.697] lstrlenW (lpString=".xlsx") returned 5 [0045.697] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.697] lstrlenW (lpString=".ppt") returned 4 [0045.697] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.697] lstrlenW (lpString=".zip") returned 4 [0045.697] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.697] lstrlenW (lpString=".rar") returned 4 [0045.697] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.697] lstrlenW (lpString=".bz2") returned 4 [0045.697] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.697] lstrlenW (lpString=".7z") returned 3 [0045.697] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.697] lstrlenW (lpString=".dbf") returned 4 [0045.697] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.697] lstrlenW (lpString=".1cd") returned 4 [0045.697] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.697] lstrlenW (lpString=".jpg") returned 4 [0045.697] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.697] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.697] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.822] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=28595) returned 1 [0045.822] CloseHandle (hObject=0x1bc) returned 1 [0045.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0045.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.822] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.822] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.823] GetLastError () returned 0x0 [0045.823] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0045.826] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.827] SetEndOfFile (hFile=0x204) returned 1 [0045.827] CloseHandle (hObject=0x204) returned 1 [0045.827] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.827] SetEndOfFile (hFile=0x1bc) returned 1 [0045.828] CloseHandle (hObject=0x1bc) returned 1 [0045.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString=".doc") returned 4 [0045.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString=".docx") returned 5 [0045.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.829] lstrlenW (lpString=".pdf") returned 4 [0045.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString=".xls") returned 4 [0045.829] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".xlsx") returned 5 [0045.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.829] lstrlenW (lpString=".ppt") returned 4 [0045.829] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString=".zip") returned 4 [0045.829] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".rar") returned 4 [0045.829] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".bz2") returned 4 [0045.829] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString=".7z") returned 3 [0045.829] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString=".dbf") returned 4 [0045.829] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString=".1cd") returned 4 [0045.829] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.829] lstrlenW (lpString=".jpg") returned 4 [0045.829] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.830] lstrlenW (lpString=".doc") returned 4 [0045.830] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString=".docx") returned 5 [0045.830] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.830] lstrlenW (lpString=".pdf") returned 4 [0045.830] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString=".xls") returned 4 [0045.830] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.830] lstrlenW (lpString=".xlsx") returned 5 [0045.830] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.830] lstrlenW (lpString=".ppt") returned 4 [0045.830] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.830] lstrlenW (lpString=".zip") returned 4 [0045.830] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.830] lstrlenW (lpString=".rar") returned 4 [0045.830] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.830] lstrlenW (lpString=".bz2") returned 4 [0045.830] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString=".7z") returned 3 [0045.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.830] lstrlenW (lpString=".dbf") returned 4 [0045.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.830] lstrlenW (lpString=".1cd") returned 4 [0045.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0045.831] lstrlenW (lpString=".jpg") returned 4 [0045.831] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.831] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0045.831] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.832] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1347) returned 1 [0045.832] CloseHandle (hObject=0x1bc) returned 1 [0045.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0045.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.832] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.832] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.834] GetLastError () returned 0x0 [0045.834] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.835] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.836] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.836] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.836] SetEndOfFile (hFile=0x204) returned 1 [0045.836] CloseHandle (hObject=0x204) returned 1 [0045.836] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.836] SetEndOfFile (hFile=0x1bc) returned 1 [0045.837] CloseHandle (hObject=0x1bc) returned 1 [0045.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0045.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.838] lstrlenW (lpString=".doc") returned 4 [0045.838] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.838] lstrlenW (lpString=".docx") returned 5 [0045.838] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.838] lstrlenW (lpString=".pdf") returned 4 [0045.838] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.838] lstrlenW (lpString=".xls") returned 4 [0045.838] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.838] lstrlenW (lpString=".xlsx") returned 5 [0045.838] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.838] lstrlenW (lpString=".ppt") returned 4 [0045.838] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.838] lstrlenW (lpString=".zip") returned 4 [0045.838] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.838] lstrlenW (lpString=".rar") returned 4 [0045.838] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.838] lstrlenW (lpString=".bz2") returned 4 [0045.838] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.838] lstrlenW (lpString=".7z") returned 3 [0045.838] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.838] lstrlenW (lpString=".dbf") returned 4 [0045.838] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.838] lstrlenW (lpString=".1cd") returned 4 [0045.839] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.839] lstrlenW (lpString=".jpg") returned 4 [0045.839] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.839] lstrlenW (lpString=".doc") returned 4 [0045.839] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.839] lstrlenW (lpString=".docx") returned 5 [0045.839] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.839] lstrlenW (lpString=".pdf") returned 4 [0045.839] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString=".xls") returned 4 [0045.839] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString=".xlsx") returned 5 [0045.839] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.839] lstrlenW (lpString=".ppt") returned 4 [0045.839] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.839] lstrlenW (lpString=".zip") returned 4 [0045.839] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString=".rar") returned 4 [0045.839] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.839] lstrlenW (lpString=".bz2") returned 4 [0045.839] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.839] lstrlenW (lpString=".7z") returned 3 [0045.839] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.839] lstrlenW (lpString=".dbf") returned 4 [0045.839] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.840] lstrlenW (lpString=".1cd") returned 4 [0045.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.840] lstrlenW (lpString=".jpg") returned 4 [0045.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.840] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0045.840] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.840] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32403) returned 1 [0045.840] CloseHandle (hObject=0x1bc) returned 1 [0045.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0045.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0045.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.841] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.841] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0045.841] GetLastError () returned 0x0 [0045.841] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0046.375] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0046.376] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.376] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.377] SetEndOfFile (hFile=0x204) returned 1 [0046.377] CloseHandle (hObject=0x204) returned 1 [0046.377] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.377] SetEndOfFile (hFile=0x1bc) returned 1 [0046.378] CloseHandle (hObject=0x1bc) returned 1 [0046.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0046.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.378] lstrlenW (lpString=".doc") returned 4 [0046.379] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.379] lstrlenW (lpString=".docx") returned 5 [0046.379] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.379] lstrlenW (lpString=".pdf") returned 4 [0046.379] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.379] lstrlenW (lpString=".xls") returned 4 [0046.379] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.379] lstrlenW (lpString=".xlsx") returned 5 [0046.379] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.379] lstrlenW (lpString=".ppt") returned 4 [0046.379] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.379] lstrlenW (lpString=".zip") returned 4 [0046.379] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.379] lstrlenW (lpString=".rar") returned 4 [0046.379] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.379] lstrlenW (lpString=".bz2") returned 4 [0046.379] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.379] lstrlenW (lpString=".7z") returned 3 [0046.379] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.379] lstrlenW (lpString=".dbf") returned 4 [0046.379] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.379] lstrlenW (lpString=".1cd") returned 4 [0046.379] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.379] lstrlenW (lpString=".jpg") returned 4 [0046.379] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.380] lstrlenW (lpString=".doc") returned 4 [0046.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".docx") returned 5 [0046.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.380] lstrlenW (lpString=".pdf") returned 4 [0046.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".xls") returned 4 [0046.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".xlsx") returned 5 [0046.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.380] lstrlenW (lpString=".ppt") returned 4 [0046.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.380] lstrlenW (lpString=".zip") returned 4 [0046.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".rar") returned 4 [0046.380] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.380] lstrlenW (lpString=".bz2") returned 4 [0046.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString=".7z") returned 3 [0046.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.380] lstrlenW (lpString=".dbf") returned 4 [0046.380] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.380] lstrlenW (lpString=".1cd") returned 4 [0046.380] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0046.381] lstrlenW (lpString=".jpg") returned 4 [0046.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.381] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0046.381] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.466] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32433) returned 1 [0046.466] CloseHandle (hObject=0x200) returned 1 [0046.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0046.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0046.466] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.466] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.467] GetLastError () returned 0x0 [0046.467] ReadFile (in: hFile=0x200, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0046.469] WriteFile (in: hFile=0x208, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0046.470] ReadFile (in: hFile=0x200, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.470] WriteFile (in: hFile=0x208, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.470] SetEndOfFile (hFile=0x208) returned 1 [0046.470] CloseHandle (hObject=0x208) returned 1 [0046.471] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.471] SetEndOfFile (hFile=0x200) returned 1 [0046.472] CloseHandle (hObject=0x200) returned 1 [0046.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0046.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.472] lstrlenW (lpString=".doc") returned 4 [0046.472] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.472] lstrlenW (lpString=".docx") returned 5 [0046.472] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.472] lstrlenW (lpString=".pdf") returned 4 [0046.472] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.472] lstrlenW (lpString=".xls") returned 4 [0046.472] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.472] lstrlenW (lpString=".xlsx") returned 5 [0046.472] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.472] lstrlenW (lpString=".ppt") returned 4 [0046.472] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString=".zip") returned 4 [0046.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.473] lstrlenW (lpString=".rar") returned 4 [0046.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.473] lstrlenW (lpString=".bz2") returned 4 [0046.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString=".7z") returned 3 [0046.473] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString=".dbf") returned 4 [0046.473] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString=".1cd") returned 4 [0046.473] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString=".jpg") returned 4 [0046.473] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.473] lstrlenW (lpString=".doc") returned 4 [0046.473] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString=".docx") returned 5 [0046.473] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.473] lstrlenW (lpString=".pdf") returned 4 [0046.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.473] lstrlenW (lpString=".xls") returned 4 [0046.473] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.473] lstrlenW (lpString=".xlsx") returned 5 [0046.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.473] lstrlenW (lpString=".ppt") returned 4 [0046.474] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.474] lstrlenW (lpString=".zip") returned 4 [0046.474] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.474] lstrlenW (lpString=".rar") returned 4 [0046.474] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.474] lstrlenW (lpString=".bz2") returned 4 [0046.474] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.474] lstrlenW (lpString=".7z") returned 3 [0046.474] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.474] lstrlenW (lpString=".dbf") returned 4 [0046.474] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.474] lstrlenW (lpString=".1cd") returned 4 [0046.474] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0046.474] lstrlenW (lpString=".jpg") returned 4 [0046.474] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.474] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0046.474] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.750] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=60724) returned 1 [0046.750] CloseHandle (hObject=0x1f0) returned 1 [0046.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0046.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.750] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.750] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0046.751] GetLastError () returned 0x0 [0046.751] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xed34, lpOverlapped=0x0) returned 1 [0046.875] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0046.878] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.878] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.879] SetEndOfFile (hFile=0x1fc) returned 1 [0046.879] CloseHandle (hObject=0x1fc) returned 1 [0046.879] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.879] SetEndOfFile (hFile=0x1f0) returned 1 [0046.880] CloseHandle (hObject=0x1f0) returned 1 [0046.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0046.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0046.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.881] lstrlenW (lpString=".doc") returned 4 [0046.881] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.881] lstrlenW (lpString=".docx") returned 5 [0046.881] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.881] lstrlenW (lpString=".pdf") returned 4 [0046.881] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.881] lstrlenW (lpString=".xls") returned 4 [0046.881] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.881] lstrlenW (lpString=".xlsx") returned 5 [0046.881] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.881] lstrlenW (lpString=".ppt") returned 4 [0046.881] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.881] lstrlenW (lpString=".zip") returned 4 [0046.881] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.881] lstrlenW (lpString=".rar") returned 4 [0046.881] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.881] lstrlenW (lpString=".bz2") returned 4 [0046.881] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.881] lstrlenW (lpString=".7z") returned 3 [0046.881] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.881] lstrlenW (lpString=".dbf") returned 4 [0046.881] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.881] lstrlenW (lpString=".1cd") returned 4 [0046.881] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.882] lstrlenW (lpString=".jpg") returned 4 [0046.882] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.882] lstrlenW (lpString=".doc") returned 4 [0046.882] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString=".docx") returned 5 [0046.882] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.882] lstrlenW (lpString=".pdf") returned 4 [0046.882] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString=".xls") returned 4 [0046.882] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.882] lstrlenW (lpString=".xlsx") returned 5 [0046.882] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.882] lstrlenW (lpString=".ppt") returned 4 [0046.882] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.882] lstrlenW (lpString=".zip") returned 4 [0046.882] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.882] lstrlenW (lpString=".rar") returned 4 [0046.882] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.882] lstrlenW (lpString=".bz2") returned 4 [0046.882] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString=".7z") returned 3 [0046.882] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.882] lstrlenW (lpString=".dbf") returned 4 [0046.882] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.883] lstrlenW (lpString=".1cd") returned 4 [0046.883] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0046.883] lstrlenW (lpString=".jpg") returned 4 [0046.883] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.883] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0046.883] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.883] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2476) returned 1 [0046.883] CloseHandle (hObject=0x1f0) returned 1 [0046.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0046.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.884] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.884] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.092] GetLastError () returned 0x0 [0047.092] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0047.604] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0047.605] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.605] WriteFile (in: hFile=0x204, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.605] SetEndOfFile (hFile=0x204) returned 1 [0047.606] CloseHandle (hObject=0x204) returned 1 [0047.606] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.606] SetEndOfFile (hFile=0x1f0) returned 1 [0047.607] CloseHandle (hObject=0x1f0) returned 1 [0047.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0047.607] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.607] lstrlenW (lpString=".doc") returned 4 [0047.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.607] lstrlenW (lpString=".docx") returned 5 [0047.607] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.607] lstrlenW (lpString=".pdf") returned 4 [0047.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.607] lstrlenW (lpString=".xls") returned 4 [0047.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.608] lstrlenW (lpString=".xlsx") returned 5 [0047.608] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.608] lstrlenW (lpString=".ppt") returned 4 [0047.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString=".zip") returned 4 [0047.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.608] lstrlenW (lpString=".rar") returned 4 [0047.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.608] lstrlenW (lpString=".bz2") returned 4 [0047.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.608] lstrlenW (lpString=".7z") returned 3 [0047.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString=".dbf") returned 4 [0047.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString=".1cd") returned 4 [0047.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString=".jpg") returned 4 [0047.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.608] lstrlenW (lpString=".doc") returned 4 [0047.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.608] lstrlenW (lpString=".docx") returned 5 [0047.609] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.609] lstrlenW (lpString=".pdf") returned 4 [0047.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.609] lstrlenW (lpString=".xls") returned 4 [0047.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.609] lstrlenW (lpString=".xlsx") returned 5 [0047.609] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.609] lstrlenW (lpString=".ppt") returned 4 [0047.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.609] lstrlenW (lpString=".zip") returned 4 [0047.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.609] lstrlenW (lpString=".rar") returned 4 [0047.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.609] lstrlenW (lpString=".bz2") returned 4 [0047.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.609] lstrlenW (lpString=".7z") returned 3 [0047.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.609] lstrlenW (lpString=".dbf") returned 4 [0047.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.609] lstrlenW (lpString=".1cd") returned 4 [0047.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.609] lstrlenW (lpString=".jpg") returned 4 [0047.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.610] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0047.610] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.610] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1379) returned 1 [0047.610] CloseHandle (hObject=0x1f0) returned 1 [0047.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0047.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.610] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.610] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.784] GetLastError () returned 0x0 [0047.784] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x563, lpOverlapped=0x0) returned 1 [0047.903] WriteFile (in: hFile=0x218, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x570, lpOverlapped=0x0) returned 1 [0047.904] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.905] WriteFile (in: hFile=0x218, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.905] SetEndOfFile (hFile=0x218) returned 1 [0047.905] CloseHandle (hObject=0x218) returned 1 [0047.905] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.905] SetEndOfFile (hFile=0x1f0) returned 1 [0047.906] CloseHandle (hObject=0x1f0) returned 1 [0047.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0047.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0047.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.907] lstrlenW (lpString=".doc") returned 4 [0047.907] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.907] lstrlenW (lpString=".docx") returned 5 [0047.907] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.907] lstrlenW (lpString=".pdf") returned 4 [0047.907] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.907] lstrlenW (lpString=".xls") returned 4 [0047.907] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.907] lstrlenW (lpString=".xlsx") returned 5 [0047.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.907] lstrlenW (lpString=".ppt") returned 4 [0047.907] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.907] lstrlenW (lpString=".zip") returned 4 [0047.907] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.907] lstrlenW (lpString=".rar") returned 4 [0047.907] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.907] lstrlenW (lpString=".bz2") returned 4 [0047.907] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.907] lstrlenW (lpString=".7z") returned 3 [0047.908] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString=".dbf") returned 4 [0047.908] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString=".1cd") returned 4 [0047.908] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString=".jpg") returned 4 [0047.908] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString=".doc") returned 4 [0047.908] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.908] lstrlenW (lpString=".docx") returned 5 [0047.908] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.908] lstrlenW (lpString=".pdf") returned 4 [0047.908] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.908] lstrlenW (lpString=".xls") returned 4 [0047.908] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.908] lstrlenW (lpString=".xlsx") returned 5 [0047.908] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.908] lstrlenW (lpString=".ppt") returned 4 [0047.908] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.908] lstrlenW (lpString=".zip") returned 4 [0047.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.909] lstrlenW (lpString=".rar") returned 4 [0047.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.909] lstrlenW (lpString=".bz2") returned 4 [0047.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.909] lstrlenW (lpString=".7z") returned 3 [0047.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.909] lstrlenW (lpString=".dbf") returned 4 [0047.909] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.909] lstrlenW (lpString=".1cd") returned 4 [0047.909] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.909] lstrlenW (lpString=".jpg") returned 4 [0047.909] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.909] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0047.909] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.910] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1364) returned 1 [0047.910] CloseHandle (hObject=0x1f0) returned 1 [0047.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0047.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.910] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.910] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.368] GetLastError () returned 0x0 [0048.368] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x554, lpOverlapped=0x0) returned 1 [0048.369] WriteFile (in: hFile=0x21c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x560, lpOverlapped=0x0) returned 1 [0048.370] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.371] WriteFile (in: hFile=0x21c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.371] SetEndOfFile (hFile=0x21c) returned 1 [0048.371] CloseHandle (hObject=0x21c) returned 1 [0048.371] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.371] SetEndOfFile (hFile=0x1f0) returned 1 [0048.372] CloseHandle (hObject=0x1f0) returned 1 [0048.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0048.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.373] lstrlenW (lpString=".doc") returned 4 [0048.373] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.373] lstrlenW (lpString=".docx") returned 5 [0048.373] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.373] lstrlenW (lpString=".pdf") returned 4 [0048.373] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.373] lstrlenW (lpString=".xls") returned 4 [0048.373] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.373] lstrlenW (lpString=".xlsx") returned 5 [0048.373] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.373] lstrlenW (lpString=".ppt") returned 4 [0048.373] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.373] lstrlenW (lpString=".zip") returned 4 [0048.373] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.373] lstrlenW (lpString=".rar") returned 4 [0048.374] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.374] lstrlenW (lpString=".bz2") returned 4 [0048.374] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.374] lstrlenW (lpString=".7z") returned 3 [0048.374] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.374] lstrlenW (lpString=".dbf") returned 4 [0048.374] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.374] lstrlenW (lpString=".1cd") returned 4 [0048.374] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.374] lstrlenW (lpString=".jpg") returned 4 [0048.374] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.374] lstrlenW (lpString=".doc") returned 4 [0048.374] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.374] lstrlenW (lpString=".docx") returned 5 [0048.374] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.374] lstrlenW (lpString=".pdf") returned 4 [0048.374] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.374] lstrlenW (lpString=".xls") returned 4 [0048.374] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.374] lstrlenW (lpString=".xlsx") returned 5 [0048.374] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.375] lstrlenW (lpString=".ppt") returned 4 [0048.375] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.375] lstrlenW (lpString=".zip") returned 4 [0048.375] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.375] lstrlenW (lpString=".rar") returned 4 [0048.375] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.375] lstrlenW (lpString=".bz2") returned 4 [0048.375] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.375] lstrlenW (lpString=".7z") returned 3 [0048.375] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.375] lstrlenW (lpString=".dbf") returned 4 [0048.375] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.375] lstrlenW (lpString=".1cd") returned 4 [0048.375] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.375] lstrlenW (lpString=".jpg") returned 4 [0048.375] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.375] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.376] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.376] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1439) returned 1 [0048.376] CloseHandle (hObject=0x1f0) returned 1 [0048.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0048.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.377] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.377] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.379] GetLastError () returned 0x0 [0048.379] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x59f, lpOverlapped=0x0) returned 1 [0048.385] WriteFile (in: hFile=0x220, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0048.386] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.386] WriteFile (in: hFile=0x220, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.386] SetEndOfFile (hFile=0x220) returned 1 [0048.386] CloseHandle (hObject=0x220) returned 1 [0048.386] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.387] SetEndOfFile (hFile=0x1f0) returned 1 [0048.387] CloseHandle (hObject=0x1f0) returned 1 [0048.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0048.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.388] lstrlenW (lpString=".doc") returned 4 [0048.388] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.388] lstrlenW (lpString=".docx") returned 5 [0048.388] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.388] lstrlenW (lpString=".pdf") returned 4 [0048.388] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.388] lstrlenW (lpString=".xls") returned 4 [0048.388] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.388] lstrlenW (lpString=".xlsx") returned 5 [0048.388] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.388] lstrlenW (lpString=".ppt") returned 4 [0048.388] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.388] lstrlenW (lpString=".zip") returned 4 [0048.388] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.388] lstrlenW (lpString=".rar") returned 4 [0048.388] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.388] lstrlenW (lpString=".bz2") returned 4 [0048.388] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.388] lstrlenW (lpString=".7z") returned 3 [0048.388] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.388] lstrlenW (lpString=".dbf") returned 4 [0048.388] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".1cd") returned 4 [0048.389] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".jpg") returned 4 [0048.389] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".doc") returned 4 [0048.389] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.389] lstrlenW (lpString=".docx") returned 5 [0048.389] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.389] lstrlenW (lpString=".pdf") returned 4 [0048.389] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString=".xls") returned 4 [0048.389] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString=".xlsx") returned 5 [0048.389] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.389] lstrlenW (lpString=".ppt") returned 4 [0048.389] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".zip") returned 4 [0048.389] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString=".rar") returned 4 [0048.389] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.389] lstrlenW (lpString=".bz2") returned 4 [0048.389] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.389] lstrlenW (lpString=".7z") returned 3 [0048.389] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".dbf") returned 4 [0048.389] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.390] lstrlenW (lpString=".1cd") returned 4 [0048.390] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.390] lstrlenW (lpString=".jpg") returned 4 [0048.390] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.390] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.390] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.392] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=37112) returned 1 [0048.392] CloseHandle (hObject=0x1f0) returned 1 [0048.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0048.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.399] GetLastError () returned 0x0 [0048.399] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0048.487] WriteFile (in: hFile=0x220, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0048.488] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.488] WriteFile (in: hFile=0x220, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.488] SetEndOfFile (hFile=0x220) returned 1 [0048.488] CloseHandle (hObject=0x220) returned 1 [0048.489] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.489] SetEndOfFile (hFile=0x1f0) returned 1 [0048.490] CloseHandle (hObject=0x1f0) returned 1 [0048.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.490] lstrlenW (lpString=".doc") returned 4 [0048.490] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.490] lstrlenW (lpString=".docx") returned 5 [0048.490] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.490] lstrlenW (lpString=".pdf") returned 4 [0048.490] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.490] lstrlenW (lpString=".xls") returned 4 [0048.490] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.490] lstrlenW (lpString=".xlsx") returned 5 [0048.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.491] lstrlenW (lpString=".ppt") returned 4 [0048.491] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString=".zip") returned 4 [0048.491] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.491] lstrlenW (lpString=".rar") returned 4 [0048.491] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.491] lstrlenW (lpString=".bz2") returned 4 [0048.491] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString=".7z") returned 3 [0048.491] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString=".dbf") returned 4 [0048.491] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString=".1cd") returned 4 [0048.491] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString=".jpg") returned 4 [0048.491] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.491] lstrlenW (lpString=".doc") returned 4 [0048.491] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString=".docx") returned 5 [0048.491] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.491] lstrlenW (lpString=".pdf") returned 4 [0048.491] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.491] lstrlenW (lpString=".xls") returned 4 [0048.491] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.491] lstrlenW (lpString=".xlsx") returned 5 [0048.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.492] lstrlenW (lpString=".ppt") returned 4 [0048.492] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.492] lstrlenW (lpString=".zip") returned 4 [0048.492] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.492] lstrlenW (lpString=".rar") returned 4 [0048.492] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.492] lstrlenW (lpString=".bz2") returned 4 [0048.492] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.492] lstrlenW (lpString=".7z") returned 3 [0048.492] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.492] lstrlenW (lpString=".dbf") returned 4 [0048.492] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.492] lstrlenW (lpString=".1cd") returned 4 [0048.492] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.492] lstrlenW (lpString=".jpg") returned 4 [0048.492] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.492] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.492] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.590] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1666) returned 1 [0048.590] CloseHandle (hObject=0x208) returned 1 [0048.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0048.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.592] GetLastError () returned 0x0 [0048.592] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x682, lpOverlapped=0x0) returned 1 [0048.593] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x690, lpOverlapped=0x0) returned 1 [0048.598] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.598] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.598] SetEndOfFile (hFile=0x214) returned 1 [0048.598] CloseHandle (hObject=0x214) returned 1 [0048.598] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.598] SetEndOfFile (hFile=0x208) returned 1 [0048.599] CloseHandle (hObject=0x208) returned 1 [0048.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString=".doc") returned 4 [0048.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.600] lstrlenW (lpString=".docx") returned 5 [0048.600] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.600] lstrlenW (lpString=".pdf") returned 4 [0048.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.600] lstrlenW (lpString=".xls") returned 4 [0048.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.600] lstrlenW (lpString=".xlsx") returned 5 [0048.600] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.600] lstrlenW (lpString=".ppt") returned 4 [0048.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString=".zip") returned 4 [0048.600] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.600] lstrlenW (lpString=".rar") returned 4 [0048.600] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.600] lstrlenW (lpString=".bz2") returned 4 [0048.600] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.600] lstrlenW (lpString=".7z") returned 3 [0048.600] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString=".dbf") returned 4 [0048.600] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString=".1cd") returned 4 [0048.600] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.600] lstrlenW (lpString=".jpg") returned 4 [0048.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString=".doc") returned 4 [0048.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.601] lstrlenW (lpString=".docx") returned 5 [0048.601] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.601] lstrlenW (lpString=".pdf") returned 4 [0048.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString=".xls") returned 4 [0048.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString=".xlsx") returned 5 [0048.601] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.601] lstrlenW (lpString=".ppt") returned 4 [0048.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString=".zip") returned 4 [0048.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString=".rar") returned 4 [0048.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.601] lstrlenW (lpString=".bz2") returned 4 [0048.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.601] lstrlenW (lpString=".7z") returned 3 [0048.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString=".dbf") returned 4 [0048.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString=".1cd") returned 4 [0048.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.601] lstrlenW (lpString=".jpg") returned 4 [0048.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.602] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0048.602] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.602] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19563) returned 1 [0048.602] CloseHandle (hObject=0x208) returned 1 [0048.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0048.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.602] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.602] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.603] GetLastError () returned 0x0 [0048.603] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0048.857] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0048.859] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.859] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.859] SetEndOfFile (hFile=0x214) returned 1 [0048.859] CloseHandle (hObject=0x214) returned 1 [0048.859] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.859] SetEndOfFile (hFile=0x208) returned 1 [0048.860] CloseHandle (hObject=0x208) returned 1 [0048.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0048.860] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0048.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.860] lstrlenW (lpString=".doc") returned 4 [0048.860] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.860] lstrlenW (lpString=".docx") returned 5 [0048.861] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.861] lstrlenW (lpString=".pdf") returned 4 [0048.861] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString=".xls") returned 4 [0048.861] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.861] lstrlenW (lpString=".xlsx") returned 5 [0048.861] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.861] lstrlenW (lpString=".ppt") returned 4 [0048.861] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString=".zip") returned 4 [0048.861] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.861] lstrlenW (lpString=".rar") returned 4 [0048.861] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.861] lstrlenW (lpString=".bz2") returned 4 [0048.861] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString=".7z") returned 3 [0048.861] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString=".dbf") returned 4 [0048.861] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString=".1cd") returned 4 [0048.861] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString=".jpg") returned 4 [0048.861] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.861] lstrlenW (lpString=".doc") returned 4 [0048.861] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.861] lstrlenW (lpString=".docx") returned 5 [0048.861] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.862] lstrlenW (lpString=".pdf") returned 4 [0048.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.862] lstrlenW (lpString=".xls") returned 4 [0048.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.862] lstrlenW (lpString=".xlsx") returned 5 [0048.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.862] lstrlenW (lpString=".ppt") returned 4 [0048.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.862] lstrlenW (lpString=".zip") returned 4 [0048.862] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.862] lstrlenW (lpString=".rar") returned 4 [0048.862] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.862] lstrlenW (lpString=".bz2") returned 4 [0048.862] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.862] lstrlenW (lpString=".7z") returned 3 [0048.862] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.862] lstrlenW (lpString=".dbf") returned 4 [0048.862] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.862] lstrlenW (lpString=".1cd") returned 4 [0048.862] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.862] lstrlenW (lpString=".jpg") returned 4 [0048.862] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.862] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0048.862] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.863] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2604) returned 1 [0048.863] CloseHandle (hObject=0x208) returned 1 [0048.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0048.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.863] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.863] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.089] GetLastError () returned 0x0 [0049.089] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0049.090] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0049.091] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.091] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.091] SetEndOfFile (hFile=0x210) returned 1 [0049.091] CloseHandle (hObject=0x210) returned 1 [0049.092] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.092] SetEndOfFile (hFile=0x208) returned 1 [0049.092] CloseHandle (hObject=0x208) returned 1 [0049.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.093] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0049.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.093] lstrlenW (lpString=".doc") returned 4 [0049.093] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.093] lstrlenW (lpString=".docx") returned 5 [0049.093] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.093] lstrlenW (lpString=".pdf") returned 4 [0049.093] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.093] lstrlenW (lpString=".xls") returned 4 [0049.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.093] lstrlenW (lpString=".xlsx") returned 5 [0049.093] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.093] lstrlenW (lpString=".ppt") returned 4 [0049.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString=".zip") returned 4 [0049.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.094] lstrlenW (lpString=".rar") returned 4 [0049.094] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.094] lstrlenW (lpString=".bz2") returned 4 [0049.094] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.094] lstrlenW (lpString=".7z") returned 3 [0049.094] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString=".dbf") returned 4 [0049.094] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString=".1cd") returned 4 [0049.094] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString=".jpg") returned 4 [0049.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.094] lstrlenW (lpString=".doc") returned 4 [0049.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.094] lstrlenW (lpString=".docx") returned 5 [0049.094] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.094] lstrlenW (lpString=".pdf") returned 4 [0049.094] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.094] lstrlenW (lpString=".xls") returned 4 [0049.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.095] lstrlenW (lpString=".xlsx") returned 5 [0049.095] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.095] lstrlenW (lpString=".ppt") returned 4 [0049.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.095] lstrlenW (lpString=".zip") returned 4 [0049.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.095] lstrlenW (lpString=".rar") returned 4 [0049.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.095] lstrlenW (lpString=".bz2") returned 4 [0049.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.095] lstrlenW (lpString=".7z") returned 3 [0049.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.095] lstrlenW (lpString=".dbf") returned 4 [0049.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.095] lstrlenW (lpString=".1cd") returned 4 [0049.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.095] lstrlenW (lpString=".jpg") returned 4 [0049.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.096] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.096] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.096] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1009) returned 1 [0049.097] CloseHandle (hObject=0x208) returned 1 [0049.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0049.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.097] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.097] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.099] GetLastError () returned 0x0 [0049.099] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0049.100] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x400, lpOverlapped=0x0) returned 1 [0049.101] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.101] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.101] SetEndOfFile (hFile=0x210) returned 1 [0049.101] CloseHandle (hObject=0x210) returned 1 [0049.101] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.102] SetEndOfFile (hFile=0x208) returned 1 [0049.102] CloseHandle (hObject=0x208) returned 1 [0049.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.103] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.103] lstrlenW (lpString=".doc") returned 4 [0049.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.103] lstrlenW (lpString=".docx") returned 5 [0049.103] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.103] lstrlenW (lpString=".pdf") returned 4 [0049.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.103] lstrlenW (lpString=".xls") returned 4 [0049.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.103] lstrlenW (lpString=".xlsx") returned 5 [0049.103] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.103] lstrlenW (lpString=".ppt") returned 4 [0049.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.103] lstrlenW (lpString=".zip") returned 4 [0049.103] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.103] lstrlenW (lpString=".rar") returned 4 [0049.103] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.103] lstrlenW (lpString=".bz2") returned 4 [0049.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.103] lstrlenW (lpString=".7z") returned 3 [0049.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.103] lstrlenW (lpString=".dbf") returned 4 [0049.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.104] lstrlenW (lpString=".1cd") returned 4 [0049.104] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.104] lstrlenW (lpString=".jpg") returned 4 [0049.104] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.104] lstrlenW (lpString=".doc") returned 4 [0049.104] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.104] lstrlenW (lpString=".docx") returned 5 [0049.105] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.105] lstrlenW (lpString=".pdf") returned 4 [0049.105] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.105] lstrlenW (lpString=".xls") returned 4 [0049.105] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.105] lstrlenW (lpString=".xlsx") returned 5 [0049.105] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.105] lstrlenW (lpString=".ppt") returned 4 [0049.105] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.105] lstrlenW (lpString=".zip") returned 4 [0049.105] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.105] lstrlenW (lpString=".rar") returned 4 [0049.105] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.105] lstrlenW (lpString=".bz2") returned 4 [0049.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.105] lstrlenW (lpString=".7z") returned 3 [0049.105] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.105] lstrlenW (lpString=".dbf") returned 4 [0049.105] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.105] lstrlenW (lpString=".1cd") returned 4 [0049.105] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.105] lstrlenW (lpString=".jpg") returned 4 [0049.105] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.106] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0049.106] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.106] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27177) returned 1 [0049.106] CloseHandle (hObject=0x208) returned 1 [0049.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0049.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.108] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.108] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.108] GetLastError () returned 0x0 [0049.108] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0049.112] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0049.113] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.113] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.113] SetEndOfFile (hFile=0x210) returned 1 [0049.114] CloseHandle (hObject=0x210) returned 1 [0049.114] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.114] SetEndOfFile (hFile=0x208) returned 1 [0049.115] CloseHandle (hObject=0x208) returned 1 [0049.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.115] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0049.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.115] lstrlenW (lpString=".doc") returned 4 [0049.115] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.115] lstrlenW (lpString=".docx") returned 5 [0049.115] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.115] lstrlenW (lpString=".pdf") returned 4 [0049.115] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.115] lstrlenW (lpString=".xls") returned 4 [0049.115] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.115] lstrlenW (lpString=".xlsx") returned 5 [0049.115] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.115] lstrlenW (lpString=".ppt") returned 4 [0049.115] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString=".zip") returned 4 [0049.116] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.116] lstrlenW (lpString=".rar") returned 4 [0049.116] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.116] lstrlenW (lpString=".bz2") returned 4 [0049.116] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString=".7z") returned 3 [0049.116] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString=".dbf") returned 4 [0049.116] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString=".1cd") returned 4 [0049.116] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString=".jpg") returned 4 [0049.116] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.116] lstrlenW (lpString=".doc") returned 4 [0049.116] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString=".docx") returned 5 [0049.116] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.116] lstrlenW (lpString=".pdf") returned 4 [0049.116] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.116] lstrlenW (lpString=".xls") returned 4 [0049.116] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.116] lstrlenW (lpString=".xlsx") returned 5 [0049.116] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.116] lstrlenW (lpString=".ppt") returned 4 [0049.116] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.117] lstrlenW (lpString=".zip") returned 4 [0049.117] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.117] lstrlenW (lpString=".rar") returned 4 [0049.117] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.117] lstrlenW (lpString=".bz2") returned 4 [0049.117] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.117] lstrlenW (lpString=".7z") returned 3 [0049.117] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.117] lstrlenW (lpString=".dbf") returned 4 [0049.117] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.117] lstrlenW (lpString=".1cd") returned 4 [0049.117] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.117] lstrlenW (lpString=".jpg") returned 4 [0049.117] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.117] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0049.117] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.118] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2209) returned 1 [0049.118] CloseHandle (hObject=0x208) returned 1 [0049.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0049.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.118] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.118] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.120] GetLastError () returned 0x0 [0049.120] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0049.122] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0049.124] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.124] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.124] SetEndOfFile (hFile=0x1f0) returned 1 [0049.124] CloseHandle (hObject=0x1f0) returned 1 [0049.124] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.124] SetEndOfFile (hFile=0x208) returned 1 [0049.125] CloseHandle (hObject=0x208) returned 1 [0049.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0049.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.125] lstrlenW (lpString=".doc") returned 4 [0049.125] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.125] lstrlenW (lpString=".docx") returned 5 [0049.125] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.125] lstrlenW (lpString=".pdf") returned 4 [0049.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString=".xls") returned 4 [0049.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString=".xlsx") returned 5 [0049.126] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.126] lstrlenW (lpString=".ppt") returned 4 [0049.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString=".zip") returned 4 [0049.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString=".rar") returned 4 [0049.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString=".bz2") returned 4 [0049.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.126] lstrlenW (lpString=".7z") returned 3 [0049.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString=".dbf") returned 4 [0049.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString=".1cd") returned 4 [0049.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString=".jpg") returned 4 [0049.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.126] lstrlenW (lpString=".doc") returned 4 [0049.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.126] lstrlenW (lpString=".docx") returned 5 [0049.127] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.127] lstrlenW (lpString=".pdf") returned 4 [0049.127] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.127] lstrlenW (lpString=".xls") returned 4 [0049.127] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.127] lstrlenW (lpString=".xlsx") returned 5 [0049.127] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.127] lstrlenW (lpString=".ppt") returned 4 [0049.127] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.127] lstrlenW (lpString=".zip") returned 4 [0049.127] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.127] lstrlenW (lpString=".rar") returned 4 [0049.127] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.127] lstrlenW (lpString=".bz2") returned 4 [0049.127] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.127] lstrlenW (lpString=".7z") returned 3 [0049.127] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.127] lstrlenW (lpString=".dbf") returned 4 [0049.127] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.127] lstrlenW (lpString=".1cd") returned 4 [0049.127] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.127] lstrlenW (lpString=".jpg") returned 4 [0049.127] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.128] lstrcmpiW (lpString1=".PNG", lpString2=".zoh") returned -1 [0049.128] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.128] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21812) returned 1 [0049.128] CloseHandle (hObject=0x208) returned 1 [0049.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0049.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0049.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.128] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.128] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.129] GetLastError () returned 0x0 [0049.129] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5534, lpOverlapped=0x0) returned 1 [0049.388] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0049.900] ReadFile (in: hFile=0x208, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.900] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.900] SetEndOfFile (hFile=0x1f0) returned 1 [0049.900] CloseHandle (hObject=0x1f0) returned 1 [0049.901] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.901] SetEndOfFile (hFile=0x208) returned 1 [0049.902] CloseHandle (hObject=0x208) returned 1 [0049.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0049.902] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.902] lstrlenW (lpString=".doc") returned 4 [0049.902] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.902] lstrlenW (lpString=".docx") returned 5 [0049.902] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.902] lstrlenW (lpString=".pdf") returned 4 [0049.902] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.902] lstrlenW (lpString=".xls") returned 4 [0049.902] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.902] lstrlenW (lpString=".xlsx") returned 5 [0049.902] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.902] lstrlenW (lpString=".ppt") returned 4 [0049.902] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.902] lstrlenW (lpString=".zip") returned 4 [0049.903] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.903] lstrlenW (lpString=".rar") returned 4 [0049.903] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.903] lstrlenW (lpString=".bz2") returned 4 [0049.903] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString=".7z") returned 3 [0049.903] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString=".dbf") returned 4 [0049.903] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString=".1cd") returned 4 [0049.903] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString=".jpg") returned 4 [0049.903] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString=".doc") returned 4 [0049.903] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString=".docx") returned 5 [0049.903] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.903] lstrlenW (lpString=".pdf") returned 4 [0049.903] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.903] lstrlenW (lpString=".xls") returned 4 [0049.903] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.903] lstrlenW (lpString=".xlsx") returned 5 [0049.903] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.903] lstrlenW (lpString=".ppt") returned 4 [0049.903] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.903] lstrlenW (lpString=".zip") returned 4 [0049.904] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.904] lstrlenW (lpString=".rar") returned 4 [0049.904] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.904] lstrlenW (lpString=".bz2") returned 4 [0049.904] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.904] lstrlenW (lpString=".7z") returned 3 [0049.904] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.904] lstrlenW (lpString=".dbf") returned 4 [0049.904] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.904] lstrlenW (lpString=".1cd") returned 4 [0049.904] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.904] lstrlenW (lpString=".jpg") returned 4 [0049.904] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.904] lstrcmpiW (lpString1=".CHM", lpString2=".zoh") returned -1 [0049.904] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0049.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.291] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=72031) returned 1 [0050.291] CloseHandle (hObject=0x18c) returned 1 [0050.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0050.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.291] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.291] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0050.294] GetLastError () returned 0x0 [0050.294] ReadFile (in: hFile=0x18c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0050.297] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0050.299] ReadFile (in: hFile=0x18c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.299] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.299] SetEndOfFile (hFile=0x190) returned 1 [0050.299] CloseHandle (hObject=0x190) returned 1 [0050.299] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.299] SetEndOfFile (hFile=0x18c) returned 1 [0050.300] CloseHandle (hObject=0x18c) returned 1 [0050.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.301] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.301] lstrlenW (lpString=".doc") returned 4 [0050.301] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString=".docx") returned 5 [0050.301] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0050.301] lstrlenW (lpString=".pdf") returned 4 [0050.301] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString=".xls") returned 4 [0050.301] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString=".xlsx") returned 5 [0050.301] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0050.301] lstrlenW (lpString=".ppt") returned 4 [0050.301] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.301] lstrlenW (lpString=".zip") returned 4 [0050.301] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString=".rar") returned 4 [0050.301] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.301] lstrlenW (lpString=".bz2") returned 4 [0050.302] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.302] lstrlenW (lpString=".7z") returned 3 [0050.302] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString=".dbf") returned 4 [0050.302] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString=".1cd") returned 4 [0050.302] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString=".jpg") returned 4 [0050.302] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString=".doc") returned 4 [0050.302] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString=".docx") returned 5 [0050.302] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0050.302] lstrlenW (lpString=".pdf") returned 4 [0050.302] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString=".xls") returned 4 [0050.302] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString=".xlsx") returned 5 [0050.302] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0050.302] lstrlenW (lpString=".ppt") returned 4 [0050.302] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.302] lstrlenW (lpString=".zip") returned 4 [0050.302] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString=".rar") returned 4 [0050.302] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.302] lstrlenW (lpString=".bz2") returned 4 [0050.303] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.303] lstrlenW (lpString=".7z") returned 3 [0050.303] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.303] lstrlenW (lpString=".dbf") returned 4 [0050.303] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.303] lstrlenW (lpString=".1cd") returned 4 [0050.303] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.303] lstrlenW (lpString=".jpg") returned 4 [0050.303] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.303] lstrcmpiW (lpString1=".MSG", lpString2=".zoh") returned -1 [0050.303] lstrlenW (lpString="FPEXT.MSG") returned 9 [0050.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.304] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=169637) returned 1 [0050.304] CloseHandle (hObject=0x18c) returned 1 [0050.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0050.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.304] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.304] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0050.305] GetLastError () returned 0x0 [0050.305] ReadFile (in: hFile=0x18c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0050.310] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0050.313] ReadFile (in: hFile=0x18c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.313] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.313] SetEndOfFile (hFile=0x190) returned 1 [0050.313] CloseHandle (hObject=0x190) returned 1 [0050.313] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.313] SetEndOfFile (hFile=0x18c) returned 1 [0050.315] CloseHandle (hObject=0x18c) returned 1 [0050.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0050.315] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString=".doc") returned 4 [0050.316] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0050.316] lstrlenW (lpString=".docx") returned 5 [0050.316] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0050.316] lstrlenW (lpString=".pdf") returned 4 [0050.316] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0050.316] lstrlenW (lpString=".xls") returned 4 [0050.316] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0050.316] lstrlenW (lpString=".xlsx") returned 5 [0050.316] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0050.316] lstrlenW (lpString=".ppt") returned 4 [0050.316] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString=".zip") returned 4 [0050.316] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0050.316] lstrlenW (lpString=".rar") returned 4 [0050.316] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0050.316] lstrlenW (lpString=".bz2") returned 4 [0050.316] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0050.316] lstrlenW (lpString=".7z") returned 3 [0050.316] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString=".dbf") returned 4 [0050.316] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString=".1cd") returned 4 [0050.316] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0050.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.316] lstrlenW (lpString=".jpg") returned 4 [0050.316] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString=".doc") returned 4 [0050.317] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0050.317] lstrlenW (lpString=".docx") returned 5 [0050.317] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0050.317] lstrlenW (lpString=".pdf") returned 4 [0050.317] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0050.317] lstrlenW (lpString=".xls") returned 4 [0050.317] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0050.317] lstrlenW (lpString=".xlsx") returned 5 [0050.317] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0050.317] lstrlenW (lpString=".ppt") returned 4 [0050.317] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString=".zip") returned 4 [0050.317] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0050.317] lstrlenW (lpString=".rar") returned 4 [0050.317] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0050.317] lstrlenW (lpString=".bz2") returned 4 [0050.317] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0050.317] lstrlenW (lpString=".7z") returned 3 [0050.317] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString=".dbf") returned 4 [0050.317] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString=".1cd") returned 4 [0050.317] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0050.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.317] lstrlenW (lpString=".jpg") returned 4 [0050.317] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0050.318] lstrcmpiW (lpString1=".bmp", lpString2=".zoh") returned -1 [0050.318] lstrlenW (lpString="verisign.bmp") returned 12 [0050.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.631] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2702) returned 1 [0050.635] CloseHandle (hObject=0x1f4) returned 1 [0050.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0050.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString=".doc") returned 4 [0050.636] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".docx") returned 5 [0050.636] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0050.636] lstrlenW (lpString=".pdf") returned 4 [0050.636] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".xls") returned 4 [0050.636] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".xlsx") returned 5 [0050.636] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0050.636] lstrlenW (lpString=".ppt") returned 4 [0050.636] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString=".zip") returned 4 [0050.636] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".rar") returned 4 [0050.636] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".bz2") returned 4 [0050.636] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString=".7z") returned 3 [0050.636] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString=".dbf") returned 4 [0050.636] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString=".1cd") returned 4 [0050.636] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.636] lstrlenW (lpString=".jpg") returned 4 [0050.637] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.637] lstrlenW (lpString=".doc") returned 4 [0050.637] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".docx") returned 5 [0050.637] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0050.637] lstrlenW (lpString=".pdf") returned 4 [0050.637] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".xls") returned 4 [0050.637] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".xlsx") returned 5 [0050.637] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0050.637] lstrlenW (lpString=".ppt") returned 4 [0050.637] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.637] lstrlenW (lpString=".zip") returned 4 [0050.637] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".rar") returned 4 [0050.637] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".bz2") returned 4 [0050.637] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString=".7z") returned 3 [0050.637] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.637] lstrlenW (lpString=".dbf") returned 4 [0050.637] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.637] lstrlenW (lpString=".1cd") returned 4 [0050.637] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.638] lstrlenW (lpString=".jpg") returned 4 [0050.638] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0050.638] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0050.638] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0050.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.788] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11861) returned 1 [0050.788] CloseHandle (hObject=0x1f0) returned 1 [0050.788] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0050.788] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.788] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.788] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.788] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.788] lstrlenW (lpString=".doc") returned 4 [0050.788] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.788] lstrlenW (lpString=".docx") returned 5 [0050.788] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0050.788] lstrlenW (lpString=".pdf") returned 4 [0050.788] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.788] lstrlenW (lpString=".xls") returned 4 [0050.788] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.788] lstrlenW (lpString=".xlsx") returned 5 [0050.788] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0050.788] lstrlenW (lpString=".ppt") returned 4 [0050.788] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString=".zip") returned 4 [0050.789] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.789] lstrlenW (lpString=".rar") returned 4 [0050.789] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.789] lstrlenW (lpString=".bz2") returned 4 [0050.789] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.789] lstrlenW (lpString=".7z") returned 3 [0050.789] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString=".dbf") returned 4 [0050.789] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString=".1cd") returned 4 [0050.789] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString=".jpg") returned 4 [0050.789] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.789] lstrlenW (lpString=".doc") returned 4 [0050.789] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.790] lstrlenW (lpString=".docx") returned 5 [0050.790] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0050.790] lstrlenW (lpString=".pdf") returned 4 [0050.790] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.790] lstrlenW (lpString=".xls") returned 4 [0050.790] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.790] lstrlenW (lpString=".xlsx") returned 5 [0050.790] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0050.790] lstrlenW (lpString=".ppt") returned 4 [0050.790] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.790] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.790] lstrlenW (lpString=".zip") returned 4 [0050.790] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.790] lstrlenW (lpString=".rar") returned 4 [0050.790] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.790] lstrlenW (lpString=".bz2") returned 4 [0050.790] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.790] lstrlenW (lpString=".7z") returned 3 [0050.790] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.790] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.790] lstrlenW (lpString=".dbf") returned 4 [0050.790] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.790] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.790] lstrlenW (lpString=".1cd") returned 4 [0050.790] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.790] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0050.790] lstrlenW (lpString=".jpg") returned 4 [0050.790] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.790] lstrcmpiW (lpString1=".png", lpString2=".zoh") returned -1 [0050.790] lstrlenW (lpString="babyblue.png") returned 12 [0050.791] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.793] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12349) returned 1 [0050.793] CloseHandle (hObject=0x1f0) returned 1 [0050.793] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0050.793] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.793] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.793] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.793] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.793] lstrlenW (lpString=".doc") returned 4 [0050.793] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.793] lstrlenW (lpString=".docx") returned 5 [0050.793] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.793] lstrlenW (lpString=".pdf") returned 4 [0050.793] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.793] lstrlenW (lpString=".xls") returned 4 [0050.793] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.793] lstrlenW (lpString=".xlsx") returned 5 [0050.793] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.793] lstrlenW (lpString=".ppt") returned 4 [0050.793] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.793] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.793] lstrlenW (lpString=".zip") returned 4 [0050.793] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.793] lstrlenW (lpString=".rar") returned 4 [0050.793] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.793] lstrlenW (lpString=".bz2") returned 4 [0050.794] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString=".7z") returned 3 [0050.794] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString=".dbf") returned 4 [0050.794] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString=".1cd") returned 4 [0050.794] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString=".jpg") returned 4 [0050.794] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString=".doc") returned 4 [0050.794] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString=".docx") returned 5 [0050.794] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.794] lstrlenW (lpString=".pdf") returned 4 [0050.794] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.794] lstrlenW (lpString=".xls") returned 4 [0050.794] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.794] lstrlenW (lpString=".xlsx") returned 5 [0050.794] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.794] lstrlenW (lpString=".ppt") returned 4 [0050.794] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.794] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.794] lstrlenW (lpString=".zip") returned 4 [0050.794] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.794] lstrlenW (lpString=".rar") returned 4 [0050.794] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.794] lstrlenW (lpString=".bz2") returned 4 [0050.794] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.795] lstrlenW (lpString=".7z") returned 3 [0050.795] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.795] lstrlenW (lpString=".dbf") returned 4 [0050.795] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.795] lstrlenW (lpString=".1cd") returned 4 [0050.795] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.795] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0050.795] lstrlenW (lpString=".jpg") returned 4 [0050.795] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.795] lstrcmpiW (lpString1=".wmv", lpString2=".zoh") returned -1 [0050.795] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0050.795] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.796] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=341322) returned 1 [0050.796] CloseHandle (hObject=0x214) returned 1 [0050.796] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0050.796] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.796] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.796] lstrlenW (lpString=".doc") returned 4 [0050.796] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0050.796] lstrlenW (lpString=".docx") returned 5 [0050.796] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0050.796] lstrlenW (lpString=".pdf") returned 4 [0050.796] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0050.796] lstrlenW (lpString=".xls") returned 4 [0050.796] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0050.796] lstrlenW (lpString=".xlsx") returned 5 [0050.796] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0050.797] lstrlenW (lpString=".ppt") returned 4 [0050.797] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString=".zip") returned 4 [0050.797] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0050.797] lstrlenW (lpString=".rar") returned 4 [0050.797] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString=".bz2") returned 4 [0050.797] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString=".7z") returned 3 [0050.797] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString=".dbf") returned 4 [0050.797] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString=".1cd") returned 4 [0050.797] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString=".jpg") returned 4 [0050.797] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.797] lstrlenW (lpString=".doc") returned 4 [0050.797] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString=".docx") returned 5 [0050.797] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0050.797] lstrlenW (lpString=".pdf") returned 4 [0050.797] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0050.797] lstrlenW (lpString=".xls") returned 4 [0050.797] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0050.797] lstrlenW (lpString=".xlsx") returned 5 [0050.797] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0050.797] lstrlenW (lpString=".ppt") returned 4 [0050.798] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0050.798] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.798] lstrlenW (lpString=".zip") returned 4 [0050.798] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0050.798] lstrlenW (lpString=".rar") returned 4 [0050.798] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0050.798] lstrlenW (lpString=".bz2") returned 4 [0050.798] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0050.798] lstrlenW (lpString=".7z") returned 3 [0050.798] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0050.798] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.798] lstrlenW (lpString=".dbf") returned 4 [0050.798] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0050.798] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.798] lstrlenW (lpString=".1cd") returned 4 [0050.798] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0050.798] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0050.798] lstrlenW (lpString=".jpg") returned 4 [0050.798] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0050.798] lstrcmpiW (lpString1=".wmv", lpString2=".zoh") returned -1 [0050.798] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0050.798] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.798] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=325322) returned 1 [0050.798] CloseHandle (hObject=0x214) returned 1 [0050.799] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0050.799] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.799] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.799] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.799] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.799] lstrlenW (lpString=".doc") returned 4 [0050.799] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0050.799] lstrlenW (lpString=".docx") returned 5 [0050.799] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0050.799] lstrlenW (lpString=".pdf") returned 4 [0050.799] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0050.799] lstrlenW (lpString=".xls") returned 4 [0050.799] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0050.799] lstrlenW (lpString=".xlsx") returned 5 [0050.799] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0050.799] lstrlenW (lpString=".ppt") returned 4 [0050.799] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0050.799] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.799] lstrlenW (lpString=".zip") returned 4 [0050.799] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0050.799] lstrlenW (lpString=".rar") returned 4 [0050.799] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0050.799] lstrlenW (lpString=".bz2") returned 4 [0050.799] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0050.799] lstrlenW (lpString=".7z") returned 3 [0050.799] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0050.799] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.799] lstrlenW (lpString=".dbf") returned 4 [0050.799] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".1cd") returned 4 [0050.800] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".jpg") returned 4 [0050.800] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".doc") returned 4 [0050.800] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString=".docx") returned 5 [0050.800] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0050.800] lstrlenW (lpString=".pdf") returned 4 [0050.800] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString=".xls") returned 4 [0050.800] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0050.800] lstrlenW (lpString=".xlsx") returned 5 [0050.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0050.800] lstrlenW (lpString=".ppt") returned 4 [0050.800] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".zip") returned 4 [0050.800] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0050.800] lstrlenW (lpString=".rar") returned 4 [0050.800] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString=".bz2") returned 4 [0050.800] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString=".7z") returned 3 [0050.800] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".dbf") returned 4 [0050.800] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0050.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.800] lstrlenW (lpString=".1cd") returned 4 [0050.801] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0050.801] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0050.801] lstrlenW (lpString=".jpg") returned 4 [0050.801] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0050.801] lstrcmpiW (lpString1=".wmv", lpString2=".zoh") returned -1 [0050.801] lstrlenW (lpString="BabyBoyMainToNotesBackground.wmv") returned 32 [0050.801] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.801] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=141214) returned 1 [0050.801] CloseHandle (hObject=0x214) returned 1 [0050.801] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0050.801] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.801] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.801] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0050.801] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0050.801] lstrlenW (lpString=".doc") returned 4 [0050.801] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0050.801] lstrlenW (lpString=".docx") returned 5 [0050.802] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0050.802] lstrlenW (lpString=".pdf") returned 4 [0050.802] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0050.802] lstrlenW (lpString=".xls") returned 4 [0050.802] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0050.802] lstrlenW (lpString=".xlsx") returned 5 [0050.802] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0050.802] lstrlenW (lpString=".ppt") returned 4 [0050.802] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0050.802] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0050.802] lstrlenW (lpString=".zip") returned 4 [0050.802] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0050.802] lstrlenW (lpString=".rar") returned 4 [0050.802] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0050.802] lstrlenW (lpString=".bz2") returned 4 [0050.802] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0050.802] lstrlenW (lpString=".7z") returned 3 [0050.802] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0050.802] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0050.802] lstrlenW (lpString=".dbf") returned 4 [0050.802] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0050.802] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=157214) returned 1 [0050.802] CloseHandle (hObject=0x214) returned 1 [0050.802] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0050.803] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.805] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=117214) returned 1 [0050.805] CloseHandle (hObject=0x214) returned 1 [0050.805] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0050.805] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.805] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.806] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=141214) returned 1 [0050.806] CloseHandle (hObject=0x214) returned 1 [0050.806] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0050.806] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.806] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.806] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=157292) returned 1 [0050.806] CloseHandle (hObject=0x214) returned 1 [0050.806] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0050.806] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.806] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.807] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=157292) returned 1 [0050.807] CloseHandle (hObject=0x214) returned 1 [0050.807] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0050.807] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.807] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.808] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=149292) returned 1 [0050.808] CloseHandle (hObject=0x214) returned 1 [0050.808] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0050.808] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.808] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=125292) returned 1 [0050.808] CloseHandle (hObject=0x214) returned 1 [0050.808] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0050.808] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.809] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=220) returned 1 [0050.809] CloseHandle (hObject=0x214) returned 1 [0050.809] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0050.809] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.809] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.809] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2922) returned 1 [0050.809] CloseHandle (hObject=0x214) returned 1 [0050.809] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0050.809] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.809] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.810] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3939) returned 1 [0050.810] CloseHandle (hObject=0x1f0) returned 1 [0050.810] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0050.811] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.811] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4503) returned 1 [0050.811] CloseHandle (hObject=0x1f0) returned 1 [0050.811] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0050.811] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.811] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4515) returned 1 [0050.811] CloseHandle (hObject=0x1f0) returned 1 [0050.812] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0050.812] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.812] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.812] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4200) returned 1 [0050.812] CloseHandle (hObject=0x1f0) returned 1 [0050.812] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0050.812] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.812] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.813] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2739) returned 1 [0050.813] CloseHandle (hObject=0x1f0) returned 1 [0050.813] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0050.813] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.813] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.814] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2211) returned 1 [0050.814] CloseHandle (hObject=0x1f0) returned 1 [0050.814] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0050.814] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.815] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.815] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1551) returned 1 [0050.815] CloseHandle (hObject=0x1f0) returned 1 [0050.815] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0050.815] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.815] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.816] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19477) returned 1 [0050.816] CloseHandle (hObject=0x1f0) returned 1 [0050.816] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0050.816] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.816] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.816] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=52251) returned 1 [0050.816] CloseHandle (hObject=0x1f0) returned 1 [0050.816] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0050.816] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.816] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.817] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=181298) returned 1 [0050.817] CloseHandle (hObject=0x1f0) returned 1 [0050.817] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0050.817] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.818] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.818] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=181322) returned 1 [0050.818] CloseHandle (hObject=0x1f0) returned 1 [0050.818] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0050.818] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.818] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.818] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=237298) returned 1 [0050.818] CloseHandle (hObject=0x1f0) returned 1 [0050.818] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0050.819] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.819] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.819] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=269322) returned 1 [0050.819] CloseHandle (hObject=0x1f0) returned 1 [0050.819] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0050.819] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.819] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.820] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3525) returned 1 [0050.820] CloseHandle (hObject=0x1f0) returned 1 [0050.820] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0050.820] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.820] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.821] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3580) returned 1 [0050.821] CloseHandle (hObject=0x1f0) returned 1 [0050.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0050.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.821] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.821] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3595) returned 1 [0050.821] CloseHandle (hObject=0x1f0) returned 1 [0050.821] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0050.822] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.822] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1885) returned 1 [0050.822] CloseHandle (hObject=0x1f0) returned 1 [0050.822] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0050.822] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.382] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1375) returned 1 [0051.382] CloseHandle (hObject=0x1bc) returned 1 [0051.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0051.382] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.382] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.491] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3118) returned 1 [0051.492] CloseHandle (hObject=0x1c0) returned 1 [0051.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0051.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.493] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3081) returned 1 [0051.493] CloseHandle (hObject=0x1c0) returned 1 [0051.493] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0051.493] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.493] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.493] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24520) returned 1 [0051.493] CloseHandle (hObject=0x1c0) returned 1 [0051.496] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0051.496] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.496] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.497] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0051.497] CloseHandle (hObject=0x1c0) returned 1 [0051.497] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0051.498] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.498] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.498] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2821) returned 1 [0051.498] CloseHandle (hObject=0x1c0) returned 1 [0051.498] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0051.499] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.499] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.499] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4563) returned 1 [0051.499] CloseHandle (hObject=0x1c0) returned 1 [0051.499] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0051.500] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.500] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4669) returned 1 [0051.500] CloseHandle (hObject=0x1c0) returned 1 [0051.500] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0051.500] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.500] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.501] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=26516) returned 1 [0051.501] CloseHandle (hObject=0x1c0) returned 1 [0051.501] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0051.501] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.501] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.502] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5088) returned 1 [0051.502] CloseHandle (hObject=0x1c0) returned 1 [0051.502] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0051.502] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.502] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.503] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3130) returned 1 [0051.503] CloseHandle (hObject=0x1c0) returned 1 [0051.503] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0051.503] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.503] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.504] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5025) returned 1 [0051.504] CloseHandle (hObject=0x1bc) returned 1 [0051.504] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0051.504] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.504] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.505] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3118) returned 1 [0051.505] CloseHandle (hObject=0x1bc) returned 1 [0051.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0051.505] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.505] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.506] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4955) returned 1 [0051.506] CloseHandle (hObject=0x1bc) returned 1 [0051.507] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0051.507] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.507] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.507] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3081) returned 1 [0051.507] CloseHandle (hObject=0x1bc) returned 1 [0051.508] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0051.508] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.508] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2962) returned 1 [0051.508] CloseHandle (hObject=0x1bc) returned 1 [0051.508] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0051.508] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.509] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30138) returned 1 [0051.509] CloseHandle (hObject=0x1bc) returned 1 [0051.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0051.509] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.509] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.510] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5072) returned 1 [0051.510] CloseHandle (hObject=0x1bc) returned 1 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.510] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.510] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4728) returned 1 [0051.510] CloseHandle (hObject=0x1bc) returned 1 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.510] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.511] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5742) returned 1 [0051.511] CloseHandle (hObject=0x1bc) returned 1 [0051.511] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0051.511] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.511] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.512] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0051.512] CloseHandle (hObject=0x1bc) returned 1 [0051.512] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0051.512] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.512] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.513] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2821) returned 1 [0051.513] CloseHandle (hObject=0x1c0) returned 1 [0051.513] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0051.513] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.513] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.513] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17378) returned 1 [0051.513] CloseHandle (hObject=0x1c0) returned 1 [0051.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0051.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.514] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2903) returned 1 [0051.514] CloseHandle (hObject=0x1c0) returned 1 [0051.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0051.514] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.514] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5088) returned 1 [0051.514] CloseHandle (hObject=0x1c0) returned 1 [0051.515] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0051.515] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.515] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3130) returned 1 [0051.515] CloseHandle (hObject=0x1c0) returned 1 [0051.515] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0051.515] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.516] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5025) returned 1 [0051.516] CloseHandle (hObject=0x1c0) returned 1 [0051.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0051.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.516] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3118) returned 1 [0051.516] CloseHandle (hObject=0x1c0) returned 1 [0051.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0051.516] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.517] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4955) returned 1 [0051.517] CloseHandle (hObject=0x1c0) returned 1 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.517] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3081) returned 1 [0051.517] CloseHandle (hObject=0x1c0) returned 1 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.518] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3887) returned 1 [0051.518] CloseHandle (hObject=0x1c0) returned 1 [0051.518] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0051.518] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.518] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.521] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0051.521] CloseHandle (hObject=0x1c0) returned 1 [0051.521] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0051.521] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.522] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2820) returned 1 [0051.522] CloseHandle (hObject=0x1c0) returned 1 [0051.522] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0051.522] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.522] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6431) returned 1 [0051.523] CloseHandle (hObject=0x1c0) returned 1 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.523] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24557) returned 1 [0051.523] CloseHandle (hObject=0x1c0) returned 1 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.524] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5088) returned 1 [0051.524] CloseHandle (hObject=0x1c0) returned 1 [0051.524] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0051.524] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.525] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3130) returned 1 [0051.525] CloseHandle (hObject=0x1c0) returned 1 [0051.525] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0051.525] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.525] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.526] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5025) returned 1 [0051.526] CloseHandle (hObject=0x1c0) returned 1 [0051.526] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0051.526] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.526] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.527] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3118) returned 1 [0051.527] CloseHandle (hObject=0x1c0) returned 1 [0051.527] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0051.527] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.527] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.528] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4955) returned 1 [0051.528] CloseHandle (hObject=0x1c0) returned 1 [0051.528] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0051.528] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.528] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.529] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3081) returned 1 [0051.529] CloseHandle (hObject=0x1c0) returned 1 [0051.529] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0051.529] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.530] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.531] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=45199) returned 1 [0051.531] CloseHandle (hObject=0x1c0) returned 1 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.531] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.531] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3122) returned 1 [0051.531] CloseHandle (hObject=0x1c0) returned 1 [0051.532] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0051.532] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.532] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1400) returned 1 [0051.532] CloseHandle (hObject=0x1c0) returned 1 [0051.532] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0051.532] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.533] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=35858) returned 1 [0051.533] CloseHandle (hObject=0x1c0) returned 1 [0051.533] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0051.533] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.533] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.241] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=194963) returned 1 [0052.241] CloseHandle (hObject=0x1a8) returned 1 [0052.242] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0052.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.343] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=629220) returned 1 [0052.343] CloseHandle (hObject=0x1f0) returned 1 [0052.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0052.343] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.343] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.343] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6716) returned 1 [0052.344] CloseHandle (hObject=0x1f0) returned 1 [0052.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0052.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.344] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.344] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12008) returned 1 [0052.344] CloseHandle (hObject=0x1f0) returned 1 [0052.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0052.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.344] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.345] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=237226) returned 1 [0052.345] CloseHandle (hObject=0x1f0) returned 1 [0052.345] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0052.345] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.345] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.346] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=253220) returned 1 [0052.346] CloseHandle (hObject=0x1f0) returned 1 [0052.346] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0052.346] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.346] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.347] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=789322) returned 1 [0052.347] CloseHandle (hObject=0x1f0) returned 1 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.347] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.347] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=869322) returned 1 [0052.347] CloseHandle (hObject=0x1f0) returned 1 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.348] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.348] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3016) returned 1 [0052.348] CloseHandle (hObject=0x1f0) returned 1 [0052.348] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0052.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.349] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.349] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1849) returned 1 [0052.349] CloseHandle (hObject=0x1f0) returned 1 [0052.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0052.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.349] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.350] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3016) returned 1 [0052.350] CloseHandle (hObject=0x1f0) returned 1 [0052.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0052.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.350] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.350] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2041) returned 1 [0052.350] CloseHandle (hObject=0x1f0) returned 1 [0052.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0052.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.351] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.351] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2891) returned 1 [0052.351] CloseHandle (hObject=0x1f0) returned 1 [0052.351] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0052.351] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.352] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3016) returned 1 [0052.352] CloseHandle (hObject=0x1f0) returned 1 [0052.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0052.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.352] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2019) returned 1 [0052.352] CloseHandle (hObject=0x1f0) returned 1 [0052.353] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0052.353] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.353] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=13239) returned 1 [0052.353] CloseHandle (hObject=0x1f0) returned 1 [0052.353] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0052.353] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.353] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5761) returned 1 [0052.354] CloseHandle (hObject=0x1f0) returned 1 [0052.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0052.354] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.354] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.355] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8169) returned 1 [0052.355] CloseHandle (hObject=0x1f0) returned 1 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.355] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=25662) returned 1 [0052.355] CloseHandle (hObject=0x1f0) returned 1 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.356] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6166) returned 1 [0052.356] CloseHandle (hObject=0x1f0) returned 1 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.356] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7946) returned 1 [0052.356] CloseHandle (hObject=0x1f0) returned 1 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.357] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4422) returned 1 [0052.357] CloseHandle (hObject=0x1f0) returned 1 [0052.357] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0052.357] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.358] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7888) returned 1 [0052.358] CloseHandle (hObject=0x1f0) returned 1 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.358] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16842) returned 1 [0052.358] CloseHandle (hObject=0x1f0) returned 1 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.359] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=253226) returned 1 [0052.359] CloseHandle (hObject=0x1f0) returned 1 [0052.359] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0052.359] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.360] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=261220) returned 1 [0052.360] CloseHandle (hObject=0x1f0) returned 1 [0052.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0052.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.360] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=797322) returned 1 [0052.360] CloseHandle (hObject=0x1f0) returned 1 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.361] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.361] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=869322) returned 1 [0052.361] CloseHandle (hObject=0x1f0) returned 1 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0052.361] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.361] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.361] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=933322) returned 1 [0052.362] CloseHandle (hObject=0x1f0) returned 1 [0052.362] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0052.362] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.363] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=989322) returned 1 [0052.363] CloseHandle (hObject=0x1f0) returned 1 [0052.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0052.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.363] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5372) returned 1 [0052.363] CloseHandle (hObject=0x1f0) returned 1 [0052.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0052.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.364] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4724) returned 1 [0052.364] CloseHandle (hObject=0x1f0) returned 1 [0052.364] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0052.364] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.364] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4710) returned 1 [0052.364] CloseHandle (hObject=0x1f0) returned 1 [0052.364] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0052.364] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.368] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=22969) returned 1 [0052.368] CloseHandle (hObject=0x1f0) returned 1 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.368] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5647) returned 1 [0052.368] CloseHandle (hObject=0x1f0) returned 1 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.369] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3214) returned 1 [0052.369] CloseHandle (hObject=0x1f0) returned 1 [0052.369] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0052.369] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.369] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.370] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0052.370] CloseHandle (hObject=0x1f0) returned 1 [0052.370] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0052.370] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.370] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.370] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0052.370] CloseHandle (hObject=0x1f0) returned 1 [0052.373] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0052.373] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.373] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.373] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5088) returned 1 [0052.373] CloseHandle (hObject=0x1f0) returned 1 [0052.373] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0052.373] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.374] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3130) returned 1 [0052.374] CloseHandle (hObject=0x1f0) returned 1 [0052.374] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.374] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.374] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5025) returned 1 [0052.374] CloseHandle (hObject=0x1f0) returned 1 [0052.374] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0052.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.375] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.375] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3118) returned 1 [0052.375] CloseHandle (hObject=0x1f0) returned 1 [0052.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0052.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.375] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.375] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4955) returned 1 [0052.375] CloseHandle (hObject=0x1f0) returned 1 [0052.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0052.376] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.376] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.376] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3081) returned 1 [0052.376] CloseHandle (hObject=0x1f0) returned 1 [0052.376] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0052.376] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.376] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.376] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24066) returned 1 [0052.376] CloseHandle (hObject=0x1f0) returned 1 [0052.377] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0052.377] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.377] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2962) returned 1 [0052.377] CloseHandle (hObject=0x1f0) returned 1 [0052.377] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0052.377] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.377] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2928) returned 1 [0052.377] CloseHandle (hObject=0x1f0) returned 1 [0052.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0052.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.378] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.378] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3000) returned 1 [0052.378] CloseHandle (hObject=0x1f0) returned 1 [0052.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0052.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.378] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.379] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4570) returned 1 [0052.379] CloseHandle (hObject=0x1f0) returned 1 [0052.379] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0052.379] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.379] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.380] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6440) returned 1 [0052.380] CloseHandle (hObject=0x1f0) returned 1 [0052.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0052.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.684] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5072) returned 1 [0052.684] CloseHandle (hObject=0x160) returned 1 [0052.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0052.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.929] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5072) returned 1 [0052.929] CloseHandle (hObject=0x1f0) returned 1 [0052.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0052.929] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.930] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.684] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8509) returned 1 [0053.684] CloseHandle (hObject=0x1f0) returned 1 [0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.425] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30948) returned 1 [0054.425] CloseHandle (hObject=0x160) returned 1 [0054.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0054.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0054.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.959] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.959] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.000] GetLastError () returned 0x0 [0055.000] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0055.003] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0055.004] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.005] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.005] SetEndOfFile (hFile=0x1f8) returned 1 [0055.005] CloseHandle (hObject=0x1f8) returned 1 [0055.005] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.005] SetEndOfFile (hFile=0x160) returned 1 [0055.006] CloseHandle (hObject=0x160) returned 1 [0055.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0055.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.006] lstrlenW (lpString=".doc") returned 4 [0055.006] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString=".docx") returned 5 [0055.007] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0055.007] lstrlenW (lpString=".pdf") returned 4 [0055.007] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString=".xls") returned 4 [0055.007] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString=".xlsx") returned 5 [0055.007] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0055.007] lstrlenW (lpString=".ppt") returned 4 [0055.007] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString=".zip") returned 4 [0055.007] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.007] lstrlenW (lpString=".rar") returned 4 [0055.007] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString=".bz2") returned 4 [0055.007] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString=".7z") returned 3 [0055.007] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString=".dbf") returned 4 [0055.007] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString=".1cd") returned 4 [0055.007] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString=".jpg") returned 4 [0055.007] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.007] lstrlenW (lpString=".doc") returned 4 [0055.007] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString=".docx") returned 5 [0055.008] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0055.008] lstrlenW (lpString=".pdf") returned 4 [0055.008] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString=".xls") returned 4 [0055.008] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString=".xlsx") returned 5 [0055.008] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0055.008] lstrlenW (lpString=".ppt") returned 4 [0055.008] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.008] lstrlenW (lpString=".zip") returned 4 [0055.008] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.008] lstrlenW (lpString=".rar") returned 4 [0055.008] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString=".bz2") returned 4 [0055.008] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString=".7z") returned 3 [0055.008] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.008] lstrlenW (lpString=".dbf") returned 4 [0055.008] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.008] lstrlenW (lpString=".1cd") returned 4 [0055.008] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0055.008] lstrlenW (lpString=".jpg") returned 4 [0055.008] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.008] lstrcmpiW (lpString1=".xsl", lpString2=".zoh") returned -1 [0055.008] lstrlenW (lpString="sql70.xsl") returned 9 [0055.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.009] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32146) returned 1 [0055.009] CloseHandle (hObject=0x160) returned 1 [0055.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0055.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.010] GetLastError () returned 0x0 [0055.010] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0055.012] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0055.013] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.013] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.014] SetEndOfFile (hFile=0x1f8) returned 1 [0055.014] CloseHandle (hObject=0x1f8) returned 1 [0055.014] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.014] SetEndOfFile (hFile=0x160) returned 1 [0055.015] CloseHandle (hObject=0x160) returned 1 [0055.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0055.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.015] lstrlenW (lpString=".doc") returned 4 [0055.015] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.015] lstrlenW (lpString=".docx") returned 5 [0055.016] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.016] lstrlenW (lpString=".pdf") returned 4 [0055.016] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString=".xls") returned 4 [0055.016] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString=".xlsx") returned 5 [0055.016] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.016] lstrlenW (lpString=".ppt") returned 4 [0055.016] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.016] lstrlenW (lpString=".zip") returned 4 [0055.016] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.016] lstrlenW (lpString=".rar") returned 4 [0055.016] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString=".bz2") returned 4 [0055.016] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString=".7z") returned 3 [0055.016] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.016] lstrlenW (lpString=".dbf") returned 4 [0055.016] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.016] lstrlenW (lpString=".1cd") returned 4 [0055.016] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.016] lstrlenW (lpString=".jpg") returned 4 [0055.016] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.017] lstrlenW (lpString=".doc") returned 4 [0055.017] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString=".docx") returned 5 [0055.017] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.017] lstrlenW (lpString=".pdf") returned 4 [0055.017] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString=".xls") returned 4 [0055.017] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString=".xlsx") returned 5 [0055.017] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.017] lstrlenW (lpString=".ppt") returned 4 [0055.017] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.017] lstrlenW (lpString=".zip") returned 4 [0055.017] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.017] lstrlenW (lpString=".rar") returned 4 [0055.017] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString=".bz2") returned 4 [0055.017] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString=".7z") returned 3 [0055.017] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.017] lstrlenW (lpString=".dbf") returned 4 [0055.017] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.017] lstrlenW (lpString=".1cd") returned 4 [0055.017] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0055.017] lstrlenW (lpString=".jpg") returned 4 [0055.017] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.018] lstrcmpiW (lpString1=".xsl", lpString2=".zoh") returned -1 [0055.018] lstrlenW (lpString="sql90.xsl") returned 9 [0055.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.018] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=39515) returned 1 [0055.018] CloseHandle (hObject=0x160) returned 1 [0055.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0055.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.018] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.018] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.019] GetLastError () returned 0x0 [0055.019] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0055.029] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0055.031] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.031] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.031] SetEndOfFile (hFile=0x1f8) returned 1 [0055.031] CloseHandle (hObject=0x1f8) returned 1 [0055.031] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.031] SetEndOfFile (hFile=0x160) returned 1 [0055.032] CloseHandle (hObject=0x160) returned 1 [0055.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.033] lstrlenW (lpString=".doc") returned 4 [0055.033] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.033] lstrlenW (lpString=".docx") returned 5 [0055.033] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.033] lstrlenW (lpString=".pdf") returned 4 [0055.033] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.033] lstrlenW (lpString=".xls") returned 4 [0055.033] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.033] lstrlenW (lpString=".xlsx") returned 5 [0055.033] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.033] lstrlenW (lpString=".ppt") returned 4 [0055.033] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.033] lstrlenW (lpString=".zip") returned 4 [0055.033] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.033] lstrlenW (lpString=".rar") returned 4 [0055.034] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString=".bz2") returned 4 [0055.034] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString=".7z") returned 3 [0055.034] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString=".dbf") returned 4 [0055.034] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString=".1cd") returned 4 [0055.034] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString=".jpg") returned 4 [0055.034] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString=".doc") returned 4 [0055.034] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString=".docx") returned 5 [0055.034] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0055.034] lstrlenW (lpString=".pdf") returned 4 [0055.034] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString=".xls") returned 4 [0055.034] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString=".xlsx") returned 5 [0055.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0055.034] lstrlenW (lpString=".ppt") returned 4 [0055.034] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.034] lstrlenW (lpString=".zip") returned 4 [0055.034] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.035] lstrlenW (lpString=".rar") returned 4 [0055.035] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.035] lstrlenW (lpString=".bz2") returned 4 [0055.035] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.035] lstrlenW (lpString=".7z") returned 3 [0055.035] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.035] lstrlenW (lpString=".dbf") returned 4 [0055.035] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.035] lstrlenW (lpString=".1cd") returned 4 [0055.035] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0055.035] lstrlenW (lpString=".jpg") returned 4 [0055.035] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.035] lstrcmpiW (lpString1=".xsl", lpString2=".zoh") returned -1 [0055.035] lstrlenW (lpString="Sybase.xsl") returned 10 [0055.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.199] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29790) returned 1 [0055.199] CloseHandle (hObject=0x1a8) returned 1 [0055.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0055.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0055.199] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.199] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.199] GetLastError () returned 0x0 [0055.200] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x745e, lpOverlapped=0x0) returned 1 [0055.204] WriteFile (in: hFile=0x21c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0055.205] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.206] WriteFile (in: hFile=0x21c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0055.206] SetEndOfFile (hFile=0x21c) returned 1 [0055.206] CloseHandle (hObject=0x21c) returned 1 [0055.206] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.206] SetEndOfFile (hFile=0x1a8) returned 1 [0055.207] CloseHandle (hObject=0x1a8) returned 1 [0055.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.207] lstrlenW (lpString=".doc") returned 4 [0055.207] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.207] lstrlenW (lpString=".docx") returned 5 [0055.208] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0055.208] lstrlenW (lpString=".pdf") returned 4 [0055.208] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString=".xls") returned 4 [0055.208] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString=".xlsx") returned 5 [0055.208] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0055.208] lstrlenW (lpString=".ppt") returned 4 [0055.208] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString=".zip") returned 4 [0055.208] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.208] lstrlenW (lpString=".rar") returned 4 [0055.208] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString=".bz2") returned 4 [0055.208] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString=".7z") returned 3 [0055.208] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString=".dbf") returned 4 [0055.208] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString=".1cd") returned 4 [0055.208] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString=".jpg") returned 4 [0055.208] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.208] lstrlenW (lpString=".doc") returned 4 [0055.208] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0055.208] lstrlenW (lpString=".docx") returned 5 [0055.208] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0055.209] lstrlenW (lpString=".pdf") returned 4 [0055.209] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString=".xls") returned 4 [0055.209] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString=".xlsx") returned 5 [0055.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0055.209] lstrlenW (lpString=".ppt") returned 4 [0055.209] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.209] lstrlenW (lpString=".zip") returned 4 [0055.209] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0055.209] lstrlenW (lpString=".rar") returned 4 [0055.209] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString=".bz2") returned 4 [0055.209] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString=".7z") returned 3 [0055.209] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.209] lstrlenW (lpString=".dbf") returned 4 [0055.209] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.209] lstrlenW (lpString=".1cd") returned 4 [0055.209] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0055.209] lstrlenW (lpString=".jpg") returned 4 [0055.209] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0055.209] lstrcmpiW (lpString1=".GIF", lpString2=".zoh") returned -1 [0055.209] lstrlenW (lpString="AG00004_.GIF") returned 12 [0055.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.212] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9024) returned 1 [0055.212] CloseHandle (hObject=0x21c) returned 1 [0055.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0055.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.212] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.212] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.212] GetLastError () returned 0x0 [0055.213] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2340, lpOverlapped=0x0) returned 1 [0055.214] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0055.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.215] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.215] SetEndOfFile (hFile=0x1f8) returned 1 [0055.215] CloseHandle (hObject=0x1f8) returned 1 [0055.216] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.216] SetEndOfFile (hFile=0x21c) returned 1 [0055.216] CloseHandle (hObject=0x21c) returned 1 [0055.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0055.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.217] lstrlenW (lpString=".doc") returned 4 [0055.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.217] lstrlenW (lpString=".docx") returned 5 [0055.217] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.217] lstrlenW (lpString=".pdf") returned 4 [0055.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.217] lstrlenW (lpString=".xls") returned 4 [0055.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.217] lstrlenW (lpString=".xlsx") returned 5 [0055.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.217] lstrlenW (lpString=".ppt") returned 4 [0055.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.217] lstrlenW (lpString=".zip") returned 4 [0055.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.217] lstrlenW (lpString=".rar") returned 4 [0055.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.217] lstrlenW (lpString=".bz2") returned 4 [0055.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.218] lstrlenW (lpString=".7z") returned 3 [0055.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString=".dbf") returned 4 [0055.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString=".1cd") returned 4 [0055.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString=".jpg") returned 4 [0055.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString=".doc") returned 4 [0055.218] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.218] lstrlenW (lpString=".docx") returned 5 [0055.218] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.218] lstrlenW (lpString=".pdf") returned 4 [0055.218] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString=".xls") returned 4 [0055.218] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString=".xlsx") returned 5 [0055.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.218] lstrlenW (lpString=".ppt") returned 4 [0055.218] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.218] lstrlenW (lpString=".zip") returned 4 [0055.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString=".rar") returned 4 [0055.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.218] lstrlenW (lpString=".bz2") returned 4 [0055.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.219] lstrlenW (lpString=".7z") returned 3 [0055.219] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.219] lstrlenW (lpString=".dbf") returned 4 [0055.219] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.219] lstrlenW (lpString=".1cd") returned 4 [0055.219] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0055.219] lstrlenW (lpString=".jpg") returned 4 [0055.219] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.219] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7216) returned 1 [0055.219] CloseHandle (hObject=0x21c) returned 1 [0055.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0055.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.220] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.220] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.220] GetLastError () returned 0x0 [0055.220] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0055.222] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0055.223] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.223] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.223] SetEndOfFile (hFile=0x1f8) returned 1 [0055.223] CloseHandle (hObject=0x1f8) returned 1 [0055.223] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.224] SetEndOfFile (hFile=0x21c) returned 1 [0055.224] CloseHandle (hObject=0x21c) returned 1 [0055.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.225] lstrlenW (lpString=".doc") returned 4 [0055.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.225] lstrlenW (lpString=".docx") returned 5 [0055.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.225] lstrlenW (lpString=".pdf") returned 4 [0055.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.225] lstrlenW (lpString=".xls") returned 4 [0055.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.225] lstrlenW (lpString=".xlsx") returned 5 [0055.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.225] lstrlenW (lpString=".ppt") returned 4 [0055.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.225] lstrlenW (lpString=".zip") returned 4 [0055.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.225] lstrlenW (lpString=".rar") returned 4 [0055.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.225] lstrlenW (lpString=".bz2") returned 4 [0055.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.225] lstrlenW (lpString=".7z") returned 3 [0055.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.225] lstrlenW (lpString=".dbf") returned 4 [0055.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.226] lstrlenW (lpString=".1cd") returned 4 [0055.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0055.226] lstrlenW (lpString=".jpg") returned 4 [0055.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.226] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14873) returned 1 [0055.226] CloseHandle (hObject=0x21c) returned 1 [0055.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0055.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.227] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.227] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.228] GetLastError () returned 0x0 [0055.228] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0055.232] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0055.233] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.233] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.234] SetEndOfFile (hFile=0x1f8) returned 1 [0055.234] CloseHandle (hObject=0x1f8) returned 1 [0055.234] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.234] SetEndOfFile (hFile=0x21c) returned 1 [0055.235] CloseHandle (hObject=0x21c) returned 1 [0055.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.235] lstrlenW (lpString=".doc") returned 4 [0055.235] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.235] lstrlenW (lpString=".docx") returned 5 [0055.235] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.235] lstrlenW (lpString=".pdf") returned 4 [0055.235] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.235] lstrlenW (lpString=".xls") returned 4 [0055.235] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.236] lstrlenW (lpString=".xlsx") returned 5 [0055.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.236] lstrlenW (lpString=".ppt") returned 4 [0055.236] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.236] lstrlenW (lpString=".zip") returned 4 [0055.236] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.236] lstrlenW (lpString=".rar") returned 4 [0055.236] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.236] lstrlenW (lpString=".bz2") returned 4 [0055.236] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.236] lstrlenW (lpString=".7z") returned 3 [0055.236] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.236] lstrlenW (lpString=".dbf") returned 4 [0055.236] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.236] lstrlenW (lpString=".1cd") returned 4 [0055.236] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0055.236] lstrlenW (lpString=".jpg") returned 4 [0055.236] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.236] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6684) returned 1 [0055.236] CloseHandle (hObject=0x21c) returned 1 [0055.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0055.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.237] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.237] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.237] GetLastError () returned 0x0 [0055.237] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0055.239] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0055.240] ReadFile (in: hFile=0x21c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.240] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.240] SetEndOfFile (hFile=0x1f8) returned 1 [0055.240] CloseHandle (hObject=0x1f8) returned 1 [0055.240] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.240] SetEndOfFile (hFile=0x21c) returned 1 [0055.241] CloseHandle (hObject=0x21c) returned 1 [0055.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0055.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.242] lstrlenW (lpString=".doc") returned 4 [0055.242] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.242] lstrlenW (lpString=".docx") returned 5 [0055.242] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.242] lstrlenW (lpString=".pdf") returned 4 [0055.242] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.242] lstrlenW (lpString=".xls") returned 4 [0055.242] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.242] lstrlenW (lpString=".xlsx") returned 5 [0055.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.242] lstrlenW (lpString=".ppt") returned 4 [0055.242] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.242] lstrlenW (lpString=".zip") returned 4 [0055.242] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.242] lstrlenW (lpString=".rar") returned 4 [0055.242] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.242] lstrlenW (lpString=".bz2") returned 4 [0055.242] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.242] lstrlenW (lpString=".7z") returned 3 [0055.242] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.242] lstrlenW (lpString=".dbf") returned 4 [0055.242] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.243] lstrlenW (lpString=".1cd") returned 4 [0055.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0055.243] lstrlenW (lpString=".jpg") returned 4 [0055.243] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.313] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3251) returned 1 [0055.313] CloseHandle (hObject=0x1ec) returned 1 [0055.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0055.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.319] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.325] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0055.331] GetLastError () returned 0x0 [0055.331] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0055.332] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0055.333] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.333] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.333] SetEndOfFile (hFile=0x1f8) returned 1 [0055.333] CloseHandle (hObject=0x1f8) returned 1 [0055.333] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.333] SetEndOfFile (hFile=0x1ec) returned 1 [0055.334] CloseHandle (hObject=0x1ec) returned 1 [0055.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString=".doc") returned 4 [0055.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.335] lstrlenW (lpString=".docx") returned 5 [0055.335] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.335] lstrlenW (lpString=".pdf") returned 4 [0055.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.335] lstrlenW (lpString=".xls") returned 4 [0055.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.335] lstrlenW (lpString=".xlsx") returned 5 [0055.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.335] lstrlenW (lpString=".ppt") returned 4 [0055.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString=".zip") returned 4 [0055.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.335] lstrlenW (lpString=".rar") returned 4 [0055.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.335] lstrlenW (lpString=".bz2") returned 4 [0055.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.335] lstrlenW (lpString=".7z") returned 3 [0055.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString=".dbf") returned 4 [0055.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString=".1cd") returned 4 [0055.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0055.335] lstrlenW (lpString=".jpg") returned 4 [0055.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.336] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10607) returned 1 [0055.336] CloseHandle (hObject=0x160) returned 1 [0055.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0055.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.337] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.337] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.337] GetLastError () returned 0x0 [0055.337] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x296f, lpOverlapped=0x0) returned 1 [0055.339] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0055.340] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.340] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.340] SetEndOfFile (hFile=0x1ec) returned 1 [0055.340] CloseHandle (hObject=0x1ec) returned 1 [0055.340] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.340] SetEndOfFile (hFile=0x160) returned 1 [0055.341] CloseHandle (hObject=0x160) returned 1 [0055.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0055.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.341] lstrlenW (lpString=".doc") returned 4 [0055.341] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.341] lstrlenW (lpString=".docx") returned 5 [0055.341] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.341] lstrlenW (lpString=".pdf") returned 4 [0055.342] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".xls") returned 4 [0055.342] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".xlsx") returned 5 [0055.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.342] lstrlenW (lpString=".ppt") returned 4 [0055.342] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.342] lstrlenW (lpString=".zip") returned 4 [0055.342] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".rar") returned 4 [0055.342] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".bz2") returned 4 [0055.342] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.342] lstrlenW (lpString=".7z") returned 3 [0055.342] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.342] lstrlenW (lpString=".dbf") returned 4 [0055.342] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.342] lstrlenW (lpString=".1cd") returned 4 [0055.342] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.342] lstrlenW (lpString=".jpg") returned 4 [0055.342] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.342] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15308) returned 1 [0055.342] CloseHandle (hObject=0x160) returned 1 [0055.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0055.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.343] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.343] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.343] GetLastError () returned 0x0 [0055.343] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0055.345] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0055.346] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.346] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.346] SetEndOfFile (hFile=0x1ec) returned 1 [0055.347] CloseHandle (hObject=0x1ec) returned 1 [0055.347] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.347] SetEndOfFile (hFile=0x160) returned 1 [0055.347] CloseHandle (hObject=0x160) returned 1 [0055.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0055.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.348] lstrlenW (lpString=".doc") returned 4 [0055.348] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.348] lstrlenW (lpString=".docx") returned 5 [0055.348] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.348] lstrlenW (lpString=".pdf") returned 4 [0055.348] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.348] lstrlenW (lpString=".xls") returned 4 [0055.348] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.348] lstrlenW (lpString=".xlsx") returned 5 [0055.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.348] lstrlenW (lpString=".ppt") returned 4 [0055.348] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.348] lstrlenW (lpString=".zip") returned 4 [0055.348] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.348] lstrlenW (lpString=".rar") returned 4 [0055.348] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.348] lstrlenW (lpString=".bz2") returned 4 [0055.349] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString=".7z") returned 3 [0055.349] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.349] lstrlenW (lpString=".dbf") returned 4 [0055.349] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.349] lstrlenW (lpString=".1cd") returned 4 [0055.349] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0055.349] lstrlenW (lpString=".jpg") returned 4 [0055.349] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.349] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5315) returned 1 [0055.349] CloseHandle (hObject=0x160) returned 1 [0055.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0055.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.349] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.350] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.350] GetLastError () returned 0x0 [0055.350] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0055.352] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0055.353] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.353] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.353] SetEndOfFile (hFile=0x1ec) returned 1 [0055.353] CloseHandle (hObject=0x1ec) returned 1 [0055.353] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.353] SetEndOfFile (hFile=0x160) returned 1 [0055.354] CloseHandle (hObject=0x160) returned 1 [0055.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0055.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.354] lstrlenW (lpString=".doc") returned 4 [0055.354] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.354] lstrlenW (lpString=".docx") returned 5 [0055.354] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.354] lstrlenW (lpString=".pdf") returned 4 [0055.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.355] lstrlenW (lpString=".xls") returned 4 [0055.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.355] lstrlenW (lpString=".xlsx") returned 5 [0055.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.355] lstrlenW (lpString=".ppt") returned 4 [0055.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.355] lstrlenW (lpString=".zip") returned 4 [0055.355] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.355] lstrlenW (lpString=".rar") returned 4 [0055.355] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.355] lstrlenW (lpString=".bz2") returned 4 [0055.355] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.355] lstrlenW (lpString=".7z") returned 3 [0055.355] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.355] lstrlenW (lpString=".dbf") returned 4 [0055.355] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.355] lstrlenW (lpString=".1cd") returned 4 [0055.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0055.355] lstrlenW (lpString=".jpg") returned 4 [0055.355] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.355] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4955) returned 1 [0055.356] CloseHandle (hObject=0x160) returned 1 [0055.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0055.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.356] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.356] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.356] GetLastError () returned 0x0 [0055.356] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x135b, lpOverlapped=0x0) returned 1 [0055.392] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0055.393] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.393] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.393] SetEndOfFile (hFile=0x1ec) returned 1 [0055.394] CloseHandle (hObject=0x1ec) returned 1 [0055.394] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.394] SetEndOfFile (hFile=0x160) returned 1 [0055.395] CloseHandle (hObject=0x160) returned 1 [0055.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0055.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.395] lstrlenW (lpString=".doc") returned 4 [0055.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.395] lstrlenW (lpString=".docx") returned 5 [0055.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.395] lstrlenW (lpString=".pdf") returned 4 [0055.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.395] lstrlenW (lpString=".xls") returned 4 [0055.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.395] lstrlenW (lpString=".xlsx") returned 5 [0055.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.395] lstrlenW (lpString=".ppt") returned 4 [0055.395] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.395] lstrlenW (lpString=".zip") returned 4 [0055.395] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.395] lstrlenW (lpString=".rar") returned 4 [0055.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.396] lstrlenW (lpString=".bz2") returned 4 [0055.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.396] lstrlenW (lpString=".7z") returned 3 [0055.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.396] lstrlenW (lpString=".dbf") returned 4 [0055.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.396] lstrlenW (lpString=".1cd") returned 4 [0055.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0055.396] lstrlenW (lpString=".jpg") returned 4 [0055.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.396] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5030) returned 1 [0055.396] CloseHandle (hObject=0x160) returned 1 [0055.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0055.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.397] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.397] GetLastError () returned 0x0 [0055.397] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0055.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0055.399] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.399] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.400] SetEndOfFile (hFile=0x1ec) returned 1 [0055.400] CloseHandle (hObject=0x1ec) returned 1 [0055.400] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.400] SetEndOfFile (hFile=0x160) returned 1 [0055.401] CloseHandle (hObject=0x160) returned 1 [0055.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0055.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0055.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.401] lstrlenW (lpString=".doc") returned 4 [0055.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.401] lstrlenW (lpString=".docx") returned 5 [0055.401] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.401] lstrlenW (lpString=".pdf") returned 4 [0055.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.401] lstrlenW (lpString=".xls") returned 4 [0055.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.401] lstrlenW (lpString=".xlsx") returned 5 [0055.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.401] lstrlenW (lpString=".ppt") returned 4 [0055.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.401] lstrlenW (lpString=".zip") returned 4 [0055.401] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.402] lstrlenW (lpString=".rar") returned 4 [0055.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.402] lstrlenW (lpString=".bz2") returned 4 [0055.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.402] lstrlenW (lpString=".7z") returned 3 [0055.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.402] lstrlenW (lpString=".dbf") returned 4 [0055.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.402] lstrlenW (lpString=".1cd") returned 4 [0055.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0055.402] lstrlenW (lpString=".jpg") returned 4 [0055.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.402] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1146) returned 1 [0055.402] CloseHandle (hObject=0x160) returned 1 [0055.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0055.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0055.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0055.403] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.403] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.403] GetLastError () returned 0x0 [0055.403] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x47a, lpOverlapped=0x0) returned 1 [0056.356] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x480, lpOverlapped=0x0) returned 1 [0056.357] ReadFile (in: hFile=0x160, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.357] SetEndOfFile (hFile=0x1ec) returned 1 [0056.357] CloseHandle (hObject=0x1ec) returned 1 [0056.357] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.357] SetEndOfFile (hFile=0x160) returned 1 [0056.358] CloseHandle (hObject=0x160) returned 1 [0056.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString=".doc") returned 4 [0056.595] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.595] lstrlenW (lpString=".docx") returned 5 [0056.595] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.595] lstrlenW (lpString=".pdf") returned 4 [0056.595] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.595] lstrlenW (lpString=".xls") returned 4 [0056.595] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.595] lstrlenW (lpString=".xlsx") returned 5 [0056.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.595] lstrlenW (lpString=".ppt") returned 4 [0056.595] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString=".zip") returned 4 [0056.595] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.595] lstrlenW (lpString=".rar") returned 4 [0056.595] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.595] lstrlenW (lpString=".bz2") returned 4 [0056.595] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.595] lstrlenW (lpString=".7z") returned 3 [0056.595] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString=".dbf") returned 4 [0056.595] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString=".1cd") returned 4 [0056.595] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.595] lstrlenW (lpString=".jpg") returned 4 [0056.595] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.736] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14428) returned 1 [0056.736] CloseHandle (hObject=0x190) returned 1 [0056.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0056.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.737] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.737] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.737] GetLastError () returned 0x0 [0056.737] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x385c, lpOverlapped=0x0) returned 1 [0056.773] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0056.780] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.780] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.780] SetEndOfFile (hFile=0x160) returned 1 [0056.780] CloseHandle (hObject=0x160) returned 1 [0056.780] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.780] SetEndOfFile (hFile=0x190) returned 1 [0056.781] CloseHandle (hObject=0x190) returned 1 [0056.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0056.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.782] lstrlenW (lpString=".doc") returned 4 [0056.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString=".docx") returned 5 [0056.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.782] lstrlenW (lpString=".pdf") returned 4 [0056.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString=".xls") returned 4 [0056.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.782] lstrlenW (lpString=".xlsx") returned 5 [0056.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.782] lstrlenW (lpString=".ppt") returned 4 [0056.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.782] lstrlenW (lpString=".zip") returned 4 [0056.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.782] lstrlenW (lpString=".rar") returned 4 [0056.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString=".bz2") returned 4 [0056.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString=".7z") returned 3 [0056.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.782] lstrlenW (lpString=".dbf") returned 4 [0056.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.782] lstrlenW (lpString=".1cd") returned 4 [0056.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0056.783] lstrlenW (lpString=".jpg") returned 4 [0056.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.783] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7072) returned 1 [0056.783] CloseHandle (hObject=0x190) returned 1 [0056.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0056.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.783] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.783] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.784] GetLastError () returned 0x0 [0056.784] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0056.797] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0056.798] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.798] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.798] SetEndOfFile (hFile=0x160) returned 1 [0056.798] CloseHandle (hObject=0x160) returned 1 [0056.798] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.798] SetEndOfFile (hFile=0x190) returned 1 [0056.799] CloseHandle (hObject=0x190) returned 1 [0056.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0056.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.799] lstrlenW (lpString=".doc") returned 4 [0056.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString=".docx") returned 5 [0056.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.800] lstrlenW (lpString=".pdf") returned 4 [0056.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString=".xls") returned 4 [0056.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.800] lstrlenW (lpString=".xlsx") returned 5 [0056.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.800] lstrlenW (lpString=".ppt") returned 4 [0056.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.800] lstrlenW (lpString=".zip") returned 4 [0056.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.800] lstrlenW (lpString=".rar") returned 4 [0056.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString=".bz2") returned 4 [0056.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString=".7z") returned 3 [0056.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.800] lstrlenW (lpString=".dbf") returned 4 [0056.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.800] lstrlenW (lpString=".1cd") returned 4 [0056.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0056.800] lstrlenW (lpString=".jpg") returned 4 [0056.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.801] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3344) returned 1 [0056.801] CloseHandle (hObject=0x190) returned 1 [0056.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0056.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.801] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.801] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.804] GetLastError () returned 0x0 [0056.804] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd10, lpOverlapped=0x0) returned 1 [0056.835] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0056.836] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.836] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.836] SetEndOfFile (hFile=0x160) returned 1 [0056.836] CloseHandle (hObject=0x160) returned 1 [0056.837] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.837] SetEndOfFile (hFile=0x190) returned 1 [0056.837] CloseHandle (hObject=0x190) returned 1 [0056.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.838] lstrlenW (lpString=".doc") returned 4 [0056.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".docx") returned 5 [0056.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.838] lstrlenW (lpString=".pdf") returned 4 [0056.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".xls") returned 4 [0056.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.838] lstrlenW (lpString=".xlsx") returned 5 [0056.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.838] lstrlenW (lpString=".ppt") returned 4 [0056.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.838] lstrlenW (lpString=".zip") returned 4 [0056.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.838] lstrlenW (lpString=".rar") returned 4 [0056.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".bz2") returned 4 [0056.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".7z") returned 3 [0056.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.839] lstrlenW (lpString=".dbf") returned 4 [0056.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.839] lstrlenW (lpString=".1cd") returned 4 [0056.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0056.839] lstrlenW (lpString=".jpg") returned 4 [0056.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.839] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1596) returned 1 [0056.839] CloseHandle (hObject=0x190) returned 1 [0056.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0056.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.839] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.839] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.840] GetLastError () returned 0x0 [0056.840] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x63c, lpOverlapped=0x0) returned 1 [0056.841] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x640, lpOverlapped=0x0) returned 1 [0056.842] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.842] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.843] SetEndOfFile (hFile=0x160) returned 1 [0056.843] CloseHandle (hObject=0x160) returned 1 [0056.843] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.843] SetEndOfFile (hFile=0x190) returned 1 [0056.844] CloseHandle (hObject=0x190) returned 1 [0056.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.844] lstrlenW (lpString=".doc") returned 4 [0056.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".docx") returned 5 [0056.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.844] lstrlenW (lpString=".pdf") returned 4 [0056.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".xls") returned 4 [0056.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.844] lstrlenW (lpString=".xlsx") returned 5 [0056.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.844] lstrlenW (lpString=".ppt") returned 4 [0056.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.844] lstrlenW (lpString=".zip") returned 4 [0056.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.844] lstrlenW (lpString=".rar") returned 4 [0056.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString=".bz2") returned 4 [0056.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString=".7z") returned 3 [0056.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.845] lstrlenW (lpString=".dbf") returned 4 [0056.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.845] lstrlenW (lpString=".1cd") returned 4 [0056.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0056.845] lstrlenW (lpString=".jpg") returned 4 [0056.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.846] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7968) returned 1 [0056.846] CloseHandle (hObject=0x190) returned 1 [0056.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0056.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.846] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.846] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.846] GetLastError () returned 0x0 [0056.847] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0056.848] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0056.849] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.849] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.849] SetEndOfFile (hFile=0x160) returned 1 [0056.849] CloseHandle (hObject=0x160) returned 1 [0056.849] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.849] SetEndOfFile (hFile=0x190) returned 1 [0056.850] CloseHandle (hObject=0x190) returned 1 [0056.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString=".doc") returned 4 [0056.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".docx") returned 5 [0056.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.851] lstrlenW (lpString=".pdf") returned 4 [0056.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".xls") returned 4 [0056.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.851] lstrlenW (lpString=".xlsx") returned 5 [0056.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.851] lstrlenW (lpString=".ppt") returned 4 [0056.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString=".zip") returned 4 [0056.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.851] lstrlenW (lpString=".rar") returned 4 [0056.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".bz2") returned 4 [0056.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".7z") returned 3 [0056.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString=".dbf") returned 4 [0056.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString=".1cd") returned 4 [0056.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0056.851] lstrlenW (lpString=".jpg") returned 4 [0056.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.852] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1832) returned 1 [0056.852] CloseHandle (hObject=0x190) returned 1 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.852] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.852] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0056.852] GetLastError () returned 0x0 [0056.852] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x728, lpOverlapped=0x0) returned 1 [0056.917] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x730, lpOverlapped=0x0) returned 1 [0056.918] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.918] WriteFile (in: hFile=0x160, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.918] SetEndOfFile (hFile=0x160) returned 1 [0056.965] CloseHandle (hObject=0x160) returned 1 [0056.986] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.986] SetEndOfFile (hFile=0x190) returned 1 [0056.987] CloseHandle (hObject=0x190) returned 1 [0056.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0057.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.110] lstrlenW (lpString=".doc") returned 4 [0057.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.110] lstrlenW (lpString=".docx") returned 5 [0057.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.110] lstrlenW (lpString=".pdf") returned 4 [0057.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.110] lstrlenW (lpString=".xls") returned 4 [0057.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.110] lstrlenW (lpString=".xlsx") returned 5 [0057.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.110] lstrlenW (lpString=".ppt") returned 4 [0057.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.111] lstrlenW (lpString=".zip") returned 4 [0057.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.111] lstrlenW (lpString=".rar") returned 4 [0057.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.111] lstrlenW (lpString=".bz2") returned 4 [0057.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.111] lstrlenW (lpString=".7z") returned 3 [0057.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.111] lstrlenW (lpString=".dbf") returned 4 [0057.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.111] lstrlenW (lpString=".1cd") returned 4 [0057.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0057.111] lstrlenW (lpString=".jpg") returned 4 [0057.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.086] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5836) returned 1 [0058.086] CloseHandle (hObject=0x1bc) returned 1 [0058.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0058.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.108] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.115] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.115] GetLastError () returned 0x0 [0058.115] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0058.119] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.119] SetEndOfFile (hFile=0x214) returned 1 [0058.119] CloseHandle (hObject=0x214) returned 1 [0058.119] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.119] SetEndOfFile (hFile=0x1bc) returned 1 [0058.120] CloseHandle (hObject=0x1bc) returned 1 [0058.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.120] lstrlenW (lpString=".doc") returned 4 [0058.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.120] lstrlenW (lpString=".docx") returned 5 [0058.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.120] lstrlenW (lpString=".pdf") returned 4 [0058.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.120] lstrlenW (lpString=".xls") returned 4 [0058.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.120] lstrlenW (lpString=".xlsx") returned 5 [0058.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.121] lstrlenW (lpString=".ppt") returned 4 [0058.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.121] lstrlenW (lpString=".zip") returned 4 [0058.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.121] lstrlenW (lpString=".rar") returned 4 [0058.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.121] lstrlenW (lpString=".bz2") returned 4 [0058.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.121] lstrlenW (lpString=".7z") returned 3 [0058.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.121] lstrlenW (lpString=".dbf") returned 4 [0058.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.121] lstrlenW (lpString=".1cd") returned 4 [0058.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".jpg") returned 4 [0058.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".doc") returned 4 [0058.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString=".docx") returned 5 [0058.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.122] lstrlenW (lpString=".pdf") returned 4 [0058.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString=".xls") returned 4 [0058.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.122] lstrlenW (lpString=".xlsx") returned 5 [0058.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.122] lstrlenW (lpString=".ppt") returned 4 [0058.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".zip") returned 4 [0058.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.122] lstrlenW (lpString=".rar") returned 4 [0058.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString=".bz2") returned 4 [0058.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString=".7z") returned 3 [0058.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".dbf") returned 4 [0058.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".1cd") returned 4 [0058.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.122] lstrlenW (lpString=".jpg") returned 4 [0058.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.123] @NlsCompareInvariantNoCase@16 () [0058.123] lstrlenW (lpString="AN04332_.WMF") returned 12 [0058.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.123] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4296) returned 1 [0058.123] CloseHandle (hObject=0x1bc) returned 1 [0058.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0058.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.124] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.124] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.124] GetLastError () returned 0x0 [0058.124] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0058.126] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0058.130] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.130] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.130] SetEndOfFile (hFile=0x214) returned 1 [0058.130] CloseHandle (hObject=0x214) returned 1 [0058.131] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.131] SetEndOfFile (hFile=0x1bc) returned 1 [0058.131] CloseHandle (hObject=0x1bc) returned 1 [0058.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0058.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.132] lstrlenW (lpString=".doc") returned 4 [0058.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.132] lstrlenW (lpString=".docx") returned 5 [0058.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.132] lstrlenW (lpString=".pdf") returned 4 [0058.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.132] lstrlenW (lpString=".xls") returned 4 [0058.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.132] lstrlenW (lpString=".xlsx") returned 5 [0058.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.132] lstrlenW (lpString=".ppt") returned 4 [0058.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.132] lstrlenW (lpString=".zip") returned 4 [0058.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.132] lstrlenW (lpString=".rar") returned 4 [0058.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.132] lstrlenW (lpString=".bz2") returned 4 [0058.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.132] lstrlenW (lpString=".7z") returned 3 [0058.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.132] lstrlenW (lpString=".dbf") returned 4 [0058.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString=".1cd") returned 4 [0058.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString=".jpg") returned 4 [0058.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString=".doc") returned 4 [0058.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString=".docx") returned 5 [0058.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.133] lstrlenW (lpString=".pdf") returned 4 [0058.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString=".xls") returned 4 [0058.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.133] lstrlenW (lpString=".xlsx") returned 5 [0058.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.133] lstrlenW (lpString=".ppt") returned 4 [0058.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString=".zip") returned 4 [0058.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.133] lstrlenW (lpString=".rar") returned 4 [0058.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString=".bz2") returned 4 [0058.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.133] lstrlenW (lpString=".7z") returned 3 [0058.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.133] lstrlenW (lpString=".dbf") returned 4 [0058.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.134] lstrlenW (lpString=".1cd") returned 4 [0058.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0058.134] lstrlenW (lpString=".jpg") returned 4 [0058.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.134] @NlsCompareInvariantNoCase@16 () [0058.134] lstrlenW (lpString="AN04355_.WMF") returned 12 [0058.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.134] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3228) returned 1 [0058.134] CloseHandle (hObject=0x1bc) returned 1 [0058.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0058.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.134] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.134] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.135] GetLastError () returned 0x0 [0058.135] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0058.144] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0058.145] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.145] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.146] SetEndOfFile (hFile=0x214) returned 1 [0058.146] CloseHandle (hObject=0x214) returned 1 [0058.146] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.146] SetEndOfFile (hFile=0x1bc) returned 1 [0058.147] CloseHandle (hObject=0x1bc) returned 1 [0058.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0058.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.147] lstrlenW (lpString=".doc") returned 4 [0058.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.147] lstrlenW (lpString=".docx") returned 5 [0058.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.147] lstrlenW (lpString=".pdf") returned 4 [0058.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.147] lstrlenW (lpString=".xls") returned 4 [0058.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.147] lstrlenW (lpString=".xlsx") returned 5 [0058.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.147] lstrlenW (lpString=".ppt") returned 4 [0058.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".zip") returned 4 [0058.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.148] lstrlenW (lpString=".rar") returned 4 [0058.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString=".bz2") returned 4 [0058.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString=".7z") returned 3 [0058.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".dbf") returned 4 [0058.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".1cd") returned 4 [0058.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".jpg") returned 4 [0058.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".doc") returned 4 [0058.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString=".docx") returned 5 [0058.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.148] lstrlenW (lpString=".pdf") returned 4 [0058.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString=".xls") returned 4 [0058.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.148] lstrlenW (lpString=".xlsx") returned 5 [0058.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.148] lstrlenW (lpString=".ppt") returned 4 [0058.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.148] lstrlenW (lpString=".zip") returned 4 [0058.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.149] lstrlenW (lpString=".rar") returned 4 [0058.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.149] lstrlenW (lpString=".bz2") returned 4 [0058.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.149] lstrlenW (lpString=".7z") returned 3 [0058.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.149] lstrlenW (lpString=".dbf") returned 4 [0058.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.149] lstrlenW (lpString=".1cd") returned 4 [0058.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0058.149] lstrlenW (lpString=".jpg") returned 4 [0058.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.149] @NlsCompareInvariantNoCase@16 () [0058.149] lstrlenW (lpString="AN04369_.WMF") returned 12 [0058.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.149] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4808) returned 1 [0058.149] CloseHandle (hObject=0x1bc) returned 1 [0058.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0058.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.150] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.150] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.150] GetLastError () returned 0x0 [0058.150] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0058.152] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0058.153] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.153] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.153] SetEndOfFile (hFile=0x214) returned 1 [0058.153] CloseHandle (hObject=0x214) returned 1 [0058.153] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.153] SetEndOfFile (hFile=0x1bc) returned 1 [0058.154] CloseHandle (hObject=0x1bc) returned 1 [0058.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString=".doc") returned 4 [0058.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString=".docx") returned 5 [0058.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.155] lstrlenW (lpString=".pdf") returned 4 [0058.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString=".xls") returned 4 [0058.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.155] lstrlenW (lpString=".xlsx") returned 5 [0058.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.155] lstrlenW (lpString=".ppt") returned 4 [0058.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString=".zip") returned 4 [0058.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.155] lstrlenW (lpString=".rar") returned 4 [0058.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString=".bz2") returned 4 [0058.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString=".7z") returned 3 [0058.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString=".dbf") returned 4 [0058.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString=".1cd") returned 4 [0058.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.155] lstrlenW (lpString=".jpg") returned 4 [0058.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString=".doc") returned 4 [0058.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString=".docx") returned 5 [0058.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.156] lstrlenW (lpString=".pdf") returned 4 [0058.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString=".xls") returned 4 [0058.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.156] lstrlenW (lpString=".xlsx") returned 5 [0058.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.156] lstrlenW (lpString=".ppt") returned 4 [0058.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString=".zip") returned 4 [0058.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.156] lstrlenW (lpString=".rar") returned 4 [0058.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString=".bz2") returned 4 [0058.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString=".7z") returned 3 [0058.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString=".dbf") returned 4 [0058.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString=".1cd") returned 4 [0058.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0058.156] lstrlenW (lpString=".jpg") returned 4 [0058.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.157] @NlsCompareInvariantNoCase@16 () [0058.157] lstrlenW (lpString="AN04384_.WMF") returned 12 [0058.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.157] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4996) returned 1 [0058.157] CloseHandle (hObject=0x1bc) returned 1 [0058.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0058.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.157] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.157] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.158] GetLastError () returned 0x0 [0058.158] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1384, lpOverlapped=0x0) returned 1 [0058.328] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0058.329] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.329] WriteFile (in: hFile=0x214, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.329] SetEndOfFile (hFile=0x214) returned 1 [0058.329] CloseHandle (hObject=0x214) returned 1 [0058.330] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.330] SetEndOfFile (hFile=0x1bc) returned 1 [0058.330] CloseHandle (hObject=0x1bc) returned 1 [0058.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0058.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.412] lstrlenW (lpString=".doc") returned 4 [0058.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.412] lstrlenW (lpString=".docx") returned 5 [0058.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.412] lstrlenW (lpString=".pdf") returned 4 [0058.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.412] lstrlenW (lpString=".xls") returned 4 [0058.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.419] lstrlenW (lpString=".xlsx") returned 5 [0058.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.419] lstrlenW (lpString=".ppt") returned 4 [0058.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.419] lstrlenW (lpString=".zip") returned 4 [0058.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.419] lstrlenW (lpString=".rar") returned 4 [0058.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.419] lstrlenW (lpString=".bz2") returned 4 [0058.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.426] lstrlenW (lpString=".7z") returned 3 [0058.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.426] lstrlenW (lpString=".dbf") returned 4 [0058.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.426] lstrlenW (lpString=".1cd") returned 4 [0058.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0058.426] lstrlenW (lpString=".jpg") returned 4 [0058.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) [0058.441] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=47786) returned 1 [0058.441] CloseHandle (hObject=0x1bc) returned 1 [0058.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0058.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.880] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.881] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0059.188] GetLastError () returned 0x0 [0059.188] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0059.356] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0059.358] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.358] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.358] SetEndOfFile (hFile=0x1bc) returned 1 [0059.358] CloseHandle (hObject=0x1bc) returned 1 [0059.358] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.358] SetEndOfFile (hFile=0x190) returned 1 [0059.359] CloseHandle (hObject=0x190) returned 1 [0059.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0059.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.371] lstrlenW (lpString=".doc") returned 4 [0059.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString=".docx") returned 5 [0059.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.371] lstrlenW (lpString=".pdf") returned 4 [0059.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString=".xls") returned 4 [0059.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.371] lstrlenW (lpString=".xlsx") returned 5 [0059.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.371] lstrlenW (lpString=".ppt") returned 4 [0059.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.371] lstrlenW (lpString=".zip") returned 4 [0059.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.371] lstrlenW (lpString=".rar") returned 4 [0059.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString=".bz2") returned 4 [0059.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString=".7z") returned 3 [0059.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.371] lstrlenW (lpString=".dbf") returned 4 [0059.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.371] lstrlenW (lpString=".1cd") returned 4 [0059.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0059.372] lstrlenW (lpString=".jpg") returned 4 [0059.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.353] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20454) returned 1 [0060.353] CloseHandle (hObject=0x1f4) returned 1 [0060.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0060.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.354] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.354] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.354] GetLastError () returned 0x0 [0060.354] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0060.359] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0060.360] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.360] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.360] SetEndOfFile (hFile=0x1c8) returned 1 [0060.360] CloseHandle (hObject=0x1c8) returned 1 [0060.360] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.360] SetEndOfFile (hFile=0x1f4) returned 1 [0060.361] CloseHandle (hObject=0x1f4) returned 1 [0060.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString=".doc") returned 4 [0060.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.362] lstrlenW (lpString=".docx") returned 5 [0060.362] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.362] lstrlenW (lpString=".pdf") returned 4 [0060.362] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.362] lstrlenW (lpString=".xls") returned 4 [0060.362] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.362] lstrlenW (lpString=".xlsx") returned 5 [0060.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.362] lstrlenW (lpString=".ppt") returned 4 [0060.362] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString=".zip") returned 4 [0060.362] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.362] lstrlenW (lpString=".rar") returned 4 [0060.362] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.362] lstrlenW (lpString=".bz2") returned 4 [0060.362] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.362] lstrlenW (lpString=".7z") returned 3 [0060.362] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString=".dbf") returned 4 [0060.362] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString=".1cd") returned 4 [0060.362] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0060.362] lstrlenW (lpString=".jpg") returned 4 [0060.363] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.363] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12982) returned 1 [0060.363] CloseHandle (hObject=0x1f4) returned 1 [0060.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0060.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.363] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.363] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.364] GetLastError () returned 0x0 [0060.364] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0060.368] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0060.370] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.370] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.370] SetEndOfFile (hFile=0x1c8) returned 1 [0060.370] CloseHandle (hObject=0x1c8) returned 1 [0060.371] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.371] SetEndOfFile (hFile=0x1f4) returned 1 [0060.371] CloseHandle (hObject=0x1f4) returned 1 [0060.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0060.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.372] lstrlenW (lpString=".doc") returned 4 [0060.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.372] lstrlenW (lpString=".docx") returned 5 [0060.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.372] lstrlenW (lpString=".pdf") returned 4 [0060.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.372] lstrlenW (lpString=".xls") returned 4 [0060.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.372] lstrlenW (lpString=".xlsx") returned 5 [0060.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.372] lstrlenW (lpString=".ppt") returned 4 [0060.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.372] lstrlenW (lpString=".zip") returned 4 [0060.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.372] lstrlenW (lpString=".rar") returned 4 [0060.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.372] lstrlenW (lpString=".bz2") returned 4 [0060.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.373] lstrlenW (lpString=".7z") returned 3 [0060.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.373] lstrlenW (lpString=".dbf") returned 4 [0060.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.373] lstrlenW (lpString=".1cd") returned 4 [0060.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0060.373] lstrlenW (lpString=".jpg") returned 4 [0060.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.373] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9710) returned 1 [0060.373] CloseHandle (hObject=0x1f4) returned 1 [0060.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0060.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.374] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.374] GetLastError () returned 0x0 [0060.374] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0060.396] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0060.397] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.397] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.397] SetEndOfFile (hFile=0x1c8) returned 1 [0060.398] CloseHandle (hObject=0x1c8) returned 1 [0060.398] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.398] SetEndOfFile (hFile=0x1f4) returned 1 [0060.399] CloseHandle (hObject=0x1f4) returned 1 [0060.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0060.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.399] lstrlenW (lpString=".doc") returned 4 [0060.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.399] lstrlenW (lpString=".docx") returned 5 [0060.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.399] lstrlenW (lpString=".pdf") returned 4 [0060.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString=".xls") returned 4 [0060.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.400] lstrlenW (lpString=".xlsx") returned 5 [0060.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.400] lstrlenW (lpString=".ppt") returned 4 [0060.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.400] lstrlenW (lpString=".zip") returned 4 [0060.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.400] lstrlenW (lpString=".rar") returned 4 [0060.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString=".bz2") returned 4 [0060.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString=".7z") returned 3 [0060.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.400] lstrlenW (lpString=".dbf") returned 4 [0060.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.400] lstrlenW (lpString=".1cd") returned 4 [0060.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0060.400] lstrlenW (lpString=".jpg") returned 4 [0060.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.401] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8772) returned 1 [0060.401] CloseHandle (hObject=0x1f4) returned 1 [0060.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0060.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.401] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.401] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.401] GetLastError () returned 0x0 [0060.401] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2244, lpOverlapped=0x0) returned 1 [0060.406] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0060.407] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.407] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.407] SetEndOfFile (hFile=0x1c8) returned 1 [0060.407] CloseHandle (hObject=0x1c8) returned 1 [0060.408] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.408] SetEndOfFile (hFile=0x1f4) returned 1 [0060.408] CloseHandle (hObject=0x1f4) returned 1 [0060.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0060.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.409] lstrlenW (lpString=".doc") returned 4 [0060.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.409] lstrlenW (lpString=".docx") returned 5 [0060.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.409] lstrlenW (lpString=".pdf") returned 4 [0060.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.409] lstrlenW (lpString=".xls") returned 4 [0060.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.409] lstrlenW (lpString=".xlsx") returned 5 [0060.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.409] lstrlenW (lpString=".ppt") returned 4 [0060.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.409] lstrlenW (lpString=".zip") returned 4 [0060.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.409] lstrlenW (lpString=".rar") returned 4 [0060.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.409] lstrlenW (lpString=".bz2") returned 4 [0060.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.410] lstrlenW (lpString=".7z") returned 3 [0060.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.410] lstrlenW (lpString=".dbf") returned 4 [0060.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.410] lstrlenW (lpString=".1cd") returned 4 [0060.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0060.410] lstrlenW (lpString=".jpg") returned 4 [0060.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.410] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14486) returned 1 [0060.410] CloseHandle (hObject=0x1f4) returned 1 [0060.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0060.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.411] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.411] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.411] GetLastError () returned 0x0 [0060.411] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3896, lpOverlapped=0x0) returned 1 [0060.415] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0060.417] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.417] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.417] SetEndOfFile (hFile=0x1c8) returned 1 [0060.417] CloseHandle (hObject=0x1c8) returned 1 [0060.417] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.417] SetEndOfFile (hFile=0x1f4) returned 1 [0060.418] CloseHandle (hObject=0x1f4) returned 1 [0060.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0060.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.421] lstrlenW (lpString=".doc") returned 4 [0060.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.421] lstrlenW (lpString=".docx") returned 5 [0060.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.421] lstrlenW (lpString=".pdf") returned 4 [0060.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.421] lstrlenW (lpString=".xls") returned 4 [0060.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.421] lstrlenW (lpString=".xlsx") returned 5 [0060.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.421] lstrlenW (lpString=".ppt") returned 4 [0060.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.421] lstrlenW (lpString=".zip") returned 4 [0060.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.421] lstrlenW (lpString=".rar") returned 4 [0060.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.421] lstrlenW (lpString=".bz2") returned 4 [0060.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.421] lstrlenW (lpString=".7z") returned 3 [0060.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.422] lstrlenW (lpString=".dbf") returned 4 [0060.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.422] lstrlenW (lpString=".1cd") returned 4 [0060.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0060.422] lstrlenW (lpString=".jpg") returned 4 [0060.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.422] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18304) returned 1 [0060.422] CloseHandle (hObject=0x1f4) returned 1 [0060.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0060.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.423] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.423] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.423] GetLastError () returned 0x0 [0060.423] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4780, lpOverlapped=0x0) returned 1 [0060.695] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0060.696] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.696] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.696] SetEndOfFile (hFile=0x1c8) returned 1 [0060.696] CloseHandle (hObject=0x1c8) returned 1 [0060.697] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.697] SetEndOfFile (hFile=0x1f4) returned 1 [0060.698] CloseHandle (hObject=0x1f4) returned 1 [0060.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.698] lstrlenW (lpString=".doc") returned 4 [0060.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.698] lstrlenW (lpString=".docx") returned 5 [0060.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.698] lstrlenW (lpString=".pdf") returned 4 [0060.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.698] lstrlenW (lpString=".xls") returned 4 [0060.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.698] lstrlenW (lpString=".xlsx") returned 5 [0060.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.698] lstrlenW (lpString=".ppt") returned 4 [0060.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.699] lstrlenW (lpString=".zip") returned 4 [0060.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.699] lstrlenW (lpString=".rar") returned 4 [0060.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.699] lstrlenW (lpString=".bz2") returned 4 [0060.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.699] lstrlenW (lpString=".7z") returned 3 [0060.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.699] lstrlenW (lpString=".dbf") returned 4 [0060.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.699] lstrlenW (lpString=".1cd") returned 4 [0060.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0060.699] lstrlenW (lpString=".jpg") returned 4 [0060.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.699] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14444) returned 1 [0060.699] CloseHandle (hObject=0x1f4) returned 1 [0060.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0060.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.700] GetLastError () returned 0x0 [0060.700] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x386c, lpOverlapped=0x0) returned 1 [0060.702] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0060.703] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.703] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.703] SetEndOfFile (hFile=0x1c8) returned 1 [0060.704] CloseHandle (hObject=0x1c8) returned 1 [0060.704] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.704] SetEndOfFile (hFile=0x1f4) returned 1 [0060.705] CloseHandle (hObject=0x1f4) returned 1 [0060.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.705] lstrlenW (lpString=".doc") returned 4 [0060.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.705] lstrlenW (lpString=".docx") returned 5 [0060.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.705] lstrlenW (lpString=".pdf") returned 4 [0060.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.705] lstrlenW (lpString=".xls") returned 4 [0060.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.705] lstrlenW (lpString=".xlsx") returned 5 [0060.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.705] lstrlenW (lpString=".ppt") returned 4 [0060.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.706] lstrlenW (lpString=".zip") returned 4 [0060.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.706] lstrlenW (lpString=".rar") returned 4 [0060.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString=".bz2") returned 4 [0060.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString=".7z") returned 3 [0060.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.706] lstrlenW (lpString=".dbf") returned 4 [0060.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.706] lstrlenW (lpString=".1cd") returned 4 [0060.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0060.706] lstrlenW (lpString=".jpg") returned 4 [0060.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.706] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1536) returned 1 [0060.706] CloseHandle (hObject=0x1f4) returned 1 [0060.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0060.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.707] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.707] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.707] GetLastError () returned 0x0 [0060.707] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x600, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x610, lpOverlapped=0x0) returned 1 [0060.710] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.710] SetEndOfFile (hFile=0x1c8) returned 1 [0060.710] CloseHandle (hObject=0x1c8) returned 1 [0060.710] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.710] SetEndOfFile (hFile=0x1f4) returned 1 [0060.711] CloseHandle (hObject=0x1f4) returned 1 [0060.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString=".doc") returned 4 [0060.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString=".docx") returned 5 [0060.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.712] lstrlenW (lpString=".pdf") returned 4 [0060.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString=".xls") returned 4 [0060.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.712] lstrlenW (lpString=".xlsx") returned 5 [0060.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.712] lstrlenW (lpString=".ppt") returned 4 [0060.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString=".zip") returned 4 [0060.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.712] lstrlenW (lpString=".rar") returned 4 [0060.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString=".bz2") returned 4 [0060.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString=".7z") returned 3 [0060.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString=".dbf") returned 4 [0060.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString=".1cd") returned 4 [0060.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0060.712] lstrlenW (lpString=".jpg") returned 4 [0060.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.713] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4708) returned 1 [0060.713] CloseHandle (hObject=0x1f4) returned 1 [0060.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0060.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.713] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.713] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.714] GetLastError () returned 0x0 [0060.714] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1264, lpOverlapped=0x0) returned 1 [0060.715] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0060.717] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.717] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.717] SetEndOfFile (hFile=0x1c8) returned 1 [0060.717] CloseHandle (hObject=0x1c8) returned 1 [0060.718] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.718] SetEndOfFile (hFile=0x1f4) returned 1 [0060.718] CloseHandle (hObject=0x1f4) returned 1 [0060.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0060.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.719] lstrlenW (lpString=".doc") returned 4 [0060.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.719] lstrlenW (lpString=".docx") returned 5 [0060.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.719] lstrlenW (lpString=".pdf") returned 4 [0060.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.719] lstrlenW (lpString=".xls") returned 4 [0060.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.719] lstrlenW (lpString=".xlsx") returned 5 [0060.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.719] lstrlenW (lpString=".ppt") returned 4 [0060.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.719] lstrlenW (lpString=".zip") returned 4 [0060.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.719] lstrlenW (lpString=".rar") returned 4 [0060.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.719] lstrlenW (lpString=".bz2") returned 4 [0060.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.719] lstrlenW (lpString=".7z") returned 3 [0060.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.719] lstrlenW (lpString=".dbf") returned 4 [0060.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.720] lstrlenW (lpString=".1cd") returned 4 [0060.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0060.720] lstrlenW (lpString=".jpg") returned 4 [0060.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.720] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1736) returned 1 [0060.721] CloseHandle (hObject=0x1f4) returned 1 [0060.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0060.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.721] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.721] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.721] GetLastError () returned 0x0 [0060.721] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0060.727] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.727] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.727] SetEndOfFile (hFile=0x1c8) returned 1 [0060.727] CloseHandle (hObject=0x1c8) returned 1 [0060.727] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.727] SetEndOfFile (hFile=0x1f4) returned 1 [0060.728] CloseHandle (hObject=0x1f4) returned 1 [0060.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.729] lstrlenW (lpString=".doc") returned 4 [0060.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString=".docx") returned 5 [0060.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.729] lstrlenW (lpString=".pdf") returned 4 [0060.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString=".xls") returned 4 [0060.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.729] lstrlenW (lpString=".xlsx") returned 5 [0060.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.729] lstrlenW (lpString=".ppt") returned 4 [0060.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.729] lstrlenW (lpString=".zip") returned 4 [0060.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.729] lstrlenW (lpString=".rar") returned 4 [0060.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString=".bz2") returned 4 [0060.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString=".7z") returned 3 [0060.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.729] lstrlenW (lpString=".dbf") returned 4 [0060.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.729] lstrlenW (lpString=".1cd") returned 4 [0060.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0060.730] lstrlenW (lpString=".jpg") returned 4 [0060.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.730] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12482) returned 1 [0060.730] CloseHandle (hObject=0x1f4) returned 1 [0060.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0060.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.730] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.730] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.731] GetLastError () returned 0x0 [0060.731] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0060.839] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0060.840] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.840] SetEndOfFile (hFile=0x1c8) returned 1 [0060.954] CloseHandle (hObject=0x1c8) returned 1 [0060.954] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.955] SetEndOfFile (hFile=0x1f4) returned 1 [0060.955] CloseHandle (hObject=0x1f4) returned 1 [0060.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0061.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.406] lstrlenW (lpString=".doc") returned 4 [0061.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".docx") returned 5 [0061.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.406] lstrlenW (lpString=".pdf") returned 4 [0061.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".xls") returned 4 [0061.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.406] lstrlenW (lpString=".xlsx") returned 5 [0061.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.406] lstrlenW (lpString=".ppt") returned 4 [0061.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.406] lstrlenW (lpString=".zip") returned 4 [0061.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.406] lstrlenW (lpString=".rar") returned 4 [0061.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".bz2") returned 4 [0061.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.406] lstrlenW (lpString=".7z") returned 3 [0061.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.407] lstrlenW (lpString=".dbf") returned 4 [0061.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.407] lstrlenW (lpString=".1cd") returned 4 [0061.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0061.407] lstrlenW (lpString=".jpg") returned 4 [0061.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.900] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5272) returned 1 [0061.900] CloseHandle (hObject=0x214) returned 1 [0061.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0061.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0061.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0061.901] GetLastError () returned 0x0 [0061.901] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1498, lpOverlapped=0x0) returned 1 [0061.984] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0061.985] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.985] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.985] SetEndOfFile (hFile=0x158) returned 1 [0061.986] CloseHandle (hObject=0x158) returned 1 [0061.986] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.986] SetEndOfFile (hFile=0x214) returned 1 [0061.987] CloseHandle (hObject=0x214) returned 1 [0061.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0061.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0062.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.210] lstrlenW (lpString=".doc") returned 4 [0062.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.210] lstrlenW (lpString=".docx") returned 5 [0062.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.211] lstrlenW (lpString=".pdf") returned 4 [0062.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString=".xls") returned 4 [0062.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.211] lstrlenW (lpString=".xlsx") returned 5 [0062.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.211] lstrlenW (lpString=".ppt") returned 4 [0062.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.211] lstrlenW (lpString=".zip") returned 4 [0062.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.211] lstrlenW (lpString=".rar") returned 4 [0062.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString=".bz2") returned 4 [0062.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString=".7z") returned 3 [0062.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.211] lstrlenW (lpString=".dbf") returned 4 [0062.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.211] lstrlenW (lpString=".1cd") returned 4 [0062.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0062.211] lstrlenW (lpString=".jpg") returned 4 [0062.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.261] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27050) returned 1 [0062.261] CloseHandle (hObject=0x16c) returned 1 [0062.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0062.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.274] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.281] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.286] GetLastError () returned 0x0 [0062.286] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0062.289] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0062.291] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.291] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.291] SetEndOfFile (hFile=0x1c8) returned 1 [0062.291] CloseHandle (hObject=0x1c8) returned 1 [0062.291] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.291] SetEndOfFile (hFile=0x16c) returned 1 [0062.292] CloseHandle (hObject=0x16c) returned 1 [0062.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.292] lstrlenW (lpString=".doc") returned 4 [0062.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString=".docx") returned 5 [0062.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.293] lstrlenW (lpString=".pdf") returned 4 [0062.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString=".xls") returned 4 [0062.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.293] lstrlenW (lpString=".xlsx") returned 5 [0062.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.293] lstrlenW (lpString=".ppt") returned 4 [0062.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.293] lstrlenW (lpString=".zip") returned 4 [0062.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.293] lstrlenW (lpString=".rar") returned 4 [0062.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString=".bz2") returned 4 [0062.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString=".7z") returned 3 [0062.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.293] lstrlenW (lpString=".dbf") returned 4 [0062.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.293] lstrlenW (lpString=".1cd") returned 4 [0062.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0062.293] lstrlenW (lpString=".jpg") returned 4 [0062.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.294] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11500) returned 1 [0062.294] CloseHandle (hObject=0x16c) returned 1 [0062.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0062.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.294] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.294] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.295] GetLastError () returned 0x0 [0062.295] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0062.296] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0062.297] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.297] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.297] SetEndOfFile (hFile=0x1c8) returned 1 [0062.297] CloseHandle (hObject=0x1c8) returned 1 [0062.297] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.297] SetEndOfFile (hFile=0x16c) returned 1 [0062.298] CloseHandle (hObject=0x16c) returned 1 [0062.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.299] lstrlenW (lpString=".doc") returned 4 [0062.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString=".docx") returned 5 [0062.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.299] lstrlenW (lpString=".pdf") returned 4 [0062.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString=".xls") returned 4 [0062.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.299] lstrlenW (lpString=".xlsx") returned 5 [0062.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.299] lstrlenW (lpString=".ppt") returned 4 [0062.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.299] lstrlenW (lpString=".zip") returned 4 [0062.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.299] lstrlenW (lpString=".rar") returned 4 [0062.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString=".bz2") returned 4 [0062.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString=".7z") returned 3 [0062.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.299] lstrlenW (lpString=".dbf") returned 4 [0062.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.300] lstrlenW (lpString=".1cd") returned 4 [0062.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0062.300] lstrlenW (lpString=".jpg") returned 4 [0062.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.301] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4408) returned 1 [0062.301] CloseHandle (hObject=0x16c) returned 1 [0062.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0062.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.301] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.302] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.302] GetLastError () returned 0x0 [0062.302] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1138, lpOverlapped=0x0) returned 1 [0062.303] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0062.304] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.304] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.304] SetEndOfFile (hFile=0x1c8) returned 1 [0062.305] CloseHandle (hObject=0x1c8) returned 1 [0062.305] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.305] SetEndOfFile (hFile=0x16c) returned 1 [0062.306] CloseHandle (hObject=0x16c) returned 1 [0062.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0062.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.306] lstrlenW (lpString=".doc") returned 4 [0062.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.306] lstrlenW (lpString=".docx") returned 5 [0062.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.306] lstrlenW (lpString=".pdf") returned 4 [0062.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.306] lstrlenW (lpString=".xls") returned 4 [0062.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.306] lstrlenW (lpString=".xlsx") returned 5 [0062.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.306] lstrlenW (lpString=".ppt") returned 4 [0062.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.306] lstrlenW (lpString=".zip") returned 4 [0062.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.307] lstrlenW (lpString=".rar") returned 4 [0062.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.307] lstrlenW (lpString=".bz2") returned 4 [0062.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.307] lstrlenW (lpString=".7z") returned 3 [0062.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.307] lstrlenW (lpString=".dbf") returned 4 [0062.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.307] lstrlenW (lpString=".1cd") returned 4 [0062.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0062.307] lstrlenW (lpString=".jpg") returned 4 [0062.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.307] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6256) returned 1 [0062.307] CloseHandle (hObject=0x16c) returned 1 [0062.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0062.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.308] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.308] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.308] GetLastError () returned 0x0 [0062.308] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1870, lpOverlapped=0x0) returned 1 [0062.309] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0062.310] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.310] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.311] SetEndOfFile (hFile=0x1c8) returned 1 [0062.311] CloseHandle (hObject=0x1c8) returned 1 [0062.311] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.311] SetEndOfFile (hFile=0x16c) returned 1 [0062.312] CloseHandle (hObject=0x16c) returned 1 [0062.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0062.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.312] lstrlenW (lpString=".doc") returned 4 [0062.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.312] lstrlenW (lpString=".docx") returned 5 [0062.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.312] lstrlenW (lpString=".pdf") returned 4 [0062.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.312] lstrlenW (lpString=".xls") returned 4 [0062.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.312] lstrlenW (lpString=".xlsx") returned 5 [0062.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.312] lstrlenW (lpString=".ppt") returned 4 [0062.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.313] lstrlenW (lpString=".zip") returned 4 [0062.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.313] lstrlenW (lpString=".rar") returned 4 [0062.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.313] lstrlenW (lpString=".bz2") returned 4 [0062.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.313] lstrlenW (lpString=".7z") returned 3 [0062.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.313] lstrlenW (lpString=".dbf") returned 4 [0062.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.313] lstrlenW (lpString=".1cd") returned 4 [0062.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0062.313] lstrlenW (lpString=".jpg") returned 4 [0062.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.314] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19476) returned 1 [0062.314] CloseHandle (hObject=0x16c) returned 1 [0062.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0062.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.314] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.314] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.315] GetLastError () returned 0x0 [0062.315] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0062.316] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0062.317] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.317] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.318] SetEndOfFile (hFile=0x1c8) returned 1 [0062.318] CloseHandle (hObject=0x1c8) returned 1 [0062.318] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.318] SetEndOfFile (hFile=0x16c) returned 1 [0062.319] CloseHandle (hObject=0x16c) returned 1 [0062.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0062.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.319] lstrlenW (lpString=".doc") returned 4 [0062.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.319] lstrlenW (lpString=".docx") returned 5 [0062.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.319] lstrlenW (lpString=".pdf") returned 4 [0062.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString=".xls") returned 4 [0062.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.320] lstrlenW (lpString=".xlsx") returned 5 [0062.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.320] lstrlenW (lpString=".ppt") returned 4 [0062.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.320] lstrlenW (lpString=".zip") returned 4 [0062.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.320] lstrlenW (lpString=".rar") returned 4 [0062.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString=".bz2") returned 4 [0062.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString=".7z") returned 3 [0062.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.320] lstrlenW (lpString=".dbf") returned 4 [0062.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.320] lstrlenW (lpString=".1cd") returned 4 [0062.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0062.320] lstrlenW (lpString=".jpg") returned 4 [0062.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.320] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3768) returned 1 [0062.321] CloseHandle (hObject=0x16c) returned 1 [0062.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0062.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.321] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.321] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.321] GetLastError () returned 0x0 [0062.321] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0062.420] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0062.421] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.421] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.421] SetEndOfFile (hFile=0x1c8) returned 1 [0062.421] CloseHandle (hObject=0x1c8) returned 1 [0062.421] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.421] SetEndOfFile (hFile=0x16c) returned 1 [0062.422] CloseHandle (hObject=0x16c) returned 1 [0062.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0062.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.423] lstrlenW (lpString=".doc") returned 4 [0062.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.423] lstrlenW (lpString=".docx") returned 5 [0062.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.423] lstrlenW (lpString=".pdf") returned 4 [0062.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.423] lstrlenW (lpString=".xls") returned 4 [0062.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.423] lstrlenW (lpString=".xlsx") returned 5 [0062.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.423] lstrlenW (lpString=".ppt") returned 4 [0062.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.424] lstrlenW (lpString=".zip") returned 4 [0062.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.424] lstrlenW (lpString=".rar") returned 4 [0062.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.424] lstrlenW (lpString=".bz2") returned 4 [0062.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.424] lstrlenW (lpString=".7z") returned 3 [0062.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.424] lstrlenW (lpString=".dbf") returned 4 [0062.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.424] lstrlenW (lpString=".1cd") returned 4 [0062.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0062.424] lstrlenW (lpString=".jpg") returned 4 [0062.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.424] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3104) returned 1 [0062.424] CloseHandle (hObject=0x16c) returned 1 [0062.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0062.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.425] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.425] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.425] GetLastError () returned 0x0 [0062.425] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc20, lpOverlapped=0x0) returned 1 [0062.427] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0062.428] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.428] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.428] SetEndOfFile (hFile=0x1c8) returned 1 [0062.428] CloseHandle (hObject=0x1c8) returned 1 [0062.428] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.428] SetEndOfFile (hFile=0x16c) returned 1 [0062.429] CloseHandle (hObject=0x16c) returned 1 [0062.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.429] lstrlenW (lpString=".doc") returned 4 [0062.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString=".docx") returned 5 [0062.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.429] lstrlenW (lpString=".pdf") returned 4 [0062.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString=".xls") returned 4 [0062.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.429] lstrlenW (lpString=".xlsx") returned 5 [0062.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.430] lstrlenW (lpString=".ppt") returned 4 [0062.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.430] lstrlenW (lpString=".zip") returned 4 [0062.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.430] lstrlenW (lpString=".rar") returned 4 [0062.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.430] lstrlenW (lpString=".bz2") returned 4 [0062.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.430] lstrlenW (lpString=".7z") returned 3 [0062.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.430] lstrlenW (lpString=".dbf") returned 4 [0062.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.430] lstrlenW (lpString=".1cd") returned 4 [0062.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0062.430] lstrlenW (lpString=".jpg") returned 4 [0062.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.430] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1588) returned 1 [0062.430] CloseHandle (hObject=0x16c) returned 1 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0062.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.431] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.431] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.431] GetLastError () returned 0x0 [0062.431] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x634, lpOverlapped=0x0) returned 1 [0062.433] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x640, lpOverlapped=0x0) returned 1 [0062.434] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.434] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.434] SetEndOfFile (hFile=0x1c8) returned 1 [0062.434] CloseHandle (hObject=0x1c8) returned 1 [0062.434] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.434] SetEndOfFile (hFile=0x16c) returned 1 [0062.435] CloseHandle (hObject=0x16c) returned 1 [0062.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.435] lstrlenW (lpString=".doc") returned 4 [0062.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".docx") returned 5 [0062.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.435] lstrlenW (lpString=".pdf") returned 4 [0062.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".xls") returned 4 [0062.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.435] lstrlenW (lpString=".xlsx") returned 5 [0062.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.435] lstrlenW (lpString=".ppt") returned 4 [0062.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.436] lstrlenW (lpString=".zip") returned 4 [0062.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.436] lstrlenW (lpString=".rar") returned 4 [0062.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.436] lstrlenW (lpString=".bz2") returned 4 [0062.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.436] lstrlenW (lpString=".7z") returned 3 [0062.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.436] lstrlenW (lpString=".dbf") returned 4 [0062.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.436] lstrlenW (lpString=".1cd") returned 4 [0062.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0062.436] lstrlenW (lpString=".jpg") returned 4 [0062.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.436] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1212) returned 1 [0062.436] CloseHandle (hObject=0x16c) returned 1 [0062.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0062.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.437] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.437] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.437] GetLastError () returned 0x0 [0062.437] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4bc, lpOverlapped=0x0) returned 1 [0062.439] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0062.439] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.439] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.440] SetEndOfFile (hFile=0x1c8) returned 1 [0062.440] CloseHandle (hObject=0x1c8) returned 1 [0062.440] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.440] SetEndOfFile (hFile=0x16c) returned 1 [0062.441] CloseHandle (hObject=0x16c) returned 1 [0062.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.441] lstrlenW (lpString=".doc") returned 4 [0062.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString=".docx") returned 5 [0062.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.441] lstrlenW (lpString=".pdf") returned 4 [0062.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString=".xls") returned 4 [0062.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.441] lstrlenW (lpString=".xlsx") returned 5 [0062.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.441] lstrlenW (lpString=".ppt") returned 4 [0062.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.441] lstrlenW (lpString=".zip") returned 4 [0062.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.441] lstrlenW (lpString=".rar") returned 4 [0062.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString=".bz2") returned 4 [0062.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString=".7z") returned 3 [0062.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.442] lstrlenW (lpString=".dbf") returned 4 [0062.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.442] lstrlenW (lpString=".1cd") returned 4 [0062.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0062.442] lstrlenW (lpString=".jpg") returned 4 [0062.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.443] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2052) returned 1 [0062.443] CloseHandle (hObject=0x1c8) returned 1 [0062.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0062.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.443] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.443] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.446] GetLastError () returned 0x0 [0062.446] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x804, lpOverlapped=0x0) returned 1 [0062.448] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x810, lpOverlapped=0x0) returned 1 [0062.448] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.449] SetEndOfFile (hFile=0x1bc) returned 1 [0062.449] CloseHandle (hObject=0x1bc) returned 1 [0062.449] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.449] SetEndOfFile (hFile=0x1c8) returned 1 [0062.450] CloseHandle (hObject=0x1c8) returned 1 [0062.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0062.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.450] lstrlenW (lpString=".doc") returned 4 [0062.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.450] lstrlenW (lpString=".docx") returned 5 [0062.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.450] lstrlenW (lpString=".pdf") returned 4 [0062.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.450] lstrlenW (lpString=".xls") returned 4 [0062.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.450] lstrlenW (lpString=".xlsx") returned 5 [0062.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.451] lstrlenW (lpString=".ppt") returned 4 [0062.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.451] lstrlenW (lpString=".zip") returned 4 [0062.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.451] lstrlenW (lpString=".rar") returned 4 [0062.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".bz2") returned 4 [0062.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".7z") returned 3 [0062.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.451] lstrlenW (lpString=".dbf") returned 4 [0062.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.451] lstrlenW (lpString=".1cd") returned 4 [0062.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0062.451] lstrlenW (lpString=".jpg") returned 4 [0062.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.451] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5580) returned 1 [0062.451] CloseHandle (hObject=0x1c8) returned 1 [0062.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0062.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.452] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.452] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0062.452] GetLastError () returned 0x0 [0062.452] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0062.454] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0062.455] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.455] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.455] SetEndOfFile (hFile=0x1bc) returned 1 [0062.455] CloseHandle (hObject=0x1bc) returned 1 [0062.455] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.455] SetEndOfFile (hFile=0x1c8) returned 1 [0062.456] CloseHandle (hObject=0x1c8) returned 1 [0062.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0062.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.456] lstrlenW (lpString=".doc") returned 4 [0062.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.456] lstrlenW (lpString=".docx") returned 5 [0062.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.456] lstrlenW (lpString=".pdf") returned 4 [0062.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString=".xls") returned 4 [0062.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.457] lstrlenW (lpString=".xlsx") returned 5 [0062.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.457] lstrlenW (lpString=".ppt") returned 4 [0062.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.457] lstrlenW (lpString=".zip") returned 4 [0062.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.457] lstrlenW (lpString=".rar") returned 4 [0062.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString=".bz2") returned 4 [0062.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString=".7z") returned 3 [0062.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.457] lstrlenW (lpString=".dbf") returned 4 [0062.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.457] lstrlenW (lpString=".1cd") returned 4 [0062.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0062.457] lstrlenW (lpString=".jpg") returned 4 [0062.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.905] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3524) returned 1 [0062.905] CloseHandle (hObject=0x214) returned 1 [0062.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0062.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.905] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.905] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.906] GetLastError () returned 0x0 [0062.906] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0062.910] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0062.911] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.911] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.911] SetEndOfFile (hFile=0x1c8) returned 1 [0062.911] CloseHandle (hObject=0x1c8) returned 1 [0062.911] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.911] SetEndOfFile (hFile=0x214) returned 1 [0062.912] CloseHandle (hObject=0x214) returned 1 [0062.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.913] lstrlenW (lpString=".doc") returned 4 [0062.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString=".docx") returned 5 [0062.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.913] lstrlenW (lpString=".pdf") returned 4 [0062.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString=".xls") returned 4 [0062.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.913] lstrlenW (lpString=".xlsx") returned 5 [0062.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.913] lstrlenW (lpString=".ppt") returned 4 [0062.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.913] lstrlenW (lpString=".zip") returned 4 [0062.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.913] lstrlenW (lpString=".rar") returned 4 [0062.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString=".bz2") returned 4 [0062.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString=".7z") returned 3 [0062.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.913] lstrlenW (lpString=".dbf") returned 4 [0062.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.913] lstrlenW (lpString=".1cd") returned 4 [0062.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0062.914] lstrlenW (lpString=".jpg") returned 4 [0062.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.914] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2488) returned 1 [0062.914] CloseHandle (hObject=0x214) returned 1 [0062.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0062.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.914] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.914] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.915] GetLastError () returned 0x0 [0062.915] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0062.916] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0062.917] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.917] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.917] SetEndOfFile (hFile=0x1c8) returned 1 [0062.918] CloseHandle (hObject=0x1c8) returned 1 [0062.918] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.918] SetEndOfFile (hFile=0x214) returned 1 [0062.918] CloseHandle (hObject=0x214) returned 1 [0062.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0062.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.919] lstrlenW (lpString=".doc") returned 4 [0062.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.919] lstrlenW (lpString=".docx") returned 5 [0062.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.919] lstrlenW (lpString=".pdf") returned 4 [0062.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.919] lstrlenW (lpString=".xls") returned 4 [0062.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.919] lstrlenW (lpString=".xlsx") returned 5 [0062.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.919] lstrlenW (lpString=".ppt") returned 4 [0062.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.919] lstrlenW (lpString=".zip") returned 4 [0062.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.919] lstrlenW (lpString=".rar") returned 4 [0062.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.919] lstrlenW (lpString=".bz2") returned 4 [0062.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.919] lstrlenW (lpString=".7z") returned 3 [0062.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.919] lstrlenW (lpString=".dbf") returned 4 [0062.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.920] lstrlenW (lpString=".1cd") returned 4 [0062.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0062.920] lstrlenW (lpString=".jpg") returned 4 [0062.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.920] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1676) returned 1 [0062.920] CloseHandle (hObject=0x214) returned 1 [0062.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0062.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.920] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.920] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.921] GetLastError () returned 0x0 [0062.921] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x68c, lpOverlapped=0x0) returned 1 [0062.923] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x690, lpOverlapped=0x0) returned 1 [0062.924] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.924] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.924] SetEndOfFile (hFile=0x1c8) returned 1 [0062.925] CloseHandle (hObject=0x1c8) returned 1 [0062.925] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.925] SetEndOfFile (hFile=0x214) returned 1 [0062.926] CloseHandle (hObject=0x214) returned 1 [0062.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0062.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.926] lstrlenW (lpString=".doc") returned 4 [0062.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.926] lstrlenW (lpString=".docx") returned 5 [0062.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.926] lstrlenW (lpString=".pdf") returned 4 [0062.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.926] lstrlenW (lpString=".xls") returned 4 [0062.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.926] lstrlenW (lpString=".xlsx") returned 5 [0062.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.926] lstrlenW (lpString=".ppt") returned 4 [0062.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.927] lstrlenW (lpString=".zip") returned 4 [0062.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.927] lstrlenW (lpString=".rar") returned 4 [0062.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.927] lstrlenW (lpString=".bz2") returned 4 [0062.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.927] lstrlenW (lpString=".7z") returned 3 [0062.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.927] lstrlenW (lpString=".dbf") returned 4 [0062.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.927] lstrlenW (lpString=".1cd") returned 4 [0062.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0062.927] lstrlenW (lpString=".jpg") returned 4 [0062.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.928] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3896) returned 1 [0062.928] CloseHandle (hObject=0x214) returned 1 [0062.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0062.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.928] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.928] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.929] GetLastError () returned 0x0 [0062.929] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xf38, lpOverlapped=0x0) returned 1 [0062.930] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0062.931] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.931] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.931] SetEndOfFile (hFile=0x1c8) returned 1 [0062.931] CloseHandle (hObject=0x1c8) returned 1 [0062.932] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.932] SetEndOfFile (hFile=0x214) returned 1 [0062.932] CloseHandle (hObject=0x214) returned 1 [0062.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0062.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.933] lstrlenW (lpString=".doc") returned 4 [0062.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString=".docx") returned 5 [0062.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.933] lstrlenW (lpString=".pdf") returned 4 [0062.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString=".xls") returned 4 [0062.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.933] lstrlenW (lpString=".xlsx") returned 5 [0062.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.933] lstrlenW (lpString=".ppt") returned 4 [0062.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.933] lstrlenW (lpString=".zip") returned 4 [0062.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.933] lstrlenW (lpString=".rar") returned 4 [0062.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString=".bz2") returned 4 [0062.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString=".7z") returned 3 [0062.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.933] lstrlenW (lpString=".dbf") returned 4 [0062.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.934] lstrlenW (lpString=".1cd") returned 4 [0062.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0062.934] lstrlenW (lpString=".jpg") returned 4 [0062.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.934] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3796) returned 1 [0062.934] CloseHandle (hObject=0x214) returned 1 [0062.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0062.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.934] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.934] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.935] GetLastError () returned 0x0 [0062.935] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xed4, lpOverlapped=0x0) returned 1 [0062.936] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0062.937] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.937] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.937] SetEndOfFile (hFile=0x1c8) returned 1 [0062.938] CloseHandle (hObject=0x1c8) returned 1 [0062.938] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.938] SetEndOfFile (hFile=0x214) returned 1 [0062.938] CloseHandle (hObject=0x214) returned 1 [0062.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0062.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.939] lstrlenW (lpString=".doc") returned 4 [0062.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.939] lstrlenW (lpString=".docx") returned 5 [0062.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.939] lstrlenW (lpString=".pdf") returned 4 [0062.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.939] lstrlenW (lpString=".xls") returned 4 [0062.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.939] lstrlenW (lpString=".xlsx") returned 5 [0062.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.939] lstrlenW (lpString=".ppt") returned 4 [0062.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.939] lstrlenW (lpString=".zip") returned 4 [0062.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.939] lstrlenW (lpString=".rar") returned 4 [0062.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.939] lstrlenW (lpString=".bz2") returned 4 [0062.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.939] lstrlenW (lpString=".7z") returned 3 [0062.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.940] lstrlenW (lpString=".dbf") returned 4 [0062.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.940] lstrlenW (lpString=".1cd") returned 4 [0062.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0062.940] lstrlenW (lpString=".jpg") returned 4 [0062.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.940] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2436) returned 1 [0062.940] CloseHandle (hObject=0x214) returned 1 [0062.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0062.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.940] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.940] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.941] GetLastError () returned 0x0 [0062.941] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x984, lpOverlapped=0x0) returned 1 [0063.575] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x990, lpOverlapped=0x0) returned 1 [0063.576] ReadFile (in: hFile=0x214, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.576] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.576] SetEndOfFile (hFile=0x1c8) returned 1 [0063.576] CloseHandle (hObject=0x1c8) returned 1 [0063.576] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.576] SetEndOfFile (hFile=0x214) returned 1 [0063.577] CloseHandle (hObject=0x214) returned 1 [0063.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0063.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.900] lstrlenW (lpString=".doc") returned 4 [0063.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString=".docx") returned 5 [0063.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.901] lstrlenW (lpString=".pdf") returned 4 [0063.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString=".xls") returned 4 [0063.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.901] lstrlenW (lpString=".xlsx") returned 5 [0063.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.901] lstrlenW (lpString=".ppt") returned 4 [0063.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.901] lstrlenW (lpString=".zip") returned 4 [0063.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.901] lstrlenW (lpString=".rar") returned 4 [0063.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString=".bz2") returned 4 [0063.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString=".7z") returned 3 [0063.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.901] lstrlenW (lpString=".dbf") returned 4 [0063.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.901] lstrlenW (lpString=".1cd") returned 4 [0063.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0063.901] lstrlenW (lpString=".jpg") returned 4 [0063.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.263] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31122) returned 1 [0064.265] CloseHandle (hObject=0x1fc) returned 1 [0064.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0064.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.283] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.290] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.835] GetLastError () returned 0x0 [0064.835] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7992, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0064.842] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.842] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.842] SetEndOfFile (hFile=0x190) returned 1 [0064.842] CloseHandle (hObject=0x190) returned 1 [0064.842] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.842] SetEndOfFile (hFile=0x1fc) returned 1 [0064.843] CloseHandle (hObject=0x1fc) returned 1 [0064.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0064.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.843] lstrlenW (lpString=".doc") returned 4 [0064.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.843] lstrlenW (lpString=".docx") returned 5 [0064.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.844] lstrlenW (lpString=".pdf") returned 4 [0064.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString=".xls") returned 4 [0064.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.844] lstrlenW (lpString=".xlsx") returned 5 [0064.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.844] lstrlenW (lpString=".ppt") returned 4 [0064.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.844] lstrlenW (lpString=".zip") returned 4 [0064.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.844] lstrlenW (lpString=".rar") returned 4 [0064.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString=".bz2") returned 4 [0064.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString=".7z") returned 3 [0064.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.844] lstrlenW (lpString=".dbf") returned 4 [0064.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.844] lstrlenW (lpString=".1cd") returned 4 [0064.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0064.844] lstrlenW (lpString=".jpg") returned 4 [0064.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.845] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17584) returned 1 [0064.845] CloseHandle (hObject=0x1fc) returned 1 [0064.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0064.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.846] GetLastError () returned 0x0 [0064.846] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0064.849] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.849] SetEndOfFile (hFile=0x190) returned 1 [0064.849] CloseHandle (hObject=0x190) returned 1 [0064.849] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.849] SetEndOfFile (hFile=0x1fc) returned 1 [0064.850] CloseHandle (hObject=0x1fc) returned 1 [0064.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0064.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.850] lstrlenW (lpString=".doc") returned 4 [0064.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.850] lstrlenW (lpString=".docx") returned 5 [0064.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.850] lstrlenW (lpString=".pdf") returned 4 [0064.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString=".xls") returned 4 [0064.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.851] lstrlenW (lpString=".xlsx") returned 5 [0064.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.851] lstrlenW (lpString=".ppt") returned 4 [0064.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.851] lstrlenW (lpString=".zip") returned 4 [0064.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.851] lstrlenW (lpString=".rar") returned 4 [0064.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString=".bz2") returned 4 [0064.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString=".7z") returned 3 [0064.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.851] lstrlenW (lpString=".dbf") returned 4 [0064.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.851] lstrlenW (lpString=".1cd") returned 4 [0064.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0064.851] lstrlenW (lpString=".jpg") returned 4 [0064.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.851] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7828) returned 1 [0064.852] CloseHandle (hObject=0x1fc) returned 1 [0064.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0064.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.852] GetLastError () returned 0x0 [0064.853] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0064.855] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0064.855] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.856] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.856] SetEndOfFile (hFile=0x190) returned 1 [0064.856] CloseHandle (hObject=0x190) returned 1 [0064.856] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.856] SetEndOfFile (hFile=0x1fc) returned 1 [0064.857] CloseHandle (hObject=0x1fc) returned 1 [0064.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0064.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.857] lstrlenW (lpString=".doc") returned 4 [0064.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.857] lstrlenW (lpString=".docx") returned 5 [0064.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.857] lstrlenW (lpString=".pdf") returned 4 [0064.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.857] lstrlenW (lpString=".xls") returned 4 [0064.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.857] lstrlenW (lpString=".xlsx") returned 5 [0064.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.857] lstrlenW (lpString=".ppt") returned 4 [0064.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.858] lstrlenW (lpString=".zip") returned 4 [0064.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.858] lstrlenW (lpString=".rar") returned 4 [0064.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.858] lstrlenW (lpString=".bz2") returned 4 [0064.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.858] lstrlenW (lpString=".7z") returned 3 [0064.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.858] lstrlenW (lpString=".dbf") returned 4 [0064.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.858] lstrlenW (lpString=".1cd") returned 4 [0064.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0064.858] lstrlenW (lpString=".jpg") returned 4 [0064.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.859] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=42992) returned 1 [0064.859] CloseHandle (hObject=0x1fc) returned 1 [0064.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0064.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.859] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.859] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.860] GetLastError () returned 0x0 [0064.860] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa800, lpOverlapped=0x0) returned 1 [0064.864] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.864] SetEndOfFile (hFile=0x190) returned 1 [0064.864] CloseHandle (hObject=0x190) returned 1 [0064.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.864] SetEndOfFile (hFile=0x1fc) returned 1 [0064.865] CloseHandle (hObject=0x1fc) returned 1 [0064.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString=".doc") returned 4 [0064.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString=".docx") returned 5 [0064.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.866] lstrlenW (lpString=".pdf") returned 4 [0064.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString=".xls") returned 4 [0064.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.866] lstrlenW (lpString=".xlsx") returned 5 [0064.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.866] lstrlenW (lpString=".ppt") returned 4 [0064.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString=".zip") returned 4 [0064.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.866] lstrlenW (lpString=".rar") returned 4 [0064.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString=".bz2") returned 4 [0064.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString=".7z") returned 3 [0064.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString=".dbf") returned 4 [0064.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString=".1cd") returned 4 [0064.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0064.866] lstrlenW (lpString=".jpg") returned 4 [0064.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.867] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=42908) returned 1 [0064.867] CloseHandle (hObject=0x1fc) returned 1 [0064.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0064.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.867] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.867] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0064.868] GetLastError () returned 0x0 [0064.868] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa79c, lpOverlapped=0x0) returned 1 [0064.872] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0064.873] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.873] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.873] SetEndOfFile (hFile=0x190) returned 1 [0064.873] CloseHandle (hObject=0x190) returned 1 [0064.873] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.873] SetEndOfFile (hFile=0x1fc) returned 1 [0064.874] CloseHandle (hObject=0x1fc) returned 1 [0064.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0064.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0064.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0064.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0064.875] lstrlenW (lpString=".doc") returned 4 [0064.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.875] lstrlenW (lpString=".docx") returned 5 [0064.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.875] lstrlenW (lpString=".pdf") returned 4 [0064.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.875] lstrlenW (lpString=".xls") returned 4 [0064.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.875] lstrlenW (lpString=".xlsx") returned 5 [0064.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.875] lstrlenW (lpString=".ppt") returned 4 [0064.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0064.875] lstrlenW (lpString=".zip") returned 4 [0064.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.875] lstrlenW (lpString=".rar") returned 4 [0065.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.059] lstrlenW (lpString=".bz2") returned 4 [0065.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.059] lstrlenW (lpString=".7z") returned 3 [0065.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0065.059] lstrlenW (lpString=".dbf") returned 4 [0065.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0065.059] lstrlenW (lpString=".1cd") returned 4 [0065.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0065.066] lstrlenW (lpString=".jpg") returned 4 [0065.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.072] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2796) returned 1 [0065.078] CloseHandle (hObject=0x150) returned 1 [0065.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0065.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.093] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.093] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.094] GetLastError () returned 0x0 [0065.094] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xaec, lpOverlapped=0x0) returned 1 [0065.095] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0065.096] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.096] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.096] SetEndOfFile (hFile=0x15c) returned 1 [0065.096] CloseHandle (hObject=0x15c) returned 1 [0065.096] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.096] SetEndOfFile (hFile=0x150) returned 1 [0065.097] CloseHandle (hObject=0x150) returned 1 [0065.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0065.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.098] lstrlenW (lpString=".doc") returned 4 [0065.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString=".docx") returned 5 [0065.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.098] lstrlenW (lpString=".pdf") returned 4 [0065.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString=".xls") returned 4 [0065.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.098] lstrlenW (lpString=".xlsx") returned 5 [0065.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.098] lstrlenW (lpString=".ppt") returned 4 [0065.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.098] lstrlenW (lpString=".zip") returned 4 [0065.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.098] lstrlenW (lpString=".rar") returned 4 [0065.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString=".bz2") returned 4 [0065.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString=".7z") returned 3 [0065.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.098] lstrlenW (lpString=".dbf") returned 4 [0065.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.098] lstrlenW (lpString=".1cd") returned 4 [0065.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0065.099] lstrlenW (lpString=".jpg") returned 4 [0065.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.101] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3588) returned 1 [0065.101] CloseHandle (hObject=0x150) returned 1 [0065.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0065.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.102] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.102] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.102] GetLastError () returned 0x0 [0065.102] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe04, lpOverlapped=0x0) returned 1 [0065.104] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0065.105] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.105] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.105] SetEndOfFile (hFile=0x15c) returned 1 [0065.105] CloseHandle (hObject=0x15c) returned 1 [0065.105] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.105] SetEndOfFile (hFile=0x150) returned 1 [0065.106] CloseHandle (hObject=0x150) returned 1 [0065.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0065.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.106] lstrlenW (lpString=".doc") returned 4 [0065.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.106] lstrlenW (lpString=".docx") returned 5 [0065.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.106] lstrlenW (lpString=".pdf") returned 4 [0065.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.106] lstrlenW (lpString=".xls") returned 4 [0065.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.107] lstrlenW (lpString=".xlsx") returned 5 [0065.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.107] lstrlenW (lpString=".ppt") returned 4 [0065.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.107] lstrlenW (lpString=".zip") returned 4 [0065.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.107] lstrlenW (lpString=".rar") returned 4 [0065.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.107] lstrlenW (lpString=".bz2") returned 4 [0065.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.107] lstrlenW (lpString=".7z") returned 3 [0065.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.107] lstrlenW (lpString=".dbf") returned 4 [0065.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.107] lstrlenW (lpString=".1cd") returned 4 [0065.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0065.107] lstrlenW (lpString=".jpg") returned 4 [0065.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.107] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2228) returned 1 [0065.107] CloseHandle (hObject=0x150) returned 1 [0065.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0065.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.108] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.108] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.108] GetLastError () returned 0x0 [0065.108] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0065.110] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0065.111] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.112] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.112] SetEndOfFile (hFile=0x15c) returned 1 [0065.112] CloseHandle (hObject=0x15c) returned 1 [0065.112] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.112] SetEndOfFile (hFile=0x150) returned 1 [0065.113] CloseHandle (hObject=0x150) returned 1 [0065.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0065.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.113] lstrlenW (lpString=".doc") returned 4 [0065.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.113] lstrlenW (lpString=".docx") returned 5 [0065.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.113] lstrlenW (lpString=".pdf") returned 4 [0065.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.113] lstrlenW (lpString=".xls") returned 4 [0065.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.113] lstrlenW (lpString=".xlsx") returned 5 [0065.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.113] lstrlenW (lpString=".ppt") returned 4 [0065.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.113] lstrlenW (lpString=".zip") returned 4 [0065.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.114] lstrlenW (lpString=".rar") returned 4 [0065.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.114] lstrlenW (lpString=".bz2") returned 4 [0065.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.114] lstrlenW (lpString=".7z") returned 3 [0065.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.114] lstrlenW (lpString=".dbf") returned 4 [0065.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.114] lstrlenW (lpString=".1cd") returned 4 [0065.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0065.114] lstrlenW (lpString=".jpg") returned 4 [0065.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.114] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2300) returned 1 [0065.114] CloseHandle (hObject=0x150) returned 1 [0065.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0065.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.115] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.115] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.115] GetLastError () returned 0x0 [0065.115] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0065.117] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x900, lpOverlapped=0x0) returned 1 [0065.118] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.118] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.118] SetEndOfFile (hFile=0x15c) returned 1 [0065.118] CloseHandle (hObject=0x15c) returned 1 [0065.118] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.118] SetEndOfFile (hFile=0x150) returned 1 [0065.119] CloseHandle (hObject=0x150) returned 1 [0065.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0065.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.119] lstrlenW (lpString=".doc") returned 4 [0065.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.119] lstrlenW (lpString=".docx") returned 5 [0065.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.119] lstrlenW (lpString=".pdf") returned 4 [0065.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.119] lstrlenW (lpString=".xls") returned 4 [0065.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.119] lstrlenW (lpString=".xlsx") returned 5 [0065.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.119] lstrlenW (lpString=".ppt") returned 4 [0065.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.120] lstrlenW (lpString=".zip") returned 4 [0065.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.120] lstrlenW (lpString=".rar") returned 4 [0065.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.120] lstrlenW (lpString=".bz2") returned 4 [0065.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.120] lstrlenW (lpString=".7z") returned 3 [0065.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.120] lstrlenW (lpString=".dbf") returned 4 [0065.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.120] lstrlenW (lpString=".1cd") returned 4 [0065.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0065.120] lstrlenW (lpString=".jpg") returned 4 [0065.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.120] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2300) returned 1 [0065.120] CloseHandle (hObject=0x150) returned 1 [0065.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0065.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0065.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0065.121] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.121] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.121] GetLastError () returned 0x0 [0065.121] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0065.123] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x900, lpOverlapped=0x0) returned 1 [0065.124] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.124] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.124] SetEndOfFile (hFile=0x15c) returned 1 [0065.124] CloseHandle (hObject=0x15c) returned 1 [0065.124] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.124] SetEndOfFile (hFile=0x150) returned 1 [0065.125] CloseHandle (hObject=0x150) returned 1 [0065.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0065.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.125] lstrlenW (lpString=".doc") returned 4 [0065.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.125] lstrlenW (lpString=".docx") returned 5 [0065.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.125] lstrlenW (lpString=".pdf") returned 4 [0065.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.125] lstrlenW (lpString=".xls") returned 4 [0065.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.125] lstrlenW (lpString=".xlsx") returned 5 [0065.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.125] lstrlenW (lpString=".ppt") returned 4 [0065.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.126] lstrlenW (lpString=".zip") returned 4 [0065.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.126] lstrlenW (lpString=".rar") returned 4 [0065.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.126] lstrlenW (lpString=".bz2") returned 4 [0065.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.126] lstrlenW (lpString=".7z") returned 3 [0065.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.126] lstrlenW (lpString=".dbf") returned 4 [0065.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.126] lstrlenW (lpString=".1cd") returned 4 [0065.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0065.126] lstrlenW (lpString=".jpg") returned 4 [0065.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.310] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2080) returned 1 [0066.310] CloseHandle (hObject=0x1c8) returned 1 [0066.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0066.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.312] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.312] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.313] GetLastError () returned 0x0 [0066.313] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x820, lpOverlapped=0x0) returned 1 [0066.315] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x830, lpOverlapped=0x0) returned 1 [0066.316] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.316] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.316] SetEndOfFile (hFile=0x22c) returned 1 [0066.316] CloseHandle (hObject=0x22c) returned 1 [0066.316] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.316] SetEndOfFile (hFile=0x1c8) returned 1 [0066.317] CloseHandle (hObject=0x1c8) returned 1 [0066.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0066.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.317] lstrlenW (lpString=".doc") returned 4 [0066.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.317] lstrlenW (lpString=".docx") returned 5 [0066.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.317] lstrlenW (lpString=".pdf") returned 4 [0066.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString=".xls") returned 4 [0066.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.318] lstrlenW (lpString=".xlsx") returned 5 [0066.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.318] lstrlenW (lpString=".ppt") returned 4 [0066.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.318] lstrlenW (lpString=".zip") returned 4 [0066.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.318] lstrlenW (lpString=".rar") returned 4 [0066.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString=".bz2") returned 4 [0066.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString=".7z") returned 3 [0066.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.318] lstrlenW (lpString=".dbf") returned 4 [0066.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.318] lstrlenW (lpString=".1cd") returned 4 [0066.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0066.318] lstrlenW (lpString=".jpg") returned 4 [0066.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.318] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2404) returned 1 [0066.319] CloseHandle (hObject=0x1c8) returned 1 [0066.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0066.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.319] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.319] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.319] GetLastError () returned 0x0 [0066.319] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x964, lpOverlapped=0x0) returned 1 [0066.321] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x970, lpOverlapped=0x0) returned 1 [0066.322] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.322] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.322] SetEndOfFile (hFile=0x22c) returned 1 [0066.322] CloseHandle (hObject=0x22c) returned 1 [0066.322] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.322] SetEndOfFile (hFile=0x1c8) returned 1 [0066.323] CloseHandle (hObject=0x1c8) returned 1 [0066.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0066.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.323] lstrlenW (lpString=".doc") returned 4 [0066.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.323] lstrlenW (lpString=".docx") returned 5 [0066.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.324] lstrlenW (lpString=".pdf") returned 4 [0066.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString=".xls") returned 4 [0066.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.324] lstrlenW (lpString=".xlsx") returned 5 [0066.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.324] lstrlenW (lpString=".ppt") returned 4 [0066.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.324] lstrlenW (lpString=".zip") returned 4 [0066.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.324] lstrlenW (lpString=".rar") returned 4 [0066.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString=".bz2") returned 4 [0066.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString=".7z") returned 3 [0066.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.324] lstrlenW (lpString=".dbf") returned 4 [0066.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.324] lstrlenW (lpString=".1cd") returned 4 [0066.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0066.324] lstrlenW (lpString=".jpg") returned 4 [0066.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.325] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2052) returned 1 [0066.325] CloseHandle (hObject=0x1c8) returned 1 [0066.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0066.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.325] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.325] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.325] GetLastError () returned 0x0 [0066.325] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x804, lpOverlapped=0x0) returned 1 [0066.327] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x810, lpOverlapped=0x0) returned 1 [0066.328] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.328] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.328] SetEndOfFile (hFile=0x22c) returned 1 [0066.328] CloseHandle (hObject=0x22c) returned 1 [0066.328] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.328] SetEndOfFile (hFile=0x1c8) returned 1 [0066.329] CloseHandle (hObject=0x1c8) returned 1 [0066.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0066.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.329] lstrlenW (lpString=".doc") returned 4 [0066.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.329] lstrlenW (lpString=".docx") returned 5 [0066.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.329] lstrlenW (lpString=".pdf") returned 4 [0066.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.329] lstrlenW (lpString=".xls") returned 4 [0066.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.329] lstrlenW (lpString=".xlsx") returned 5 [0066.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.330] lstrlenW (lpString=".ppt") returned 4 [0066.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.330] lstrlenW (lpString=".zip") returned 4 [0066.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.330] lstrlenW (lpString=".rar") returned 4 [0066.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.330] lstrlenW (lpString=".bz2") returned 4 [0066.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.330] lstrlenW (lpString=".7z") returned 3 [0066.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.330] lstrlenW (lpString=".dbf") returned 4 [0066.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.330] lstrlenW (lpString=".1cd") returned 4 [0066.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0066.330] lstrlenW (lpString=".jpg") returned 4 [0066.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.330] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2232) returned 1 [0066.330] CloseHandle (hObject=0x1c8) returned 1 [0066.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0066.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.331] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.331] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.331] GetLastError () returned 0x0 [0066.331] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0066.333] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0066.334] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.334] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.334] SetEndOfFile (hFile=0x22c) returned 1 [0066.334] CloseHandle (hObject=0x22c) returned 1 [0066.336] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.336] SetEndOfFile (hFile=0x1c8) returned 1 [0066.337] CloseHandle (hObject=0x1c8) returned 1 [0066.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString=".doc") returned 4 [0066.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString=".docx") returned 5 [0066.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.338] lstrlenW (lpString=".pdf") returned 4 [0066.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString=".xls") returned 4 [0066.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.338] lstrlenW (lpString=".xlsx") returned 5 [0066.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.338] lstrlenW (lpString=".ppt") returned 4 [0066.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString=".zip") returned 4 [0066.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.338] lstrlenW (lpString=".rar") returned 4 [0066.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString=".bz2") returned 4 [0066.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString=".7z") returned 3 [0066.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString=".dbf") returned 4 [0066.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString=".1cd") returned 4 [0066.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0066.338] lstrlenW (lpString=".jpg") returned 4 [0066.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.339] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1804) returned 1 [0066.339] CloseHandle (hObject=0x1c8) returned 1 [0066.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0066.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.340] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.340] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.340] GetLastError () returned 0x0 [0066.340] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x70c, lpOverlapped=0x0) returned 1 [0066.342] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x710, lpOverlapped=0x0) returned 1 [0066.343] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.343] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.343] SetEndOfFile (hFile=0x22c) returned 1 [0066.343] CloseHandle (hObject=0x22c) returned 1 [0066.343] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.343] SetEndOfFile (hFile=0x1c8) returned 1 [0066.344] CloseHandle (hObject=0x1c8) returned 1 [0066.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0066.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.344] lstrlenW (lpString=".doc") returned 4 [0066.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.344] lstrlenW (lpString=".docx") returned 5 [0066.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.344] lstrlenW (lpString=".pdf") returned 4 [0066.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.344] lstrlenW (lpString=".xls") returned 4 [0066.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.345] lstrlenW (lpString=".xlsx") returned 5 [0066.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.345] lstrlenW (lpString=".ppt") returned 4 [0066.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.345] lstrlenW (lpString=".zip") returned 4 [0066.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.345] lstrlenW (lpString=".rar") returned 4 [0066.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.345] lstrlenW (lpString=".bz2") returned 4 [0066.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.345] lstrlenW (lpString=".7z") returned 3 [0066.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.345] lstrlenW (lpString=".dbf") returned 4 [0066.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.345] lstrlenW (lpString=".1cd") returned 4 [0066.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0066.345] lstrlenW (lpString=".jpg") returned 4 [0066.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.345] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1888) returned 1 [0066.345] CloseHandle (hObject=0x1c8) returned 1 [0066.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0066.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.346] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.346] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.346] GetLastError () returned 0x0 [0066.346] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x760, lpOverlapped=0x0) returned 1 [0066.503] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x770, lpOverlapped=0x0) returned 1 [0066.504] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.504] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.505] SetEndOfFile (hFile=0x22c) returned 1 [0066.505] CloseHandle (hObject=0x22c) returned 1 [0066.505] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.505] SetEndOfFile (hFile=0x1c8) returned 1 [0066.505] CloseHandle (hObject=0x1c8) returned 1 [0066.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0067.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.360] lstrlenW (lpString=".doc") returned 4 [0067.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.360] lstrlenW (lpString=".docx") returned 5 [0067.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.362] lstrlenW (lpString=".pdf") returned 4 [0067.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.362] lstrlenW (lpString=".xls") returned 4 [0067.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.364] lstrlenW (lpString=".xlsx") returned 5 [0067.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.364] lstrlenW (lpString=".ppt") returned 4 [0067.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.365] lstrlenW (lpString=".zip") returned 4 [0067.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.365] lstrlenW (lpString=".rar") returned 4 [0067.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.368] lstrlenW (lpString=".bz2") returned 4 [0067.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.368] lstrlenW (lpString=".7z") returned 3 [0067.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.368] lstrlenW (lpString=".dbf") returned 4 [0067.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.368] lstrlenW (lpString=".1cd") returned 4 [0067.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0067.368] lstrlenW (lpString=".jpg") returned 4 [0067.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.449] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6958) returned 1 [0068.449] CloseHandle (hObject=0x180) returned 1 [0068.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0068.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0068.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.450] GetLastError () returned 0x0 [0068.450] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0068.451] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0068.452] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.452] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.452] SetEndOfFile (hFile=0x210) returned 1 [0068.452] CloseHandle (hObject=0x210) returned 1 [0068.452] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.452] SetEndOfFile (hFile=0x180) returned 1 [0068.453] CloseHandle (hObject=0x180) returned 1 [0068.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0068.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.454] lstrlenW (lpString=".doc") returned 4 [0068.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString=".docx") returned 5 [0068.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.454] lstrlenW (lpString=".pdf") returned 4 [0068.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString=".xls") returned 4 [0068.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.454] lstrlenW (lpString=".xlsx") returned 5 [0068.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.454] lstrlenW (lpString=".ppt") returned 4 [0068.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.454] lstrlenW (lpString=".zip") returned 4 [0068.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.454] lstrlenW (lpString=".rar") returned 4 [0068.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString=".bz2") returned 4 [0068.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString=".7z") returned 3 [0068.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.454] lstrlenW (lpString=".dbf") returned 4 [0068.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.454] lstrlenW (lpString=".1cd") returned 4 [0068.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.454] lstrlenW (lpString=".jpg") returned 4 [0068.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.454] lstrlenW (lpString=".pdf") returned 4 [0068.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString=".xls") returned 4 [0068.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.455] lstrlenW (lpString=".xlsx") returned 5 [0068.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.455] lstrlenW (lpString=".ppt") returned 4 [0068.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.455] lstrlenW (lpString=".zip") returned 4 [0068.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.455] lstrlenW (lpString=".rar") returned 4 [0068.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString=".bz2") returned 4 [0068.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString=".7z") returned 3 [0068.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.455] lstrlenW (lpString=".dbf") returned 4 [0068.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.455] lstrlenW (lpString=".1cd") returned 4 [0068.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0068.455] lstrlenW (lpString=".jpg") returned 4 [0068.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.455] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") [0068.456] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11994) returned 1 [0068.456] CloseHandle (hObject=0x180) returned 1 [0068.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0068.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0068.456] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.456] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.456] GetLastError () returned 0x0 [0068.456] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0068.689] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.689] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.690] SetEndOfFile (hFile=0x210) returned 1 [0068.690] CloseHandle (hObject=0x210) returned 1 [0068.690] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.690] SetEndOfFile (hFile=0x180) returned 1 [0068.691] CloseHandle (hObject=0x180) returned 1 [0068.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.691] lstrlenW (lpString=".doc") returned 4 [0068.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".docx") returned 5 [0068.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.691] lstrlenW (lpString=".pdf") returned 4 [0068.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".xls") returned 4 [0068.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.691] lstrlenW (lpString=".xlsx") returned 5 [0068.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.691] lstrlenW (lpString=".ppt") returned 4 [0068.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.691] lstrlenW (lpString=".zip") returned 4 [0068.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.692] lstrlenW (lpString=".rar") returned 4 [0068.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".bz2") returned 4 [0068.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".7z") returned 3 [0068.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.692] lstrlenW (lpString=".dbf") returned 4 [0068.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.692] lstrlenW (lpString=".1cd") returned 4 [0068.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.692] lstrlenW (lpString=".jpg") returned 4 [0068.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".pdf") returned 4 [0068.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".xls") returned 4 [0068.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.692] lstrlenW (lpString=".xlsx") returned 5 [0068.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.692] lstrlenW (lpString=".ppt") returned 4 [0068.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.692] lstrlenW (lpString=".zip") returned 4 [0068.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.692] lstrlenW (lpString=".rar") returned 4 [0068.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".bz2") returned 4 [0068.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.692] lstrlenW (lpString=".7z") returned 3 [0068.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.693] lstrlenW (lpString=".dbf") returned 4 [0068.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.693] lstrlenW (lpString=".1cd") returned 4 [0068.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0068.693] lstrlenW (lpString=".jpg") returned 4 [0068.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.693] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") [0068.693] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=37390) returned 1 [0068.693] CloseHandle (hObject=0x180) returned 1 [0068.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0068.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0068.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.694] GetLastError () returned 0x0 [0068.694] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x920e, lpOverlapped=0x0) returned 1 [0068.776] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0068.778] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.778] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.778] SetEndOfFile (hFile=0x210) returned 1 [0068.778] CloseHandle (hObject=0x210) returned 1 [0068.778] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.778] SetEndOfFile (hFile=0x180) returned 1 [0068.780] CloseHandle (hObject=0x180) returned 1 [0068.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0068.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.780] lstrlenW (lpString=".doc") returned 4 [0068.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.780] lstrlenW (lpString=".docx") returned 5 [0068.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.780] lstrlenW (lpString=".pdf") returned 4 [0068.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.780] lstrlenW (lpString=".xls") returned 4 [0068.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.780] lstrlenW (lpString=".xlsx") returned 5 [0068.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.780] lstrlenW (lpString=".ppt") returned 4 [0068.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.780] lstrlenW (lpString=".zip") returned 4 [0068.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.781] lstrlenW (lpString=".rar") returned 4 [0068.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".bz2") returned 4 [0068.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".7z") returned 3 [0068.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.781] lstrlenW (lpString=".dbf") returned 4 [0068.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.781] lstrlenW (lpString=".1cd") returned 4 [0068.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.781] lstrlenW (lpString=".jpg") returned 4 [0068.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".pdf") returned 4 [0068.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".xls") returned 4 [0068.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.781] lstrlenW (lpString=".xlsx") returned 5 [0068.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.781] lstrlenW (lpString=".ppt") returned 4 [0068.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.781] lstrlenW (lpString=".zip") returned 4 [0068.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.781] lstrlenW (lpString=".rar") returned 4 [0068.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".bz2") returned 4 [0068.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString=".7z") returned 3 [0068.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.782] lstrlenW (lpString=".dbf") returned 4 [0068.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.782] lstrlenW (lpString=".1cd") returned 4 [0068.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0068.782] lstrlenW (lpString=".jpg") returned 4 [0068.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.782] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") [0070.084] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18194) returned 1 [0070.084] CloseHandle (hObject=0x210) returned 1 [0070.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0070.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.084] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.084] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0070.085] GetLastError () returned 0x0 [0070.085] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4712, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0070.674] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.674] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.674] SetEndOfFile (hFile=0x1c8) returned 1 [0070.674] CloseHandle (hObject=0x1c8) returned 1 [0070.674] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.674] SetEndOfFile (hFile=0x210) returned 1 [0070.675] CloseHandle (hObject=0x210) returned 1 [0070.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0070.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.675] lstrlenW (lpString=".doc") returned 4 [0070.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.675] lstrlenW (lpString=".docx") returned 5 [0070.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.676] lstrlenW (lpString=".pdf") returned 4 [0070.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString=".xls") returned 4 [0070.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.676] lstrlenW (lpString=".xlsx") returned 5 [0070.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.676] lstrlenW (lpString=".ppt") returned 4 [0070.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.676] lstrlenW (lpString=".zip") returned 4 [0070.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.676] lstrlenW (lpString=".rar") returned 4 [0070.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString=".bz2") returned 4 [0070.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString=".7z") returned 3 [0070.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.676] lstrlenW (lpString=".dbf") returned 4 [0070.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.676] lstrlenW (lpString=".1cd") returned 4 [0070.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.676] lstrlenW (lpString=".jpg") returned 4 [0070.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.677] lstrlenW (lpString=".pdf") returned 4 [0070.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.677] lstrlenW (lpString=".xls") returned 4 [0070.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.695] lstrlenW (lpString=".xlsx") returned 5 [0070.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.695] lstrlenW (lpString=".ppt") returned 4 [0070.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.695] lstrlenW (lpString=".zip") returned 4 [0070.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.695] lstrlenW (lpString=".rar") returned 4 [0070.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.695] lstrlenW (lpString=".bz2") returned 4 [0070.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.695] lstrlenW (lpString=".7z") returned 3 [0070.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.695] lstrlenW (lpString=".dbf") returned 4 [0070.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.695] lstrlenW (lpString=".1cd") returned 4 [0070.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0070.695] lstrlenW (lpString=".jpg") returned 4 [0070.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.695] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") [0070.696] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5098) returned 1 [0070.696] CloseHandle (hObject=0x210) returned 1 [0070.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0070.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.696] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.696] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0070.697] GetLastError () returned 0x0 [0070.697] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0070.723] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0070.724] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.724] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.724] SetEndOfFile (hFile=0x1c8) returned 1 [0070.724] CloseHandle (hObject=0x1c8) returned 1 [0070.724] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.724] SetEndOfFile (hFile=0x210) returned 1 [0070.725] CloseHandle (hObject=0x210) returned 1 [0070.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString=".doc") returned 4 [0070.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString=".docx") returned 5 [0070.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.726] lstrlenW (lpString=".pdf") returned 4 [0070.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString=".xls") returned 4 [0070.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.726] lstrlenW (lpString=".xlsx") returned 5 [0070.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.726] lstrlenW (lpString=".ppt") returned 4 [0070.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString=".zip") returned 4 [0070.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.726] lstrlenW (lpString=".rar") returned 4 [0070.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString=".bz2") returned 4 [0070.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString=".7z") returned 3 [0070.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString=".dbf") returned 4 [0070.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString=".1cd") returned 4 [0070.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.726] lstrlenW (lpString=".jpg") returned 4 [0070.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString=".pdf") returned 4 [0070.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString=".xls") returned 4 [0070.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.727] lstrlenW (lpString=".xlsx") returned 5 [0070.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.727] lstrlenW (lpString=".ppt") returned 4 [0070.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.727] lstrlenW (lpString=".zip") returned 4 [0070.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.727] lstrlenW (lpString=".rar") returned 4 [0070.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString=".bz2") returned 4 [0070.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString=".7z") returned 3 [0070.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.727] lstrlenW (lpString=".dbf") returned 4 [0070.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.727] lstrlenW (lpString=".1cd") returned 4 [0070.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0070.727] lstrlenW (lpString=".jpg") returned 4 [0070.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.728] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") [0070.733] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5260) returned 1 [0070.733] CloseHandle (hObject=0x1fc) returned 1 [0070.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0070.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.734] GetLastError () returned 0x0 [0070.734] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x148c, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0070.737] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.737] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.737] SetEndOfFile (hFile=0x190) returned 1 [0070.737] CloseHandle (hObject=0x190) returned 1 [0070.737] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.737] SetEndOfFile (hFile=0x1fc) returned 1 [0070.738] CloseHandle (hObject=0x1fc) returned 1 [0070.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString=".doc") returned 4 [0070.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString=".docx") returned 5 [0070.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.739] lstrlenW (lpString=".pdf") returned 4 [0070.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString=".xls") returned 4 [0070.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.739] lstrlenW (lpString=".xlsx") returned 5 [0070.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.739] lstrlenW (lpString=".ppt") returned 4 [0070.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString=".zip") returned 4 [0070.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.739] lstrlenW (lpString=".rar") returned 4 [0070.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString=".bz2") returned 4 [0070.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString=".7z") returned 3 [0070.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString=".dbf") returned 4 [0070.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString=".1cd") returned 4 [0070.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.739] lstrlenW (lpString=".jpg") returned 4 [0070.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString=".pdf") returned 4 [0070.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString=".xls") returned 4 [0070.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.740] lstrlenW (lpString=".xlsx") returned 5 [0070.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.740] lstrlenW (lpString=".ppt") returned 4 [0070.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.740] lstrlenW (lpString=".zip") returned 4 [0070.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.740] lstrlenW (lpString=".rar") returned 4 [0070.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString=".bz2") returned 4 [0070.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString=".7z") returned 3 [0070.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.740] lstrlenW (lpString=".dbf") returned 4 [0070.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.740] lstrlenW (lpString=".1cd") returned 4 [0070.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0070.740] lstrlenW (lpString=".jpg") returned 4 [0070.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.740] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") [0070.741] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=896) returned 1 [0070.741] CloseHandle (hObject=0x1fc) returned 1 [0070.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0070.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.741] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.741] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.742] GetLastError () returned 0x0 [0070.742] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x380, lpOverlapped=0x0) returned 1 [0070.744] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x390, lpOverlapped=0x0) returned 1 [0070.745] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.745] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.745] SetEndOfFile (hFile=0x190) returned 1 [0070.745] CloseHandle (hObject=0x190) returned 1 [0070.745] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.745] SetEndOfFile (hFile=0x1fc) returned 1 [0070.746] CloseHandle (hObject=0x1fc) returned 1 [0070.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0070.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.746] lstrlenW (lpString=".doc") returned 4 [0070.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.746] lstrlenW (lpString=".docx") returned 5 [0070.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.746] lstrlenW (lpString=".pdf") returned 4 [0070.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.746] lstrlenW (lpString=".xls") returned 4 [0070.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.747] lstrlenW (lpString=".xlsx") returned 5 [0070.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.747] lstrlenW (lpString=".ppt") returned 4 [0070.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.747] lstrlenW (lpString=".zip") returned 4 [0070.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.747] lstrlenW (lpString=".rar") returned 4 [0070.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString=".bz2") returned 4 [0070.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString=".7z") returned 3 [0070.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.747] lstrlenW (lpString=".dbf") returned 4 [0070.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.747] lstrlenW (lpString=".1cd") returned 4 [0070.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.747] lstrlenW (lpString=".jpg") returned 4 [0070.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString=".pdf") returned 4 [0070.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString=".xls") returned 4 [0070.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.747] lstrlenW (lpString=".xlsx") returned 5 [0070.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.747] lstrlenW (lpString=".ppt") returned 4 [0070.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.747] lstrlenW (lpString=".zip") returned 4 [0070.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.748] lstrlenW (lpString=".rar") returned 4 [0070.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.748] lstrlenW (lpString=".bz2") returned 4 [0070.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.748] lstrlenW (lpString=".7z") returned 3 [0070.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.748] lstrlenW (lpString=".dbf") returned 4 [0070.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.748] lstrlenW (lpString=".1cd") returned 4 [0070.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0070.748] lstrlenW (lpString=".jpg") returned 4 [0070.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.748] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") [0070.748] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=752) returned 1 [0070.748] CloseHandle (hObject=0x1fc) returned 1 [0070.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0070.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.749] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.749] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.749] GetLastError () returned 0x0 [0070.749] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2f0, lpOverlapped=0x0) returned 1 [0070.751] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x300, lpOverlapped=0x0) returned 1 [0070.751] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.751] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.752] SetEndOfFile (hFile=0x190) returned 1 [0070.752] CloseHandle (hObject=0x190) returned 1 [0070.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.752] SetEndOfFile (hFile=0x1fc) returned 1 [0070.753] CloseHandle (hObject=0x1fc) returned 1 [0070.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0070.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.753] lstrlenW (lpString=".doc") returned 4 [0070.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.753] lstrlenW (lpString=".docx") returned 5 [0070.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.753] lstrlenW (lpString=".pdf") returned 4 [0070.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.753] lstrlenW (lpString=".xls") returned 4 [0070.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.753] lstrlenW (lpString=".xlsx") returned 5 [0070.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.753] lstrlenW (lpString=".ppt") returned 4 [0070.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.753] lstrlenW (lpString=".zip") returned 4 [0070.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.753] lstrlenW (lpString=".rar") returned 4 [0070.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".bz2") returned 4 [0070.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".7z") returned 3 [0070.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.754] lstrlenW (lpString=".dbf") returned 4 [0070.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.754] lstrlenW (lpString=".1cd") returned 4 [0070.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.754] lstrlenW (lpString=".jpg") returned 4 [0070.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".pdf") returned 4 [0070.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".xls") returned 4 [0070.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.754] lstrlenW (lpString=".xlsx") returned 5 [0070.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.754] lstrlenW (lpString=".ppt") returned 4 [0070.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.754] lstrlenW (lpString=".zip") returned 4 [0070.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.754] lstrlenW (lpString=".rar") returned 4 [0070.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".bz2") returned 4 [0070.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.754] lstrlenW (lpString=".7z") returned 3 [0070.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.754] lstrlenW (lpString=".dbf") returned 4 [0070.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.755] lstrlenW (lpString=".1cd") returned 4 [0070.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0070.755] lstrlenW (lpString=".jpg") returned 4 [0070.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.755] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") [0070.755] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11152) returned 1 [0070.755] CloseHandle (hObject=0x1fc) returned 1 [0070.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0070.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0070.755] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.755] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.756] GetLastError () returned 0x0 [0070.756] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0071.085] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0071.087] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.087] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.087] SetEndOfFile (hFile=0x190) returned 1 [0071.203] CloseHandle (hObject=0x190) returned 1 [0071.203] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.203] SetEndOfFile (hFile=0x1fc) returned 1 [0071.204] CloseHandle (hObject=0x1fc) returned 1 [0071.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0071.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.449] lstrlenW (lpString=".doc") returned 4 [0071.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString=".docx") returned 5 [0071.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.449] lstrlenW (lpString=".pdf") returned 4 [0071.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString=".xls") returned 4 [0071.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.449] lstrlenW (lpString=".xlsx") returned 5 [0071.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.449] lstrlenW (lpString=".ppt") returned 4 [0071.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.449] lstrlenW (lpString=".zip") returned 4 [0071.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.449] lstrlenW (lpString=".rar") returned 4 [0071.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString=".bz2") returned 4 [0071.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString=".7z") returned 3 [0071.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.449] lstrlenW (lpString=".dbf") returned 4 [0071.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.449] lstrlenW (lpString=".1cd") returned 4 [0071.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.450] lstrlenW (lpString=".jpg") returned 4 [0071.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString=".pdf") returned 4 [0071.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString=".xls") returned 4 [0071.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.450] lstrlenW (lpString=".xlsx") returned 5 [0071.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.450] lstrlenW (lpString=".ppt") returned 4 [0071.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.450] lstrlenW (lpString=".zip") returned 4 [0071.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.450] lstrlenW (lpString=".rar") returned 4 [0071.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString=".bz2") returned 4 [0071.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString=".7z") returned 3 [0071.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.450] lstrlenW (lpString=".dbf") returned 4 [0071.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.450] lstrlenW (lpString=".1cd") returned 4 [0071.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0071.450] lstrlenW (lpString=".jpg") returned 4 [0071.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.450] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") [0072.456] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2332) returned 1 [0072.456] CloseHandle (hObject=0x210) returned 1 [0072.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0072.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.210] GetLastError () returned 0x0 [0073.210] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x91c, lpOverlapped=0x0) returned 1 [0073.218] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x920, lpOverlapped=0x0) returned 1 [0073.583] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.583] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.583] SetEndOfFile (hFile=0x154) returned 1 [0073.584] CloseHandle (hObject=0x154) returned 1 [0073.584] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.584] SetEndOfFile (hFile=0x210) returned 1 [0073.584] CloseHandle (hObject=0x210) returned 1 [0073.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0073.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.585] lstrlenW (lpString=".doc") returned 4 [0073.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.585] lstrlenW (lpString=".docx") returned 5 [0073.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.585] lstrlenW (lpString=".pdf") returned 4 [0073.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.585] lstrlenW (lpString=".xls") returned 4 [0073.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.585] lstrlenW (lpString=".xlsx") returned 5 [0073.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.585] lstrlenW (lpString=".ppt") returned 4 [0073.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.585] lstrlenW (lpString=".zip") returned 4 [0073.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.586] lstrlenW (lpString=".rar") returned 4 [0073.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".bz2") returned 4 [0073.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".7z") returned 3 [0073.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.586] lstrlenW (lpString=".dbf") returned 4 [0073.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.586] lstrlenW (lpString=".1cd") returned 4 [0073.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.586] lstrlenW (lpString=".jpg") returned 4 [0073.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".pdf") returned 4 [0073.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".xls") returned 4 [0073.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.586] lstrlenW (lpString=".xlsx") returned 5 [0073.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.586] lstrlenW (lpString=".ppt") returned 4 [0073.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.586] lstrlenW (lpString=".zip") returned 4 [0073.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.586] lstrlenW (lpString=".rar") returned 4 [0073.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".bz2") returned 4 [0073.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.586] lstrlenW (lpString=".7z") returned 3 [0073.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.587] lstrlenW (lpString=".dbf") returned 4 [0073.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.587] lstrlenW (lpString=".1cd") returned 4 [0073.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0073.587] lstrlenW (lpString=".jpg") returned 4 [0073.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.587] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") [0073.588] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2472) returned 1 [0073.588] CloseHandle (hObject=0x210) returned 1 [0073.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0073.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.589] GetLastError () returned 0x0 [0073.589] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9a8, lpOverlapped=0x0) returned 1 [0073.590] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0073.592] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.592] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.592] SetEndOfFile (hFile=0x154) returned 1 [0073.592] CloseHandle (hObject=0x154) returned 1 [0073.592] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.592] SetEndOfFile (hFile=0x210) returned 1 [0073.593] CloseHandle (hObject=0x210) returned 1 [0073.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0073.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.593] lstrlenW (lpString=".doc") returned 4 [0073.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.593] lstrlenW (lpString=".docx") returned 5 [0073.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.593] lstrlenW (lpString=".pdf") returned 4 [0073.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.593] lstrlenW (lpString=".xls") returned 4 [0073.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.593] lstrlenW (lpString=".xlsx") returned 5 [0073.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.593] lstrlenW (lpString=".ppt") returned 4 [0073.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.594] lstrlenW (lpString=".zip") returned 4 [0073.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.594] lstrlenW (lpString=".rar") returned 4 [0073.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString=".bz2") returned 4 [0073.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString=".7z") returned 3 [0073.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.594] lstrlenW (lpString=".dbf") returned 4 [0073.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.594] lstrlenW (lpString=".1cd") returned 4 [0073.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.594] lstrlenW (lpString=".jpg") returned 4 [0073.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString=".pdf") returned 4 [0073.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString=".xls") returned 4 [0073.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.594] lstrlenW (lpString=".xlsx") returned 5 [0073.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.594] lstrlenW (lpString=".ppt") returned 4 [0073.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.594] lstrlenW (lpString=".zip") returned 4 [0073.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.594] lstrlenW (lpString=".rar") returned 4 [0073.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.594] lstrlenW (lpString=".bz2") returned 4 [0073.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.595] lstrlenW (lpString=".7z") returned 3 [0073.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.595] lstrlenW (lpString=".dbf") returned 4 [0073.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.595] lstrlenW (lpString=".1cd") returned 4 [0073.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0073.595] lstrlenW (lpString=".jpg") returned 4 [0073.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.595] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") [0073.596] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2232) returned 1 [0073.596] CloseHandle (hObject=0x210) returned 1 [0073.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0073.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.596] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.596] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.597] GetLastError () returned 0x0 [0073.597] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0073.599] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0073.600] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.600] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.600] SetEndOfFile (hFile=0x154) returned 1 [0073.600] CloseHandle (hObject=0x154) returned 1 [0073.600] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.600] SetEndOfFile (hFile=0x210) returned 1 [0073.601] CloseHandle (hObject=0x210) returned 1 [0073.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0073.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.601] lstrlenW (lpString=".doc") returned 4 [0073.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.601] lstrlenW (lpString=".docx") returned 5 [0073.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.601] lstrlenW (lpString=".pdf") returned 4 [0073.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.601] lstrlenW (lpString=".xls") returned 4 [0073.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.602] lstrlenW (lpString=".xlsx") returned 5 [0073.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.602] lstrlenW (lpString=".ppt") returned 4 [0073.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.602] lstrlenW (lpString=".zip") returned 4 [0073.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.602] lstrlenW (lpString=".rar") returned 4 [0073.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString=".bz2") returned 4 [0073.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString=".7z") returned 3 [0073.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.602] lstrlenW (lpString=".dbf") returned 4 [0073.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.602] lstrlenW (lpString=".1cd") returned 4 [0073.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.602] lstrlenW (lpString=".jpg") returned 4 [0073.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString=".pdf") returned 4 [0073.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString=".xls") returned 4 [0073.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.602] lstrlenW (lpString=".xlsx") returned 5 [0073.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.602] lstrlenW (lpString=".ppt") returned 4 [0073.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.603] lstrlenW (lpString=".zip") returned 4 [0073.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.603] lstrlenW (lpString=".rar") returned 4 [0073.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.603] lstrlenW (lpString=".bz2") returned 4 [0073.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.603] lstrlenW (lpString=".7z") returned 3 [0073.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.603] lstrlenW (lpString=".dbf") returned 4 [0073.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.603] lstrlenW (lpString=".1cd") returned 4 [0073.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0073.603] lstrlenW (lpString=".jpg") returned 4 [0073.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.603] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") [0073.603] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1026) returned 1 [0073.603] CloseHandle (hObject=0x210) returned 1 [0073.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0073.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.604] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.604] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.604] GetLastError () returned 0x0 [0073.604] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x402, lpOverlapped=0x0) returned 1 [0073.606] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x410, lpOverlapped=0x0) returned 1 [0073.606] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.606] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.607] SetEndOfFile (hFile=0x154) returned 1 [0073.607] CloseHandle (hObject=0x154) returned 1 [0073.607] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.607] SetEndOfFile (hFile=0x210) returned 1 [0073.607] CloseHandle (hObject=0x210) returned 1 [0073.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0073.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.608] lstrlenW (lpString=".doc") returned 4 [0073.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.608] lstrlenW (lpString=".docx") returned 5 [0073.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.608] lstrlenW (lpString=".pdf") returned 4 [0073.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.608] lstrlenW (lpString=".xls") returned 4 [0073.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.608] lstrlenW (lpString=".xlsx") returned 5 [0073.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.608] lstrlenW (lpString=".ppt") returned 4 [0073.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.608] lstrlenW (lpString=".zip") returned 4 [0073.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.608] lstrlenW (lpString=".rar") returned 4 [0073.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.608] lstrlenW (lpString=".bz2") returned 4 [0073.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString=".7z") returned 3 [0073.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".dbf") returned 4 [0073.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".1cd") returned 4 [0073.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".jpg") returned 4 [0073.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString=".pdf") returned 4 [0073.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString=".xls") returned 4 [0073.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.609] lstrlenW (lpString=".xlsx") returned 5 [0073.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.609] lstrlenW (lpString=".ppt") returned 4 [0073.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".zip") returned 4 [0073.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.609] lstrlenW (lpString=".rar") returned 4 [0073.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString=".bz2") returned 4 [0073.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString=".7z") returned 3 [0073.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".dbf") returned 4 [0073.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.609] lstrlenW (lpString=".1cd") returned 4 [0073.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0073.610] lstrlenW (lpString=".jpg") returned 4 [0073.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.610] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") [0073.610] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3286) returned 1 [0073.610] CloseHandle (hObject=0x210) returned 1 [0073.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0073.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.610] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.610] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.611] GetLastError () returned 0x0 [0073.611] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0073.637] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0073.638] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.638] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.638] SetEndOfFile (hFile=0x154) returned 1 [0073.638] CloseHandle (hObject=0x154) returned 1 [0073.638] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.638] SetEndOfFile (hFile=0x210) returned 1 [0073.639] CloseHandle (hObject=0x210) returned 1 [0073.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0073.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0073.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.639] lstrlenW (lpString=".doc") returned 4 [0073.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.639] lstrlenW (lpString=".docx") returned 5 [0073.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.639] lstrlenW (lpString=".pdf") returned 4 [0073.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.639] lstrlenW (lpString=".xls") returned 4 [0073.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.640] lstrlenW (lpString=".xlsx") returned 5 [0073.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.640] lstrlenW (lpString=".ppt") returned 4 [0073.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.640] lstrlenW (lpString=".zip") returned 4 [0073.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.640] lstrlenW (lpString=".rar") returned 4 [0073.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString=".bz2") returned 4 [0073.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString=".7z") returned 3 [0073.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.640] lstrlenW (lpString=".dbf") returned 4 [0073.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.640] lstrlenW (lpString=".1cd") returned 4 [0073.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.640] lstrlenW (lpString=".jpg") returned 4 [0073.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString=".pdf") returned 4 [0073.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString=".xls") returned 4 [0073.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.640] lstrlenW (lpString=".xlsx") returned 5 [0073.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.640] lstrlenW (lpString=".ppt") returned 4 [0073.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.640] lstrlenW (lpString=".zip") returned 4 [0073.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.641] lstrlenW (lpString=".rar") returned 4 [0073.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.641] lstrlenW (lpString=".bz2") returned 4 [0073.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.641] lstrlenW (lpString=".7z") returned 3 [0073.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.641] lstrlenW (lpString=".dbf") returned 4 [0073.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.641] lstrlenW (lpString=".1cd") returned 4 [0073.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0073.641] lstrlenW (lpString=".jpg") returned 4 [0073.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.641] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") [0073.641] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1528) returned 1 [0073.641] CloseHandle (hObject=0x210) returned 1 [0073.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0073.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0073.642] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.642] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0073.642] GetLastError () returned 0x0 [0073.642] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0073.935] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x600, lpOverlapped=0x0) returned 1 [0073.938] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.938] WriteFile (in: hFile=0x154, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.938] SetEndOfFile (hFile=0x154) returned 1 [0074.059] CloseHandle (hObject=0x154) returned 1 [0074.060] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.060] SetEndOfFile (hFile=0x210) returned 1 [0074.060] CloseHandle (hObject=0x210) returned 1 [0074.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0074.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.108] lstrlenW (lpString=".doc") returned 4 [0074.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.108] lstrlenW (lpString=".docx") returned 5 [0074.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.108] lstrlenW (lpString=".pdf") returned 4 [0074.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.108] lstrlenW (lpString=".xls") returned 4 [0074.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.108] lstrlenW (lpString=".xlsx") returned 5 [0074.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.108] lstrlenW (lpString=".ppt") returned 4 [0074.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.108] lstrlenW (lpString=".zip") returned 4 [0074.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.109] lstrlenW (lpString=".rar") returned 4 [0074.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString=".bz2") returned 4 [0074.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString=".7z") returned 3 [0074.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString=".dbf") returned 4 [0074.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString=".1cd") returned 4 [0074.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString=".jpg") returned 4 [0074.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString=".doc") returned 4 [0074.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString=".docx") returned 5 [0074.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.109] lstrlenW (lpString=".pdf") returned 4 [0074.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString=".xls") returned 4 [0074.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.109] lstrlenW (lpString=".xlsx") returned 5 [0074.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.109] lstrlenW (lpString=".ppt") returned 4 [0074.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.109] lstrlenW (lpString=".zip") returned 4 [0074.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.109] lstrlenW (lpString=".rar") returned 4 [0074.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.110] lstrlenW (lpString=".bz2") returned 4 [0074.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.110] lstrlenW (lpString=".7z") returned 3 [0074.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.110] lstrlenW (lpString=".dbf") returned 4 [0074.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.110] lstrlenW (lpString=".1cd") returned 4 [0074.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0074.110] lstrlenW (lpString=".jpg") returned 4 [0074.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.110] lstrlenW (lpString="HH00681_.WMF") returned 12 [0074.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.233] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9300) returned 1 [0074.234] CloseHandle (hObject=0x154) returned 1 [0074.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0074.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.306] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.306] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.306] GetLastError () returned 0x0 [0074.306] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2454, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0074.309] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.309] SetEndOfFile (hFile=0x1ec) returned 1 [0074.309] CloseHandle (hObject=0x1ec) returned 1 [0074.309] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.309] SetEndOfFile (hFile=0x154) returned 1 [0074.310] CloseHandle (hObject=0x154) returned 1 [0074.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0074.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.310] lstrlenW (lpString=".doc") returned 4 [0074.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.310] lstrlenW (lpString=".docx") returned 5 [0074.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.310] lstrlenW (lpString=".pdf") returned 4 [0074.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.310] lstrlenW (lpString=".xls") returned 4 [0074.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.310] lstrlenW (lpString=".xlsx") returned 5 [0074.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.310] lstrlenW (lpString=".ppt") returned 4 [0074.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.311] lstrlenW (lpString=".zip") returned 4 [0074.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.311] lstrlenW (lpString=".rar") returned 4 [0074.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString=".bz2") returned 4 [0074.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString=".7z") returned 3 [0074.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.311] lstrlenW (lpString=".dbf") returned 4 [0074.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.311] lstrlenW (lpString=".1cd") returned 4 [0074.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.311] lstrlenW (lpString=".jpg") returned 4 [0074.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString=".pdf") returned 4 [0074.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString=".xls") returned 4 [0074.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.311] lstrlenW (lpString=".xlsx") returned 5 [0074.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.311] lstrlenW (lpString=".ppt") returned 4 [0074.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.311] lstrlenW (lpString=".zip") returned 4 [0074.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.311] lstrlenW (lpString=".rar") returned 4 [0074.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.311] lstrlenW (lpString=".bz2") returned 4 [0074.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.312] lstrlenW (lpString=".7z") returned 3 [0074.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.312] lstrlenW (lpString=".dbf") returned 4 [0074.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.312] lstrlenW (lpString=".1cd") returned 4 [0074.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0074.312] lstrlenW (lpString=".jpg") returned 4 [0074.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.312] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") [0074.312] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6016) returned 1 [0074.312] CloseHandle (hObject=0x154) returned 1 [0074.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0074.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.313] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.313] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.313] GetLastError () returned 0x0 [0074.313] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1780, lpOverlapped=0x0) returned 1 [0074.358] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0074.359] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.359] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.359] SetEndOfFile (hFile=0x1ec) returned 1 [0074.359] CloseHandle (hObject=0x1ec) returned 1 [0074.359] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.359] SetEndOfFile (hFile=0x154) returned 1 [0074.360] CloseHandle (hObject=0x154) returned 1 [0074.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.360] lstrlenW (lpString=".doc") returned 4 [0074.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.360] lstrlenW (lpString=".docx") returned 5 [0074.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.360] lstrlenW (lpString=".pdf") returned 4 [0074.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString=".xls") returned 4 [0074.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.361] lstrlenW (lpString=".xlsx") returned 5 [0074.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.361] lstrlenW (lpString=".ppt") returned 4 [0074.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.361] lstrlenW (lpString=".zip") returned 4 [0074.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.361] lstrlenW (lpString=".rar") returned 4 [0074.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString=".bz2") returned 4 [0074.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString=".7z") returned 3 [0074.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.361] lstrlenW (lpString=".dbf") returned 4 [0074.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.361] lstrlenW (lpString=".1cd") returned 4 [0074.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.361] lstrlenW (lpString=".jpg") returned 4 [0074.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString=".pdf") returned 4 [0074.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString=".xls") returned 4 [0074.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.361] lstrlenW (lpString=".xlsx") returned 5 [0074.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.361] lstrlenW (lpString=".ppt") returned 4 [0074.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.361] lstrlenW (lpString=".zip") returned 4 [0074.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.362] lstrlenW (lpString=".rar") returned 4 [0074.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.362] lstrlenW (lpString=".bz2") returned 4 [0074.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.362] lstrlenW (lpString=".7z") returned 3 [0074.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.362] lstrlenW (lpString=".dbf") returned 4 [0074.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.362] lstrlenW (lpString=".1cd") returned 4 [0074.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0074.362] lstrlenW (lpString=".jpg") returned 4 [0074.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.362] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") [0074.362] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5958) returned 1 [0074.362] CloseHandle (hObject=0x154) returned 1 [0074.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0074.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.363] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.363] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.363] GetLastError () returned 0x0 [0074.363] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1746, lpOverlapped=0x0) returned 1 [0074.365] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0074.366] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.366] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.366] SetEndOfFile (hFile=0x1ec) returned 1 [0074.366] CloseHandle (hObject=0x1ec) returned 1 [0074.366] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.366] SetEndOfFile (hFile=0x154) returned 1 [0074.367] CloseHandle (hObject=0x154) returned 1 [0074.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.370] lstrlenW (lpString=".doc") returned 4 [0074.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.370] lstrlenW (lpString=".docx") returned 5 [0074.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.370] lstrlenW (lpString=".pdf") returned 4 [0074.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.370] lstrlenW (lpString=".xls") returned 4 [0074.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.370] lstrlenW (lpString=".xlsx") returned 5 [0074.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.370] lstrlenW (lpString=".ppt") returned 4 [0074.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.371] lstrlenW (lpString=".zip") returned 4 [0074.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.371] lstrlenW (lpString=".rar") returned 4 [0074.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString=".bz2") returned 4 [0074.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString=".7z") returned 3 [0074.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.371] lstrlenW (lpString=".dbf") returned 4 [0074.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.371] lstrlenW (lpString=".1cd") returned 4 [0074.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.371] lstrlenW (lpString=".jpg") returned 4 [0074.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString=".pdf") returned 4 [0074.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString=".xls") returned 4 [0074.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.371] lstrlenW (lpString=".xlsx") returned 5 [0074.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.371] lstrlenW (lpString=".ppt") returned 4 [0074.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.371] lstrlenW (lpString=".zip") returned 4 [0074.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.371] lstrlenW (lpString=".rar") returned 4 [0074.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.371] lstrlenW (lpString=".bz2") returned 4 [0074.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.372] lstrlenW (lpString=".7z") returned 3 [0074.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.372] lstrlenW (lpString=".dbf") returned 4 [0074.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.372] lstrlenW (lpString=".1cd") returned 4 [0074.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0074.372] lstrlenW (lpString=".jpg") returned 4 [0074.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.372] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") [0074.372] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7296) returned 1 [0074.372] CloseHandle (hObject=0x154) returned 1 [0074.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0074.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.373] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.373] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.373] GetLastError () returned 0x0 [0074.373] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1c80, lpOverlapped=0x0) returned 1 [0074.491] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0074.492] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.492] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.492] SetEndOfFile (hFile=0x1ec) returned 1 [0074.496] CloseHandle (hObject=0x1ec) returned 1 [0074.496] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.496] SetEndOfFile (hFile=0x154) returned 1 [0074.497] CloseHandle (hObject=0x154) returned 1 [0074.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0074.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.516] lstrlenW (lpString=".doc") returned 4 [0074.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.516] lstrlenW (lpString=".docx") returned 5 [0074.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.516] lstrlenW (lpString=".pdf") returned 4 [0074.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.516] lstrlenW (lpString=".xls") returned 4 [0074.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.516] lstrlenW (lpString=".xlsx") returned 5 [0074.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.517] lstrlenW (lpString=".ppt") returned 4 [0074.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString=".zip") returned 4 [0074.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.517] lstrlenW (lpString=".rar") returned 4 [0074.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString=".bz2") returned 4 [0074.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString=".7z") returned 3 [0074.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString=".dbf") returned 4 [0074.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString=".1cd") returned 4 [0074.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString=".jpg") returned 4 [0074.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.517] lstrlenW (lpString=".doc") returned 4 [0074.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString=".docx") returned 5 [0074.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.517] lstrlenW (lpString=".pdf") returned 4 [0074.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.517] lstrlenW (lpString=".xls") returned 4 [0074.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.517] lstrlenW (lpString=".xlsx") returned 5 [0074.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.518] lstrlenW (lpString=".ppt") returned 4 [0074.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.518] lstrlenW (lpString=".zip") returned 4 [0074.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.518] lstrlenW (lpString=".rar") returned 4 [0074.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString=".bz2") returned 4 [0074.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString=".7z") returned 3 [0074.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.518] lstrlenW (lpString=".dbf") returned 4 [0074.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.518] lstrlenW (lpString=".1cd") returned 4 [0074.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0074.518] lstrlenW (lpString=".jpg") returned 4 [0074.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.518] lstrlenW (lpString="HM00426_.WMF") returned 12 [0074.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.519] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=68776) returned 1 [0074.519] CloseHandle (hObject=0x1f4) returned 1 [0074.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0074.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0074.519] GetLastError () returned 0x0 [0074.519] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0074.531] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0074.536] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.536] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.536] SetEndOfFile (hFile=0x158) returned 1 [0074.542] CloseHandle (hObject=0x158) returned 1 [0074.542] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.542] SetEndOfFile (hFile=0x1f4) returned 1 [0074.543] CloseHandle (hObject=0x1f4) returned 1 [0074.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.547] lstrlenW (lpString=".doc") returned 4 [0074.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".docx") returned 5 [0074.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.547] lstrlenW (lpString=".pdf") returned 4 [0074.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".xls") returned 4 [0074.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.548] lstrlenW (lpString=".xlsx") returned 5 [0074.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.548] lstrlenW (lpString=".ppt") returned 4 [0074.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString=".zip") returned 4 [0074.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.548] lstrlenW (lpString=".rar") returned 4 [0074.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".bz2") returned 4 [0074.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".7z") returned 3 [0074.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString=".dbf") returned 4 [0074.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString=".1cd") returned 4 [0074.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString=".jpg") returned 4 [0074.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.548] lstrlenW (lpString=".doc") returned 4 [0074.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".docx") returned 5 [0074.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.548] lstrlenW (lpString=".pdf") returned 4 [0074.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".xls") returned 4 [0074.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.549] lstrlenW (lpString=".xlsx") returned 5 [0074.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.549] lstrlenW (lpString=".ppt") returned 4 [0074.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.549] lstrlenW (lpString=".zip") returned 4 [0074.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.549] lstrlenW (lpString=".rar") returned 4 [0074.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString=".bz2") returned 4 [0074.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString=".7z") returned 3 [0074.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.549] lstrlenW (lpString=".dbf") returned 4 [0074.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.549] lstrlenW (lpString=".1cd") returned 4 [0074.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0074.549] lstrlenW (lpString=".jpg") returned 4 [0074.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="IN00177_.WMF") returned 12 [0074.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.558] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1074) returned 1 [0074.558] CloseHandle (hObject=0x154) returned 1 [0074.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0074.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.559] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.559] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.559] GetLastError () returned 0x0 [0074.559] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x432, lpOverlapped=0x0) returned 1 [0074.641] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x440, lpOverlapped=0x0) returned 1 [0074.642] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.642] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.642] SetEndOfFile (hFile=0x1ec) returned 1 [0074.642] CloseHandle (hObject=0x1ec) returned 1 [0074.642] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.642] SetEndOfFile (hFile=0x154) returned 1 [0074.643] CloseHandle (hObject=0x154) returned 1 [0074.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.646] lstrlenW (lpString=".doc") returned 4 [0074.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.646] lstrlenW (lpString=".docx") returned 5 [0074.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.646] lstrlenW (lpString=".pdf") returned 4 [0074.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.646] lstrlenW (lpString=".xls") returned 4 [0074.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.646] lstrlenW (lpString=".xlsx") returned 5 [0074.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.646] lstrlenW (lpString=".ppt") returned 4 [0074.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.646] lstrlenW (lpString=".zip") returned 4 [0074.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.646] lstrlenW (lpString=".rar") returned 4 [0074.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.646] lstrlenW (lpString=".bz2") returned 4 [0074.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.646] lstrlenW (lpString=".7z") returned 3 [0074.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString=".dbf") returned 4 [0074.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString=".1cd") returned 4 [0074.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString=".jpg") returned 4 [0074.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString=".doc") returned 4 [0074.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString=".docx") returned 5 [0074.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.647] lstrlenW (lpString=".pdf") returned 4 [0074.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString=".xls") returned 4 [0074.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.647] lstrlenW (lpString=".xlsx") returned 5 [0074.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.647] lstrlenW (lpString=".ppt") returned 4 [0074.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.647] lstrlenW (lpString=".zip") returned 4 [0074.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.647] lstrlenW (lpString=".rar") returned 4 [0074.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString=".bz2") returned 4 [0074.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.647] lstrlenW (lpString=".7z") returned 3 [0074.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.648] lstrlenW (lpString=".dbf") returned 4 [0074.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.648] lstrlenW (lpString=".1cd") returned 4 [0074.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0074.648] lstrlenW (lpString=".jpg") returned 4 [0074.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.648] lstrlenW (lpString="IN00557_.WMF") returned 12 [0074.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.648] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9172) returned 1 [0074.648] CloseHandle (hObject=0x154) returned 1 [0074.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0074.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.649] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.649] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.649] GetLastError () returned 0x0 [0074.649] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x23d4, lpOverlapped=0x0) returned 1 [0074.701] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0074.702] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.703] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.703] SetEndOfFile (hFile=0x1ec) returned 1 [0074.703] CloseHandle (hObject=0x1ec) returned 1 [0074.703] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.703] SetEndOfFile (hFile=0x154) returned 1 [0074.704] CloseHandle (hObject=0x154) returned 1 [0074.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.704] lstrlenW (lpString=".doc") returned 4 [0074.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.704] lstrlenW (lpString=".docx") returned 5 [0074.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.704] lstrlenW (lpString=".pdf") returned 4 [0074.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString=".xls") returned 4 [0074.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.705] lstrlenW (lpString=".xlsx") returned 5 [0074.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.705] lstrlenW (lpString=".ppt") returned 4 [0074.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString=".zip") returned 4 [0074.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.705] lstrlenW (lpString=".rar") returned 4 [0074.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString=".bz2") returned 4 [0074.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString=".7z") returned 3 [0074.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString=".dbf") returned 4 [0074.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString=".1cd") returned 4 [0074.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString=".jpg") returned 4 [0074.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.705] lstrlenW (lpString=".doc") returned 4 [0074.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString=".docx") returned 5 [0074.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.705] lstrlenW (lpString=".pdf") returned 4 [0074.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.705] lstrlenW (lpString=".xls") returned 4 [0074.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.706] lstrlenW (lpString=".xlsx") returned 5 [0074.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.706] lstrlenW (lpString=".ppt") returned 4 [0074.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.706] lstrlenW (lpString=".zip") returned 4 [0074.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.706] lstrlenW (lpString=".rar") returned 4 [0074.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString=".bz2") returned 4 [0074.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString=".7z") returned 3 [0074.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.706] lstrlenW (lpString=".dbf") returned 4 [0074.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.706] lstrlenW (lpString=".1cd") returned 4 [0074.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0074.706] lstrlenW (lpString=".jpg") returned 4 [0074.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.706] lstrlenW (lpString="IN00919_.WMF") returned 12 [0074.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.707] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6920) returned 1 [0074.707] CloseHandle (hObject=0x154) returned 1 [0074.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0074.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.707] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.707] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.707] GetLastError () returned 0x0 [0074.707] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1b08, lpOverlapped=0x0) returned 1 [0074.709] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0074.710] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.710] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.710] SetEndOfFile (hFile=0x1ec) returned 1 [0074.710] CloseHandle (hObject=0x1ec) returned 1 [0074.710] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.710] SetEndOfFile (hFile=0x154) returned 1 [0074.711] CloseHandle (hObject=0x154) returned 1 [0074.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0074.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.711] lstrlenW (lpString=".doc") returned 4 [0074.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString=".docx") returned 5 [0074.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.712] lstrlenW (lpString=".pdf") returned 4 [0074.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString=".xls") returned 4 [0074.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.712] lstrlenW (lpString=".xlsx") returned 5 [0074.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.712] lstrlenW (lpString=".ppt") returned 4 [0074.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString=".zip") returned 4 [0074.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.712] lstrlenW (lpString=".rar") returned 4 [0074.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString=".bz2") returned 4 [0074.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString=".7z") returned 3 [0074.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString=".dbf") returned 4 [0074.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString=".1cd") returned 4 [0074.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString=".jpg") returned 4 [0074.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.712] lstrlenW (lpString=".doc") returned 4 [0074.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString=".docx") returned 5 [0074.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.713] lstrlenW (lpString=".pdf") returned 4 [0074.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString=".xls") returned 4 [0074.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.713] lstrlenW (lpString=".xlsx") returned 5 [0074.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.713] lstrlenW (lpString=".ppt") returned 4 [0074.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.713] lstrlenW (lpString=".zip") returned 4 [0074.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.713] lstrlenW (lpString=".rar") returned 4 [0074.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString=".bz2") returned 4 [0074.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString=".7z") returned 3 [0074.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.713] lstrlenW (lpString=".dbf") returned 4 [0074.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.713] lstrlenW (lpString=".1cd") returned 4 [0074.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0074.713] lstrlenW (lpString=".jpg") returned 4 [0074.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.713] lstrlenW (lpString="IN00956_.WMF") returned 12 [0074.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.714] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1256) returned 1 [0074.714] CloseHandle (hObject=0x154) returned 1 [0074.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0074.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0074.714] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.714] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.715] GetLastError () returned 0x0 [0074.715] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4e8, lpOverlapped=0x0) returned 1 [0074.748] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0074.749] ReadFile (in: hFile=0x154, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.749] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.749] SetEndOfFile (hFile=0x1ec) returned 1 [0074.750] CloseHandle (hObject=0x1ec) returned 1 [0074.750] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.750] SetEndOfFile (hFile=0x154) returned 1 [0074.751] CloseHandle (hObject=0x154) returned 1 [0074.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0074.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString=".doc") returned 4 [0074.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString=".docx") returned 5 [0074.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.763] lstrlenW (lpString=".pdf") returned 4 [0074.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString=".xls") returned 4 [0074.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.763] lstrlenW (lpString=".xlsx") returned 5 [0074.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.763] lstrlenW (lpString=".ppt") returned 4 [0074.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString=".zip") returned 4 [0074.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.763] lstrlenW (lpString=".rar") returned 4 [0074.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString=".bz2") returned 4 [0074.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString=".7z") returned 3 [0074.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString=".dbf") returned 4 [0074.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString=".1cd") returned 4 [0074.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString=".jpg") returned 4 [0074.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.764] lstrlenW (lpString=".doc") returned 4 [0074.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString=".docx") returned 5 [0074.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.764] lstrlenW (lpString=".pdf") returned 4 [0074.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString=".xls") returned 4 [0074.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.764] lstrlenW (lpString=".xlsx") returned 5 [0074.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.764] lstrlenW (lpString=".ppt") returned 4 [0074.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.764] lstrlenW (lpString=".zip") returned 4 [0074.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.764] lstrlenW (lpString=".rar") returned 4 [0074.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString=".bz2") returned 4 [0074.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString=".7z") returned 3 [0074.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.764] lstrlenW (lpString=".dbf") returned 4 [0074.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.764] lstrlenW (lpString=".1cd") returned 4 [0074.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0074.764] lstrlenW (lpString=".jpg") returned 4 [0074.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.764] lstrlenW (lpString="J0086384.WMF") returned 12 [0074.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.257] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9734) returned 1 [0075.257] CloseHandle (hObject=0x1f4) returned 1 [0075.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0075.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.258] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.258] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.258] GetLastError () returned 0x0 [0075.258] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2606, lpOverlapped=0x0) returned 1 [0075.260] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0075.262] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.262] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.262] SetEndOfFile (hFile=0x210) returned 1 [0075.262] CloseHandle (hObject=0x210) returned 1 [0075.262] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.262] SetEndOfFile (hFile=0x1f4) returned 1 [0075.263] CloseHandle (hObject=0x1f4) returned 1 [0075.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0075.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.263] lstrlenW (lpString=".doc") returned 4 [0075.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.263] lstrlenW (lpString=".docx") returned 5 [0075.263] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0075.264] lstrlenW (lpString=".pdf") returned 4 [0075.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString=".xls") returned 4 [0075.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.264] lstrlenW (lpString=".xlsx") returned 5 [0075.264] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0075.264] lstrlenW (lpString=".ppt") returned 4 [0075.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.264] lstrlenW (lpString=".zip") returned 4 [0075.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.264] lstrlenW (lpString=".rar") returned 4 [0075.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString=".bz2") returned 4 [0075.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString=".7z") returned 3 [0075.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.264] lstrlenW (lpString=".dbf") returned 4 [0075.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.264] lstrlenW (lpString=".1cd") returned 4 [0075.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0075.264] lstrlenW (lpString=".jpg") returned 4 [0075.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.264] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") [0075.265] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9596) returned 1 [0075.265] CloseHandle (hObject=0x1f4) returned 1 [0075.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0075.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.265] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.265] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.265] GetLastError () returned 0x0 [0075.265] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x257c, lpOverlapped=0x0) returned 1 [0075.267] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0075.271] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.271] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.271] SetEndOfFile (hFile=0x210) returned 1 [0075.271] CloseHandle (hObject=0x210) returned 1 [0075.271] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.271] SetEndOfFile (hFile=0x1f4) returned 1 [0075.272] CloseHandle (hObject=0x1f4) returned 1 [0075.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0075.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.272] lstrlenW (lpString=".doc") returned 4 [0075.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.272] lstrlenW (lpString=".docx") returned 5 [0075.272] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0075.272] lstrlenW (lpString=".pdf") returned 4 [0075.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.272] lstrlenW (lpString=".xls") returned 4 [0075.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.272] lstrlenW (lpString=".xlsx") returned 5 [0075.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0075.272] lstrlenW (lpString=".ppt") returned 4 [0075.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.273] lstrlenW (lpString=".zip") returned 4 [0075.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.273] lstrlenW (lpString=".rar") returned 4 [0075.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.273] lstrlenW (lpString=".bz2") returned 4 [0075.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.273] lstrlenW (lpString=".7z") returned 3 [0075.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.273] lstrlenW (lpString=".dbf") returned 4 [0075.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.273] lstrlenW (lpString=".1cd") returned 4 [0075.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0075.273] lstrlenW (lpString=".jpg") returned 4 [0075.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.273] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") [0075.273] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17016) returned 1 [0075.273] CloseHandle (hObject=0x1f4) returned 1 [0075.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0075.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.274] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.274] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.274] GetLastError () returned 0x0 [0075.274] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4278, lpOverlapped=0x0) returned 1 [0075.320] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0075.321] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.321] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.321] SetEndOfFile (hFile=0x210) returned 1 [0075.321] CloseHandle (hObject=0x210) returned 1 [0075.321] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.321] SetEndOfFile (hFile=0x1f4) returned 1 [0075.322] CloseHandle (hObject=0x1f4) returned 1 [0075.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0075.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.322] lstrlenW (lpString=".doc") returned 4 [0075.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.322] lstrlenW (lpString=".docx") returned 5 [0075.323] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0075.323] lstrlenW (lpString=".pdf") returned 4 [0075.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString=".xls") returned 4 [0075.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.323] lstrlenW (lpString=".xlsx") returned 5 [0075.323] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0075.323] lstrlenW (lpString=".ppt") returned 4 [0075.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.323] lstrlenW (lpString=".zip") returned 4 [0075.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.323] lstrlenW (lpString=".rar") returned 4 [0075.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString=".bz2") returned 4 [0075.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString=".7z") returned 3 [0075.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.323] lstrlenW (lpString=".dbf") returned 4 [0075.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.323] lstrlenW (lpString=".1cd") returned 4 [0075.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0075.323] lstrlenW (lpString=".jpg") returned 4 [0075.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.323] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") [0075.324] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21782) returned 1 [0075.324] CloseHandle (hObject=0x1f4) returned 1 [0075.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0075.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.324] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.324] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.324] GetLastError () returned 0x0 [0075.324] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5516, lpOverlapped=0x0) returned 1 [0075.373] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5520, lpOverlapped=0x0) returned 1 [0075.375] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.375] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.375] SetEndOfFile (hFile=0x210) returned 1 [0075.375] CloseHandle (hObject=0x210) returned 1 [0075.375] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.375] SetEndOfFile (hFile=0x1f4) returned 1 [0075.376] CloseHandle (hObject=0x1f4) returned 1 [0075.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0075.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.377] lstrlenW (lpString=".doc") returned 4 [0075.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.377] lstrlenW (lpString=".docx") returned 5 [0075.377] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0075.377] lstrlenW (lpString=".pdf") returned 4 [0075.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.377] lstrlenW (lpString=".xls") returned 4 [0075.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.377] lstrlenW (lpString=".xlsx") returned 5 [0075.377] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0075.377] lstrlenW (lpString=".ppt") returned 4 [0075.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.377] lstrlenW (lpString=".zip") returned 4 [0075.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.377] lstrlenW (lpString=".rar") returned 4 [0075.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.377] lstrlenW (lpString=".bz2") returned 4 [0075.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.377] lstrlenW (lpString=".7z") returned 3 [0075.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.377] lstrlenW (lpString=".dbf") returned 4 [0075.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.378] lstrlenW (lpString=".1cd") returned 4 [0075.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0075.378] lstrlenW (lpString=".jpg") returned 4 [0075.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.378] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") [0075.378] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15680) returned 1 [0075.378] CloseHandle (hObject=0x1f4) returned 1 [0075.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0075.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.379] GetLastError () returned 0x0 [0075.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0075.389] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0075.390] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.390] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.391] SetEndOfFile (hFile=0x210) returned 1 [0075.391] CloseHandle (hObject=0x210) returned 1 [0075.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.391] SetEndOfFile (hFile=0x1f4) returned 1 [0075.392] CloseHandle (hObject=0x1f4) returned 1 [0075.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.392] lstrlenW (lpString=".doc") returned 4 [0075.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.392] lstrlenW (lpString=".docx") returned 5 [0075.392] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0075.392] lstrlenW (lpString=".pdf") returned 4 [0075.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.392] lstrlenW (lpString=".xls") returned 4 [0075.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.392] lstrlenW (lpString=".xlsx") returned 5 [0075.392] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0075.392] lstrlenW (lpString=".ppt") returned 4 [0075.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.392] lstrlenW (lpString=".zip") returned 4 [0075.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.392] lstrlenW (lpString=".rar") returned 4 [0075.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.393] lstrlenW (lpString=".bz2") returned 4 [0075.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.393] lstrlenW (lpString=".7z") returned 3 [0075.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.393] lstrlenW (lpString=".dbf") returned 4 [0075.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.393] lstrlenW (lpString=".1cd") returned 4 [0075.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0075.393] lstrlenW (lpString=".jpg") returned 4 [0075.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.393] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") [0075.393] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=46936) returned 1 [0075.393] CloseHandle (hObject=0x1f4) returned 1 [0075.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0075.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0075.394] GetLastError () returned 0x0 [0075.394] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xb758, lpOverlapped=0x0) returned 1 [0075.879] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0075.881] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.881] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.881] SetEndOfFile (hFile=0x210) returned 1 [0075.926] CloseHandle (hObject=0x210) returned 1 [0075.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.929] SetEndOfFile (hFile=0x1f4) returned 1 [0075.945] CloseHandle (hObject=0x1f4) returned 1 [0075.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString=".doc") returned 4 [0075.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".docx") returned 5 [0075.989] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0075.989] lstrlenW (lpString=".pdf") returned 4 [0075.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".xls") returned 4 [0075.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.989] lstrlenW (lpString=".xlsx") returned 5 [0075.989] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0075.989] lstrlenW (lpString=".ppt") returned 4 [0075.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString=".zip") returned 4 [0075.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.989] lstrlenW (lpString=".rar") returned 4 [0075.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".bz2") returned 4 [0075.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".7z") returned 3 [0075.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString=".dbf") returned 4 [0075.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString=".1cd") returned 4 [0075.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0075.989] lstrlenW (lpString=".jpg") returned 4 [0075.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.990] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") [0075.993] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=42050) returned 1 [0075.993] CloseHandle (hObject=0x1f4) returned 1 [0075.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0075.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.993] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.993] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0075.994] GetLastError () returned 0x0 [0075.994] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa442, lpOverlapped=0x0) returned 1 [0076.014] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa450, lpOverlapped=0x0) returned 1 [0076.016] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.016] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.016] SetEndOfFile (hFile=0x150) returned 1 [0076.016] CloseHandle (hObject=0x150) returned 1 [0076.016] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.016] SetEndOfFile (hFile=0x1f4) returned 1 [0076.017] CloseHandle (hObject=0x1f4) returned 1 [0076.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0076.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.017] lstrlenW (lpString=".doc") returned 4 [0076.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.017] lstrlenW (lpString=".docx") returned 5 [0076.018] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0076.018] lstrlenW (lpString=".pdf") returned 4 [0076.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".xls") returned 4 [0076.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".xlsx") returned 5 [0076.018] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0076.018] lstrlenW (lpString=".ppt") returned 4 [0076.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.018] lstrlenW (lpString=".zip") returned 4 [0076.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".rar") returned 4 [0076.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".bz2") returned 4 [0076.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".7z") returned 3 [0076.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.018] lstrlenW (lpString=".dbf") returned 4 [0076.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.018] lstrlenW (lpString=".1cd") returned 4 [0076.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0076.018] lstrlenW (lpString=".jpg") returned 4 [0076.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.018] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") [0076.019] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24759) returned 1 [0076.019] CloseHandle (hObject=0x1f4) returned 1 [0076.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0076.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.019] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.019] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.019] GetLastError () returned 0x0 [0076.019] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x60b7, lpOverlapped=0x0) returned 1 [0076.030] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0076.032] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.032] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.032] SetEndOfFile (hFile=0x150) returned 1 [0076.032] CloseHandle (hObject=0x150) returned 1 [0076.032] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.032] SetEndOfFile (hFile=0x1f4) returned 1 [0076.033] CloseHandle (hObject=0x1f4) returned 1 [0076.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString=".doc") returned 4 [0076.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.034] lstrlenW (lpString=".docx") returned 5 [0076.034] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0076.034] lstrlenW (lpString=".pdf") returned 4 [0076.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.034] lstrlenW (lpString=".xls") returned 4 [0076.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.034] lstrlenW (lpString=".xlsx") returned 5 [0076.034] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0076.034] lstrlenW (lpString=".ppt") returned 4 [0076.034] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString=".zip") returned 4 [0076.034] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.034] lstrlenW (lpString=".rar") returned 4 [0076.034] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.034] lstrlenW (lpString=".bz2") returned 4 [0076.034] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.034] lstrlenW (lpString=".7z") returned 3 [0076.034] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString=".dbf") returned 4 [0076.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString=".1cd") returned 4 [0076.034] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0076.034] lstrlenW (lpString=".jpg") returned 4 [0076.034] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.035] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") [0076.035] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24377) returned 1 [0076.035] CloseHandle (hObject=0x1f4) returned 1 [0076.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0076.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.035] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.035] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.036] GetLastError () returned 0x0 [0076.036] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5f39, lpOverlapped=0x0) returned 1 [0076.048] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0076.049] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.049] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.049] SetEndOfFile (hFile=0x150) returned 1 [0076.049] CloseHandle (hObject=0x150) returned 1 [0076.049] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.049] SetEndOfFile (hFile=0x1f4) returned 1 [0076.050] CloseHandle (hObject=0x1f4) returned 1 [0076.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0076.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.050] lstrlenW (lpString=".doc") returned 4 [0076.050] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.051] lstrlenW (lpString=".docx") returned 5 [0076.051] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0076.051] lstrlenW (lpString=".pdf") returned 4 [0076.051] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.051] lstrlenW (lpString=".xls") returned 4 [0076.051] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.051] lstrlenW (lpString=".xlsx") returned 5 [0076.051] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0076.051] lstrlenW (lpString=".ppt") returned 4 [0076.051] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.051] lstrlenW (lpString=".zip") returned 4 [0076.051] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.051] lstrlenW (lpString=".rar") returned 4 [0076.051] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.051] lstrlenW (lpString=".bz2") returned 4 [0076.051] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.051] lstrlenW (lpString=".7z") returned 3 [0076.051] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.051] lstrlenW (lpString=".dbf") returned 4 [0076.051] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.051] lstrlenW (lpString=".1cd") returned 4 [0076.051] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0076.051] lstrlenW (lpString=".jpg") returned 4 [0076.051] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.051] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") [0076.052] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=73214) returned 1 [0076.052] CloseHandle (hObject=0x1f4) returned 1 [0076.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0076.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0076.053] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.053] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.053] GetLastError () returned 0x0 [0076.053] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0076.072] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0076.074] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.074] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.074] SetEndOfFile (hFile=0x150) returned 1 [0076.075] CloseHandle (hObject=0x150) returned 1 [0076.075] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.075] SetEndOfFile (hFile=0x1f4) returned 1 [0076.077] CloseHandle (hObject=0x1f4) returned 1 [0076.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.087] lstrlenW (lpString=".doc") returned 4 [0076.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".docx") returned 5 [0076.087] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0076.087] lstrlenW (lpString=".pdf") returned 4 [0076.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".xls") returned 4 [0076.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.087] lstrlenW (lpString=".xlsx") returned 5 [0076.087] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0076.087] lstrlenW (lpString=".ppt") returned 4 [0076.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.088] lstrlenW (lpString=".zip") returned 4 [0076.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.088] lstrlenW (lpString=".rar") returned 4 [0076.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString=".bz2") returned 4 [0076.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString=".7z") returned 3 [0076.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.088] lstrlenW (lpString=".dbf") returned 4 [0076.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.088] lstrlenW (lpString=".1cd") returned 4 [0076.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0076.088] lstrlenW (lpString=".jpg") returned 4 [0076.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.088] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") [0076.189] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11694) returned 1 [0076.189] CloseHandle (hObject=0x190) returned 1 [0076.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0076.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.189] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.189] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.190] GetLastError () returned 0x0 [0076.190] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0076.233] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0076.234] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.234] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.234] SetEndOfFile (hFile=0x1f0) returned 1 [0076.234] CloseHandle (hObject=0x1f0) returned 1 [0076.234] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.234] SetEndOfFile (hFile=0x190) returned 1 [0076.235] CloseHandle (hObject=0x190) returned 1 [0076.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.235] lstrlenW (lpString=".doc") returned 4 [0076.235] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.235] lstrlenW (lpString=".docx") returned 5 [0076.235] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0076.235] lstrlenW (lpString=".pdf") returned 4 [0076.235] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.235] lstrlenW (lpString=".xls") returned 4 [0076.235] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.235] lstrlenW (lpString=".xlsx") returned 5 [0076.235] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0076.235] lstrlenW (lpString=".ppt") returned 4 [0076.236] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.236] lstrlenW (lpString=".zip") returned 4 [0076.236] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.236] lstrlenW (lpString=".rar") returned 4 [0076.236] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.236] lstrlenW (lpString=".bz2") returned 4 [0076.236] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.236] lstrlenW (lpString=".7z") returned 3 [0076.236] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.236] lstrlenW (lpString=".dbf") returned 4 [0076.236] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.236] lstrlenW (lpString=".1cd") returned 4 [0076.236] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0076.236] lstrlenW (lpString=".jpg") returned 4 [0076.236] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.236] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") [0076.236] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9671) returned 1 [0076.237] CloseHandle (hObject=0x190) returned 1 [0076.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0076.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.237] GetLastError () returned 0x0 [0076.237] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x25c7, lpOverlapped=0x0) returned 1 [0076.264] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0076.265] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.265] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.265] SetEndOfFile (hFile=0x1f0) returned 1 [0076.265] CloseHandle (hObject=0x1f0) returned 1 [0076.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.265] SetEndOfFile (hFile=0x190) returned 1 [0076.266] CloseHandle (hObject=0x190) returned 1 [0076.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.267] lstrlenW (lpString=".doc") returned 4 [0076.267] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.267] lstrlenW (lpString=".docx") returned 5 [0076.267] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0076.267] lstrlenW (lpString=".pdf") returned 4 [0076.267] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.267] lstrlenW (lpString=".xls") returned 4 [0076.267] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.267] lstrlenW (lpString=".xlsx") returned 5 [0076.267] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0076.267] lstrlenW (lpString=".ppt") returned 4 [0076.267] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.267] lstrlenW (lpString=".zip") returned 4 [0076.267] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.267] lstrlenW (lpString=".rar") returned 4 [0076.267] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.267] lstrlenW (lpString=".bz2") returned 4 [0076.267] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.267] lstrlenW (lpString=".7z") returned 3 [0076.267] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.268] lstrlenW (lpString=".dbf") returned 4 [0076.268] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.268] lstrlenW (lpString=".1cd") returned 4 [0076.268] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0076.268] lstrlenW (lpString=".jpg") returned 4 [0076.268] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.268] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") [0076.268] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7154) returned 1 [0076.268] CloseHandle (hObject=0x190) returned 1 [0076.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0076.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.269] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.269] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.269] GetLastError () returned 0x0 [0076.269] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0076.400] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0076.483] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.504] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.510] SetEndOfFile (hFile=0x1f0) returned 1 [0076.602] CloseHandle (hObject=0x1f0) returned 1 [0076.603] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.603] SetEndOfFile (hFile=0x190) returned 1 [0076.603] CloseHandle (hObject=0x190) returned 1 [0076.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0076.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.604] lstrlenW (lpString=".doc") returned 4 [0076.604] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.604] lstrlenW (lpString=".docx") returned 5 [0076.604] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0076.604] lstrlenW (lpString=".pdf") returned 4 [0076.604] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.604] lstrlenW (lpString=".xls") returned 4 [0076.604] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.604] lstrlenW (lpString=".xlsx") returned 5 [0076.604] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0076.604] lstrlenW (lpString=".ppt") returned 4 [0076.604] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.604] lstrlenW (lpString=".zip") returned 4 [0076.604] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.604] lstrlenW (lpString=".rar") returned 4 [0076.604] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.604] lstrlenW (lpString=".bz2") returned 4 [0076.604] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.604] lstrlenW (lpString=".7z") returned 3 [0076.604] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.605] lstrlenW (lpString=".dbf") returned 4 [0076.605] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.605] lstrlenW (lpString=".1cd") returned 4 [0076.605] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0076.605] lstrlenW (lpString=".jpg") returned 4 [0076.605] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.605] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") [0076.605] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19656) returned 1 [0076.605] CloseHandle (hObject=0x190) returned 1 [0076.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0076.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.606] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.606] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.607] GetLastError () returned 0x0 [0076.607] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0076.616] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0076.617] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.617] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.617] SetEndOfFile (hFile=0x1f0) returned 1 [0076.617] CloseHandle (hObject=0x1f0) returned 1 [0076.617] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.617] SetEndOfFile (hFile=0x190) returned 1 [0076.618] CloseHandle (hObject=0x190) returned 1 [0076.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString=".doc") returned 4 [0076.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.619] lstrlenW (lpString=".docx") returned 5 [0076.619] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0076.619] lstrlenW (lpString=".pdf") returned 4 [0076.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.619] lstrlenW (lpString=".xls") returned 4 [0076.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.619] lstrlenW (lpString=".xlsx") returned 5 [0076.619] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0076.619] lstrlenW (lpString=".ppt") returned 4 [0076.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString=".zip") returned 4 [0076.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.619] lstrlenW (lpString=".rar") returned 4 [0076.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.619] lstrlenW (lpString=".bz2") returned 4 [0076.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.619] lstrlenW (lpString=".7z") returned 3 [0076.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString=".dbf") returned 4 [0076.619] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString=".1cd") returned 4 [0076.619] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0076.619] lstrlenW (lpString=".jpg") returned 4 [0076.619] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.620] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") [0076.620] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=22356) returned 1 [0076.620] CloseHandle (hObject=0x190) returned 1 [0076.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0076.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.620] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.620] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.621] GetLastError () returned 0x0 [0076.621] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5754, lpOverlapped=0x0) returned 1 [0076.629] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5760, lpOverlapped=0x0) returned 1 [0076.630] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.630] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.630] SetEndOfFile (hFile=0x1f0) returned 1 [0076.630] CloseHandle (hObject=0x1f0) returned 1 [0076.630] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.630] SetEndOfFile (hFile=0x190) returned 1 [0076.631] CloseHandle (hObject=0x190) returned 1 [0076.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0076.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.691] lstrlenW (lpString=".doc") returned 4 [0076.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.691] lstrlenW (lpString=".docx") returned 5 [0076.691] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0076.691] lstrlenW (lpString=".pdf") returned 4 [0076.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString=".xls") returned 4 [0076.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.692] lstrlenW (lpString=".xlsx") returned 5 [0076.692] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0076.692] lstrlenW (lpString=".ppt") returned 4 [0076.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.692] lstrlenW (lpString=".zip") returned 4 [0076.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.692] lstrlenW (lpString=".rar") returned 4 [0076.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString=".bz2") returned 4 [0076.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString=".7z") returned 3 [0076.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.692] lstrlenW (lpString=".dbf") returned 4 [0076.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.692] lstrlenW (lpString=".1cd") returned 4 [0076.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0076.692] lstrlenW (lpString=".jpg") returned 4 [0076.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.692] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") [0076.698] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=50490) returned 1 [0076.698] CloseHandle (hObject=0x158) returned 1 [0076.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0076.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.698] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.698] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.699] GetLastError () returned 0x0 [0076.699] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc53a, lpOverlapped=0x0) returned 1 [0076.704] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc540, lpOverlapped=0x0) returned 1 [0076.712] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.712] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.712] SetEndOfFile (hFile=0x150) returned 1 [0076.712] CloseHandle (hObject=0x150) returned 1 [0076.712] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.712] SetEndOfFile (hFile=0x158) returned 1 [0076.713] CloseHandle (hObject=0x158) returned 1 [0076.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString=".doc") returned 4 [0076.714] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.714] lstrlenW (lpString=".docx") returned 5 [0076.714] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0076.714] lstrlenW (lpString=".pdf") returned 4 [0076.714] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.714] lstrlenW (lpString=".xls") returned 4 [0076.714] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.714] lstrlenW (lpString=".xlsx") returned 5 [0076.714] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0076.714] lstrlenW (lpString=".ppt") returned 4 [0076.714] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString=".zip") returned 4 [0076.714] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.714] lstrlenW (lpString=".rar") returned 4 [0076.714] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.714] lstrlenW (lpString=".bz2") returned 4 [0076.714] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.714] lstrlenW (lpString=".7z") returned 3 [0076.714] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString=".dbf") returned 4 [0076.714] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString=".1cd") returned 4 [0076.714] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0076.714] lstrlenW (lpString=".jpg") returned 4 [0076.714] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.714] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") [0076.715] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20179) returned 1 [0076.715] CloseHandle (hObject=0x158) returned 1 [0076.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0076.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0076.715] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.715] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0076.716] GetLastError () returned 0x0 [0076.716] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0076.719] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0076.721] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.721] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.721] SetEndOfFile (hFile=0x150) returned 1 [0076.832] CloseHandle (hObject=0x150) returned 1 [0076.832] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.832] SetEndOfFile (hFile=0x158) returned 1 [0076.833] CloseHandle (hObject=0x158) returned 1 [0076.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0076.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.895] lstrlenW (lpString=".doc") returned 4 [0076.895] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0076.895] lstrlenW (lpString=".docx") returned 5 [0076.895] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0076.895] lstrlenW (lpString=".pdf") returned 4 [0076.895] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0076.895] lstrlenW (lpString=".xls") returned 4 [0076.925] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0076.925] lstrlenW (lpString=".xlsx") returned 5 [0076.925] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0076.925] lstrlenW (lpString=".ppt") returned 4 [0076.925] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0076.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.925] lstrlenW (lpString=".zip") returned 4 [0076.925] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0076.925] lstrlenW (lpString=".rar") returned 4 [0076.925] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0076.925] lstrlenW (lpString=".bz2") returned 4 [0076.925] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0076.925] lstrlenW (lpString=".7z") returned 3 [0076.925] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0076.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.925] lstrlenW (lpString=".dbf") returned 4 [0076.925] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0076.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.925] lstrlenW (lpString=".1cd") returned 4 [0076.925] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0076.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0076.925] lstrlenW (lpString=".jpg") returned 4 [0076.925] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0076.926] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") [0077.473] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3606) returned 1 [0077.473] CloseHandle (hObject=0x1c0) returned 1 [0077.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0077.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.473] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.473] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.474] GetLastError () returned 0x0 [0077.474] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe16, lpOverlapped=0x0) returned 1 [0077.481] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0077.482] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.482] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.482] SetEndOfFile (hFile=0x1f0) returned 1 [0077.482] CloseHandle (hObject=0x1f0) returned 1 [0077.482] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.482] SetEndOfFile (hFile=0x1c0) returned 1 [0077.483] CloseHandle (hObject=0x1c0) returned 1 [0077.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0077.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.483] lstrlenW (lpString=".doc") returned 4 [0077.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.483] lstrlenW (lpString=".docx") returned 5 [0077.483] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0077.483] lstrlenW (lpString=".pdf") returned 4 [0077.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.483] lstrlenW (lpString=".xls") returned 4 [0077.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.484] lstrlenW (lpString=".xlsx") returned 5 [0077.484] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0077.484] lstrlenW (lpString=".ppt") returned 4 [0077.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.484] lstrlenW (lpString=".zip") returned 4 [0077.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.484] lstrlenW (lpString=".rar") returned 4 [0077.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.484] lstrlenW (lpString=".bz2") returned 4 [0077.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.484] lstrlenW (lpString=".7z") returned 3 [0077.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.484] lstrlenW (lpString=".dbf") returned 4 [0077.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.484] lstrlenW (lpString=".1cd") returned 4 [0077.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0077.484] lstrlenW (lpString=".jpg") returned 4 [0077.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.484] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") [0077.485] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3840) returned 1 [0077.485] CloseHandle (hObject=0x1c0) returned 1 [0077.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0077.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.485] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.485] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.485] GetLastError () returned 0x0 [0077.485] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xf00, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf10, lpOverlapped=0x0) returned 1 [0077.488] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.488] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.488] SetEndOfFile (hFile=0x1f0) returned 1 [0077.489] CloseHandle (hObject=0x1f0) returned 1 [0077.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.489] SetEndOfFile (hFile=0x1c0) returned 1 [0077.489] CloseHandle (hObject=0x1c0) returned 1 [0077.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0077.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.490] lstrlenW (lpString=".doc") returned 4 [0077.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.490] lstrlenW (lpString=".docx") returned 5 [0077.490] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0077.490] lstrlenW (lpString=".pdf") returned 4 [0077.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.490] lstrlenW (lpString=".xls") returned 4 [0077.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.490] lstrlenW (lpString=".xlsx") returned 5 [0077.490] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0077.490] lstrlenW (lpString=".ppt") returned 4 [0077.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.490] lstrlenW (lpString=".zip") returned 4 [0077.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.490] lstrlenW (lpString=".rar") returned 4 [0077.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.490] lstrlenW (lpString=".bz2") returned 4 [0077.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.490] lstrlenW (lpString=".7z") returned 3 [0077.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.491] lstrlenW (lpString=".dbf") returned 4 [0077.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.491] lstrlenW (lpString=".1cd") returned 4 [0077.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0077.491] lstrlenW (lpString=".jpg") returned 4 [0077.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.491] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") [0077.492] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4946) returned 1 [0077.492] CloseHandle (hObject=0x1c0) returned 1 [0077.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0077.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.492] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.492] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.493] GetLastError () returned 0x0 [0077.493] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1352, lpOverlapped=0x0) returned 1 [0077.507] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0077.508] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.508] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.508] SetEndOfFile (hFile=0x1f0) returned 1 [0077.508] CloseHandle (hObject=0x1f0) returned 1 [0077.508] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.508] SetEndOfFile (hFile=0x1c0) returned 1 [0077.509] CloseHandle (hObject=0x1c0) returned 1 [0077.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0077.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.510] lstrlenW (lpString=".doc") returned 4 [0077.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString=".docx") returned 5 [0077.510] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0077.510] lstrlenW (lpString=".pdf") returned 4 [0077.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString=".xls") returned 4 [0077.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.510] lstrlenW (lpString=".xlsx") returned 5 [0077.510] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0077.510] lstrlenW (lpString=".ppt") returned 4 [0077.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.510] lstrlenW (lpString=".zip") returned 4 [0077.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.510] lstrlenW (lpString=".rar") returned 4 [0077.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString=".bz2") returned 4 [0077.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString=".7z") returned 3 [0077.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.510] lstrlenW (lpString=".dbf") returned 4 [0077.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.510] lstrlenW (lpString=".1cd") returned 4 [0077.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0077.510] lstrlenW (lpString=".jpg") returned 4 [0077.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.510] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") [0077.511] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16738) returned 1 [0077.511] CloseHandle (hObject=0x1c0) returned 1 [0077.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0077.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.511] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.511] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.512] GetLastError () returned 0x0 [0077.512] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4162, lpOverlapped=0x0) returned 1 [0077.528] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0077.529] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.529] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.529] SetEndOfFile (hFile=0x1f0) returned 1 [0077.529] CloseHandle (hObject=0x1f0) returned 1 [0077.529] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.529] SetEndOfFile (hFile=0x1c0) returned 1 [0077.530] CloseHandle (hObject=0x1c0) returned 1 [0077.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0077.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.530] lstrlenW (lpString=".doc") returned 4 [0077.530] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.530] lstrlenW (lpString=".docx") returned 5 [0077.530] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0077.530] lstrlenW (lpString=".pdf") returned 4 [0077.531] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.531] lstrlenW (lpString=".xls") returned 4 [0077.531] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.531] lstrlenW (lpString=".xlsx") returned 5 [0077.531] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0077.531] lstrlenW (lpString=".ppt") returned 4 [0077.531] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.531] lstrlenW (lpString=".zip") returned 4 [0077.531] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.531] lstrlenW (lpString=".rar") returned 4 [0077.531] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.531] lstrlenW (lpString=".bz2") returned 4 [0077.531] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.531] lstrlenW (lpString=".7z") returned 3 [0077.531] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.531] lstrlenW (lpString=".dbf") returned 4 [0077.531] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.531] lstrlenW (lpString=".1cd") returned 4 [0077.531] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0077.531] lstrlenW (lpString=".jpg") returned 4 [0077.531] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.531] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") [0077.532] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8076) returned 1 [0077.532] CloseHandle (hObject=0x1c0) returned 1 [0077.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0077.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.533] GetLastError () returned 0x0 [0077.533] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0077.555] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.555] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.555] SetEndOfFile (hFile=0x1f0) returned 1 [0077.555] CloseHandle (hObject=0x1f0) returned 1 [0077.556] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.556] SetEndOfFile (hFile=0x1c0) returned 1 [0077.556] CloseHandle (hObject=0x1c0) returned 1 [0077.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.557] lstrlenW (lpString=".doc") returned 4 [0077.557] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.557] lstrlenW (lpString=".docx") returned 5 [0077.557] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0077.557] lstrlenW (lpString=".pdf") returned 4 [0077.557] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.557] lstrlenW (lpString=".xls") returned 4 [0077.557] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.557] lstrlenW (lpString=".xlsx") returned 5 [0077.557] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0077.557] lstrlenW (lpString=".ppt") returned 4 [0077.557] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.557] lstrlenW (lpString=".zip") returned 4 [0077.557] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.557] lstrlenW (lpString=".rar") returned 4 [0077.557] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.557] lstrlenW (lpString=".bz2") returned 4 [0077.557] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.557] lstrlenW (lpString=".7z") returned 3 [0077.557] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.557] lstrlenW (lpString=".dbf") returned 4 [0077.558] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.558] lstrlenW (lpString=".1cd") returned 4 [0077.558] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0077.558] lstrlenW (lpString=".jpg") returned 4 [0077.558] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.558] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") [0077.558] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=35546) returned 1 [0077.558] CloseHandle (hObject=0x1c0) returned 1 [0077.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0077.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.648] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.648] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0077.649] GetLastError () returned 0x0 [0077.649] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8ada, lpOverlapped=0x0) returned 1 [0077.940] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0077.941] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.941] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.942] SetEndOfFile (hFile=0x180) returned 1 [0077.942] CloseHandle (hObject=0x180) returned 1 [0077.942] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.942] SetEndOfFile (hFile=0x1c8) returned 1 [0077.943] CloseHandle (hObject=0x1c8) returned 1 [0077.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0077.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.983] lstrlenW (lpString=".doc") returned 4 [0077.983] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.983] lstrlenW (lpString=".docx") returned 5 [0077.983] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0077.983] lstrlenW (lpString=".pdf") returned 4 [0077.983] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.983] lstrlenW (lpString=".xls") returned 4 [0077.983] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.983] lstrlenW (lpString=".xlsx") returned 5 [0077.983] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0077.983] lstrlenW (lpString=".ppt") returned 4 [0077.983] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.983] lstrlenW (lpString=".zip") returned 4 [0077.983] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.983] lstrlenW (lpString=".rar") returned 4 [0077.983] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.983] lstrlenW (lpString=".bz2") returned 4 [0077.983] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.983] lstrlenW (lpString=".7z") returned 3 [0077.983] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.984] lstrlenW (lpString=".dbf") returned 4 [0077.984] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.984] lstrlenW (lpString=".1cd") returned 4 [0077.984] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0077.984] lstrlenW (lpString=".jpg") returned 4 [0077.984] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.984] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") [0077.984] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0077.984] CloseHandle (hObject=0x210) returned 1 [0077.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0077.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.984] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.985] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0077.985] GetLastError () returned 0x0 [0077.985] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0077.992] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0077.994] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.994] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.994] SetEndOfFile (hFile=0x16c) returned 1 [0077.994] CloseHandle (hObject=0x16c) returned 1 [0077.994] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.994] SetEndOfFile (hFile=0x210) returned 1 [0077.995] CloseHandle (hObject=0x210) returned 1 [0077.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0077.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.996] lstrlenW (lpString=".doc") returned 4 [0077.996] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".docx") returned 5 [0077.996] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0077.996] lstrlenW (lpString=".pdf") returned 4 [0077.996] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".xls") returned 4 [0077.996] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".xlsx") returned 5 [0077.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0077.996] lstrlenW (lpString=".ppt") returned 4 [0077.996] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.996] lstrlenW (lpString=".zip") returned 4 [0077.996] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".rar") returned 4 [0077.996] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".bz2") returned 4 [0077.996] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString=".7z") returned 3 [0077.996] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0077.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.996] lstrlenW (lpString=".dbf") returned 4 [0077.996] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0077.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.997] lstrlenW (lpString=".1cd") returned 4 [0077.997] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0077.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0077.997] lstrlenW (lpString=".jpg") returned 4 [0077.997] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0077.997] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") [0077.997] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0077.997] CloseHandle (hObject=0x210) returned 1 [0077.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0077.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0077.997] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.997] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0077.998] GetLastError () returned 0x0 [0077.998] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.000] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.004] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.004] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.004] SetEndOfFile (hFile=0x16c) returned 1 [0078.004] CloseHandle (hObject=0x16c) returned 1 [0078.004] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.004] SetEndOfFile (hFile=0x210) returned 1 [0078.005] CloseHandle (hObject=0x210) returned 1 [0078.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0078.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString=".doc") returned 4 [0078.006] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".docx") returned 5 [0078.006] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0078.006] lstrlenW (lpString=".pdf") returned 4 [0078.006] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".xls") returned 4 [0078.006] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".xlsx") returned 5 [0078.006] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0078.006] lstrlenW (lpString=".ppt") returned 4 [0078.006] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString=".zip") returned 4 [0078.006] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".rar") returned 4 [0078.006] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".bz2") returned 4 [0078.006] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString=".7z") returned 3 [0078.006] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString=".dbf") returned 4 [0078.006] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString=".1cd") returned 4 [0078.006] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0078.006] lstrlenW (lpString=".jpg") returned 4 [0078.006] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.006] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") [0078.007] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0078.007] CloseHandle (hObject=0x210) returned 1 [0078.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0078.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.007] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.007] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0078.008] GetLastError () returned 0x0 [0078.008] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.011] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.013] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.013] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.013] SetEndOfFile (hFile=0x16c) returned 1 [0078.013] CloseHandle (hObject=0x16c) returned 1 [0078.013] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.013] SetEndOfFile (hFile=0x210) returned 1 [0078.014] CloseHandle (hObject=0x210) returned 1 [0078.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0078.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.014] lstrlenW (lpString=".doc") returned 4 [0078.014] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.014] lstrlenW (lpString=".docx") returned 5 [0078.014] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0078.014] lstrlenW (lpString=".pdf") returned 4 [0078.014] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString=".xls") returned 4 [0078.015] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString=".xlsx") returned 5 [0078.015] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0078.015] lstrlenW (lpString=".ppt") returned 4 [0078.015] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.015] lstrlenW (lpString=".zip") returned 4 [0078.015] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString=".rar") returned 4 [0078.015] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString=".bz2") returned 4 [0078.015] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString=".7z") returned 3 [0078.015] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.015] lstrlenW (lpString=".dbf") returned 4 [0078.015] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.015] lstrlenW (lpString=".1cd") returned 4 [0078.015] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0078.015] lstrlenW (lpString=".jpg") returned 4 [0078.015] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.015] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") [0078.016] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31968) returned 1 [0078.016] CloseHandle (hObject=0x210) returned 1 [0078.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0078.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.016] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.016] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0078.016] GetLastError () returned 0x0 [0078.016] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0078.019] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0078.020] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.020] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.020] SetEndOfFile (hFile=0x16c) returned 1 [0078.020] CloseHandle (hObject=0x16c) returned 1 [0078.020] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.020] SetEndOfFile (hFile=0x210) returned 1 [0078.021] CloseHandle (hObject=0x210) returned 1 [0078.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.022] lstrlenW (lpString=".doc") returned 4 [0078.022] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".docx") returned 5 [0078.022] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0078.022] lstrlenW (lpString=".pdf") returned 4 [0078.022] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".xls") returned 4 [0078.022] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".xlsx") returned 5 [0078.022] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0078.022] lstrlenW (lpString=".ppt") returned 4 [0078.022] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.022] lstrlenW (lpString=".zip") returned 4 [0078.022] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".rar") returned 4 [0078.022] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".bz2") returned 4 [0078.022] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.022] lstrlenW (lpString=".7z") returned 3 [0078.022] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.023] lstrlenW (lpString=".dbf") returned 4 [0078.023] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.023] lstrlenW (lpString=".1cd") returned 4 [0078.023] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0078.023] lstrlenW (lpString=".jpg") returned 4 [0078.023] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.023] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") [0078.023] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0078.023] CloseHandle (hObject=0x210) returned 1 [0078.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0078.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0078.023] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.024] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0078.024] GetLastError () returned 0x0 [0078.024] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0078.093] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0078.095] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.095] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.095] SetEndOfFile (hFile=0x16c) returned 1 [0078.116] CloseHandle (hObject=0x16c) returned 1 [0078.116] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.117] SetEndOfFile (hFile=0x210) returned 1 [0078.117] CloseHandle (hObject=0x210) returned 1 [0078.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.118] lstrlenW (lpString=".doc") returned 4 [0078.118] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".docx") returned 5 [0078.118] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0078.118] lstrlenW (lpString=".pdf") returned 4 [0078.118] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".xls") returned 4 [0078.118] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".xlsx") returned 5 [0078.118] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0078.118] lstrlenW (lpString=".ppt") returned 4 [0078.118] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.118] lstrlenW (lpString=".zip") returned 4 [0078.118] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".rar") returned 4 [0078.118] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".bz2") returned 4 [0078.118] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0078.118] lstrlenW (lpString=".7z") returned 3 [0078.119] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.119] lstrlenW (lpString=".dbf") returned 4 [0078.119] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.119] lstrlenW (lpString=".1cd") returned 4 [0078.119] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0078.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0078.119] lstrlenW (lpString=".jpg") returned 4 [0078.119] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0078.119] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") [0078.129] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16104) returned 1 [0078.129] CloseHandle (hObject=0x1fc) returned 1 [0078.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0078.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.129] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.129] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.130] GetLastError () returned 0x0 [0078.130] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0078.147] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0078.148] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.148] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.148] SetEndOfFile (hFile=0x15c) returned 1 [0078.149] CloseHandle (hObject=0x15c) returned 1 [0078.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.149] SetEndOfFile (hFile=0x1fc) returned 1 [0078.150] CloseHandle (hObject=0x1fc) returned 1 [0078.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0078.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.150] lstrlenW (lpString=".doc") returned 4 [0078.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.150] lstrlenW (lpString=".docx") returned 5 [0078.150] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.150] lstrlenW (lpString=".pdf") returned 4 [0078.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.150] lstrlenW (lpString=".xls") returned 4 [0078.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.150] lstrlenW (lpString=".xlsx") returned 5 [0078.150] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.150] lstrlenW (lpString=".ppt") returned 4 [0078.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.150] lstrlenW (lpString=".zip") returned 4 [0078.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.150] lstrlenW (lpString=".rar") returned 4 [0078.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.151] lstrlenW (lpString=".bz2") returned 4 [0078.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.151] lstrlenW (lpString=".7z") returned 3 [0078.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.151] lstrlenW (lpString=".dbf") returned 4 [0078.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.151] lstrlenW (lpString=".1cd") returned 4 [0078.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0078.151] lstrlenW (lpString=".jpg") returned 4 [0078.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.151] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") [0078.152] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27000) returned 1 [0078.152] CloseHandle (hObject=0x1fc) returned 1 [0078.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0078.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.153] GetLastError () returned 0x0 [0078.153] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6978, lpOverlapped=0x0) returned 1 [0078.161] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6980, lpOverlapped=0x0) returned 1 [0078.162] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.162] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.162] SetEndOfFile (hFile=0x15c) returned 1 [0078.162] CloseHandle (hObject=0x15c) returned 1 [0078.162] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.163] SetEndOfFile (hFile=0x1fc) returned 1 [0078.163] CloseHandle (hObject=0x1fc) returned 1 [0078.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0078.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.164] lstrlenW (lpString=".doc") returned 4 [0078.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.164] lstrlenW (lpString=".docx") returned 5 [0078.164] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.164] lstrlenW (lpString=".pdf") returned 4 [0078.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.164] lstrlenW (lpString=".xls") returned 4 [0078.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.164] lstrlenW (lpString=".xlsx") returned 5 [0078.164] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.164] lstrlenW (lpString=".ppt") returned 4 [0078.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.164] lstrlenW (lpString=".zip") returned 4 [0078.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.164] lstrlenW (lpString=".rar") returned 4 [0078.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.164] lstrlenW (lpString=".bz2") returned 4 [0078.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.164] lstrlenW (lpString=".7z") returned 3 [0078.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.164] lstrlenW (lpString=".dbf") returned 4 [0078.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.165] lstrlenW (lpString=".1cd") returned 4 [0078.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0078.165] lstrlenW (lpString=".jpg") returned 4 [0078.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.165] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") [0078.165] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17040) returned 1 [0078.165] CloseHandle (hObject=0x1fc) returned 1 [0078.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0078.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.166] GetLastError () returned 0x0 [0078.166] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4290, lpOverlapped=0x0) returned 1 [0078.196] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0078.197] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.197] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.197] SetEndOfFile (hFile=0x15c) returned 1 [0078.197] CloseHandle (hObject=0x15c) returned 1 [0078.197] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.197] SetEndOfFile (hFile=0x1fc) returned 1 [0078.198] CloseHandle (hObject=0x1fc) returned 1 [0078.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.199] lstrlenW (lpString=".doc") returned 4 [0078.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString=".docx") returned 5 [0078.199] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.199] lstrlenW (lpString=".pdf") returned 4 [0078.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString=".xls") returned 4 [0078.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.199] lstrlenW (lpString=".xlsx") returned 5 [0078.199] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.199] lstrlenW (lpString=".ppt") returned 4 [0078.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.199] lstrlenW (lpString=".zip") returned 4 [0078.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.199] lstrlenW (lpString=".rar") returned 4 [0078.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString=".bz2") returned 4 [0078.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString=".7z") returned 3 [0078.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.199] lstrlenW (lpString=".dbf") returned 4 [0078.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.199] lstrlenW (lpString=".1cd") returned 4 [0078.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0078.200] lstrlenW (lpString=".jpg") returned 4 [0078.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.200] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") [0078.200] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12900) returned 1 [0078.200] CloseHandle (hObject=0x1fc) returned 1 [0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.201] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.201] GetLastError () returned 0x0 [0078.201] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3264, lpOverlapped=0x0) returned 1 [0078.210] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3270, lpOverlapped=0x0) returned 1 [0078.211] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.211] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.211] SetEndOfFile (hFile=0x15c) returned 1 [0078.211] CloseHandle (hObject=0x15c) returned 1 [0078.211] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.211] SetEndOfFile (hFile=0x1fc) returned 1 [0078.212] CloseHandle (hObject=0x1fc) returned 1 [0078.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.213] lstrlenW (lpString=".doc") returned 4 [0078.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.213] lstrlenW (lpString=".docx") returned 5 [0078.213] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.213] lstrlenW (lpString=".pdf") returned 4 [0078.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.213] lstrlenW (lpString=".xls") returned 4 [0078.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.213] lstrlenW (lpString=".xlsx") returned 5 [0078.213] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.213] lstrlenW (lpString=".ppt") returned 4 [0078.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.213] lstrlenW (lpString=".zip") returned 4 [0078.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.213] lstrlenW (lpString=".rar") returned 4 [0078.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.213] lstrlenW (lpString=".bz2") returned 4 [0078.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.213] lstrlenW (lpString=".7z") returned 3 [0078.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.213] lstrlenW (lpString=".dbf") returned 4 [0078.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.214] lstrlenW (lpString=".1cd") returned 4 [0078.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0078.214] lstrlenW (lpString=".jpg") returned 4 [0078.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.214] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") [0078.214] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5908) returned 1 [0078.214] CloseHandle (hObject=0x1fc) returned 1 [0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.215] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.215] GetLastError () returned 0x0 [0078.215] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1714, lpOverlapped=0x0) returned 1 [0078.217] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0078.218] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.218] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.218] SetEndOfFile (hFile=0x15c) returned 1 [0078.218] CloseHandle (hObject=0x15c) returned 1 [0078.218] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.219] SetEndOfFile (hFile=0x1fc) returned 1 [0078.219] CloseHandle (hObject=0x1fc) returned 1 [0078.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.220] lstrlenW (lpString=".doc") returned 4 [0078.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString=".docx") returned 5 [0078.220] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.220] lstrlenW (lpString=".pdf") returned 4 [0078.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString=".xls") returned 4 [0078.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.220] lstrlenW (lpString=".xlsx") returned 5 [0078.220] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.220] lstrlenW (lpString=".ppt") returned 4 [0078.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.220] lstrlenW (lpString=".zip") returned 4 [0078.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.220] lstrlenW (lpString=".rar") returned 4 [0078.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString=".bz2") returned 4 [0078.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString=".7z") returned 3 [0078.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.220] lstrlenW (lpString=".dbf") returned 4 [0078.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.220] lstrlenW (lpString=".1cd") returned 4 [0078.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0078.221] lstrlenW (lpString=".jpg") returned 4 [0078.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.221] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") [0078.221] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=23596) returned 1 [0078.221] CloseHandle (hObject=0x1fc) returned 1 [0078.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0078.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.221] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.221] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.222] GetLastError () returned 0x0 [0078.222] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0078.226] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0078.227] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.227] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.227] SetEndOfFile (hFile=0x15c) returned 1 [0078.227] CloseHandle (hObject=0x15c) returned 1 [0078.227] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.227] SetEndOfFile (hFile=0x1fc) returned 1 [0078.228] CloseHandle (hObject=0x1fc) returned 1 [0078.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.229] lstrlenW (lpString=".doc") returned 4 [0078.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString=".docx") returned 5 [0078.229] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.229] lstrlenW (lpString=".pdf") returned 4 [0078.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString=".xls") returned 4 [0078.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.229] lstrlenW (lpString=".xlsx") returned 5 [0078.229] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.229] lstrlenW (lpString=".ppt") returned 4 [0078.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.229] lstrlenW (lpString=".zip") returned 4 [0078.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.229] lstrlenW (lpString=".rar") returned 4 [0078.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString=".bz2") returned 4 [0078.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString=".7z") returned 3 [0078.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.229] lstrlenW (lpString=".dbf") returned 4 [0078.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.229] lstrlenW (lpString=".1cd") returned 4 [0078.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0078.230] lstrlenW (lpString=".jpg") returned 4 [0078.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.230] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") [0078.230] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5172) returned 1 [0078.230] CloseHandle (hObject=0x1fc) returned 1 [0078.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0078.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.231] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.231] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.232] GetLastError () returned 0x0 [0078.232] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1434, lpOverlapped=0x0) returned 1 [0078.233] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0078.234] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.234] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.234] SetEndOfFile (hFile=0x15c) returned 1 [0078.234] CloseHandle (hObject=0x15c) returned 1 [0078.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.234] SetEndOfFile (hFile=0x1fc) returned 1 [0078.235] CloseHandle (hObject=0x1fc) returned 1 [0078.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString=".doc") returned 4 [0078.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString=".docx") returned 5 [0078.236] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.236] lstrlenW (lpString=".pdf") returned 4 [0078.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString=".xls") returned 4 [0078.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.236] lstrlenW (lpString=".xlsx") returned 5 [0078.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.236] lstrlenW (lpString=".ppt") returned 4 [0078.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString=".zip") returned 4 [0078.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.236] lstrlenW (lpString=".rar") returned 4 [0078.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString=".bz2") returned 4 [0078.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString=".7z") returned 3 [0078.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString=".dbf") returned 4 [0078.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString=".1cd") returned 4 [0078.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0078.236] lstrlenW (lpString=".jpg") returned 4 [0078.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.237] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") [0078.240] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5632) returned 1 [0078.240] CloseHandle (hObject=0x1fc) returned 1 [0078.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0078.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.240] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.240] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0078.241] GetLastError () returned 0x0 [0078.241] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1600, lpOverlapped=0x0) returned 1 [0078.242] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1610, lpOverlapped=0x0) returned 1 [0078.243] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.243] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.244] SetEndOfFile (hFile=0x15c) returned 1 [0078.244] CloseHandle (hObject=0x15c) returned 1 [0078.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.244] SetEndOfFile (hFile=0x1fc) returned 1 [0078.244] CloseHandle (hObject=0x1fc) returned 1 [0078.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0078.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.245] lstrlenW (lpString=".doc") returned 4 [0078.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.245] lstrlenW (lpString=".docx") returned 5 [0078.245] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.245] lstrlenW (lpString=".pdf") returned 4 [0078.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.245] lstrlenW (lpString=".xls") returned 4 [0078.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.245] lstrlenW (lpString=".xlsx") returned 5 [0078.245] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.246] lstrlenW (lpString=".ppt") returned 4 [0078.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.246] lstrlenW (lpString=".zip") returned 4 [0078.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.246] lstrlenW (lpString=".rar") returned 4 [0078.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.246] lstrlenW (lpString=".bz2") returned 4 [0078.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.246] lstrlenW (lpString=".7z") returned 3 [0078.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.246] lstrlenW (lpString=".dbf") returned 4 [0078.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.246] lstrlenW (lpString=".1cd") returned 4 [0078.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0078.246] lstrlenW (lpString=".jpg") returned 4 [0078.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.246] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") [0078.247] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3444) returned 1 [0078.247] CloseHandle (hObject=0x1f0) returned 1 [0078.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0078.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.248] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.248] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.248] GetLastError () returned 0x0 [0078.248] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd74, lpOverlapped=0x0) returned 1 [0078.285] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd80, lpOverlapped=0x0) returned 1 [0078.286] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.286] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.286] SetEndOfFile (hFile=0x1fc) returned 1 [0078.286] CloseHandle (hObject=0x1fc) returned 1 [0078.286] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.286] SetEndOfFile (hFile=0x1f0) returned 1 [0078.287] CloseHandle (hObject=0x1f0) returned 1 [0078.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0078.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.290] lstrlenW (lpString=".doc") returned 4 [0078.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString=".docx") returned 5 [0078.290] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.290] lstrlenW (lpString=".pdf") returned 4 [0078.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString=".xls") returned 4 [0078.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.290] lstrlenW (lpString=".xlsx") returned 5 [0078.290] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.290] lstrlenW (lpString=".ppt") returned 4 [0078.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.290] lstrlenW (lpString=".zip") returned 4 [0078.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.290] lstrlenW (lpString=".rar") returned 4 [0078.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString=".bz2") returned 4 [0078.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString=".7z") returned 3 [0078.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.290] lstrlenW (lpString=".dbf") returned 4 [0078.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.290] lstrlenW (lpString=".1cd") returned 4 [0078.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0078.291] lstrlenW (lpString=".jpg") returned 4 [0078.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.291] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") [0078.291] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11228) returned 1 [0078.291] CloseHandle (hObject=0x1f0) returned 1 [0078.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0078.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0078.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0078.292] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.292] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.292] GetLastError () returned 0x0 [0078.292] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0078.305] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0078.306] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.306] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.306] SetEndOfFile (hFile=0x1fc) returned 1 [0078.306] CloseHandle (hObject=0x1fc) returned 1 [0078.306] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.306] SetEndOfFile (hFile=0x1f0) returned 1 [0078.307] CloseHandle (hObject=0x1f0) returned 1 [0078.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0078.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString=".doc") returned 4 [0078.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString=".docx") returned 5 [0078.439] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.439] lstrlenW (lpString=".pdf") returned 4 [0078.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString=".xls") returned 4 [0078.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.439] lstrlenW (lpString=".xlsx") returned 5 [0078.439] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.439] lstrlenW (lpString=".ppt") returned 4 [0078.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString=".zip") returned 4 [0078.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.439] lstrlenW (lpString=".rar") returned 4 [0078.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString=".bz2") returned 4 [0078.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString=".7z") returned 3 [0078.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString=".dbf") returned 4 [0078.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString=".1cd") returned 4 [0078.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0078.439] lstrlenW (lpString=".jpg") returned 4 [0078.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.440] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") [0079.220] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8860) returned 1 [0079.220] CloseHandle (hObject=0x190) returned 1 [0079.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0079.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.220] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.220] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.221] GetLastError () returned 0x0 [0079.221] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x229c, lpOverlapped=0x0) returned 1 [0079.317] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0079.318] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.318] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.318] SetEndOfFile (hFile=0x158) returned 1 [0079.318] CloseHandle (hObject=0x158) returned 1 [0079.318] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.318] SetEndOfFile (hFile=0x190) returned 1 [0079.319] CloseHandle (hObject=0x190) returned 1 [0079.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0079.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.320] lstrlenW (lpString=".doc") returned 4 [0079.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString=".docx") returned 5 [0079.320] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.320] lstrlenW (lpString=".pdf") returned 4 [0079.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString=".xls") returned 4 [0079.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.320] lstrlenW (lpString=".xlsx") returned 5 [0079.320] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.320] lstrlenW (lpString=".ppt") returned 4 [0079.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.320] lstrlenW (lpString=".zip") returned 4 [0079.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.320] lstrlenW (lpString=".rar") returned 4 [0079.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString=".bz2") returned 4 [0079.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString=".7z") returned 3 [0079.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.320] lstrlenW (lpString=".dbf") returned 4 [0079.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.321] lstrlenW (lpString=".1cd") returned 4 [0079.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0079.321] lstrlenW (lpString=".jpg") returned 4 [0079.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.321] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") [0079.321] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5980) returned 1 [0079.321] CloseHandle (hObject=0x190) returned 1 [0079.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0079.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.322] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.322] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.322] GetLastError () returned 0x0 [0079.322] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x175c, lpOverlapped=0x0) returned 1 [0079.375] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0079.376] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.376] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.376] SetEndOfFile (hFile=0x158) returned 1 [0079.383] CloseHandle (hObject=0x158) returned 1 [0079.383] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.383] SetEndOfFile (hFile=0x190) returned 1 [0079.392] CloseHandle (hObject=0x190) returned 1 [0079.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0079.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.392] lstrlenW (lpString=".doc") returned 4 [0079.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString=".docx") returned 5 [0079.393] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.393] lstrlenW (lpString=".pdf") returned 4 [0079.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString=".xls") returned 4 [0079.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.393] lstrlenW (lpString=".xlsx") returned 5 [0079.393] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.393] lstrlenW (lpString=".ppt") returned 4 [0079.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.393] lstrlenW (lpString=".zip") returned 4 [0079.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.393] lstrlenW (lpString=".rar") returned 4 [0079.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString=".bz2") returned 4 [0079.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString=".7z") returned 3 [0079.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.393] lstrlenW (lpString=".dbf") returned 4 [0079.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.393] lstrlenW (lpString=".1cd") returned 4 [0079.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0079.393] lstrlenW (lpString=".jpg") returned 4 [0079.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.393] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") [0079.394] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11012) returned 1 [0079.394] CloseHandle (hObject=0x190) returned 1 [0079.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0079.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.394] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.395] GetLastError () returned 0x0 [0079.395] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2b04, lpOverlapped=0x0) returned 1 [0079.412] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0079.413] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.413] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.413] SetEndOfFile (hFile=0x158) returned 1 [0079.413] CloseHandle (hObject=0x158) returned 1 [0079.413] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.413] SetEndOfFile (hFile=0x190) returned 1 [0079.414] CloseHandle (hObject=0x190) returned 1 [0079.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0079.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.414] lstrlenW (lpString=".doc") returned 4 [0079.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.414] lstrlenW (lpString=".docx") returned 5 [0079.414] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.414] lstrlenW (lpString=".pdf") returned 4 [0079.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.414] lstrlenW (lpString=".xls") returned 4 [0079.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.415] lstrlenW (lpString=".xlsx") returned 5 [0079.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.415] lstrlenW (lpString=".ppt") returned 4 [0079.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.415] lstrlenW (lpString=".zip") returned 4 [0079.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.415] lstrlenW (lpString=".rar") returned 4 [0079.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.415] lstrlenW (lpString=".bz2") returned 4 [0079.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.415] lstrlenW (lpString=".7z") returned 3 [0079.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.415] lstrlenW (lpString=".dbf") returned 4 [0079.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.415] lstrlenW (lpString=".1cd") returned 4 [0079.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0079.415] lstrlenW (lpString=".jpg") returned 4 [0079.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.415] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") [0079.416] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20444) returned 1 [0079.416] CloseHandle (hObject=0x190) returned 1 [0079.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0079.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0079.416] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.416] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.417] GetLastError () returned 0x0 [0079.417] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0079.419] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0079.420] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.420] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.420] SetEndOfFile (hFile=0x158) returned 1 [0079.420] CloseHandle (hObject=0x158) returned 1 [0079.420] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.420] SetEndOfFile (hFile=0x190) returned 1 [0079.428] CloseHandle (hObject=0x190) returned 1 [0079.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0079.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.428] lstrlenW (lpString=".doc") returned 4 [0079.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.428] lstrlenW (lpString=".docx") returned 5 [0079.428] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.428] lstrlenW (lpString=".pdf") returned 4 [0079.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString=".xls") returned 4 [0079.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.429] lstrlenW (lpString=".xlsx") returned 5 [0079.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.429] lstrlenW (lpString=".ppt") returned 4 [0079.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.429] lstrlenW (lpString=".zip") returned 4 [0079.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.429] lstrlenW (lpString=".rar") returned 4 [0079.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString=".bz2") returned 4 [0079.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString=".7z") returned 3 [0079.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.429] lstrlenW (lpString=".dbf") returned 4 [0079.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.429] lstrlenW (lpString=".1cd") returned 4 [0079.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0079.429] lstrlenW (lpString=".jpg") returned 4 [0079.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.429] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") [0079.430] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9400) returned 1 [0079.430] CloseHandle (hObject=0x190) returned 1 [0079.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0079.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.549] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.549] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.550] GetLastError () returned 0x0 [0079.550] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x24b8, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0079.561] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.561] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.561] SetEndOfFile (hFile=0x180) returned 1 [0079.561] CloseHandle (hObject=0x180) returned 1 [0079.561] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.561] SetEndOfFile (hFile=0x158) returned 1 [0079.562] CloseHandle (hObject=0x158) returned 1 [0079.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0079.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.562] lstrlenW (lpString=".doc") returned 4 [0079.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.562] lstrlenW (lpString=".docx") returned 5 [0079.562] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0079.562] lstrlenW (lpString=".pdf") returned 4 [0079.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.562] lstrlenW (lpString=".xls") returned 4 [0079.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.563] lstrlenW (lpString=".xlsx") returned 5 [0079.563] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0079.563] lstrlenW (lpString=".ppt") returned 4 [0079.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.563] lstrlenW (lpString=".zip") returned 4 [0079.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.563] lstrlenW (lpString=".rar") returned 4 [0079.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.563] lstrlenW (lpString=".bz2") returned 4 [0079.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.563] lstrlenW (lpString=".7z") returned 3 [0079.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.563] lstrlenW (lpString=".dbf") returned 4 [0079.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.563] lstrlenW (lpString=".1cd") returned 4 [0079.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0079.563] lstrlenW (lpString=".jpg") returned 4 [0079.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.563] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") [0079.564] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7384) returned 1 [0079.564] CloseHandle (hObject=0x158) returned 1 [0079.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0079.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.565] GetLastError () returned 0x0 [0079.565] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0079.579] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0079.580] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.580] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.580] SetEndOfFile (hFile=0x180) returned 1 [0079.580] CloseHandle (hObject=0x180) returned 1 [0079.580] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.580] SetEndOfFile (hFile=0x158) returned 1 [0079.581] CloseHandle (hObject=0x158) returned 1 [0079.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0079.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.605] lstrlenW (lpString=".doc") returned 4 [0079.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.605] lstrlenW (lpString=".docx") returned 5 [0079.605] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.605] lstrlenW (lpString=".pdf") returned 4 [0079.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString=".xls") returned 4 [0079.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.606] lstrlenW (lpString=".xlsx") returned 5 [0079.606] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.606] lstrlenW (lpString=".ppt") returned 4 [0079.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.606] lstrlenW (lpString=".zip") returned 4 [0079.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.606] lstrlenW (lpString=".rar") returned 4 [0079.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString=".bz2") returned 4 [0079.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString=".7z") returned 3 [0079.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.606] lstrlenW (lpString=".dbf") returned 4 [0079.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.606] lstrlenW (lpString=".1cd") returned 4 [0079.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0079.606] lstrlenW (lpString=".jpg") returned 4 [0079.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.606] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") [0079.607] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11720) returned 1 [0079.607] CloseHandle (hObject=0x150) returned 1 [0079.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0079.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.607] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.608] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.608] GetLastError () returned 0x0 [0079.608] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0079.617] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0079.618] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.618] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.618] SetEndOfFile (hFile=0x1c0) returned 1 [0079.619] CloseHandle (hObject=0x1c0) returned 1 [0079.619] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.619] SetEndOfFile (hFile=0x150) returned 1 [0079.619] CloseHandle (hObject=0x150) returned 1 [0079.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0079.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.620] lstrlenW (lpString=".doc") returned 4 [0079.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.620] lstrlenW (lpString=".docx") returned 5 [0079.620] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0079.620] lstrlenW (lpString=".pdf") returned 4 [0079.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.620] lstrlenW (lpString=".xls") returned 4 [0079.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.620] lstrlenW (lpString=".xlsx") returned 5 [0079.620] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0079.620] lstrlenW (lpString=".ppt") returned 4 [0079.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.620] lstrlenW (lpString=".zip") returned 4 [0079.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.620] lstrlenW (lpString=".rar") returned 4 [0079.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.621] lstrlenW (lpString=".bz2") returned 4 [0079.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.621] lstrlenW (lpString=".7z") returned 3 [0079.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.621] lstrlenW (lpString=".dbf") returned 4 [0079.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.621] lstrlenW (lpString=".1cd") returned 4 [0079.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0079.621] lstrlenW (lpString=".jpg") returned 4 [0079.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.621] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") [0079.621] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10060) returned 1 [0079.621] CloseHandle (hObject=0x150) returned 1 [0079.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0079.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.622] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.622] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.622] GetLastError () returned 0x0 [0079.622] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x274c, lpOverlapped=0x0) returned 1 [0079.624] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2750, lpOverlapped=0x0) returned 1 [0079.625] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.625] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.625] SetEndOfFile (hFile=0x1c0) returned 1 [0079.625] CloseHandle (hObject=0x1c0) returned 1 [0079.625] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.625] SetEndOfFile (hFile=0x150) returned 1 [0079.626] CloseHandle (hObject=0x150) returned 1 [0079.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0079.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.627] lstrlenW (lpString=".doc") returned 4 [0079.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString=".docx") returned 5 [0079.627] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.627] lstrlenW (lpString=".pdf") returned 4 [0079.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString=".xls") returned 4 [0079.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.627] lstrlenW (lpString=".xlsx") returned 5 [0079.627] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.627] lstrlenW (lpString=".ppt") returned 4 [0079.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.627] lstrlenW (lpString=".zip") returned 4 [0079.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.627] lstrlenW (lpString=".rar") returned 4 [0079.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString=".bz2") returned 4 [0079.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString=".7z") returned 3 [0079.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.627] lstrlenW (lpString=".dbf") returned 4 [0079.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.627] lstrlenW (lpString=".1cd") returned 4 [0079.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0079.628] lstrlenW (lpString=".jpg") returned 4 [0079.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.628] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") [0079.628] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5812) returned 1 [0079.628] CloseHandle (hObject=0x150) returned 1 [0079.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0079.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.628] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.628] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.629] GetLastError () returned 0x0 [0079.629] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16b4, lpOverlapped=0x0) returned 1 [0079.631] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0079.632] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.632] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.632] SetEndOfFile (hFile=0x1c0) returned 1 [0079.632] CloseHandle (hObject=0x1c0) returned 1 [0079.632] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.632] SetEndOfFile (hFile=0x150) returned 1 [0079.633] CloseHandle (hObject=0x150) returned 1 [0079.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0079.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.633] lstrlenW (lpString=".doc") returned 4 [0079.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString=".docx") returned 5 [0079.634] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.634] lstrlenW (lpString=".pdf") returned 4 [0079.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString=".xls") returned 4 [0079.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.634] lstrlenW (lpString=".xlsx") returned 5 [0079.634] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.634] lstrlenW (lpString=".ppt") returned 4 [0079.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.634] lstrlenW (lpString=".zip") returned 4 [0079.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.634] lstrlenW (lpString=".rar") returned 4 [0079.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString=".bz2") returned 4 [0079.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString=".7z") returned 3 [0079.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.634] lstrlenW (lpString=".dbf") returned 4 [0079.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.634] lstrlenW (lpString=".1cd") returned 4 [0079.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0079.634] lstrlenW (lpString=".jpg") returned 4 [0079.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.634] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") [0079.635] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=23548) returned 1 [0079.635] CloseHandle (hObject=0x150) returned 1 [0079.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0079.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0079.635] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.635] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.636] GetLastError () returned 0x0 [0079.636] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0079.731] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0079.732] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.732] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.732] SetEndOfFile (hFile=0x1c0) returned 1 [0079.884] CloseHandle (hObject=0x1c0) returned 1 [0079.884] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.884] SetEndOfFile (hFile=0x150) returned 1 [0079.907] CloseHandle (hObject=0x150) returned 1 [0079.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString=".doc") returned 4 [0080.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString=".docx") returned 5 [0080.049] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0080.049] lstrlenW (lpString=".pdf") returned 4 [0080.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString=".xls") returned 4 [0080.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.049] lstrlenW (lpString=".xlsx") returned 5 [0080.049] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0080.049] lstrlenW (lpString=".ppt") returned 4 [0080.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString=".zip") returned 4 [0080.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.049] lstrlenW (lpString=".rar") returned 4 [0080.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString=".bz2") returned 4 [0080.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString=".7z") returned 3 [0080.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString=".dbf") returned 4 [0080.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString=".1cd") returned 4 [0080.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0080.049] lstrlenW (lpString=".jpg") returned 4 [0080.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.050] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") [0081.266] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3020) returned 1 [0081.278] CloseHandle (hObject=0x210) returned 1 [0081.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0081.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.374] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.390] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.414] GetLastError () returned 0x0 [0081.416] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xbcc, lpOverlapped=0x0) returned 1 [0081.451] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0081.452] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.452] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.452] SetEndOfFile (hFile=0x150) returned 1 [0081.452] CloseHandle (hObject=0x150) returned 1 [0081.452] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.453] SetEndOfFile (hFile=0x210) returned 1 [0081.453] CloseHandle (hObject=0x210) returned 1 [0081.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0081.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.454] lstrlenW (lpString=".doc") returned 4 [0081.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.454] lstrlenW (lpString=".docx") returned 5 [0081.454] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0081.454] lstrlenW (lpString=".pdf") returned 4 [0081.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.454] lstrlenW (lpString=".xls") returned 4 [0081.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.454] lstrlenW (lpString=".xlsx") returned 5 [0081.454] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0081.454] lstrlenW (lpString=".ppt") returned 4 [0081.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.454] lstrlenW (lpString=".zip") returned 4 [0081.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.455] lstrlenW (lpString=".rar") returned 4 [0081.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.455] lstrlenW (lpString=".bz2") returned 4 [0081.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.455] lstrlenW (lpString=".7z") returned 3 [0081.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.455] lstrlenW (lpString=".dbf") returned 4 [0081.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.455] lstrlenW (lpString=".1cd") returned 4 [0081.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0081.455] lstrlenW (lpString=".jpg") returned 4 [0081.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.455] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") [0081.456] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14996) returned 1 [0081.456] CloseHandle (hObject=0x210) returned 1 [0081.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0081.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0081.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.456] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0081.457] GetLastError () returned 0x0 [0081.457] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0081.841] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0081.842] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.842] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.842] SetEndOfFile (hFile=0x150) returned 1 [0081.843] CloseHandle (hObject=0x150) returned 1 [0081.843] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.843] SetEndOfFile (hFile=0x210) returned 1 [0081.843] CloseHandle (hObject=0x210) returned 1 [0081.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0081.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0081.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0081.999] lstrlenW (lpString=".doc") returned 4 [0081.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString=".docx") returned 5 [0081.999] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0081.999] lstrlenW (lpString=".pdf") returned 4 [0081.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString=".xls") returned 4 [0081.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.999] lstrlenW (lpString=".xlsx") returned 5 [0081.999] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0081.999] lstrlenW (lpString=".ppt") returned 4 [0081.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0081.999] lstrlenW (lpString=".zip") returned 4 [0081.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.999] lstrlenW (lpString=".rar") returned 4 [0081.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString=".bz2") returned 4 [0081.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString=".7z") returned 3 [0081.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0081.999] lstrlenW (lpString=".dbf") returned 4 [0081.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0081.999] lstrlenW (lpString=".1cd") returned 4 [0081.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0082.000] lstrlenW (lpString=".jpg") returned 4 [0082.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.000] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") [0082.000] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9968) returned 1 [0082.000] CloseHandle (hObject=0x15c) returned 1 [0082.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0082.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.001] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.001] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0082.002] GetLastError () returned 0x0 [0082.002] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x26f0, lpOverlapped=0x0) returned 1 [0082.070] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2700, lpOverlapped=0x0) returned 1 [0082.085] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.085] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.086] SetEndOfFile (hFile=0x1f0) returned 1 [0082.086] CloseHandle (hObject=0x1f0) returned 1 [0082.086] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.086] SetEndOfFile (hFile=0x15c) returned 1 [0082.087] CloseHandle (hObject=0x15c) returned 1 [0082.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0082.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.087] lstrlenW (lpString=".doc") returned 4 [0082.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.087] lstrlenW (lpString=".docx") returned 5 [0082.087] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0082.087] lstrlenW (lpString=".pdf") returned 4 [0082.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.087] lstrlenW (lpString=".xls") returned 4 [0082.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.087] lstrlenW (lpString=".xlsx") returned 5 [0082.088] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0082.088] lstrlenW (lpString=".ppt") returned 4 [0082.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.088] lstrlenW (lpString=".zip") returned 4 [0082.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.088] lstrlenW (lpString=".rar") returned 4 [0082.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.088] lstrlenW (lpString=".bz2") returned 4 [0082.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.088] lstrlenW (lpString=".7z") returned 3 [0082.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.088] lstrlenW (lpString=".dbf") returned 4 [0082.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.088] lstrlenW (lpString=".1cd") returned 4 [0082.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0082.088] lstrlenW (lpString=".jpg") returned 4 [0082.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.088] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") [0082.089] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20212) returned 1 [0082.089] CloseHandle (hObject=0x15c) returned 1 [0082.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0082.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.089] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.089] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0082.090] GetLastError () returned 0x0 [0082.090] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0082.097] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0082.098] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.098] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.098] SetEndOfFile (hFile=0x1f0) returned 1 [0082.098] CloseHandle (hObject=0x1f0) returned 1 [0082.098] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.098] SetEndOfFile (hFile=0x15c) returned 1 [0082.099] CloseHandle (hObject=0x15c) returned 1 [0082.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0082.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.100] lstrlenW (lpString=".doc") returned 4 [0082.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.100] lstrlenW (lpString=".docx") returned 5 [0082.100] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0082.100] lstrlenW (lpString=".pdf") returned 4 [0082.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.100] lstrlenW (lpString=".xls") returned 4 [0082.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.100] lstrlenW (lpString=".xlsx") returned 5 [0082.100] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0082.100] lstrlenW (lpString=".ppt") returned 4 [0082.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.100] lstrlenW (lpString=".zip") returned 4 [0082.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.100] lstrlenW (lpString=".rar") returned 4 [0082.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.100] lstrlenW (lpString=".bz2") returned 4 [0082.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.100] lstrlenW (lpString=".7z") returned 3 [0082.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.101] lstrlenW (lpString=".dbf") returned 4 [0082.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.101] lstrlenW (lpString=".1cd") returned 4 [0082.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0082.101] lstrlenW (lpString=".jpg") returned 4 [0082.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.101] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") [0082.101] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7996) returned 1 [0082.101] CloseHandle (hObject=0x15c) returned 1 [0082.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0082.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0082.102] GetLastError () returned 0x0 [0082.102] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0082.104] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0082.105] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.105] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.105] SetEndOfFile (hFile=0x1f0) returned 1 [0082.106] CloseHandle (hObject=0x1f0) returned 1 [0082.106] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.106] SetEndOfFile (hFile=0x15c) returned 1 [0082.107] CloseHandle (hObject=0x15c) returned 1 [0082.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0082.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.107] lstrlenW (lpString=".doc") returned 4 [0082.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.107] lstrlenW (lpString=".docx") returned 5 [0082.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0082.107] lstrlenW (lpString=".pdf") returned 4 [0082.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.107] lstrlenW (lpString=".xls") returned 4 [0082.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.107] lstrlenW (lpString=".xlsx") returned 5 [0082.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0082.107] lstrlenW (lpString=".ppt") returned 4 [0082.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.107] lstrlenW (lpString=".zip") returned 4 [0082.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.107] lstrlenW (lpString=".rar") returned 4 [0082.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.108] lstrlenW (lpString=".bz2") returned 4 [0082.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.108] lstrlenW (lpString=".7z") returned 3 [0082.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.108] lstrlenW (lpString=".dbf") returned 4 [0082.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.108] lstrlenW (lpString=".1cd") returned 4 [0082.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0082.108] lstrlenW (lpString=".jpg") returned 4 [0082.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.108] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") [0082.109] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5272) returned 1 [0082.109] CloseHandle (hObject=0x15c) returned 1 [0082.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0082.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.109] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.109] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0082.110] GetLastError () returned 0x0 [0082.110] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1498, lpOverlapped=0x0) returned 1 [0082.111] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0082.121] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.121] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.121] SetEndOfFile (hFile=0x1f0) returned 1 [0082.122] CloseHandle (hObject=0x1f0) returned 1 [0082.122] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.122] SetEndOfFile (hFile=0x15c) returned 1 [0082.123] CloseHandle (hObject=0x15c) returned 1 [0082.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0082.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.123] lstrlenW (lpString=".doc") returned 4 [0082.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.123] lstrlenW (lpString=".docx") returned 5 [0082.123] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0082.123] lstrlenW (lpString=".pdf") returned 4 [0082.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.123] lstrlenW (lpString=".xls") returned 4 [0082.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.123] lstrlenW (lpString=".xlsx") returned 5 [0082.123] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0082.123] lstrlenW (lpString=".ppt") returned 4 [0082.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.123] lstrlenW (lpString=".zip") returned 4 [0082.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.123] lstrlenW (lpString=".rar") returned 4 [0082.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.124] lstrlenW (lpString=".bz2") returned 4 [0082.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.124] lstrlenW (lpString=".7z") returned 3 [0082.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.124] lstrlenW (lpString=".dbf") returned 4 [0082.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.124] lstrlenW (lpString=".1cd") returned 4 [0082.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0082.124] lstrlenW (lpString=".jpg") returned 4 [0082.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.124] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") [0082.125] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5868) returned 1 [0082.125] CloseHandle (hObject=0x15c) returned 1 [0082.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0082.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0082.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0082.126] GetLastError () returned 0x0 [0082.126] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16ec, lpOverlapped=0x0) returned 1 [0082.207] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0082.208] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.208] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.208] SetEndOfFile (hFile=0x1f0) returned 1 [0082.384] CloseHandle (hObject=0x1f0) returned 1 [0082.384] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.384] SetEndOfFile (hFile=0x15c) returned 1 [0082.385] CloseHandle (hObject=0x15c) returned 1 [0082.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString=".doc") returned 4 [0082.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString=".docx") returned 5 [0082.454] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0082.454] lstrlenW (lpString=".pdf") returned 4 [0082.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString=".xls") returned 4 [0082.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.454] lstrlenW (lpString=".xlsx") returned 5 [0082.454] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0082.454] lstrlenW (lpString=".ppt") returned 4 [0082.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString=".zip") returned 4 [0082.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.454] lstrlenW (lpString=".rar") returned 4 [0082.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString=".bz2") returned 4 [0082.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString=".7z") returned 3 [0082.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString=".dbf") returned 4 [0082.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString=".1cd") returned 4 [0082.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0082.454] lstrlenW (lpString=".jpg") returned 4 [0082.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.455] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") [0083.488] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10852) returned 1 [0083.488] CloseHandle (hObject=0x1c8) returned 1 [0083.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0083.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0083.495] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.501] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0083.510] GetLastError () returned 0x0 [0083.513] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2a64, lpOverlapped=0x0) returned 1 [0083.519] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0083.520] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.520] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.520] SetEndOfFile (hFile=0x22c) returned 1 [0083.520] CloseHandle (hObject=0x22c) returned 1 [0083.520] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.520] SetEndOfFile (hFile=0x1c8) returned 1 [0083.521] CloseHandle (hObject=0x1c8) returned 1 [0083.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0083.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString=".doc") returned 4 [0083.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString=".docx") returned 5 [0083.692] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0083.692] lstrlenW (lpString=".pdf") returned 4 [0083.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString=".xls") returned 4 [0083.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.692] lstrlenW (lpString=".xlsx") returned 5 [0083.692] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0083.692] lstrlenW (lpString=".ppt") returned 4 [0083.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString=".zip") returned 4 [0083.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.692] lstrlenW (lpString=".rar") returned 4 [0083.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString=".bz2") returned 4 [0083.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString=".7z") returned 3 [0083.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString=".dbf") returned 4 [0083.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString=".1cd") returned 4 [0083.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0083.692] lstrlenW (lpString=".jpg") returned 4 [0083.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.693] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") [0084.080] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3724) returned 1 [0084.080] CloseHandle (hObject=0x1fc) returned 1 [0084.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0084.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.081] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.081] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.081] GetLastError () returned 0x0 [0084.081] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe8c, lpOverlapped=0x0) returned 1 [0084.083] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0084.084] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.084] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.084] SetEndOfFile (hFile=0x1f0) returned 1 [0084.084] CloseHandle (hObject=0x1f0) returned 1 [0084.084] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.084] SetEndOfFile (hFile=0x1fc) returned 1 [0084.085] CloseHandle (hObject=0x1fc) returned 1 [0084.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0084.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.085] lstrlenW (lpString=".doc") returned 4 [0084.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString=".docx") returned 5 [0084.086] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0084.086] lstrlenW (lpString=".pdf") returned 4 [0084.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString=".xls") returned 4 [0084.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.086] lstrlenW (lpString=".xlsx") returned 5 [0084.086] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0084.086] lstrlenW (lpString=".ppt") returned 4 [0084.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.086] lstrlenW (lpString=".zip") returned 4 [0084.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.086] lstrlenW (lpString=".rar") returned 4 [0084.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString=".bz2") returned 4 [0084.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString=".7z") returned 3 [0084.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.086] lstrlenW (lpString=".dbf") returned 4 [0084.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.086] lstrlenW (lpString=".1cd") returned 4 [0084.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0084.086] lstrlenW (lpString=".jpg") returned 4 [0084.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.086] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") [0084.087] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7948) returned 1 [0084.087] CloseHandle (hObject=0x1fc) returned 1 [0084.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0084.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.088] GetLastError () returned 0x0 [0084.088] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0084.090] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0084.091] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.091] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.091] SetEndOfFile (hFile=0x1f0) returned 1 [0084.091] CloseHandle (hObject=0x1f0) returned 1 [0084.091] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.091] SetEndOfFile (hFile=0x1fc) returned 1 [0084.092] CloseHandle (hObject=0x1fc) returned 1 [0084.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0084.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.092] lstrlenW (lpString=".doc") returned 4 [0084.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.092] lstrlenW (lpString=".docx") returned 5 [0084.092] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0084.092] lstrlenW (lpString=".pdf") returned 4 [0084.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.092] lstrlenW (lpString=".xls") returned 4 [0084.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.092] lstrlenW (lpString=".xlsx") returned 5 [0084.092] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0084.092] lstrlenW (lpString=".ppt") returned 4 [0084.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.093] lstrlenW (lpString=".zip") returned 4 [0084.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.093] lstrlenW (lpString=".rar") returned 4 [0084.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.093] lstrlenW (lpString=".bz2") returned 4 [0084.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.093] lstrlenW (lpString=".7z") returned 3 [0084.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.093] lstrlenW (lpString=".dbf") returned 4 [0084.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.093] lstrlenW (lpString=".1cd") returned 4 [0084.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0084.093] lstrlenW (lpString=".jpg") returned 4 [0084.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.093] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") [0084.093] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6792) returned 1 [0084.094] CloseHandle (hObject=0x1fc) returned 1 [0084.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0084.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.094] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.094] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.094] GetLastError () returned 0x0 [0084.094] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1a88, lpOverlapped=0x0) returned 1 [0084.096] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1a90, lpOverlapped=0x0) returned 1 [0084.097] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.097] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.097] SetEndOfFile (hFile=0x1f0) returned 1 [0084.097] CloseHandle (hObject=0x1f0) returned 1 [0084.097] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.097] SetEndOfFile (hFile=0x1fc) returned 1 [0084.098] CloseHandle (hObject=0x1fc) returned 1 [0084.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0084.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.098] lstrlenW (lpString=".doc") returned 4 [0084.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString=".docx") returned 5 [0084.099] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0084.099] lstrlenW (lpString=".pdf") returned 4 [0084.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString=".xls") returned 4 [0084.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.099] lstrlenW (lpString=".xlsx") returned 5 [0084.099] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0084.099] lstrlenW (lpString=".ppt") returned 4 [0084.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.099] lstrlenW (lpString=".zip") returned 4 [0084.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.099] lstrlenW (lpString=".rar") returned 4 [0084.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString=".bz2") returned 4 [0084.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString=".7z") returned 3 [0084.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.099] lstrlenW (lpString=".dbf") returned 4 [0084.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.099] lstrlenW (lpString=".1cd") returned 4 [0084.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0084.099] lstrlenW (lpString=".jpg") returned 4 [0084.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.099] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") [0084.100] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=26768) returned 1 [0084.100] CloseHandle (hObject=0x1fc) returned 1 [0084.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0084.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.100] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.100] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.101] GetLastError () returned 0x0 [0084.101] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6890, lpOverlapped=0x0) returned 1 [0084.102] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x68a0, lpOverlapped=0x0) returned 1 [0084.104] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.104] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.104] SetEndOfFile (hFile=0x1f0) returned 1 [0084.104] CloseHandle (hObject=0x1f0) returned 1 [0084.104] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.104] SetEndOfFile (hFile=0x1fc) returned 1 [0084.105] CloseHandle (hObject=0x1fc) returned 1 [0084.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0084.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.105] lstrlenW (lpString=".doc") returned 4 [0084.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.105] lstrlenW (lpString=".docx") returned 5 [0084.105] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0084.105] lstrlenW (lpString=".pdf") returned 4 [0084.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString=".xls") returned 4 [0084.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.106] lstrlenW (lpString=".xlsx") returned 5 [0084.106] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0084.106] lstrlenW (lpString=".ppt") returned 4 [0084.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.106] lstrlenW (lpString=".zip") returned 4 [0084.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.106] lstrlenW (lpString=".rar") returned 4 [0084.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString=".bz2") returned 4 [0084.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString=".7z") returned 3 [0084.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.106] lstrlenW (lpString=".dbf") returned 4 [0084.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.106] lstrlenW (lpString=".1cd") returned 4 [0084.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0084.106] lstrlenW (lpString=".jpg") returned 4 [0084.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.106] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") [0084.107] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7072) returned 1 [0084.107] CloseHandle (hObject=0x1fc) returned 1 [0084.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0084.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.108] GetLastError () returned 0x0 [0084.108] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0084.109] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0084.110] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.110] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.110] SetEndOfFile (hFile=0x1f0) returned 1 [0084.110] CloseHandle (hObject=0x1f0) returned 1 [0084.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.111] SetEndOfFile (hFile=0x1fc) returned 1 [0084.111] CloseHandle (hObject=0x1fc) returned 1 [0084.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0084.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.112] lstrlenW (lpString=".doc") returned 4 [0084.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.112] lstrlenW (lpString=".docx") returned 5 [0084.112] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0084.112] lstrlenW (lpString=".pdf") returned 4 [0084.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.112] lstrlenW (lpString=".xls") returned 4 [0084.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.112] lstrlenW (lpString=".xlsx") returned 5 [0084.112] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0084.112] lstrlenW (lpString=".ppt") returned 4 [0084.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.112] lstrlenW (lpString=".zip") returned 4 [0084.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.112] lstrlenW (lpString=".rar") returned 4 [0084.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.112] lstrlenW (lpString=".bz2") returned 4 [0084.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.112] lstrlenW (lpString=".7z") returned 3 [0084.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.112] lstrlenW (lpString=".dbf") returned 4 [0084.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.113] lstrlenW (lpString=".1cd") returned 4 [0084.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0084.113] lstrlenW (lpString=".jpg") returned 4 [0084.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.113] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") [0084.114] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4808) returned 1 [0084.114] CloseHandle (hObject=0x1fc) returned 1 [0084.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0084.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0084.114] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.114] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.115] GetLastError () returned 0x0 [0084.115] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0084.254] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0084.299] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.300] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.300] SetEndOfFile (hFile=0x1f0) returned 1 [0084.300] CloseHandle (hObject=0x1f0) returned 1 [0084.300] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.300] SetEndOfFile (hFile=0x1fc) returned 1 [0084.301] CloseHandle (hObject=0x1fc) returned 1 [0084.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0084.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0084.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.552] lstrlenW (lpString=".doc") returned 4 [0084.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.558] lstrlenW (lpString=".docx") returned 5 [0084.567] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0084.568] lstrlenW (lpString=".pdf") returned 4 [0084.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.574] lstrlenW (lpString=".xls") returned 4 [0084.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.578] lstrlenW (lpString=".xlsx") returned 5 [0084.585] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0084.590] lstrlenW (lpString=".ppt") returned 4 [0084.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.594] lstrlenW (lpString=".zip") returned 4 [0084.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.596] lstrlenW (lpString=".rar") returned 4 [0084.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.597] lstrlenW (lpString=".bz2") returned 4 [0084.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.601] lstrlenW (lpString=".7z") returned 3 [0084.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.607] lstrlenW (lpString=".dbf") returned 4 [0084.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.613] lstrlenW (lpString=".1cd") returned 4 [0084.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0084.619] lstrlenW (lpString=".jpg") returned 4 [0084.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.619] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") [0085.127] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8224) returned 1 [0085.127] CloseHandle (hObject=0x1fc) returned 1 [0085.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0085.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0085.128] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.128] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0085.128] GetLastError () returned 0x0 [0085.128] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2020, lpOverlapped=0x0) returned 1 [0085.163] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2030, lpOverlapped=0x0) returned 1 [0085.164] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.164] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.164] SetEndOfFile (hFile=0x1f0) returned 1 [0085.165] CloseHandle (hObject=0x1f0) returned 1 [0085.165] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.165] SetEndOfFile (hFile=0x1fc) returned 1 [0085.166] CloseHandle (hObject=0x1fc) returned 1 [0085.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0085.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.321] lstrlenW (lpString=".doc") returned 4 [0085.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.321] lstrlenW (lpString=".docx") returned 5 [0085.321] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0085.321] lstrlenW (lpString=".pdf") returned 4 [0085.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.321] lstrlenW (lpString=".xls") returned 4 [0085.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.321] lstrlenW (lpString=".xlsx") returned 5 [0085.322] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0085.322] lstrlenW (lpString=".ppt") returned 4 [0085.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.322] lstrlenW (lpString=".zip") returned 4 [0085.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.322] lstrlenW (lpString=".rar") returned 4 [0085.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.322] lstrlenW (lpString=".bz2") returned 4 [0085.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.322] lstrlenW (lpString=".7z") returned 3 [0085.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.322] lstrlenW (lpString=".dbf") returned 4 [0085.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.322] lstrlenW (lpString=".1cd") returned 4 [0085.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0085.322] lstrlenW (lpString=".jpg") returned 4 [0085.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.322] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") [0085.506] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=33657) returned 1 [0085.506] CloseHandle (hObject=0x180) returned 1 [0085.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0085.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.506] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.506] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.507] GetLastError () returned 0x0 [0085.507] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8379, lpOverlapped=0x0) returned 1 [0085.509] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8380, lpOverlapped=0x0) returned 1 [0085.510] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.510] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.510] SetEndOfFile (hFile=0x158) returned 1 [0085.510] CloseHandle (hObject=0x158) returned 1 [0085.510] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.510] SetEndOfFile (hFile=0x180) returned 1 [0085.511] CloseHandle (hObject=0x180) returned 1 [0085.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.512] lstrlenW (lpString=".doc") returned 4 [0085.512] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.512] lstrlenW (lpString=".docx") returned 5 [0085.512] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0085.512] lstrlenW (lpString=".pdf") returned 4 [0085.512] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.512] lstrlenW (lpString=".xls") returned 4 [0085.512] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.512] lstrlenW (lpString=".xlsx") returned 5 [0085.512] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0085.512] lstrlenW (lpString=".ppt") returned 4 [0085.512] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.512] lstrlenW (lpString=".zip") returned 4 [0085.512] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.512] lstrlenW (lpString=".rar") returned 4 [0085.512] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.512] lstrlenW (lpString=".bz2") returned 4 [0085.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.512] lstrlenW (lpString=".7z") returned 3 [0085.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.512] lstrlenW (lpString=".dbf") returned 4 [0085.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.513] lstrlenW (lpString=".1cd") returned 4 [0085.513] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0085.513] lstrlenW (lpString=".jpg") returned 4 [0085.513] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.513] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") [0085.514] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=61633) returned 1 [0085.514] CloseHandle (hObject=0x16c) returned 1 [0085.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0085.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0085.514] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.514] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.515] GetLastError () returned 0x0 [0085.515] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0085.518] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0d0, lpOverlapped=0x0) returned 1 [0085.519] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.519] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.520] SetEndOfFile (hFile=0x180) returned 1 [0085.520] CloseHandle (hObject=0x180) returned 1 [0085.521] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.521] SetEndOfFile (hFile=0x16c) returned 1 [0085.522] CloseHandle (hObject=0x16c) returned 1 [0085.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0085.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.522] lstrlenW (lpString=".doc") returned 4 [0085.522] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.522] lstrlenW (lpString=".docx") returned 5 [0085.522] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0085.522] lstrlenW (lpString=".pdf") returned 4 [0085.522] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.522] lstrlenW (lpString=".xls") returned 4 [0085.522] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.522] lstrlenW (lpString=".xlsx") returned 5 [0085.523] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0085.523] lstrlenW (lpString=".ppt") returned 4 [0085.523] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.523] lstrlenW (lpString=".zip") returned 4 [0085.523] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.523] lstrlenW (lpString=".rar") returned 4 [0085.523] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.523] lstrlenW (lpString=".bz2") returned 4 [0085.523] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.523] lstrlenW (lpString=".7z") returned 3 [0085.523] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.523] lstrlenW (lpString=".dbf") returned 4 [0085.523] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.523] lstrlenW (lpString=".1cd") returned 4 [0085.523] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0085.523] lstrlenW (lpString=".jpg") returned 4 [0085.523] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.523] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") [0085.524] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=49238) returned 1 [0085.524] CloseHandle (hObject=0x16c) returned 1 [0085.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0085.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0085.524] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.524] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.524] GetLastError () returned 0x0 [0085.525] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc056, lpOverlapped=0x0) returned 1 [0085.530] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc060, lpOverlapped=0x0) returned 1 [0085.532] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.532] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.532] SetEndOfFile (hFile=0x180) returned 1 [0085.532] CloseHandle (hObject=0x180) returned 1 [0085.532] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.532] SetEndOfFile (hFile=0x16c) returned 1 [0085.533] CloseHandle (hObject=0x16c) returned 1 [0085.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.534] lstrlenW (lpString=".doc") returned 4 [0085.534] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.534] lstrlenW (lpString=".docx") returned 5 [0085.534] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0085.534] lstrlenW (lpString=".pdf") returned 4 [0085.534] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.534] lstrlenW (lpString=".xls") returned 4 [0085.534] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.534] lstrlenW (lpString=".xlsx") returned 5 [0085.534] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0085.534] lstrlenW (lpString=".ppt") returned 4 [0085.534] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.534] lstrlenW (lpString=".zip") returned 4 [0085.534] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.534] lstrlenW (lpString=".rar") returned 4 [0085.534] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.534] lstrlenW (lpString=".bz2") returned 4 [0085.534] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.534] lstrlenW (lpString=".7z") returned 3 [0085.534] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.535] lstrlenW (lpString=".dbf") returned 4 [0085.535] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.535] lstrlenW (lpString=".1cd") returned 4 [0085.535] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0085.535] lstrlenW (lpString=".jpg") returned 4 [0085.535] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.535] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") [0085.535] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17867) returned 1 [0085.535] CloseHandle (hObject=0x16c) returned 1 [0085.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0085.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0085.536] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.536] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0085.536] GetLastError () returned 0x0 [0085.536] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x45cb, lpOverlapped=0x0) returned 1 [0085.540] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x45d0, lpOverlapped=0x0) returned 1 [0085.721] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.721] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0085.721] SetEndOfFile (hFile=0x180) returned 1 [0085.721] CloseHandle (hObject=0x180) returned 1 [0085.721] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.721] SetEndOfFile (hFile=0x16c) returned 1 [0085.722] CloseHandle (hObject=0x16c) returned 1 [0085.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0085.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.723] lstrlenW (lpString=".doc") returned 4 [0085.723] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0085.723] lstrlenW (lpString=".docx") returned 5 [0085.723] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0085.723] lstrlenW (lpString=".pdf") returned 4 [0085.723] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0085.723] lstrlenW (lpString=".xls") returned 4 [0085.723] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0085.723] lstrlenW (lpString=".xlsx") returned 5 [0085.723] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0085.723] lstrlenW (lpString=".ppt") returned 4 [0085.723] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0085.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.723] lstrlenW (lpString=".zip") returned 4 [0085.723] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0085.723] lstrlenW (lpString=".rar") returned 4 [0085.723] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0085.723] lstrlenW (lpString=".bz2") returned 4 [0085.723] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0085.723] lstrlenW (lpString=".7z") returned 3 [0085.723] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0085.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.723] lstrlenW (lpString=".dbf") returned 4 [0085.723] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0085.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.744] lstrlenW (lpString=".1cd") returned 4 [0085.744] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0085.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0085.744] lstrlenW (lpString=".jpg") returned 4 [0085.744] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0085.744] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") [0086.100] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=64802) returned 1 [0086.100] CloseHandle (hObject=0x1c8) returned 1 [0086.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0086.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0086.109] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.109] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.110] GetLastError () returned 0x0 [0086.110] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xfd22, lpOverlapped=0x0) returned 1 [0086.116] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xfd30, lpOverlapped=0x0) returned 1 [0086.118] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.118] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.118] SetEndOfFile (hFile=0x158) returned 1 [0086.118] CloseHandle (hObject=0x158) returned 1 [0086.118] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.118] SetEndOfFile (hFile=0x1c8) returned 1 [0086.120] CloseHandle (hObject=0x1c8) returned 1 [0086.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0086.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.120] lstrlenW (lpString=".doc") returned 4 [0086.121] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0086.121] lstrlenW (lpString=".docx") returned 5 [0086.121] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0086.121] lstrlenW (lpString=".pdf") returned 4 [0086.121] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0086.121] lstrlenW (lpString=".xls") returned 4 [0086.121] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0086.121] lstrlenW (lpString=".xlsx") returned 5 [0086.121] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0086.121] lstrlenW (lpString=".ppt") returned 4 [0086.121] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0086.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.121] lstrlenW (lpString=".zip") returned 4 [0086.121] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0086.121] lstrlenW (lpString=".rar") returned 4 [0086.121] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0086.121] lstrlenW (lpString=".bz2") returned 4 [0086.121] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0086.121] lstrlenW (lpString=".7z") returned 3 [0086.121] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0086.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.121] lstrlenW (lpString=".dbf") returned 4 [0086.121] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0086.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.121] lstrlenW (lpString=".1cd") returned 4 [0086.121] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0086.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0086.122] lstrlenW (lpString=".jpg") returned 4 [0086.122] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0086.122] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") [0086.122] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18500) returned 1 [0086.123] CloseHandle (hObject=0x1c8) returned 1 [0086.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0086.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0086.123] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.123] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0086.124] GetLastError () returned 0x0 [0086.124] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4844, lpOverlapped=0x0) returned 1 [0086.397] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4850, lpOverlapped=0x0) returned 1 [0086.398] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.398] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.398] SetEndOfFile (hFile=0x158) returned 1 [0086.400] CloseHandle (hObject=0x158) returned 1 [0086.400] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.400] SetEndOfFile (hFile=0x1c8) returned 1 [0086.401] CloseHandle (hObject=0x1c8) returned 1 [0086.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0086.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.942] lstrlenW (lpString=".doc") returned 4 [0086.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.942] lstrlenW (lpString=".docx") returned 5 [0086.942] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0086.942] lstrlenW (lpString=".pdf") returned 4 [0086.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.942] lstrlenW (lpString=".xls") returned 4 [0086.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.943] lstrlenW (lpString=".xlsx") returned 5 [0086.943] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0086.943] lstrlenW (lpString=".ppt") returned 4 [0086.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.943] lstrlenW (lpString=".zip") returned 4 [0086.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.943] lstrlenW (lpString=".rar") returned 4 [0086.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString=".bz2") returned 4 [0086.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString=".7z") returned 3 [0086.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.943] lstrlenW (lpString=".dbf") returned 4 [0086.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.943] lstrlenW (lpString=".1cd") returned 4 [0086.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.943] lstrlenW (lpString=".jpg") returned 4 [0086.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.943] @NlsCompareInvariantNoCase@16 () [0086.943] lstrlenW (lpString=".docx") returned 5 [0086.943] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0086.943] lstrlenW (lpString=".pdf") returned 4 [0086.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.943] lstrlenW (lpString=".xls") returned 4 [0086.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.943] lstrlenW (lpString=".xlsx") returned 5 [0086.943] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0086.943] lstrlenW (lpString=".ppt") returned 4 [0086.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.944] lstrlenW (lpString=".zip") returned 4 [0086.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.944] lstrlenW (lpString=".rar") returned 4 [0086.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.944] lstrlenW (lpString=".bz2") returned 4 [0086.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.944] lstrlenW (lpString=".7z") returned 3 [0086.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.944] lstrlenW (lpString=".dbf") returned 4 [0086.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.944] lstrlenW (lpString=".1cd") returned 4 [0086.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0086.944] lstrlenW (lpString=".jpg") returned 4 [0086.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.944] @NlsCompareInvariantNoCase@16 () [0086.944] lstrlenW (lpString="J0152560.WMF") returned 12 [0086.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.945] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10880) returned 1 [0086.945] CloseHandle (hObject=0x1c0) returned 1 [0086.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0086.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.945] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.945] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0086.946] GetLastError () returned 0x0 [0086.946] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2a80, lpOverlapped=0x0) returned 1 [0086.948] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2a90, lpOverlapped=0x0) returned 1 [0086.949] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.949] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.949] SetEndOfFile (hFile=0x16c) returned 1 [0086.949] CloseHandle (hObject=0x16c) returned 1 [0086.949] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.949] SetEndOfFile (hFile=0x1c0) returned 1 [0086.951] CloseHandle (hObject=0x1c0) returned 1 [0086.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString=".doc") returned 4 [0086.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString=".docx") returned 5 [0086.952] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.952] lstrlenW (lpString=".pdf") returned 4 [0086.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString=".xls") returned 4 [0086.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.952] lstrlenW (lpString=".xlsx") returned 5 [0086.952] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.952] lstrlenW (lpString=".ppt") returned 4 [0086.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString=".zip") returned 4 [0086.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.952] lstrlenW (lpString=".rar") returned 4 [0086.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString=".bz2") returned 4 [0086.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString=".7z") returned 3 [0086.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString=".dbf") returned 4 [0086.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString=".1cd") returned 4 [0086.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.952] lstrlenW (lpString=".jpg") returned 4 [0086.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.953] @NlsCompareInvariantNoCase@16 () [0086.953] lstrlenW (lpString=".docx") returned 5 [0086.953] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.953] lstrlenW (lpString=".pdf") returned 4 [0086.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString=".xls") returned 4 [0086.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.953] lstrlenW (lpString=".xlsx") returned 5 [0086.953] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.953] lstrlenW (lpString=".ppt") returned 4 [0086.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.953] lstrlenW (lpString=".zip") returned 4 [0086.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.953] lstrlenW (lpString=".rar") returned 4 [0086.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString=".bz2") returned 4 [0086.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString=".7z") returned 3 [0086.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.953] lstrlenW (lpString=".dbf") returned 4 [0086.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.953] lstrlenW (lpString=".1cd") returned 4 [0086.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0086.953] lstrlenW (lpString=".jpg") returned 4 [0086.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.953] @NlsCompareInvariantNoCase@16 () [0086.953] lstrlenW (lpString="J0152568.WMF") returned 12 [0086.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.955] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3696) returned 1 [0086.955] CloseHandle (hObject=0x1c0) returned 1 [0086.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0086.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.955] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.955] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0086.955] GetLastError () returned 0x0 [0086.955] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe70, lpOverlapped=0x0) returned 1 [0086.960] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0086.960] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.960] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.960] SetEndOfFile (hFile=0x16c) returned 1 [0086.961] CloseHandle (hObject=0x16c) returned 1 [0086.961] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.961] SetEndOfFile (hFile=0x1c0) returned 1 [0086.961] CloseHandle (hObject=0x1c0) returned 1 [0086.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0086.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.962] lstrlenW (lpString=".doc") returned 4 [0086.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.962] lstrlenW (lpString=".docx") returned 5 [0086.962] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0086.962] lstrlenW (lpString=".pdf") returned 4 [0086.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.962] lstrlenW (lpString=".xls") returned 4 [0086.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.962] lstrlenW (lpString=".xlsx") returned 5 [0086.962] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0086.962] lstrlenW (lpString=".ppt") returned 4 [0086.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.962] lstrlenW (lpString=".zip") returned 4 [0086.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.962] lstrlenW (lpString=".rar") returned 4 [0086.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.962] lstrlenW (lpString=".bz2") returned 4 [0086.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.962] lstrlenW (lpString=".7z") returned 3 [0086.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".dbf") returned 4 [0086.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".1cd") returned 4 [0086.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".jpg") returned 4 [0086.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.963] @NlsCompareInvariantNoCase@16 () [0086.963] lstrlenW (lpString=".docx") returned 5 [0086.963] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0086.963] lstrlenW (lpString=".pdf") returned 4 [0086.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString=".xls") returned 4 [0086.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.963] lstrlenW (lpString=".xlsx") returned 5 [0086.963] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0086.963] lstrlenW (lpString=".ppt") returned 4 [0086.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".zip") returned 4 [0086.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.963] lstrlenW (lpString=".rar") returned 4 [0086.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString=".bz2") returned 4 [0086.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString=".7z") returned 3 [0086.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".dbf") returned 4 [0086.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.963] lstrlenW (lpString=".1cd") returned 4 [0086.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0086.964] lstrlenW (lpString=".jpg") returned 4 [0086.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.964] @NlsCompareInvariantNoCase@16 () [0086.964] lstrlenW (lpString="J0152570.WMF") returned 12 [0086.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.965] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3368) returned 1 [0086.965] CloseHandle (hObject=0x1c0) returned 1 [0086.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0086.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.965] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.965] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0086.966] GetLastError () returned 0x0 [0086.966] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd28, lpOverlapped=0x0) returned 1 [0086.967] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0086.968] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.968] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.968] SetEndOfFile (hFile=0x16c) returned 1 [0086.968] CloseHandle (hObject=0x16c) returned 1 [0086.969] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.969] SetEndOfFile (hFile=0x1c0) returned 1 [0086.969] CloseHandle (hObject=0x1c0) returned 1 [0086.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0086.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.970] lstrlenW (lpString=".doc") returned 4 [0086.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.970] lstrlenW (lpString=".docx") returned 5 [0086.970] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.970] lstrlenW (lpString=".pdf") returned 4 [0086.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.970] lstrlenW (lpString=".xls") returned 4 [0086.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.970] lstrlenW (lpString=".xlsx") returned 5 [0086.970] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.970] lstrlenW (lpString=".ppt") returned 4 [0086.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.970] lstrlenW (lpString=".zip") returned 4 [0086.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.970] lstrlenW (lpString=".rar") returned 4 [0086.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.970] lstrlenW (lpString=".bz2") returned 4 [0086.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.970] lstrlenW (lpString=".7z") returned 3 [0086.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.970] lstrlenW (lpString=".dbf") returned 4 [0086.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.971] lstrlenW (lpString=".1cd") returned 4 [0086.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.971] lstrlenW (lpString=".jpg") returned 4 [0086.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.971] @NlsCompareInvariantNoCase@16 () [0086.971] lstrlenW (lpString=".docx") returned 5 [0086.971] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0086.971] lstrlenW (lpString=".pdf") returned 4 [0086.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString=".xls") returned 4 [0086.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.971] lstrlenW (lpString=".xlsx") returned 5 [0086.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0086.971] lstrlenW (lpString=".ppt") returned 4 [0086.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.971] lstrlenW (lpString=".zip") returned 4 [0086.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.971] lstrlenW (lpString=".rar") returned 4 [0086.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString=".bz2") returned 4 [0086.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString=".7z") returned 3 [0086.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.971] lstrlenW (lpString=".dbf") returned 4 [0086.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.971] lstrlenW (lpString=".1cd") returned 4 [0086.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0086.972] lstrlenW (lpString=".jpg") returned 4 [0086.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.972] @NlsCompareInvariantNoCase@16 () [0086.972] lstrlenW (lpString="J0152590.WMF") returned 12 [0086.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.972] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10932) returned 1 [0086.972] CloseHandle (hObject=0x1c0) returned 1 [0086.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0086.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0086.973] GetLastError () returned 0x0 [0086.973] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0086.976] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2ac0, lpOverlapped=0x0) returned 1 [0086.977] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.977] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.977] SetEndOfFile (hFile=0x16c) returned 1 [0087.020] CloseHandle (hObject=0x16c) returned 1 [0087.020] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.020] SetEndOfFile (hFile=0x1c0) returned 1 [0087.028] CloseHandle (hObject=0x1c0) returned 1 [0087.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0087.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.054] lstrlenW (lpString=".doc") returned 4 [0087.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.054] lstrlenW (lpString=".docx") returned 5 [0087.054] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0087.055] lstrlenW (lpString=".pdf") returned 4 [0087.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString=".xls") returned 4 [0087.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.055] lstrlenW (lpString=".xlsx") returned 5 [0087.055] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0087.055] lstrlenW (lpString=".ppt") returned 4 [0087.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.055] lstrlenW (lpString=".zip") returned 4 [0087.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.055] lstrlenW (lpString=".rar") returned 4 [0087.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString=".bz2") returned 4 [0087.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString=".7z") returned 3 [0087.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.055] lstrlenW (lpString=".dbf") returned 4 [0087.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.055] lstrlenW (lpString=".1cd") returned 4 [0087.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0087.055] lstrlenW (lpString=".jpg") returned 4 [0087.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.056] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") [0087.056] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6340) returned 1 [0087.056] CloseHandle (hObject=0x1c0) returned 1 [0087.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0087.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.056] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.056] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.057] GetLastError () returned 0x0 [0087.057] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x18c4, lpOverlapped=0x0) returned 1 [0087.059] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x18d0, lpOverlapped=0x0) returned 1 [0087.060] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.060] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.061] SetEndOfFile (hFile=0x150) returned 1 [0087.061] CloseHandle (hObject=0x150) returned 1 [0087.061] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.061] SetEndOfFile (hFile=0x1c0) returned 1 [0087.062] CloseHandle (hObject=0x1c0) returned 1 [0087.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0087.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.062] lstrlenW (lpString=".doc") returned 4 [0087.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.062] lstrlenW (lpString=".docx") returned 5 [0087.062] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0087.062] lstrlenW (lpString=".pdf") returned 4 [0087.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.062] lstrlenW (lpString=".xls") returned 4 [0087.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.062] lstrlenW (lpString=".xlsx") returned 5 [0087.062] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0087.062] lstrlenW (lpString=".ppt") returned 4 [0087.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.062] lstrlenW (lpString=".zip") returned 4 [0087.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.062] lstrlenW (lpString=".rar") returned 4 [0087.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.062] lstrlenW (lpString=".bz2") returned 4 [0087.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.062] lstrlenW (lpString=".7z") returned 3 [0087.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.063] lstrlenW (lpString=".dbf") returned 4 [0087.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.063] lstrlenW (lpString=".1cd") returned 4 [0087.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0087.063] lstrlenW (lpString=".jpg") returned 4 [0087.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.063] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") [0087.063] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9768) returned 1 [0087.063] CloseHandle (hObject=0x1c0) returned 1 [0087.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0087.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.064] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.064] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.064] GetLastError () returned 0x0 [0087.064] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2628, lpOverlapped=0x0) returned 1 [0087.066] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2630, lpOverlapped=0x0) returned 1 [0087.067] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.067] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.067] SetEndOfFile (hFile=0x150) returned 1 [0087.067] CloseHandle (hObject=0x150) returned 1 [0087.067] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.068] SetEndOfFile (hFile=0x1c0) returned 1 [0087.068] CloseHandle (hObject=0x1c0) returned 1 [0087.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.069] lstrlenW (lpString=".doc") returned 4 [0087.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString=".docx") returned 5 [0087.069] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0087.069] lstrlenW (lpString=".pdf") returned 4 [0087.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString=".xls") returned 4 [0087.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.069] lstrlenW (lpString=".xlsx") returned 5 [0087.069] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0087.069] lstrlenW (lpString=".ppt") returned 4 [0087.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.069] lstrlenW (lpString=".zip") returned 4 [0087.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.069] lstrlenW (lpString=".rar") returned 4 [0087.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString=".bz2") returned 4 [0087.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString=".7z") returned 3 [0087.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.069] lstrlenW (lpString=".dbf") returned 4 [0087.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.069] lstrlenW (lpString=".1cd") returned 4 [0087.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0087.070] lstrlenW (lpString=".jpg") returned 4 [0087.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.070] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") [0087.070] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6276) returned 1 [0087.070] CloseHandle (hObject=0x1c0) returned 1 [0087.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0087.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.070] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.070] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.071] GetLastError () returned 0x0 [0087.071] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1884, lpOverlapped=0x0) returned 1 [0087.073] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1890, lpOverlapped=0x0) returned 1 [0087.074] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.074] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.074] SetEndOfFile (hFile=0x150) returned 1 [0087.074] CloseHandle (hObject=0x150) returned 1 [0087.074] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.074] SetEndOfFile (hFile=0x1c0) returned 1 [0087.075] CloseHandle (hObject=0x1c0) returned 1 [0087.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString=".doc") returned 4 [0087.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString=".docx") returned 5 [0087.076] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.076] lstrlenW (lpString=".pdf") returned 4 [0087.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString=".xls") returned 4 [0087.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.076] lstrlenW (lpString=".xlsx") returned 5 [0087.076] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.076] lstrlenW (lpString=".ppt") returned 4 [0087.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString=".zip") returned 4 [0087.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.076] lstrlenW (lpString=".rar") returned 4 [0087.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString=".bz2") returned 4 [0087.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString=".7z") returned 3 [0087.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString=".dbf") returned 4 [0087.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString=".1cd") returned 4 [0087.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0087.076] lstrlenW (lpString=".jpg") returned 4 [0087.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.076] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") [0087.077] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16632) returned 1 [0087.078] CloseHandle (hObject=0x1c0) returned 1 [0087.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0087.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.078] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.078] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.078] GetLastError () returned 0x0 [0087.078] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x40f8, lpOverlapped=0x0) returned 1 [0087.080] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4100, lpOverlapped=0x0) returned 1 [0087.081] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.081] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.082] SetEndOfFile (hFile=0x150) returned 1 [0087.082] CloseHandle (hObject=0x150) returned 1 [0087.082] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.082] SetEndOfFile (hFile=0x1c0) returned 1 [0087.083] CloseHandle (hObject=0x1c0) returned 1 [0087.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0087.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.083] lstrlenW (lpString=".doc") returned 4 [0087.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.083] lstrlenW (lpString=".docx") returned 5 [0087.083] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.083] lstrlenW (lpString=".pdf") returned 4 [0087.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.083] lstrlenW (lpString=".xls") returned 4 [0087.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.083] lstrlenW (lpString=".xlsx") returned 5 [0087.083] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.083] lstrlenW (lpString=".ppt") returned 4 [0087.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.083] lstrlenW (lpString=".zip") returned 4 [0087.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.083] lstrlenW (lpString=".rar") returned 4 [0087.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.084] lstrlenW (lpString=".bz2") returned 4 [0087.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.084] lstrlenW (lpString=".7z") returned 3 [0087.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.084] lstrlenW (lpString=".dbf") returned 4 [0087.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.084] lstrlenW (lpString=".1cd") returned 4 [0087.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0087.084] lstrlenW (lpString=".jpg") returned 4 [0087.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.084] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") [0087.084] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12436) returned 1 [0087.084] CloseHandle (hObject=0x1c0) returned 1 [0087.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0087.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.085] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.085] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.085] GetLastError () returned 0x0 [0087.085] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3094, lpOverlapped=0x0) returned 1 [0087.240] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x30a0, lpOverlapped=0x0) returned 1 [0087.263] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.263] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.263] SetEndOfFile (hFile=0x150) returned 1 [0087.263] CloseHandle (hObject=0x150) returned 1 [0087.263] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.263] SetEndOfFile (hFile=0x1c0) returned 1 [0087.264] CloseHandle (hObject=0x1c0) returned 1 [0087.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0087.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.264] lstrlenW (lpString=".doc") returned 4 [0087.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.264] lstrlenW (lpString=".docx") returned 5 [0087.264] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.264] lstrlenW (lpString=".pdf") returned 4 [0087.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.264] lstrlenW (lpString=".xls") returned 4 [0087.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.265] lstrlenW (lpString=".xlsx") returned 5 [0087.265] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.265] lstrlenW (lpString=".ppt") returned 4 [0087.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.265] lstrlenW (lpString=".zip") returned 4 [0087.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.265] lstrlenW (lpString=".rar") returned 4 [0087.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.265] lstrlenW (lpString=".bz2") returned 4 [0087.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.265] lstrlenW (lpString=".7z") returned 3 [0087.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.265] lstrlenW (lpString=".dbf") returned 4 [0087.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.265] lstrlenW (lpString=".1cd") returned 4 [0087.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0087.265] lstrlenW (lpString=".jpg") returned 4 [0087.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.265] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") [0087.266] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4580) returned 1 [0087.266] CloseHandle (hObject=0x1c0) returned 1 [0087.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0087.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.267] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.267] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.267] GetLastError () returned 0x0 [0087.267] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x11e4, lpOverlapped=0x0) returned 1 [0087.269] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x11f0, lpOverlapped=0x0) returned 1 [0087.270] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.270] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.270] SetEndOfFile (hFile=0x150) returned 1 [0087.270] CloseHandle (hObject=0x150) returned 1 [0087.271] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.271] SetEndOfFile (hFile=0x1c0) returned 1 [0087.271] CloseHandle (hObject=0x1c0) returned 1 [0087.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0087.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.272] lstrlenW (lpString=".doc") returned 4 [0087.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.272] lstrlenW (lpString=".docx") returned 5 [0087.272] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.272] lstrlenW (lpString=".pdf") returned 4 [0087.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.272] lstrlenW (lpString=".xls") returned 4 [0087.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.272] lstrlenW (lpString=".xlsx") returned 5 [0087.272] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.272] lstrlenW (lpString=".ppt") returned 4 [0087.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.272] lstrlenW (lpString=".zip") returned 4 [0087.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.272] lstrlenW (lpString=".rar") returned 4 [0087.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.272] lstrlenW (lpString=".bz2") returned 4 [0087.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.272] lstrlenW (lpString=".7z") returned 3 [0087.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.273] lstrlenW (lpString=".dbf") returned 4 [0087.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.273] lstrlenW (lpString=".1cd") returned 4 [0087.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0087.273] lstrlenW (lpString=".jpg") returned 4 [0087.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.273] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") [0087.274] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7020) returned 1 [0087.274] CloseHandle (hObject=0x1c0) returned 1 [0087.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0087.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.274] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.274] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.275] GetLastError () returned 0x0 [0087.275] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0087.277] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0087.278] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.278] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.278] SetEndOfFile (hFile=0x150) returned 1 [0087.278] CloseHandle (hObject=0x150) returned 1 [0087.278] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.278] SetEndOfFile (hFile=0x1c0) returned 1 [0087.279] CloseHandle (hObject=0x1c0) returned 1 [0087.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0087.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.280] lstrlenW (lpString=".doc") returned 4 [0087.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString=".docx") returned 5 [0087.280] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.280] lstrlenW (lpString=".pdf") returned 4 [0087.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString=".xls") returned 4 [0087.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.280] lstrlenW (lpString=".xlsx") returned 5 [0087.280] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.280] lstrlenW (lpString=".ppt") returned 4 [0087.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.280] lstrlenW (lpString=".zip") returned 4 [0087.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.280] lstrlenW (lpString=".rar") returned 4 [0087.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString=".bz2") returned 4 [0087.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString=".7z") returned 3 [0087.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.280] lstrlenW (lpString=".dbf") returned 4 [0087.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.280] lstrlenW (lpString=".1cd") returned 4 [0087.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0087.281] lstrlenW (lpString=".jpg") returned 4 [0087.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.281] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") [0087.282] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7876) returned 1 [0087.282] CloseHandle (hObject=0x1c0) returned 1 [0087.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0087.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.282] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.282] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.283] GetLastError () returned 0x0 [0087.283] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0087.284] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0087.285] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.285] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.286] SetEndOfFile (hFile=0x150) returned 1 [0087.286] CloseHandle (hObject=0x150) returned 1 [0087.286] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.286] SetEndOfFile (hFile=0x1c0) returned 1 [0087.287] CloseHandle (hObject=0x1c0) returned 1 [0087.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0087.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.287] lstrlenW (lpString=".doc") returned 4 [0087.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.287] lstrlenW (lpString=".docx") returned 5 [0087.287] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0087.287] lstrlenW (lpString=".pdf") returned 4 [0087.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.287] lstrlenW (lpString=".xls") returned 4 [0087.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.287] lstrlenW (lpString=".xlsx") returned 5 [0087.287] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0087.287] lstrlenW (lpString=".ppt") returned 4 [0087.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.287] lstrlenW (lpString=".zip") returned 4 [0087.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.287] lstrlenW (lpString=".rar") returned 4 [0087.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.288] lstrlenW (lpString=".bz2") returned 4 [0087.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.288] lstrlenW (lpString=".7z") returned 3 [0087.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.288] lstrlenW (lpString=".dbf") returned 4 [0087.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.288] lstrlenW (lpString=".1cd") returned 4 [0087.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0087.288] lstrlenW (lpString=".jpg") returned 4 [0087.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.288] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") [0087.288] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14888) returned 1 [0087.288] CloseHandle (hObject=0x1c0) returned 1 [0087.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0087.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.289] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.289] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.289] GetLastError () returned 0x0 [0087.289] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3a28, lpOverlapped=0x0) returned 1 [0087.291] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3a30, lpOverlapped=0x0) returned 1 [0087.292] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.292] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.292] SetEndOfFile (hFile=0x150) returned 1 [0087.292] CloseHandle (hObject=0x150) returned 1 [0087.293] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.293] SetEndOfFile (hFile=0x1c0) returned 1 [0087.294] CloseHandle (hObject=0x1c0) returned 1 [0087.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0087.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.294] lstrlenW (lpString=".doc") returned 4 [0087.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.294] lstrlenW (lpString=".docx") returned 5 [0087.294] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0087.294] lstrlenW (lpString=".pdf") returned 4 [0087.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.294] lstrlenW (lpString=".xls") returned 4 [0087.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.294] lstrlenW (lpString=".xlsx") returned 5 [0087.294] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0087.294] lstrlenW (lpString=".ppt") returned 4 [0087.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.294] lstrlenW (lpString=".zip") returned 4 [0087.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.295] lstrlenW (lpString=".rar") returned 4 [0087.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.295] lstrlenW (lpString=".bz2") returned 4 [0087.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.295] lstrlenW (lpString=".7z") returned 3 [0087.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.295] lstrlenW (lpString=".dbf") returned 4 [0087.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.295] lstrlenW (lpString=".1cd") returned 4 [0087.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0087.295] lstrlenW (lpString=".jpg") returned 4 [0087.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.295] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") [0087.295] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9072) returned 1 [0087.296] CloseHandle (hObject=0x1c0) returned 1 [0087.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0087.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0087.296] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.296] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.296] GetLastError () returned 0x0 [0087.296] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2370, lpOverlapped=0x0) returned 1 [0087.375] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0087.376] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.376] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0087.376] SetEndOfFile (hFile=0x150) returned 1 [0087.384] CloseHandle (hObject=0x150) returned 1 [0087.384] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.384] SetEndOfFile (hFile=0x1c0) returned 1 [0087.385] CloseHandle (hObject=0x1c0) returned 1 [0087.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0087.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.515] lstrlenW (lpString=".doc") returned 4 [0087.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.518] lstrlenW (lpString=".docx") returned 5 [0087.521] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0087.524] lstrlenW (lpString=".pdf") returned 4 [0087.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.528] lstrlenW (lpString=".xls") returned 4 [0087.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.532] lstrlenW (lpString=".xlsx") returned 5 [0087.532] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0087.533] lstrlenW (lpString=".ppt") returned 4 [0087.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.537] lstrlenW (lpString=".zip") returned 4 [0087.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.546] lstrlenW (lpString=".rar") returned 4 [0087.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.548] lstrlenW (lpString=".bz2") returned 4 [0087.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.550] lstrlenW (lpString=".7z") returned 3 [0087.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.555] lstrlenW (lpString=".dbf") returned 4 [0087.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.559] lstrlenW (lpString=".1cd") returned 4 [0087.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0087.562] lstrlenW (lpString=".jpg") returned 4 [0087.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.568] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") [0088.206] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7848) returned 1 [0088.206] CloseHandle (hObject=0x1c0) returned 1 [0088.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0088.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.363] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.363] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.378] GetLastError () returned 0x0 [0088.378] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0088.393] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1eb0, lpOverlapped=0x0) returned 1 [0088.394] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.394] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.394] SetEndOfFile (hFile=0x1c8) returned 1 [0088.394] CloseHandle (hObject=0x1c8) returned 1 [0088.394] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.394] SetEndOfFile (hFile=0x150) returned 1 [0088.395] CloseHandle (hObject=0x150) returned 1 [0088.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0088.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.395] lstrlenW (lpString=".doc") returned 4 [0088.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString=".docx") returned 5 [0088.396] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0088.396] lstrlenW (lpString=".pdf") returned 4 [0088.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString=".xls") returned 4 [0088.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.396] lstrlenW (lpString=".xlsx") returned 5 [0088.396] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0088.396] lstrlenW (lpString=".ppt") returned 4 [0088.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.396] lstrlenW (lpString=".zip") returned 4 [0088.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.396] lstrlenW (lpString=".rar") returned 4 [0088.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString=".bz2") returned 4 [0088.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString=".7z") returned 3 [0088.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.396] lstrlenW (lpString=".dbf") returned 4 [0088.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.396] lstrlenW (lpString=".1cd") returned 4 [0088.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0088.396] lstrlenW (lpString=".jpg") returned 4 [0088.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.396] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") [0088.397] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30800) returned 1 [0088.397] CloseHandle (hObject=0x150) returned 1 [0088.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0088.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.398] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.398] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.398] GetLastError () returned 0x0 [0088.398] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7850, lpOverlapped=0x0) returned 1 [0088.400] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0088.401] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.402] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.402] SetEndOfFile (hFile=0x1c8) returned 1 [0088.402] CloseHandle (hObject=0x1c8) returned 1 [0088.402] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.402] SetEndOfFile (hFile=0x150) returned 1 [0088.403] CloseHandle (hObject=0x150) returned 1 [0088.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0088.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.403] lstrlenW (lpString=".doc") returned 4 [0088.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.403] lstrlenW (lpString=".docx") returned 5 [0088.403] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0088.403] lstrlenW (lpString=".pdf") returned 4 [0088.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.403] lstrlenW (lpString=".xls") returned 4 [0088.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.403] lstrlenW (lpString=".xlsx") returned 5 [0088.403] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0088.403] lstrlenW (lpString=".ppt") returned 4 [0088.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.404] lstrlenW (lpString=".zip") returned 4 [0088.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.404] lstrlenW (lpString=".rar") returned 4 [0088.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.404] lstrlenW (lpString=".bz2") returned 4 [0088.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.404] lstrlenW (lpString=".7z") returned 3 [0088.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.404] lstrlenW (lpString=".dbf") returned 4 [0088.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.404] lstrlenW (lpString=".1cd") returned 4 [0088.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0088.404] lstrlenW (lpString=".jpg") returned 4 [0088.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.404] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") [0088.405] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=38488) returned 1 [0088.405] CloseHandle (hObject=0x150) returned 1 [0088.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0088.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.405] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.405] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.405] GetLastError () returned 0x0 [0088.405] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9658, lpOverlapped=0x0) returned 1 [0088.408] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9660, lpOverlapped=0x0) returned 1 [0088.409] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.409] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.409] SetEndOfFile (hFile=0x1c8) returned 1 [0088.409] CloseHandle (hObject=0x1c8) returned 1 [0088.409] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.409] SetEndOfFile (hFile=0x150) returned 1 [0088.410] CloseHandle (hObject=0x150) returned 1 [0088.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0088.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.411] lstrlenW (lpString=".doc") returned 4 [0088.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.411] lstrlenW (lpString=".docx") returned 5 [0088.411] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0088.411] lstrlenW (lpString=".pdf") returned 4 [0088.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.411] lstrlenW (lpString=".xls") returned 4 [0088.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.411] lstrlenW (lpString=".xlsx") returned 5 [0088.411] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0088.411] lstrlenW (lpString=".ppt") returned 4 [0088.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.411] lstrlenW (lpString=".zip") returned 4 [0088.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.411] lstrlenW (lpString=".rar") returned 4 [0088.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.411] lstrlenW (lpString=".bz2") returned 4 [0088.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.412] lstrlenW (lpString=".7z") returned 3 [0088.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.412] lstrlenW (lpString=".dbf") returned 4 [0088.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.412] lstrlenW (lpString=".1cd") returned 4 [0088.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0088.412] lstrlenW (lpString=".jpg") returned 4 [0088.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.412] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") [0088.412] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15448) returned 1 [0088.412] CloseHandle (hObject=0x150) returned 1 [0088.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0088.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.413] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.413] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.413] GetLastError () returned 0x0 [0088.413] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c58, lpOverlapped=0x0) returned 1 [0088.416] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0088.417] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.417] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.417] SetEndOfFile (hFile=0x1c8) returned 1 [0088.417] CloseHandle (hObject=0x1c8) returned 1 [0088.417] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.417] SetEndOfFile (hFile=0x150) returned 1 [0088.418] CloseHandle (hObject=0x150) returned 1 [0088.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0088.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.419] lstrlenW (lpString=".doc") returned 4 [0088.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString=".docx") returned 5 [0088.419] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0088.419] lstrlenW (lpString=".pdf") returned 4 [0088.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString=".xls") returned 4 [0088.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.419] lstrlenW (lpString=".xlsx") returned 5 [0088.419] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0088.419] lstrlenW (lpString=".ppt") returned 4 [0088.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.419] lstrlenW (lpString=".zip") returned 4 [0088.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.419] lstrlenW (lpString=".rar") returned 4 [0088.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString=".bz2") returned 4 [0088.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString=".7z") returned 3 [0088.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.419] lstrlenW (lpString=".dbf") returned 4 [0088.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.419] lstrlenW (lpString=".1cd") returned 4 [0088.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0088.420] lstrlenW (lpString=".jpg") returned 4 [0088.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.420] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") [0088.420] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16952) returned 1 [0088.420] CloseHandle (hObject=0x150) returned 1 [0088.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0088.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.420] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.421] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.421] GetLastError () returned 0x0 [0088.421] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4238, lpOverlapped=0x0) returned 1 [0088.423] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4240, lpOverlapped=0x0) returned 1 [0088.424] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.424] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.424] SetEndOfFile (hFile=0x1c8) returned 1 [0088.424] CloseHandle (hObject=0x1c8) returned 1 [0088.424] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.424] SetEndOfFile (hFile=0x150) returned 1 [0088.425] CloseHandle (hObject=0x150) returned 1 [0088.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0088.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.426] lstrlenW (lpString=".doc") returned 4 [0088.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString=".docx") returned 5 [0088.426] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0088.426] lstrlenW (lpString=".pdf") returned 4 [0088.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString=".xls") returned 4 [0088.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.426] lstrlenW (lpString=".xlsx") returned 5 [0088.426] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0088.426] lstrlenW (lpString=".ppt") returned 4 [0088.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.426] lstrlenW (lpString=".zip") returned 4 [0088.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.426] lstrlenW (lpString=".rar") returned 4 [0088.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString=".bz2") returned 4 [0088.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString=".7z") returned 3 [0088.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.426] lstrlenW (lpString=".dbf") returned 4 [0088.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.426] lstrlenW (lpString=".1cd") returned 4 [0088.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0088.427] lstrlenW (lpString=".jpg") returned 4 [0088.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.427] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") [0088.427] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17508) returned 1 [0088.427] CloseHandle (hObject=0x150) returned 1 [0088.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0088.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0088.427] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.427] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.428] GetLastError () returned 0x0 [0088.428] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4464, lpOverlapped=0x0) returned 1 [0088.455] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4470, lpOverlapped=0x0) returned 1 [0088.456] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.456] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0088.456] SetEndOfFile (hFile=0x1c8) returned 1 [0088.775] CloseHandle (hObject=0x1c8) returned 1 [0088.775] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.775] SetEndOfFile (hFile=0x150) returned 1 [0088.776] CloseHandle (hObject=0x150) returned 1 [0088.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0089.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.118] lstrlenW (lpString=".doc") returned 4 [0089.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString=".docx") returned 5 [0089.118] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0089.118] lstrlenW (lpString=".pdf") returned 4 [0089.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString=".xls") returned 4 [0089.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.118] lstrlenW (lpString=".xlsx") returned 5 [0089.118] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0089.118] lstrlenW (lpString=".ppt") returned 4 [0089.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.118] lstrlenW (lpString=".zip") returned 4 [0089.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.118] lstrlenW (lpString=".rar") returned 4 [0089.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString=".bz2") returned 4 [0089.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString=".7z") returned 3 [0089.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.118] lstrlenW (lpString=".dbf") returned 4 [0089.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.119] lstrlenW (lpString=".1cd") returned 4 [0089.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0089.119] lstrlenW (lpString=".jpg") returned 4 [0089.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.119] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") [0089.364] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7432) returned 1 [0089.365] CloseHandle (hObject=0x1f0) returned 1 [0089.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0089.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0089.380] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.380] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.398] GetLastError () returned 0x0 [0089.398] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1d08, lpOverlapped=0x0) returned 1 [0089.400] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1d10, lpOverlapped=0x0) returned 1 [0089.401] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.401] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.401] SetEndOfFile (hFile=0x210) returned 1 [0089.401] CloseHandle (hObject=0x210) returned 1 [0089.401] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.401] SetEndOfFile (hFile=0x1f0) returned 1 [0089.402] CloseHandle (hObject=0x1f0) returned 1 [0089.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0089.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.402] lstrlenW (lpString=".doc") returned 4 [0089.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.402] lstrlenW (lpString=".docx") returned 5 [0089.402] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0089.402] lstrlenW (lpString=".pdf") returned 4 [0089.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.402] lstrlenW (lpString=".xls") returned 4 [0089.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.402] lstrlenW (lpString=".xlsx") returned 5 [0089.402] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0089.403] lstrlenW (lpString=".ppt") returned 4 [0089.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.403] lstrlenW (lpString=".zip") returned 4 [0089.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.403] lstrlenW (lpString=".rar") returned 4 [0089.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.403] lstrlenW (lpString=".bz2") returned 4 [0089.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.403] lstrlenW (lpString=".7z") returned 3 [0089.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.403] lstrlenW (lpString=".dbf") returned 4 [0089.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.403] lstrlenW (lpString=".1cd") returned 4 [0089.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0089.403] lstrlenW (lpString=".jpg") returned 4 [0089.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.403] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") [0089.404] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17912) returned 1 [0089.404] CloseHandle (hObject=0x1f0) returned 1 [0089.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0089.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0089.404] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.404] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.405] GetLastError () returned 0x0 [0089.405] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x45f8, lpOverlapped=0x0) returned 1 [0089.407] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4600, lpOverlapped=0x0) returned 1 [0089.408] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.408] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.408] SetEndOfFile (hFile=0x210) returned 1 [0089.408] CloseHandle (hObject=0x210) returned 1 [0089.408] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.408] SetEndOfFile (hFile=0x1f0) returned 1 [0089.409] CloseHandle (hObject=0x1f0) returned 1 [0089.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0089.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.409] lstrlenW (lpString=".doc") returned 4 [0089.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.409] lstrlenW (lpString=".docx") returned 5 [0089.409] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0089.409] lstrlenW (lpString=".pdf") returned 4 [0089.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.409] lstrlenW (lpString=".xls") returned 4 [0089.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.410] lstrlenW (lpString=".xlsx") returned 5 [0089.410] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0089.410] lstrlenW (lpString=".ppt") returned 4 [0089.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.410] lstrlenW (lpString=".zip") returned 4 [0089.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.410] lstrlenW (lpString=".rar") returned 4 [0089.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.410] lstrlenW (lpString=".bz2") returned 4 [0089.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.410] lstrlenW (lpString=".7z") returned 3 [0089.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.410] lstrlenW (lpString=".dbf") returned 4 [0089.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.410] lstrlenW (lpString=".1cd") returned 4 [0089.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0089.410] lstrlenW (lpString=".jpg") returned 4 [0089.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.410] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") [0089.411] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11396) returned 1 [0089.411] CloseHandle (hObject=0x1f0) returned 1 [0089.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0089.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0089.411] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.411] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.412] GetLastError () returned 0x0 [0089.412] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2c84, lpOverlapped=0x0) returned 1 [0089.413] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0089.415] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.415] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.415] SetEndOfFile (hFile=0x210) returned 1 [0089.415] CloseHandle (hObject=0x210) returned 1 [0089.415] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.415] SetEndOfFile (hFile=0x1f0) returned 1 [0089.416] CloseHandle (hObject=0x1f0) returned 1 [0089.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0089.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.416] lstrlenW (lpString=".doc") returned 4 [0089.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.416] lstrlenW (lpString=".docx") returned 5 [0089.416] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0089.416] lstrlenW (lpString=".pdf") returned 4 [0089.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.416] lstrlenW (lpString=".xls") returned 4 [0089.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.417] lstrlenW (lpString=".xlsx") returned 5 [0089.417] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0089.417] lstrlenW (lpString=".ppt") returned 4 [0089.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.417] lstrlenW (lpString=".zip") returned 4 [0089.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.417] lstrlenW (lpString=".rar") returned 4 [0089.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.417] lstrlenW (lpString=".bz2") returned 4 [0089.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.417] lstrlenW (lpString=".7z") returned 3 [0089.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.417] lstrlenW (lpString=".dbf") returned 4 [0089.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.417] lstrlenW (lpString=".1cd") returned 4 [0089.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0089.417] lstrlenW (lpString=".jpg") returned 4 [0089.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.417] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") [0089.418] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18652) returned 1 [0089.418] CloseHandle (hObject=0x1f0) returned 1 [0089.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0089.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0089.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.418] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.419] GetLastError () returned 0x0 [0089.419] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x48dc, lpOverlapped=0x0) returned 1 [0089.420] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x48e0, lpOverlapped=0x0) returned 1 [0089.422] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.422] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.422] SetEndOfFile (hFile=0x210) returned 1 [0089.422] CloseHandle (hObject=0x210) returned 1 [0089.422] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.422] SetEndOfFile (hFile=0x1f0) returned 1 [0089.423] CloseHandle (hObject=0x1f0) returned 1 [0089.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0089.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.423] lstrlenW (lpString=".doc") returned 4 [0089.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.423] lstrlenW (lpString=".docx") returned 5 [0089.423] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0089.423] lstrlenW (lpString=".pdf") returned 4 [0089.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.423] lstrlenW (lpString=".xls") returned 4 [0089.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.424] lstrlenW (lpString=".xlsx") returned 5 [0089.424] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0089.424] lstrlenW (lpString=".ppt") returned 4 [0089.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.424] lstrlenW (lpString=".zip") returned 4 [0089.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.424] lstrlenW (lpString=".rar") returned 4 [0089.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.424] lstrlenW (lpString=".bz2") returned 4 [0089.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.424] lstrlenW (lpString=".7z") returned 3 [0089.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.424] lstrlenW (lpString=".dbf") returned 4 [0089.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.424] lstrlenW (lpString=".1cd") returned 4 [0089.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0089.424] lstrlenW (lpString=".jpg") returned 4 [0089.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.424] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") [0089.425] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17966) returned 1 [0089.425] CloseHandle (hObject=0x1f0) returned 1 [0089.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0089.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0089.426] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.426] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.426] GetLastError () returned 0x0 [0089.426] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x462e, lpOverlapped=0x0) returned 1 [0089.431] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0089.432] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.432] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.432] SetEndOfFile (hFile=0x210) returned 1 [0089.432] CloseHandle (hObject=0x210) returned 1 [0089.432] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.432] SetEndOfFile (hFile=0x1f0) returned 1 [0089.433] CloseHandle (hObject=0x1f0) returned 1 [0089.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.434] lstrlenW (lpString=".doc") returned 4 [0089.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString=".docx") returned 5 [0089.434] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0089.434] lstrlenW (lpString=".pdf") returned 4 [0089.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString=".xls") returned 4 [0089.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.434] lstrlenW (lpString=".xlsx") returned 5 [0089.434] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0089.434] lstrlenW (lpString=".ppt") returned 4 [0089.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.434] lstrlenW (lpString=".zip") returned 4 [0089.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.434] lstrlenW (lpString=".rar") returned 4 [0089.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString=".bz2") returned 4 [0089.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString=".7z") returned 3 [0089.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.434] lstrlenW (lpString=".dbf") returned 4 [0089.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.434] lstrlenW (lpString=".1cd") returned 4 [0089.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0089.435] lstrlenW (lpString=".jpg") returned 4 [0089.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.435] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") [0089.904] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29406) returned 1 [0089.904] CloseHandle (hObject=0x1c8) returned 1 [0089.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0089.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.911] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.911] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0089.925] GetLastError () returned 0x0 [0089.925] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x72de, lpOverlapped=0x0) returned 1 [0089.938] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x72e0, lpOverlapped=0x0) returned 1 [0089.939] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.939] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.939] SetEndOfFile (hFile=0x158) returned 1 [0089.939] CloseHandle (hObject=0x158) returned 1 [0089.939] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.939] SetEndOfFile (hFile=0x1c8) returned 1 [0089.940] CloseHandle (hObject=0x1c8) returned 1 [0089.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0090.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.030] lstrlenW (lpString=".doc") returned 4 [0090.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.030] lstrlenW (lpString=".docx") returned 5 [0090.030] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0090.030] lstrlenW (lpString=".pdf") returned 4 [0090.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.030] lstrlenW (lpString=".xls") returned 4 [0090.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.030] lstrlenW (lpString=".xlsx") returned 5 [0090.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0090.031] lstrlenW (lpString=".ppt") returned 4 [0090.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.031] lstrlenW (lpString=".zip") returned 4 [0090.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.031] lstrlenW (lpString=".rar") returned 4 [0090.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString=".bz2") returned 4 [0090.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString=".7z") returned 3 [0090.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.031] lstrlenW (lpString=".dbf") returned 4 [0090.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.031] lstrlenW (lpString=".1cd") returned 4 [0090.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0090.031] lstrlenW (lpString=".jpg") returned 4 [0090.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.031] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") [0090.083] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5864) returned 1 [0090.083] CloseHandle (hObject=0x190) returned 1 [0090.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0090.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.096] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.096] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.104] GetLastError () returned 0x0 [0090.104] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16e8, lpOverlapped=0x0) returned 1 [0090.113] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0090.114] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.114] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.115] SetEndOfFile (hFile=0x16c) returned 1 [0090.115] CloseHandle (hObject=0x16c) returned 1 [0090.115] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.115] SetEndOfFile (hFile=0x190) returned 1 [0090.116] CloseHandle (hObject=0x190) returned 1 [0090.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.116] lstrlenW (lpString=".doc") returned 4 [0090.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.116] lstrlenW (lpString=".docx") returned 5 [0090.116] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.116] lstrlenW (lpString=".pdf") returned 4 [0090.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.116] lstrlenW (lpString=".xls") returned 4 [0090.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.116] lstrlenW (lpString=".xlsx") returned 5 [0090.116] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.116] lstrlenW (lpString=".ppt") returned 4 [0090.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.116] lstrlenW (lpString=".zip") returned 4 [0090.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.117] lstrlenW (lpString=".rar") returned 4 [0090.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.117] lstrlenW (lpString=".bz2") returned 4 [0090.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.117] lstrlenW (lpString=".7z") returned 3 [0090.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.117] lstrlenW (lpString=".dbf") returned 4 [0090.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.117] lstrlenW (lpString=".1cd") returned 4 [0090.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0090.117] lstrlenW (lpString=".jpg") returned 4 [0090.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.117] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") [0090.118] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=45358) returned 1 [0090.118] CloseHandle (hObject=0x190) returned 1 [0090.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0090.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.118] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.118] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.119] GetLastError () returned 0x0 [0090.119] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xb12e, lpOverlapped=0x0) returned 1 [0090.121] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xb130, lpOverlapped=0x0) returned 1 [0090.123] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.123] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.123] SetEndOfFile (hFile=0x16c) returned 1 [0090.123] CloseHandle (hObject=0x16c) returned 1 [0090.123] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.123] SetEndOfFile (hFile=0x190) returned 1 [0090.124] CloseHandle (hObject=0x190) returned 1 [0090.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0090.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.125] lstrlenW (lpString=".doc") returned 4 [0090.125] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.125] lstrlenW (lpString=".docx") returned 5 [0090.125] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0090.125] lstrlenW (lpString=".pdf") returned 4 [0090.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.125] lstrlenW (lpString=".xls") returned 4 [0090.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.125] lstrlenW (lpString=".xlsx") returned 5 [0090.125] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0090.125] lstrlenW (lpString=".ppt") returned 4 [0090.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.125] lstrlenW (lpString=".zip") returned 4 [0090.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.125] lstrlenW (lpString=".rar") returned 4 [0090.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.125] lstrlenW (lpString=".bz2") returned 4 [0090.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.125] lstrlenW (lpString=".7z") returned 3 [0090.125] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.125] lstrlenW (lpString=".dbf") returned 4 [0090.126] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.126] lstrlenW (lpString=".1cd") returned 4 [0090.126] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0090.126] lstrlenW (lpString=".jpg") returned 4 [0090.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.126] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") [0090.127] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=55554) returned 1 [0090.127] CloseHandle (hObject=0x190) returned 1 [0090.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0090.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.127] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.127] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.128] GetLastError () returned 0x0 [0090.128] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd902, lpOverlapped=0x0) returned 1 [0090.130] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd910, lpOverlapped=0x0) returned 1 [0090.140] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.140] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.140] SetEndOfFile (hFile=0x16c) returned 1 [0090.140] CloseHandle (hObject=0x16c) returned 1 [0090.140] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.140] SetEndOfFile (hFile=0x190) returned 1 [0090.141] CloseHandle (hObject=0x190) returned 1 [0090.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0090.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.142] lstrlenW (lpString=".doc") returned 4 [0090.142] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.142] lstrlenW (lpString=".docx") returned 5 [0090.142] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0090.142] lstrlenW (lpString=".pdf") returned 4 [0090.142] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.142] lstrlenW (lpString=".xls") returned 4 [0090.142] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.142] lstrlenW (lpString=".xlsx") returned 5 [0090.142] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0090.142] lstrlenW (lpString=".ppt") returned 4 [0090.142] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.142] lstrlenW (lpString=".zip") returned 4 [0090.142] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.142] lstrlenW (lpString=".rar") returned 4 [0090.142] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.142] lstrlenW (lpString=".bz2") returned 4 [0090.143] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.143] lstrlenW (lpString=".7z") returned 3 [0090.143] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.143] lstrlenW (lpString=".dbf") returned 4 [0090.143] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.143] lstrlenW (lpString=".1cd") returned 4 [0090.143] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0090.143] lstrlenW (lpString=".jpg") returned 4 [0090.143] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.143] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") [0090.143] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=36989) returned 1 [0090.143] CloseHandle (hObject=0x190) returned 1 [0090.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0090.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.144] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.144] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.144] GetLastError () returned 0x0 [0090.144] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x907d, lpOverlapped=0x0) returned 1 [0090.147] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9080, lpOverlapped=0x0) returned 1 [0090.149] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.149] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.149] SetEndOfFile (hFile=0x16c) returned 1 [0090.149] CloseHandle (hObject=0x16c) returned 1 [0090.149] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.149] SetEndOfFile (hFile=0x190) returned 1 [0090.150] CloseHandle (hObject=0x190) returned 1 [0090.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0090.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.150] lstrlenW (lpString=".doc") returned 4 [0090.150] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.150] lstrlenW (lpString=".docx") returned 5 [0090.150] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0090.150] lstrlenW (lpString=".pdf") returned 4 [0090.151] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.151] lstrlenW (lpString=".xls") returned 4 [0090.151] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.151] lstrlenW (lpString=".xlsx") returned 5 [0090.151] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0090.151] lstrlenW (lpString=".ppt") returned 4 [0090.151] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.151] lstrlenW (lpString=".zip") returned 4 [0090.151] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.151] lstrlenW (lpString=".rar") returned 4 [0090.151] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.151] lstrlenW (lpString=".bz2") returned 4 [0090.151] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.151] lstrlenW (lpString=".7z") returned 3 [0090.151] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.151] lstrlenW (lpString=".dbf") returned 4 [0090.151] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.151] lstrlenW (lpString=".1cd") returned 4 [0090.151] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0090.151] lstrlenW (lpString=".jpg") returned 4 [0090.151] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.151] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") [0090.152] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29204) returned 1 [0090.152] CloseHandle (hObject=0x190) returned 1 [0090.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0090.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0090.152] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.152] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.153] GetLastError () returned 0x0 [0090.153] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7214, lpOverlapped=0x0) returned 1 [0090.263] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0090.264] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.264] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.264] SetEndOfFile (hFile=0x16c) returned 1 [0090.399] CloseHandle (hObject=0x16c) returned 1 [0090.399] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.399] SetEndOfFile (hFile=0x190) returned 1 [0090.400] CloseHandle (hObject=0x190) returned 1 [0090.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0090.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.488] lstrlenW (lpString=".doc") returned 4 [0090.488] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.488] lstrlenW (lpString=".docx") returned 5 [0090.488] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0090.488] lstrlenW (lpString=".pdf") returned 4 [0090.488] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.488] lstrlenW (lpString=".xls") returned 4 [0090.488] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.488] lstrlenW (lpString=".xlsx") returned 5 [0090.488] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0090.488] lstrlenW (lpString=".ppt") returned 4 [0090.489] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.489] lstrlenW (lpString=".zip") returned 4 [0090.489] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.489] lstrlenW (lpString=".rar") returned 4 [0090.489] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.489] lstrlenW (lpString=".bz2") returned 4 [0090.489] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.489] lstrlenW (lpString=".7z") returned 3 [0090.489] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.489] lstrlenW (lpString=".dbf") returned 4 [0090.489] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.489] lstrlenW (lpString=".1cd") returned 4 [0090.489] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0090.489] lstrlenW (lpString=".jpg") returned 4 [0090.489] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.489] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") [0090.562] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16615) returned 1 [0090.575] CloseHandle (hObject=0x1c0) returned 1 [0090.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0090.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0090.580] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.580] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0090.750] GetLastError () returned 0x0 [0090.750] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x40e7, lpOverlapped=0x0) returned 1 [0090.858] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x40f0, lpOverlapped=0x0) returned 1 [0090.859] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.859] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.859] SetEndOfFile (hFile=0x1ec) returned 1 [0090.859] CloseHandle (hObject=0x1ec) returned 1 [0090.859] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.859] SetEndOfFile (hFile=0x16c) returned 1 [0090.860] CloseHandle (hObject=0x16c) returned 1 [0090.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0090.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.861] lstrlenW (lpString=".doc") returned 4 [0090.861] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.861] lstrlenW (lpString=".docx") returned 5 [0090.861] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0090.861] lstrlenW (lpString=".pdf") returned 4 [0090.861] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.861] lstrlenW (lpString=".xls") returned 4 [0090.861] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.861] lstrlenW (lpString=".xlsx") returned 5 [0090.861] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0090.861] lstrlenW (lpString=".ppt") returned 4 [0090.861] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.861] lstrlenW (lpString=".zip") returned 4 [0090.861] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.861] lstrlenW (lpString=".rar") returned 4 [0090.861] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.861] lstrlenW (lpString=".bz2") returned 4 [0090.861] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.861] lstrlenW (lpString=".7z") returned 3 [0090.861] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.861] lstrlenW (lpString=".dbf") returned 4 [0090.861] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.861] lstrlenW (lpString=".1cd") returned 4 [0090.861] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0090.862] lstrlenW (lpString=".jpg") returned 4 [0090.862] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.862] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") [0091.351] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19274) returned 1 [0091.352] CloseHandle (hObject=0x22c) returned 1 [0091.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0091.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0091.352] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.352] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0091.353] GetLastError () returned 0x0 [0091.353] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4b4a, lpOverlapped=0x0) returned 1 [0091.420] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4b50, lpOverlapped=0x0) returned 1 [0091.421] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.422] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.422] SetEndOfFile (hFile=0x150) returned 1 [0092.004] CloseHandle (hObject=0x150) returned 1 [0092.036] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.036] SetEndOfFile (hFile=0x22c) returned 1 [0092.053] CloseHandle (hObject=0x22c) returned 1 [0092.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0092.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.068] lstrlenW (lpString=".doc") returned 4 [0092.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.068] lstrlenW (lpString=".docx") returned 5 [0092.068] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0092.068] lstrlenW (lpString=".pdf") returned 4 [0092.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.068] lstrlenW (lpString=".xls") returned 4 [0092.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.068] lstrlenW (lpString=".xlsx") returned 5 [0092.068] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0092.073] lstrlenW (lpString=".ppt") returned 4 [0092.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.073] lstrlenW (lpString=".zip") returned 4 [0092.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.073] lstrlenW (lpString=".rar") returned 4 [0092.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.073] lstrlenW (lpString=".bz2") returned 4 [0092.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.073] lstrlenW (lpString=".7z") returned 3 [0092.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.073] lstrlenW (lpString=".dbf") returned 4 [0092.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.074] lstrlenW (lpString=".1cd") returned 4 [0092.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0092.074] lstrlenW (lpString=".jpg") returned 4 [0092.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.074] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") [0092.249] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8666) returned 1 [0092.249] CloseHandle (hObject=0x1f0) returned 1 [0092.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0092.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.249] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.250] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0092.250] GetLastError () returned 0x0 [0092.250] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x21da, lpOverlapped=0x0) returned 1 [0092.252] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x21e0, lpOverlapped=0x0) returned 1 [0092.253] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.253] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.253] SetEndOfFile (hFile=0x190) returned 1 [0092.254] CloseHandle (hObject=0x190) returned 1 [0092.254] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.254] SetEndOfFile (hFile=0x1f0) returned 1 [0092.255] CloseHandle (hObject=0x1f0) returned 1 [0092.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0092.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.255] lstrlenW (lpString=".doc") returned 4 [0092.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.255] lstrlenW (lpString=".docx") returned 5 [0092.255] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0092.255] lstrlenW (lpString=".pdf") returned 4 [0092.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.255] lstrlenW (lpString=".xls") returned 4 [0092.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.255] lstrlenW (lpString=".xlsx") returned 5 [0092.255] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0092.255] lstrlenW (lpString=".ppt") returned 4 [0092.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.255] lstrlenW (lpString=".zip") returned 4 [0092.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.256] lstrlenW (lpString=".rar") returned 4 [0092.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.256] lstrlenW (lpString=".bz2") returned 4 [0092.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.256] lstrlenW (lpString=".7z") returned 3 [0092.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.256] lstrlenW (lpString=".dbf") returned 4 [0092.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.256] lstrlenW (lpString=".1cd") returned 4 [0092.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0092.256] lstrlenW (lpString=".jpg") returned 4 [0092.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.256] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") [0092.256] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11644) returned 1 [0092.257] CloseHandle (hObject=0x1f0) returned 1 [0092.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0092.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.257] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.257] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0092.258] GetLastError () returned 0x0 [0092.258] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2d7c, lpOverlapped=0x0) returned 1 [0092.259] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0092.260] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.260] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.260] SetEndOfFile (hFile=0x190) returned 1 [0092.260] CloseHandle (hObject=0x190) returned 1 [0092.260] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.260] SetEndOfFile (hFile=0x1f0) returned 1 [0092.261] CloseHandle (hObject=0x1f0) returned 1 [0092.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0092.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.262] lstrlenW (lpString=".doc") returned 4 [0092.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.262] lstrlenW (lpString=".docx") returned 5 [0092.262] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0092.262] lstrlenW (lpString=".pdf") returned 4 [0092.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.262] lstrlenW (lpString=".xls") returned 4 [0092.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.262] lstrlenW (lpString=".xlsx") returned 5 [0092.262] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0092.262] lstrlenW (lpString=".ppt") returned 4 [0092.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.262] lstrlenW (lpString=".zip") returned 4 [0092.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.262] lstrlenW (lpString=".rar") returned 4 [0092.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.262] lstrlenW (lpString=".bz2") returned 4 [0092.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.262] lstrlenW (lpString=".7z") returned 3 [0092.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.262] lstrlenW (lpString=".dbf") returned 4 [0092.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.263] lstrlenW (lpString=".1cd") returned 4 [0092.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0092.263] lstrlenW (lpString=".jpg") returned 4 [0092.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.263] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") [0092.264] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10352) returned 1 [0092.264] CloseHandle (hObject=0x1f0) returned 1 [0092.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0092.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.264] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.264] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0092.265] GetLastError () returned 0x0 [0092.265] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2870, lpOverlapped=0x0) returned 1 [0092.267] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0092.268] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.268] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.268] SetEndOfFile (hFile=0x190) returned 1 [0092.268] CloseHandle (hObject=0x190) returned 1 [0092.268] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.268] SetEndOfFile (hFile=0x1f0) returned 1 [0092.269] CloseHandle (hObject=0x1f0) returned 1 [0092.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0092.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.269] lstrlenW (lpString=".doc") returned 4 [0092.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.269] lstrlenW (lpString=".docx") returned 5 [0092.269] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0092.269] lstrlenW (lpString=".pdf") returned 4 [0092.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.269] lstrlenW (lpString=".xls") returned 4 [0092.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.269] lstrlenW (lpString=".xlsx") returned 5 [0092.270] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0092.270] lstrlenW (lpString=".ppt") returned 4 [0092.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.270] lstrlenW (lpString=".zip") returned 4 [0092.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.270] lstrlenW (lpString=".rar") returned 4 [0092.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.270] lstrlenW (lpString=".bz2") returned 4 [0092.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.270] lstrlenW (lpString=".7z") returned 3 [0092.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.270] lstrlenW (lpString=".dbf") returned 4 [0092.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.270] lstrlenW (lpString=".1cd") returned 4 [0092.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0092.270] lstrlenW (lpString=".jpg") returned 4 [0092.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.270] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") [0092.271] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7500) returned 1 [0092.271] CloseHandle (hObject=0x1f0) returned 1 [0092.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0092.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.271] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.271] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0092.272] GetLastError () returned 0x0 [0092.272] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1d4c, lpOverlapped=0x0) returned 1 [0092.273] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0092.274] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.274] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.274] SetEndOfFile (hFile=0x190) returned 1 [0092.274] CloseHandle (hObject=0x190) returned 1 [0092.274] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.274] SetEndOfFile (hFile=0x1f0) returned 1 [0092.275] CloseHandle (hObject=0x1f0) returned 1 [0092.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0092.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.276] lstrlenW (lpString=".doc") returned 4 [0092.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString=".docx") returned 5 [0092.276] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0092.276] lstrlenW (lpString=".pdf") returned 4 [0092.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString=".xls") returned 4 [0092.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.276] lstrlenW (lpString=".xlsx") returned 5 [0092.276] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0092.276] lstrlenW (lpString=".ppt") returned 4 [0092.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.276] lstrlenW (lpString=".zip") returned 4 [0092.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.276] lstrlenW (lpString=".rar") returned 4 [0092.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString=".bz2") returned 4 [0092.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString=".7z") returned 3 [0092.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.276] lstrlenW (lpString=".dbf") returned 4 [0092.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.276] lstrlenW (lpString=".1cd") returned 4 [0092.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0092.277] lstrlenW (lpString=".jpg") returned 4 [0092.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.277] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") [0092.277] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12352) returned 1 [0092.277] CloseHandle (hObject=0x1f0) returned 1 [0092.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0092.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.277] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.278] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0092.278] GetLastError () returned 0x0 [0092.278] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3040, lpOverlapped=0x0) returned 1 [0092.501] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0092.515] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.515] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.515] SetEndOfFile (hFile=0x190) returned 1 [0092.515] CloseHandle (hObject=0x190) returned 1 [0092.515] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.515] SetEndOfFile (hFile=0x1f0) returned 1 [0092.516] CloseHandle (hObject=0x1f0) returned 1 [0092.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0092.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.517] lstrlenW (lpString=".doc") returned 4 [0092.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString=".docx") returned 5 [0092.517] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0092.517] lstrlenW (lpString=".pdf") returned 4 [0092.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString=".xls") returned 4 [0092.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.517] lstrlenW (lpString=".xlsx") returned 5 [0092.517] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0092.517] lstrlenW (lpString=".ppt") returned 4 [0092.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.517] lstrlenW (lpString=".zip") returned 4 [0092.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.517] lstrlenW (lpString=".rar") returned 4 [0092.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString=".bz2") returned 4 [0092.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString=".7z") returned 3 [0092.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.517] lstrlenW (lpString=".dbf") returned 4 [0092.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.518] lstrlenW (lpString=".1cd") returned 4 [0092.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0092.518] lstrlenW (lpString=".jpg") returned 4 [0092.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.518] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") [0093.078] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10716) returned 1 [0093.078] CloseHandle (hObject=0x150) returned 1 [0093.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0093.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.078] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.078] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.079] GetLastError () returned 0x0 [0093.079] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x29dc, lpOverlapped=0x0) returned 1 [0093.081] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x29e0, lpOverlapped=0x0) returned 1 [0093.082] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.082] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.082] SetEndOfFile (hFile=0x22c) returned 1 [0093.082] CloseHandle (hObject=0x22c) returned 1 [0093.082] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.082] SetEndOfFile (hFile=0x150) returned 1 [0093.083] CloseHandle (hObject=0x150) returned 1 [0093.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.083] lstrlenW (lpString=".doc") returned 4 [0093.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.083] lstrlenW (lpString=".docx") returned 5 [0093.083] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0093.083] lstrlenW (lpString=".pdf") returned 4 [0093.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString=".xls") returned 4 [0093.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.084] lstrlenW (lpString=".xlsx") returned 5 [0093.084] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0093.084] lstrlenW (lpString=".ppt") returned 4 [0093.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.084] lstrlenW (lpString=".zip") returned 4 [0093.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.084] lstrlenW (lpString=".rar") returned 4 [0093.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString=".bz2") returned 4 [0093.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString=".7z") returned 3 [0093.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.084] lstrlenW (lpString=".dbf") returned 4 [0093.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.084] lstrlenW (lpString=".1cd") returned 4 [0093.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0093.084] lstrlenW (lpString=".jpg") returned 4 [0093.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.084] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") [0093.085] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16030) returned 1 [0093.085] CloseHandle (hObject=0x150) returned 1 [0093.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0093.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.085] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.085] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.086] GetLastError () returned 0x0 [0093.086] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3e9e, lpOverlapped=0x0) returned 1 [0093.088] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0093.089] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.089] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.089] SetEndOfFile (hFile=0x22c) returned 1 [0093.089] CloseHandle (hObject=0x22c) returned 1 [0093.090] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.090] SetEndOfFile (hFile=0x150) returned 1 [0093.090] CloseHandle (hObject=0x150) returned 1 [0093.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.091] lstrlenW (lpString=".doc") returned 4 [0093.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.091] lstrlenW (lpString=".docx") returned 5 [0093.091] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.091] lstrlenW (lpString=".pdf") returned 4 [0093.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.091] lstrlenW (lpString=".xls") returned 4 [0093.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.091] lstrlenW (lpString=".xlsx") returned 5 [0093.091] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.091] lstrlenW (lpString=".ppt") returned 4 [0093.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.091] lstrlenW (lpString=".zip") returned 4 [0093.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.091] lstrlenW (lpString=".rar") returned 4 [0093.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.091] lstrlenW (lpString=".bz2") returned 4 [0093.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.091] lstrlenW (lpString=".7z") returned 3 [0093.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.092] lstrlenW (lpString=".dbf") returned 4 [0093.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.092] lstrlenW (lpString=".1cd") returned 4 [0093.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0093.092] lstrlenW (lpString=".jpg") returned 4 [0093.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.092] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") [0093.093] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29602) returned 1 [0093.093] CloseHandle (hObject=0x150) returned 1 [0093.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0093.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.093] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.093] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.094] GetLastError () returned 0x0 [0093.094] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x73a2, lpOverlapped=0x0) returned 1 [0093.096] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x73b0, lpOverlapped=0x0) returned 1 [0093.098] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.098] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.098] SetEndOfFile (hFile=0x22c) returned 1 [0093.098] CloseHandle (hObject=0x22c) returned 1 [0093.098] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.098] SetEndOfFile (hFile=0x150) returned 1 [0093.099] CloseHandle (hObject=0x150) returned 1 [0093.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString=".doc") returned 4 [0093.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString=".docx") returned 5 [0093.100] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.100] lstrlenW (lpString=".pdf") returned 4 [0093.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString=".xls") returned 4 [0093.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.100] lstrlenW (lpString=".xlsx") returned 5 [0093.100] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.100] lstrlenW (lpString=".ppt") returned 4 [0093.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString=".zip") returned 4 [0093.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.100] lstrlenW (lpString=".rar") returned 4 [0093.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString=".bz2") returned 4 [0093.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString=".7z") returned 3 [0093.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString=".dbf") returned 4 [0093.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString=".1cd") returned 4 [0093.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0093.100] lstrlenW (lpString=".jpg") returned 4 [0093.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.101] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") [0093.101] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=13162) returned 1 [0093.101] CloseHandle (hObject=0x150) returned 1 [0093.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0093.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.102] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.102] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.102] GetLastError () returned 0x0 [0093.102] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x336a, lpOverlapped=0x0) returned 1 [0093.104] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3370, lpOverlapped=0x0) returned 1 [0093.106] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.106] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.106] SetEndOfFile (hFile=0x22c) returned 1 [0093.106] CloseHandle (hObject=0x22c) returned 1 [0093.106] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.106] SetEndOfFile (hFile=0x150) returned 1 [0093.107] CloseHandle (hObject=0x150) returned 1 [0093.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0093.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.107] lstrlenW (lpString=".doc") returned 4 [0093.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.107] lstrlenW (lpString=".docx") returned 5 [0093.107] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.108] lstrlenW (lpString=".pdf") returned 4 [0093.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString=".xls") returned 4 [0093.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.108] lstrlenW (lpString=".xlsx") returned 5 [0093.108] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.108] lstrlenW (lpString=".ppt") returned 4 [0093.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.108] lstrlenW (lpString=".zip") returned 4 [0093.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.108] lstrlenW (lpString=".rar") returned 4 [0093.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString=".bz2") returned 4 [0093.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString=".7z") returned 3 [0093.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.108] lstrlenW (lpString=".dbf") returned 4 [0093.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.108] lstrlenW (lpString=".1cd") returned 4 [0093.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0093.108] lstrlenW (lpString=".jpg") returned 4 [0093.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.108] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") [0093.109] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7332) returned 1 [0093.109] CloseHandle (hObject=0x150) returned 1 [0093.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0093.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.109] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.109] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.110] GetLastError () returned 0x0 [0093.110] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ca4, lpOverlapped=0x0) returned 1 [0093.112] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0093.113] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.113] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.113] SetEndOfFile (hFile=0x22c) returned 1 [0093.113] CloseHandle (hObject=0x22c) returned 1 [0093.113] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.113] SetEndOfFile (hFile=0x150) returned 1 [0093.114] CloseHandle (hObject=0x150) returned 1 [0093.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.114] lstrlenW (lpString=".doc") returned 4 [0093.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.114] lstrlenW (lpString=".docx") returned 5 [0093.114] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.115] lstrlenW (lpString=".pdf") returned 4 [0093.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString=".xls") returned 4 [0093.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.115] lstrlenW (lpString=".xlsx") returned 5 [0093.115] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.115] lstrlenW (lpString=".ppt") returned 4 [0093.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.115] lstrlenW (lpString=".zip") returned 4 [0093.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.115] lstrlenW (lpString=".rar") returned 4 [0093.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString=".bz2") returned 4 [0093.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString=".7z") returned 3 [0093.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.115] lstrlenW (lpString=".dbf") returned 4 [0093.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.115] lstrlenW (lpString=".1cd") returned 4 [0093.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0093.115] lstrlenW (lpString=".jpg") returned 4 [0093.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.115] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") [0093.116] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4534) returned 1 [0093.116] CloseHandle (hObject=0x150) returned 1 [0093.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0093.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.116] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.116] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.117] GetLastError () returned 0x0 [0093.117] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x11b6, lpOverlapped=0x0) returned 1 [0093.370] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0093.371] ReadFile (in: hFile=0x150, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.371] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.371] SetEndOfFile (hFile=0x22c) returned 1 [0093.371] CloseHandle (hObject=0x22c) returned 1 [0093.372] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.372] SetEndOfFile (hFile=0x150) returned 1 [0093.372] CloseHandle (hObject=0x150) returned 1 [0093.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0093.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.373] lstrlenW (lpString=".doc") returned 4 [0093.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.373] lstrlenW (lpString=".docx") returned 5 [0093.373] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.373] lstrlenW (lpString=".pdf") returned 4 [0093.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.373] lstrlenW (lpString=".xls") returned 4 [0093.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.373] lstrlenW (lpString=".xlsx") returned 5 [0093.373] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.373] lstrlenW (lpString=".ppt") returned 4 [0093.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.373] lstrlenW (lpString=".zip") returned 4 [0093.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.373] lstrlenW (lpString=".rar") returned 4 [0093.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.373] lstrlenW (lpString=".bz2") returned 4 [0093.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.373] lstrlenW (lpString=".7z") returned 3 [0093.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.374] lstrlenW (lpString=".dbf") returned 4 [0093.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.374] lstrlenW (lpString=".1cd") returned 4 [0093.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0093.374] lstrlenW (lpString=".jpg") returned 4 [0093.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.374] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") [0093.380] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=26252) returned 1 [0093.380] CloseHandle (hObject=0x1f0) returned 1 [0093.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0093.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.381] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.381] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.381] GetLastError () returned 0x0 [0093.381] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x668c, lpOverlapped=0x0) returned 1 [0093.384] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0093.385] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.385] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.385] SetEndOfFile (hFile=0x190) returned 1 [0093.385] CloseHandle (hObject=0x190) returned 1 [0093.385] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.385] SetEndOfFile (hFile=0x1f0) returned 1 [0093.386] CloseHandle (hObject=0x1f0) returned 1 [0093.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0093.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.387] lstrlenW (lpString=".doc") returned 4 [0093.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString=".docx") returned 5 [0093.387] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.387] lstrlenW (lpString=".pdf") returned 4 [0093.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString=".xls") returned 4 [0093.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.387] lstrlenW (lpString=".xlsx") returned 5 [0093.387] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.387] lstrlenW (lpString=".ppt") returned 4 [0093.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.387] lstrlenW (lpString=".zip") returned 4 [0093.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.387] lstrlenW (lpString=".rar") returned 4 [0093.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString=".bz2") returned 4 [0093.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString=".7z") returned 3 [0093.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.387] lstrlenW (lpString=".dbf") returned 4 [0093.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.387] lstrlenW (lpString=".1cd") returned 4 [0093.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0093.388] lstrlenW (lpString=".jpg") returned 4 [0093.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.388] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") [0093.388] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=33948) returned 1 [0093.388] CloseHandle (hObject=0x1f0) returned 1 [0093.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0093.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.389] GetLastError () returned 0x0 [0093.390] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x849c, lpOverlapped=0x0) returned 1 [0093.392] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x84a0, lpOverlapped=0x0) returned 1 [0093.393] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.393] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.393] SetEndOfFile (hFile=0x190) returned 1 [0093.393] CloseHandle (hObject=0x190) returned 1 [0093.393] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.394] SetEndOfFile (hFile=0x1f0) returned 1 [0093.394] CloseHandle (hObject=0x1f0) returned 1 [0093.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.395] lstrlenW (lpString=".doc") returned 4 [0093.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.395] lstrlenW (lpString=".docx") returned 5 [0093.395] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.395] lstrlenW (lpString=".pdf") returned 4 [0093.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.395] lstrlenW (lpString=".xls") returned 4 [0093.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.395] lstrlenW (lpString=".xlsx") returned 5 [0093.395] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.395] lstrlenW (lpString=".ppt") returned 4 [0093.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.395] lstrlenW (lpString=".zip") returned 4 [0093.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.395] lstrlenW (lpString=".rar") returned 4 [0093.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.395] lstrlenW (lpString=".bz2") returned 4 [0093.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.395] lstrlenW (lpString=".7z") returned 3 [0093.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.396] lstrlenW (lpString=".dbf") returned 4 [0093.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.396] lstrlenW (lpString=".1cd") returned 4 [0093.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0093.396] lstrlenW (lpString=".jpg") returned 4 [0093.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.396] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") [0093.396] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=23726) returned 1 [0093.396] CloseHandle (hObject=0x1f0) returned 1 [0093.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0093.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.397] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.397] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.397] GetLastError () returned 0x0 [0093.397] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5cae, lpOverlapped=0x0) returned 1 [0093.402] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5cb0, lpOverlapped=0x0) returned 1 [0093.403] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.403] WriteFile (in: hFile=0x190, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.403] SetEndOfFile (hFile=0x190) returned 1 [0093.403] CloseHandle (hObject=0x190) returned 1 [0093.403] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.403] SetEndOfFile (hFile=0x1f0) returned 1 [0093.404] CloseHandle (hObject=0x1f0) returned 1 [0093.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0093.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.407] lstrlenW (lpString=".doc") returned 4 [0093.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString=".docx") returned 5 [0093.407] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.407] lstrlenW (lpString=".pdf") returned 4 [0093.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString=".xls") returned 4 [0093.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.407] lstrlenW (lpString=".xlsx") returned 5 [0093.407] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.407] lstrlenW (lpString=".ppt") returned 4 [0093.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.407] lstrlenW (lpString=".zip") returned 4 [0093.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.407] lstrlenW (lpString=".rar") returned 4 [0093.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString=".bz2") returned 4 [0093.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString=".7z") returned 3 [0093.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.407] lstrlenW (lpString=".dbf") returned 4 [0093.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.407] lstrlenW (lpString=".1cd") returned 4 [0093.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0093.407] lstrlenW (lpString=".jpg") returned 4 [0093.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.408] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") [0093.417] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15566) returned 1 [0093.417] CloseHandle (hObject=0x16c) returned 1 [0093.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0093.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.426] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.433] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.439] GetLastError () returned 0x0 [0093.439] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3cce, lpOverlapped=0x0) returned 1 [0093.443] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3cd0, lpOverlapped=0x0) returned 1 [0093.444] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.444] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.444] SetEndOfFile (hFile=0x1ec) returned 1 [0093.445] CloseHandle (hObject=0x1ec) returned 1 [0093.445] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.445] SetEndOfFile (hFile=0x16c) returned 1 [0093.445] CloseHandle (hObject=0x16c) returned 1 [0093.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.446] lstrlenW (lpString=".doc") returned 4 [0093.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".docx") returned 5 [0093.446] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0093.446] lstrlenW (lpString=".pdf") returned 4 [0093.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".xls") returned 4 [0093.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.446] lstrlenW (lpString=".xlsx") returned 5 [0093.446] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0093.446] lstrlenW (lpString=".ppt") returned 4 [0093.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.446] lstrlenW (lpString=".zip") returned 4 [0093.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.446] lstrlenW (lpString=".rar") returned 4 [0093.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".bz2") returned 4 [0093.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".7z") returned 3 [0093.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.447] lstrlenW (lpString=".dbf") returned 4 [0093.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.447] lstrlenW (lpString=".1cd") returned 4 [0093.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0093.447] lstrlenW (lpString=".jpg") returned 4 [0093.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.447] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") [0093.447] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=28572) returned 1 [0093.447] CloseHandle (hObject=0x16c) returned 1 [0093.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0093.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.448] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.448] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.448] GetLastError () returned 0x0 [0093.448] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6f9c, lpOverlapped=0x0) returned 1 [0093.455] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6fa0, lpOverlapped=0x0) returned 1 [0093.456] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.456] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.457] SetEndOfFile (hFile=0x1ec) returned 1 [0093.457] CloseHandle (hObject=0x1ec) returned 1 [0093.457] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.457] SetEndOfFile (hFile=0x16c) returned 1 [0093.458] CloseHandle (hObject=0x16c) returned 1 [0093.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0093.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.458] lstrlenW (lpString=".doc") returned 4 [0093.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.458] lstrlenW (lpString=".docx") returned 5 [0093.458] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.458] lstrlenW (lpString=".pdf") returned 4 [0093.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.458] lstrlenW (lpString=".xls") returned 4 [0093.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.458] lstrlenW (lpString=".xlsx") returned 5 [0093.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.459] lstrlenW (lpString=".ppt") returned 4 [0093.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.459] lstrlenW (lpString=".zip") returned 4 [0093.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.459] lstrlenW (lpString=".rar") returned 4 [0093.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.459] lstrlenW (lpString=".bz2") returned 4 [0093.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.459] lstrlenW (lpString=".7z") returned 3 [0093.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.459] lstrlenW (lpString=".dbf") returned 4 [0093.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.459] lstrlenW (lpString=".1cd") returned 4 [0093.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0093.459] lstrlenW (lpString=".jpg") returned 4 [0093.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.459] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") [0093.472] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=49676) returned 1 [0093.472] CloseHandle (hObject=0x190) returned 1 [0093.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 0x20 [0093.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.486] GetLastError () returned 0x0 [0093.486] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc20c, lpOverlapped=0x0) returned 1 [0093.488] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc210, lpOverlapped=0x0) returned 1 [0093.490] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.490] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.490] SetEndOfFile (hFile=0x150) returned 1 [0093.490] CloseHandle (hObject=0x150) returned 1 [0093.490] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.490] SetEndOfFile (hFile=0x190) returned 1 [0093.491] CloseHandle (hObject=0x190) returned 1 [0093.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString=".doc") returned 4 [0093.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString=".docx") returned 5 [0093.492] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0093.492] lstrlenW (lpString=".pdf") returned 4 [0093.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString=".xls") returned 4 [0093.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.492] lstrlenW (lpString=".xlsx") returned 5 [0093.492] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0093.492] lstrlenW (lpString=".ppt") returned 4 [0093.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString=".zip") returned 4 [0093.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.492] lstrlenW (lpString=".rar") returned 4 [0093.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString=".bz2") returned 4 [0093.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString=".7z") returned 3 [0093.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString=".dbf") returned 4 [0093.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString=".1cd") returned 4 [0093.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0093.492] lstrlenW (lpString=".jpg") returned 4 [0093.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.493] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") [0093.493] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29006) returned 1 [0093.493] CloseHandle (hObject=0x190) returned 1 [0093.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 0x20 [0093.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0093.493] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.494] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.494] GetLastError () returned 0x0 [0093.494] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x714e, lpOverlapped=0x0) returned 1 [0093.496] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0093.497] ReadFile (in: hFile=0x190, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.497] WriteFile (in: hFile=0x150, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.498] SetEndOfFile (hFile=0x150) returned 1 [0093.498] CloseHandle (hObject=0x150) returned 1 [0093.498] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.498] SetEndOfFile (hFile=0x190) returned 1 [0093.499] CloseHandle (hObject=0x190) returned 1 [0093.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0093.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.499] lstrlenW (lpString=".doc") returned 4 [0093.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.499] lstrlenW (lpString=".docx") returned 5 [0093.499] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0093.499] lstrlenW (lpString=".pdf") returned 4 [0093.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.499] lstrlenW (lpString=".xls") returned 4 [0093.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.499] lstrlenW (lpString=".xlsx") returned 5 [0093.499] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0093.499] lstrlenW (lpString=".ppt") returned 4 [0093.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.500] lstrlenW (lpString=".zip") returned 4 [0093.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.500] lstrlenW (lpString=".rar") returned 4 [0093.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.500] lstrlenW (lpString=".bz2") returned 4 [0093.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.500] lstrlenW (lpString=".7z") returned 3 [0093.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.500] lstrlenW (lpString=".dbf") returned 4 [0093.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.500] lstrlenW (lpString=".1cd") returned 4 [0093.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0093.500] lstrlenW (lpString=".jpg") returned 4 [0093.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.500] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") [0093.538] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31822) returned 1 [0093.538] CloseHandle (hObject=0x16c) returned 1 [0093.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 0x20 [0093.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.538] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.538] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.539] GetLastError () returned 0x0 [0093.539] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7c4e, lpOverlapped=0x0) returned 1 [0093.746] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0093.812] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.812] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.812] SetEndOfFile (hFile=0x1ec) returned 1 [0093.954] CloseHandle (hObject=0x1ec) returned 1 [0093.954] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.954] SetEndOfFile (hFile=0x16c) returned 1 [0093.963] CloseHandle (hObject=0x16c) returned 1 [0093.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0093.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.980] lstrlenW (lpString=".doc") returned 4 [0093.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.980] lstrlenW (lpString=".docx") returned 5 [0093.980] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0093.980] lstrlenW (lpString=".pdf") returned 4 [0093.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString=".xls") returned 4 [0093.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.981] lstrlenW (lpString=".xlsx") returned 5 [0093.981] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0093.981] lstrlenW (lpString=".ppt") returned 4 [0093.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.981] lstrlenW (lpString=".zip") returned 4 [0093.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.981] lstrlenW (lpString=".rar") returned 4 [0093.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString=".bz2") returned 4 [0093.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString=".7z") returned 3 [0093.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.981] lstrlenW (lpString=".dbf") returned 4 [0093.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.981] lstrlenW (lpString=".1cd") returned 4 [0093.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0093.981] lstrlenW (lpString=".jpg") returned 4 [0093.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.981] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") [0093.982] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10046) returned 1 [0093.982] CloseHandle (hObject=0x16c) returned 1 [0093.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 0x20 [0093.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.982] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.982] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.983] GetLastError () returned 0x0 [0093.983] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x273e, lpOverlapped=0x0) returned 1 [0093.984] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2740, lpOverlapped=0x0) returned 1 [0093.985] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.986] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.986] SetEndOfFile (hFile=0x1ec) returned 1 [0093.986] CloseHandle (hObject=0x1ec) returned 1 [0093.986] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.986] SetEndOfFile (hFile=0x16c) returned 1 [0093.987] CloseHandle (hObject=0x16c) returned 1 [0093.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0093.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.987] lstrlenW (lpString=".doc") returned 4 [0093.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString=".docx") returned 5 [0093.987] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0093.987] lstrlenW (lpString=".pdf") returned 4 [0093.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString=".xls") returned 4 [0093.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.987] lstrlenW (lpString=".xlsx") returned 5 [0093.987] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0093.988] lstrlenW (lpString=".ppt") returned 4 [0093.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.988] lstrlenW (lpString=".zip") returned 4 [0093.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.988] lstrlenW (lpString=".rar") returned 4 [0093.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString=".bz2") returned 4 [0093.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString=".7z") returned 3 [0093.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.988] lstrlenW (lpString=".dbf") returned 4 [0093.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.988] lstrlenW (lpString=".1cd") returned 4 [0093.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0093.988] lstrlenW (lpString=".jpg") returned 4 [0093.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.988] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") [0093.989] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3894) returned 1 [0093.989] CloseHandle (hObject=0x16c) returned 1 [0093.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 0x20 [0093.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.989] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.989] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.990] GetLastError () returned 0x0 [0093.990] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xf36, lpOverlapped=0x0) returned 1 [0093.991] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0093.992] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.992] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.992] SetEndOfFile (hFile=0x1ec) returned 1 [0093.993] CloseHandle (hObject=0x1ec) returned 1 [0093.993] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.993] SetEndOfFile (hFile=0x16c) returned 1 [0093.994] CloseHandle (hObject=0x16c) returned 1 [0093.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0093.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.994] lstrlenW (lpString=".doc") returned 4 [0093.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.994] lstrlenW (lpString=".docx") returned 5 [0093.994] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0093.994] lstrlenW (lpString=".pdf") returned 4 [0093.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.994] lstrlenW (lpString=".xls") returned 4 [0093.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.994] lstrlenW (lpString=".xlsx") returned 5 [0093.994] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0093.994] lstrlenW (lpString=".ppt") returned 4 [0093.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.994] lstrlenW (lpString=".zip") returned 4 [0093.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.994] lstrlenW (lpString=".rar") returned 4 [0093.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.994] lstrlenW (lpString=".bz2") returned 4 [0093.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.995] lstrlenW (lpString=".7z") returned 3 [0093.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.995] lstrlenW (lpString=".dbf") returned 4 [0093.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.995] lstrlenW (lpString=".1cd") returned 4 [0093.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0093.995] lstrlenW (lpString=".jpg") returned 4 [0093.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.995] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") [0093.995] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=42254) returned 1 [0093.995] CloseHandle (hObject=0x16c) returned 1 [0093.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 0x20 [0093.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0093.996] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.996] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.996] GetLastError () returned 0x0 [0093.996] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa50e, lpOverlapped=0x0) returned 1 [0093.998] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa510, lpOverlapped=0x0) returned 1 [0094.000] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.000] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.000] SetEndOfFile (hFile=0x1ec) returned 1 [0094.000] CloseHandle (hObject=0x1ec) returned 1 [0094.000] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.000] SetEndOfFile (hFile=0x16c) returned 1 [0094.001] CloseHandle (hObject=0x16c) returned 1 [0094.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0094.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.002] lstrlenW (lpString=".doc") returned 4 [0094.002] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0094.002] lstrlenW (lpString=".docx") returned 5 [0094.002] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0094.002] lstrlenW (lpString=".pdf") returned 4 [0094.002] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0094.002] lstrlenW (lpString=".xls") returned 4 [0094.002] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0094.002] lstrlenW (lpString=".xlsx") returned 5 [0094.002] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0094.002] lstrlenW (lpString=".ppt") returned 4 [0094.002] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0094.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.002] lstrlenW (lpString=".zip") returned 4 [0094.002] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0094.002] lstrlenW (lpString=".rar") returned 4 [0094.002] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0094.002] lstrlenW (lpString=".bz2") returned 4 [0094.002] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0094.002] lstrlenW (lpString=".7z") returned 3 [0094.002] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0094.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.002] lstrlenW (lpString=".dbf") returned 4 [0094.003] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0094.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.003] lstrlenW (lpString=".1cd") returned 4 [0094.003] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0094.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0094.003] lstrlenW (lpString=".jpg") returned 4 [0094.003] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0094.003] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") [0094.003] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=28276) returned 1 [0094.003] CloseHandle (hObject=0x16c) returned 1 [0094.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 0x20 [0094.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.004] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.004] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.004] GetLastError () returned 0x0 [0094.004] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6e74, lpOverlapped=0x0) returned 1 [0094.006] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6e80, lpOverlapped=0x0) returned 1 [0094.007] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.007] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.007] SetEndOfFile (hFile=0x1ec) returned 1 [0094.008] CloseHandle (hObject=0x1ec) returned 1 [0094.008] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.008] SetEndOfFile (hFile=0x16c) returned 1 [0094.009] CloseHandle (hObject=0x16c) returned 1 [0094.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 1 [0094.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.009] lstrlenW (lpString=".doc") returned 4 [0094.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.009] lstrlenW (lpString=".docx") returned 5 [0094.009] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.009] lstrlenW (lpString=".pdf") returned 4 [0094.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.009] lstrlenW (lpString=".xls") returned 4 [0094.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.009] lstrlenW (lpString=".xlsx") returned 5 [0094.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.009] lstrlenW (lpString=".ppt") returned 4 [0094.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.009] lstrlenW (lpString=".zip") returned 4 [0094.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.010] lstrlenW (lpString=".rar") returned 4 [0094.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".bz2") returned 4 [0094.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".7z") returned 3 [0094.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.010] lstrlenW (lpString=".dbf") returned 4 [0094.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.010] lstrlenW (lpString=".1cd") returned 4 [0094.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0094.010] lstrlenW (lpString=".jpg") returned 4 [0094.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.010] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") [0094.011] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6158) returned 1 [0094.011] CloseHandle (hObject=0x16c) returned 1 [0094.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 0x20 [0094.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.012] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.012] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.012] GetLastError () returned 0x0 [0094.012] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x180e, lpOverlapped=0x0) returned 1 [0094.199] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1810, lpOverlapped=0x0) returned 1 [0094.200] ReadFile (in: hFile=0x16c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.200] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.200] SetEndOfFile (hFile=0x1ec) returned 1 [0094.200] CloseHandle (hObject=0x1ec) returned 1 [0094.200] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.200] SetEndOfFile (hFile=0x16c) returned 1 [0094.201] CloseHandle (hObject=0x16c) returned 1 [0094.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0094.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.201] lstrlenW (lpString=".doc") returned 4 [0094.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString=".docx") returned 5 [0094.202] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0094.202] lstrlenW (lpString=".pdf") returned 4 [0094.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString=".xls") returned 4 [0094.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.202] lstrlenW (lpString=".xlsx") returned 5 [0094.202] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0094.202] lstrlenW (lpString=".ppt") returned 4 [0094.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.202] lstrlenW (lpString=".zip") returned 4 [0094.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.202] lstrlenW (lpString=".rar") returned 4 [0094.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString=".bz2") returned 4 [0094.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString=".7z") returned 3 [0094.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.202] lstrlenW (lpString=".dbf") returned 4 [0094.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.202] lstrlenW (lpString=".1cd") returned 4 [0094.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0094.202] lstrlenW (lpString=".jpg") returned 4 [0094.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.202] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") [0094.470] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21620) returned 1 [0094.470] CloseHandle (hObject=0x22c) returned 1 [0094.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 0x20 [0094.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0094.472] GetLastError () returned 0x0 [0094.472] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5474, lpOverlapped=0x0) returned 1 [0094.547] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5480, lpOverlapped=0x0) returned 1 [0094.548] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.548] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.548] SetEndOfFile (hFile=0x180) returned 1 [0094.549] CloseHandle (hObject=0x180) returned 1 [0094.549] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.549] SetEndOfFile (hFile=0x22c) returned 1 [0094.550] CloseHandle (hObject=0x22c) returned 1 [0094.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0094.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.550] lstrlenW (lpString=".doc") returned 4 [0094.550] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0094.550] lstrlenW (lpString=".docx") returned 5 [0094.550] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0094.550] lstrlenW (lpString=".pdf") returned 4 [0094.550] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0094.550] lstrlenW (lpString=".xls") returned 4 [0094.550] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0094.550] lstrlenW (lpString=".xlsx") returned 5 [0094.550] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0094.550] lstrlenW (lpString=".ppt") returned 4 [0094.550] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0094.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.551] lstrlenW (lpString=".zip") returned 4 [0094.551] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0094.551] lstrlenW (lpString=".rar") returned 4 [0094.551] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0094.551] lstrlenW (lpString=".bz2") returned 4 [0094.551] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0094.551] lstrlenW (lpString=".7z") returned 3 [0094.551] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0094.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.551] lstrlenW (lpString=".dbf") returned 4 [0094.551] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0094.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.551] lstrlenW (lpString=".1cd") returned 4 [0094.551] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0094.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0094.551] lstrlenW (lpString=".jpg") returned 4 [0094.551] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0094.551] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") [0094.583] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=58089) returned 1 [0094.583] CloseHandle (hObject=0x22c) returned 1 [0094.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 0x20 [0094.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.583] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.583] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.592] GetLastError () returned 0x0 [0094.592] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe2e9, lpOverlapped=0x0) returned 1 [0094.595] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe2f0, lpOverlapped=0x0) returned 1 [0094.597] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.597] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.597] SetEndOfFile (hFile=0x15c) returned 1 [0094.597] CloseHandle (hObject=0x15c) returned 1 [0094.597] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.597] SetEndOfFile (hFile=0x22c) returned 1 [0094.598] CloseHandle (hObject=0x22c) returned 1 [0094.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 1 [0094.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.599] lstrlenW (lpString=".doc") returned 4 [0094.599] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0094.599] lstrlenW (lpString=".docx") returned 5 [0094.599] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0094.599] lstrlenW (lpString=".pdf") returned 4 [0094.599] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0094.599] lstrlenW (lpString=".xls") returned 4 [0094.599] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0094.599] lstrlenW (lpString=".xlsx") returned 5 [0094.599] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0094.599] lstrlenW (lpString=".ppt") returned 4 [0094.599] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0094.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.599] lstrlenW (lpString=".zip") returned 4 [0094.599] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0094.599] lstrlenW (lpString=".rar") returned 4 [0094.599] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0094.599] lstrlenW (lpString=".bz2") returned 4 [0094.599] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0094.599] lstrlenW (lpString=".7z") returned 3 [0094.599] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0094.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.599] lstrlenW (lpString=".dbf") returned 4 [0094.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0094.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.600] lstrlenW (lpString=".1cd") returned 4 [0094.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0094.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0094.600] lstrlenW (lpString=".jpg") returned 4 [0094.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0094.600] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") [0094.600] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4198) returned 1 [0094.600] CloseHandle (hObject=0x22c) returned 1 [0094.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 0x20 [0094.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.601] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.601] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.601] GetLastError () returned 0x0 [0094.601] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1066, lpOverlapped=0x0) returned 1 [0094.603] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0094.604] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.604] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.604] SetEndOfFile (hFile=0x15c) returned 1 [0094.604] CloseHandle (hObject=0x15c) returned 1 [0094.604] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.604] SetEndOfFile (hFile=0x22c) returned 1 [0094.605] CloseHandle (hObject=0x22c) returned 1 [0094.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 1 [0094.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.606] lstrlenW (lpString=".doc") returned 4 [0094.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString=".docx") returned 5 [0094.606] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.606] lstrlenW (lpString=".pdf") returned 4 [0094.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString=".xls") returned 4 [0094.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.606] lstrlenW (lpString=".xlsx") returned 5 [0094.606] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.606] lstrlenW (lpString=".ppt") returned 4 [0094.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.606] lstrlenW (lpString=".zip") returned 4 [0094.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.606] lstrlenW (lpString=".rar") returned 4 [0094.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString=".bz2") returned 4 [0094.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString=".7z") returned 3 [0094.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.606] lstrlenW (lpString=".dbf") returned 4 [0094.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.606] lstrlenW (lpString=".1cd") returned 4 [0094.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0094.607] lstrlenW (lpString=".jpg") returned 4 [0094.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.607] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") [0094.607] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=13098) returned 1 [0094.607] CloseHandle (hObject=0x22c) returned 1 [0094.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 0x20 [0094.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.607] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.608] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.608] GetLastError () returned 0x0 [0094.608] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x332a, lpOverlapped=0x0) returned 1 [0094.610] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0094.611] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.611] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.611] SetEndOfFile (hFile=0x15c) returned 1 [0094.611] CloseHandle (hObject=0x15c) returned 1 [0094.611] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.611] SetEndOfFile (hFile=0x22c) returned 1 [0094.612] CloseHandle (hObject=0x22c) returned 1 [0094.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 1 [0094.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.613] lstrlenW (lpString=".doc") returned 4 [0094.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString=".docx") returned 5 [0094.613] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.613] lstrlenW (lpString=".pdf") returned 4 [0094.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString=".xls") returned 4 [0094.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.613] lstrlenW (lpString=".xlsx") returned 5 [0094.613] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.613] lstrlenW (lpString=".ppt") returned 4 [0094.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.613] lstrlenW (lpString=".zip") returned 4 [0094.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.613] lstrlenW (lpString=".rar") returned 4 [0094.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString=".bz2") returned 4 [0094.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString=".7z") returned 3 [0094.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.613] lstrlenW (lpString=".dbf") returned 4 [0094.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.613] lstrlenW (lpString=".1cd") returned 4 [0094.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0094.614] lstrlenW (lpString=".jpg") returned 4 [0094.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.614] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") [0094.614] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27586) returned 1 [0094.614] CloseHandle (hObject=0x22c) returned 1 [0094.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 0x20 [0094.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.615] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.615] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.615] GetLastError () returned 0x0 [0094.615] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6bc2, lpOverlapped=0x0) returned 1 [0094.807] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6bd0, lpOverlapped=0x0) returned 1 [0094.817] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.817] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.817] SetEndOfFile (hFile=0x15c) returned 1 [0094.817] CloseHandle (hObject=0x15c) returned 1 [0094.817] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.817] SetEndOfFile (hFile=0x22c) returned 1 [0094.818] CloseHandle (hObject=0x22c) returned 1 [0094.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 1 [0094.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.818] lstrlenW (lpString=".doc") returned 4 [0094.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.818] lstrlenW (lpString=".docx") returned 5 [0094.818] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0094.818] lstrlenW (lpString=".pdf") returned 4 [0094.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.818] lstrlenW (lpString=".xls") returned 4 [0094.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.818] lstrlenW (lpString=".xlsx") returned 5 [0094.819] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0094.819] lstrlenW (lpString=".ppt") returned 4 [0094.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.819] lstrlenW (lpString=".zip") returned 4 [0094.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.819] lstrlenW (lpString=".rar") returned 4 [0094.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.819] lstrlenW (lpString=".bz2") returned 4 [0094.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.819] lstrlenW (lpString=".7z") returned 3 [0094.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.819] lstrlenW (lpString=".dbf") returned 4 [0094.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.819] lstrlenW (lpString=".1cd") returned 4 [0094.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0094.819] lstrlenW (lpString=".jpg") returned 4 [0094.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.819] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") [0094.820] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19264) returned 1 [0094.820] CloseHandle (hObject=0x22c) returned 1 [0094.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 0x20 [0094.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.820] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.820] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.821] GetLastError () returned 0x0 [0094.821] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4b40, lpOverlapped=0x0) returned 1 [0094.822] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4b50, lpOverlapped=0x0) returned 1 [0094.824] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.824] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.824] SetEndOfFile (hFile=0x15c) returned 1 [0094.824] CloseHandle (hObject=0x15c) returned 1 [0094.824] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.824] SetEndOfFile (hFile=0x22c) returned 1 [0094.825] CloseHandle (hObject=0x22c) returned 1 [0094.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 1 [0094.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.825] lstrlenW (lpString=".doc") returned 4 [0094.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.825] lstrlenW (lpString=".docx") returned 5 [0094.825] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0094.825] lstrlenW (lpString=".pdf") returned 4 [0094.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.825] lstrlenW (lpString=".xls") returned 4 [0094.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.825] lstrlenW (lpString=".xlsx") returned 5 [0094.825] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0094.825] lstrlenW (lpString=".ppt") returned 4 [0094.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.826] lstrlenW (lpString=".zip") returned 4 [0094.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.826] lstrlenW (lpString=".rar") returned 4 [0094.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.826] lstrlenW (lpString=".bz2") returned 4 [0094.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.826] lstrlenW (lpString=".7z") returned 3 [0094.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.826] lstrlenW (lpString=".dbf") returned 4 [0094.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.826] lstrlenW (lpString=".1cd") returned 4 [0094.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 63 [0094.826] lstrlenW (lpString=".jpg") returned 4 [0094.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.826] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") [0094.827] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32980) returned 1 [0094.827] CloseHandle (hObject=0x22c) returned 1 [0094.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 0x20 [0094.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.828] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.828] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.828] GetLastError () returned 0x0 [0094.828] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x80d4, lpOverlapped=0x0) returned 1 [0094.830] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x80e0, lpOverlapped=0x0) returned 1 [0094.832] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.832] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.832] SetEndOfFile (hFile=0x15c) returned 1 [0094.832] CloseHandle (hObject=0x15c) returned 1 [0094.832] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.832] SetEndOfFile (hFile=0x22c) returned 1 [0094.833] CloseHandle (hObject=0x22c) returned 1 [0094.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 1 [0094.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString=".doc") returned 4 [0094.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString=".docx") returned 5 [0094.834] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0094.834] lstrlenW (lpString=".pdf") returned 4 [0094.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString=".xls") returned 4 [0094.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.834] lstrlenW (lpString=".xlsx") returned 5 [0094.834] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0094.834] lstrlenW (lpString=".ppt") returned 4 [0094.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString=".zip") returned 4 [0094.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.834] lstrlenW (lpString=".rar") returned 4 [0094.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString=".bz2") returned 4 [0094.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString=".7z") returned 3 [0094.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString=".dbf") returned 4 [0094.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString=".1cd") returned 4 [0094.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 63 [0094.834] lstrlenW (lpString=".jpg") returned 4 [0094.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.834] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") [0094.835] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=52128) returned 1 [0094.835] CloseHandle (hObject=0x22c) returned 1 [0094.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 0x20 [0094.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.835] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.835] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.838] GetLastError () returned 0x0 [0094.838] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xcba0, lpOverlapped=0x0) returned 1 [0094.841] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xcbb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xcbb0, lpOverlapped=0x0) returned 1 [0094.842] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.843] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.843] SetEndOfFile (hFile=0x15c) returned 1 [0094.843] CloseHandle (hObject=0x15c) returned 1 [0094.843] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.843] SetEndOfFile (hFile=0x22c) returned 1 [0094.844] CloseHandle (hObject=0x22c) returned 1 [0094.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 1 [0094.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.845] lstrlenW (lpString=".doc") returned 4 [0094.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString=".docx") returned 5 [0094.845] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0094.845] lstrlenW (lpString=".pdf") returned 4 [0094.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString=".xls") returned 4 [0094.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.845] lstrlenW (lpString=".xlsx") returned 5 [0094.845] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0094.845] lstrlenW (lpString=".ppt") returned 4 [0094.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.845] lstrlenW (lpString=".zip") returned 4 [0094.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.845] lstrlenW (lpString=".rar") returned 4 [0094.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString=".bz2") returned 4 [0094.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString=".7z") returned 3 [0094.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.845] lstrlenW (lpString=".dbf") returned 4 [0094.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.845] lstrlenW (lpString=".1cd") returned 4 [0094.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 63 [0094.845] lstrlenW (lpString=".jpg") returned 4 [0094.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.845] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") [0094.846] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=22272) returned 1 [0094.846] CloseHandle (hObject=0x22c) returned 1 [0094.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 0x20 [0094.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.846] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.846] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0094.847] GetLastError () returned 0x0 [0094.847] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5700, lpOverlapped=0x0) returned 1 [0094.856] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5710, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5710, lpOverlapped=0x0) returned 1 [0094.857] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.857] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.858] SetEndOfFile (hFile=0x15c) returned 1 [0094.858] CloseHandle (hObject=0x15c) returned 1 [0094.858] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.858] SetEndOfFile (hFile=0x22c) returned 1 [0094.973] CloseHandle (hObject=0x22c) returned 1 [0094.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 1 [0094.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0094.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0094.981] lstrlenW (lpString=".doc") returned 4 [0094.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.981] lstrlenW (lpString=".docx") returned 5 [0094.981] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.981] lstrlenW (lpString=".pdf") returned 4 [0094.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.987] lstrlenW (lpString=".xls") returned 4 [0094.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.988] lstrlenW (lpString=".xlsx") returned 5 [0094.988] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.988] lstrlenW (lpString=".ppt") returned 4 [0094.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0094.988] lstrlenW (lpString=".zip") returned 4 [0094.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.994] lstrlenW (lpString=".rar") returned 4 [0094.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.994] lstrlenW (lpString=".bz2") returned 4 [0094.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.994] lstrlenW (lpString=".7z") returned 3 [0094.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0095.001] lstrlenW (lpString=".dbf") returned 4 [0095.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0095.001] lstrlenW (lpString=".1cd") returned 4 [0095.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 63 [0095.001] lstrlenW (lpString=".jpg") returned 4 [0095.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.001] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") [0095.002] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7112) returned 1 [0095.002] CloseHandle (hObject=0x22c) returned 1 [0095.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 0x20 [0095.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.002] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.002] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.003] GetLastError () returned 0x0 [0095.003] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1bc8, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0095.005] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.005] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.005] SetEndOfFile (hFile=0x19c) returned 1 [0095.005] CloseHandle (hObject=0x19c) returned 1 [0095.006] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.006] SetEndOfFile (hFile=0x22c) returned 1 [0095.006] CloseHandle (hObject=0x22c) returned 1 [0095.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 1 [0095.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.007] lstrlenW (lpString=".doc") returned 4 [0095.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString=".docx") returned 5 [0095.007] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0095.007] lstrlenW (lpString=".pdf") returned 4 [0095.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString=".xls") returned 4 [0095.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.007] lstrlenW (lpString=".xlsx") returned 5 [0095.007] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0095.007] lstrlenW (lpString=".ppt") returned 4 [0095.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.007] lstrlenW (lpString=".zip") returned 4 [0095.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.007] lstrlenW (lpString=".rar") returned 4 [0095.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString=".bz2") returned 4 [0095.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString=".7z") returned 3 [0095.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.007] lstrlenW (lpString=".dbf") returned 4 [0095.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.007] lstrlenW (lpString=".1cd") returned 4 [0095.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 63 [0095.008] lstrlenW (lpString=".jpg") returned 4 [0095.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.008] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") [0095.009] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4936) returned 1 [0095.009] CloseHandle (hObject=0x22c) returned 1 [0095.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 0x20 [0095.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.009] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.009] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.010] GetLastError () returned 0x0 [0095.010] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1348, lpOverlapped=0x0) returned 1 [0095.011] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1350, lpOverlapped=0x0) returned 1 [0095.012] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.012] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.012] SetEndOfFile (hFile=0x19c) returned 1 [0095.012] CloseHandle (hObject=0x19c) returned 1 [0095.012] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.012] SetEndOfFile (hFile=0x22c) returned 1 [0095.013] CloseHandle (hObject=0x22c) returned 1 [0095.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 1 [0095.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString=".doc") returned 4 [0095.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString=".docx") returned 5 [0095.014] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0095.014] lstrlenW (lpString=".pdf") returned 4 [0095.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString=".xls") returned 4 [0095.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.014] lstrlenW (lpString=".xlsx") returned 5 [0095.014] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0095.014] lstrlenW (lpString=".ppt") returned 4 [0095.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString=".zip") returned 4 [0095.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.014] lstrlenW (lpString=".rar") returned 4 [0095.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString=".bz2") returned 4 [0095.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString=".7z") returned 3 [0095.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString=".dbf") returned 4 [0095.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString=".1cd") returned 4 [0095.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 63 [0095.014] lstrlenW (lpString=".jpg") returned 4 [0095.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.014] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") [0095.015] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5920) returned 1 [0095.015] CloseHandle (hObject=0x22c) returned 1 [0095.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 0x20 [0095.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.015] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.015] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.016] GetLastError () returned 0x0 [0095.016] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1720, lpOverlapped=0x0) returned 1 [0095.017] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1730, lpOverlapped=0x0) returned 1 [0095.018] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.018] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.019] SetEndOfFile (hFile=0x19c) returned 1 [0095.019] CloseHandle (hObject=0x19c) returned 1 [0095.019] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.019] SetEndOfFile (hFile=0x22c) returned 1 [0095.019] CloseHandle (hObject=0x22c) returned 1 [0095.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 1 [0095.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.020] lstrlenW (lpString=".doc") returned 4 [0095.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.020] lstrlenW (lpString=".docx") returned 5 [0095.020] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0095.020] lstrlenW (lpString=".pdf") returned 4 [0095.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.020] lstrlenW (lpString=".xls") returned 4 [0095.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.020] lstrlenW (lpString=".xlsx") returned 5 [0095.020] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0095.020] lstrlenW (lpString=".ppt") returned 4 [0095.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.020] lstrlenW (lpString=".zip") returned 4 [0095.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.020] lstrlenW (lpString=".rar") returned 4 [0095.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.020] lstrlenW (lpString=".bz2") returned 4 [0095.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.021] lstrlenW (lpString=".7z") returned 3 [0095.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.021] lstrlenW (lpString=".dbf") returned 4 [0095.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.021] lstrlenW (lpString=".1cd") returned 4 [0095.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 63 [0095.021] lstrlenW (lpString=".jpg") returned 4 [0095.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.021] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") [0095.021] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5452) returned 1 [0095.021] CloseHandle (hObject=0x22c) returned 1 [0095.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 0x20 [0095.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.022] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.022] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.022] GetLastError () returned 0x0 [0095.022] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x154c, lpOverlapped=0x0) returned 1 [0095.024] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0095.025] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.025] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.025] SetEndOfFile (hFile=0x19c) returned 1 [0095.025] CloseHandle (hObject=0x19c) returned 1 [0095.025] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.025] SetEndOfFile (hFile=0x22c) returned 1 [0095.026] CloseHandle (hObject=0x22c) returned 1 [0095.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 1 [0095.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.026] lstrlenW (lpString=".doc") returned 4 [0095.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.026] lstrlenW (lpString=".docx") returned 5 [0095.026] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0095.026] lstrlenW (lpString=".pdf") returned 4 [0095.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.026] lstrlenW (lpString=".xls") returned 4 [0095.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.027] lstrlenW (lpString=".xlsx") returned 5 [0095.027] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0095.027] lstrlenW (lpString=".ppt") returned 4 [0095.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.027] lstrlenW (lpString=".zip") returned 4 [0095.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.027] lstrlenW (lpString=".rar") returned 4 [0095.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.027] lstrlenW (lpString=".bz2") returned 4 [0095.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.027] lstrlenW (lpString=".7z") returned 3 [0095.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.027] lstrlenW (lpString=".dbf") returned 4 [0095.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.027] lstrlenW (lpString=".1cd") returned 4 [0095.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 63 [0095.027] lstrlenW (lpString=".jpg") returned 4 [0095.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.027] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") [0095.028] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5096) returned 1 [0095.028] CloseHandle (hObject=0x22c) returned 1 [0095.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 0x20 [0095.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.029] GetLastError () returned 0x0 [0095.029] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x13e8, lpOverlapped=0x0) returned 1 [0095.031] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0095.032] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.032] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.032] SetEndOfFile (hFile=0x19c) returned 1 [0095.032] CloseHandle (hObject=0x19c) returned 1 [0095.032] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.032] SetEndOfFile (hFile=0x22c) returned 1 [0095.033] CloseHandle (hObject=0x22c) returned 1 [0095.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 1 [0095.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.033] lstrlenW (lpString=".doc") returned 4 [0095.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString=".docx") returned 5 [0095.034] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0095.034] lstrlenW (lpString=".pdf") returned 4 [0095.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString=".xls") returned 4 [0095.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.034] lstrlenW (lpString=".xlsx") returned 5 [0095.034] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0095.034] lstrlenW (lpString=".ppt") returned 4 [0095.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.034] lstrlenW (lpString=".zip") returned 4 [0095.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.034] lstrlenW (lpString=".rar") returned 4 [0095.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString=".bz2") returned 4 [0095.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString=".7z") returned 3 [0095.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.034] lstrlenW (lpString=".dbf") returned 4 [0095.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.034] lstrlenW (lpString=".1cd") returned 4 [0095.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 63 [0095.034] lstrlenW (lpString=".jpg") returned 4 [0095.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.034] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") [0095.035] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3488) returned 1 [0095.035] CloseHandle (hObject=0x22c) returned 1 [0095.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 0x20 [0095.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.035] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.035] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.036] GetLastError () returned 0x0 [0095.036] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xda0, lpOverlapped=0x0) returned 1 [0095.117] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0095.118] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.118] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.118] SetEndOfFile (hFile=0x19c) returned 1 [0095.122] CloseHandle (hObject=0x19c) returned 1 [0095.123] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.123] SetEndOfFile (hFile=0x22c) returned 1 [0095.123] CloseHandle (hObject=0x22c) returned 1 [0095.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 1 [0095.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.128] lstrlenW (lpString=".doc") returned 4 [0095.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.128] lstrlenW (lpString=".docx") returned 5 [0095.128] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0095.128] lstrlenW (lpString=".pdf") returned 4 [0095.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.128] lstrlenW (lpString=".xls") returned 4 [0095.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.129] lstrlenW (lpString=".xlsx") returned 5 [0095.129] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0095.129] lstrlenW (lpString=".ppt") returned 4 [0095.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.129] lstrlenW (lpString=".zip") returned 4 [0095.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.129] lstrlenW (lpString=".rar") returned 4 [0095.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.129] lstrlenW (lpString=".bz2") returned 4 [0095.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.129] lstrlenW (lpString=".7z") returned 3 [0095.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.129] lstrlenW (lpString=".dbf") returned 4 [0095.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.129] lstrlenW (lpString=".1cd") returned 4 [0095.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 63 [0095.129] lstrlenW (lpString=".jpg") returned 4 [0095.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.129] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") [0095.299] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31032) returned 1 [0095.301] CloseHandle (hObject=0x158) returned 1 [0095.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 0x20 [0095.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.308] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.308] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.326] GetLastError () returned 0x0 [0095.326] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7938, lpOverlapped=0x0) returned 1 [0095.329] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7940, lpOverlapped=0x0) returned 1 [0095.330] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.330] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.330] SetEndOfFile (hFile=0x1ec) returned 1 [0095.331] CloseHandle (hObject=0x1ec) returned 1 [0095.331] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.331] SetEndOfFile (hFile=0x158) returned 1 [0095.332] CloseHandle (hObject=0x158) returned 1 [0095.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 1 [0095.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.332] lstrlenW (lpString=".doc") returned 4 [0095.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.332] lstrlenW (lpString=".docx") returned 5 [0095.332] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0095.332] lstrlenW (lpString=".pdf") returned 4 [0095.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.332] lstrlenW (lpString=".xls") returned 4 [0095.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.332] lstrlenW (lpString=".xlsx") returned 5 [0095.332] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0095.332] lstrlenW (lpString=".ppt") returned 4 [0095.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.332] lstrlenW (lpString=".zip") returned 4 [0095.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.332] lstrlenW (lpString=".rar") returned 4 [0095.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.332] lstrlenW (lpString=".bz2") returned 4 [0095.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.333] lstrlenW (lpString=".7z") returned 3 [0095.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.333] lstrlenW (lpString=".dbf") returned 4 [0095.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.333] lstrlenW (lpString=".1cd") returned 4 [0095.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 63 [0095.333] lstrlenW (lpString=".jpg") returned 4 [0095.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.333] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") [0095.334] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12764) returned 1 [0095.334] CloseHandle (hObject=0x158) returned 1 [0095.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 0x20 [0095.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.334] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.334] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.335] GetLastError () returned 0x0 [0095.335] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x31dc, lpOverlapped=0x0) returned 1 [0095.337] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0095.338] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.338] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.338] SetEndOfFile (hFile=0x1ec) returned 1 [0095.338] CloseHandle (hObject=0x1ec) returned 1 [0095.338] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.339] SetEndOfFile (hFile=0x158) returned 1 [0095.339] CloseHandle (hObject=0x158) returned 1 [0095.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 1 [0095.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.340] lstrlenW (lpString=".doc") returned 4 [0095.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.340] lstrlenW (lpString=".docx") returned 5 [0095.340] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0095.340] lstrlenW (lpString=".pdf") returned 4 [0095.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.340] lstrlenW (lpString=".xls") returned 4 [0095.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.340] lstrlenW (lpString=".xlsx") returned 5 [0095.340] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0095.340] lstrlenW (lpString=".ppt") returned 4 [0095.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.340] lstrlenW (lpString=".zip") returned 4 [0095.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.340] lstrlenW (lpString=".rar") returned 4 [0095.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.340] lstrlenW (lpString=".bz2") returned 4 [0095.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.340] lstrlenW (lpString=".7z") returned 3 [0095.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.341] lstrlenW (lpString=".dbf") returned 4 [0095.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.341] lstrlenW (lpString=".1cd") returned 4 [0095.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 63 [0095.341] lstrlenW (lpString=".jpg") returned 4 [0095.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.341] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") [0095.341] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14420) returned 1 [0095.341] CloseHandle (hObject=0x158) returned 1 [0095.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 0x20 [0095.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.342] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.342] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.342] GetLastError () returned 0x0 [0095.342] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3854, lpOverlapped=0x0) returned 1 [0095.344] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0095.345] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.345] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.345] SetEndOfFile (hFile=0x1ec) returned 1 [0095.346] CloseHandle (hObject=0x1ec) returned 1 [0095.346] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.346] SetEndOfFile (hFile=0x158) returned 1 [0095.346] CloseHandle (hObject=0x158) returned 1 [0095.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.347] lstrlenW (lpString=".doc") returned 4 [0095.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.347] lstrlenW (lpString=".docx") returned 5 [0095.347] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0095.347] lstrlenW (lpString=".pdf") returned 4 [0095.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.347] lstrlenW (lpString=".xls") returned 4 [0095.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.347] lstrlenW (lpString=".xlsx") returned 5 [0095.347] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0095.347] lstrlenW (lpString=".ppt") returned 4 [0095.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.347] lstrlenW (lpString=".zip") returned 4 [0095.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.347] lstrlenW (lpString=".rar") returned 4 [0095.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.347] lstrlenW (lpString=".bz2") returned 4 [0095.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.347] lstrlenW (lpString=".7z") returned 3 [0095.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.348] lstrlenW (lpString=".dbf") returned 4 [0095.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.348] lstrlenW (lpString=".1cd") returned 4 [0095.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 63 [0095.348] lstrlenW (lpString=".jpg") returned 4 [0095.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.348] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") [0095.348] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11912) returned 1 [0095.348] CloseHandle (hObject=0x158) returned 1 [0095.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 0x20 [0095.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.349] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.349] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.349] GetLastError () returned 0x0 [0095.349] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2e88, lpOverlapped=0x0) returned 1 [0095.351] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2e90, lpOverlapped=0x0) returned 1 [0095.352] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.352] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.353] SetEndOfFile (hFile=0x1ec) returned 1 [0095.353] CloseHandle (hObject=0x1ec) returned 1 [0095.353] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.353] SetEndOfFile (hFile=0x158) returned 1 [0095.354] CloseHandle (hObject=0x158) returned 1 [0095.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 1 [0095.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.354] lstrlenW (lpString=".doc") returned 4 [0095.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.354] lstrlenW (lpString=".docx") returned 5 [0095.354] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.354] lstrlenW (lpString=".pdf") returned 4 [0095.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.354] lstrlenW (lpString=".xls") returned 4 [0095.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.354] lstrlenW (lpString=".xlsx") returned 5 [0095.354] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.354] lstrlenW (lpString=".ppt") returned 4 [0095.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.354] lstrlenW (lpString=".zip") returned 4 [0095.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.354] lstrlenW (lpString=".rar") returned 4 [0095.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.355] lstrlenW (lpString=".bz2") returned 4 [0095.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.355] lstrlenW (lpString=".7z") returned 3 [0095.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.355] lstrlenW (lpString=".dbf") returned 4 [0095.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.355] lstrlenW (lpString=".1cd") returned 4 [0095.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 63 [0095.355] lstrlenW (lpString=".jpg") returned 4 [0095.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.355] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") [0095.355] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12530) returned 1 [0095.355] CloseHandle (hObject=0x158) returned 1 [0095.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 0x20 [0095.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.356] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.356] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.356] GetLastError () returned 0x0 [0095.356] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x30f2, lpOverlapped=0x0) returned 1 [0095.363] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0095.364] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.365] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.365] SetEndOfFile (hFile=0x1ec) returned 1 [0095.365] CloseHandle (hObject=0x1ec) returned 1 [0095.365] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.365] SetEndOfFile (hFile=0x158) returned 1 [0095.366] CloseHandle (hObject=0x158) returned 1 [0095.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 1 [0095.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.366] lstrlenW (lpString=".doc") returned 4 [0095.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.366] lstrlenW (lpString=".docx") returned 5 [0095.366] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0095.366] lstrlenW (lpString=".pdf") returned 4 [0095.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.366] lstrlenW (lpString=".xls") returned 4 [0095.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.366] lstrlenW (lpString=".xlsx") returned 5 [0095.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0095.366] lstrlenW (lpString=".ppt") returned 4 [0095.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.367] lstrlenW (lpString=".zip") returned 4 [0095.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.367] lstrlenW (lpString=".rar") returned 4 [0095.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.367] lstrlenW (lpString=".bz2") returned 4 [0095.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.367] lstrlenW (lpString=".7z") returned 3 [0095.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.367] lstrlenW (lpString=".dbf") returned 4 [0095.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.367] lstrlenW (lpString=".1cd") returned 4 [0095.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 63 [0095.367] lstrlenW (lpString=".jpg") returned 4 [0095.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.367] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") [0095.367] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15518) returned 1 [0095.368] CloseHandle (hObject=0x158) returned 1 [0095.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 0x20 [0095.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0095.368] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.368] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.368] GetLastError () returned 0x0 [0095.369] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c9e, lpOverlapped=0x0) returned 1 [0095.425] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3ca0, lpOverlapped=0x0) returned 1 [0095.426] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.426] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.426] SetEndOfFile (hFile=0x1ec) returned 1 [0095.450] CloseHandle (hObject=0x1ec) returned 1 [0095.450] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.450] SetEndOfFile (hFile=0x158) returned 1 [0095.451] CloseHandle (hObject=0x158) returned 1 [0095.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 1 [0095.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.632] lstrlenW (lpString=".doc") returned 4 [0095.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.632] lstrlenW (lpString=".docx") returned 5 [0095.632] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0095.632] lstrlenW (lpString=".pdf") returned 4 [0095.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.632] lstrlenW (lpString=".xls") returned 4 [0095.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.632] lstrlenW (lpString=".xlsx") returned 5 [0095.632] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0095.633] lstrlenW (lpString=".ppt") returned 4 [0095.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.633] lstrlenW (lpString=".zip") returned 4 [0095.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.633] lstrlenW (lpString=".rar") returned 4 [0095.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.633] lstrlenW (lpString=".bz2") returned 4 [0095.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.633] lstrlenW (lpString=".7z") returned 3 [0095.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.633] lstrlenW (lpString=".dbf") returned 4 [0095.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.633] lstrlenW (lpString=".1cd") returned 4 [0095.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 63 [0095.633] lstrlenW (lpString=".jpg") returned 4 [0095.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.633] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") [0095.751] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=13648) returned 1 [0095.751] CloseHandle (hObject=0x1b8) returned 1 [0095.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 0x20 [0095.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0095.751] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.751] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0095.752] GetLastError () returned 0x0 [0095.752] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3550, lpOverlapped=0x0) returned 1 [0095.824] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3560, lpOverlapped=0x0) returned 1 [0095.825] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.825] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.825] SetEndOfFile (hFile=0x1a0) returned 1 [0095.825] CloseHandle (hObject=0x1a0) returned 1 [0095.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.826] SetEndOfFile (hFile=0x1b8) returned 1 [0095.827] CloseHandle (hObject=0x1b8) returned 1 [0095.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 1 [0095.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.853] lstrlenW (lpString=".doc") returned 4 [0095.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString=".docx") returned 5 [0095.853] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0095.853] lstrlenW (lpString=".pdf") returned 4 [0095.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString=".xls") returned 4 [0095.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.853] lstrlenW (lpString=".xlsx") returned 5 [0095.853] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0095.853] lstrlenW (lpString=".ppt") returned 4 [0095.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.853] lstrlenW (lpString=".zip") returned 4 [0095.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.853] lstrlenW (lpString=".rar") returned 4 [0095.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString=".bz2") returned 4 [0095.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString=".7z") returned 3 [0095.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.853] lstrlenW (lpString=".dbf") returned 4 [0095.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.853] lstrlenW (lpString=".1cd") returned 4 [0095.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 63 [0095.854] lstrlenW (lpString=".jpg") returned 4 [0095.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.854] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") [0095.866] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30872) returned 1 [0095.867] CloseHandle (hObject=0x1c0) returned 1 [0095.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 0x20 [0095.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.867] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.867] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.878] GetLastError () returned 0x0 [0095.878] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7898, lpOverlapped=0x0) returned 1 [0095.888] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x78a0, lpOverlapped=0x0) returned 1 [0095.889] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.889] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.890] SetEndOfFile (hFile=0x1c8) returned 1 [0095.890] CloseHandle (hObject=0x1c8) returned 1 [0095.890] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.890] SetEndOfFile (hFile=0x1c0) returned 1 [0095.891] CloseHandle (hObject=0x1c0) returned 1 [0095.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 1 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.891] lstrlenW (lpString=".doc") returned 4 [0095.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.891] lstrlenW (lpString=".docx") returned 5 [0095.891] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.891] lstrlenW (lpString=".pdf") returned 4 [0095.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.891] lstrlenW (lpString=".xls") returned 4 [0095.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.891] lstrlenW (lpString=".xlsx") returned 5 [0095.891] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.891] lstrlenW (lpString=".ppt") returned 4 [0095.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.892] lstrlenW (lpString=".zip") returned 4 [0095.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.892] lstrlenW (lpString=".rar") returned 4 [0095.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.892] lstrlenW (lpString=".bz2") returned 4 [0095.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.892] lstrlenW (lpString=".7z") returned 3 [0095.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.892] lstrlenW (lpString=".dbf") returned 4 [0095.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.892] lstrlenW (lpString=".1cd") returned 4 [0095.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 63 [0095.892] lstrlenW (lpString=".jpg") returned 4 [0095.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.892] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") [0095.893] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=52496) returned 1 [0095.893] CloseHandle (hObject=0x1c0) returned 1 [0095.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 0x20 [0095.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.893] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.893] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.896] GetLastError () returned 0x0 [0095.896] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xcd10, lpOverlapped=0x0) returned 1 [0095.937] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xcd20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xcd20, lpOverlapped=0x0) returned 1 [0095.938] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.938] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.938] SetEndOfFile (hFile=0x1c8) returned 1 [0095.938] CloseHandle (hObject=0x1c8) returned 1 [0095.938] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.939] SetEndOfFile (hFile=0x1c0) returned 1 [0095.940] CloseHandle (hObject=0x1c0) returned 1 [0095.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 1 [0095.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.940] lstrlenW (lpString=".doc") returned 4 [0095.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.940] lstrlenW (lpString=".docx") returned 5 [0095.940] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0095.940] lstrlenW (lpString=".pdf") returned 4 [0095.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.940] lstrlenW (lpString=".xls") returned 4 [0095.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.940] lstrlenW (lpString=".xlsx") returned 5 [0095.940] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0095.940] lstrlenW (lpString=".ppt") returned 4 [0095.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.940] lstrlenW (lpString=".zip") returned 4 [0095.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.941] lstrlenW (lpString=".rar") returned 4 [0095.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".bz2") returned 4 [0095.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".7z") returned 3 [0095.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.941] lstrlenW (lpString=".dbf") returned 4 [0095.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.941] lstrlenW (lpString=".1cd") returned 4 [0095.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 63 [0095.941] lstrlenW (lpString=".jpg") returned 4 [0095.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.941] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") [0095.941] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=43020) returned 1 [0095.942] CloseHandle (hObject=0x1c0) returned 1 [0095.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 0x20 [0095.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.942] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.942] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.942] GetLastError () returned 0x0 [0095.942] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa80c, lpOverlapped=0x0) returned 1 [0095.949] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa810, lpOverlapped=0x0) returned 1 [0095.950] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.950] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.950] SetEndOfFile (hFile=0x1c8) returned 1 [0095.951] CloseHandle (hObject=0x1c8) returned 1 [0095.951] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.951] SetEndOfFile (hFile=0x1c0) returned 1 [0095.952] CloseHandle (hObject=0x1c0) returned 1 [0095.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 1 [0095.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.952] lstrlenW (lpString=".doc") returned 4 [0095.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.952] lstrlenW (lpString=".docx") returned 5 [0095.952] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0095.952] lstrlenW (lpString=".pdf") returned 4 [0095.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.952] lstrlenW (lpString=".xls") returned 4 [0095.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.952] lstrlenW (lpString=".xlsx") returned 5 [0095.953] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0095.953] lstrlenW (lpString=".ppt") returned 4 [0095.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.953] lstrlenW (lpString=".zip") returned 4 [0095.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.953] lstrlenW (lpString=".rar") returned 4 [0095.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.953] lstrlenW (lpString=".bz2") returned 4 [0095.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.953] lstrlenW (lpString=".7z") returned 3 [0095.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.953] lstrlenW (lpString=".dbf") returned 4 [0095.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.953] lstrlenW (lpString=".1cd") returned 4 [0095.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 63 [0095.953] lstrlenW (lpString=".jpg") returned 4 [0095.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.953] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") [0095.954] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=54972) returned 1 [0095.954] CloseHandle (hObject=0x1c0) returned 1 [0095.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 0x20 [0095.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0095.954] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.954] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.955] GetLastError () returned 0x0 [0095.955] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd6bc, lpOverlapped=0x0) returned 1 [0096.031] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd6c0, lpOverlapped=0x0) returned 1 [0096.033] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.033] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.033] SetEndOfFile (hFile=0x1c8) returned 1 [0096.095] CloseHandle (hObject=0x1c8) returned 1 [0096.095] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.095] SetEndOfFile (hFile=0x1c0) returned 1 [0096.096] CloseHandle (hObject=0x1c0) returned 1 [0096.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 1 [0096.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.281] lstrlenW (lpString=".doc") returned 4 [0096.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.281] lstrlenW (lpString=".docx") returned 5 [0096.281] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0096.281] lstrlenW (lpString=".pdf") returned 4 [0096.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.281] lstrlenW (lpString=".xls") returned 4 [0096.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.296] lstrlenW (lpString=".xlsx") returned 5 [0096.296] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0096.296] lstrlenW (lpString=".ppt") returned 4 [0096.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.296] lstrlenW (lpString=".zip") returned 4 [0096.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.296] lstrlenW (lpString=".rar") returned 4 [0096.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.296] lstrlenW (lpString=".bz2") returned 4 [0096.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.303] lstrlenW (lpString=".7z") returned 3 [0096.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.303] lstrlenW (lpString=".dbf") returned 4 [0096.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.303] lstrlenW (lpString=".1cd") returned 4 [0096.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 63 [0096.310] lstrlenW (lpString=".jpg") returned 4 [0096.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.310] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") [0096.310] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6078) returned 1 [0096.310] CloseHandle (hObject=0x180) returned 1 [0096.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 0x20 [0096.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.311] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.311] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.311] GetLastError () returned 0x0 [0096.311] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x17be, lpOverlapped=0x0) returned 1 [0096.313] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0096.314] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.314] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.314] SetEndOfFile (hFile=0x15c) returned 1 [0096.314] CloseHandle (hObject=0x15c) returned 1 [0096.314] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.314] SetEndOfFile (hFile=0x180) returned 1 [0096.315] CloseHandle (hObject=0x180) returned 1 [0096.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 1 [0096.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.316] lstrlenW (lpString=".doc") returned 4 [0096.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString=".docx") returned 5 [0096.316] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0096.316] lstrlenW (lpString=".pdf") returned 4 [0096.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString=".xls") returned 4 [0096.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.316] lstrlenW (lpString=".xlsx") returned 5 [0096.316] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0096.316] lstrlenW (lpString=".ppt") returned 4 [0096.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.316] lstrlenW (lpString=".zip") returned 4 [0096.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.316] lstrlenW (lpString=".rar") returned 4 [0096.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString=".bz2") returned 4 [0096.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString=".7z") returned 3 [0096.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.316] lstrlenW (lpString=".dbf") returned 4 [0096.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.316] lstrlenW (lpString=".1cd") returned 4 [0096.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 63 [0096.317] lstrlenW (lpString=".jpg") returned 4 [0096.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.317] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") [0096.318] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14302) returned 1 [0096.318] CloseHandle (hObject=0x180) returned 1 [0096.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 0x20 [0096.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.318] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.318] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.319] GetLastError () returned 0x0 [0096.319] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x37de, lpOverlapped=0x0) returned 1 [0096.320] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x37e0, lpOverlapped=0x0) returned 1 [0096.322] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.322] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.322] SetEndOfFile (hFile=0x15c) returned 1 [0096.322] CloseHandle (hObject=0x15c) returned 1 [0096.322] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.322] SetEndOfFile (hFile=0x180) returned 1 [0096.323] CloseHandle (hObject=0x180) returned 1 [0096.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 1 [0096.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.323] lstrlenW (lpString=".doc") returned 4 [0096.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.323] lstrlenW (lpString=".docx") returned 5 [0096.323] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0096.323] lstrlenW (lpString=".pdf") returned 4 [0096.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.323] lstrlenW (lpString=".xls") returned 4 [0096.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.323] lstrlenW (lpString=".xlsx") returned 5 [0096.324] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0096.324] lstrlenW (lpString=".ppt") returned 4 [0096.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.324] lstrlenW (lpString=".zip") returned 4 [0096.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.324] lstrlenW (lpString=".rar") returned 4 [0096.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.324] lstrlenW (lpString=".bz2") returned 4 [0096.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.324] lstrlenW (lpString=".7z") returned 3 [0096.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.324] lstrlenW (lpString=".dbf") returned 4 [0096.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.324] lstrlenW (lpString=".1cd") returned 4 [0096.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 63 [0096.324] lstrlenW (lpString=".jpg") returned 4 [0096.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.324] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") [0096.325] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24960) returned 1 [0096.325] CloseHandle (hObject=0x180) returned 1 [0096.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 0x20 [0096.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.325] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.325] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.326] GetLastError () returned 0x0 [0096.326] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6180, lpOverlapped=0x0) returned 1 [0096.328] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0096.329] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.329] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.330] SetEndOfFile (hFile=0x15c) returned 1 [0096.330] CloseHandle (hObject=0x15c) returned 1 [0096.330] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.330] SetEndOfFile (hFile=0x180) returned 1 [0096.331] CloseHandle (hObject=0x180) returned 1 [0096.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 1 [0096.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.333] lstrlenW (lpString=".doc") returned 4 [0096.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString=".docx") returned 5 [0096.333] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0096.333] lstrlenW (lpString=".pdf") returned 4 [0096.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString=".xls") returned 4 [0096.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.333] lstrlenW (lpString=".xlsx") returned 5 [0096.333] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0096.333] lstrlenW (lpString=".ppt") returned 4 [0096.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.333] lstrlenW (lpString=".zip") returned 4 [0096.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.333] lstrlenW (lpString=".rar") returned 4 [0096.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString=".bz2") returned 4 [0096.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString=".7z") returned 3 [0096.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.333] lstrlenW (lpString=".dbf") returned 4 [0096.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.333] lstrlenW (lpString=".1cd") returned 4 [0096.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 63 [0096.334] lstrlenW (lpString=".jpg") returned 4 [0096.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.334] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") [0096.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8626) returned 1 [0096.335] CloseHandle (hObject=0x180) returned 1 [0096.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 0x20 [0096.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.336] GetLastError () returned 0x0 [0096.336] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x21b2, lpOverlapped=0x0) returned 1 [0096.338] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x21c0, lpOverlapped=0x0) returned 1 [0096.339] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.339] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.339] SetEndOfFile (hFile=0x15c) returned 1 [0096.339] CloseHandle (hObject=0x15c) returned 1 [0096.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.339] SetEndOfFile (hFile=0x180) returned 1 [0096.340] CloseHandle (hObject=0x180) returned 1 [0096.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 1 [0096.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.340] lstrlenW (lpString=".doc") returned 4 [0096.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString=".docx") returned 5 [0096.341] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0096.341] lstrlenW (lpString=".pdf") returned 4 [0096.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString=".xls") returned 4 [0096.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.341] lstrlenW (lpString=".xlsx") returned 5 [0096.341] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0096.341] lstrlenW (lpString=".ppt") returned 4 [0096.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.341] lstrlenW (lpString=".zip") returned 4 [0096.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.341] lstrlenW (lpString=".rar") returned 4 [0096.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString=".bz2") returned 4 [0096.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString=".7z") returned 3 [0096.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.341] lstrlenW (lpString=".dbf") returned 4 [0096.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.341] lstrlenW (lpString=".1cd") returned 4 [0096.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 63 [0096.341] lstrlenW (lpString=".jpg") returned 4 [0096.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.342] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") [0096.342] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=58412) returned 1 [0096.342] CloseHandle (hObject=0x180) returned 1 [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 0x20 [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.343] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.343] GetLastError () returned 0x0 [0096.343] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe42c, lpOverlapped=0x0) returned 1 [0096.502] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe430, lpOverlapped=0x0) returned 1 [0096.504] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.504] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.504] SetEndOfFile (hFile=0x15c) returned 1 [0096.504] CloseHandle (hObject=0x15c) returned 1 [0096.504] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.504] SetEndOfFile (hFile=0x180) returned 1 [0096.506] CloseHandle (hObject=0x180) returned 1 [0096.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 1 [0096.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.506] lstrlenW (lpString=".doc") returned 4 [0096.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.506] lstrlenW (lpString=".docx") returned 5 [0096.506] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0096.506] lstrlenW (lpString=".pdf") returned 4 [0096.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.506] lstrlenW (lpString=".xls") returned 4 [0096.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.506] lstrlenW (lpString=".xlsx") returned 5 [0096.506] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0096.506] lstrlenW (lpString=".ppt") returned 4 [0096.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.506] lstrlenW (lpString=".zip") returned 4 [0096.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.506] lstrlenW (lpString=".rar") returned 4 [0096.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.507] lstrlenW (lpString=".bz2") returned 4 [0096.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.507] lstrlenW (lpString=".7z") returned 3 [0096.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.507] lstrlenW (lpString=".dbf") returned 4 [0096.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.507] lstrlenW (lpString=".1cd") returned 4 [0096.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 63 [0096.507] lstrlenW (lpString=".jpg") returned 4 [0096.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.507] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") [0096.624] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=67726) returned 1 [0096.624] CloseHandle (hObject=0x180) returned 1 [0096.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 0x20 [0096.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0096.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0096.625] GetLastError () returned 0x0 [0096.625] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1088e, lpOverlapped=0x0) returned 1 [0096.637] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10890, lpOverlapped=0x0) returned 1 [0096.639] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.639] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.639] SetEndOfFile (hFile=0x15c) returned 1 [0096.639] CloseHandle (hObject=0x15c) returned 1 [0096.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.639] SetEndOfFile (hFile=0x180) returned 1 [0096.640] CloseHandle (hObject=0x180) returned 1 [0096.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 1 [0096.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.915] lstrlenW (lpString=".doc") returned 4 [0096.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.915] lstrlenW (lpString=".docx") returned 5 [0096.915] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0096.915] lstrlenW (lpString=".pdf") returned 4 [0096.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.915] lstrlenW (lpString=".xls") returned 4 [0096.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.915] lstrlenW (lpString=".xlsx") returned 5 [0096.915] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0096.915] lstrlenW (lpString=".ppt") returned 4 [0096.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.916] lstrlenW (lpString=".zip") returned 4 [0096.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.916] lstrlenW (lpString=".rar") returned 4 [0096.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString=".bz2") returned 4 [0096.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString=".7z") returned 3 [0096.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.916] lstrlenW (lpString=".dbf") returned 4 [0096.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.916] lstrlenW (lpString=".1cd") returned 4 [0096.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 63 [0096.916] lstrlenW (lpString=".jpg") returned 4 [0096.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.916] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") [0097.118] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17796) returned 1 [0097.118] CloseHandle (hObject=0x1ec) returned 1 [0097.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 0x20 [0097.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0097.119] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.119] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0097.122] GetLastError () returned 0x0 [0097.122] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4584, lpOverlapped=0x0) returned 1 [0097.223] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4590, lpOverlapped=0x0) returned 1 [0097.224] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.224] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.224] SetEndOfFile (hFile=0x1b8) returned 1 [0097.224] CloseHandle (hObject=0x1b8) returned 1 [0097.224] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.224] SetEndOfFile (hFile=0x1ec) returned 1 [0097.225] CloseHandle (hObject=0x1ec) returned 1 [0097.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 1 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString=".doc") returned 4 [0097.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString=".docx") returned 5 [0097.226] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0097.226] lstrlenW (lpString=".pdf") returned 4 [0097.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString=".xls") returned 4 [0097.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.226] lstrlenW (lpString=".xlsx") returned 5 [0097.226] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0097.226] lstrlenW (lpString=".ppt") returned 4 [0097.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString=".zip") returned 4 [0097.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.226] lstrlenW (lpString=".rar") returned 4 [0097.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString=".bz2") returned 4 [0097.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString=".7z") returned 3 [0097.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString=".dbf") returned 4 [0097.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString=".1cd") returned 4 [0097.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 63 [0097.226] lstrlenW (lpString=".jpg") returned 4 [0097.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.227] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") [0097.424] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19034) returned 1 [0097.424] CloseHandle (hObject=0x15c) returned 1 [0097.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 0x20 [0097.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0097.425] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.425] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0097.425] GetLastError () returned 0x0 [0097.425] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4a5a, lpOverlapped=0x0) returned 1 [0097.522] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4a60, lpOverlapped=0x0) returned 1 [0097.524] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.524] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.524] SetEndOfFile (hFile=0x22c) returned 1 [0098.214] CloseHandle (hObject=0x22c) returned 1 [0098.218] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.218] SetEndOfFile (hFile=0x15c) returned 1 [0098.238] CloseHandle (hObject=0x15c) returned 1 [0098.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 1 [0098.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.247] lstrlenW (lpString=".doc") returned 4 [0098.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString=".docx") returned 5 [0098.247] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0098.247] lstrlenW (lpString=".pdf") returned 4 [0098.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString=".xls") returned 4 [0098.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.247] lstrlenW (lpString=".xlsx") returned 5 [0098.247] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0098.247] lstrlenW (lpString=".ppt") returned 4 [0098.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.247] lstrlenW (lpString=".zip") returned 4 [0098.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.247] lstrlenW (lpString=".rar") returned 4 [0098.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString=".bz2") returned 4 [0098.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString=".7z") returned 3 [0098.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.247] lstrlenW (lpString=".dbf") returned 4 [0098.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.247] lstrlenW (lpString=".1cd") returned 4 [0098.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 63 [0098.248] lstrlenW (lpString=".jpg") returned 4 [0098.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.248] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") [0098.249] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20366) returned 1 [0098.249] CloseHandle (hObject=0x158) returned 1 [0098.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 0x20 [0098.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.249] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.249] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.250] GetLastError () returned 0x0 [0098.250] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4f8e, lpOverlapped=0x0) returned 1 [0098.261] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4f90, lpOverlapped=0x0) returned 1 [0098.262] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.262] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.262] SetEndOfFile (hFile=0x15c) returned 1 [0098.262] CloseHandle (hObject=0x15c) returned 1 [0098.262] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.262] SetEndOfFile (hFile=0x158) returned 1 [0098.263] CloseHandle (hObject=0x158) returned 1 [0098.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 1 [0098.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.264] lstrlenW (lpString=".doc") returned 4 [0098.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString=".docx") returned 5 [0098.264] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0098.264] lstrlenW (lpString=".pdf") returned 4 [0098.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString=".xls") returned 4 [0098.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.264] lstrlenW (lpString=".xlsx") returned 5 [0098.264] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0098.264] lstrlenW (lpString=".ppt") returned 4 [0098.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.264] lstrlenW (lpString=".zip") returned 4 [0098.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.264] lstrlenW (lpString=".rar") returned 4 [0098.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString=".bz2") returned 4 [0098.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString=".7z") returned 3 [0098.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.264] lstrlenW (lpString=".dbf") returned 4 [0098.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.264] lstrlenW (lpString=".1cd") returned 4 [0098.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 63 [0098.265] lstrlenW (lpString=".jpg") returned 4 [0098.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.265] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") [0098.266] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10692) returned 1 [0098.266] CloseHandle (hObject=0x158) returned 1 [0098.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 0x20 [0098.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.266] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.266] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.267] GetLastError () returned 0x0 [0098.267] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x29c4, lpOverlapped=0x0) returned 1 [0098.269] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x29d0, lpOverlapped=0x0) returned 1 [0098.270] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.270] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.270] SetEndOfFile (hFile=0x15c) returned 1 [0098.270] CloseHandle (hObject=0x15c) returned 1 [0098.270] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.270] SetEndOfFile (hFile=0x158) returned 1 [0098.271] CloseHandle (hObject=0x158) returned 1 [0098.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 1 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString=".doc") returned 4 [0098.272] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.272] lstrlenW (lpString=".docx") returned 5 [0098.272] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0098.272] lstrlenW (lpString=".pdf") returned 4 [0098.272] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.272] lstrlenW (lpString=".xls") returned 4 [0098.272] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.272] lstrlenW (lpString=".xlsx") returned 5 [0098.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0098.272] lstrlenW (lpString=".ppt") returned 4 [0098.272] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString=".zip") returned 4 [0098.272] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.272] lstrlenW (lpString=".rar") returned 4 [0098.272] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.272] lstrlenW (lpString=".bz2") returned 4 [0098.272] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.272] lstrlenW (lpString=".7z") returned 3 [0098.272] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString=".dbf") returned 4 [0098.272] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString=".1cd") returned 4 [0098.272] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 63 [0098.272] lstrlenW (lpString=".jpg") returned 4 [0098.272] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.273] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") [0098.274] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21580) returned 1 [0098.274] CloseHandle (hObject=0x158) returned 1 [0098.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 0x20 [0098.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.274] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.274] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.275] GetLastError () returned 0x0 [0098.275] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x544c, lpOverlapped=0x0) returned 1 [0098.277] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5450, lpOverlapped=0x0) returned 1 [0098.278] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.278] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.278] SetEndOfFile (hFile=0x15c) returned 1 [0098.278] CloseHandle (hObject=0x15c) returned 1 [0098.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.278] SetEndOfFile (hFile=0x158) returned 1 [0098.279] CloseHandle (hObject=0x158) returned 1 [0098.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 1 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString=".doc") returned 4 [0098.280] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.280] lstrlenW (lpString=".docx") returned 5 [0098.280] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0098.280] lstrlenW (lpString=".pdf") returned 4 [0098.280] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.280] lstrlenW (lpString=".xls") returned 4 [0098.280] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.280] lstrlenW (lpString=".xlsx") returned 5 [0098.280] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0098.280] lstrlenW (lpString=".ppt") returned 4 [0098.280] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString=".zip") returned 4 [0098.280] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.280] lstrlenW (lpString=".rar") returned 4 [0098.280] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.280] lstrlenW (lpString=".bz2") returned 4 [0098.280] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.280] lstrlenW (lpString=".7z") returned 3 [0098.280] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString=".dbf") returned 4 [0098.280] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString=".1cd") returned 4 [0098.280] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 63 [0098.280] lstrlenW (lpString=".jpg") returned 4 [0098.280] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.281] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") [0098.281] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=39563) returned 1 [0098.281] CloseHandle (hObject=0x158) returned 1 [0098.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 0x20 [0098.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.281] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.281] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0098.282] GetLastError () returned 0x0 [0098.282] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9a8b, lpOverlapped=0x0) returned 1 [0098.357] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9a90, lpOverlapped=0x0) returned 1 [0098.358] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.358] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.358] SetEndOfFile (hFile=0x15c) returned 1 [0098.358] CloseHandle (hObject=0x15c) returned 1 [0098.358] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.359] SetEndOfFile (hFile=0x158) returned 1 [0098.359] CloseHandle (hObject=0x158) returned 1 [0098.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.368] lstrlenW (lpString=".doc") returned 4 [0098.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.368] lstrlenW (lpString=".docx") returned 5 [0098.368] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.368] lstrlenW (lpString=".pdf") returned 4 [0098.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.368] lstrlenW (lpString=".xls") returned 4 [0098.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.368] lstrlenW (lpString=".xlsx") returned 5 [0098.368] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.368] lstrlenW (lpString=".ppt") returned 4 [0098.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.368] lstrlenW (lpString=".zip") returned 4 [0098.368] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.368] lstrlenW (lpString=".rar") returned 4 [0098.368] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.368] lstrlenW (lpString=".bz2") returned 4 [0098.368] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.368] lstrlenW (lpString=".7z") returned 3 [0098.368] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.368] lstrlenW (lpString=".dbf") returned 4 [0098.368] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.369] lstrlenW (lpString=".1cd") returned 4 [0098.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 63 [0098.369] lstrlenW (lpString=".jpg") returned 4 [0098.370] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.370] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") [0098.611] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19202) returned 1 [0098.611] CloseHandle (hObject=0x1fc) returned 1 [0098.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 0x20 [0098.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.626] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.642] GetLastError () returned 0x0 [0098.642] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4b02, lpOverlapped=0x0) returned 1 [0098.644] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4b10, lpOverlapped=0x0) returned 1 [0098.645] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.645] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.645] SetEndOfFile (hFile=0x1c0) returned 1 [0098.645] CloseHandle (hObject=0x1c0) returned 1 [0098.645] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.645] SetEndOfFile (hFile=0x1fc) returned 1 [0098.646] CloseHandle (hObject=0x1fc) returned 1 [0098.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 1 [0098.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.647] lstrlenW (lpString=".doc") returned 4 [0098.647] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.647] lstrlenW (lpString=".docx") returned 5 [0098.647] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0098.647] lstrlenW (lpString=".pdf") returned 4 [0098.647] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.647] lstrlenW (lpString=".xls") returned 4 [0098.647] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.647] lstrlenW (lpString=".xlsx") returned 5 [0098.647] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0098.647] lstrlenW (lpString=".ppt") returned 4 [0098.647] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.647] lstrlenW (lpString=".zip") returned 4 [0098.647] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.647] lstrlenW (lpString=".rar") returned 4 [0098.647] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.647] lstrlenW (lpString=".bz2") returned 4 [0098.647] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.647] lstrlenW (lpString=".7z") returned 3 [0098.647] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.648] lstrlenW (lpString=".dbf") returned 4 [0098.648] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.648] lstrlenW (lpString=".1cd") returned 4 [0098.648] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 63 [0098.648] lstrlenW (lpString=".jpg") returned 4 [0098.648] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.648] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") [0098.648] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21187) returned 1 [0098.648] CloseHandle (hObject=0x1fc) returned 1 [0098.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0098.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.649] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.649] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.649] GetLastError () returned 0x0 [0098.649] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x52c3, lpOverlapped=0x0) returned 1 [0098.651] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x52d0, lpOverlapped=0x0) returned 1 [0098.652] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.652] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.652] SetEndOfFile (hFile=0x1c0) returned 1 [0098.653] CloseHandle (hObject=0x1c0) returned 1 [0098.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.653] SetEndOfFile (hFile=0x1fc) returned 1 [0098.654] CloseHandle (hObject=0x1fc) returned 1 [0098.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 1 [0098.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.654] lstrlenW (lpString=".doc") returned 4 [0098.654] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.654] lstrlenW (lpString=".docx") returned 5 [0098.654] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0098.654] lstrlenW (lpString=".pdf") returned 4 [0098.654] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.654] lstrlenW (lpString=".xls") returned 4 [0098.654] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.654] lstrlenW (lpString=".xlsx") returned 5 [0098.654] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0098.654] lstrlenW (lpString=".ppt") returned 4 [0098.654] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.654] lstrlenW (lpString=".zip") returned 4 [0098.654] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.654] lstrlenW (lpString=".rar") returned 4 [0098.654] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.655] lstrlenW (lpString=".bz2") returned 4 [0098.655] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.655] lstrlenW (lpString=".7z") returned 3 [0098.655] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.655] lstrlenW (lpString=".dbf") returned 4 [0098.655] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.655] lstrlenW (lpString=".1cd") returned 4 [0098.655] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 63 [0098.655] lstrlenW (lpString=".jpg") returned 4 [0098.655] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.655] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") [0098.656] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29783) returned 1 [0098.656] CloseHandle (hObject=0x1fc) returned 1 [0098.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0098.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.656] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.656] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.657] GetLastError () returned 0x0 [0098.657] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7457, lpOverlapped=0x0) returned 1 [0098.659] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0098.660] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.660] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.660] SetEndOfFile (hFile=0x1c0) returned 1 [0098.661] CloseHandle (hObject=0x1c0) returned 1 [0098.661] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.661] SetEndOfFile (hFile=0x1fc) returned 1 [0098.662] CloseHandle (hObject=0x1fc) returned 1 [0098.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 1 [0098.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.662] lstrlenW (lpString=".doc") returned 4 [0098.662] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.662] lstrlenW (lpString=".docx") returned 5 [0098.662] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.662] lstrlenW (lpString=".pdf") returned 4 [0098.662] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.662] lstrlenW (lpString=".xls") returned 4 [0098.662] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.662] lstrlenW (lpString=".xlsx") returned 5 [0098.662] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.662] lstrlenW (lpString=".ppt") returned 4 [0098.662] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.662] lstrlenW (lpString=".zip") returned 4 [0098.662] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.663] lstrlenW (lpString=".rar") returned 4 [0098.663] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.663] lstrlenW (lpString=".bz2") returned 4 [0098.663] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.663] lstrlenW (lpString=".7z") returned 3 [0098.663] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.663] lstrlenW (lpString=".dbf") returned 4 [0098.663] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.663] lstrlenW (lpString=".1cd") returned 4 [0098.663] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 63 [0098.663] lstrlenW (lpString=".jpg") returned 4 [0098.663] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.663] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") [0098.664] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=43490) returned 1 [0098.664] CloseHandle (hObject=0x1fc) returned 1 [0098.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0098.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.664] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.664] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.665] GetLastError () returned 0x0 [0098.665] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa9e2, lpOverlapped=0x0) returned 1 [0098.667] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa9f0, lpOverlapped=0x0) returned 1 [0098.668] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.668] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.668] SetEndOfFile (hFile=0x1c0) returned 1 [0098.669] CloseHandle (hObject=0x1c0) returned 1 [0098.669] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.669] SetEndOfFile (hFile=0x1fc) returned 1 [0098.670] CloseHandle (hObject=0x1fc) returned 1 [0098.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 1 [0098.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.670] lstrlenW (lpString=".doc") returned 4 [0098.670] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.670] lstrlenW (lpString=".docx") returned 5 [0098.670] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.670] lstrlenW (lpString=".pdf") returned 4 [0098.670] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.670] lstrlenW (lpString=".xls") returned 4 [0098.670] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.670] lstrlenW (lpString=".xlsx") returned 5 [0098.671] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.671] lstrlenW (lpString=".ppt") returned 4 [0098.671] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.671] lstrlenW (lpString=".zip") returned 4 [0098.671] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.671] lstrlenW (lpString=".rar") returned 4 [0098.671] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.671] lstrlenW (lpString=".bz2") returned 4 [0098.671] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.671] lstrlenW (lpString=".7z") returned 3 [0098.671] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.671] lstrlenW (lpString=".dbf") returned 4 [0098.671] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.671] lstrlenW (lpString=".1cd") returned 4 [0098.671] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 63 [0098.671] lstrlenW (lpString=".jpg") returned 4 [0098.671] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.671] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") [0098.672] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=16099) returned 1 [0098.672] CloseHandle (hObject=0x1fc) returned 1 [0098.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0098.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0098.672] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.672] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0098.673] GetLastError () returned 0x0 [0098.673] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3ee3, lpOverlapped=0x0) returned 1 [0098.747] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0098.748] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.749] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.749] SetEndOfFile (hFile=0x1c0) returned 1 [0098.749] CloseHandle (hObject=0x1c0) returned 1 [0098.749] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.749] SetEndOfFile (hFile=0x1fc) returned 1 [0098.750] CloseHandle (hObject=0x1fc) returned 1 [0098.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 1 [0098.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.780] lstrlenW (lpString=".doc") returned 4 [0098.780] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.780] lstrlenW (lpString=".docx") returned 5 [0098.781] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0098.781] lstrlenW (lpString=".pdf") returned 4 [0098.781] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.781] lstrlenW (lpString=".xls") returned 4 [0098.781] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.781] lstrlenW (lpString=".xlsx") returned 5 [0098.781] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0098.781] lstrlenW (lpString=".ppt") returned 4 [0098.781] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.781] lstrlenW (lpString=".zip") returned 4 [0098.781] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.781] lstrlenW (lpString=".rar") returned 4 [0098.781] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.781] lstrlenW (lpString=".bz2") returned 4 [0098.781] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.781] lstrlenW (lpString=".7z") returned 3 [0098.781] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.781] lstrlenW (lpString=".dbf") returned 4 [0098.781] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.781] lstrlenW (lpString=".1cd") returned 4 [0098.781] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 63 [0098.781] lstrlenW (lpString=".jpg") returned 4 [0098.781] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.781] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") [0098.835] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=15863) returned 1 [0098.835] CloseHandle (hObject=0x180) returned 1 [0098.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 0x20 [0098.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.836] GetLastError () returned 0x0 [0098.836] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3df7, lpOverlapped=0x0) returned 1 [0098.838] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0098.840] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.840] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.840] SetEndOfFile (hFile=0x158) returned 1 [0098.840] CloseHandle (hObject=0x158) returned 1 [0098.840] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.840] SetEndOfFile (hFile=0x180) returned 1 [0098.841] CloseHandle (hObject=0x180) returned 1 [0098.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 1 [0098.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.841] lstrlenW (lpString=".doc") returned 4 [0098.841] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.841] lstrlenW (lpString=".docx") returned 5 [0098.841] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0098.841] lstrlenW (lpString=".pdf") returned 4 [0098.841] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.841] lstrlenW (lpString=".xls") returned 4 [0098.841] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.841] lstrlenW (lpString=".xlsx") returned 5 [0098.842] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0098.842] lstrlenW (lpString=".ppt") returned 4 [0098.842] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.842] lstrlenW (lpString=".zip") returned 4 [0098.842] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.842] lstrlenW (lpString=".rar") returned 4 [0098.842] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.842] lstrlenW (lpString=".bz2") returned 4 [0098.842] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.842] lstrlenW (lpString=".7z") returned 3 [0098.842] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.842] lstrlenW (lpString=".dbf") returned 4 [0098.842] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.842] lstrlenW (lpString=".1cd") returned 4 [0098.842] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 63 [0098.842] lstrlenW (lpString=".jpg") returned 4 [0098.842] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.842] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") [0098.843] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=68572) returned 1 [0098.843] CloseHandle (hObject=0x180) returned 1 [0098.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 0x20 [0098.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.843] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.843] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.844] GetLastError () returned 0x0 [0098.844] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10bdc, lpOverlapped=0x0) returned 1 [0098.847] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10be0, lpOverlapped=0x0) returned 1 [0098.848] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.849] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.849] SetEndOfFile (hFile=0x158) returned 1 [0098.849] CloseHandle (hObject=0x158) returned 1 [0098.849] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.849] SetEndOfFile (hFile=0x180) returned 1 [0098.850] CloseHandle (hObject=0x180) returned 1 [0098.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.850] lstrlenW (lpString=".doc") returned 4 [0098.850] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.850] lstrlenW (lpString=".docx") returned 5 [0098.850] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0098.851] lstrlenW (lpString=".pdf") returned 4 [0098.851] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.851] lstrlenW (lpString=".xls") returned 4 [0098.851] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.851] lstrlenW (lpString=".xlsx") returned 5 [0098.851] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0098.851] lstrlenW (lpString=".ppt") returned 4 [0098.851] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.851] lstrlenW (lpString=".zip") returned 4 [0098.851] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.851] lstrlenW (lpString=".rar") returned 4 [0098.851] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.851] lstrlenW (lpString=".bz2") returned 4 [0098.851] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.851] lstrlenW (lpString=".7z") returned 3 [0098.851] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.851] lstrlenW (lpString=".dbf") returned 4 [0098.851] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.851] lstrlenW (lpString=".1cd") returned 4 [0098.851] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 63 [0098.851] lstrlenW (lpString=".jpg") returned 4 [0098.851] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.851] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") [0098.852] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=118362) returned 1 [0098.852] CloseHandle (hObject=0x180) returned 1 [0098.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 0x20 [0098.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.852] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.852] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.853] GetLastError () returned 0x0 [0098.853] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ce5a, lpOverlapped=0x0) returned 1 [0098.857] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ce60, lpOverlapped=0x0) returned 1 [0098.859] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.859] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.859] SetEndOfFile (hFile=0x158) returned 1 [0098.860] CloseHandle (hObject=0x158) returned 1 [0098.860] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.860] SetEndOfFile (hFile=0x180) returned 1 [0098.861] CloseHandle (hObject=0x180) returned 1 [0098.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 1 [0098.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.861] lstrlenW (lpString=".doc") returned 4 [0098.862] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.862] lstrlenW (lpString=".docx") returned 5 [0098.862] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0098.862] lstrlenW (lpString=".pdf") returned 4 [0098.862] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.862] lstrlenW (lpString=".xls") returned 4 [0098.862] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.862] lstrlenW (lpString=".xlsx") returned 5 [0098.862] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0098.862] lstrlenW (lpString=".ppt") returned 4 [0098.862] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.862] lstrlenW (lpString=".zip") returned 4 [0098.862] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.862] lstrlenW (lpString=".rar") returned 4 [0098.862] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.862] lstrlenW (lpString=".bz2") returned 4 [0098.862] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.862] lstrlenW (lpString=".7z") returned 3 [0098.862] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.862] lstrlenW (lpString=".dbf") returned 4 [0098.862] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.862] lstrlenW (lpString=".1cd") returned 4 [0098.862] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 63 [0098.862] lstrlenW (lpString=".jpg") returned 4 [0098.862] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.862] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") [0098.863] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=91948) returned 1 [0098.863] CloseHandle (hObject=0x180) returned 1 [0098.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 0x20 [0098.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.864] GetLastError () returned 0x0 [0098.864] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1672c, lpOverlapped=0x0) returned 1 [0098.870] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16730, lpOverlapped=0x0) returned 1 [0098.872] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.872] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.872] SetEndOfFile (hFile=0x158) returned 1 [0098.872] CloseHandle (hObject=0x158) returned 1 [0098.872] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.872] SetEndOfFile (hFile=0x180) returned 1 [0098.873] CloseHandle (hObject=0x180) returned 1 [0098.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 1 [0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.874] lstrlenW (lpString=".doc") returned 4 [0098.874] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0098.874] lstrlenW (lpString=".docx") returned 5 [0098.874] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0098.874] lstrlenW (lpString=".pdf") returned 4 [0098.874] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0098.874] lstrlenW (lpString=".xls") returned 4 [0098.874] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0098.874] lstrlenW (lpString=".xlsx") returned 5 [0098.874] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0098.874] lstrlenW (lpString=".ppt") returned 4 [0098.874] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0098.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.874] lstrlenW (lpString=".zip") returned 4 [0098.874] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0098.874] lstrlenW (lpString=".rar") returned 4 [0098.874] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0098.874] lstrlenW (lpString=".bz2") returned 4 [0098.874] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0098.874] lstrlenW (lpString=".7z") returned 3 [0098.875] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0098.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.875] lstrlenW (lpString=".dbf") returned 4 [0098.875] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0098.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.875] lstrlenW (lpString=".1cd") returned 4 [0098.875] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0098.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 63 [0098.875] lstrlenW (lpString=".jpg") returned 4 [0098.875] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0098.875] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") [0098.875] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=129132) returned 1 [0098.875] CloseHandle (hObject=0x180) returned 1 [0098.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 0x20 [0098.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0098.876] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.876] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0098.876] GetLastError () returned 0x0 [0098.877] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1f86c, lpOverlapped=0x0) returned 1 [0098.987] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1f870, lpOverlapped=0x0) returned 1 [0099.008] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.008] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.008] SetEndOfFile (hFile=0x158) returned 1 [0099.008] CloseHandle (hObject=0x158) returned 1 [0099.008] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.008] SetEndOfFile (hFile=0x180) returned 1 [0099.009] CloseHandle (hObject=0x180) returned 1 [0099.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 1 [0099.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.118] lstrlenW (lpString=".doc") returned 4 [0099.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.118] lstrlenW (lpString=".docx") returned 5 [0099.118] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0099.118] lstrlenW (lpString=".pdf") returned 4 [0099.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.119] lstrlenW (lpString=".xls") returned 4 [0099.119] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.119] lstrlenW (lpString=".xlsx") returned 5 [0099.119] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0099.119] lstrlenW (lpString=".ppt") returned 4 [0099.119] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.119] lstrlenW (lpString=".zip") returned 4 [0099.119] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.119] lstrlenW (lpString=".rar") returned 4 [0099.119] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.119] lstrlenW (lpString=".bz2") returned 4 [0099.119] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.119] lstrlenW (lpString=".7z") returned 3 [0099.119] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.119] lstrlenW (lpString=".dbf") returned 4 [0099.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.119] lstrlenW (lpString=".1cd") returned 4 [0099.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 63 [0099.119] lstrlenW (lpString=".jpg") returned 4 [0099.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.119] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") [0099.120] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=103399) returned 1 [0099.120] CloseHandle (hObject=0x19c) returned 1 [0099.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 0x20 [0099.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.120] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.120] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0099.305] GetLastError () returned 0x0 [0099.305] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x193e7, lpOverlapped=0x0) returned 1 [0099.310] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x193f0, lpOverlapped=0x0) returned 1 [0099.313] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.313] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.313] SetEndOfFile (hFile=0x1ec) returned 1 [0099.313] CloseHandle (hObject=0x1ec) returned 1 [0099.313] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.313] SetEndOfFile (hFile=0x19c) returned 1 [0099.314] CloseHandle (hObject=0x19c) returned 1 [0099.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 1 [0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.315] lstrlenW (lpString=".doc") returned 4 [0099.315] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.315] lstrlenW (lpString=".docx") returned 5 [0099.315] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0099.315] lstrlenW (lpString=".pdf") returned 4 [0099.315] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.315] lstrlenW (lpString=".xls") returned 4 [0099.315] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.315] lstrlenW (lpString=".xlsx") returned 5 [0099.315] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0099.315] lstrlenW (lpString=".ppt") returned 4 [0099.315] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.315] lstrlenW (lpString=".zip") returned 4 [0099.315] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.315] lstrlenW (lpString=".rar") returned 4 [0099.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.315] lstrlenW (lpString=".bz2") returned 4 [0099.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.315] lstrlenW (lpString=".7z") returned 3 [0099.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.315] lstrlenW (lpString=".dbf") returned 4 [0099.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.316] lstrlenW (lpString=".1cd") returned 4 [0099.316] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 63 [0099.316] lstrlenW (lpString=".jpg") returned 4 [0099.316] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.316] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") [0099.317] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=85898) returned 1 [0099.318] CloseHandle (hObject=0x19c) returned 1 [0099.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 0x20 [0099.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.318] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.318] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0099.319] GetLastError () returned 0x0 [0099.319] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x14f8a, lpOverlapped=0x0) returned 1 [0099.322] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x14f90, lpOverlapped=0x0) returned 1 [0099.325] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.325] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.325] SetEndOfFile (hFile=0x1ec) returned 1 [0099.325] CloseHandle (hObject=0x1ec) returned 1 [0099.325] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.325] SetEndOfFile (hFile=0x19c) returned 1 [0099.326] CloseHandle (hObject=0x19c) returned 1 [0099.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 1 [0099.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.327] lstrlenW (lpString=".doc") returned 4 [0099.327] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.327] lstrlenW (lpString=".docx") returned 5 [0099.327] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0099.327] lstrlenW (lpString=".pdf") returned 4 [0099.327] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.327] lstrlenW (lpString=".xls") returned 4 [0099.327] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.327] lstrlenW (lpString=".xlsx") returned 5 [0099.327] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0099.327] lstrlenW (lpString=".ppt") returned 4 [0099.327] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.327] lstrlenW (lpString=".zip") returned 4 [0099.327] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.327] lstrlenW (lpString=".rar") returned 4 [0099.327] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.327] lstrlenW (lpString=".bz2") returned 4 [0099.327] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.327] lstrlenW (lpString=".7z") returned 3 [0099.327] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.327] lstrlenW (lpString=".dbf") returned 4 [0099.327] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.327] lstrlenW (lpString=".1cd") returned 4 [0099.327] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 63 [0099.328] lstrlenW (lpString=".jpg") returned 4 [0099.328] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.328] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") [0099.329] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=107508) returned 1 [0099.329] CloseHandle (hObject=0x19c) returned 1 [0099.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 0x20 [0099.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.330] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.330] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0099.331] GetLastError () returned 0x0 [0099.331] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1a3f4, lpOverlapped=0x0) returned 1 [0099.335] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1a400, lpOverlapped=0x0) returned 1 [0099.337] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.338] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.338] SetEndOfFile (hFile=0x1ec) returned 1 [0099.338] CloseHandle (hObject=0x1ec) returned 1 [0099.338] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.338] SetEndOfFile (hFile=0x19c) returned 1 [0099.339] CloseHandle (hObject=0x19c) returned 1 [0099.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 1 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.340] lstrlenW (lpString=".doc") returned 4 [0099.340] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.340] lstrlenW (lpString=".docx") returned 5 [0099.340] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.340] lstrlenW (lpString=".pdf") returned 4 [0099.340] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.340] lstrlenW (lpString=".xls") returned 4 [0099.340] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.340] lstrlenW (lpString=".xlsx") returned 5 [0099.340] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.340] lstrlenW (lpString=".ppt") returned 4 [0099.340] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.340] lstrlenW (lpString=".zip") returned 4 [0099.340] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.340] lstrlenW (lpString=".rar") returned 4 [0099.340] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.340] lstrlenW (lpString=".bz2") returned 4 [0099.340] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.340] lstrlenW (lpString=".7z") returned 3 [0099.340] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.340] lstrlenW (lpString=".dbf") returned 4 [0099.340] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.340] lstrlenW (lpString=".1cd") returned 4 [0099.340] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 63 [0099.341] lstrlenW (lpString=".jpg") returned 4 [0099.341] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.341] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") [0099.342] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=101060) returned 1 [0099.342] CloseHandle (hObject=0x19c) returned 1 [0099.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 0x20 [0099.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.342] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.342] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0099.343] GetLastError () returned 0x0 [0099.343] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x18ac4, lpOverlapped=0x0) returned 1 [0099.412] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x18ad0, lpOverlapped=0x0) returned 1 [0099.415] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.415] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.415] SetEndOfFile (hFile=0x1ec) returned 1 [0099.415] CloseHandle (hObject=0x1ec) returned 1 [0099.415] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.415] SetEndOfFile (hFile=0x19c) returned 1 [0099.416] CloseHandle (hObject=0x19c) returned 1 [0099.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 1 [0099.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.573] lstrlenW (lpString=".doc") returned 4 [0099.573] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.573] lstrlenW (lpString=".docx") returned 5 [0099.573] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0099.573] lstrlenW (lpString=".pdf") returned 4 [0099.573] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.573] lstrlenW (lpString=".xls") returned 4 [0099.573] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.573] lstrlenW (lpString=".xlsx") returned 5 [0099.573] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0099.574] lstrlenW (lpString=".ppt") returned 4 [0099.574] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.574] lstrlenW (lpString=".zip") returned 4 [0099.574] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.574] lstrlenW (lpString=".rar") returned 4 [0099.574] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.574] lstrlenW (lpString=".bz2") returned 4 [0099.574] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.574] lstrlenW (lpString=".7z") returned 3 [0099.574] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.574] lstrlenW (lpString=".dbf") returned 4 [0099.574] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.574] lstrlenW (lpString=".1cd") returned 4 [0099.574] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 63 [0099.574] lstrlenW (lpString=".jpg") returned 4 [0099.574] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.574] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") [0099.780] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=88980) returned 1 [0099.780] CloseHandle (hObject=0x210) returned 1 [0099.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 0x20 [0099.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.812] GetLastError () returned 0x0 [0099.813] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x15b94, lpOverlapped=0x0) returned 1 [0099.816] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x15ba0, lpOverlapped=0x0) returned 1 [0099.818] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.818] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.818] SetEndOfFile (hFile=0x16c) returned 1 [0099.818] CloseHandle (hObject=0x16c) returned 1 [0099.819] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.819] SetEndOfFile (hFile=0x210) returned 1 [0099.820] CloseHandle (hObject=0x210) returned 1 [0099.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 1 [0099.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.820] lstrlenW (lpString=".doc") returned 4 [0099.820] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.820] lstrlenW (lpString=".docx") returned 5 [0099.820] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.820] lstrlenW (lpString=".pdf") returned 4 [0099.820] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.821] lstrlenW (lpString=".xls") returned 4 [0099.821] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.821] lstrlenW (lpString=".xlsx") returned 5 [0099.821] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.821] lstrlenW (lpString=".ppt") returned 4 [0099.821] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.821] lstrlenW (lpString=".zip") returned 4 [0099.821] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.821] lstrlenW (lpString=".rar") returned 4 [0099.821] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.821] lstrlenW (lpString=".bz2") returned 4 [0099.821] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.821] lstrlenW (lpString=".7z") returned 3 [0099.821] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.821] lstrlenW (lpString=".dbf") returned 4 [0099.821] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.821] lstrlenW (lpString=".1cd") returned 4 [0099.821] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 63 [0099.821] lstrlenW (lpString=".jpg") returned 4 [0099.821] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.821] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") [0099.822] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30842) returned 1 [0099.822] CloseHandle (hObject=0x210) returned 1 [0099.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0099.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.822] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.822] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.823] GetLastError () returned 0x0 [0099.823] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x787a, lpOverlapped=0x0) returned 1 [0099.847] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7880, lpOverlapped=0x0) returned 1 [0099.848] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.848] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.849] SetEndOfFile (hFile=0x16c) returned 1 [0099.849] CloseHandle (hObject=0x16c) returned 1 [0099.849] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.849] SetEndOfFile (hFile=0x210) returned 1 [0099.850] CloseHandle (hObject=0x210) returned 1 [0099.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 1 [0099.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.850] lstrlenW (lpString=".doc") returned 4 [0099.850] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.850] lstrlenW (lpString=".docx") returned 5 [0099.850] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0099.850] lstrlenW (lpString=".pdf") returned 4 [0099.850] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.851] lstrlenW (lpString=".xls") returned 4 [0099.851] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.851] lstrlenW (lpString=".xlsx") returned 5 [0099.851] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0099.851] lstrlenW (lpString=".ppt") returned 4 [0099.851] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.851] lstrlenW (lpString=".zip") returned 4 [0099.851] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.851] lstrlenW (lpString=".rar") returned 4 [0099.851] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.851] lstrlenW (lpString=".bz2") returned 4 [0099.851] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.851] lstrlenW (lpString=".7z") returned 3 [0099.851] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.851] lstrlenW (lpString=".dbf") returned 4 [0099.851] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.851] lstrlenW (lpString=".1cd") returned 4 [0099.851] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 63 [0099.851] lstrlenW (lpString=".jpg") returned 4 [0099.851] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.851] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") [0099.852] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=43294) returned 1 [0099.852] CloseHandle (hObject=0x210) returned 1 [0099.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0099.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.852] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.852] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0099.853] GetLastError () returned 0x0 [0099.853] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa91e, lpOverlapped=0x0) returned 1 [0099.904] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa920, lpOverlapped=0x0) returned 1 [0099.905] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.905] WriteFile (in: hFile=0x16c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.905] SetEndOfFile (hFile=0x16c) returned 1 [0099.909] CloseHandle (hObject=0x16c) returned 1 [0099.909] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.916] SetEndOfFile (hFile=0x210) returned 1 [0099.924] CloseHandle (hObject=0x210) returned 1 [0099.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 1 [0099.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.929] lstrlenW (lpString=".doc") returned 4 [0099.929] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.929] lstrlenW (lpString=".docx") returned 5 [0099.929] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0099.929] lstrlenW (lpString=".pdf") returned 4 [0099.929] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.929] lstrlenW (lpString=".xls") returned 4 [0099.929] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.929] lstrlenW (lpString=".xlsx") returned 5 [0099.929] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0099.930] lstrlenW (lpString=".ppt") returned 4 [0099.930] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.930] lstrlenW (lpString=".zip") returned 4 [0099.930] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.930] lstrlenW (lpString=".rar") returned 4 [0099.930] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.930] lstrlenW (lpString=".bz2") returned 4 [0099.930] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.930] lstrlenW (lpString=".7z") returned 3 [0099.930] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.930] lstrlenW (lpString=".dbf") returned 4 [0099.930] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.930] lstrlenW (lpString=".1cd") returned 4 [0099.930] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 63 [0099.930] lstrlenW (lpString=".jpg") returned 4 [0099.930] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.930] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") [0099.931] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=51978) returned 1 [0099.931] CloseHandle (hObject=0x210) returned 1 [0099.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 0x20 [0099.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0099.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.932] GetLastError () returned 0x0 [0099.932] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xcb0a, lpOverlapped=0x0) returned 1 [0099.938] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xcb10, lpOverlapped=0x0) returned 1 [0099.939] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.939] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.940] SetEndOfFile (hFile=0x22c) returned 1 [0099.940] CloseHandle (hObject=0x22c) returned 1 [0099.940] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.940] SetEndOfFile (hFile=0x210) returned 1 [0099.941] CloseHandle (hObject=0x210) returned 1 [0099.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 1 [0099.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.941] lstrlenW (lpString=".doc") returned 4 [0099.941] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0099.941] lstrlenW (lpString=".docx") returned 5 [0099.941] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0099.941] lstrlenW (lpString=".pdf") returned 4 [0099.941] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0099.941] lstrlenW (lpString=".xls") returned 4 [0099.941] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0099.941] lstrlenW (lpString=".xlsx") returned 5 [0099.941] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0099.941] lstrlenW (lpString=".ppt") returned 4 [0099.942] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0099.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.942] lstrlenW (lpString=".zip") returned 4 [0099.942] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0099.942] lstrlenW (lpString=".rar") returned 4 [0099.942] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0099.942] lstrlenW (lpString=".bz2") returned 4 [0099.942] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0099.942] lstrlenW (lpString=".7z") returned 3 [0099.942] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0099.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.942] lstrlenW (lpString=".dbf") returned 4 [0099.942] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0099.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.942] lstrlenW (lpString=".1cd") returned 4 [0099.942] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0099.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 63 [0099.942] lstrlenW (lpString=".jpg") returned 4 [0099.942] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0099.942] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") [0100.323] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=39111) returned 1 [0100.323] CloseHandle (hObject=0x210) returned 1 [0100.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 0x20 [0100.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.323] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.323] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.324] GetLastError () returned 0x0 [0100.324] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x98c7, lpOverlapped=0x0) returned 1 [0100.327] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x98d0, lpOverlapped=0x0) returned 1 [0100.328] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.328] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.328] SetEndOfFile (hFile=0x168) returned 1 [0100.328] CloseHandle (hObject=0x168) returned 1 [0100.328] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.328] SetEndOfFile (hFile=0x210) returned 1 [0100.329] CloseHandle (hObject=0x210) returned 1 [0100.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 1 [0100.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.330] lstrlenW (lpString=".doc") returned 4 [0100.330] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0100.330] lstrlenW (lpString=".docx") returned 5 [0100.330] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0100.330] lstrlenW (lpString=".pdf") returned 4 [0100.330] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0100.330] lstrlenW (lpString=".xls") returned 4 [0100.330] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0100.330] lstrlenW (lpString=".xlsx") returned 5 [0100.330] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0100.330] lstrlenW (lpString=".ppt") returned 4 [0100.330] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0100.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.330] lstrlenW (lpString=".zip") returned 4 [0100.330] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0100.330] lstrlenW (lpString=".rar") returned 4 [0100.330] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0100.330] lstrlenW (lpString=".bz2") returned 4 [0100.330] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0100.330] lstrlenW (lpString=".7z") returned 3 [0100.330] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0100.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.330] lstrlenW (lpString=".dbf") returned 4 [0100.330] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0100.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.330] lstrlenW (lpString=".1cd") returned 4 [0100.330] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0100.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 63 [0100.331] lstrlenW (lpString=".jpg") returned 4 [0100.331] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0100.331] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") [0100.332] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12770) returned 1 [0100.332] CloseHandle (hObject=0x210) returned 1 [0100.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x20 [0100.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.332] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.332] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.333] GetLastError () returned 0x0 [0100.333] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x31e2, lpOverlapped=0x0) returned 1 [0100.335] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x31f0, lpOverlapped=0x0) returned 1 [0100.336] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.336] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.337] SetEndOfFile (hFile=0x168) returned 1 [0100.337] CloseHandle (hObject=0x168) returned 1 [0100.337] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.337] SetEndOfFile (hFile=0x210) returned 1 [0100.338] CloseHandle (hObject=0x210) returned 1 [0100.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 1 [0100.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.338] lstrlenW (lpString=".doc") returned 4 [0100.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.338] lstrlenW (lpString=".docx") returned 5 [0100.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.338] lstrlenW (lpString=".pdf") returned 4 [0100.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.338] lstrlenW (lpString=".xls") returned 4 [0100.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.338] lstrlenW (lpString=".xlsx") returned 5 [0100.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.338] lstrlenW (lpString=".ppt") returned 4 [0100.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.339] lstrlenW (lpString=".zip") returned 4 [0100.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.339] lstrlenW (lpString=".rar") returned 4 [0100.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString=".bz2") returned 4 [0100.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString=".7z") returned 3 [0100.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.339] lstrlenW (lpString=".dbf") returned 4 [0100.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.339] lstrlenW (lpString=".1cd") returned 4 [0100.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.339] lstrlenW (lpString=".jpg") returned 4 [0100.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString=".pdf") returned 4 [0100.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString=".xls") returned 4 [0100.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.339] lstrlenW (lpString=".xlsx") returned 5 [0100.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.339] lstrlenW (lpString=".ppt") returned 4 [0100.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.339] lstrlenW (lpString=".zip") returned 4 [0100.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.339] lstrlenW (lpString=".rar") returned 4 [0100.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.339] lstrlenW (lpString=".bz2") returned 4 [0100.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.340] lstrlenW (lpString=".7z") returned 3 [0100.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.340] lstrlenW (lpString=".dbf") returned 4 [0100.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.340] lstrlenW (lpString=".1cd") returned 4 [0100.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 63 [0100.340] lstrlenW (lpString=".jpg") returned 4 [0100.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.340] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") [0100.341] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20548) returned 1 [0100.341] CloseHandle (hObject=0x210) returned 1 [0100.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 0x20 [0100.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.341] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.341] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.342] GetLastError () returned 0x0 [0100.342] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5044, lpOverlapped=0x0) returned 1 [0100.345] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0100.346] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.346] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.346] SetEndOfFile (hFile=0x168) returned 1 [0100.346] CloseHandle (hObject=0x168) returned 1 [0100.346] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.346] SetEndOfFile (hFile=0x210) returned 1 [0100.347] CloseHandle (hObject=0x210) returned 1 [0100.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString=".doc") returned 4 [0100.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString=".docx") returned 5 [0100.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.348] lstrlenW (lpString=".pdf") returned 4 [0100.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString=".xls") returned 4 [0100.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.348] lstrlenW (lpString=".xlsx") returned 5 [0100.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.348] lstrlenW (lpString=".ppt") returned 4 [0100.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString=".zip") returned 4 [0100.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.348] lstrlenW (lpString=".rar") returned 4 [0100.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString=".bz2") returned 4 [0100.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString=".7z") returned 3 [0100.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString=".dbf") returned 4 [0100.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString=".1cd") returned 4 [0100.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.348] lstrlenW (lpString=".jpg") returned 4 [0100.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString=".pdf") returned 4 [0100.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString=".xls") returned 4 [0100.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.349] lstrlenW (lpString=".xlsx") returned 5 [0100.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.349] lstrlenW (lpString=".ppt") returned 4 [0100.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.349] lstrlenW (lpString=".zip") returned 4 [0100.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.349] lstrlenW (lpString=".rar") returned 4 [0100.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString=".bz2") returned 4 [0100.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString=".7z") returned 3 [0100.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.349] lstrlenW (lpString=".dbf") returned 4 [0100.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.349] lstrlenW (lpString=".1cd") returned 4 [0100.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 63 [0100.349] lstrlenW (lpString=".jpg") returned 4 [0100.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.349] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") [0100.351] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10818) returned 1 [0100.351] CloseHandle (hObject=0x210) returned 1 [0100.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 0x20 [0100.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.351] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.351] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.352] GetLastError () returned 0x0 [0100.352] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2a42, lpOverlapped=0x0) returned 1 [0100.354] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0100.355] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.355] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.355] SetEndOfFile (hFile=0x168) returned 1 [0100.355] CloseHandle (hObject=0x168) returned 1 [0100.355] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.355] SetEndOfFile (hFile=0x210) returned 1 [0100.356] CloseHandle (hObject=0x210) returned 1 [0100.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 1 [0100.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.357] lstrlenW (lpString=".doc") returned 4 [0100.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.357] lstrlenW (lpString=".docx") returned 5 [0100.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.357] lstrlenW (lpString=".pdf") returned 4 [0100.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.357] lstrlenW (lpString=".xls") returned 4 [0100.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.357] lstrlenW (lpString=".xlsx") returned 5 [0100.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.357] lstrlenW (lpString=".ppt") returned 4 [0100.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.357] lstrlenW (lpString=".zip") returned 4 [0100.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.357] lstrlenW (lpString=".rar") returned 4 [0100.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.357] lstrlenW (lpString=".bz2") returned 4 [0100.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.357] lstrlenW (lpString=".7z") returned 3 [0100.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.357] lstrlenW (lpString=".dbf") returned 4 [0100.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.358] lstrlenW (lpString=".1cd") returned 4 [0100.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.358] lstrlenW (lpString=".jpg") returned 4 [0100.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString=".pdf") returned 4 [0100.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString=".xls") returned 4 [0100.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.358] lstrlenW (lpString=".xlsx") returned 5 [0100.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.358] lstrlenW (lpString=".ppt") returned 4 [0100.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.358] lstrlenW (lpString=".zip") returned 4 [0100.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.358] lstrlenW (lpString=".rar") returned 4 [0100.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString=".bz2") returned 4 [0100.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString=".7z") returned 3 [0100.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.358] lstrlenW (lpString=".dbf") returned 4 [0100.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.358] lstrlenW (lpString=".1cd") returned 4 [0100.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 63 [0100.359] lstrlenW (lpString=".jpg") returned 4 [0100.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.359] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") [0100.360] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3754) returned 1 [0100.360] CloseHandle (hObject=0x210) returned 1 [0100.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 0x20 [0100.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.363] GetLastError () returned 0x0 [0100.363] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xeaa, lpOverlapped=0x0) returned 1 [0100.433] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0100.463] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.464] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.464] SetEndOfFile (hFile=0x168) returned 1 [0100.488] CloseHandle (hObject=0x168) returned 1 [0100.488] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.488] SetEndOfFile (hFile=0x210) returned 1 [0100.496] CloseHandle (hObject=0x210) returned 1 [0100.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 1 [0100.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.512] lstrlenW (lpString=".doc") returned 4 [0100.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.512] lstrlenW (lpString=".docx") returned 5 [0100.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.512] lstrlenW (lpString=".pdf") returned 4 [0100.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.512] lstrlenW (lpString=".xls") returned 4 [0100.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.512] lstrlenW (lpString=".xlsx") returned 5 [0100.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.520] lstrlenW (lpString=".ppt") returned 4 [0100.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.520] lstrlenW (lpString=".zip") returned 4 [0100.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.520] lstrlenW (lpString=".rar") returned 4 [0100.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.520] lstrlenW (lpString=".bz2") returned 4 [0100.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.520] lstrlenW (lpString=".7z") returned 3 [0100.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.520] lstrlenW (lpString=".dbf") returned 4 [0100.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.520] lstrlenW (lpString=".1cd") returned 4 [0100.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.520] lstrlenW (lpString=".jpg") returned 4 [0100.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString=".pdf") returned 4 [0100.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString=".xls") returned 4 [0100.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.521] lstrlenW (lpString=".xlsx") returned 5 [0100.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.521] lstrlenW (lpString=".ppt") returned 4 [0100.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.521] lstrlenW (lpString=".zip") returned 4 [0100.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.521] lstrlenW (lpString=".rar") returned 4 [0100.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString=".bz2") returned 4 [0100.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString=".7z") returned 3 [0100.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.521] lstrlenW (lpString=".dbf") returned 4 [0100.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.521] lstrlenW (lpString=".1cd") returned 4 [0100.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 63 [0100.521] lstrlenW (lpString=".jpg") returned 4 [0100.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.521] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") [0100.522] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8684) returned 1 [0100.522] CloseHandle (hObject=0x210) returned 1 [0100.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 0x20 [0100.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.522] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.523] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.523] GetLastError () returned 0x0 [0100.523] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x21ec, lpOverlapped=0x0) returned 1 [0100.525] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0100.526] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.526] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.526] SetEndOfFile (hFile=0x168) returned 1 [0100.526] CloseHandle (hObject=0x168) returned 1 [0100.526] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.526] SetEndOfFile (hFile=0x210) returned 1 [0100.527] CloseHandle (hObject=0x210) returned 1 [0100.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 1 [0100.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.527] lstrlenW (lpString=".doc") returned 4 [0100.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.527] lstrlenW (lpString=".docx") returned 5 [0100.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.527] lstrlenW (lpString=".pdf") returned 4 [0100.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString=".xls") returned 4 [0100.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.528] lstrlenW (lpString=".xlsx") returned 5 [0100.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.528] lstrlenW (lpString=".ppt") returned 4 [0100.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.528] lstrlenW (lpString=".zip") returned 4 [0100.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.528] lstrlenW (lpString=".rar") returned 4 [0100.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString=".bz2") returned 4 [0100.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString=".7z") returned 3 [0100.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.528] lstrlenW (lpString=".dbf") returned 4 [0100.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.528] lstrlenW (lpString=".1cd") returned 4 [0100.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.528] lstrlenW (lpString=".jpg") returned 4 [0100.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString=".pdf") returned 4 [0100.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString=".xls") returned 4 [0100.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.528] lstrlenW (lpString=".xlsx") returned 5 [0100.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.528] lstrlenW (lpString=".ppt") returned 4 [0100.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.529] lstrlenW (lpString=".zip") returned 4 [0100.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.529] lstrlenW (lpString=".rar") returned 4 [0100.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.529] lstrlenW (lpString=".bz2") returned 4 [0100.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.529] lstrlenW (lpString=".7z") returned 3 [0100.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.529] lstrlenW (lpString=".dbf") returned 4 [0100.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.529] lstrlenW (lpString=".1cd") returned 4 [0100.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 63 [0100.529] lstrlenW (lpString=".jpg") returned 4 [0100.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.529] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") [0100.530] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10964) returned 1 [0100.530] CloseHandle (hObject=0x210) returned 1 [0100.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 0x20 [0100.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.531] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.531] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.531] GetLastError () returned 0x0 [0100.531] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2ad4, lpOverlapped=0x0) returned 1 [0100.533] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2ae0, lpOverlapped=0x0) returned 1 [0100.534] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.534] SetEndOfFile (hFile=0x168) returned 1 [0100.534] CloseHandle (hObject=0x168) returned 1 [0100.535] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.535] SetEndOfFile (hFile=0x210) returned 1 [0100.535] CloseHandle (hObject=0x210) returned 1 [0100.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 1 [0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.536] lstrlenW (lpString=".doc") returned 4 [0100.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.536] lstrlenW (lpString=".docx") returned 5 [0100.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.536] lstrlenW (lpString=".pdf") returned 4 [0100.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.536] lstrlenW (lpString=".xls") returned 4 [0100.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.536] lstrlenW (lpString=".xlsx") returned 5 [0100.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.536] lstrlenW (lpString=".ppt") returned 4 [0100.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.536] lstrlenW (lpString=".zip") returned 4 [0100.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.536] lstrlenW (lpString=".rar") returned 4 [0100.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.536] lstrlenW (lpString=".bz2") returned 4 [0100.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.536] lstrlenW (lpString=".7z") returned 3 [0100.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.536] lstrlenW (lpString=".dbf") returned 4 [0100.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.537] lstrlenW (lpString=".1cd") returned 4 [0100.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.537] lstrlenW (lpString=".jpg") returned 4 [0100.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString=".pdf") returned 4 [0100.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString=".xls") returned 4 [0100.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.537] lstrlenW (lpString=".xlsx") returned 5 [0100.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.537] lstrlenW (lpString=".ppt") returned 4 [0100.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.537] lstrlenW (lpString=".zip") returned 4 [0100.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.537] lstrlenW (lpString=".rar") returned 4 [0100.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.537] lstrlenW (lpString=".bz2") returned 4 [0100.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.538] lstrlenW (lpString=".7z") returned 3 [0100.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.538] lstrlenW (lpString=".dbf") returned 4 [0100.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.538] lstrlenW (lpString=".1cd") returned 4 [0100.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 63 [0100.538] lstrlenW (lpString=".jpg") returned 4 [0100.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.538] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") [0100.538] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6474) returned 1 [0100.538] CloseHandle (hObject=0x210) returned 1 [0100.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 0x20 [0100.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.539] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.539] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.539] GetLastError () returned 0x0 [0100.539] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x194a, lpOverlapped=0x0) returned 1 [0100.541] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1950, lpOverlapped=0x0) returned 1 [0100.542] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.542] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.542] SetEndOfFile (hFile=0x168) returned 1 [0100.542] CloseHandle (hObject=0x168) returned 1 [0100.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.542] SetEndOfFile (hFile=0x210) returned 1 [0100.543] CloseHandle (hObject=0x210) returned 1 [0100.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 1 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString=".doc") returned 4 [0100.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString=".docx") returned 5 [0100.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.544] lstrlenW (lpString=".pdf") returned 4 [0100.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString=".xls") returned 4 [0100.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.544] lstrlenW (lpString=".xlsx") returned 5 [0100.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.544] lstrlenW (lpString=".ppt") returned 4 [0100.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString=".zip") returned 4 [0100.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.544] lstrlenW (lpString=".rar") returned 4 [0100.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString=".bz2") returned 4 [0100.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString=".7z") returned 3 [0100.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString=".dbf") returned 4 [0100.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString=".1cd") returned 4 [0100.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.544] lstrlenW (lpString=".jpg") returned 4 [0100.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString=".pdf") returned 4 [0100.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString=".xls") returned 4 [0100.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.545] lstrlenW (lpString=".xlsx") returned 5 [0100.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.545] lstrlenW (lpString=".ppt") returned 4 [0100.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.545] lstrlenW (lpString=".zip") returned 4 [0100.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.545] lstrlenW (lpString=".rar") returned 4 [0100.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString=".bz2") returned 4 [0100.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString=".7z") returned 3 [0100.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.545] lstrlenW (lpString=".dbf") returned 4 [0100.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.545] lstrlenW (lpString=".1cd") returned 4 [0100.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 63 [0100.545] lstrlenW (lpString=".jpg") returned 4 [0100.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.545] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") [0100.546] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=14534) returned 1 [0100.546] CloseHandle (hObject=0x210) returned 1 [0100.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 0x20 [0100.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.546] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.546] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.547] GetLastError () returned 0x0 [0100.547] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x38c6, lpOverlapped=0x0) returned 1 [0100.549] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0100.550] ReadFile (in: hFile=0x210, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.550] WriteFile (in: hFile=0x168, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.550] SetEndOfFile (hFile=0x168) returned 1 [0100.550] CloseHandle (hObject=0x168) returned 1 [0100.550] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.550] SetEndOfFile (hFile=0x210) returned 1 [0100.551] CloseHandle (hObject=0x210) returned 1 [0100.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 1 [0100.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.551] lstrlenW (lpString=".doc") returned 4 [0100.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.551] lstrlenW (lpString=".docx") returned 5 [0100.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.552] lstrlenW (lpString=".pdf") returned 4 [0100.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString=".xls") returned 4 [0100.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.552] lstrlenW (lpString=".xlsx") returned 5 [0100.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.552] lstrlenW (lpString=".ppt") returned 4 [0100.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.552] lstrlenW (lpString=".zip") returned 4 [0100.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.552] lstrlenW (lpString=".rar") returned 4 [0100.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString=".bz2") returned 4 [0100.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString=".7z") returned 3 [0100.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.552] lstrlenW (lpString=".dbf") returned 4 [0100.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.552] lstrlenW (lpString=".1cd") returned 4 [0100.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.552] lstrlenW (lpString=".jpg") returned 4 [0100.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString=".pdf") returned 4 [0100.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.552] lstrlenW (lpString=".xls") returned 4 [0100.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.552] lstrlenW (lpString=".xlsx") returned 5 [0100.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.553] lstrlenW (lpString=".ppt") returned 4 [0100.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.649] lstrlenW (lpString=".zip") returned 4 [0100.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.649] lstrlenW (lpString=".rar") returned 4 [0100.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.649] lstrlenW (lpString=".bz2") returned 4 [0100.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.649] lstrlenW (lpString=".7z") returned 3 [0100.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.649] lstrlenW (lpString=".dbf") returned 4 [0100.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.649] lstrlenW (lpString=".1cd") returned 4 [0100.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 63 [0100.649] lstrlenW (lpString=".jpg") returned 4 [0100.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.650] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") [0100.842] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2360) returned 1 [0100.842] CloseHandle (hObject=0x19c) returned 1 [0100.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 0x20 [0100.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.850] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.850] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0100.874] GetLastError () returned 0x0 [0100.874] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x938, lpOverlapped=0x0) returned 1 [0100.907] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x940, lpOverlapped=0x0) returned 1 [0100.908] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.908] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.908] SetEndOfFile (hFile=0x22c) returned 1 [0100.908] CloseHandle (hObject=0x22c) returned 1 [0100.908] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.908] SetEndOfFile (hFile=0x19c) returned 1 [0100.909] CloseHandle (hObject=0x19c) returned 1 [0100.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 1 [0100.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.909] lstrlenW (lpString=".doc") returned 4 [0100.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.909] lstrlenW (lpString=".docx") returned 5 [0100.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.909] lstrlenW (lpString=".pdf") returned 4 [0100.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString=".xls") returned 4 [0100.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.910] lstrlenW (lpString=".xlsx") returned 5 [0100.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.910] lstrlenW (lpString=".ppt") returned 4 [0100.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.910] lstrlenW (lpString=".zip") returned 4 [0100.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.910] lstrlenW (lpString=".rar") returned 4 [0100.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString=".bz2") returned 4 [0100.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString=".7z") returned 3 [0100.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.910] lstrlenW (lpString=".dbf") returned 4 [0100.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.910] lstrlenW (lpString=".1cd") returned 4 [0100.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.910] lstrlenW (lpString=".jpg") returned 4 [0100.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString=".pdf") returned 4 [0100.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString=".xls") returned 4 [0100.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.910] lstrlenW (lpString=".xlsx") returned 5 [0100.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.910] lstrlenW (lpString=".ppt") returned 4 [0100.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.911] lstrlenW (lpString=".zip") returned 4 [0100.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.911] lstrlenW (lpString=".rar") returned 4 [0100.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.911] lstrlenW (lpString=".bz2") returned 4 [0100.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.911] lstrlenW (lpString=".7z") returned 3 [0100.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.911] lstrlenW (lpString=".dbf") returned 4 [0100.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.911] lstrlenW (lpString=".1cd") returned 4 [0100.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 63 [0100.911] lstrlenW (lpString=".jpg") returned 4 [0100.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.911] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") [0100.912] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31814) returned 1 [0100.912] CloseHandle (hObject=0x19c) returned 1 [0100.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 0x20 [0100.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.912] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.912] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0100.913] GetLastError () returned 0x0 [0100.913] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7c46, lpOverlapped=0x0) returned 1 [0100.921] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0100.922] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.922] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.922] SetEndOfFile (hFile=0x22c) returned 1 [0100.922] CloseHandle (hObject=0x22c) returned 1 [0100.922] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.922] SetEndOfFile (hFile=0x19c) returned 1 [0100.923] CloseHandle (hObject=0x19c) returned 1 [0100.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.924] lstrlenW (lpString=".doc") returned 4 [0100.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.924] lstrlenW (lpString=".docx") returned 5 [0100.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.924] lstrlenW (lpString=".pdf") returned 4 [0100.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.924] lstrlenW (lpString=".xls") returned 4 [0100.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.924] lstrlenW (lpString=".xlsx") returned 5 [0100.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.924] lstrlenW (lpString=".ppt") returned 4 [0100.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.924] lstrlenW (lpString=".zip") returned 4 [0100.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.924] lstrlenW (lpString=".rar") returned 4 [0100.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.924] lstrlenW (lpString=".bz2") returned 4 [0100.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.924] lstrlenW (lpString=".7z") returned 3 [0100.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.924] lstrlenW (lpString=".dbf") returned 4 [0100.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.925] lstrlenW (lpString=".1cd") returned 4 [0100.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.925] lstrlenW (lpString=".jpg") returned 4 [0100.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString=".pdf") returned 4 [0100.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString=".xls") returned 4 [0100.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.925] lstrlenW (lpString=".xlsx") returned 5 [0100.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.925] lstrlenW (lpString=".ppt") returned 4 [0100.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.925] lstrlenW (lpString=".zip") returned 4 [0100.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.925] lstrlenW (lpString=".rar") returned 4 [0100.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString=".bz2") returned 4 [0100.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.925] lstrlenW (lpString=".7z") returned 3 [0100.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.925] lstrlenW (lpString=".dbf") returned 4 [0100.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.926] lstrlenW (lpString=".1cd") returned 4 [0100.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 63 [0100.926] lstrlenW (lpString=".jpg") returned 4 [0100.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.926] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") [0100.932] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21672) returned 1 [0100.932] CloseHandle (hObject=0x1a0) returned 1 [0100.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 0x20 [0100.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0100.932] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.933] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.933] GetLastError () returned 0x0 [0100.933] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x54a8, lpOverlapped=0x0) returned 1 [0100.938] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x54b0, lpOverlapped=0x0) returned 1 [0100.939] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.939] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.939] SetEndOfFile (hFile=0x19c) returned 1 [0100.939] CloseHandle (hObject=0x19c) returned 1 [0100.939] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.939] SetEndOfFile (hFile=0x1a0) returned 1 [0100.940] CloseHandle (hObject=0x1a0) returned 1 [0100.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 1 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString=".doc") returned 4 [0100.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString=".docx") returned 5 [0100.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.941] lstrlenW (lpString=".pdf") returned 4 [0100.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString=".xls") returned 4 [0100.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.941] lstrlenW (lpString=".xlsx") returned 5 [0100.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.941] lstrlenW (lpString=".ppt") returned 4 [0100.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString=".zip") returned 4 [0100.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.941] lstrlenW (lpString=".rar") returned 4 [0100.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString=".bz2") returned 4 [0100.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString=".7z") returned 3 [0100.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString=".dbf") returned 4 [0100.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString=".1cd") returned 4 [0100.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.941] lstrlenW (lpString=".jpg") returned 4 [0100.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.941] lstrlenW (lpString=".pdf") returned 4 [0100.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString=".xls") returned 4 [0100.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.942] lstrlenW (lpString=".xlsx") returned 5 [0100.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.942] lstrlenW (lpString=".ppt") returned 4 [0100.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.942] lstrlenW (lpString=".zip") returned 4 [0100.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.942] lstrlenW (lpString=".rar") returned 4 [0100.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString=".bz2") returned 4 [0100.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString=".7z") returned 3 [0100.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.942] lstrlenW (lpString=".dbf") returned 4 [0100.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.942] lstrlenW (lpString=".1cd") returned 4 [0100.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 63 [0100.942] lstrlenW (lpString=".jpg") returned 4 [0100.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.942] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") [0100.943] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6782) returned 1 [0100.943] CloseHandle (hObject=0x1a0) returned 1 [0100.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 0x20 [0100.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0100.943] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.943] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.944] GetLastError () returned 0x0 [0100.944] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1a7e, lpOverlapped=0x0) returned 1 [0100.947] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0100.948] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.948] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.948] SetEndOfFile (hFile=0x19c) returned 1 [0100.948] CloseHandle (hObject=0x19c) returned 1 [0100.948] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.948] SetEndOfFile (hFile=0x1a0) returned 1 [0100.949] CloseHandle (hObject=0x1a0) returned 1 [0100.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 1 [0100.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.950] lstrlenW (lpString=".doc") returned 4 [0100.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.950] lstrlenW (lpString=".docx") returned 5 [0100.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.950] lstrlenW (lpString=".pdf") returned 4 [0100.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.950] lstrlenW (lpString=".xls") returned 4 [0100.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.950] lstrlenW (lpString=".xlsx") returned 5 [0100.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.950] lstrlenW (lpString=".ppt") returned 4 [0100.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.950] lstrlenW (lpString=".zip") returned 4 [0100.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.950] lstrlenW (lpString=".rar") returned 4 [0100.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.950] lstrlenW (lpString=".bz2") returned 4 [0100.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.950] lstrlenW (lpString=".7z") returned 3 [0100.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.950] lstrlenW (lpString=".dbf") returned 4 [0100.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".1cd") returned 4 [0100.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".jpg") returned 4 [0100.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString=".pdf") returned 4 [0100.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString=".xls") returned 4 [0100.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.951] lstrlenW (lpString=".xlsx") returned 5 [0100.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.951] lstrlenW (lpString=".ppt") returned 4 [0100.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".zip") returned 4 [0100.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.951] lstrlenW (lpString=".rar") returned 4 [0100.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString=".bz2") returned 4 [0100.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString=".7z") returned 3 [0100.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".dbf") returned 4 [0100.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".1cd") returned 4 [0100.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 63 [0100.951] lstrlenW (lpString=".jpg") returned 4 [0100.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.952] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") [0100.952] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7680) returned 1 [0100.952] CloseHandle (hObject=0x1a0) returned 1 [0100.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 0x20 [0100.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0100.952] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.953] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.953] GetLastError () returned 0x0 [0100.953] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1e00, lpOverlapped=0x0) returned 1 [0101.051] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0101.052] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.052] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.052] SetEndOfFile (hFile=0x19c) returned 1 [0101.053] CloseHandle (hObject=0x19c) returned 1 [0101.053] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.053] SetEndOfFile (hFile=0x1a0) returned 1 [0101.054] CloseHandle (hObject=0x1a0) returned 1 [0101.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 1 [0101.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.129] lstrlenW (lpString=".doc") returned 4 [0101.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.129] lstrlenW (lpString=".docx") returned 5 [0101.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.129] lstrlenW (lpString=".pdf") returned 4 [0101.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.129] lstrlenW (lpString=".xls") returned 4 [0101.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.129] lstrlenW (lpString=".xlsx") returned 5 [0101.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.129] lstrlenW (lpString=".ppt") returned 4 [0101.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.129] lstrlenW (lpString=".zip") returned 4 [0101.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.130] lstrlenW (lpString=".rar") returned 4 [0101.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".bz2") returned 4 [0101.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".7z") returned 3 [0101.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.130] lstrlenW (lpString=".dbf") returned 4 [0101.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.130] lstrlenW (lpString=".1cd") returned 4 [0101.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.130] lstrlenW (lpString=".jpg") returned 4 [0101.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".pdf") returned 4 [0101.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".xls") returned 4 [0101.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.130] lstrlenW (lpString=".xlsx") returned 5 [0101.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.130] lstrlenW (lpString=".ppt") returned 4 [0101.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.130] lstrlenW (lpString=".zip") returned 4 [0101.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.130] lstrlenW (lpString=".rar") returned 4 [0101.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".bz2") returned 4 [0101.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.130] lstrlenW (lpString=".7z") returned 3 [0101.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.131] lstrlenW (lpString=".dbf") returned 4 [0101.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.131] lstrlenW (lpString=".1cd") returned 4 [0101.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 63 [0101.131] lstrlenW (lpString=".jpg") returned 4 [0101.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.131] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") [0101.227] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5780) returned 1 [0101.227] CloseHandle (hObject=0x1f4) returned 1 [0101.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 0x20 [0101.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0101.227] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.227] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0101.228] GetLastError () returned 0x0 [0101.228] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1694, lpOverlapped=0x0) returned 1 [0101.303] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16a0, lpOverlapped=0x0) returned 1 [0101.305] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.305] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.305] SetEndOfFile (hFile=0x1b8) returned 1 [0101.305] CloseHandle (hObject=0x1b8) returned 1 [0101.305] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.305] SetEndOfFile (hFile=0x1f4) returned 1 [0101.306] CloseHandle (hObject=0x1f4) returned 1 [0101.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 1 [0101.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.480] lstrlenW (lpString=".doc") returned 4 [0101.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.480] lstrlenW (lpString=".docx") returned 5 [0101.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.480] lstrlenW (lpString=".pdf") returned 4 [0101.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.480] lstrlenW (lpString=".xls") returned 4 [0101.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.480] lstrlenW (lpString=".xlsx") returned 5 [0101.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.480] lstrlenW (lpString=".ppt") returned 4 [0101.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.488] lstrlenW (lpString=".zip") returned 4 [0101.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.488] lstrlenW (lpString=".rar") returned 4 [0101.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.488] lstrlenW (lpString=".bz2") returned 4 [0101.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.488] lstrlenW (lpString=".7z") returned 3 [0101.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.488] lstrlenW (lpString=".dbf") returned 4 [0101.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.504] lstrlenW (lpString=".1cd") returned 4 [0101.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.504] lstrlenW (lpString=".jpg") returned 4 [0101.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString=".pdf") returned 4 [0101.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString=".xls") returned 4 [0101.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.504] lstrlenW (lpString=".xlsx") returned 5 [0101.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.504] lstrlenW (lpString=".ppt") returned 4 [0101.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.504] lstrlenW (lpString=".zip") returned 4 [0101.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.504] lstrlenW (lpString=".rar") returned 4 [0101.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString=".bz2") returned 4 [0101.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.504] lstrlenW (lpString=".7z") returned 3 [0101.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.505] lstrlenW (lpString=".dbf") returned 4 [0101.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.505] lstrlenW (lpString=".1cd") returned 4 [0101.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 63 [0101.505] lstrlenW (lpString=".jpg") returned 4 [0101.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.505] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") [0102.314] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7028) returned 1 [0102.314] CloseHandle (hObject=0x1fc) returned 1 [0102.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 0x20 [0102.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.434] GetLastError () returned 0x0 [0102.434] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1b74, lpOverlapped=0x0) returned 1 [0102.459] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0102.460] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.460] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.461] SetEndOfFile (hFile=0x19c) returned 1 [0102.461] CloseHandle (hObject=0x19c) returned 1 [0102.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.461] SetEndOfFile (hFile=0x1fc) returned 1 [0102.462] CloseHandle (hObject=0x1fc) returned 1 [0102.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 1 [0102.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.462] lstrlenW (lpString=".doc") returned 4 [0102.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.462] lstrlenW (lpString=".docx") returned 5 [0102.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.462] lstrlenW (lpString=".pdf") returned 4 [0102.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.462] lstrlenW (lpString=".xls") returned 4 [0102.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.462] lstrlenW (lpString=".xlsx") returned 5 [0102.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.462] lstrlenW (lpString=".ppt") returned 4 [0102.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.462] lstrlenW (lpString=".zip") returned 4 [0102.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.462] lstrlenW (lpString=".rar") returned 4 [0102.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".bz2") returned 4 [0102.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".7z") returned 3 [0102.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.463] lstrlenW (lpString=".dbf") returned 4 [0102.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.463] lstrlenW (lpString=".1cd") returned 4 [0102.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.463] lstrlenW (lpString=".jpg") returned 4 [0102.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".pdf") returned 4 [0102.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".xls") returned 4 [0102.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.463] lstrlenW (lpString=".xlsx") returned 5 [0102.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.463] lstrlenW (lpString=".ppt") returned 4 [0102.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.463] lstrlenW (lpString=".zip") returned 4 [0102.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.463] lstrlenW (lpString=".rar") returned 4 [0102.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".bz2") returned 4 [0102.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString=".7z") returned 3 [0102.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.463] lstrlenW (lpString=".dbf") returned 4 [0102.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.464] lstrlenW (lpString=".1cd") returned 4 [0102.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 63 [0102.464] lstrlenW (lpString=".jpg") returned 4 [0102.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.464] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") [0102.464] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1644) returned 1 [0102.464] CloseHandle (hObject=0x1fc) returned 1 [0102.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 0x20 [0102.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.465] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.465] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.465] GetLastError () returned 0x0 [0102.465] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x66c, lpOverlapped=0x0) returned 1 [0102.467] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x670, lpOverlapped=0x0) returned 1 [0102.468] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.468] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.468] SetEndOfFile (hFile=0x19c) returned 1 [0102.468] CloseHandle (hObject=0x19c) returned 1 [0102.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.468] SetEndOfFile (hFile=0x1fc) returned 1 [0102.469] CloseHandle (hObject=0x1fc) returned 1 [0102.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.470] lstrlenW (lpString=".doc") returned 4 [0102.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString=".docx") returned 5 [0102.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.470] lstrlenW (lpString=".pdf") returned 4 [0102.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString=".xls") returned 4 [0102.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.470] lstrlenW (lpString=".xlsx") returned 5 [0102.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.470] lstrlenW (lpString=".ppt") returned 4 [0102.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.470] lstrlenW (lpString=".zip") returned 4 [0102.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.470] lstrlenW (lpString=".rar") returned 4 [0102.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString=".bz2") returned 4 [0102.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString=".7z") returned 3 [0102.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.470] lstrlenW (lpString=".dbf") returned 4 [0102.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.470] lstrlenW (lpString=".1cd") returned 4 [0102.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.471] lstrlenW (lpString=".jpg") returned 4 [0102.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString=".pdf") returned 4 [0102.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString=".xls") returned 4 [0102.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.471] lstrlenW (lpString=".xlsx") returned 5 [0102.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.471] lstrlenW (lpString=".ppt") returned 4 [0102.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.471] lstrlenW (lpString=".zip") returned 4 [0102.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.471] lstrlenW (lpString=".rar") returned 4 [0102.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString=".bz2") returned 4 [0102.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString=".7z") returned 3 [0102.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.471] lstrlenW (lpString=".dbf") returned 4 [0102.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.471] lstrlenW (lpString=".1cd") returned 4 [0102.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 63 [0102.471] lstrlenW (lpString=".jpg") returned 4 [0102.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.471] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") [0102.472] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=672) returned 1 [0102.472] CloseHandle (hObject=0x1fc) returned 1 [0102.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 0x20 [0102.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.473] GetLastError () returned 0x0 [0102.473] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2a0, lpOverlapped=0x0) returned 1 [0102.474] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0102.475] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.475] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.475] SetEndOfFile (hFile=0x19c) returned 1 [0102.475] CloseHandle (hObject=0x19c) returned 1 [0102.475] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.475] SetEndOfFile (hFile=0x1fc) returned 1 [0102.476] CloseHandle (hObject=0x1fc) returned 1 [0102.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.476] lstrlenW (lpString=".doc") returned 4 [0102.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString=".docx") returned 5 [0102.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.477] lstrlenW (lpString=".pdf") returned 4 [0102.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString=".xls") returned 4 [0102.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.477] lstrlenW (lpString=".xlsx") returned 5 [0102.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.477] lstrlenW (lpString=".ppt") returned 4 [0102.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.477] lstrlenW (lpString=".zip") returned 4 [0102.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.477] lstrlenW (lpString=".rar") returned 4 [0102.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString=".bz2") returned 4 [0102.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString=".7z") returned 3 [0102.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.477] lstrlenW (lpString=".dbf") returned 4 [0102.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.477] lstrlenW (lpString=".1cd") returned 4 [0102.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.477] lstrlenW (lpString=".jpg") returned 4 [0102.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString=".pdf") returned 4 [0102.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.477] lstrlenW (lpString=".xls") returned 4 [0102.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.478] lstrlenW (lpString=".xlsx") returned 5 [0102.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.478] lstrlenW (lpString=".ppt") returned 4 [0102.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.478] lstrlenW (lpString=".zip") returned 4 [0102.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.478] lstrlenW (lpString=".rar") returned 4 [0102.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.478] lstrlenW (lpString=".bz2") returned 4 [0102.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.478] lstrlenW (lpString=".7z") returned 3 [0102.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.478] lstrlenW (lpString=".dbf") returned 4 [0102.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.478] lstrlenW (lpString=".1cd") returned 4 [0102.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 63 [0102.478] lstrlenW (lpString=".jpg") returned 4 [0102.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.478] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") [0102.479] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8168) returned 1 [0102.479] CloseHandle (hObject=0x1fc) returned 1 [0102.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 0x20 [0102.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.479] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.479] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.480] GetLastError () returned 0x0 [0102.480] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1fe8, lpOverlapped=0x0) returned 1 [0102.482] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ff0, lpOverlapped=0x0) returned 1 [0102.483] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.483] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.483] SetEndOfFile (hFile=0x19c) returned 1 [0102.483] CloseHandle (hObject=0x19c) returned 1 [0102.483] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.483] SetEndOfFile (hFile=0x1fc) returned 1 [0102.484] CloseHandle (hObject=0x1fc) returned 1 [0102.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 1 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.484] lstrlenW (lpString=".doc") returned 4 [0102.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.484] lstrlenW (lpString=".docx") returned 5 [0102.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.484] lstrlenW (lpString=".pdf") returned 4 [0102.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.484] lstrlenW (lpString=".xls") returned 4 [0102.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.484] lstrlenW (lpString=".xlsx") returned 5 [0102.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.485] lstrlenW (lpString=".ppt") returned 4 [0102.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.485] lstrlenW (lpString=".zip") returned 4 [0102.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.485] lstrlenW (lpString=".rar") returned 4 [0102.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString=".bz2") returned 4 [0102.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString=".7z") returned 3 [0102.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.485] lstrlenW (lpString=".dbf") returned 4 [0102.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.485] lstrlenW (lpString=".1cd") returned 4 [0102.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.485] lstrlenW (lpString=".jpg") returned 4 [0102.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString=".pdf") returned 4 [0102.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString=".xls") returned 4 [0102.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.485] lstrlenW (lpString=".xlsx") returned 5 [0102.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.485] lstrlenW (lpString=".ppt") returned 4 [0102.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.485] lstrlenW (lpString=".zip") returned 4 [0102.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.485] lstrlenW (lpString=".rar") returned 4 [0102.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.486] lstrlenW (lpString=".bz2") returned 4 [0102.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.486] lstrlenW (lpString=".7z") returned 3 [0102.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.486] lstrlenW (lpString=".dbf") returned 4 [0102.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.486] lstrlenW (lpString=".1cd") returned 4 [0102.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 63 [0102.486] lstrlenW (lpString=".jpg") returned 4 [0102.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.486] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") [0102.487] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18454) returned 1 [0102.487] CloseHandle (hObject=0x1fc) returned 1 [0102.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 0x20 [0102.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.488] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.488] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.488] GetLastError () returned 0x0 [0102.488] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4816, lpOverlapped=0x0) returned 1 [0102.614] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4820, lpOverlapped=0x0) returned 1 [0102.615] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.615] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.615] SetEndOfFile (hFile=0x19c) returned 1 [0102.616] CloseHandle (hObject=0x19c) returned 1 [0102.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.616] SetEndOfFile (hFile=0x1fc) returned 1 [0102.617] CloseHandle (hObject=0x1fc) returned 1 [0102.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 1 [0102.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.617] lstrlenW (lpString=".doc") returned 4 [0102.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.617] lstrlenW (lpString=".docx") returned 5 [0102.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.617] lstrlenW (lpString=".pdf") returned 4 [0102.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.617] lstrlenW (lpString=".xls") returned 4 [0102.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.617] lstrlenW (lpString=".xlsx") returned 5 [0102.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.617] lstrlenW (lpString=".ppt") returned 4 [0102.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.617] lstrlenW (lpString=".zip") returned 4 [0102.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.617] lstrlenW (lpString=".rar") returned 4 [0102.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".bz2") returned 4 [0102.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".7z") returned 3 [0102.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.618] lstrlenW (lpString=".dbf") returned 4 [0102.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.618] lstrlenW (lpString=".1cd") returned 4 [0102.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.618] lstrlenW (lpString=".jpg") returned 4 [0102.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".pdf") returned 4 [0102.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".xls") returned 4 [0102.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.618] lstrlenW (lpString=".xlsx") returned 5 [0102.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.618] lstrlenW (lpString=".ppt") returned 4 [0102.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.618] lstrlenW (lpString=".zip") returned 4 [0102.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.618] lstrlenW (lpString=".rar") returned 4 [0102.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".bz2") returned 4 [0102.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.618] lstrlenW (lpString=".7z") returned 3 [0102.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.618] lstrlenW (lpString=".dbf") returned 4 [0102.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.619] lstrlenW (lpString=".1cd") returned 4 [0102.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 63 [0102.619] lstrlenW (lpString=".jpg") returned 4 [0102.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.619] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") [0102.619] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3328) returned 1 [0102.619] CloseHandle (hObject=0x1fc) returned 1 [0102.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 0x20 [0102.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.620] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.620] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0102.831] GetLastError () returned 0x0 [0102.832] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd00, lpOverlapped=0x0) returned 1 [0102.834] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0102.835] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.835] WriteFile (in: hFile=0x19c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.835] SetEndOfFile (hFile=0x19c) returned 1 [0102.835] CloseHandle (hObject=0x19c) returned 1 [0102.835] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.835] SetEndOfFile (hFile=0x1fc) returned 1 [0102.836] CloseHandle (hObject=0x1fc) returned 1 [0102.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 1 [0102.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.963] lstrlenW (lpString=".doc") returned 4 [0102.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.963] lstrlenW (lpString=".docx") returned 5 [0102.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.964] lstrlenW (lpString=".pdf") returned 4 [0102.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString=".xls") returned 4 [0102.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.964] lstrlenW (lpString=".xlsx") returned 5 [0102.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.964] lstrlenW (lpString=".ppt") returned 4 [0102.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.964] lstrlenW (lpString=".zip") returned 4 [0102.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.964] lstrlenW (lpString=".rar") returned 4 [0102.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString=".bz2") returned 4 [0102.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString=".7z") returned 3 [0102.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.964] lstrlenW (lpString=".dbf") returned 4 [0102.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.964] lstrlenW (lpString=".1cd") returned 4 [0102.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.964] lstrlenW (lpString=".jpg") returned 4 [0102.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString=".pdf") returned 4 [0102.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.964] lstrlenW (lpString=".xls") returned 4 [0102.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.964] lstrlenW (lpString=".xlsx") returned 5 [0102.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.964] lstrlenW (lpString=".ppt") returned 4 [0102.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.965] lstrlenW (lpString=".zip") returned 4 [0102.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.965] lstrlenW (lpString=".rar") returned 4 [0102.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.965] lstrlenW (lpString=".bz2") returned 4 [0102.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.965] lstrlenW (lpString=".7z") returned 3 [0102.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.965] lstrlenW (lpString=".dbf") returned 4 [0102.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.965] lstrlenW (lpString=".1cd") returned 4 [0102.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 63 [0102.965] lstrlenW (lpString=".jpg") returned 4 [0102.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.965] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") [0102.977] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20608) returned 1 [0102.977] CloseHandle (hObject=0x1a0) returned 1 [0102.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 0x20 [0102.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.978] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.978] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.979] GetLastError () returned 0x0 [0102.979] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5080, lpOverlapped=0x0) returned 1 [0102.980] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5090, lpOverlapped=0x0) returned 1 [0102.982] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.982] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.982] SetEndOfFile (hFile=0x15c) returned 1 [0102.982] CloseHandle (hObject=0x15c) returned 1 [0102.982] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.982] SetEndOfFile (hFile=0x1a0) returned 1 [0102.983] CloseHandle (hObject=0x1a0) returned 1 [0102.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.983] lstrlenW (lpString=".doc") returned 4 [0102.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.983] lstrlenW (lpString=".docx") returned 5 [0102.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0102.983] lstrlenW (lpString=".pdf") returned 4 [0102.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.983] lstrlenW (lpString=".xls") returned 4 [0102.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.984] lstrlenW (lpString=".xlsx") returned 5 [0102.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.984] lstrlenW (lpString=".ppt") returned 4 [0102.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.984] lstrlenW (lpString=".zip") returned 4 [0102.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.984] lstrlenW (lpString=".rar") returned 4 [0102.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString=".bz2") returned 4 [0102.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString=".7z") returned 3 [0102.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.984] lstrlenW (lpString=".dbf") returned 4 [0102.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.984] lstrlenW (lpString=".1cd") returned 4 [0102.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.984] lstrlenW (lpString=".jpg") returned 4 [0102.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString=".pdf") returned 4 [0102.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString=".xls") returned 4 [0102.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.984] lstrlenW (lpString=".xlsx") returned 5 [0102.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0102.984] lstrlenW (lpString=".ppt") returned 4 [0102.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.984] lstrlenW (lpString=".zip") returned 4 [0102.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.984] lstrlenW (lpString=".rar") returned 4 [0102.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.985] lstrlenW (lpString=".bz2") returned 4 [0102.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.985] lstrlenW (lpString=".7z") returned 3 [0102.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.985] lstrlenW (lpString=".dbf") returned 4 [0102.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.985] lstrlenW (lpString=".1cd") returned 4 [0102.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 63 [0102.985] lstrlenW (lpString=".jpg") returned 4 [0102.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.985] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") [0102.985] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10476) returned 1 [0102.986] CloseHandle (hObject=0x1a0) returned 1 [0102.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 0x20 [0102.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.986] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.986] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0102.987] GetLastError () returned 0x0 [0102.987] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x28ec, lpOverlapped=0x0) returned 1 [0103.022] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x28f0, lpOverlapped=0x0) returned 1 [0103.023] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.024] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.024] SetEndOfFile (hFile=0x15c) returned 1 [0103.024] CloseHandle (hObject=0x15c) returned 1 [0103.024] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.024] SetEndOfFile (hFile=0x1a0) returned 1 [0103.025] CloseHandle (hObject=0x1a0) returned 1 [0103.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 1 [0103.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.025] lstrlenW (lpString=".doc") returned 4 [0103.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.025] lstrlenW (lpString=".docx") returned 5 [0103.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.025] lstrlenW (lpString=".pdf") returned 4 [0103.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString=".xls") returned 4 [0103.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.026] lstrlenW (lpString=".xlsx") returned 5 [0103.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.026] lstrlenW (lpString=".ppt") returned 4 [0103.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.026] lstrlenW (lpString=".zip") returned 4 [0103.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.026] lstrlenW (lpString=".rar") returned 4 [0103.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString=".bz2") returned 4 [0103.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString=".7z") returned 3 [0103.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.026] lstrlenW (lpString=".dbf") returned 4 [0103.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.026] lstrlenW (lpString=".1cd") returned 4 [0103.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.026] lstrlenW (lpString=".jpg") returned 4 [0103.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString=".pdf") returned 4 [0103.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString=".xls") returned 4 [0103.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.026] lstrlenW (lpString=".xlsx") returned 5 [0103.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.026] lstrlenW (lpString=".ppt") returned 4 [0103.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.027] lstrlenW (lpString=".zip") returned 4 [0103.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.027] lstrlenW (lpString=".rar") returned 4 [0103.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.027] lstrlenW (lpString=".bz2") returned 4 [0103.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.027] lstrlenW (lpString=".7z") returned 3 [0103.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.027] lstrlenW (lpString=".dbf") returned 4 [0103.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.027] lstrlenW (lpString=".1cd") returned 4 [0103.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 63 [0103.027] lstrlenW (lpString=".jpg") returned 4 [0103.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.027] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") [0103.053] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1340) returned 1 [0103.053] CloseHandle (hObject=0x1c0) returned 1 [0103.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 0x20 [0103.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0103.053] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.053] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0103.054] GetLastError () returned 0x0 [0103.054] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x53c, lpOverlapped=0x0) returned 1 [0103.206] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x540, lpOverlapped=0x0) returned 1 [0103.207] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.207] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.207] SetEndOfFile (hFile=0x210) returned 1 [0103.207] CloseHandle (hObject=0x210) returned 1 [0103.207] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.208] SetEndOfFile (hFile=0x1c0) returned 1 [0103.208] CloseHandle (hObject=0x1c0) returned 1 [0103.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 1 [0103.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.209] lstrlenW (lpString=".doc") returned 4 [0103.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.209] lstrlenW (lpString=".docx") returned 5 [0103.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.209] lstrlenW (lpString=".pdf") returned 4 [0103.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.209] lstrlenW (lpString=".xls") returned 4 [0103.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.209] lstrlenW (lpString=".xlsx") returned 5 [0103.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.209] lstrlenW (lpString=".ppt") returned 4 [0103.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.210] lstrlenW (lpString=".zip") returned 4 [0103.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.210] lstrlenW (lpString=".rar") returned 4 [0103.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString=".bz2") returned 4 [0103.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString=".7z") returned 3 [0103.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.210] lstrlenW (lpString=".dbf") returned 4 [0103.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.210] lstrlenW (lpString=".1cd") returned 4 [0103.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.210] lstrlenW (lpString=".jpg") returned 4 [0103.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString=".pdf") returned 4 [0103.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.210] lstrlenW (lpString=".xls") returned 4 [0103.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.210] lstrlenW (lpString=".xlsx") returned 5 [0103.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.210] lstrlenW (lpString=".ppt") returned 4 [0103.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.211] lstrlenW (lpString=".zip") returned 4 [0103.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.211] lstrlenW (lpString=".rar") returned 4 [0103.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.211] lstrlenW (lpString=".bz2") returned 4 [0103.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.211] lstrlenW (lpString=".7z") returned 3 [0103.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.211] lstrlenW (lpString=".dbf") returned 4 [0103.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.211] lstrlenW (lpString=".1cd") returned 4 [0103.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 63 [0103.211] lstrlenW (lpString=".jpg") returned 4 [0103.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.211] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") [0103.212] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5172) returned 1 [0103.212] CloseHandle (hObject=0x1c0) returned 1 [0103.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 0x20 [0103.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0103.212] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.212] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0103.213] GetLastError () returned 0x0 [0103.213] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1434, lpOverlapped=0x0) returned 1 [0103.352] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0103.353] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.353] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.353] SetEndOfFile (hFile=0x210) returned 1 [0103.353] CloseHandle (hObject=0x210) returned 1 [0103.353] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.353] SetEndOfFile (hFile=0x1c0) returned 1 [0103.354] CloseHandle (hObject=0x1c0) returned 1 [0103.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 1 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString=".doc") returned 4 [0103.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString=".docx") returned 5 [0103.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.355] lstrlenW (lpString=".pdf") returned 4 [0103.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString=".xls") returned 4 [0103.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.355] lstrlenW (lpString=".xlsx") returned 5 [0103.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.355] lstrlenW (lpString=".ppt") returned 4 [0103.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString=".zip") returned 4 [0103.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.355] lstrlenW (lpString=".rar") returned 4 [0103.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString=".bz2") returned 4 [0103.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString=".7z") returned 3 [0103.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString=".dbf") returned 4 [0103.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString=".1cd") returned 4 [0103.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.355] lstrlenW (lpString=".jpg") returned 4 [0103.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString=".pdf") returned 4 [0103.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString=".xls") returned 4 [0103.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.356] lstrlenW (lpString=".xlsx") returned 5 [0103.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.356] lstrlenW (lpString=".ppt") returned 4 [0103.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.356] lstrlenW (lpString=".zip") returned 4 [0103.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.356] lstrlenW (lpString=".rar") returned 4 [0103.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString=".bz2") returned 4 [0103.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString=".7z") returned 3 [0103.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.356] lstrlenW (lpString=".dbf") returned 4 [0103.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.356] lstrlenW (lpString=".1cd") returned 4 [0103.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 63 [0103.356] lstrlenW (lpString=".jpg") returned 4 [0103.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.356] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") [0103.358] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2612) returned 1 [0103.358] CloseHandle (hObject=0x1c0) returned 1 [0103.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 0x20 [0103.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0103.358] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.358] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0103.359] GetLastError () returned 0x0 [0103.359] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa34, lpOverlapped=0x0) returned 1 [0103.420] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa40, lpOverlapped=0x0) returned 1 [0103.421] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.421] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.421] SetEndOfFile (hFile=0x210) returned 1 [0103.715] CloseHandle (hObject=0x210) returned 1 [0103.715] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.715] SetEndOfFile (hFile=0x1c0) returned 1 [0103.716] CloseHandle (hObject=0x1c0) returned 1 [0103.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.731] lstrlenW (lpString=".doc") returned 4 [0103.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString=".docx") returned 5 [0103.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.731] lstrlenW (lpString=".pdf") returned 4 [0103.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString=".xls") returned 4 [0103.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.731] lstrlenW (lpString=".xlsx") returned 5 [0103.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.731] lstrlenW (lpString=".ppt") returned 4 [0103.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.731] lstrlenW (lpString=".zip") returned 4 [0103.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.731] lstrlenW (lpString=".rar") returned 4 [0103.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString=".bz2") returned 4 [0103.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString=".7z") returned 3 [0103.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.731] lstrlenW (lpString=".dbf") returned 4 [0103.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".1cd") returned 4 [0103.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".jpg") returned 4 [0103.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString=".pdf") returned 4 [0103.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString=".xls") returned 4 [0103.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.732] lstrlenW (lpString=".xlsx") returned 5 [0103.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.732] lstrlenW (lpString=".ppt") returned 4 [0103.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".zip") returned 4 [0103.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.732] lstrlenW (lpString=".rar") returned 4 [0103.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString=".bz2") returned 4 [0103.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString=".7z") returned 3 [0103.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".dbf") returned 4 [0103.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".1cd") returned 4 [0103.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 63 [0103.732] lstrlenW (lpString=".jpg") returned 4 [0103.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.732] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") [0103.754] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3388) returned 1 [0103.754] CloseHandle (hObject=0x1a0) returned 1 [0103.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 0x20 [0103.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.763] GetLastError () returned 0x0 [0103.764] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xd3c, lpOverlapped=0x0) returned 1 [0103.781] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0103.782] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.782] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.782] SetEndOfFile (hFile=0x15c) returned 1 [0103.782] CloseHandle (hObject=0x15c) returned 1 [0103.782] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.782] SetEndOfFile (hFile=0x1a0) returned 1 [0103.783] CloseHandle (hObject=0x1a0) returned 1 [0103.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 1 [0103.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.783] lstrlenW (lpString=".doc") returned 4 [0103.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".docx") returned 5 [0103.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.784] lstrlenW (lpString=".pdf") returned 4 [0103.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".xls") returned 4 [0103.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.784] lstrlenW (lpString=".xlsx") returned 5 [0103.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.784] lstrlenW (lpString=".ppt") returned 4 [0103.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.784] lstrlenW (lpString=".zip") returned 4 [0103.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.784] lstrlenW (lpString=".rar") returned 4 [0103.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".bz2") returned 4 [0103.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".7z") returned 3 [0103.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.784] lstrlenW (lpString=".dbf") returned 4 [0103.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.784] lstrlenW (lpString=".1cd") returned 4 [0103.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.784] lstrlenW (lpString=".jpg") returned 4 [0103.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".pdf") returned 4 [0103.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.784] lstrlenW (lpString=".xls") returned 4 [0103.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.785] lstrlenW (lpString=".xlsx") returned 5 [0103.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.785] lstrlenW (lpString=".ppt") returned 4 [0103.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.785] lstrlenW (lpString=".zip") returned 4 [0103.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.785] lstrlenW (lpString=".rar") returned 4 [0103.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.785] lstrlenW (lpString=".bz2") returned 4 [0103.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.785] lstrlenW (lpString=".7z") returned 3 [0103.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.785] lstrlenW (lpString=".dbf") returned 4 [0103.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.785] lstrlenW (lpString=".1cd") returned 4 [0103.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 63 [0103.785] lstrlenW (lpString=".jpg") returned 4 [0103.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.785] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") [0103.786] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=19736) returned 1 [0103.786] CloseHandle (hObject=0x1a0) returned 1 [0103.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x20 [0103.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.786] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.786] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.787] GetLastError () returned 0x0 [0103.787] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4d18, lpOverlapped=0x0) returned 1 [0103.789] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4d20, lpOverlapped=0x0) returned 1 [0103.790] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.790] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.790] SetEndOfFile (hFile=0x15c) returned 1 [0103.790] CloseHandle (hObject=0x15c) returned 1 [0103.790] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.790] SetEndOfFile (hFile=0x1a0) returned 1 [0103.791] CloseHandle (hObject=0x1a0) returned 1 [0103.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 1 [0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.792] lstrlenW (lpString=".doc") returned 4 [0103.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.792] lstrlenW (lpString=".docx") returned 5 [0103.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.792] lstrlenW (lpString=".pdf") returned 4 [0103.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.792] lstrlenW (lpString=".xls") returned 4 [0103.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.792] lstrlenW (lpString=".xlsx") returned 5 [0103.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.792] lstrlenW (lpString=".ppt") returned 4 [0103.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.792] lstrlenW (lpString=".zip") returned 4 [0103.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.792] lstrlenW (lpString=".rar") returned 4 [0103.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString=".bz2") returned 4 [0103.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString=".7z") returned 3 [0103.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.793] lstrlenW (lpString=".dbf") returned 4 [0103.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.793] lstrlenW (lpString=".1cd") returned 4 [0103.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.793] lstrlenW (lpString=".jpg") returned 4 [0103.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString=".pdf") returned 4 [0103.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString=".xls") returned 4 [0103.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.793] lstrlenW (lpString=".xlsx") returned 5 [0103.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.793] lstrlenW (lpString=".ppt") returned 4 [0103.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.793] lstrlenW (lpString=".zip") returned 4 [0103.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.793] lstrlenW (lpString=".rar") returned 4 [0103.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.793] lstrlenW (lpString=".bz2") returned 4 [0103.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.794] lstrlenW (lpString=".7z") returned 3 [0103.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.794] lstrlenW (lpString=".dbf") returned 4 [0103.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.794] lstrlenW (lpString=".1cd") returned 4 [0103.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 63 [0103.794] lstrlenW (lpString=".jpg") returned 4 [0103.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.794] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") [0103.795] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18412) returned 1 [0103.795] CloseHandle (hObject=0x1a0) returned 1 [0103.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 0x20 [0103.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.795] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.795] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.796] GetLastError () returned 0x0 [0103.796] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x47ec, lpOverlapped=0x0) returned 1 [0103.797] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0103.799] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.799] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.799] SetEndOfFile (hFile=0x15c) returned 1 [0103.799] CloseHandle (hObject=0x15c) returned 1 [0103.799] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.799] SetEndOfFile (hFile=0x1a0) returned 1 [0103.800] CloseHandle (hObject=0x1a0) returned 1 [0103.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 1 [0103.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.801] lstrlenW (lpString=".doc") returned 4 [0103.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.801] lstrlenW (lpString=".docx") returned 5 [0103.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.801] lstrlenW (lpString=".pdf") returned 4 [0103.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.801] lstrlenW (lpString=".xls") returned 4 [0103.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.801] lstrlenW (lpString=".xlsx") returned 5 [0103.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.801] lstrlenW (lpString=".ppt") returned 4 [0103.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.801] lstrlenW (lpString=".zip") returned 4 [0103.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.801] lstrlenW (lpString=".rar") returned 4 [0103.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.801] lstrlenW (lpString=".bz2") returned 4 [0103.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString=".7z") returned 3 [0103.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".dbf") returned 4 [0103.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".1cd") returned 4 [0103.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".jpg") returned 4 [0103.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString=".pdf") returned 4 [0103.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString=".xls") returned 4 [0103.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.802] lstrlenW (lpString=".xlsx") returned 5 [0103.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.802] lstrlenW (lpString=".ppt") returned 4 [0103.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".zip") returned 4 [0103.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.802] lstrlenW (lpString=".rar") returned 4 [0103.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString=".bz2") returned 4 [0103.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString=".7z") returned 3 [0103.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".dbf") returned 4 [0103.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.802] lstrlenW (lpString=".1cd") returned 4 [0103.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 63 [0103.803] lstrlenW (lpString=".jpg") returned 4 [0103.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.803] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") [0103.803] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2228) returned 1 [0103.803] CloseHandle (hObject=0x1a0) returned 1 [0103.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x20 [0103.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0103.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.804] GetLastError () returned 0x0 [0103.804] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0103.806] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0103.807] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.807] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.807] SetEndOfFile (hFile=0x15c) returned 1 [0103.807] CloseHandle (hObject=0x15c) returned 1 [0103.807] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.807] SetEndOfFile (hFile=0x1a0) returned 1 [0103.808] CloseHandle (hObject=0x1a0) returned 1 [0103.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 1 [0103.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.808] lstrlenW (lpString=".doc") returned 4 [0103.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.808] lstrlenW (lpString=".docx") returned 5 [0103.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0103.808] lstrlenW (lpString=".pdf") returned 4 [0103.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.808] lstrlenW (lpString=".xls") returned 4 [0103.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.809] lstrlenW (lpString=".xlsx") returned 5 [0103.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.809] lstrlenW (lpString=".ppt") returned 4 [0103.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.809] lstrlenW (lpString=".zip") returned 4 [0103.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.809] lstrlenW (lpString=".rar") returned 4 [0103.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString=".bz2") returned 4 [0103.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString=".7z") returned 3 [0103.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.809] lstrlenW (lpString=".dbf") returned 4 [0103.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.809] lstrlenW (lpString=".1cd") returned 4 [0103.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.809] lstrlenW (lpString=".jpg") returned 4 [0103.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString=".pdf") returned 4 [0103.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString=".xls") returned 4 [0103.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.809] lstrlenW (lpString=".xlsx") returned 5 [0103.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0103.809] lstrlenW (lpString=".ppt") returned 4 [0103.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.810] lstrlenW (lpString=".zip") returned 4 [0103.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.810] lstrlenW (lpString=".rar") returned 4 [0103.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.810] lstrlenW (lpString=".bz2") returned 4 [0103.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.810] lstrlenW (lpString=".7z") returned 3 [0103.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.810] lstrlenW (lpString=".dbf") returned 4 [0103.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.810] lstrlenW (lpString=".1cd") returned 4 [0103.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 63 [0103.810] lstrlenW (lpString=".jpg") returned 4 [0103.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.810] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") [0104.288] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2804) returned 1 [0104.288] CloseHandle (hObject=0x158) returned 1 [0104.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x20 [0104.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.289] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.289] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.317] GetLastError () returned 0x0 [0104.317] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xaf4, lpOverlapped=0x0) returned 1 [0104.352] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xb00, lpOverlapped=0x0) returned 1 [0104.353] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.353] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.353] SetEndOfFile (hFile=0x15c) returned 1 [0104.353] CloseHandle (hObject=0x15c) returned 1 [0104.353] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.353] SetEndOfFile (hFile=0x158) returned 1 [0104.354] CloseHandle (hObject=0x158) returned 1 [0104.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 1 [0104.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString=".doc") returned 4 [0104.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString=".docx") returned 5 [0104.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.355] lstrlenW (lpString=".pdf") returned 4 [0104.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString=".xls") returned 4 [0104.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.355] lstrlenW (lpString=".xlsx") returned 5 [0104.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.355] lstrlenW (lpString=".ppt") returned 4 [0104.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString=".zip") returned 4 [0104.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.355] lstrlenW (lpString=".rar") returned 4 [0104.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString=".bz2") returned 4 [0104.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString=".7z") returned 3 [0104.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString=".dbf") returned 4 [0104.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString=".1cd") returned 4 [0104.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.355] lstrlenW (lpString=".jpg") returned 4 [0104.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString=".pdf") returned 4 [0104.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString=".xls") returned 4 [0104.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.356] lstrlenW (lpString=".xlsx") returned 5 [0104.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.356] lstrlenW (lpString=".ppt") returned 4 [0104.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.356] lstrlenW (lpString=".zip") returned 4 [0104.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.356] lstrlenW (lpString=".rar") returned 4 [0104.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString=".bz2") returned 4 [0104.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString=".7z") returned 3 [0104.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.356] lstrlenW (lpString=".dbf") returned 4 [0104.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.356] lstrlenW (lpString=".1cd") returned 4 [0104.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 63 [0104.356] lstrlenW (lpString=".jpg") returned 4 [0104.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.356] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") [0104.357] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6908) returned 1 [0104.357] CloseHandle (hObject=0x158) returned 1 [0104.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x20 [0104.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.357] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.357] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.358] GetLastError () returned 0x0 [0104.358] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1afc, lpOverlapped=0x0) returned 1 [0104.360] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b00, lpOverlapped=0x0) returned 1 [0104.361] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.361] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.361] SetEndOfFile (hFile=0x15c) returned 1 [0104.361] CloseHandle (hObject=0x15c) returned 1 [0104.361] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.361] SetEndOfFile (hFile=0x158) returned 1 [0104.362] CloseHandle (hObject=0x158) returned 1 [0104.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 1 [0104.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.362] lstrlenW (lpString=".doc") returned 4 [0104.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.362] lstrlenW (lpString=".docx") returned 5 [0104.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.363] lstrlenW (lpString=".pdf") returned 4 [0104.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString=".xls") returned 4 [0104.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.363] lstrlenW (lpString=".xlsx") returned 5 [0104.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.363] lstrlenW (lpString=".ppt") returned 4 [0104.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.363] lstrlenW (lpString=".zip") returned 4 [0104.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.363] lstrlenW (lpString=".rar") returned 4 [0104.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString=".bz2") returned 4 [0104.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString=".7z") returned 3 [0104.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.363] lstrlenW (lpString=".dbf") returned 4 [0104.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.363] lstrlenW (lpString=".1cd") returned 4 [0104.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.363] lstrlenW (lpString=".jpg") returned 4 [0104.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString=".pdf") returned 4 [0104.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.363] lstrlenW (lpString=".xls") returned 4 [0104.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.363] lstrlenW (lpString=".xlsx") returned 5 [0104.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.364] lstrlenW (lpString=".ppt") returned 4 [0104.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.364] lstrlenW (lpString=".zip") returned 4 [0104.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.364] lstrlenW (lpString=".rar") returned 4 [0104.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.364] lstrlenW (lpString=".bz2") returned 4 [0104.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.364] lstrlenW (lpString=".7z") returned 3 [0104.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.364] lstrlenW (lpString=".dbf") returned 4 [0104.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.364] lstrlenW (lpString=".1cd") returned 4 [0104.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 63 [0104.364] lstrlenW (lpString=".jpg") returned 4 [0104.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.364] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") [0104.365] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=45476) returned 1 [0104.365] CloseHandle (hObject=0x158) returned 1 [0104.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x20 [0104.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0104.365] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.365] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0104.366] GetLastError () returned 0x0 [0104.366] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xb1a4, lpOverlapped=0x0) returned 1 [0104.370] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xb1b0, lpOverlapped=0x0) returned 1 [0104.380] ReadFile (in: hFile=0x158, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.381] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.381] SetEndOfFile (hFile=0x15c) returned 1 [0104.381] CloseHandle (hObject=0x15c) returned 1 [0104.381] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.381] SetEndOfFile (hFile=0x158) returned 1 [0104.382] CloseHandle (hObject=0x158) returned 1 [0104.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 1 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.383] lstrlenW (lpString=".doc") returned 4 [0104.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString=".docx") returned 5 [0104.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.383] lstrlenW (lpString=".pdf") returned 4 [0104.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString=".xls") returned 4 [0104.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.383] lstrlenW (lpString=".xlsx") returned 5 [0104.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.383] lstrlenW (lpString=".ppt") returned 4 [0104.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.383] lstrlenW (lpString=".zip") returned 4 [0104.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.383] lstrlenW (lpString=".rar") returned 4 [0104.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString=".bz2") returned 4 [0104.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString=".7z") returned 3 [0104.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.383] lstrlenW (lpString=".dbf") returned 4 [0104.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.383] lstrlenW (lpString=".1cd") returned 4 [0104.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.383] lstrlenW (lpString=".jpg") returned 4 [0104.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.383] lstrlenW (lpString=".pdf") returned 4 [0104.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString=".xls") returned 4 [0104.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.384] lstrlenW (lpString=".xlsx") returned 5 [0104.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.384] lstrlenW (lpString=".ppt") returned 4 [0104.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.384] lstrlenW (lpString=".zip") returned 4 [0104.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.384] lstrlenW (lpString=".rar") returned 4 [0104.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString=".bz2") returned 4 [0104.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString=".7z") returned 3 [0104.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.384] lstrlenW (lpString=".dbf") returned 4 [0104.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.384] lstrlenW (lpString=".1cd") returned 4 [0104.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 63 [0104.384] lstrlenW (lpString=".jpg") returned 4 [0104.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.384] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") [0104.660] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=40492) returned 1 [0104.660] CloseHandle (hObject=0x22c) returned 1 [0104.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x20 [0104.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.661] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.661] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0104.662] GetLastError () returned 0x0 [0104.662] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9e2c, lpOverlapped=0x0) returned 1 [0104.688] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9e30, lpOverlapped=0x0) returned 1 [0104.692] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.692] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.692] SetEndOfFile (hFile=0x1fc) returned 1 [0104.692] CloseHandle (hObject=0x1fc) returned 1 [0104.692] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.692] SetEndOfFile (hFile=0x22c) returned 1 [0104.693] CloseHandle (hObject=0x22c) returned 1 [0104.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 1 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.694] lstrlenW (lpString=".doc") returned 4 [0104.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".docx") returned 5 [0104.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.694] lstrlenW (lpString=".pdf") returned 4 [0104.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".xls") returned 4 [0104.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.694] lstrlenW (lpString=".xlsx") returned 5 [0104.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.694] lstrlenW (lpString=".ppt") returned 4 [0104.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.694] lstrlenW (lpString=".zip") returned 4 [0104.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.694] lstrlenW (lpString=".rar") returned 4 [0104.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".bz2") returned 4 [0104.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".7z") returned 3 [0104.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".dbf") returned 4 [0104.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".1cd") returned 4 [0104.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".jpg") returned 4 [0104.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".pdf") returned 4 [0104.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".xls") returned 4 [0104.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.695] lstrlenW (lpString=".xlsx") returned 5 [0104.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.695] lstrlenW (lpString=".ppt") returned 4 [0104.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".zip") returned 4 [0104.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.695] lstrlenW (lpString=".rar") returned 4 [0104.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".bz2") returned 4 [0104.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".7z") returned 3 [0104.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".dbf") returned 4 [0104.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.695] lstrlenW (lpString=".1cd") returned 4 [0104.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 63 [0104.696] lstrlenW (lpString=".jpg") returned 4 [0104.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.696] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") [0104.697] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7328) returned 1 [0104.697] CloseHandle (hObject=0x22c) returned 1 [0104.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 0x20 [0104.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.697] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.697] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0104.698] GetLastError () returned 0x0 [0104.698] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1ca0, lpOverlapped=0x0) returned 1 [0104.702] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0104.703] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.703] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.704] SetEndOfFile (hFile=0x1fc) returned 1 [0104.704] CloseHandle (hObject=0x1fc) returned 1 [0104.704] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.704] SetEndOfFile (hFile=0x22c) returned 1 [0104.705] CloseHandle (hObject=0x22c) returned 1 [0104.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.705] lstrlenW (lpString=".doc") returned 4 [0104.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.705] lstrlenW (lpString=".docx") returned 5 [0104.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.705] lstrlenW (lpString=".pdf") returned 4 [0104.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.705] lstrlenW (lpString=".xls") returned 4 [0104.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.705] lstrlenW (lpString=".xlsx") returned 5 [0104.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.705] lstrlenW (lpString=".ppt") returned 4 [0104.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.705] lstrlenW (lpString=".zip") returned 4 [0104.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.705] lstrlenW (lpString=".rar") returned 4 [0104.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.705] lstrlenW (lpString=".bz2") returned 4 [0104.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString=".7z") returned 3 [0104.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.706] lstrlenW (lpString=".dbf") returned 4 [0104.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.706] lstrlenW (lpString=".1cd") returned 4 [0104.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.706] lstrlenW (lpString=".jpg") returned 4 [0104.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString=".pdf") returned 4 [0104.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString=".xls") returned 4 [0104.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.706] lstrlenW (lpString=".xlsx") returned 5 [0104.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.706] lstrlenW (lpString=".ppt") returned 4 [0104.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.706] lstrlenW (lpString=".zip") returned 4 [0104.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.706] lstrlenW (lpString=".rar") returned 4 [0104.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString=".bz2") returned 4 [0104.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.706] lstrlenW (lpString=".7z") returned 3 [0104.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.706] lstrlenW (lpString=".dbf") returned 4 [0104.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.707] lstrlenW (lpString=".1cd") returned 4 [0104.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 63 [0104.707] lstrlenW (lpString=".jpg") returned 4 [0104.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.707] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") [0104.707] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6408) returned 1 [0104.707] CloseHandle (hObject=0x22c) returned 1 [0104.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x20 [0104.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0104.708] GetLastError () returned 0x0 [0104.708] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1908, lpOverlapped=0x0) returned 1 [0104.715] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1910, lpOverlapped=0x0) returned 1 [0104.716] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.716] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.716] SetEndOfFile (hFile=0x1fc) returned 1 [0104.716] CloseHandle (hObject=0x1fc) returned 1 [0104.716] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.716] SetEndOfFile (hFile=0x22c) returned 1 [0104.717] CloseHandle (hObject=0x22c) returned 1 [0104.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 1 [0104.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.718] lstrlenW (lpString=".doc") returned 4 [0104.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString=".docx") returned 5 [0104.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.718] lstrlenW (lpString=".pdf") returned 4 [0104.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString=".xls") returned 4 [0104.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.718] lstrlenW (lpString=".xlsx") returned 5 [0104.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.718] lstrlenW (lpString=".ppt") returned 4 [0104.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.718] lstrlenW (lpString=".zip") returned 4 [0104.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.718] lstrlenW (lpString=".rar") returned 4 [0104.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString=".bz2") returned 4 [0104.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString=".7z") returned 3 [0104.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.718] lstrlenW (lpString=".dbf") returned 4 [0104.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.718] lstrlenW (lpString=".1cd") returned 4 [0104.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.718] lstrlenW (lpString=".jpg") returned 4 [0104.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString=".pdf") returned 4 [0104.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString=".xls") returned 4 [0104.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.719] lstrlenW (lpString=".xlsx") returned 5 [0104.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.719] lstrlenW (lpString=".ppt") returned 4 [0104.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.719] lstrlenW (lpString=".zip") returned 4 [0104.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.719] lstrlenW (lpString=".rar") returned 4 [0104.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString=".bz2") returned 4 [0104.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString=".7z") returned 3 [0104.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.719] lstrlenW (lpString=".dbf") returned 4 [0104.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.719] lstrlenW (lpString=".1cd") returned 4 [0104.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 63 [0104.719] lstrlenW (lpString=".jpg") returned 4 [0104.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.719] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") [0104.720] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12544) returned 1 [0104.720] CloseHandle (hObject=0x22c) returned 1 [0104.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x20 [0104.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.720] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.720] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0104.721] GetLastError () returned 0x0 [0104.721] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3100, lpOverlapped=0x0) returned 1 [0104.723] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3110, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3110, lpOverlapped=0x0) returned 1 [0104.724] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.724] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.724] SetEndOfFile (hFile=0x1fc) returned 1 [0104.724] CloseHandle (hObject=0x1fc) returned 1 [0104.724] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.724] SetEndOfFile (hFile=0x22c) returned 1 [0104.725] CloseHandle (hObject=0x22c) returned 1 [0104.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 1 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.725] lstrlenW (lpString=".doc") returned 4 [0104.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.725] lstrlenW (lpString=".docx") returned 5 [0104.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.725] lstrlenW (lpString=".pdf") returned 4 [0104.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString=".xls") returned 4 [0104.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.726] lstrlenW (lpString=".xlsx") returned 5 [0104.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.726] lstrlenW (lpString=".ppt") returned 4 [0104.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.726] lstrlenW (lpString=".zip") returned 4 [0104.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.726] lstrlenW (lpString=".rar") returned 4 [0104.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString=".bz2") returned 4 [0104.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString=".7z") returned 3 [0104.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.726] lstrlenW (lpString=".dbf") returned 4 [0104.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.726] lstrlenW (lpString=".1cd") returned 4 [0104.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.726] lstrlenW (lpString=".jpg") returned 4 [0104.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString=".pdf") returned 4 [0104.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.726] lstrlenW (lpString=".xls") returned 4 [0104.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.726] lstrlenW (lpString=".xlsx") returned 5 [0104.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.726] lstrlenW (lpString=".ppt") returned 4 [0104.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.727] lstrlenW (lpString=".zip") returned 4 [0104.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.727] lstrlenW (lpString=".rar") returned 4 [0104.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.727] lstrlenW (lpString=".bz2") returned 4 [0104.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.727] lstrlenW (lpString=".7z") returned 3 [0104.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.727] lstrlenW (lpString=".dbf") returned 4 [0104.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.727] lstrlenW (lpString=".1cd") returned 4 [0104.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 63 [0104.727] lstrlenW (lpString=".jpg") returned 4 [0104.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.727] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") [0104.728] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10500) returned 1 [0104.728] CloseHandle (hObject=0x22c) returned 1 [0104.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x20 [0104.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.728] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.728] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0104.729] GetLastError () returned 0x0 [0104.729] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2904, lpOverlapped=0x0) returned 1 [0104.979] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0104.980] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.980] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.980] SetEndOfFile (hFile=0x1fc) returned 1 [0104.980] CloseHandle (hObject=0x1fc) returned 1 [0104.980] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.980] SetEndOfFile (hFile=0x22c) returned 1 [0104.981] CloseHandle (hObject=0x22c) returned 1 [0104.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 1 [0104.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.981] lstrlenW (lpString=".doc") returned 4 [0104.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.981] lstrlenW (lpString=".docx") returned 5 [0104.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0104.981] lstrlenW (lpString=".pdf") returned 4 [0104.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.981] lstrlenW (lpString=".xls") returned 4 [0104.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.981] lstrlenW (lpString=".xlsx") returned 5 [0104.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.981] lstrlenW (lpString=".ppt") returned 4 [0104.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.981] lstrlenW (lpString=".zip") returned 4 [0104.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.982] lstrlenW (lpString=".rar") returned 4 [0104.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".bz2") returned 4 [0104.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".7z") returned 3 [0104.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.982] lstrlenW (lpString=".dbf") returned 4 [0104.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.982] lstrlenW (lpString=".1cd") returned 4 [0104.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.982] lstrlenW (lpString=".jpg") returned 4 [0104.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".pdf") returned 4 [0104.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".xls") returned 4 [0104.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.982] lstrlenW (lpString=".xlsx") returned 5 [0104.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0104.982] lstrlenW (lpString=".ppt") returned 4 [0104.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.982] lstrlenW (lpString=".zip") returned 4 [0104.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.982] lstrlenW (lpString=".rar") returned 4 [0104.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".bz2") returned 4 [0104.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.982] lstrlenW (lpString=".7z") returned 3 [0104.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.983] lstrlenW (lpString=".dbf") returned 4 [0104.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.983] lstrlenW (lpString=".1cd") returned 4 [0104.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 63 [0104.983] lstrlenW (lpString=".jpg") returned 4 [0104.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.983] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") [0105.145] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=47556) returned 1 [0105.145] CloseHandle (hObject=0x15c) returned 1 [0105.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 0x20 [0105.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.145] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.145] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.150] GetLastError () returned 0x0 [0105.150] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xb9c4, lpOverlapped=0x0) returned 1 [0105.153] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xb9d0, lpOverlapped=0x0) returned 1 [0105.155] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.155] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.155] SetEndOfFile (hFile=0x1a0) returned 1 [0105.155] CloseHandle (hObject=0x1a0) returned 1 [0105.155] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.155] SetEndOfFile (hFile=0x15c) returned 1 [0105.156] CloseHandle (hObject=0x15c) returned 1 [0105.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 1 [0105.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString=".doc") returned 4 [0105.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString=".docx") returned 5 [0105.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.157] lstrlenW (lpString=".pdf") returned 4 [0105.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString=".xls") returned 4 [0105.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.157] lstrlenW (lpString=".xlsx") returned 5 [0105.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.157] lstrlenW (lpString=".ppt") returned 4 [0105.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString=".zip") returned 4 [0105.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.157] lstrlenW (lpString=".rar") returned 4 [0105.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString=".bz2") returned 4 [0105.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString=".7z") returned 3 [0105.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString=".dbf") returned 4 [0105.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString=".1cd") returned 4 [0105.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.157] lstrlenW (lpString=".jpg") returned 4 [0105.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString=".pdf") returned 4 [0105.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString=".xls") returned 4 [0105.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.158] lstrlenW (lpString=".xlsx") returned 5 [0105.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.158] lstrlenW (lpString=".ppt") returned 4 [0105.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.158] lstrlenW (lpString=".zip") returned 4 [0105.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.158] lstrlenW (lpString=".rar") returned 4 [0105.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString=".bz2") returned 4 [0105.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString=".7z") returned 3 [0105.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.158] lstrlenW (lpString=".dbf") returned 4 [0105.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.158] lstrlenW (lpString=".1cd") returned 4 [0105.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 63 [0105.158] lstrlenW (lpString=".jpg") returned 4 [0105.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.158] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") [0105.160] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1682) returned 1 [0105.160] CloseHandle (hObject=0x15c) returned 1 [0105.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 0x20 [0105.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.160] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.160] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.161] GetLastError () returned 0x0 [0105.161] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x692, lpOverlapped=0x0) returned 1 [0105.162] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0105.163] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.163] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.164] SetEndOfFile (hFile=0x1a0) returned 1 [0105.164] CloseHandle (hObject=0x1a0) returned 1 [0105.164] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.164] SetEndOfFile (hFile=0x15c) returned 1 [0105.165] CloseHandle (hObject=0x15c) returned 1 [0105.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 1 [0105.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.165] lstrlenW (lpString=".doc") returned 4 [0105.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.165] lstrlenW (lpString=".docx") returned 5 [0105.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.165] lstrlenW (lpString=".pdf") returned 4 [0105.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.165] lstrlenW (lpString=".xls") returned 4 [0105.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.165] lstrlenW (lpString=".xlsx") returned 5 [0105.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.165] lstrlenW (lpString=".ppt") returned 4 [0105.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.165] lstrlenW (lpString=".zip") returned 4 [0105.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.165] lstrlenW (lpString=".rar") returned 4 [0105.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".bz2") returned 4 [0105.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".7z") returned 3 [0105.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.166] lstrlenW (lpString=".dbf") returned 4 [0105.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.166] lstrlenW (lpString=".1cd") returned 4 [0105.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.166] lstrlenW (lpString=".jpg") returned 4 [0105.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".pdf") returned 4 [0105.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".xls") returned 4 [0105.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.166] lstrlenW (lpString=".xlsx") returned 5 [0105.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.166] lstrlenW (lpString=".ppt") returned 4 [0105.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.166] lstrlenW (lpString=".zip") returned 4 [0105.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.166] lstrlenW (lpString=".rar") returned 4 [0105.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".bz2") returned 4 [0105.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.166] lstrlenW (lpString=".7z") returned 3 [0105.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.166] lstrlenW (lpString=".dbf") returned 4 [0105.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.167] lstrlenW (lpString=".1cd") returned 4 [0105.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 63 [0105.167] lstrlenW (lpString=".jpg") returned 4 [0105.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.167] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") [0105.167] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10284) returned 1 [0105.167] CloseHandle (hObject=0x15c) returned 1 [0105.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x20 [0105.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.168] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.168] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.168] GetLastError () returned 0x0 [0105.168] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x282c, lpOverlapped=0x0) returned 1 [0105.171] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2830, lpOverlapped=0x0) returned 1 [0105.172] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.172] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.172] SetEndOfFile (hFile=0x1a0) returned 1 [0105.172] CloseHandle (hObject=0x1a0) returned 1 [0105.172] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.172] SetEndOfFile (hFile=0x15c) returned 1 [0105.173] CloseHandle (hObject=0x15c) returned 1 [0105.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 1 [0105.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.173] lstrlenW (lpString=".doc") returned 4 [0105.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.173] lstrlenW (lpString=".docx") returned 5 [0105.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.174] lstrlenW (lpString=".pdf") returned 4 [0105.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString=".xls") returned 4 [0105.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.174] lstrlenW (lpString=".xlsx") returned 5 [0105.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.174] lstrlenW (lpString=".ppt") returned 4 [0105.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.174] lstrlenW (lpString=".zip") returned 4 [0105.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.174] lstrlenW (lpString=".rar") returned 4 [0105.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString=".bz2") returned 4 [0105.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString=".7z") returned 3 [0105.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.174] lstrlenW (lpString=".dbf") returned 4 [0105.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.174] lstrlenW (lpString=".1cd") returned 4 [0105.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.174] lstrlenW (lpString=".jpg") returned 4 [0105.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString=".pdf") returned 4 [0105.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.174] lstrlenW (lpString=".xls") returned 4 [0105.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.175] lstrlenW (lpString=".xlsx") returned 5 [0105.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.175] lstrlenW (lpString=".ppt") returned 4 [0105.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.175] lstrlenW (lpString=".zip") returned 4 [0105.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.175] lstrlenW (lpString=".rar") returned 4 [0105.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.175] lstrlenW (lpString=".bz2") returned 4 [0105.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.175] lstrlenW (lpString=".7z") returned 3 [0105.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.175] lstrlenW (lpString=".dbf") returned 4 [0105.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.175] lstrlenW (lpString=".1cd") returned 4 [0105.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 63 [0105.175] lstrlenW (lpString=".jpg") returned 4 [0105.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.175] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") [0105.176] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8456) returned 1 [0105.176] CloseHandle (hObject=0x15c) returned 1 [0105.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x20 [0105.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0105.176] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.176] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.177] GetLastError () returned 0x0 [0105.177] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2108, lpOverlapped=0x0) returned 1 [0105.230] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2110, lpOverlapped=0x0) returned 1 [0105.231] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.231] SetEndOfFile (hFile=0x1a0) returned 1 [0105.377] CloseHandle (hObject=0x1a0) returned 1 [0105.385] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.393] SetEndOfFile (hFile=0x15c) returned 1 [0105.402] CloseHandle (hObject=0x15c) returned 1 [0105.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 1 [0105.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.402] lstrlenW (lpString=".doc") returned 4 [0105.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.402] lstrlenW (lpString=".docx") returned 5 [0105.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.402] lstrlenW (lpString=".pdf") returned 4 [0105.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString=".xls") returned 4 [0105.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.403] lstrlenW (lpString=".xlsx") returned 5 [0105.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.403] lstrlenW (lpString=".ppt") returned 4 [0105.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.403] lstrlenW (lpString=".zip") returned 4 [0105.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.403] lstrlenW (lpString=".rar") returned 4 [0105.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString=".bz2") returned 4 [0105.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString=".7z") returned 3 [0105.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.403] lstrlenW (lpString=".dbf") returned 4 [0105.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.403] lstrlenW (lpString=".1cd") returned 4 [0105.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.403] lstrlenW (lpString=".jpg") returned 4 [0105.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString=".pdf") returned 4 [0105.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString=".xls") returned 4 [0105.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.403] lstrlenW (lpString=".xlsx") returned 5 [0105.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.403] lstrlenW (lpString=".ppt") returned 4 [0105.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.404] lstrlenW (lpString=".zip") returned 4 [0105.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.404] lstrlenW (lpString=".rar") returned 4 [0105.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.404] lstrlenW (lpString=".bz2") returned 4 [0105.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.404] lstrlenW (lpString=".7z") returned 3 [0105.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.404] lstrlenW (lpString=".dbf") returned 4 [0105.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.404] lstrlenW (lpString=".1cd") returned 4 [0105.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 63 [0105.404] lstrlenW (lpString=".jpg") returned 4 [0105.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.404] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") [0106.008] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1544) returned 1 [0106.008] CloseHandle (hObject=0x1c8) returned 1 [0106.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x20 [0106.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.008] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.008] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.009] GetLastError () returned 0x0 [0106.009] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x608, lpOverlapped=0x0) returned 1 [0106.011] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x610, lpOverlapped=0x0) returned 1 [0106.011] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.012] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.012] SetEndOfFile (hFile=0x22c) returned 1 [0106.012] CloseHandle (hObject=0x22c) returned 1 [0106.012] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.012] SetEndOfFile (hFile=0x1c8) returned 1 [0106.013] CloseHandle (hObject=0x1c8) returned 1 [0106.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 1 [0106.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.013] lstrlenW (lpString=".doc") returned 4 [0106.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.013] lstrlenW (lpString=".docx") returned 5 [0106.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.013] lstrlenW (lpString=".pdf") returned 4 [0106.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString=".xls") returned 4 [0106.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.014] lstrlenW (lpString=".xlsx") returned 5 [0106.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.014] lstrlenW (lpString=".ppt") returned 4 [0106.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.014] lstrlenW (lpString=".zip") returned 4 [0106.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.014] lstrlenW (lpString=".rar") returned 4 [0106.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString=".bz2") returned 4 [0106.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString=".7z") returned 3 [0106.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.014] lstrlenW (lpString=".dbf") returned 4 [0106.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.014] lstrlenW (lpString=".1cd") returned 4 [0106.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.014] lstrlenW (lpString=".jpg") returned 4 [0106.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString=".pdf") returned 4 [0106.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.014] lstrlenW (lpString=".xls") returned 4 [0106.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.014] lstrlenW (lpString=".xlsx") returned 5 [0106.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.014] lstrlenW (lpString=".ppt") returned 4 [0106.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.015] lstrlenW (lpString=".zip") returned 4 [0106.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.015] lstrlenW (lpString=".rar") returned 4 [0106.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.015] lstrlenW (lpString=".bz2") returned 4 [0106.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.015] lstrlenW (lpString=".7z") returned 3 [0106.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.015] lstrlenW (lpString=".dbf") returned 4 [0106.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.015] lstrlenW (lpString=".1cd") returned 4 [0106.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 63 [0106.015] lstrlenW (lpString=".jpg") returned 4 [0106.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.015] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") [0106.016] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6334) returned 1 [0106.016] CloseHandle (hObject=0x1c8) returned 1 [0106.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x20 [0106.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.016] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.016] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.017] GetLastError () returned 0x0 [0106.017] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x18be, lpOverlapped=0x0) returned 1 [0106.018] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0106.019] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.019] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.019] SetEndOfFile (hFile=0x22c) returned 1 [0106.019] CloseHandle (hObject=0x22c) returned 1 [0106.019] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.020] SetEndOfFile (hFile=0x1c8) returned 1 [0106.020] CloseHandle (hObject=0x1c8) returned 1 [0106.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.021] lstrlenW (lpString=".doc") returned 4 [0106.021] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.021] lstrlenW (lpString=".docx") returned 5 [0106.021] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0106.021] lstrlenW (lpString=".pdf") returned 4 [0106.021] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.021] lstrlenW (lpString=".xls") returned 4 [0106.021] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.021] lstrlenW (lpString=".xlsx") returned 5 [0106.021] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0106.021] lstrlenW (lpString=".ppt") returned 4 [0106.021] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.021] lstrlenW (lpString=".zip") returned 4 [0106.021] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.021] lstrlenW (lpString=".rar") returned 4 [0106.021] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.021] lstrlenW (lpString=".bz2") returned 4 [0106.021] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.021] lstrlenW (lpString=".7z") returned 3 [0106.021] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.021] lstrlenW (lpString=".dbf") returned 4 [0106.021] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.021] lstrlenW (lpString=".1cd") returned 4 [0106.022] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 63 [0106.022] lstrlenW (lpString=".jpg") returned 4 [0106.022] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.022] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") [0106.022] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7316) returned 1 [0106.022] CloseHandle (hObject=0x1c8) returned 1 [0106.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x20 [0106.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.023] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.023] GetLastError () returned 0x0 [0106.023] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1c94, lpOverlapped=0x0) returned 1 [0106.025] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0106.026] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.026] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.026] SetEndOfFile (hFile=0x22c) returned 1 [0106.026] CloseHandle (hObject=0x22c) returned 1 [0106.026] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.026] SetEndOfFile (hFile=0x1c8) returned 1 [0106.027] CloseHandle (hObject=0x1c8) returned 1 [0106.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 1 [0106.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.027] lstrlenW (lpString=".doc") returned 4 [0106.028] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.028] lstrlenW (lpString=".docx") returned 5 [0106.028] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0106.028] lstrlenW (lpString=".pdf") returned 4 [0106.028] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.028] lstrlenW (lpString=".xls") returned 4 [0106.028] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.028] lstrlenW (lpString=".xlsx") returned 5 [0106.028] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0106.028] lstrlenW (lpString=".ppt") returned 4 [0106.028] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.028] lstrlenW (lpString=".zip") returned 4 [0106.028] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.028] lstrlenW (lpString=".rar") returned 4 [0106.028] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.028] lstrlenW (lpString=".bz2") returned 4 [0106.028] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.028] lstrlenW (lpString=".7z") returned 3 [0106.028] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.028] lstrlenW (lpString=".dbf") returned 4 [0106.028] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.028] lstrlenW (lpString=".1cd") returned 4 [0106.028] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 63 [0106.028] lstrlenW (lpString=".jpg") returned 4 [0106.028] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.029] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") [0106.029] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0106.029] CloseHandle (hObject=0x1c8) returned 1 [0106.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x20 [0106.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.029] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.029] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.030] GetLastError () returned 0x0 [0106.030] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.032] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.033] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.033] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.034] SetEndOfFile (hFile=0x22c) returned 1 [0106.034] CloseHandle (hObject=0x22c) returned 1 [0106.034] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.034] SetEndOfFile (hFile=0x1c8) returned 1 [0106.035] CloseHandle (hObject=0x1c8) returned 1 [0106.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 1 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.035] lstrlenW (lpString=".doc") returned 4 [0106.035] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.035] lstrlenW (lpString=".docx") returned 5 [0106.035] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.035] lstrlenW (lpString=".pdf") returned 4 [0106.035] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.035] lstrlenW (lpString=".xls") returned 4 [0106.035] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.035] lstrlenW (lpString=".xlsx") returned 5 [0106.035] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.035] lstrlenW (lpString=".ppt") returned 4 [0106.035] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.035] lstrlenW (lpString=".zip") returned 4 [0106.036] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.036] lstrlenW (lpString=".rar") returned 4 [0106.036] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.036] lstrlenW (lpString=".bz2") returned 4 [0106.036] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.036] lstrlenW (lpString=".7z") returned 3 [0106.036] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.036] lstrlenW (lpString=".dbf") returned 4 [0106.036] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.036] lstrlenW (lpString=".1cd") returned 4 [0106.036] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 63 [0106.036] lstrlenW (lpString=".jpg") returned 4 [0106.036] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.036] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") [0106.037] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31968) returned 1 [0106.037] CloseHandle (hObject=0x1c8) returned 1 [0106.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 0x20 [0106.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.037] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.037] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0106.038] GetLastError () returned 0x0 [0106.038] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.039] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.041] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.041] WriteFile (in: hFile=0x22c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.041] SetEndOfFile (hFile=0x22c) returned 1 [0106.041] CloseHandle (hObject=0x22c) returned 1 [0106.041] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.041] SetEndOfFile (hFile=0x1c8) returned 1 [0106.042] CloseHandle (hObject=0x1c8) returned 1 [0106.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString=".doc") returned 4 [0106.043] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".docx") returned 5 [0106.043] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.043] lstrlenW (lpString=".pdf") returned 4 [0106.043] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".xls") returned 4 [0106.043] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".xlsx") returned 5 [0106.043] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.043] lstrlenW (lpString=".ppt") returned 4 [0106.043] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString=".zip") returned 4 [0106.043] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".rar") returned 4 [0106.043] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".bz2") returned 4 [0106.043] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString=".7z") returned 3 [0106.043] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString=".dbf") returned 4 [0106.043] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString=".1cd") returned 4 [0106.043] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 63 [0106.043] lstrlenW (lpString=".jpg") returned 4 [0106.043] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.043] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") [0106.346] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5988) returned 1 [0106.346] CloseHandle (hObject=0x19c) returned 1 [0106.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x20 [0106.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.347] GetLastError () returned 0x0 [0106.347] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1764, lpOverlapped=0x0) returned 1 [0106.349] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1770, lpOverlapped=0x0) returned 1 [0106.350] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.350] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.350] SetEndOfFile (hFile=0x158) returned 1 [0106.350] CloseHandle (hObject=0x158) returned 1 [0106.350] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.350] SetEndOfFile (hFile=0x19c) returned 1 [0106.351] CloseHandle (hObject=0x19c) returned 1 [0106.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 1 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString=".doc") returned 4 [0106.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.352] lstrlenW (lpString=".docx") returned 5 [0106.352] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0106.352] lstrlenW (lpString=".pdf") returned 4 [0106.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.352] lstrlenW (lpString=".xls") returned 4 [0106.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.352] lstrlenW (lpString=".xlsx") returned 5 [0106.352] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0106.352] lstrlenW (lpString=".ppt") returned 4 [0106.352] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString=".zip") returned 4 [0106.352] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.352] lstrlenW (lpString=".rar") returned 4 [0106.352] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.352] lstrlenW (lpString=".bz2") returned 4 [0106.352] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.352] lstrlenW (lpString=".7z") returned 3 [0106.352] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString=".dbf") returned 4 [0106.352] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString=".1cd") returned 4 [0106.352] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 63 [0106.352] lstrlenW (lpString=".jpg") returned 4 [0106.352] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.353] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") [0106.353] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=39614) returned 1 [0106.353] CloseHandle (hObject=0x19c) returned 1 [0106.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x20 [0106.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.353] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.354] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.354] GetLastError () returned 0x0 [0106.354] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9abe, lpOverlapped=0x0) returned 1 [0106.357] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9ac0, lpOverlapped=0x0) returned 1 [0106.358] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.358] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.358] SetEndOfFile (hFile=0x158) returned 1 [0106.358] CloseHandle (hObject=0x158) returned 1 [0106.358] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.358] SetEndOfFile (hFile=0x19c) returned 1 [0106.359] CloseHandle (hObject=0x19c) returned 1 [0106.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 1 [0106.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.360] lstrlenW (lpString=".doc") returned 4 [0106.360] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.360] lstrlenW (lpString=".docx") returned 5 [0106.360] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0106.360] lstrlenW (lpString=".pdf") returned 4 [0106.360] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.360] lstrlenW (lpString=".xls") returned 4 [0106.360] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.360] lstrlenW (lpString=".xlsx") returned 5 [0106.360] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0106.360] lstrlenW (lpString=".ppt") returned 4 [0106.360] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.360] lstrlenW (lpString=".zip") returned 4 [0106.360] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.360] lstrlenW (lpString=".rar") returned 4 [0106.360] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.360] lstrlenW (lpString=".bz2") returned 4 [0106.360] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.360] lstrlenW (lpString=".7z") returned 3 [0106.360] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.360] lstrlenW (lpString=".dbf") returned 4 [0106.360] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.360] lstrlenW (lpString=".1cd") returned 4 [0106.361] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 63 [0106.361] lstrlenW (lpString=".jpg") returned 4 [0106.361] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.361] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") [0106.361] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17694) returned 1 [0106.361] CloseHandle (hObject=0x19c) returned 1 [0106.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x20 [0106.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.362] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.362] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.362] GetLastError () returned 0x0 [0106.362] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x451e, lpOverlapped=0x0) returned 1 [0106.364] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4520, lpOverlapped=0x0) returned 1 [0106.365] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.365] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.365] SetEndOfFile (hFile=0x158) returned 1 [0106.365] CloseHandle (hObject=0x158) returned 1 [0106.365] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.365] SetEndOfFile (hFile=0x19c) returned 1 [0106.366] CloseHandle (hObject=0x19c) returned 1 [0106.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 1 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString=".doc") returned 4 [0106.367] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.367] lstrlenW (lpString=".docx") returned 5 [0106.367] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0106.367] lstrlenW (lpString=".pdf") returned 4 [0106.367] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.367] lstrlenW (lpString=".xls") returned 4 [0106.367] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.367] lstrlenW (lpString=".xlsx") returned 5 [0106.367] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0106.367] lstrlenW (lpString=".ppt") returned 4 [0106.367] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString=".zip") returned 4 [0106.367] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.367] lstrlenW (lpString=".rar") returned 4 [0106.367] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.367] lstrlenW (lpString=".bz2") returned 4 [0106.367] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.367] lstrlenW (lpString=".7z") returned 3 [0106.367] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString=".dbf") returned 4 [0106.367] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString=".1cd") returned 4 [0106.367] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 63 [0106.367] lstrlenW (lpString=".jpg") returned 4 [0106.367] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.368] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") [0106.368] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31968) returned 1 [0106.368] CloseHandle (hObject=0x19c) returned 1 [0106.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x20 [0106.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.368] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.368] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.369] GetLastError () returned 0x0 [0106.369] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.371] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.372] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.373] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.373] SetEndOfFile (hFile=0x158) returned 1 [0106.373] CloseHandle (hObject=0x158) returned 1 [0106.373] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.373] SetEndOfFile (hFile=0x19c) returned 1 [0106.374] CloseHandle (hObject=0x19c) returned 1 [0106.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 1 [0106.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.374] lstrlenW (lpString=".doc") returned 4 [0106.374] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.374] lstrlenW (lpString=".docx") returned 5 [0106.374] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.374] lstrlenW (lpString=".pdf") returned 4 [0106.374] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.374] lstrlenW (lpString=".xls") returned 4 [0106.374] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString=".xlsx") returned 5 [0106.375] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.375] lstrlenW (lpString=".ppt") returned 4 [0106.375] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.375] lstrlenW (lpString=".zip") returned 4 [0106.375] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString=".rar") returned 4 [0106.375] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString=".bz2") returned 4 [0106.375] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString=".7z") returned 3 [0106.375] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.375] lstrlenW (lpString=".dbf") returned 4 [0106.375] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.375] lstrlenW (lpString=".1cd") returned 4 [0106.375] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 63 [0106.375] lstrlenW (lpString=".jpg") returned 4 [0106.375] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.375] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") [0106.376] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32184) returned 1 [0106.376] CloseHandle (hObject=0x19c) returned 1 [0106.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x20 [0106.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.376] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.376] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.377] GetLastError () returned 0x0 [0106.377] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0106.379] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0106.380] ReadFile (in: hFile=0x19c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.380] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.380] SetEndOfFile (hFile=0x158) returned 1 [0106.380] CloseHandle (hObject=0x158) returned 1 [0106.381] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.381] SetEndOfFile (hFile=0x19c) returned 1 [0106.381] CloseHandle (hObject=0x19c) returned 1 [0106.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 1 [0106.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.382] lstrlenW (lpString=".doc") returned 4 [0106.382] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".docx") returned 5 [0106.382] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.382] lstrlenW (lpString=".pdf") returned 4 [0106.382] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".xls") returned 4 [0106.382] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".xlsx") returned 5 [0106.382] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.382] lstrlenW (lpString=".ppt") returned 4 [0106.382] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.382] lstrlenW (lpString=".zip") returned 4 [0106.382] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".rar") returned 4 [0106.382] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".bz2") returned 4 [0106.382] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.382] lstrlenW (lpString=".7z") returned 3 [0106.382] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.383] lstrlenW (lpString=".dbf") returned 4 [0106.383] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.383] lstrlenW (lpString=".1cd") returned 4 [0106.383] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 63 [0106.383] lstrlenW (lpString=".jpg") returned 4 [0106.383] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.383] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") [0106.765] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27388) returned 1 [0106.812] CloseHandle (hObject=0x180) returned 1 [0106.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 0x20 [0106.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.812] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.812] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.813] GetLastError () returned 0x0 [0106.813] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6afc, lpOverlapped=0x0) returned 1 [0106.815] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6b00, lpOverlapped=0x0) returned 1 [0106.817] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.817] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.817] SetEndOfFile (hFile=0x210) returned 1 [0106.817] CloseHandle (hObject=0x210) returned 1 [0106.817] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.817] SetEndOfFile (hFile=0x180) returned 1 [0106.818] CloseHandle (hObject=0x180) returned 1 [0106.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 1 [0106.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.818] lstrlenW (lpString=".doc") returned 4 [0106.818] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0106.818] lstrlenW (lpString=".docx") returned 5 [0106.818] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0106.818] lstrlenW (lpString=".pdf") returned 4 [0106.818] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0106.818] lstrlenW (lpString=".xls") returned 4 [0106.818] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0106.819] lstrlenW (lpString=".xlsx") returned 5 [0106.819] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0106.819] lstrlenW (lpString=".ppt") returned 4 [0106.819] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0106.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.819] lstrlenW (lpString=".zip") returned 4 [0106.819] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0106.819] lstrlenW (lpString=".rar") returned 4 [0106.819] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0106.819] lstrlenW (lpString=".bz2") returned 4 [0106.819] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0106.819] lstrlenW (lpString=".7z") returned 3 [0106.819] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0106.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.819] lstrlenW (lpString=".dbf") returned 4 [0106.819] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0106.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.819] lstrlenW (lpString=".1cd") returned 4 [0106.819] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0106.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 63 [0106.819] lstrlenW (lpString=".jpg") returned 4 [0106.819] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0106.819] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") [0106.820] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31752) returned 1 [0106.820] CloseHandle (hObject=0x180) returned 1 [0106.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 0x20 [0106.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.820] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.820] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.821] GetLastError () returned 0x0 [0106.821] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7c08, lpOverlapped=0x0) returned 1 [0106.823] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7c10, lpOverlapped=0x0) returned 1 [0106.825] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.825] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.825] SetEndOfFile (hFile=0x210) returned 1 [0106.825] CloseHandle (hObject=0x210) returned 1 [0106.825] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.825] SetEndOfFile (hFile=0x180) returned 1 [0106.826] CloseHandle (hObject=0x180) returned 1 [0106.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString=".doc") returned 4 [0106.827] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".docx") returned 5 [0106.827] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.827] lstrlenW (lpString=".pdf") returned 4 [0106.827] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".xls") returned 4 [0106.827] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".xlsx") returned 5 [0106.827] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.827] lstrlenW (lpString=".ppt") returned 4 [0106.827] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString=".zip") returned 4 [0106.827] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".rar") returned 4 [0106.827] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".bz2") returned 4 [0106.827] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString=".7z") returned 3 [0106.827] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString=".dbf") returned 4 [0106.827] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString=".1cd") returned 4 [0106.827] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 63 [0106.827] lstrlenW (lpString=".jpg") returned 4 [0106.827] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.828] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") [0106.829] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18684) returned 1 [0106.829] CloseHandle (hObject=0x180) returned 1 [0106.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x20 [0106.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.829] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.829] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.830] GetLastError () returned 0x0 [0106.830] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x48fc, lpOverlapped=0x0) returned 1 [0106.831] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4900, lpOverlapped=0x0) returned 1 [0106.833] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.833] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.833] SetEndOfFile (hFile=0x210) returned 1 [0106.833] CloseHandle (hObject=0x210) returned 1 [0106.833] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.833] SetEndOfFile (hFile=0x180) returned 1 [0106.834] CloseHandle (hObject=0x180) returned 1 [0106.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 1 [0106.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.834] lstrlenW (lpString=".doc") returned 4 [0106.834] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.834] lstrlenW (lpString=".docx") returned 5 [0106.834] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.834] lstrlenW (lpString=".pdf") returned 4 [0106.834] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString=".xls") returned 4 [0106.835] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString=".xlsx") returned 5 [0106.835] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.835] lstrlenW (lpString=".ppt") returned 4 [0106.835] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.835] lstrlenW (lpString=".zip") returned 4 [0106.835] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString=".rar") returned 4 [0106.835] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString=".bz2") returned 4 [0106.835] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString=".7z") returned 3 [0106.835] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.835] lstrlenW (lpString=".dbf") returned 4 [0106.835] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.835] lstrlenW (lpString=".1cd") returned 4 [0106.835] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 63 [0106.835] lstrlenW (lpString=".jpg") returned 4 [0106.835] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.835] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") [0106.836] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31968) returned 1 [0106.837] CloseHandle (hObject=0x180) returned 1 [0106.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x20 [0106.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.837] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.837] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.838] GetLastError () returned 0x0 [0106.838] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0106.840] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0106.841] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.841] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.841] SetEndOfFile (hFile=0x210) returned 1 [0106.841] CloseHandle (hObject=0x210) returned 1 [0106.842] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.842] SetEndOfFile (hFile=0x180) returned 1 [0106.842] CloseHandle (hObject=0x180) returned 1 [0106.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 1 [0106.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.843] lstrlenW (lpString=".doc") returned 4 [0106.843] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString=".docx") returned 5 [0106.843] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0106.843] lstrlenW (lpString=".pdf") returned 4 [0106.843] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString=".xls") returned 4 [0106.843] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString=".xlsx") returned 5 [0106.843] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0106.843] lstrlenW (lpString=".ppt") returned 4 [0106.843] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.843] lstrlenW (lpString=".zip") returned 4 [0106.843] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString=".rar") returned 4 [0106.843] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0106.843] lstrlenW (lpString=".bz2") returned 4 [0106.843] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0106.844] lstrlenW (lpString=".7z") returned 3 [0106.844] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0106.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.844] lstrlenW (lpString=".dbf") returned 4 [0106.844] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0106.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.844] lstrlenW (lpString=".1cd") returned 4 [0106.844] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0106.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 63 [0106.844] lstrlenW (lpString=".jpg") returned 4 [0106.844] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0106.844] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") [0106.844] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=33945) returned 1 [0106.845] CloseHandle (hObject=0x180) returned 1 [0106.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x20 [0106.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.845] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.845] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0106.845] GetLastError () returned 0x0 [0106.846] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8499, lpOverlapped=0x0) returned 1 [0107.102] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x84a0, lpOverlapped=0x0) returned 1 [0107.103] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.103] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.103] SetEndOfFile (hFile=0x210) returned 1 [0107.103] CloseHandle (hObject=0x210) returned 1 [0107.103] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.103] SetEndOfFile (hFile=0x180) returned 1 [0107.104] CloseHandle (hObject=0x180) returned 1 [0107.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 1 [0107.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.105] lstrlenW (lpString=".doc") returned 4 [0107.105] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.105] lstrlenW (lpString=".docx") returned 5 [0107.105] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0107.105] lstrlenW (lpString=".pdf") returned 4 [0107.105] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.105] lstrlenW (lpString=".xls") returned 4 [0107.105] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.105] lstrlenW (lpString=".xlsx") returned 5 [0107.105] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0107.105] lstrlenW (lpString=".ppt") returned 4 [0107.105] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.106] lstrlenW (lpString=".zip") returned 4 [0107.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.106] lstrlenW (lpString=".rar") returned 4 [0107.106] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.106] lstrlenW (lpString=".bz2") returned 4 [0107.106] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.106] lstrlenW (lpString=".7z") returned 3 [0107.106] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.106] lstrlenW (lpString=".dbf") returned 4 [0107.106] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.106] lstrlenW (lpString=".1cd") returned 4 [0107.106] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 63 [0107.106] lstrlenW (lpString=".jpg") returned 4 [0107.106] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.106] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") [0107.107] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=34709) returned 1 [0107.107] CloseHandle (hObject=0x180) returned 1 [0107.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 0x20 [0107.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.108] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.108] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.109] GetLastError () returned 0x0 [0107.109] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8795, lpOverlapped=0x0) returned 1 [0107.110] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x87a0, lpOverlapped=0x0) returned 1 [0107.112] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.112] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.112] SetEndOfFile (hFile=0x210) returned 1 [0107.112] CloseHandle (hObject=0x210) returned 1 [0107.112] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.112] SetEndOfFile (hFile=0x180) returned 1 [0107.113] CloseHandle (hObject=0x180) returned 1 [0107.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 1 [0107.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.113] lstrlenW (lpString=".doc") returned 4 [0107.114] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.114] lstrlenW (lpString=".docx") returned 5 [0107.114] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.114] lstrlenW (lpString=".pdf") returned 4 [0107.114] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.114] lstrlenW (lpString=".xls") returned 4 [0107.114] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.114] lstrlenW (lpString=".xlsx") returned 5 [0107.114] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.114] lstrlenW (lpString=".ppt") returned 4 [0107.114] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.114] lstrlenW (lpString=".zip") returned 4 [0107.114] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.114] lstrlenW (lpString=".rar") returned 4 [0107.114] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.114] lstrlenW (lpString=".bz2") returned 4 [0107.114] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.114] lstrlenW (lpString=".7z") returned 3 [0107.114] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.114] lstrlenW (lpString=".dbf") returned 4 [0107.114] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.114] lstrlenW (lpString=".1cd") returned 4 [0107.114] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 63 [0107.114] lstrlenW (lpString=".jpg") returned 4 [0107.114] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.114] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") [0107.116] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=33048) returned 1 [0107.116] CloseHandle (hObject=0x180) returned 1 [0107.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x20 [0107.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.116] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.116] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.117] GetLastError () returned 0x0 [0107.117] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8118, lpOverlapped=0x0) returned 1 [0107.119] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8120, lpOverlapped=0x0) returned 1 [0107.120] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.120] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.120] SetEndOfFile (hFile=0x210) returned 1 [0107.120] CloseHandle (hObject=0x210) returned 1 [0107.120] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.120] SetEndOfFile (hFile=0x180) returned 1 [0107.121] CloseHandle (hObject=0x180) returned 1 [0107.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 1 [0107.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.122] lstrlenW (lpString=".doc") returned 4 [0107.122] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".docx") returned 5 [0107.122] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.122] lstrlenW (lpString=".pdf") returned 4 [0107.122] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".xls") returned 4 [0107.122] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".xlsx") returned 5 [0107.122] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.122] lstrlenW (lpString=".ppt") returned 4 [0107.122] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.122] lstrlenW (lpString=".zip") returned 4 [0107.122] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".rar") returned 4 [0107.122] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".bz2") returned 4 [0107.122] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.122] lstrlenW (lpString=".7z") returned 3 [0107.122] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.122] lstrlenW (lpString=".dbf") returned 4 [0107.123] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.123] lstrlenW (lpString=".1cd") returned 4 [0107.123] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 63 [0107.123] lstrlenW (lpString=".jpg") returned 4 [0107.123] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.123] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") [0107.123] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=25799) returned 1 [0107.123] CloseHandle (hObject=0x180) returned 1 [0107.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 0x20 [0107.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.124] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.124] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.124] GetLastError () returned 0x0 [0107.125] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x64c7, lpOverlapped=0x0) returned 1 [0107.127] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x64d0, lpOverlapped=0x0) returned 1 [0107.128] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.128] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.128] SetEndOfFile (hFile=0x210) returned 1 [0107.128] CloseHandle (hObject=0x210) returned 1 [0107.128] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.128] SetEndOfFile (hFile=0x180) returned 1 [0107.129] CloseHandle (hObject=0x180) returned 1 [0107.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 1 [0107.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.129] lstrlenW (lpString=".doc") returned 4 [0107.129] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.129] lstrlenW (lpString=".docx") returned 5 [0107.130] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0107.130] lstrlenW (lpString=".pdf") returned 4 [0107.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.130] lstrlenW (lpString=".xls") returned 4 [0107.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.130] lstrlenW (lpString=".xlsx") returned 5 [0107.130] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0107.130] lstrlenW (lpString=".ppt") returned 4 [0107.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.130] lstrlenW (lpString=".zip") returned 4 [0107.130] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.130] lstrlenW (lpString=".rar") returned 4 [0107.130] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.130] lstrlenW (lpString=".bz2") returned 4 [0107.130] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.130] lstrlenW (lpString=".7z") returned 3 [0107.130] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.130] lstrlenW (lpString=".dbf") returned 4 [0107.130] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.130] lstrlenW (lpString=".1cd") returned 4 [0107.130] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 63 [0107.130] lstrlenW (lpString=".jpg") returned 4 [0107.130] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.130] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") [0107.131] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=94016) returned 1 [0107.131] CloseHandle (hObject=0x180) returned 1 [0107.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x20 [0107.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.131] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.131] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.132] GetLastError () returned 0x0 [0107.132] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16f40, lpOverlapped=0x0) returned 1 [0107.135] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16f50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16f50, lpOverlapped=0x0) returned 1 [0107.275] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.275] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.291] SetEndOfFile (hFile=0x210) returned 1 [0107.292] CloseHandle (hObject=0x210) returned 1 [0107.292] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.292] SetEndOfFile (hFile=0x180) returned 1 [0107.293] CloseHandle (hObject=0x180) returned 1 [0107.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 1 [0107.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.294] lstrlenW (lpString=".doc") returned 4 [0107.294] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".docx") returned 5 [0107.294] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.294] lstrlenW (lpString=".pdf") returned 4 [0107.294] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".xls") returned 4 [0107.294] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".xlsx") returned 5 [0107.294] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.294] lstrlenW (lpString=".ppt") returned 4 [0107.294] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.294] lstrlenW (lpString=".zip") returned 4 [0107.294] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".rar") returned 4 [0107.294] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".bz2") returned 4 [0107.294] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.294] lstrlenW (lpString=".7z") returned 3 [0107.294] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.295] lstrlenW (lpString=".dbf") returned 4 [0107.295] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.295] lstrlenW (lpString=".1cd") returned 4 [0107.295] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 63 [0107.295] lstrlenW (lpString=".jpg") returned 4 [0107.295] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.295] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") [0107.296] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4118) returned 1 [0107.296] CloseHandle (hObject=0x180) returned 1 [0107.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x20 [0107.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.296] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.296] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.297] GetLastError () returned 0x0 [0107.297] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1016, lpOverlapped=0x0) returned 1 [0107.299] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0107.300] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.300] SetEndOfFile (hFile=0x210) returned 1 [0107.300] CloseHandle (hObject=0x210) returned 1 [0107.300] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.300] SetEndOfFile (hFile=0x180) returned 1 [0107.301] CloseHandle (hObject=0x180) returned 1 [0107.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 1 [0107.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.301] lstrlenW (lpString=".doc") returned 4 [0107.301] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0107.301] lstrlenW (lpString=".docx") returned 5 [0107.301] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0107.301] lstrlenW (lpString=".pdf") returned 4 [0107.301] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString=".xls") returned 4 [0107.302] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString=".xlsx") returned 5 [0107.302] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0107.302] lstrlenW (lpString=".ppt") returned 4 [0107.302] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.302] lstrlenW (lpString=".zip") returned 4 [0107.302] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString=".rar") returned 4 [0107.302] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString=".bz2") returned 4 [0107.302] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString=".7z") returned 3 [0107.302] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.302] lstrlenW (lpString=".dbf") returned 4 [0107.302] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.302] lstrlenW (lpString=".1cd") returned 4 [0107.302] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 63 [0107.302] lstrlenW (lpString=".jpg") returned 4 [0107.302] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0107.302] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") [0107.303] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18898) returned 1 [0107.303] CloseHandle (hObject=0x180) returned 1 [0107.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 0x20 [0107.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.303] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.303] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.304] GetLastError () returned 0x0 [0107.304] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x49d2, lpOverlapped=0x0) returned 1 [0107.306] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x49e0, lpOverlapped=0x0) returned 1 [0107.307] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.307] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.307] SetEndOfFile (hFile=0x210) returned 1 [0107.307] CloseHandle (hObject=0x210) returned 1 [0107.308] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.308] SetEndOfFile (hFile=0x180) returned 1 [0107.308] CloseHandle (hObject=0x180) returned 1 [0107.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 1 [0107.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.309] lstrlenW (lpString=".doc") returned 4 [0107.309] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0107.309] lstrlenW (lpString=".docx") returned 5 [0107.309] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0107.309] lstrlenW (lpString=".pdf") returned 4 [0107.309] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.309] lstrlenW (lpString=".xls") returned 4 [0107.309] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.309] lstrlenW (lpString=".xlsx") returned 5 [0107.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0107.309] lstrlenW (lpString=".ppt") returned 4 [0107.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.309] lstrlenW (lpString=".zip") returned 4 [0107.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.309] lstrlenW (lpString=".rar") returned 4 [0107.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.309] lstrlenW (lpString=".bz2") returned 4 [0107.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.309] lstrlenW (lpString=".7z") returned 3 [0107.310] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.310] lstrlenW (lpString=".dbf") returned 4 [0107.310] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.310] lstrlenW (lpString=".1cd") returned 4 [0107.310] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.310] lstrlenW (lpString=".jpg") returned 4 [0107.310] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString=".pdf") returned 4 [0107.310] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString=".xls") returned 4 [0107.310] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString=".xlsx") returned 5 [0107.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0107.310] lstrlenW (lpString=".ppt") returned 4 [0107.310] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.310] lstrlenW (lpString=".zip") returned 4 [0107.310] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString=".rar") returned 4 [0107.310] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0107.310] lstrlenW (lpString=".bz2") returned 4 [0107.310] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0107.310] lstrlenW (lpString=".7z") returned 3 [0107.310] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0107.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.310] lstrlenW (lpString=".dbf") returned 4 [0107.310] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0107.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.311] lstrlenW (lpString=".1cd") returned 4 [0107.311] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0107.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 63 [0107.311] lstrlenW (lpString=".jpg") returned 4 [0107.311] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0107.311] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") [0107.311] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=30895) returned 1 [0107.311] CloseHandle (hObject=0x180) returned 1 [0107.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 0x20 [0107.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.312] GetLastError () returned 0x0 [0107.312] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x78af, lpOverlapped=0x0) returned 1 [0107.315] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x78b0, lpOverlapped=0x0) returned 1 [0107.316] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.316] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.316] SetEndOfFile (hFile=0x210) returned 1 [0107.316] CloseHandle (hObject=0x210) returned 1 [0107.317] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.317] SetEndOfFile (hFile=0x180) returned 1 [0107.318] CloseHandle (hObject=0x180) returned 1 [0107.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 1 [0107.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.318] lstrlenW (lpString=".doc") returned 4 [0107.318] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.318] lstrlenW (lpString=".docx") returned 5 [0107.318] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0107.318] lstrlenW (lpString=".pdf") returned 4 [0107.318] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.318] lstrlenW (lpString=".xls") returned 4 [0107.318] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.318] lstrlenW (lpString=".xlsx") returned 5 [0107.318] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0107.318] lstrlenW (lpString=".ppt") returned 4 [0107.318] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.318] lstrlenW (lpString=".zip") returned 4 [0107.319] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.319] lstrlenW (lpString=".rar") returned 4 [0107.319] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.319] lstrlenW (lpString=".bz2") returned 4 [0107.319] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.319] lstrlenW (lpString=".7z") returned 3 [0107.319] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.319] lstrlenW (lpString=".dbf") returned 4 [0107.319] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.319] lstrlenW (lpString=".1cd") returned 4 [0107.319] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 63 [0107.319] lstrlenW (lpString=".jpg") returned 4 [0107.319] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.319] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") [0107.320] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=29776) returned 1 [0107.320] CloseHandle (hObject=0x180) returned 1 [0107.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x20 [0107.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.320] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.320] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.321] GetLastError () returned 0x0 [0107.321] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7450, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0107.325] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.325] SetEndOfFile (hFile=0x210) returned 1 [0107.325] CloseHandle (hObject=0x210) returned 1 [0107.325] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.325] SetEndOfFile (hFile=0x180) returned 1 [0107.326] CloseHandle (hObject=0x180) returned 1 [0107.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 1 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString=".doc") returned 4 [0107.327] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.327] lstrlenW (lpString=".docx") returned 5 [0107.327] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0107.327] lstrlenW (lpString=".pdf") returned 4 [0107.327] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.327] lstrlenW (lpString=".xls") returned 4 [0107.327] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.327] lstrlenW (lpString=".xlsx") returned 5 [0107.327] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0107.327] lstrlenW (lpString=".ppt") returned 4 [0107.327] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString=".zip") returned 4 [0107.327] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.327] lstrlenW (lpString=".rar") returned 4 [0107.327] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.327] lstrlenW (lpString=".bz2") returned 4 [0107.327] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.327] lstrlenW (lpString=".7z") returned 3 [0107.327] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString=".dbf") returned 4 [0107.327] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString=".1cd") returned 4 [0107.327] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 63 [0107.327] lstrlenW (lpString=".jpg") returned 4 [0107.327] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.327] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") [0107.562] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=41795) returned 1 [0107.562] CloseHandle (hObject=0x180) returned 1 [0107.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x20 [0107.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.563] GetLastError () returned 0x0 [0107.563] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa343, lpOverlapped=0x0) returned 1 [0107.921] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xa350, lpOverlapped=0x0) returned 1 [0107.922] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.924] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.924] SetEndOfFile (hFile=0x210) returned 1 [0107.925] CloseHandle (hObject=0x210) returned 1 [0107.925] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.925] SetEndOfFile (hFile=0x180) returned 1 [0107.926] CloseHandle (hObject=0x180) returned 1 [0107.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 1 [0107.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.963] lstrlenW (lpString=".doc") returned 4 [0107.963] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0107.963] lstrlenW (lpString=".docx") returned 5 [0107.963] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0107.963] lstrlenW (lpString=".pdf") returned 4 [0107.963] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0107.963] lstrlenW (lpString=".xls") returned 4 [0107.963] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0107.963] lstrlenW (lpString=".xlsx") returned 5 [0107.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0107.963] lstrlenW (lpString=".ppt") returned 4 [0107.963] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0107.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.963] lstrlenW (lpString=".zip") returned 4 [0107.963] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0107.963] lstrlenW (lpString=".rar") returned 4 [0107.963] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0107.963] lstrlenW (lpString=".bz2") returned 4 [0107.963] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0107.963] lstrlenW (lpString=".7z") returned 3 [0107.963] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0107.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.963] lstrlenW (lpString=".dbf") returned 4 [0107.963] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0107.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.964] lstrlenW (lpString=".1cd") returned 4 [0107.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0107.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 63 [0107.964] lstrlenW (lpString=".jpg") returned 4 [0107.964] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0107.964] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") [0107.965] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31404) returned 1 [0107.965] CloseHandle (hObject=0x180) returned 1 [0107.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 0x20 [0107.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.965] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.965] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.967] GetLastError () returned 0x0 [0107.967] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7aac, lpOverlapped=0x0) returned 1 [0107.969] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7ab0, lpOverlapped=0x0) returned 1 [0107.970] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.970] SetEndOfFile (hFile=0x210) returned 1 [0107.970] CloseHandle (hObject=0x210) returned 1 [0107.970] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.970] SetEndOfFile (hFile=0x180) returned 1 [0107.971] CloseHandle (hObject=0x180) returned 1 [0107.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 1 [0107.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.972] lstrlenW (lpString=".doc") returned 4 [0107.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString=".docx") returned 5 [0107.972] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0107.972] lstrlenW (lpString=".pdf") returned 4 [0107.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString=".xls") returned 4 [0107.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.972] lstrlenW (lpString=".xlsx") returned 5 [0107.972] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0107.972] lstrlenW (lpString=".ppt") returned 4 [0107.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.972] lstrlenW (lpString=".zip") returned 4 [0107.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.972] lstrlenW (lpString=".rar") returned 4 [0107.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString=".bz2") returned 4 [0107.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString=".7z") returned 3 [0107.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.972] lstrlenW (lpString=".dbf") returned 4 [0107.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.972] lstrlenW (lpString=".1cd") returned 4 [0107.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 63 [0107.973] lstrlenW (lpString=".jpg") returned 4 [0107.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.973] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") [0107.974] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=982) returned 1 [0107.974] CloseHandle (hObject=0x180) returned 1 [0107.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 0x20 [0107.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.974] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.974] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.975] GetLastError () returned 0x0 [0107.975] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3d6, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3e0, lpOverlapped=0x0) returned 1 [0107.977] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0107.977] SetEndOfFile (hFile=0x210) returned 1 [0107.977] CloseHandle (hObject=0x210) returned 1 [0107.978] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.978] SetEndOfFile (hFile=0x180) returned 1 [0107.979] CloseHandle (hObject=0x180) returned 1 [0107.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 1 [0107.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.979] lstrlenW (lpString=".doc") returned 4 [0107.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.979] lstrlenW (lpString=".docx") returned 5 [0107.979] lstrcmpiW (lpString1=".docx", lpString2="O.WMF") returned -1 [0107.979] lstrlenW (lpString=".pdf") returned 4 [0107.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.979] lstrlenW (lpString=".xls") returned 4 [0107.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.979] lstrlenW (lpString=".xlsx") returned 5 [0107.979] lstrcmpiW (lpString1=".xlsx", lpString2="O.WMF") returned -1 [0107.979] lstrlenW (lpString=".ppt") returned 4 [0107.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.979] lstrlenW (lpString=".zip") returned 4 [0107.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.980] lstrlenW (lpString=".rar") returned 4 [0107.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.980] lstrlenW (lpString=".bz2") returned 4 [0107.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.980] lstrlenW (lpString=".7z") returned 3 [0107.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.980] lstrlenW (lpString=".dbf") returned 4 [0107.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.980] lstrlenW (lpString=".1cd") returned 4 [0107.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 62 [0107.980] lstrlenW (lpString=".jpg") returned 4 [0107.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.980] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") [0107.981] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3594) returned 1 [0107.981] CloseHandle (hObject=0x180) returned 1 [0107.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x20 [0107.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0107.982] GetLastError () returned 0x0 [0107.982] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xe0a, lpOverlapped=0x0) returned 1 [0107.984] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0107.985] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.985] WriteFile (in: hFile=0x210, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.985] SetEndOfFile (hFile=0x210) returned 1 [0107.985] CloseHandle (hObject=0x210) returned 1 [0107.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.985] SetEndOfFile (hFile=0x180) returned 1 [0107.986] CloseHandle (hObject=0x180) returned 1 [0107.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 1 [0107.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.986] lstrlenW (lpString=".doc") returned 4 [0107.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.986] lstrlenW (lpString=".docx") returned 5 [0107.986] lstrcmpiW (lpString1=".docx", lpString2="G.WMF") returned -1 [0107.986] lstrlenW (lpString=".pdf") returned 4 [0107.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.986] lstrlenW (lpString=".xls") returned 4 [0107.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.987] lstrlenW (lpString=".xlsx") returned 5 [0107.987] lstrcmpiW (lpString1=".xlsx", lpString2="G.WMF") returned -1 [0107.987] lstrlenW (lpString=".ppt") returned 4 [0107.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.987] lstrlenW (lpString=".zip") returned 4 [0107.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.987] lstrlenW (lpString=".rar") returned 4 [0107.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.987] lstrlenW (lpString=".bz2") returned 4 [0107.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.987] lstrlenW (lpString=".7z") returned 3 [0107.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.987] lstrlenW (lpString=".dbf") returned 4 [0107.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.987] lstrlenW (lpString=".1cd") returned 4 [0107.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 63 [0107.987] lstrlenW (lpString=".jpg") returned 4 [0107.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.987] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") [0108.352] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1910) returned 1 [0108.352] CloseHandle (hObject=0x22c) returned 1 [0108.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x20 [0108.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.352] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.352] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.353] GetLastError () returned 0x0 [0108.353] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x776, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x780, lpOverlapped=0x0) returned 1 [0108.356] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.356] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.356] SetEndOfFile (hFile=0x1b8) returned 1 [0108.356] CloseHandle (hObject=0x1b8) returned 1 [0108.356] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.356] SetEndOfFile (hFile=0x22c) returned 1 [0108.357] CloseHandle (hObject=0x22c) returned 1 [0108.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 1 [0108.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.357] lstrlenW (lpString=".doc") returned 4 [0108.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.357] lstrlenW (lpString=".docx") returned 5 [0108.357] lstrcmpiW (lpString1=".docx", lpString2="M.WMF") returned -1 [0108.357] lstrlenW (lpString=".pdf") returned 4 [0108.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.357] lstrlenW (lpString=".xls") returned 4 [0108.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.358] lstrlenW (lpString=".xlsx") returned 5 [0108.358] lstrcmpiW (lpString1=".xlsx", lpString2="M.WMF") returned -1 [0108.358] lstrlenW (lpString=".ppt") returned 4 [0108.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.358] lstrlenW (lpString=".zip") returned 4 [0108.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.358] lstrlenW (lpString=".rar") returned 4 [0108.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString=".bz2") returned 4 [0108.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString=".7z") returned 3 [0108.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.358] lstrlenW (lpString=".dbf") returned 4 [0108.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.358] lstrlenW (lpString=".1cd") returned 4 [0108.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 63 [0108.358] lstrlenW (lpString=".jpg") returned 4 [0108.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.358] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") [0108.359] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10762) returned 1 [0108.359] CloseHandle (hObject=0x22c) returned 1 [0108.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x20 [0108.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.359] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.359] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.360] GetLastError () returned 0x0 [0108.360] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2a0a, lpOverlapped=0x0) returned 1 [0108.369] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0108.371] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.371] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.371] SetEndOfFile (hFile=0x1b8) returned 1 [0108.371] CloseHandle (hObject=0x1b8) returned 1 [0108.371] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.371] SetEndOfFile (hFile=0x22c) returned 1 [0108.372] CloseHandle (hObject=0x22c) returned 1 [0108.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 1 [0108.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.372] lstrlenW (lpString=".doc") returned 4 [0108.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.372] lstrlenW (lpString=".docx") returned 5 [0108.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.372] lstrlenW (lpString=".pdf") returned 4 [0108.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.372] lstrlenW (lpString=".xls") returned 4 [0108.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.372] lstrlenW (lpString=".xlsx") returned 5 [0108.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.373] lstrlenW (lpString=".ppt") returned 4 [0108.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.373] lstrlenW (lpString=".zip") returned 4 [0108.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.373] lstrlenW (lpString=".rar") returned 4 [0108.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".bz2") returned 4 [0108.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".7z") returned 3 [0108.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.373] lstrlenW (lpString=".dbf") returned 4 [0108.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.373] lstrlenW (lpString=".1cd") returned 4 [0108.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.373] lstrlenW (lpString=".jpg") returned 4 [0108.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".pdf") returned 4 [0108.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".xls") returned 4 [0108.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.373] lstrlenW (lpString=".xlsx") returned 5 [0108.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.373] lstrlenW (lpString=".ppt") returned 4 [0108.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.374] lstrlenW (lpString=".zip") returned 4 [0108.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.374] lstrlenW (lpString=".rar") returned 4 [0108.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".bz2") returned 4 [0108.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".7z") returned 3 [0108.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.374] lstrlenW (lpString=".dbf") returned 4 [0108.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.374] lstrlenW (lpString=".1cd") returned 4 [0108.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 63 [0108.374] lstrlenW (lpString=".jpg") returned 4 [0108.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.374] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") [0108.375] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3932) returned 1 [0108.375] CloseHandle (hObject=0x22c) returned 1 [0108.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x20 [0108.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.375] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.375] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.376] GetLastError () returned 0x0 [0108.376] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xf5c, lpOverlapped=0x0) returned 1 [0108.387] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf60, lpOverlapped=0x0) returned 1 [0108.388] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.388] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.388] SetEndOfFile (hFile=0x1b8) returned 1 [0108.395] CloseHandle (hObject=0x1b8) returned 1 [0108.399] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.400] SetEndOfFile (hFile=0x22c) returned 1 [0108.408] CloseHandle (hObject=0x22c) returned 1 [0108.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 1 [0108.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.408] lstrlenW (lpString=".doc") returned 4 [0108.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".docx") returned 5 [0108.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.409] lstrlenW (lpString=".pdf") returned 4 [0108.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".xls") returned 4 [0108.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.409] lstrlenW (lpString=".xlsx") returned 5 [0108.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.409] lstrlenW (lpString=".ppt") returned 4 [0108.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.409] lstrlenW (lpString=".zip") returned 4 [0108.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.409] lstrlenW (lpString=".rar") returned 4 [0108.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".bz2") returned 4 [0108.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".7z") returned 3 [0108.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.409] lstrlenW (lpString=".dbf") returned 4 [0108.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.409] lstrlenW (lpString=".1cd") returned 4 [0108.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.409] lstrlenW (lpString=".jpg") returned 4 [0108.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".pdf") returned 4 [0108.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.409] lstrlenW (lpString=".xls") returned 4 [0108.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.410] lstrlenW (lpString=".xlsx") returned 5 [0108.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.410] lstrlenW (lpString=".ppt") returned 4 [0108.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.410] lstrlenW (lpString=".zip") returned 4 [0108.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.410] lstrlenW (lpString=".rar") returned 4 [0108.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.410] lstrlenW (lpString=".bz2") returned 4 [0108.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.410] lstrlenW (lpString=".7z") returned 3 [0108.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.410] lstrlenW (lpString=".dbf") returned 4 [0108.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.410] lstrlenW (lpString=".1cd") returned 4 [0108.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 63 [0108.410] lstrlenW (lpString=".jpg") returned 4 [0108.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.410] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") [0108.411] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2788) returned 1 [0108.411] CloseHandle (hObject=0x22c) returned 1 [0108.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x20 [0108.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.411] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.411] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.412] GetLastError () returned 0x0 [0108.412] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xae4, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0108.428] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.428] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.428] SetEndOfFile (hFile=0x180) returned 1 [0108.428] CloseHandle (hObject=0x180) returned 1 [0108.429] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.429] SetEndOfFile (hFile=0x22c) returned 1 [0108.429] CloseHandle (hObject=0x22c) returned 1 [0108.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 1 [0108.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.430] lstrlenW (lpString=".doc") returned 4 [0108.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.430] lstrlenW (lpString=".docx") returned 5 [0108.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.430] lstrlenW (lpString=".pdf") returned 4 [0108.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.430] lstrlenW (lpString=".xls") returned 4 [0108.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.430] lstrlenW (lpString=".xlsx") returned 5 [0108.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.430] lstrlenW (lpString=".ppt") returned 4 [0108.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.430] lstrlenW (lpString=".zip") returned 4 [0108.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.430] lstrlenW (lpString=".rar") returned 4 [0108.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.430] lstrlenW (lpString=".bz2") returned 4 [0108.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.430] lstrlenW (lpString=".7z") returned 3 [0108.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.430] lstrlenW (lpString=".dbf") returned 4 [0108.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".1cd") returned 4 [0108.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".jpg") returned 4 [0108.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString=".pdf") returned 4 [0108.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString=".xls") returned 4 [0108.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.431] lstrlenW (lpString=".xlsx") returned 5 [0108.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.431] lstrlenW (lpString=".ppt") returned 4 [0108.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".zip") returned 4 [0108.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.431] lstrlenW (lpString=".rar") returned 4 [0108.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString=".bz2") returned 4 [0108.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString=".7z") returned 3 [0108.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".dbf") returned 4 [0108.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".1cd") returned 4 [0108.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 63 [0108.431] lstrlenW (lpString=".jpg") returned 4 [0108.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.432] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") [0108.432] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7608) returned 1 [0108.432] CloseHandle (hObject=0x22c) returned 1 [0108.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x20 [0108.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.433] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.433] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.433] GetLastError () returned 0x0 [0108.433] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1db8, lpOverlapped=0x0) returned 1 [0108.442] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1dc0, lpOverlapped=0x0) returned 1 [0108.443] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.443] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.443] SetEndOfFile (hFile=0x180) returned 1 [0108.444] CloseHandle (hObject=0x180) returned 1 [0108.444] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.444] SetEndOfFile (hFile=0x22c) returned 1 [0108.444] CloseHandle (hObject=0x22c) returned 1 [0108.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 1 [0108.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.445] lstrlenW (lpString=".doc") returned 4 [0108.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.445] lstrlenW (lpString=".docx") returned 5 [0108.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.445] lstrlenW (lpString=".pdf") returned 4 [0108.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.445] lstrlenW (lpString=".xls") returned 4 [0108.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.445] lstrlenW (lpString=".xlsx") returned 5 [0108.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.445] lstrlenW (lpString=".ppt") returned 4 [0108.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.445] lstrlenW (lpString=".zip") returned 4 [0108.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.445] lstrlenW (lpString=".rar") returned 4 [0108.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.445] lstrlenW (lpString=".bz2") returned 4 [0108.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString=".7z") returned 3 [0108.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.446] lstrlenW (lpString=".dbf") returned 4 [0108.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.446] lstrlenW (lpString=".1cd") returned 4 [0108.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.446] lstrlenW (lpString=".jpg") returned 4 [0108.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString=".pdf") returned 4 [0108.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString=".xls") returned 4 [0108.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.446] lstrlenW (lpString=".xlsx") returned 5 [0108.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.446] lstrlenW (lpString=".ppt") returned 4 [0108.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.446] lstrlenW (lpString=".zip") returned 4 [0108.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.509] lstrlenW (lpString=".rar") returned 4 [0108.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.509] lstrlenW (lpString=".bz2") returned 4 [0108.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.509] lstrlenW (lpString=".7z") returned 3 [0108.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.509] lstrlenW (lpString=".dbf") returned 4 [0108.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.509] lstrlenW (lpString=".1cd") returned 4 [0108.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 63 [0108.509] lstrlenW (lpString=".jpg") returned 4 [0108.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.509] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") [0108.510] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31360) returned 1 [0108.510] CloseHandle (hObject=0x22c) returned 1 [0108.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 0x20 [0108.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.510] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.511] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.511] GetLastError () returned 0x0 [0108.511] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7a80, lpOverlapped=0x0) returned 1 [0108.568] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7a90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7a90, lpOverlapped=0x0) returned 1 [0108.569] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.569] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.569] SetEndOfFile (hFile=0x180) returned 1 [0108.570] CloseHandle (hObject=0x180) returned 1 [0108.570] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.570] SetEndOfFile (hFile=0x22c) returned 1 [0108.571] CloseHandle (hObject=0x22c) returned 1 [0108.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 1 [0108.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.571] lstrlenW (lpString=".doc") returned 4 [0108.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.571] lstrlenW (lpString=".docx") returned 5 [0108.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.572] lstrlenW (lpString=".pdf") returned 4 [0108.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString=".xls") returned 4 [0108.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.572] lstrlenW (lpString=".xlsx") returned 5 [0108.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.572] lstrlenW (lpString=".ppt") returned 4 [0108.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.572] lstrlenW (lpString=".zip") returned 4 [0108.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.572] lstrlenW (lpString=".rar") returned 4 [0108.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString=".bz2") returned 4 [0108.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString=".7z") returned 3 [0108.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.572] lstrlenW (lpString=".dbf") returned 4 [0108.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.572] lstrlenW (lpString=".1cd") returned 4 [0108.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.572] lstrlenW (lpString=".jpg") returned 4 [0108.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString=".pdf") returned 4 [0108.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.572] lstrlenW (lpString=".xls") returned 4 [0108.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.572] lstrlenW (lpString=".xlsx") returned 5 [0108.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.573] lstrlenW (lpString=".ppt") returned 4 [0108.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.573] lstrlenW (lpString=".zip") returned 4 [0108.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.573] lstrlenW (lpString=".rar") returned 4 [0108.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.573] lstrlenW (lpString=".bz2") returned 4 [0108.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.573] lstrlenW (lpString=".7z") returned 3 [0108.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.573] lstrlenW (lpString=".dbf") returned 4 [0108.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.573] lstrlenW (lpString=".1cd") returned 4 [0108.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 63 [0108.573] lstrlenW (lpString=".jpg") returned 4 [0108.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.573] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") [0108.590] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=36622) returned 1 [0108.590] CloseHandle (hObject=0x22c) returned 1 [0108.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 0x20 [0108.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.591] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.591] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.591] GetLastError () returned 0x0 [0108.591] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8f0e, lpOverlapped=0x0) returned 1 [0108.606] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0108.608] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.608] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.608] SetEndOfFile (hFile=0x180) returned 1 [0108.608] CloseHandle (hObject=0x180) returned 1 [0108.608] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.608] SetEndOfFile (hFile=0x22c) returned 1 [0108.609] CloseHandle (hObject=0x22c) returned 1 [0108.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 1 [0108.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.610] lstrlenW (lpString=".doc") returned 4 [0108.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString=".docx") returned 5 [0108.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.610] lstrlenW (lpString=".pdf") returned 4 [0108.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString=".xls") returned 4 [0108.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.610] lstrlenW (lpString=".xlsx") returned 5 [0108.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.610] lstrlenW (lpString=".ppt") returned 4 [0108.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.610] lstrlenW (lpString=".zip") returned 4 [0108.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.610] lstrlenW (lpString=".rar") returned 4 [0108.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString=".bz2") returned 4 [0108.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString=".7z") returned 3 [0108.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.610] lstrlenW (lpString=".dbf") returned 4 [0108.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.610] lstrlenW (lpString=".1cd") returned 4 [0108.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.610] lstrlenW (lpString=".jpg") returned 4 [0108.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.610] lstrlenW (lpString=".pdf") returned 4 [0108.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.611] lstrlenW (lpString=".xls") returned 4 [0108.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.611] lstrlenW (lpString=".xlsx") returned 5 [0108.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.611] lstrlenW (lpString=".ppt") returned 4 [0108.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.611] lstrlenW (lpString=".zip") returned 4 [0108.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.611] lstrlenW (lpString=".rar") returned 4 [0108.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.611] lstrlenW (lpString=".bz2") returned 4 [0108.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.611] lstrlenW (lpString=".7z") returned 3 [0108.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.611] lstrlenW (lpString=".dbf") returned 4 [0108.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.611] lstrlenW (lpString=".1cd") returned 4 [0108.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 63 [0108.647] lstrlenW (lpString=".jpg") returned 4 [0108.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.647] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") [0108.648] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10534) returned 1 [0108.648] CloseHandle (hObject=0x22c) returned 1 [0108.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf")) returned 0x20 [0108.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.648] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.648] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.649] GetLastError () returned 0x0 [0108.649] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2926, lpOverlapped=0x0) returned 1 [0108.650] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0108.651] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.651] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.651] SetEndOfFile (hFile=0x180) returned 1 [0108.652] CloseHandle (hObject=0x180) returned 1 [0108.652] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.652] SetEndOfFile (hFile=0x22c) returned 1 [0108.652] CloseHandle (hObject=0x22c) returned 1 [0108.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf")) returned 1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.653] lstrlenW (lpString=".doc") returned 4 [0108.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.653] lstrlenW (lpString=".docx") returned 5 [0108.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.653] lstrlenW (lpString=".pdf") returned 4 [0108.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.653] lstrlenW (lpString=".xls") returned 4 [0108.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.653] lstrlenW (lpString=".xlsx") returned 5 [0108.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.653] lstrlenW (lpString=".ppt") returned 4 [0108.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.653] lstrlenW (lpString=".zip") returned 4 [0108.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.653] lstrlenW (lpString=".rar") returned 4 [0108.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.653] lstrlenW (lpString=".bz2") returned 4 [0108.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".7z") returned 3 [0108.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.654] lstrlenW (lpString=".dbf") returned 4 [0108.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.654] lstrlenW (lpString=".1cd") returned 4 [0108.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.654] lstrlenW (lpString=".jpg") returned 4 [0108.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".pdf") returned 4 [0108.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".xls") returned 4 [0108.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.654] lstrlenW (lpString=".xlsx") returned 5 [0108.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.654] lstrlenW (lpString=".ppt") returned 4 [0108.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.654] lstrlenW (lpString=".zip") returned 4 [0108.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.654] lstrlenW (lpString=".rar") returned 4 [0108.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".bz2") returned 4 [0108.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".7z") returned 3 [0108.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.654] lstrlenW (lpString=".dbf") returned 4 [0108.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.655] lstrlenW (lpString=".1cd") returned 4 [0108.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 63 [0108.655] lstrlenW (lpString=".jpg") returned 4 [0108.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.655] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") [0108.655] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=11936) returned 1 [0108.655] CloseHandle (hObject=0x22c) returned 1 [0108.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf")) returned 0x20 [0108.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.656] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.656] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.656] GetLastError () returned 0x0 [0108.656] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2ea0, lpOverlapped=0x0) returned 1 [0108.658] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2eb0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2eb0, lpOverlapped=0x0) returned 1 [0108.659] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.659] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.659] SetEndOfFile (hFile=0x180) returned 1 [0108.659] CloseHandle (hObject=0x180) returned 1 [0108.659] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.659] SetEndOfFile (hFile=0x22c) returned 1 [0108.660] CloseHandle (hObject=0x22c) returned 1 [0108.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf")) returned 1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.720] lstrlenW (lpString=".doc") returned 4 [0108.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.720] lstrlenW (lpString=".docx") returned 5 [0108.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.720] lstrlenW (lpString=".pdf") returned 4 [0108.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.720] lstrlenW (lpString=".xls") returned 4 [0108.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.720] lstrlenW (lpString=".xlsx") returned 5 [0108.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.720] lstrlenW (lpString=".ppt") returned 4 [0108.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.720] lstrlenW (lpString=".zip") returned 4 [0108.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.720] lstrlenW (lpString=".rar") returned 4 [0108.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.720] lstrlenW (lpString=".bz2") returned 4 [0108.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.720] lstrlenW (lpString=".7z") returned 3 [0108.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.720] lstrlenW (lpString=".dbf") returned 4 [0108.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".1cd") returned 4 [0108.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".jpg") returned 4 [0108.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString=".pdf") returned 4 [0108.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString=".xls") returned 4 [0108.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.721] lstrlenW (lpString=".xlsx") returned 5 [0108.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.721] lstrlenW (lpString=".ppt") returned 4 [0108.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".zip") returned 4 [0108.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.721] lstrlenW (lpString=".rar") returned 4 [0108.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString=".bz2") returned 4 [0108.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString=".7z") returned 3 [0108.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".dbf") returned 4 [0108.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".1cd") returned 4 [0108.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 63 [0108.721] lstrlenW (lpString=".jpg") returned 4 [0108.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.722] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") [0108.722] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=68792) returned 1 [0108.722] CloseHandle (hObject=0x22c) returned 1 [0108.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 0x20 [0108.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.739] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.740] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.740] GetLastError () returned 0x0 [0108.740] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x10cb8, lpOverlapped=0x0) returned 1 [0108.743] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x10cc0, lpOverlapped=0x0) returned 1 [0108.745] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.745] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.745] SetEndOfFile (hFile=0x180) returned 1 [0108.745] CloseHandle (hObject=0x180) returned 1 [0108.745] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.745] SetEndOfFile (hFile=0x22c) returned 1 [0108.747] CloseHandle (hObject=0x22c) returned 1 [0108.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 1 [0108.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.747] lstrlenW (lpString=".doc") returned 4 [0108.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.747] lstrlenW (lpString=".docx") returned 5 [0108.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.747] lstrlenW (lpString=".pdf") returned 4 [0108.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.747] lstrlenW (lpString=".xls") returned 4 [0108.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.747] lstrlenW (lpString=".xlsx") returned 5 [0108.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.747] lstrlenW (lpString=".ppt") returned 4 [0108.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.747] lstrlenW (lpString=".zip") returned 4 [0108.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.747] lstrlenW (lpString=".rar") returned 4 [0108.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".bz2") returned 4 [0108.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".7z") returned 3 [0108.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.748] lstrlenW (lpString=".dbf") returned 4 [0108.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.748] lstrlenW (lpString=".1cd") returned 4 [0108.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.748] lstrlenW (lpString=".jpg") returned 4 [0108.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".pdf") returned 4 [0108.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".xls") returned 4 [0108.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.748] lstrlenW (lpString=".xlsx") returned 5 [0108.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.748] lstrlenW (lpString=".ppt") returned 4 [0108.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.748] lstrlenW (lpString=".zip") returned 4 [0108.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.748] lstrlenW (lpString=".rar") returned 4 [0108.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".bz2") returned 4 [0108.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".7z") returned 3 [0108.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.749] lstrlenW (lpString=".dbf") returned 4 [0108.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.749] lstrlenW (lpString=".1cd") returned 4 [0108.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 63 [0108.749] lstrlenW (lpString=".jpg") returned 4 [0108.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.749] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") [0108.749] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=35734) returned 1 [0108.749] CloseHandle (hObject=0x22c) returned 1 [0108.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 0x20 [0108.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.750] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.750] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.750] GetLastError () returned 0x0 [0108.750] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8b96, lpOverlapped=0x0) returned 1 [0108.754] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8ba0, lpOverlapped=0x0) returned 1 [0108.755] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.755] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.756] SetEndOfFile (hFile=0x180) returned 1 [0108.756] CloseHandle (hObject=0x180) returned 1 [0108.756] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.756] SetEndOfFile (hFile=0x22c) returned 1 [0108.757] CloseHandle (hObject=0x22c) returned 1 [0108.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 1 [0108.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.757] lstrlenW (lpString=".doc") returned 4 [0108.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.757] lstrlenW (lpString=".docx") returned 5 [0108.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.757] lstrlenW (lpString=".pdf") returned 4 [0108.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.757] lstrlenW (lpString=".xls") returned 4 [0108.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.757] lstrlenW (lpString=".xlsx") returned 5 [0108.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.758] lstrlenW (lpString=".ppt") returned 4 [0108.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.758] lstrlenW (lpString=".zip") returned 4 [0108.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".rar") returned 4 [0108.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".bz2") returned 4 [0108.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".7z") returned 3 [0108.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.758] lstrlenW (lpString=".dbf") returned 4 [0108.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.758] lstrlenW (lpString=".1cd") returned 4 [0108.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.758] lstrlenW (lpString=".jpg") returned 4 [0108.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".pdf") returned 4 [0108.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".xls") returned 4 [0108.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".xlsx") returned 5 [0108.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.758] lstrlenW (lpString=".ppt") returned 4 [0108.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.759] lstrlenW (lpString=".zip") returned 4 [0108.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.759] lstrlenW (lpString=".rar") returned 4 [0108.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString=".bz2") returned 4 [0108.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString=".7z") returned 3 [0108.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.759] lstrlenW (lpString=".dbf") returned 4 [0108.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.759] lstrlenW (lpString=".1cd") returned 4 [0108.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 63 [0108.759] lstrlenW (lpString=".jpg") returned 4 [0108.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.759] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") [0108.760] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=48096) returned 1 [0108.760] CloseHandle (hObject=0x22c) returned 1 [0108.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 0x20 [0108.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.760] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.760] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.761] GetLastError () returned 0x0 [0108.761] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xbbe0, lpOverlapped=0x0) returned 1 [0108.763] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xbbf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xbbf0, lpOverlapped=0x0) returned 1 [0108.764] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.764] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.764] SetEndOfFile (hFile=0x180) returned 1 [0108.765] CloseHandle (hObject=0x180) returned 1 [0108.765] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.765] SetEndOfFile (hFile=0x22c) returned 1 [0108.766] CloseHandle (hObject=0x22c) returned 1 [0108.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.766] lstrlenW (lpString=".doc") returned 4 [0108.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".docx") returned 5 [0108.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.766] lstrlenW (lpString=".pdf") returned 4 [0108.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".xls") returned 4 [0108.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.766] lstrlenW (lpString=".xlsx") returned 5 [0108.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.766] lstrlenW (lpString=".ppt") returned 4 [0108.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.767] lstrlenW (lpString=".zip") returned 4 [0108.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.767] lstrlenW (lpString=".rar") returned 4 [0108.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString=".bz2") returned 4 [0108.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString=".7z") returned 3 [0108.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.767] lstrlenW (lpString=".dbf") returned 4 [0108.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.767] lstrlenW (lpString=".1cd") returned 4 [0108.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.767] lstrlenW (lpString=".jpg") returned 4 [0108.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString=".pdf") returned 4 [0108.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString=".xls") returned 4 [0108.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.767] lstrlenW (lpString=".xlsx") returned 5 [0108.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.767] lstrlenW (lpString=".ppt") returned 4 [0108.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.767] lstrlenW (lpString=".zip") returned 4 [0108.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.768] lstrlenW (lpString=".rar") returned 4 [0108.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.768] lstrlenW (lpString=".bz2") returned 4 [0108.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.768] lstrlenW (lpString=".7z") returned 3 [0108.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.768] lstrlenW (lpString=".dbf") returned 4 [0108.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.768] lstrlenW (lpString=".1cd") returned 4 [0108.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 63 [0108.768] lstrlenW (lpString=".jpg") returned 4 [0108.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.768] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") [0108.769] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=37708) returned 1 [0108.769] CloseHandle (hObject=0x22c) returned 1 [0108.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 0x20 [0108.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0108.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0108.769] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.770] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.770] GetLastError () returned 0x0 [0108.770] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x934c, lpOverlapped=0x0) returned 1 [0108.950] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9350, lpOverlapped=0x0) returned 1 [0108.951] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.951] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.952] SetEndOfFile (hFile=0x180) returned 1 [0108.952] CloseHandle (hObject=0x180) returned 1 [0108.952] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.952] SetEndOfFile (hFile=0x22c) returned 1 [0108.953] CloseHandle (hObject=0x22c) returned 1 [0108.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 1 [0109.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString=".doc") returned 4 [0109.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString=".docx") returned 5 [0109.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.231] lstrlenW (lpString=".pdf") returned 4 [0109.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString=".xls") returned 4 [0109.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.231] lstrlenW (lpString=".xlsx") returned 5 [0109.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.231] lstrlenW (lpString=".ppt") returned 4 [0109.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString=".zip") returned 4 [0109.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.231] lstrlenW (lpString=".rar") returned 4 [0109.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString=".bz2") returned 4 [0109.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString=".7z") returned 3 [0109.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString=".dbf") returned 4 [0109.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString=".1cd") returned 4 [0109.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.231] lstrlenW (lpString=".jpg") returned 4 [0109.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.231] lstrlenW (lpString=".pdf") returned 4 [0109.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString=".xls") returned 4 [0109.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.232] lstrlenW (lpString=".xlsx") returned 5 [0109.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.232] lstrlenW (lpString=".ppt") returned 4 [0109.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.232] lstrlenW (lpString=".zip") returned 4 [0109.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.232] lstrlenW (lpString=".rar") returned 4 [0109.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString=".bz2") returned 4 [0109.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString=".7z") returned 3 [0109.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.232] lstrlenW (lpString=".dbf") returned 4 [0109.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.232] lstrlenW (lpString=".1cd") returned 4 [0109.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 63 [0109.232] lstrlenW (lpString=".jpg") returned 4 [0109.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.232] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") [0109.233] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2724) returned 1 [0109.233] CloseHandle (hObject=0x1c8) returned 1 [0109.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf")) returned 0x20 [0109.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.233] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.233] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.234] GetLastError () returned 0x0 [0109.234] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xaa4, lpOverlapped=0x0) returned 1 [0109.235] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0109.236] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.236] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.236] SetEndOfFile (hFile=0x1b8) returned 1 [0109.236] CloseHandle (hObject=0x1b8) returned 1 [0109.237] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.237] SetEndOfFile (hFile=0x1c8) returned 1 [0109.237] CloseHandle (hObject=0x1c8) returned 1 [0109.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf")) returned 1 [0109.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.238] lstrlenW (lpString=".doc") returned 4 [0109.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString=".docx") returned 5 [0109.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.238] lstrlenW (lpString=".pdf") returned 4 [0109.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString=".xls") returned 4 [0109.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.238] lstrlenW (lpString=".xlsx") returned 5 [0109.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.238] lstrlenW (lpString=".ppt") returned 4 [0109.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.238] lstrlenW (lpString=".zip") returned 4 [0109.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.238] lstrlenW (lpString=".rar") returned 4 [0109.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString=".bz2") returned 4 [0109.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString=".7z") returned 3 [0109.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.238] lstrlenW (lpString=".dbf") returned 4 [0109.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".1cd") returned 4 [0109.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".jpg") returned 4 [0109.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString=".pdf") returned 4 [0109.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString=".xls") returned 4 [0109.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.239] lstrlenW (lpString=".xlsx") returned 5 [0109.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.239] lstrlenW (lpString=".ppt") returned 4 [0109.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".zip") returned 4 [0109.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.239] lstrlenW (lpString=".rar") returned 4 [0109.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString=".bz2") returned 4 [0109.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString=".7z") returned 3 [0109.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".dbf") returned 4 [0109.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".1cd") returned 4 [0109.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 63 [0109.239] lstrlenW (lpString=".jpg") returned 4 [0109.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.240] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") [0109.240] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5924) returned 1 [0109.240] CloseHandle (hObject=0x1c8) returned 1 [0109.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf")) returned 0x20 [0109.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.240] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.240] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.241] GetLastError () returned 0x0 [0109.241] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1724, lpOverlapped=0x0) returned 1 [0109.243] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1730, lpOverlapped=0x0) returned 1 [0109.244] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.244] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.244] SetEndOfFile (hFile=0x1b8) returned 1 [0109.244] CloseHandle (hObject=0x1b8) returned 1 [0109.244] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.244] SetEndOfFile (hFile=0x1c8) returned 1 [0109.245] CloseHandle (hObject=0x1c8) returned 1 [0109.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf")) returned 1 [0109.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.245] lstrlenW (lpString=".doc") returned 4 [0109.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.245] lstrlenW (lpString=".docx") returned 5 [0109.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.245] lstrlenW (lpString=".pdf") returned 4 [0109.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.245] lstrlenW (lpString=".xls") returned 4 [0109.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.245] lstrlenW (lpString=".xlsx") returned 5 [0109.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.246] lstrlenW (lpString=".ppt") returned 4 [0109.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.246] lstrlenW (lpString=".zip") returned 4 [0109.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.246] lstrlenW (lpString=".rar") returned 4 [0109.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString=".bz2") returned 4 [0109.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString=".7z") returned 3 [0109.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.246] lstrlenW (lpString=".dbf") returned 4 [0109.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.246] lstrlenW (lpString=".1cd") returned 4 [0109.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.246] lstrlenW (lpString=".jpg") returned 4 [0109.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString=".pdf") returned 4 [0109.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString=".xls") returned 4 [0109.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.246] lstrlenW (lpString=".xlsx") returned 5 [0109.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.246] lstrlenW (lpString=".ppt") returned 4 [0109.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.246] lstrlenW (lpString=".zip") returned 4 [0109.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.246] lstrlenW (lpString=".rar") returned 4 [0109.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.247] lstrlenW (lpString=".bz2") returned 4 [0109.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.247] lstrlenW (lpString=".7z") returned 3 [0109.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.247] lstrlenW (lpString=".dbf") returned 4 [0109.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.247] lstrlenW (lpString=".1cd") returned 4 [0109.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 63 [0109.247] lstrlenW (lpString=".jpg") returned 4 [0109.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.247] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") [0109.249] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9730) returned 1 [0109.250] CloseHandle (hObject=0x1c8) returned 1 [0109.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf")) returned 0x20 [0109.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.250] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.250] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.251] GetLastError () returned 0x0 [0109.251] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2602, lpOverlapped=0x0) returned 1 [0109.252] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0109.253] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.253] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.253] SetEndOfFile (hFile=0x1b8) returned 1 [0109.253] CloseHandle (hObject=0x1b8) returned 1 [0109.254] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.254] SetEndOfFile (hFile=0x1c8) returned 1 [0109.254] CloseHandle (hObject=0x1c8) returned 1 [0109.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf")) returned 1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.255] lstrlenW (lpString=".doc") returned 4 [0109.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.255] lstrlenW (lpString=".docx") returned 5 [0109.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.255] lstrlenW (lpString=".pdf") returned 4 [0109.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.255] lstrlenW (lpString=".xls") returned 4 [0109.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.255] lstrlenW (lpString=".xlsx") returned 5 [0109.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.255] lstrlenW (lpString=".ppt") returned 4 [0109.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.255] lstrlenW (lpString=".zip") returned 4 [0109.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.255] lstrlenW (lpString=".rar") returned 4 [0109.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.255] lstrlenW (lpString=".bz2") returned 4 [0109.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.255] lstrlenW (lpString=".7z") returned 3 [0109.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".dbf") returned 4 [0109.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".1cd") returned 4 [0109.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".jpg") returned 4 [0109.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString=".pdf") returned 4 [0109.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString=".xls") returned 4 [0109.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.256] lstrlenW (lpString=".xlsx") returned 5 [0109.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.256] lstrlenW (lpString=".ppt") returned 4 [0109.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".zip") returned 4 [0109.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.256] lstrlenW (lpString=".rar") returned 4 [0109.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString=".bz2") returned 4 [0109.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString=".7z") returned 3 [0109.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".dbf") returned 4 [0109.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".1cd") returned 4 [0109.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 63 [0109.256] lstrlenW (lpString=".jpg") returned 4 [0109.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.257] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") [0109.257] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=25184) returned 1 [0109.257] CloseHandle (hObject=0x1c8) returned 1 [0109.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf")) returned 0x20 [0109.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.258] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.258] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.258] GetLastError () returned 0x0 [0109.258] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6260, lpOverlapped=0x0) returned 1 [0109.260] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6270, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6270, lpOverlapped=0x0) returned 1 [0109.261] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.261] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.262] SetEndOfFile (hFile=0x1b8) returned 1 [0109.262] CloseHandle (hObject=0x1b8) returned 1 [0109.262] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.262] SetEndOfFile (hFile=0x1c8) returned 1 [0109.263] CloseHandle (hObject=0x1c8) returned 1 [0109.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf")) returned 1 [0109.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.263] lstrlenW (lpString=".doc") returned 4 [0109.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.263] lstrlenW (lpString=".docx") returned 5 [0109.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.263] lstrlenW (lpString=".pdf") returned 4 [0109.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.263] lstrlenW (lpString=".xls") returned 4 [0109.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.263] lstrlenW (lpString=".xlsx") returned 5 [0109.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.263] lstrlenW (lpString=".ppt") returned 4 [0109.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.264] lstrlenW (lpString=".zip") returned 4 [0109.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.264] lstrlenW (lpString=".rar") returned 4 [0109.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".bz2") returned 4 [0109.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".7z") returned 3 [0109.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.264] lstrlenW (lpString=".dbf") returned 4 [0109.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.264] lstrlenW (lpString=".1cd") returned 4 [0109.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.264] lstrlenW (lpString=".jpg") returned 4 [0109.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".pdf") returned 4 [0109.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".xls") returned 4 [0109.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.264] lstrlenW (lpString=".xlsx") returned 5 [0109.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.264] lstrlenW (lpString=".ppt") returned 4 [0109.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.264] lstrlenW (lpString=".zip") returned 4 [0109.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.264] lstrlenW (lpString=".rar") returned 4 [0109.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".bz2") returned 4 [0109.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.264] lstrlenW (lpString=".7z") returned 3 [0109.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.265] lstrlenW (lpString=".dbf") returned 4 [0109.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.265] lstrlenW (lpString=".1cd") returned 4 [0109.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 63 [0109.265] lstrlenW (lpString=".jpg") returned 4 [0109.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.265] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") [0109.265] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=40064) returned 1 [0109.265] CloseHandle (hObject=0x1c8) returned 1 [0109.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf")) returned 0x20 [0109.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.266] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.266] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.266] GetLastError () returned 0x0 [0109.266] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9c80, lpOverlapped=0x0) returned 1 [0109.346] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9c90, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9c90, lpOverlapped=0x0) returned 1 [0109.348] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.348] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.348] SetEndOfFile (hFile=0x1b8) returned 1 [0109.358] CloseHandle (hObject=0x1b8) returned 1 [0109.358] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.358] SetEndOfFile (hFile=0x1c8) returned 1 [0109.359] CloseHandle (hObject=0x1c8) returned 1 [0109.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf")) returned 1 [0109.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.385] lstrlenW (lpString=".doc") returned 4 [0109.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.385] lstrlenW (lpString=".docx") returned 5 [0109.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.385] lstrlenW (lpString=".pdf") returned 4 [0109.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.385] lstrlenW (lpString=".xls") returned 4 [0109.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.385] lstrlenW (lpString=".xlsx") returned 5 [0109.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.385] lstrlenW (lpString=".ppt") returned 4 [0109.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.385] lstrlenW (lpString=".zip") returned 4 [0109.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.385] lstrlenW (lpString=".rar") returned 4 [0109.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".bz2") returned 4 [0109.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".7z") returned 3 [0109.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.386] lstrlenW (lpString=".dbf") returned 4 [0109.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.386] lstrlenW (lpString=".1cd") returned 4 [0109.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.386] lstrlenW (lpString=".jpg") returned 4 [0109.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".pdf") returned 4 [0109.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".xls") returned 4 [0109.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.386] lstrlenW (lpString=".xlsx") returned 5 [0109.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.386] lstrlenW (lpString=".ppt") returned 4 [0109.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.386] lstrlenW (lpString=".zip") returned 4 [0109.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.386] lstrlenW (lpString=".rar") returned 4 [0109.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".bz2") returned 4 [0109.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.386] lstrlenW (lpString=".7z") returned 3 [0109.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.386] lstrlenW (lpString=".dbf") returned 4 [0109.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.387] lstrlenW (lpString=".1cd") returned 4 [0109.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 63 [0109.387] lstrlenW (lpString=".jpg") returned 4 [0109.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.387] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") [0109.391] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=13878) returned 1 [0109.392] CloseHandle (hObject=0x1a0) returned 1 [0109.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf")) returned 0x20 [0109.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.392] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.392] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.394] GetLastError () returned 0x0 [0109.394] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3636, lpOverlapped=0x0) returned 1 [0109.445] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3640, lpOverlapped=0x0) returned 1 [0109.446] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.446] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.447] SetEndOfFile (hFile=0x15c) returned 1 [0109.447] CloseHandle (hObject=0x15c) returned 1 [0109.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.447] SetEndOfFile (hFile=0x1a0) returned 1 [0109.448] CloseHandle (hObject=0x1a0) returned 1 [0109.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf")) returned 1 [0109.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.448] lstrlenW (lpString=".doc") returned 4 [0109.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.448] lstrlenW (lpString=".docx") returned 5 [0109.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.448] lstrlenW (lpString=".pdf") returned 4 [0109.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.448] lstrlenW (lpString=".xls") returned 4 [0109.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.448] lstrlenW (lpString=".xlsx") returned 5 [0109.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.448] lstrlenW (lpString=".ppt") returned 4 [0109.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.448] lstrlenW (lpString=".zip") returned 4 [0109.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.449] lstrlenW (lpString=".rar") returned 4 [0109.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString=".bz2") returned 4 [0109.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString=".7z") returned 3 [0109.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.449] lstrlenW (lpString=".dbf") returned 4 [0109.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.449] lstrlenW (lpString=".1cd") returned 4 [0109.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.449] lstrlenW (lpString=".jpg") returned 4 [0109.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString=".pdf") returned 4 [0109.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.449] lstrlenW (lpString=".xls") returned 4 [0109.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.451] lstrlenW (lpString=".xlsx") returned 5 [0109.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.451] lstrlenW (lpString=".ppt") returned 4 [0109.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.451] lstrlenW (lpString=".zip") returned 4 [0109.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.451] lstrlenW (lpString=".rar") returned 4 [0109.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.451] lstrlenW (lpString=".bz2") returned 4 [0109.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.451] lstrlenW (lpString=".7z") returned 3 [0109.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.451] lstrlenW (lpString=".dbf") returned 4 [0109.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.452] lstrlenW (lpString=".1cd") returned 4 [0109.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 63 [0109.452] lstrlenW (lpString=".jpg") returned 4 [0109.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.452] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") [0109.452] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=91256) returned 1 [0109.452] CloseHandle (hObject=0x1a0) returned 1 [0109.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf")) returned 0x20 [0109.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.454] GetLastError () returned 0x0 [0109.454] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16478, lpOverlapped=0x0) returned 1 [0109.494] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x16480, lpOverlapped=0x0) returned 1 [0109.497] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.497] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.497] SetEndOfFile (hFile=0x15c) returned 1 [0109.497] CloseHandle (hObject=0x15c) returned 1 [0109.497] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.497] SetEndOfFile (hFile=0x1a0) returned 1 [0109.498] CloseHandle (hObject=0x1a0) returned 1 [0109.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf")) returned 1 [0109.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.499] lstrlenW (lpString=".doc") returned 4 [0109.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.499] lstrlenW (lpString=".docx") returned 5 [0109.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.499] lstrlenW (lpString=".pdf") returned 4 [0109.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.499] lstrlenW (lpString=".xls") returned 4 [0109.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.499] lstrlenW (lpString=".xlsx") returned 5 [0109.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.499] lstrlenW (lpString=".ppt") returned 4 [0109.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.499] lstrlenW (lpString=".zip") returned 4 [0109.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.499] lstrlenW (lpString=".rar") returned 4 [0109.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.499] lstrlenW (lpString=".bz2") returned 4 [0109.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.499] lstrlenW (lpString=".7z") returned 3 [0109.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.500] lstrlenW (lpString=".dbf") returned 4 [0109.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.500] lstrlenW (lpString=".1cd") returned 4 [0109.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.500] lstrlenW (lpString=".jpg") returned 4 [0109.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString=".pdf") returned 4 [0109.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString=".xls") returned 4 [0109.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.500] lstrlenW (lpString=".xlsx") returned 5 [0109.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.500] lstrlenW (lpString=".ppt") returned 4 [0109.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.500] lstrlenW (lpString=".zip") returned 4 [0109.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.500] lstrlenW (lpString=".rar") returned 4 [0109.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.500] lstrlenW (lpString=".bz2") returned 4 [0109.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.501] lstrlenW (lpString=".7z") returned 3 [0109.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.501] lstrlenW (lpString=".dbf") returned 4 [0109.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.501] lstrlenW (lpString=".1cd") returned 4 [0109.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 63 [0109.501] lstrlenW (lpString=".jpg") returned 4 [0109.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.501] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") [0109.502] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5976) returned 1 [0109.502] CloseHandle (hObject=0x1a0) returned 1 [0109.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf")) returned 0x20 [0109.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.503] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.503] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.507] GetLastError () returned 0x0 [0109.507] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1758, lpOverlapped=0x0) returned 1 [0109.509] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0109.509] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.509] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.510] SetEndOfFile (hFile=0x15c) returned 1 [0109.510] CloseHandle (hObject=0x15c) returned 1 [0109.510] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.510] SetEndOfFile (hFile=0x1a0) returned 1 [0109.511] CloseHandle (hObject=0x1a0) returned 1 [0109.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf")) returned 1 [0109.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.511] lstrlenW (lpString=".doc") returned 4 [0109.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.511] lstrlenW (lpString=".docx") returned 5 [0109.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.511] lstrlenW (lpString=".pdf") returned 4 [0109.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.511] lstrlenW (lpString=".xls") returned 4 [0109.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.511] lstrlenW (lpString=".xlsx") returned 5 [0109.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.511] lstrlenW (lpString=".ppt") returned 4 [0109.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.512] lstrlenW (lpString=".zip") returned 4 [0109.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.512] lstrlenW (lpString=".rar") returned 4 [0109.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString=".bz2") returned 4 [0109.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString=".7z") returned 3 [0109.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.512] lstrlenW (lpString=".dbf") returned 4 [0109.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.512] lstrlenW (lpString=".1cd") returned 4 [0109.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.512] lstrlenW (lpString=".jpg") returned 4 [0109.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString=".pdf") returned 4 [0109.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString=".xls") returned 4 [0109.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.512] lstrlenW (lpString=".xlsx") returned 5 [0109.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.512] lstrlenW (lpString=".ppt") returned 4 [0109.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.512] lstrlenW (lpString=".zip") returned 4 [0109.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.512] lstrlenW (lpString=".rar") returned 4 [0109.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.512] lstrlenW (lpString=".bz2") returned 4 [0109.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.513] lstrlenW (lpString=".7z") returned 3 [0109.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.513] lstrlenW (lpString=".dbf") returned 4 [0109.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.513] lstrlenW (lpString=".1cd") returned 4 [0109.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 63 [0109.513] lstrlenW (lpString=".jpg") returned 4 [0109.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.513] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") [0109.514] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5116) returned 1 [0109.514] CloseHandle (hObject=0x1a0) returned 1 [0109.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf")) returned 0x20 [0109.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0109.514] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.514] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0109.515] GetLastError () returned 0x0 [0109.515] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x13fc, lpOverlapped=0x0) returned 1 [0109.667] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1400, lpOverlapped=0x0) returned 1 [0109.668] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.668] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.668] SetEndOfFile (hFile=0x15c) returned 1 [0109.902] CloseHandle (hObject=0x15c) returned 1 [0109.903] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.903] SetEndOfFile (hFile=0x1a0) returned 1 [0109.907] CloseHandle (hObject=0x1a0) returned 1 [0109.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf")) returned 1 [0109.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.940] lstrlenW (lpString=".doc") returned 4 [0109.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.940] lstrlenW (lpString=".docx") returned 5 [0109.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.940] lstrlenW (lpString=".pdf") returned 4 [0109.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.940] lstrlenW (lpString=".xls") returned 4 [0109.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.940] lstrlenW (lpString=".xlsx") returned 5 [0109.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.940] lstrlenW (lpString=".ppt") returned 4 [0109.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.941] lstrlenW (lpString=".zip") returned 4 [0109.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.941] lstrlenW (lpString=".rar") returned 4 [0109.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString=".bz2") returned 4 [0109.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString=".7z") returned 3 [0109.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.941] lstrlenW (lpString=".dbf") returned 4 [0109.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.941] lstrlenW (lpString=".1cd") returned 4 [0109.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.941] lstrlenW (lpString=".jpg") returned 4 [0109.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString=".pdf") returned 4 [0109.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString=".xls") returned 4 [0109.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.941] lstrlenW (lpString=".xlsx") returned 5 [0109.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.941] lstrlenW (lpString=".ppt") returned 4 [0109.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.942] lstrlenW (lpString=".zip") returned 4 [0109.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.942] lstrlenW (lpString=".rar") returned 4 [0109.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.942] lstrlenW (lpString=".bz2") returned 4 [0109.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.942] lstrlenW (lpString=".7z") returned 3 [0109.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.942] lstrlenW (lpString=".dbf") returned 4 [0109.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.942] lstrlenW (lpString=".1cd") returned 4 [0109.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 63 [0109.942] lstrlenW (lpString=".jpg") returned 4 [0109.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.942] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") [0110.788] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=21562) returned 1 [0110.788] CloseHandle (hObject=0x1b8) returned 1 [0110.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf")) returned 0x20 [0110.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.788] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.788] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.789] GetLastError () returned 0x0 [0110.789] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x543a, lpOverlapped=0x0) returned 1 [0110.791] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5440, lpOverlapped=0x0) returned 1 [0110.793] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.793] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.793] SetEndOfFile (hFile=0x15c) returned 1 [0110.793] CloseHandle (hObject=0x15c) returned 1 [0110.793] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.793] SetEndOfFile (hFile=0x1b8) returned 1 [0110.794] CloseHandle (hObject=0x1b8) returned 1 [0110.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf")) returned 1 [0110.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.794] lstrlenW (lpString=".doc") returned 4 [0110.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.794] lstrlenW (lpString=".docx") returned 5 [0110.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.794] lstrlenW (lpString=".pdf") returned 4 [0110.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString=".xls") returned 4 [0110.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.795] lstrlenW (lpString=".xlsx") returned 5 [0110.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.795] lstrlenW (lpString=".ppt") returned 4 [0110.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.795] lstrlenW (lpString=".zip") returned 4 [0110.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.795] lstrlenW (lpString=".rar") returned 4 [0110.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString=".bz2") returned 4 [0110.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString=".7z") returned 3 [0110.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.795] lstrlenW (lpString=".dbf") returned 4 [0110.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.795] lstrlenW (lpString=".1cd") returned 4 [0110.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.795] lstrlenW (lpString=".jpg") returned 4 [0110.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString=".pdf") returned 4 [0110.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString=".xls") returned 4 [0110.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.795] lstrlenW (lpString=".xlsx") returned 5 [0110.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.795] lstrlenW (lpString=".ppt") returned 4 [0110.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.796] lstrlenW (lpString=".zip") returned 4 [0110.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.796] lstrlenW (lpString=".rar") returned 4 [0110.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.796] lstrlenW (lpString=".bz2") returned 4 [0110.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.796] lstrlenW (lpString=".7z") returned 3 [0110.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.796] lstrlenW (lpString=".dbf") returned 4 [0110.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.796] lstrlenW (lpString=".1cd") returned 4 [0110.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 63 [0110.796] lstrlenW (lpString=".jpg") returned 4 [0110.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.796] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") [0110.797] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17328) returned 1 [0110.797] CloseHandle (hObject=0x1b8) returned 1 [0110.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf")) returned 0x20 [0110.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.797] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.797] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.798] GetLastError () returned 0x0 [0110.798] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x43b0, lpOverlapped=0x0) returned 1 [0110.800] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0110.801] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.801] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.801] SetEndOfFile (hFile=0x15c) returned 1 [0110.801] CloseHandle (hObject=0x15c) returned 1 [0110.801] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.801] SetEndOfFile (hFile=0x1b8) returned 1 [0110.802] CloseHandle (hObject=0x1b8) returned 1 [0110.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf")) returned 1 [0110.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.803] lstrlenW (lpString=".doc") returned 4 [0110.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.803] lstrlenW (lpString=".docx") returned 5 [0110.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.803] lstrlenW (lpString=".pdf") returned 4 [0110.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.803] lstrlenW (lpString=".xls") returned 4 [0110.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.803] lstrlenW (lpString=".xlsx") returned 5 [0110.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.803] lstrlenW (lpString=".ppt") returned 4 [0110.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.803] lstrlenW (lpString=".zip") returned 4 [0110.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.803] lstrlenW (lpString=".rar") returned 4 [0110.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.803] lstrlenW (lpString=".bz2") returned 4 [0110.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.803] lstrlenW (lpString=".7z") returned 3 [0110.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.803] lstrlenW (lpString=".dbf") returned 4 [0110.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.804] lstrlenW (lpString=".1cd") returned 4 [0110.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.804] lstrlenW (lpString=".jpg") returned 4 [0110.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString=".pdf") returned 4 [0110.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString=".xls") returned 4 [0110.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.804] lstrlenW (lpString=".xlsx") returned 5 [0110.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.804] lstrlenW (lpString=".ppt") returned 4 [0110.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.804] lstrlenW (lpString=".zip") returned 4 [0110.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.804] lstrlenW (lpString=".rar") returned 4 [0110.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString=".bz2") returned 4 [0110.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString=".7z") returned 3 [0110.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.804] lstrlenW (lpString=".dbf") returned 4 [0110.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.804] lstrlenW (lpString=".1cd") returned 4 [0110.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 63 [0110.805] lstrlenW (lpString=".jpg") returned 4 [0110.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.805] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") [0110.805] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=23000) returned 1 [0110.805] CloseHandle (hObject=0x1b8) returned 1 [0110.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf")) returned 0x20 [0110.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.806] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.806] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.806] GetLastError () returned 0x0 [0110.806] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x59d8, lpOverlapped=0x0) returned 1 [0110.818] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x59e0, lpOverlapped=0x0) returned 1 [0110.819] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.820] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.820] SetEndOfFile (hFile=0x15c) returned 1 [0110.820] CloseHandle (hObject=0x15c) returned 1 [0110.820] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.820] SetEndOfFile (hFile=0x1b8) returned 1 [0110.821] CloseHandle (hObject=0x1b8) returned 1 [0110.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf")) returned 1 [0110.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.821] lstrlenW (lpString=".doc") returned 4 [0110.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.821] lstrlenW (lpString=".docx") returned 5 [0110.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.821] lstrlenW (lpString=".pdf") returned 4 [0110.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.821] lstrlenW (lpString=".xls") returned 4 [0110.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.821] lstrlenW (lpString=".xlsx") returned 5 [0110.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.821] lstrlenW (lpString=".ppt") returned 4 [0110.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.822] lstrlenW (lpString=".zip") returned 4 [0110.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.822] lstrlenW (lpString=".rar") returned 4 [0110.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString=".bz2") returned 4 [0110.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString=".7z") returned 3 [0110.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.822] lstrlenW (lpString=".dbf") returned 4 [0110.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.822] lstrlenW (lpString=".1cd") returned 4 [0110.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.822] lstrlenW (lpString=".jpg") returned 4 [0110.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString=".pdf") returned 4 [0110.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString=".xls") returned 4 [0110.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.822] lstrlenW (lpString=".xlsx") returned 5 [0110.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.822] lstrlenW (lpString=".ppt") returned 4 [0110.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.822] lstrlenW (lpString=".zip") returned 4 [0110.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.822] lstrlenW (lpString=".rar") returned 4 [0110.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.822] lstrlenW (lpString=".bz2") returned 4 [0110.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.823] lstrlenW (lpString=".7z") returned 3 [0110.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.823] lstrlenW (lpString=".dbf") returned 4 [0110.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.823] lstrlenW (lpString=".1cd") returned 4 [0110.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 63 [0110.823] lstrlenW (lpString=".jpg") returned 4 [0110.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.823] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") [0110.824] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=20904) returned 1 [0110.824] CloseHandle (hObject=0x1b8) returned 1 [0110.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf")) returned 0x20 [0110.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0110.824] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.824] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0110.825] GetLastError () returned 0x0 [0110.825] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x51a8, lpOverlapped=0x0) returned 1 [0110.835] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0110.836] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.836] WriteFile (in: hFile=0x15c, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.836] SetEndOfFile (hFile=0x15c) returned 1 [0110.837] CloseHandle (hObject=0x15c) returned 1 [0110.837] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.837] SetEndOfFile (hFile=0x1b8) returned 1 [0110.838] CloseHandle (hObject=0x1b8) returned 1 [0110.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf")) returned 1 [0110.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.838] lstrlenW (lpString=".doc") returned 4 [0110.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.838] lstrlenW (lpString=".docx") returned 5 [0110.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0110.838] lstrlenW (lpString=".pdf") returned 4 [0110.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.838] lstrlenW (lpString=".xls") returned 4 [0110.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.838] lstrlenW (lpString=".xlsx") returned 5 [0110.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.839] lstrlenW (lpString=".ppt") returned 4 [0110.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.839] lstrlenW (lpString=".zip") returned 4 [0110.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.839] lstrlenW (lpString=".rar") returned 4 [0110.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString=".bz2") returned 4 [0110.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString=".7z") returned 3 [0110.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.839] lstrlenW (lpString=".dbf") returned 4 [0110.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.839] lstrlenW (lpString=".1cd") returned 4 [0110.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.839] lstrlenW (lpString=".jpg") returned 4 [0110.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString=".pdf") returned 4 [0110.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString=".xls") returned 4 [0110.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.839] lstrlenW (lpString=".xlsx") returned 5 [0110.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0110.839] lstrlenW (lpString=".ppt") returned 4 [0110.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.839] lstrlenW (lpString=".zip") returned 4 [0110.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.839] lstrlenW (lpString=".rar") returned 4 [0110.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.840] lstrlenW (lpString=".bz2") returned 4 [0110.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.840] lstrlenW (lpString=".7z") returned 3 [0110.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.840] lstrlenW (lpString=".dbf") returned 4 [0110.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.840] lstrlenW (lpString=".1cd") returned 4 [0110.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 63 [0110.840] lstrlenW (lpString=".jpg") returned 4 [0110.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.840] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") [0111.021] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=18336) returned 1 [0111.021] CloseHandle (hObject=0x180) returned 1 [0111.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf")) returned 0x20 [0111.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.021] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.021] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.022] GetLastError () returned 0x0 [0111.022] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x47a0, lpOverlapped=0x0) returned 1 [0111.024] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x47b0, lpOverlapped=0x0) returned 1 [0111.025] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.025] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.025] SetEndOfFile (hFile=0x1c8) returned 1 [0111.025] CloseHandle (hObject=0x1c8) returned 1 [0111.025] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.025] SetEndOfFile (hFile=0x180) returned 1 [0111.026] CloseHandle (hObject=0x180) returned 1 [0111.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf")) returned 1 [0111.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.027] lstrlenW (lpString=".doc") returned 4 [0111.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString=".docx") returned 5 [0111.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.027] lstrlenW (lpString=".pdf") returned 4 [0111.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString=".xls") returned 4 [0111.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.027] lstrlenW (lpString=".xlsx") returned 5 [0111.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.027] lstrlenW (lpString=".ppt") returned 4 [0111.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.027] lstrlenW (lpString=".zip") returned 4 [0111.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.027] lstrlenW (lpString=".rar") returned 4 [0111.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString=".bz2") returned 4 [0111.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString=".7z") returned 3 [0111.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.027] lstrlenW (lpString=".dbf") returned 4 [0111.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.027] lstrlenW (lpString=".1cd") returned 4 [0111.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.028] lstrlenW (lpString=".jpg") returned 4 [0111.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString=".pdf") returned 4 [0111.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString=".xls") returned 4 [0111.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.028] lstrlenW (lpString=".xlsx") returned 5 [0111.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.028] lstrlenW (lpString=".ppt") returned 4 [0111.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.028] lstrlenW (lpString=".zip") returned 4 [0111.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.028] lstrlenW (lpString=".rar") returned 4 [0111.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString=".bz2") returned 4 [0111.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString=".7z") returned 3 [0111.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.028] lstrlenW (lpString=".dbf") returned 4 [0111.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.028] lstrlenW (lpString=".1cd") returned 4 [0111.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 63 [0111.028] lstrlenW (lpString=".jpg") returned 4 [0111.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.028] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") [0111.030] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7444) returned 1 [0111.030] CloseHandle (hObject=0x180) returned 1 [0111.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf")) returned 0x20 [0111.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.030] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.030] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.031] GetLastError () returned 0x0 [0111.031] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1d14, lpOverlapped=0x0) returned 1 [0111.032] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0111.033] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.033] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.033] SetEndOfFile (hFile=0x1c8) returned 1 [0111.033] CloseHandle (hObject=0x1c8) returned 1 [0111.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.033] SetEndOfFile (hFile=0x180) returned 1 [0111.034] CloseHandle (hObject=0x180) returned 1 [0111.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf")) returned 1 [0111.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.034] lstrlenW (lpString=".doc") returned 4 [0111.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".docx") returned 5 [0111.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.035] lstrlenW (lpString=".pdf") returned 4 [0111.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".xls") returned 4 [0111.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.035] lstrlenW (lpString=".xlsx") returned 5 [0111.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.035] lstrlenW (lpString=".ppt") returned 4 [0111.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.035] lstrlenW (lpString=".zip") returned 4 [0111.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.035] lstrlenW (lpString=".rar") returned 4 [0111.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".bz2") returned 4 [0111.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".7z") returned 3 [0111.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.035] lstrlenW (lpString=".dbf") returned 4 [0111.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.035] lstrlenW (lpString=".1cd") returned 4 [0111.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.035] lstrlenW (lpString=".jpg") returned 4 [0111.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".pdf") returned 4 [0111.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.035] lstrlenW (lpString=".xls") returned 4 [0111.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.036] lstrlenW (lpString=".xlsx") returned 5 [0111.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.036] lstrlenW (lpString=".ppt") returned 4 [0111.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.036] lstrlenW (lpString=".zip") returned 4 [0111.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.036] lstrlenW (lpString=".rar") returned 4 [0111.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.036] lstrlenW (lpString=".bz2") returned 4 [0111.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.036] lstrlenW (lpString=".7z") returned 3 [0111.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.036] lstrlenW (lpString=".dbf") returned 4 [0111.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.036] lstrlenW (lpString=".1cd") returned 4 [0111.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 63 [0111.036] lstrlenW (lpString=".jpg") returned 4 [0111.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.036] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") [0111.037] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7528) returned 1 [0111.037] CloseHandle (hObject=0x180) returned 1 [0111.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf")) returned 0x20 [0111.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.037] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.037] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.038] GetLastError () returned 0x0 [0111.038] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1d68, lpOverlapped=0x0) returned 1 [0111.052] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1d70, lpOverlapped=0x0) returned 1 [0111.053] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.053] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.054] SetEndOfFile (hFile=0x1c8) returned 1 [0111.054] CloseHandle (hObject=0x1c8) returned 1 [0111.054] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.054] SetEndOfFile (hFile=0x180) returned 1 [0111.055] CloseHandle (hObject=0x180) returned 1 [0111.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf")) returned 1 [0111.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.055] lstrlenW (lpString=".doc") returned 4 [0111.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.055] lstrlenW (lpString=".docx") returned 5 [0111.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.055] lstrlenW (lpString=".pdf") returned 4 [0111.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.055] lstrlenW (lpString=".xls") returned 4 [0111.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.055] lstrlenW (lpString=".xlsx") returned 5 [0111.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.055] lstrlenW (lpString=".ppt") returned 4 [0111.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.055] lstrlenW (lpString=".zip") returned 4 [0111.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.055] lstrlenW (lpString=".rar") returned 4 [0111.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".bz2") returned 4 [0111.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".7z") returned 3 [0111.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.056] lstrlenW (lpString=".dbf") returned 4 [0111.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.056] lstrlenW (lpString=".1cd") returned 4 [0111.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.056] lstrlenW (lpString=".jpg") returned 4 [0111.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".pdf") returned 4 [0111.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".xls") returned 4 [0111.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.056] lstrlenW (lpString=".xlsx") returned 5 [0111.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.056] lstrlenW (lpString=".ppt") returned 4 [0111.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.056] lstrlenW (lpString=".zip") returned 4 [0111.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.056] lstrlenW (lpString=".rar") returned 4 [0111.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".bz2") returned 4 [0111.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.056] lstrlenW (lpString=".7z") returned 3 [0111.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.056] lstrlenW (lpString=".dbf") returned 4 [0111.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.057] lstrlenW (lpString=".1cd") returned 4 [0111.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 63 [0111.057] lstrlenW (lpString=".jpg") returned 4 [0111.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.057] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") [0111.057] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9416) returned 1 [0111.057] CloseHandle (hObject=0x180) returned 1 [0111.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf")) returned 0x20 [0111.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.058] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.058] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.058] GetLastError () returned 0x0 [0111.058] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x24c8, lpOverlapped=0x0) returned 1 [0111.067] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x24d0, lpOverlapped=0x0) returned 1 [0111.068] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.068] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.068] SetEndOfFile (hFile=0x1c8) returned 1 [0111.069] CloseHandle (hObject=0x1c8) returned 1 [0111.069] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.069] SetEndOfFile (hFile=0x180) returned 1 [0111.069] CloseHandle (hObject=0x180) returned 1 [0111.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf")) returned 1 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.070] lstrlenW (lpString=".doc") returned 4 [0111.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".docx") returned 5 [0111.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.070] lstrlenW (lpString=".pdf") returned 4 [0111.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".xls") returned 4 [0111.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.070] lstrlenW (lpString=".xlsx") returned 5 [0111.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.070] lstrlenW (lpString=".ppt") returned 4 [0111.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.070] lstrlenW (lpString=".zip") returned 4 [0111.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.070] lstrlenW (lpString=".rar") returned 4 [0111.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".bz2") returned 4 [0111.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".7z") returned 3 [0111.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".dbf") returned 4 [0111.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".1cd") returned 4 [0111.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".jpg") returned 4 [0111.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".pdf") returned 4 [0111.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".xls") returned 4 [0111.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.071] lstrlenW (lpString=".xlsx") returned 5 [0111.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.071] lstrlenW (lpString=".ppt") returned 4 [0111.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".zip") returned 4 [0111.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.071] lstrlenW (lpString=".rar") returned 4 [0111.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".bz2") returned 4 [0111.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".7z") returned 3 [0111.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".dbf") returned 4 [0111.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.071] lstrlenW (lpString=".1cd") returned 4 [0111.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 63 [0111.072] lstrlenW (lpString=".jpg") returned 4 [0111.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.072] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") [0111.088] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8158) returned 1 [0111.096] CloseHandle (hObject=0x180) returned 1 [0111.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf")) returned 0x20 [0111.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.097] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.097] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.098] GetLastError () returned 0x0 [0111.098] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1fde, lpOverlapped=0x0) returned 1 [0111.146] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1fe0, lpOverlapped=0x0) returned 1 [0111.146] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.147] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.147] SetEndOfFile (hFile=0x1c8) returned 1 [0111.147] CloseHandle (hObject=0x1c8) returned 1 [0111.147] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.147] SetEndOfFile (hFile=0x180) returned 1 [0111.148] CloseHandle (hObject=0x180) returned 1 [0111.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf")) returned 1 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.149] lstrlenW (lpString=".doc") returned 4 [0111.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString=".docx") returned 5 [0111.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.149] lstrlenW (lpString=".pdf") returned 4 [0111.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString=".xls") returned 4 [0111.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.149] lstrlenW (lpString=".xlsx") returned 5 [0111.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.149] lstrlenW (lpString=".ppt") returned 4 [0111.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.149] lstrlenW (lpString=".zip") returned 4 [0111.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.149] lstrlenW (lpString=".rar") returned 4 [0111.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString=".bz2") returned 4 [0111.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString=".7z") returned 3 [0111.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.149] lstrlenW (lpString=".dbf") returned 4 [0111.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.149] lstrlenW (lpString=".1cd") returned 4 [0111.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.150] lstrlenW (lpString=".jpg") returned 4 [0111.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString=".pdf") returned 4 [0111.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString=".xls") returned 4 [0111.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.150] lstrlenW (lpString=".xlsx") returned 5 [0111.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.150] lstrlenW (lpString=".ppt") returned 4 [0111.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.150] lstrlenW (lpString=".zip") returned 4 [0111.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.150] lstrlenW (lpString=".rar") returned 4 [0111.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString=".bz2") returned 4 [0111.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString=".7z") returned 3 [0111.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.150] lstrlenW (lpString=".dbf") returned 4 [0111.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.150] lstrlenW (lpString=".1cd") returned 4 [0111.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 63 [0111.150] lstrlenW (lpString=".jpg") returned 4 [0111.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.150] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") [0111.151] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2272) returned 1 [0111.151] CloseHandle (hObject=0x180) returned 1 [0111.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf")) returned 0x20 [0111.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.152] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.152] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.153] GetLastError () returned 0x0 [0111.153] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x8e0, lpOverlapped=0x0) returned 1 [0111.166] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0111.167] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.167] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.167] SetEndOfFile (hFile=0x1c8) returned 1 [0111.167] CloseHandle (hObject=0x1c8) returned 1 [0111.167] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.167] SetEndOfFile (hFile=0x180) returned 1 [0111.168] CloseHandle (hObject=0x180) returned 1 [0111.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf")) returned 1 [0111.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.168] lstrlenW (lpString=".doc") returned 4 [0111.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString=".docx") returned 5 [0111.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.169] lstrlenW (lpString=".pdf") returned 4 [0111.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString=".xls") returned 4 [0111.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.169] lstrlenW (lpString=".xlsx") returned 5 [0111.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.169] lstrlenW (lpString=".ppt") returned 4 [0111.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.169] lstrlenW (lpString=".zip") returned 4 [0111.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.169] lstrlenW (lpString=".rar") returned 4 [0111.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString=".bz2") returned 4 [0111.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString=".7z") returned 3 [0111.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.169] lstrlenW (lpString=".dbf") returned 4 [0111.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.169] lstrlenW (lpString=".1cd") returned 4 [0111.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.169] lstrlenW (lpString=".jpg") returned 4 [0111.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.169] lstrlenW (lpString=".pdf") returned 4 [0111.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString=".xls") returned 4 [0111.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.170] lstrlenW (lpString=".xlsx") returned 5 [0111.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.170] lstrlenW (lpString=".ppt") returned 4 [0111.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.170] lstrlenW (lpString=".zip") returned 4 [0111.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.170] lstrlenW (lpString=".rar") returned 4 [0111.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString=".bz2") returned 4 [0111.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString=".7z") returned 3 [0111.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.170] lstrlenW (lpString=".dbf") returned 4 [0111.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.170] lstrlenW (lpString=".1cd") returned 4 [0111.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 63 [0111.170] lstrlenW (lpString=".jpg") returned 4 [0111.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.170] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") [0111.171] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2708) returned 1 [0111.171] CloseHandle (hObject=0x180) returned 1 [0111.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf")) returned 0x20 [0111.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.172] GetLastError () returned 0x0 [0111.172] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xa94, lpOverlapped=0x0) returned 1 [0111.173] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0111.174] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.174] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.174] SetEndOfFile (hFile=0x1c8) returned 1 [0111.175] CloseHandle (hObject=0x1c8) returned 1 [0111.175] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.175] SetEndOfFile (hFile=0x180) returned 1 [0111.176] CloseHandle (hObject=0x180) returned 1 [0111.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf")) returned 1 [0111.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.176] lstrlenW (lpString=".doc") returned 4 [0111.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.176] lstrlenW (lpString=".docx") returned 5 [0111.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.176] lstrlenW (lpString=".pdf") returned 4 [0111.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.176] lstrlenW (lpString=".xls") returned 4 [0111.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.176] lstrlenW (lpString=".xlsx") returned 5 [0111.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.177] lstrlenW (lpString=".ppt") returned 4 [0111.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.177] lstrlenW (lpString=".zip") returned 4 [0111.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.177] lstrlenW (lpString=".rar") returned 4 [0111.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString=".bz2") returned 4 [0111.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString=".7z") returned 3 [0111.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.177] lstrlenW (lpString=".dbf") returned 4 [0111.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.177] lstrlenW (lpString=".1cd") returned 4 [0111.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.177] lstrlenW (lpString=".jpg") returned 4 [0111.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString=".pdf") returned 4 [0111.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString=".xls") returned 4 [0111.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.177] lstrlenW (lpString=".xlsx") returned 5 [0111.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.177] lstrlenW (lpString=".ppt") returned 4 [0111.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.177] lstrlenW (lpString=".zip") returned 4 [0111.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.177] lstrlenW (lpString=".rar") returned 4 [0111.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.178] lstrlenW (lpString=".bz2") returned 4 [0111.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.178] lstrlenW (lpString=".7z") returned 3 [0111.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.178] lstrlenW (lpString=".dbf") returned 4 [0111.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.178] lstrlenW (lpString=".1cd") returned 4 [0111.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 63 [0111.178] lstrlenW (lpString=".jpg") returned 4 [0111.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.178] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") [0111.179] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=908) returned 1 [0111.179] CloseHandle (hObject=0x180) returned 1 [0111.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf")) returned 0x20 [0111.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.179] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.179] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.180] GetLastError () returned 0x0 [0111.180] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x38c, lpOverlapped=0x0) returned 1 [0111.181] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x390, lpOverlapped=0x0) returned 1 [0111.183] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.183] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.183] SetEndOfFile (hFile=0x1c8) returned 1 [0111.183] CloseHandle (hObject=0x1c8) returned 1 [0111.183] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.183] SetEndOfFile (hFile=0x180) returned 1 [0111.184] CloseHandle (hObject=0x180) returned 1 [0111.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf")) returned 1 [0111.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.184] lstrlenW (lpString=".doc") returned 4 [0111.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.184] lstrlenW (lpString=".docx") returned 5 [0111.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.184] lstrlenW (lpString=".pdf") returned 4 [0111.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.184] lstrlenW (lpString=".xls") returned 4 [0111.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.184] lstrlenW (lpString=".xlsx") returned 5 [0111.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.184] lstrlenW (lpString=".ppt") returned 4 [0111.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.185] lstrlenW (lpString=".zip") returned 4 [0111.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.185] lstrlenW (lpString=".rar") returned 4 [0111.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString=".bz2") returned 4 [0111.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString=".7z") returned 3 [0111.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.185] lstrlenW (lpString=".dbf") returned 4 [0111.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.185] lstrlenW (lpString=".1cd") returned 4 [0111.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.185] lstrlenW (lpString=".jpg") returned 4 [0111.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString=".pdf") returned 4 [0111.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString=".xls") returned 4 [0111.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.185] lstrlenW (lpString=".xlsx") returned 5 [0111.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.185] lstrlenW (lpString=".ppt") returned 4 [0111.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.185] lstrlenW (lpString=".zip") returned 4 [0111.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.185] lstrlenW (lpString=".rar") returned 4 [0111.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.186] lstrlenW (lpString=".bz2") returned 4 [0111.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.186] lstrlenW (lpString=".7z") returned 3 [0111.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.186] lstrlenW (lpString=".dbf") returned 4 [0111.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.186] lstrlenW (lpString=".1cd") returned 4 [0111.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 63 [0111.186] lstrlenW (lpString=".jpg") returned 4 [0111.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.186] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") [0111.187] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1564) returned 1 [0111.187] CloseHandle (hObject=0x180) returned 1 [0111.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf")) returned 0x20 [0111.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.187] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.187] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0111.188] GetLastError () returned 0x0 [0111.188] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x61c, lpOverlapped=0x0) returned 1 [0111.189] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x620, lpOverlapped=0x0) returned 1 [0111.190] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.190] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.190] SetEndOfFile (hFile=0x1c8) returned 1 [0111.190] CloseHandle (hObject=0x1c8) returned 1 [0111.190] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.190] SetEndOfFile (hFile=0x180) returned 1 [0111.191] CloseHandle (hObject=0x180) returned 1 [0111.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf")) returned 1 [0111.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.192] lstrlenW (lpString=".doc") returned 4 [0111.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.192] lstrlenW (lpString=".docx") returned 5 [0111.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.192] lstrlenW (lpString=".pdf") returned 4 [0111.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.192] lstrlenW (lpString=".xls") returned 4 [0111.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.244] lstrlenW (lpString=".xlsx") returned 5 [0111.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.244] lstrlenW (lpString=".ppt") returned 4 [0111.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.244] lstrlenW (lpString=".zip") returned 4 [0111.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.245] lstrlenW (lpString=".rar") returned 4 [0111.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString=".bz2") returned 4 [0111.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString=".7z") returned 3 [0111.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.245] lstrlenW (lpString=".dbf") returned 4 [0111.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.245] lstrlenW (lpString=".1cd") returned 4 [0111.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.245] lstrlenW (lpString=".jpg") returned 4 [0111.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString=".pdf") returned 4 [0111.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString=".xls") returned 4 [0111.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.245] lstrlenW (lpString=".xlsx") returned 5 [0111.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.245] lstrlenW (lpString=".ppt") returned 4 [0111.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.245] lstrlenW (lpString=".zip") returned 4 [0111.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.245] lstrlenW (lpString=".rar") returned 4 [0111.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.245] lstrlenW (lpString=".bz2") returned 4 [0111.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.246] lstrlenW (lpString=".7z") returned 3 [0111.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.246] lstrlenW (lpString=".dbf") returned 4 [0111.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.246] lstrlenW (lpString=".1cd") returned 4 [0111.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 63 [0111.246] lstrlenW (lpString=".jpg") returned 4 [0111.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.246] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") [0111.568] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=12516) returned 1 [0111.568] CloseHandle (hObject=0x1a0) returned 1 [0111.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf")) returned 0x20 [0111.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.568] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.568] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0111.569] GetLastError () returned 0x0 [0111.569] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x30e4, lpOverlapped=0x0) returned 1 [0111.571] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0111.572] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.572] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.572] SetEndOfFile (hFile=0x158) returned 1 [0111.572] CloseHandle (hObject=0x158) returned 1 [0111.572] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.572] SetEndOfFile (hFile=0x1a0) returned 1 [0111.573] CloseHandle (hObject=0x1a0) returned 1 [0111.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf")) returned 1 [0111.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.574] lstrlenW (lpString=".doc") returned 4 [0111.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString=".docx") returned 5 [0111.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.574] lstrlenW (lpString=".pdf") returned 4 [0111.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString=".xls") returned 4 [0111.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.574] lstrlenW (lpString=".xlsx") returned 5 [0111.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.574] lstrlenW (lpString=".ppt") returned 4 [0111.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.574] lstrlenW (lpString=".zip") returned 4 [0111.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.574] lstrlenW (lpString=".rar") returned 4 [0111.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString=".bz2") returned 4 [0111.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString=".7z") returned 3 [0111.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.574] lstrlenW (lpString=".dbf") returned 4 [0111.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.574] lstrlenW (lpString=".1cd") returned 4 [0111.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.574] lstrlenW (lpString=".jpg") returned 4 [0111.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.574] lstrlenW (lpString=".pdf") returned 4 [0111.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString=".xls") returned 4 [0111.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.575] lstrlenW (lpString=".xlsx") returned 5 [0111.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.575] lstrlenW (lpString=".ppt") returned 4 [0111.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.575] lstrlenW (lpString=".zip") returned 4 [0111.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.575] lstrlenW (lpString=".rar") returned 4 [0111.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString=".bz2") returned 4 [0111.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString=".7z") returned 3 [0111.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.575] lstrlenW (lpString=".dbf") returned 4 [0111.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.575] lstrlenW (lpString=".1cd") returned 4 [0111.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 63 [0111.575] lstrlenW (lpString=".jpg") returned 4 [0111.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.575] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") [0111.577] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=6602) returned 1 [0111.577] CloseHandle (hObject=0x1a0) returned 1 [0111.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf")) returned 0x20 [0111.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.577] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.578] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0111.578] GetLastError () returned 0x0 [0111.578] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x19ca, lpOverlapped=0x0) returned 1 [0111.580] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x19d0, lpOverlapped=0x0) returned 1 [0111.581] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.581] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.581] SetEndOfFile (hFile=0x158) returned 1 [0111.581] CloseHandle (hObject=0x158) returned 1 [0111.581] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.581] SetEndOfFile (hFile=0x1a0) returned 1 [0111.582] CloseHandle (hObject=0x1a0) returned 1 [0111.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf")) returned 1 [0111.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.583] lstrlenW (lpString=".doc") returned 4 [0111.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString=".docx") returned 5 [0111.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.583] lstrlenW (lpString=".pdf") returned 4 [0111.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString=".xls") returned 4 [0111.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.583] lstrlenW (lpString=".xlsx") returned 5 [0111.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.583] lstrlenW (lpString=".ppt") returned 4 [0111.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.583] lstrlenW (lpString=".zip") returned 4 [0111.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.583] lstrlenW (lpString=".rar") returned 4 [0111.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString=".bz2") returned 4 [0111.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString=".7z") returned 3 [0111.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.583] lstrlenW (lpString=".dbf") returned 4 [0111.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.583] lstrlenW (lpString=".1cd") returned 4 [0111.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.584] lstrlenW (lpString=".jpg") returned 4 [0111.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString=".pdf") returned 4 [0111.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString=".xls") returned 4 [0111.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.584] lstrlenW (lpString=".xlsx") returned 5 [0111.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.584] lstrlenW (lpString=".ppt") returned 4 [0111.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.584] lstrlenW (lpString=".zip") returned 4 [0111.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.584] lstrlenW (lpString=".rar") returned 4 [0111.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString=".bz2") returned 4 [0111.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString=".7z") returned 3 [0111.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.584] lstrlenW (lpString=".dbf") returned 4 [0111.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.584] lstrlenW (lpString=".1cd") returned 4 [0111.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 63 [0111.585] lstrlenW (lpString=".jpg") returned 4 [0111.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.585] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") [0111.585] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=24556) returned 1 [0111.585] CloseHandle (hObject=0x1a0) returned 1 [0111.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf")) returned 0x20 [0111.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.586] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.586] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0111.586] GetLastError () returned 0x0 [0111.586] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5fec, lpOverlapped=0x0) returned 1 [0111.588] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5ff0, lpOverlapped=0x0) returned 1 [0111.589] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.590] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.590] SetEndOfFile (hFile=0x158) returned 1 [0111.590] CloseHandle (hObject=0x158) returned 1 [0111.590] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.590] SetEndOfFile (hFile=0x1a0) returned 1 [0111.591] CloseHandle (hObject=0x1a0) returned 1 [0111.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf")) returned 1 [0111.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.591] lstrlenW (lpString=".doc") returned 4 [0111.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.591] lstrlenW (lpString=".docx") returned 5 [0111.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.591] lstrlenW (lpString=".pdf") returned 4 [0111.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.591] lstrlenW (lpString=".xls") returned 4 [0111.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.591] lstrlenW (lpString=".xlsx") returned 5 [0111.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.592] lstrlenW (lpString=".ppt") returned 4 [0111.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.592] lstrlenW (lpString=".zip") returned 4 [0111.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.592] lstrlenW (lpString=".rar") returned 4 [0111.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString=".bz2") returned 4 [0111.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString=".7z") returned 3 [0111.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.592] lstrlenW (lpString=".dbf") returned 4 [0111.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.592] lstrlenW (lpString=".1cd") returned 4 [0111.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.592] lstrlenW (lpString=".jpg") returned 4 [0111.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString=".pdf") returned 4 [0111.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString=".xls") returned 4 [0111.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.592] lstrlenW (lpString=".xlsx") returned 5 [0111.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.592] lstrlenW (lpString=".ppt") returned 4 [0111.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.592] lstrlenW (lpString=".zip") returned 4 [0111.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.592] lstrlenW (lpString=".rar") returned 4 [0111.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.593] lstrlenW (lpString=".bz2") returned 4 [0111.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.593] lstrlenW (lpString=".7z") returned 3 [0111.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.593] lstrlenW (lpString=".dbf") returned 4 [0111.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.593] lstrlenW (lpString=".1cd") returned 4 [0111.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 63 [0111.593] lstrlenW (lpString=".jpg") returned 4 [0111.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.593] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") [0111.594] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=32590) returned 1 [0111.594] CloseHandle (hObject=0x1a0) returned 1 [0111.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf")) returned 0x20 [0111.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.594] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.594] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0111.595] GetLastError () returned 0x0 [0111.595] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7f4e, lpOverlapped=0x0) returned 1 [0111.597] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7f50, lpOverlapped=0x0) returned 1 [0111.599] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.599] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.599] SetEndOfFile (hFile=0x158) returned 1 [0111.599] CloseHandle (hObject=0x158) returned 1 [0111.599] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.599] SetEndOfFile (hFile=0x1a0) returned 1 [0111.601] CloseHandle (hObject=0x1a0) returned 1 [0111.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf")) returned 1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.601] lstrlenW (lpString=".doc") returned 4 [0111.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.601] lstrlenW (lpString=".docx") returned 5 [0111.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0111.601] lstrlenW (lpString=".pdf") returned 4 [0111.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.601] lstrlenW (lpString=".xls") returned 4 [0111.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.601] lstrlenW (lpString=".xlsx") returned 5 [0111.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.601] lstrlenW (lpString=".ppt") returned 4 [0111.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.601] lstrlenW (lpString=".zip") returned 4 [0111.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.601] lstrlenW (lpString=".rar") returned 4 [0111.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".bz2") returned 4 [0111.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".7z") returned 3 [0111.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.602] lstrlenW (lpString=".dbf") returned 4 [0111.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.602] lstrlenW (lpString=".1cd") returned 4 [0111.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.602] lstrlenW (lpString=".jpg") returned 4 [0111.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".pdf") returned 4 [0111.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".xls") returned 4 [0111.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.602] lstrlenW (lpString=".xlsx") returned 5 [0111.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0111.602] lstrlenW (lpString=".ppt") returned 4 [0111.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.602] lstrlenW (lpString=".zip") returned 4 [0111.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.602] lstrlenW (lpString=".rar") returned 4 [0111.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".bz2") returned 4 [0111.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.602] lstrlenW (lpString=".7z") returned 3 [0111.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.603] lstrlenW (lpString=".dbf") returned 4 [0111.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.603] lstrlenW (lpString=".1cd") returned 4 [0111.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 63 [0111.603] lstrlenW (lpString=".jpg") returned 4 [0111.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.603] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") [0111.603] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=17164) returned 1 [0111.603] CloseHandle (hObject=0x1a0) returned 1 [0111.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf")) returned 0x20 [0111.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.604] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.604] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0111.605] GetLastError () returned 0x0 [0111.605] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x430c, lpOverlapped=0x0) returned 1 [0112.078] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4310, lpOverlapped=0x0) returned 1 [0112.079] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.079] WriteFile (in: hFile=0x158, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.079] SetEndOfFile (hFile=0x158) returned 1 [0112.239] CloseHandle (hObject=0x158) returned 1 [0112.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.239] SetEndOfFile (hFile=0x1a0) returned 1 [0112.716] CloseHandle (hObject=0x1a0) returned 1 [0112.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf")) returned 1 [0112.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.717] lstrlenW (lpString=".doc") returned 4 [0112.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.749] lstrlenW (lpString=".docx") returned 5 [0112.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.749] lstrlenW (lpString=".pdf") returned 4 [0112.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.749] lstrlenW (lpString=".xls") returned 4 [0112.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.749] lstrlenW (lpString=".xlsx") returned 5 [0112.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.749] lstrlenW (lpString=".ppt") returned 4 [0112.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.749] lstrlenW (lpString=".zip") returned 4 [0112.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.750] lstrlenW (lpString=".rar") returned 4 [0112.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".bz2") returned 4 [0112.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".7z") returned 3 [0112.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.750] lstrlenW (lpString=".dbf") returned 4 [0112.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.750] lstrlenW (lpString=".1cd") returned 4 [0112.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.750] lstrlenW (lpString=".jpg") returned 4 [0112.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".pdf") returned 4 [0112.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".xls") returned 4 [0112.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.750] lstrlenW (lpString=".xlsx") returned 5 [0112.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.750] lstrlenW (lpString=".ppt") returned 4 [0112.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.750] lstrlenW (lpString=".zip") returned 4 [0112.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.750] lstrlenW (lpString=".rar") returned 4 [0112.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".bz2") returned 4 [0112.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.750] lstrlenW (lpString=".7z") returned 3 [0112.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.751] lstrlenW (lpString=".dbf") returned 4 [0112.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.751] lstrlenW (lpString=".1cd") returned 4 [0112.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 63 [0112.751] lstrlenW (lpString=".jpg") returned 4 [0112.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.751] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") [0112.869] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=3030) returned 1 [0112.876] CloseHandle (hObject=0x1a0) returned 1 [0112.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf")) returned 0x20 [0112.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0112.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.908] GetLastError () returned 0x0 [0112.908] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xbd6, lpOverlapped=0x0) returned 1 [0112.932] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0112.932] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.933] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.933] SetEndOfFile (hFile=0x180) returned 1 [0112.933] CloseHandle (hObject=0x180) returned 1 [0112.933] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.933] SetEndOfFile (hFile=0x1a0) returned 1 [0112.934] CloseHandle (hObject=0x1a0) returned 1 [0112.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf")) returned 1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.934] lstrlenW (lpString=".doc") returned 4 [0112.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".docx") returned 5 [0112.934] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0112.934] lstrlenW (lpString=".pdf") returned 4 [0112.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".xls") returned 4 [0112.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.934] lstrlenW (lpString=".xlsx") returned 5 [0112.934] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0112.934] lstrlenW (lpString=".ppt") returned 4 [0112.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.934] lstrlenW (lpString=".zip") returned 4 [0112.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.934] lstrlenW (lpString=".rar") returned 4 [0112.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.935] lstrlenW (lpString=".bz2") returned 4 [0112.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.935] lstrlenW (lpString=".7z") returned 3 [0112.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.935] lstrlenW (lpString=".dbf") returned 4 [0112.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.935] lstrlenW (lpString=".1cd") returned 4 [0112.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 62 [0112.935] lstrlenW (lpString=".jpg") returned 4 [0112.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.935] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") [0112.935] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10084) returned 1 [0112.936] CloseHandle (hObject=0x1a0) returned 1 [0112.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf")) returned 0x20 [0112.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0112.936] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.936] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.937] GetLastError () returned 0x0 [0112.937] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2764, lpOverlapped=0x0) returned 1 [0112.938] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2770, lpOverlapped=0x0) returned 1 [0112.939] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.939] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.940] SetEndOfFile (hFile=0x180) returned 1 [0112.940] CloseHandle (hObject=0x180) returned 1 [0112.940] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.940] SetEndOfFile (hFile=0x1a0) returned 1 [0112.941] CloseHandle (hObject=0x1a0) returned 1 [0112.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf")) returned 1 [0112.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.941] lstrlenW (lpString=".doc") returned 4 [0112.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.941] lstrlenW (lpString=".docx") returned 5 [0112.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.941] lstrlenW (lpString=".pdf") returned 4 [0112.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.941] lstrlenW (lpString=".xls") returned 4 [0112.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.941] lstrlenW (lpString=".xlsx") returned 5 [0112.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.942] lstrlenW (lpString=".ppt") returned 4 [0112.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.942] lstrlenW (lpString=".zip") returned 4 [0112.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.942] lstrlenW (lpString=".rar") returned 4 [0112.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString=".bz2") returned 4 [0112.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString=".7z") returned 3 [0112.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.942] lstrlenW (lpString=".dbf") returned 4 [0112.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.942] lstrlenW (lpString=".1cd") returned 4 [0112.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.942] lstrlenW (lpString=".jpg") returned 4 [0112.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString=".pdf") returned 4 [0112.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString=".xls") returned 4 [0112.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.942] lstrlenW (lpString=".xlsx") returned 5 [0112.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.942] lstrlenW (lpString=".ppt") returned 4 [0112.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.942] lstrlenW (lpString=".zip") returned 4 [0112.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.942] lstrlenW (lpString=".rar") returned 4 [0112.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString=".bz2") returned 4 [0112.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString=".7z") returned 3 [0112.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.943] lstrlenW (lpString=".dbf") returned 4 [0112.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.943] lstrlenW (lpString=".1cd") returned 4 [0112.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 63 [0112.943] lstrlenW (lpString=".jpg") returned 4 [0112.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.943] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") [0112.944] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2480) returned 1 [0112.944] CloseHandle (hObject=0x1a0) returned 1 [0112.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf")) returned 0x20 [0112.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0112.944] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.945] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.945] GetLastError () returned 0x0 [0112.945] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x9b0, lpOverlapped=0x0) returned 1 [0112.947] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0112.948] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.948] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.948] SetEndOfFile (hFile=0x180) returned 1 [0112.948] CloseHandle (hObject=0x180) returned 1 [0112.948] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.948] SetEndOfFile (hFile=0x1a0) returned 1 [0112.949] CloseHandle (hObject=0x1a0) returned 1 [0112.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf")) returned 1 [0112.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.949] lstrlenW (lpString=".doc") returned 4 [0112.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.949] lstrlenW (lpString=".docx") returned 5 [0112.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.949] lstrlenW (lpString=".pdf") returned 4 [0112.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.949] lstrlenW (lpString=".xls") returned 4 [0112.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.949] lstrlenW (lpString=".xlsx") returned 5 [0112.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.950] lstrlenW (lpString=".ppt") returned 4 [0112.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.950] lstrlenW (lpString=".zip") returned 4 [0112.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.950] lstrlenW (lpString=".rar") returned 4 [0112.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString=".bz2") returned 4 [0112.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString=".7z") returned 3 [0112.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.950] lstrlenW (lpString=".dbf") returned 4 [0112.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.950] lstrlenW (lpString=".1cd") returned 4 [0112.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.950] lstrlenW (lpString=".jpg") returned 4 [0112.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString=".pdf") returned 4 [0112.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString=".xls") returned 4 [0112.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.950] lstrlenW (lpString=".xlsx") returned 5 [0112.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.950] lstrlenW (lpString=".ppt") returned 4 [0112.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.950] lstrlenW (lpString=".zip") returned 4 [0112.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.950] lstrlenW (lpString=".rar") returned 4 [0112.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.950] lstrlenW (lpString=".bz2") returned 4 [0112.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.951] lstrlenW (lpString=".7z") returned 3 [0112.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.951] lstrlenW (lpString=".dbf") returned 4 [0112.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.951] lstrlenW (lpString=".1cd") returned 4 [0112.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 63 [0112.951] lstrlenW (lpString=".jpg") returned 4 [0112.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.951] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") [0112.951] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1588) returned 1 [0112.952] CloseHandle (hObject=0x1a0) returned 1 [0112.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf")) returned 0x20 [0112.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0112.952] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.952] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.953] GetLastError () returned 0x0 [0112.953] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x634, lpOverlapped=0x0) returned 1 [0112.954] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x640, lpOverlapped=0x0) returned 1 [0112.955] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.955] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.955] SetEndOfFile (hFile=0x180) returned 1 [0112.955] CloseHandle (hObject=0x180) returned 1 [0112.955] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.955] SetEndOfFile (hFile=0x1a0) returned 1 [0112.956] CloseHandle (hObject=0x1a0) returned 1 [0112.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf")) returned 1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.956] lstrlenW (lpString=".doc") returned 4 [0112.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.956] lstrlenW (lpString=".docx") returned 5 [0112.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0112.956] lstrlenW (lpString=".pdf") returned 4 [0112.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.956] lstrlenW (lpString=".xls") returned 4 [0112.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.957] lstrlenW (lpString=".xlsx") returned 5 [0112.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.957] lstrlenW (lpString=".ppt") returned 4 [0112.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.957] lstrlenW (lpString=".zip") returned 4 [0112.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.957] lstrlenW (lpString=".rar") returned 4 [0112.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString=".bz2") returned 4 [0112.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString=".7z") returned 3 [0112.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.957] lstrlenW (lpString=".dbf") returned 4 [0112.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.957] lstrlenW (lpString=".1cd") returned 4 [0112.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.957] lstrlenW (lpString=".jpg") returned 4 [0112.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString=".pdf") returned 4 [0112.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString=".xls") returned 4 [0112.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.957] lstrlenW (lpString=".xlsx") returned 5 [0112.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0112.957] lstrlenW (lpString=".ppt") returned 4 [0112.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.957] lstrlenW (lpString=".zip") returned 4 [0112.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.958] lstrlenW (lpString=".rar") returned 4 [0112.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.958] lstrlenW (lpString=".bz2") returned 4 [0112.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.958] lstrlenW (lpString=".7z") returned 3 [0112.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.958] lstrlenW (lpString=".dbf") returned 4 [0112.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.958] lstrlenW (lpString=".1cd") returned 4 [0112.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 63 [0112.958] lstrlenW (lpString=".jpg") returned 4 [0112.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.958] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") [0112.959] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=10036) returned 1 [0112.959] CloseHandle (hObject=0x1a0) returned 1 [0112.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf")) returned 0x20 [0112.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0112.959] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.959] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.960] GetLastError () returned 0x0 [0112.960] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2734, lpOverlapped=0x0) returned 1 [0112.997] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2740, lpOverlapped=0x0) returned 1 [0112.998] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.998] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.998] SetEndOfFile (hFile=0x180) returned 1 [0113.345] CloseHandle (hObject=0x180) returned 1 [0113.345] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.345] SetEndOfFile (hFile=0x1a0) returned 1 [0113.346] CloseHandle (hObject=0x1a0) returned 1 [0113.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf")) returned 1 [0113.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.346] lstrlenW (lpString=".doc") returned 4 [0113.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.346] lstrlenW (lpString=".docx") returned 5 [0113.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.346] lstrlenW (lpString=".pdf") returned 4 [0113.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.346] lstrlenW (lpString=".xls") returned 4 [0113.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.347] lstrlenW (lpString=".xlsx") returned 5 [0113.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.347] lstrlenW (lpString=".ppt") returned 4 [0113.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.347] lstrlenW (lpString=".zip") returned 4 [0113.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.347] lstrlenW (lpString=".rar") returned 4 [0113.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString=".bz2") returned 4 [0113.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString=".7z") returned 3 [0113.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.347] lstrlenW (lpString=".dbf") returned 4 [0113.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.347] lstrlenW (lpString=".1cd") returned 4 [0113.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.347] lstrlenW (lpString=".jpg") returned 4 [0113.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString=".pdf") returned 4 [0113.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString=".xls") returned 4 [0113.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.347] lstrlenW (lpString=".xlsx") returned 5 [0113.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.347] lstrlenW (lpString=".ppt") returned 4 [0113.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.347] lstrlenW (lpString=".zip") returned 4 [0113.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.348] lstrlenW (lpString=".rar") returned 4 [0113.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.348] lstrlenW (lpString=".bz2") returned 4 [0113.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.348] lstrlenW (lpString=".7z") returned 3 [0113.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.348] lstrlenW (lpString=".dbf") returned 4 [0113.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.348] lstrlenW (lpString=".1cd") returned 4 [0113.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 63 [0113.348] lstrlenW (lpString=".jpg") returned 4 [0113.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.348] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") [0113.349] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9276) returned 1 [0113.349] CloseHandle (hObject=0x1a0) returned 1 [0113.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf")) returned 0x20 [0113.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.349] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.349] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.350] GetLastError () returned 0x0 [0113.350] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x243c, lpOverlapped=0x0) returned 1 [0113.358] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2440, lpOverlapped=0x0) returned 1 [0113.359] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.359] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.359] SetEndOfFile (hFile=0x180) returned 1 [0113.360] CloseHandle (hObject=0x180) returned 1 [0113.360] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.360] SetEndOfFile (hFile=0x1a0) returned 1 [0113.361] CloseHandle (hObject=0x1a0) returned 1 [0113.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf")) returned 1 [0113.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.361] lstrlenW (lpString=".doc") returned 4 [0113.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.361] lstrlenW (lpString=".docx") returned 5 [0113.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.361] lstrlenW (lpString=".pdf") returned 4 [0113.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.361] lstrlenW (lpString=".xls") returned 4 [0113.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.361] lstrlenW (lpString=".xlsx") returned 5 [0113.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.361] lstrlenW (lpString=".ppt") returned 4 [0113.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.361] lstrlenW (lpString=".zip") returned 4 [0113.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.362] lstrlenW (lpString=".rar") returned 4 [0113.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".bz2") returned 4 [0113.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".7z") returned 3 [0113.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.362] lstrlenW (lpString=".dbf") returned 4 [0113.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.362] lstrlenW (lpString=".1cd") returned 4 [0113.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.362] lstrlenW (lpString=".jpg") returned 4 [0113.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".pdf") returned 4 [0113.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".xls") returned 4 [0113.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.362] lstrlenW (lpString=".xlsx") returned 5 [0113.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.362] lstrlenW (lpString=".ppt") returned 4 [0113.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.362] lstrlenW (lpString=".zip") returned 4 [0113.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.362] lstrlenW (lpString=".rar") returned 4 [0113.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".bz2") returned 4 [0113.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.362] lstrlenW (lpString=".7z") returned 3 [0113.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.363] lstrlenW (lpString=".dbf") returned 4 [0113.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.363] lstrlenW (lpString=".1cd") returned 4 [0113.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 63 [0113.363] lstrlenW (lpString=".jpg") returned 4 [0113.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.363] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") [0113.364] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5978) returned 1 [0113.364] CloseHandle (hObject=0x1a0) returned 1 [0113.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf")) returned 0x20 [0113.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0113.364] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.364] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0113.365] GetLastError () returned 0x0 [0113.365] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x175a, lpOverlapped=0x0) returned 1 [0113.367] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0113.368] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.368] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.369] SetEndOfFile (hFile=0x180) returned 1 [0113.369] CloseHandle (hObject=0x180) returned 1 [0113.369] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.369] SetEndOfFile (hFile=0x1a0) returned 1 [0113.370] CloseHandle (hObject=0x1a0) returned 1 [0113.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf")) returned 1 [0113.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.370] lstrlenW (lpString=".doc") returned 4 [0113.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.370] lstrlenW (lpString=".docx") returned 5 [0113.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.370] lstrlenW (lpString=".pdf") returned 4 [0113.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.370] lstrlenW (lpString=".xls") returned 4 [0113.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.370] lstrlenW (lpString=".xlsx") returned 5 [0113.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.370] lstrlenW (lpString=".ppt") returned 4 [0113.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.370] lstrlenW (lpString=".zip") returned 4 [0113.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.370] lstrlenW (lpString=".rar") returned 4 [0113.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.370] lstrlenW (lpString=".bz2") returned 4 [0113.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString=".7z") returned 3 [0113.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".dbf") returned 4 [0113.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".1cd") returned 4 [0113.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".jpg") returned 4 [0113.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString=".pdf") returned 4 [0113.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString=".xls") returned 4 [0113.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.371] lstrlenW (lpString=".xlsx") returned 5 [0113.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.371] lstrlenW (lpString=".ppt") returned 4 [0113.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".zip") returned 4 [0113.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.371] lstrlenW (lpString=".rar") returned 4 [0113.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString=".bz2") returned 4 [0113.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString=".7z") returned 3 [0113.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".dbf") returned 4 [0113.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.371] lstrlenW (lpString=".1cd") returned 4 [0113.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 63 [0113.372] lstrlenW (lpString=".jpg") returned 4 [0113.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.372] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") [0113.383] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7186) returned 1 [0113.383] CloseHandle (hObject=0x1b8) returned 1 [0113.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf")) returned 0x20 [0113.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.421] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.428] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.842] GetLastError () returned 0x0 [0113.842] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1c12, lpOverlapped=0x0) returned 1 [0113.867] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1c20, lpOverlapped=0x0) returned 1 [0113.868] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.868] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.868] SetEndOfFile (hFile=0x1c0) returned 1 [0113.868] CloseHandle (hObject=0x1c0) returned 1 [0113.868] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.868] SetEndOfFile (hFile=0x1b8) returned 1 [0113.869] CloseHandle (hObject=0x1b8) returned 1 [0113.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf")) returned 1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString=".doc") returned 4 [0113.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString=".docx") returned 5 [0113.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.870] lstrlenW (lpString=".pdf") returned 4 [0113.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString=".xls") returned 4 [0113.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.870] lstrlenW (lpString=".xlsx") returned 5 [0113.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.870] lstrlenW (lpString=".ppt") returned 4 [0113.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString=".zip") returned 4 [0113.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.870] lstrlenW (lpString=".rar") returned 4 [0113.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString=".bz2") returned 4 [0113.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString=".7z") returned 3 [0113.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString=".dbf") returned 4 [0113.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString=".1cd") returned 4 [0113.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.870] lstrlenW (lpString=".jpg") returned 4 [0113.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString=".pdf") returned 4 [0113.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString=".xls") returned 4 [0113.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.871] lstrlenW (lpString=".xlsx") returned 5 [0113.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.871] lstrlenW (lpString=".ppt") returned 4 [0113.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.871] lstrlenW (lpString=".zip") returned 4 [0113.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.871] lstrlenW (lpString=".rar") returned 4 [0113.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString=".bz2") returned 4 [0113.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString=".7z") returned 3 [0113.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.871] lstrlenW (lpString=".dbf") returned 4 [0113.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.871] lstrlenW (lpString=".1cd") returned 4 [0113.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 63 [0113.871] lstrlenW (lpString=".jpg") returned 4 [0113.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.871] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") [0113.872] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4660) returned 1 [0113.872] CloseHandle (hObject=0x1b8) returned 1 [0113.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf")) returned 0x20 [0113.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.872] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.872] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.873] GetLastError () returned 0x0 [0113.873] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1234, lpOverlapped=0x0) returned 1 [0113.875] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1240, lpOverlapped=0x0) returned 1 [0113.876] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.876] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.876] SetEndOfFile (hFile=0x1c0) returned 1 [0113.876] CloseHandle (hObject=0x1c0) returned 1 [0113.876] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.876] SetEndOfFile (hFile=0x1b8) returned 1 [0113.877] CloseHandle (hObject=0x1b8) returned 1 [0113.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf")) returned 1 [0113.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.877] lstrlenW (lpString=".doc") returned 4 [0113.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".docx") returned 5 [0113.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.878] lstrlenW (lpString=".pdf") returned 4 [0113.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".xls") returned 4 [0113.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.878] lstrlenW (lpString=".xlsx") returned 5 [0113.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.878] lstrlenW (lpString=".ppt") returned 4 [0113.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.878] lstrlenW (lpString=".zip") returned 4 [0113.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.878] lstrlenW (lpString=".rar") returned 4 [0113.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".bz2") returned 4 [0113.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".7z") returned 3 [0113.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.878] lstrlenW (lpString=".dbf") returned 4 [0113.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.878] lstrlenW (lpString=".1cd") returned 4 [0113.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.878] lstrlenW (lpString=".jpg") returned 4 [0113.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".pdf") returned 4 [0113.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.878] lstrlenW (lpString=".xls") returned 4 [0113.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.879] lstrlenW (lpString=".xlsx") returned 5 [0113.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.879] lstrlenW (lpString=".ppt") returned 4 [0113.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.879] lstrlenW (lpString=".zip") returned 4 [0113.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.879] lstrlenW (lpString=".rar") returned 4 [0113.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.879] lstrlenW (lpString=".bz2") returned 4 [0113.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.879] lstrlenW (lpString=".7z") returned 3 [0113.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.879] lstrlenW (lpString=".dbf") returned 4 [0113.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.879] lstrlenW (lpString=".1cd") returned 4 [0113.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 63 [0113.879] lstrlenW (lpString=".jpg") returned 4 [0113.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.879] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") [0113.880] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=9052) returned 1 [0113.880] CloseHandle (hObject=0x1b8) returned 1 [0113.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf")) returned 0x20 [0113.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.880] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.880] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.881] GetLastError () returned 0x0 [0113.881] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x235c, lpOverlapped=0x0) returned 1 [0113.882] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0113.883] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.883] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.884] SetEndOfFile (hFile=0x1c0) returned 1 [0113.884] CloseHandle (hObject=0x1c0) returned 1 [0113.884] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.884] SetEndOfFile (hFile=0x1b8) returned 1 [0113.885] CloseHandle (hObject=0x1b8) returned 1 [0113.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf")) returned 1 [0113.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.885] lstrlenW (lpString=".doc") returned 4 [0113.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.885] lstrlenW (lpString=".docx") returned 5 [0113.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.885] lstrlenW (lpString=".pdf") returned 4 [0113.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.885] lstrlenW (lpString=".xls") returned 4 [0113.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.885] lstrlenW (lpString=".xlsx") returned 5 [0113.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.885] lstrlenW (lpString=".ppt") returned 4 [0113.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.885] lstrlenW (lpString=".zip") returned 4 [0113.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.885] lstrlenW (lpString=".rar") returned 4 [0113.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".bz2") returned 4 [0113.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".7z") returned 3 [0113.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.886] lstrlenW (lpString=".dbf") returned 4 [0113.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.886] lstrlenW (lpString=".1cd") returned 4 [0113.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.886] lstrlenW (lpString=".jpg") returned 4 [0113.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".pdf") returned 4 [0113.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".xls") returned 4 [0113.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.886] lstrlenW (lpString=".xlsx") returned 5 [0113.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.886] lstrlenW (lpString=".ppt") returned 4 [0113.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.886] lstrlenW (lpString=".zip") returned 4 [0113.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.886] lstrlenW (lpString=".rar") returned 4 [0113.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".bz2") returned 4 [0113.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.886] lstrlenW (lpString=".7z") returned 3 [0113.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.886] lstrlenW (lpString=".dbf") returned 4 [0113.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.887] lstrlenW (lpString=".1cd") returned 4 [0113.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 63 [0113.887] lstrlenW (lpString=".jpg") returned 4 [0113.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.887] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") [0113.887] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8514) returned 1 [0113.887] CloseHandle (hObject=0x1b8) returned 1 [0113.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf")) returned 0x20 [0113.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.888] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.888] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.888] GetLastError () returned 0x0 [0113.888] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2142, lpOverlapped=0x0) returned 1 [0113.890] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2150, lpOverlapped=0x0) returned 1 [0113.891] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.891] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.891] SetEndOfFile (hFile=0x1c0) returned 1 [0113.892] CloseHandle (hObject=0x1c0) returned 1 [0113.892] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.892] SetEndOfFile (hFile=0x1b8) returned 1 [0113.892] CloseHandle (hObject=0x1b8) returned 1 [0113.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf")) returned 1 [0113.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.893] lstrlenW (lpString=".doc") returned 4 [0113.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.893] lstrlenW (lpString=".docx") returned 5 [0113.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.893] lstrlenW (lpString=".pdf") returned 4 [0113.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.893] lstrlenW (lpString=".xls") returned 4 [0113.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.893] lstrlenW (lpString=".xlsx") returned 5 [0113.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.893] lstrlenW (lpString=".ppt") returned 4 [0113.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.893] lstrlenW (lpString=".zip") returned 4 [0113.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.893] lstrlenW (lpString=".rar") returned 4 [0113.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.893] lstrlenW (lpString=".bz2") returned 4 [0113.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.893] lstrlenW (lpString=".7z") returned 3 [0113.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".dbf") returned 4 [0113.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".1cd") returned 4 [0113.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".jpg") returned 4 [0113.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString=".pdf") returned 4 [0113.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString=".xls") returned 4 [0113.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.894] lstrlenW (lpString=".xlsx") returned 5 [0113.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.894] lstrlenW (lpString=".ppt") returned 4 [0113.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".zip") returned 4 [0113.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.894] lstrlenW (lpString=".rar") returned 4 [0113.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString=".bz2") returned 4 [0113.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString=".7z") returned 3 [0113.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".dbf") returned 4 [0113.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.894] lstrlenW (lpString=".1cd") returned 4 [0113.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 63 [0113.895] lstrlenW (lpString=".jpg") returned 4 [0113.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.895] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") [0113.895] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=27840) returned 1 [0113.895] CloseHandle (hObject=0x1b8) returned 1 [0113.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf")) returned 0x20 [0113.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.896] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.896] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.896] GetLastError () returned 0x0 [0113.896] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6cc0, lpOverlapped=0x0) returned 1 [0113.898] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6cd0, lpOverlapped=0x0) returned 1 [0113.899] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.899] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.899] SetEndOfFile (hFile=0x1c0) returned 1 [0113.899] CloseHandle (hObject=0x1c0) returned 1 [0113.899] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.900] SetEndOfFile (hFile=0x1b8) returned 1 [0113.900] CloseHandle (hObject=0x1b8) returned 1 [0113.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf")) returned 1 [0113.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.901] lstrlenW (lpString=".doc") returned 4 [0113.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.901] lstrlenW (lpString=".docx") returned 5 [0113.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.901] lstrlenW (lpString=".pdf") returned 4 [0113.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.901] lstrlenW (lpString=".xls") returned 4 [0113.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.901] lstrlenW (lpString=".xlsx") returned 5 [0113.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.901] lstrlenW (lpString=".ppt") returned 4 [0113.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.901] lstrlenW (lpString=".zip") returned 4 [0113.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.901] lstrlenW (lpString=".rar") returned 4 [0113.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.901] lstrlenW (lpString=".bz2") returned 4 [0113.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.901] lstrlenW (lpString=".7z") returned 3 [0113.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.901] lstrlenW (lpString=".dbf") returned 4 [0113.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".1cd") returned 4 [0113.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".jpg") returned 4 [0113.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString=".pdf") returned 4 [0113.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString=".xls") returned 4 [0113.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.902] lstrlenW (lpString=".xlsx") returned 5 [0113.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.902] lstrlenW (lpString=".ppt") returned 4 [0113.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".zip") returned 4 [0113.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.902] lstrlenW (lpString=".rar") returned 4 [0113.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString=".bz2") returned 4 [0113.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString=".7z") returned 3 [0113.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".dbf") returned 4 [0113.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".1cd") returned 4 [0113.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 63 [0113.902] lstrlenW (lpString=".jpg") returned 4 [0113.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.903] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") [0113.903] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=31818) returned 1 [0113.903] CloseHandle (hObject=0x1b8) returned 1 [0113.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf")) returned 0x20 [0113.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.904] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.904] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.904] GetLastError () returned 0x0 [0113.904] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x7c4a, lpOverlapped=0x0) returned 1 [0113.952] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0113.953] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.953] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.953] SetEndOfFile (hFile=0x1c0) returned 1 [0113.953] CloseHandle (hObject=0x1c0) returned 1 [0113.953] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.953] SetEndOfFile (hFile=0x1b8) returned 1 [0113.954] CloseHandle (hObject=0x1b8) returned 1 [0113.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf")) returned 1 [0113.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.956] lstrlenW (lpString=".doc") returned 4 [0113.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.956] lstrlenW (lpString=".docx") returned 5 [0113.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0113.957] lstrlenW (lpString=".pdf") returned 4 [0113.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString=".xls") returned 4 [0113.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.957] lstrlenW (lpString=".xlsx") returned 5 [0113.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.957] lstrlenW (lpString=".ppt") returned 4 [0113.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.957] lstrlenW (lpString=".zip") returned 4 [0113.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.957] lstrlenW (lpString=".rar") returned 4 [0113.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString=".bz2") returned 4 [0113.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString=".7z") returned 3 [0113.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.957] lstrlenW (lpString=".dbf") returned 4 [0113.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.957] lstrlenW (lpString=".1cd") returned 4 [0113.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.957] lstrlenW (lpString=".jpg") returned 4 [0113.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString=".pdf") returned 4 [0113.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.957] lstrlenW (lpString=".xls") returned 4 [0113.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.957] lstrlenW (lpString=".xlsx") returned 5 [0113.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0113.958] lstrlenW (lpString=".ppt") returned 4 [0113.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.958] lstrlenW (lpString=".zip") returned 4 [0113.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.958] lstrlenW (lpString=".rar") returned 4 [0113.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.958] lstrlenW (lpString=".bz2") returned 4 [0113.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.958] lstrlenW (lpString=".7z") returned 3 [0113.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.958] lstrlenW (lpString=".dbf") returned 4 [0113.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.958] lstrlenW (lpString=".1cd") returned 4 [0113.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 63 [0113.958] lstrlenW (lpString=".jpg") returned 4 [0113.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.958] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") [0113.959] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=363) returned 1 [0113.959] CloseHandle (hObject=0x1b8) returned 1 [0113.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0113.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.959] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.959] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.960] GetLastError () returned 0x0 [0113.960] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x16b, lpOverlapped=0x0) returned 1 [0113.961] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x170, lpOverlapped=0x0) returned 1 [0113.962] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.962] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.962] SetEndOfFile (hFile=0x1c0) returned 1 [0113.962] CloseHandle (hObject=0x1c0) returned 1 [0113.962] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.962] SetEndOfFile (hFile=0x1b8) returned 1 [0113.963] CloseHandle (hObject=0x1b8) returned 1 [0113.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 1 [0113.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.963] lstrlenW (lpString=".doc") returned 4 [0113.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.963] lstrlenW (lpString=".docx") returned 5 [0113.964] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0113.964] lstrlenW (lpString=".pdf") returned 4 [0113.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".xls") returned 4 [0113.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".xlsx") returned 5 [0113.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.964] lstrlenW (lpString=".ppt") returned 4 [0113.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.964] lstrlenW (lpString=".zip") returned 4 [0113.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".rar") returned 4 [0113.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".bz2") returned 4 [0113.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.964] lstrlenW (lpString=".7z") returned 3 [0113.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.964] lstrlenW (lpString=".dbf") returned 4 [0113.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.964] lstrlenW (lpString=".1cd") returned 4 [0113.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.964] lstrlenW (lpString=".jpg") returned 4 [0113.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".pdf") returned 4 [0113.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".xls") returned 4 [0113.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.964] lstrlenW (lpString=".xlsx") returned 5 [0113.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.965] lstrlenW (lpString=".ppt") returned 4 [0113.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.965] lstrlenW (lpString=".zip") returned 4 [0113.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.965] lstrlenW (lpString=".rar") returned 4 [0113.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.965] lstrlenW (lpString=".bz2") returned 4 [0113.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.965] lstrlenW (lpString=".7z") returned 3 [0113.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.965] lstrlenW (lpString=".dbf") returned 4 [0113.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.965] lstrlenW (lpString=".1cd") returned 4 [0113.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 63 [0113.965] lstrlenW (lpString=".jpg") returned 4 [0113.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.965] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") [0113.966] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=359) returned 1 [0113.966] CloseHandle (hObject=0x1b8) returned 1 [0113.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0113.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.966] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.966] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.967] GetLastError () returned 0x0 [0113.967] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x167, lpOverlapped=0x0) returned 1 [0113.968] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x170, lpOverlapped=0x0) returned 1 [0113.969] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.969] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.969] SetEndOfFile (hFile=0x1c0) returned 1 [0113.969] CloseHandle (hObject=0x1c0) returned 1 [0113.969] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.969] SetEndOfFile (hFile=0x1b8) returned 1 [0113.970] CloseHandle (hObject=0x1b8) returned 1 [0113.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 1 [0113.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.973] lstrlenW (lpString=".doc") returned 4 [0113.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.973] lstrlenW (lpString=".docx") returned 5 [0113.973] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0113.973] lstrlenW (lpString=".pdf") returned 4 [0113.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.973] lstrlenW (lpString=".xls") returned 4 [0113.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.973] lstrlenW (lpString=".xlsx") returned 5 [0113.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.973] lstrlenW (lpString=".ppt") returned 4 [0113.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.973] lstrlenW (lpString=".zip") returned 4 [0113.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.973] lstrlenW (lpString=".rar") returned 4 [0113.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.973] lstrlenW (lpString=".bz2") returned 4 [0113.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.973] lstrlenW (lpString=".7z") returned 3 [0113.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.973] lstrlenW (lpString=".dbf") returned 4 [0113.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".1cd") returned 4 [0113.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".jpg") returned 4 [0113.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString=".pdf") returned 4 [0113.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString=".xls") returned 4 [0113.974] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString=".xlsx") returned 5 [0113.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.974] lstrlenW (lpString=".ppt") returned 4 [0113.974] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".zip") returned 4 [0113.974] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString=".rar") returned 4 [0113.974] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.974] lstrlenW (lpString=".bz2") returned 4 [0113.974] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.974] lstrlenW (lpString=".7z") returned 3 [0113.974] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".dbf") returned 4 [0113.974] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".1cd") returned 4 [0113.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 63 [0113.974] lstrlenW (lpString=".jpg") returned 4 [0113.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.975] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") [0113.975] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=410) returned 1 [0113.976] CloseHandle (hObject=0x1b8) returned 1 [0113.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 0x20 [0113.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.976] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.976] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.977] GetLastError () returned 0x0 [0113.977] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x19a, lpOverlapped=0x0) returned 1 [0113.977] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1a0, lpOverlapped=0x0) returned 1 [0113.978] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.978] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.979] SetEndOfFile (hFile=0x1c0) returned 1 [0113.979] CloseHandle (hObject=0x1c0) returned 1 [0113.979] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.979] SetEndOfFile (hFile=0x1b8) returned 1 [0113.979] CloseHandle (hObject=0x1b8) returned 1 [0113.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 1 [0113.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.980] lstrlenW (lpString=".doc") returned 4 [0113.980] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.980] lstrlenW (lpString=".docx") returned 5 [0113.980] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0113.980] lstrlenW (lpString=".pdf") returned 4 [0113.980] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.980] lstrlenW (lpString=".xls") returned 4 [0113.980] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.980] lstrlenW (lpString=".xlsx") returned 5 [0113.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.980] lstrlenW (lpString=".ppt") returned 4 [0113.980] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.980] lstrlenW (lpString=".zip") returned 4 [0113.980] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.980] lstrlenW (lpString=".rar") returned 4 [0113.980] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.980] lstrlenW (lpString=".bz2") returned 4 [0113.980] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.980] lstrlenW (lpString=".7z") returned 3 [0113.980] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".dbf") returned 4 [0113.981] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".1cd") returned 4 [0113.981] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".jpg") returned 4 [0113.981] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString=".pdf") returned 4 [0113.981] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString=".xls") returned 4 [0113.981] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString=".xlsx") returned 5 [0113.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.981] lstrlenW (lpString=".ppt") returned 4 [0113.981] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".zip") returned 4 [0113.981] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString=".rar") returned 4 [0113.981] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.981] lstrlenW (lpString=".bz2") returned 4 [0113.981] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.981] lstrlenW (lpString=".7z") returned 3 [0113.981] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".dbf") returned 4 [0113.981] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.981] lstrlenW (lpString=".1cd") returned 4 [0113.981] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 63 [0113.982] lstrlenW (lpString=".jpg") returned 4 [0113.982] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.982] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") [0113.982] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=333) returned 1 [0113.982] CloseHandle (hObject=0x1b8) returned 1 [0113.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 0x20 [0113.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.983] GetLastError () returned 0x0 [0113.983] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x14d, lpOverlapped=0x0) returned 1 [0113.984] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x150, lpOverlapped=0x0) returned 1 [0113.985] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.985] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.985] SetEndOfFile (hFile=0x1c0) returned 1 [0113.986] CloseHandle (hObject=0x1c0) returned 1 [0113.986] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.986] SetEndOfFile (hFile=0x1b8) returned 1 [0113.986] CloseHandle (hObject=0x1b8) returned 1 [0113.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 1 [0113.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.987] lstrlenW (lpString=".doc") returned 4 [0113.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.987] lstrlenW (lpString=".docx") returned 5 [0113.987] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0113.987] lstrlenW (lpString=".pdf") returned 4 [0113.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.987] lstrlenW (lpString=".xls") returned 4 [0113.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.987] lstrlenW (lpString=".xlsx") returned 5 [0113.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.987] lstrlenW (lpString=".ppt") returned 4 [0113.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.987] lstrlenW (lpString=".zip") returned 4 [0113.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.987] lstrlenW (lpString=".rar") returned 4 [0113.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.987] lstrlenW (lpString=".bz2") returned 4 [0113.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.987] lstrlenW (lpString=".7z") returned 3 [0113.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".dbf") returned 4 [0113.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".1cd") returned 4 [0113.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".jpg") returned 4 [0113.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString=".pdf") returned 4 [0113.988] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString=".xls") returned 4 [0113.988] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString=".xlsx") returned 5 [0113.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0113.988] lstrlenW (lpString=".ppt") returned 4 [0113.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".zip") returned 4 [0113.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString=".rar") returned 4 [0113.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.988] lstrlenW (lpString=".bz2") returned 4 [0113.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.988] lstrlenW (lpString=".7z") returned 3 [0113.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".dbf") returned 4 [0113.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.988] lstrlenW (lpString=".1cd") returned 4 [0113.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 63 [0113.989] lstrlenW (lpString=".jpg") returned 4 [0113.989] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.989] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") [0113.989] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=386) returned 1 [0113.989] CloseHandle (hObject=0x1b8) returned 1 [0113.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 0x20 [0113.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0113.990] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.990] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.990] GetLastError () returned 0x0 [0113.990] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x182, lpOverlapped=0x0) returned 1 [0114.007] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x190, lpOverlapped=0x0) returned 1 [0114.008] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.008] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.008] SetEndOfFile (hFile=0x1c0) returned 1 [0114.236] CloseHandle (hObject=0x1c0) returned 1 [0114.236] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.236] SetEndOfFile (hFile=0x1b8) returned 1 [0114.236] CloseHandle (hObject=0x1b8) returned 1 [0114.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 1 [0114.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.237] lstrlenW (lpString=".doc") returned 4 [0114.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.237] lstrlenW (lpString=".docx") returned 5 [0114.237] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.237] lstrlenW (lpString=".pdf") returned 4 [0114.237] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.237] lstrlenW (lpString=".xls") returned 4 [0114.237] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.237] lstrlenW (lpString=".xlsx") returned 5 [0114.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.237] lstrlenW (lpString=".ppt") returned 4 [0114.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.237] lstrlenW (lpString=".zip") returned 4 [0114.237] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.237] lstrlenW (lpString=".rar") returned 4 [0114.237] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.237] lstrlenW (lpString=".bz2") returned 4 [0114.237] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.237] lstrlenW (lpString=".7z") returned 3 [0114.237] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".dbf") returned 4 [0114.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".1cd") returned 4 [0114.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".jpg") returned 4 [0114.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString=".pdf") returned 4 [0114.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString=".xls") returned 4 [0114.238] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString=".xlsx") returned 5 [0114.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.238] lstrlenW (lpString=".ppt") returned 4 [0114.238] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".zip") returned 4 [0114.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString=".rar") returned 4 [0114.238] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.238] lstrlenW (lpString=".bz2") returned 4 [0114.238] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.238] lstrlenW (lpString=".7z") returned 3 [0114.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".dbf") returned 4 [0114.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".1cd") returned 4 [0114.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 63 [0114.238] lstrlenW (lpString=".jpg") returned 4 [0114.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.239] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") [0114.416] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=370) returned 1 [0114.416] CloseHandle (hObject=0x22c) returned 1 [0114.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif")) returned 0x20 [0114.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.416] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.416] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.869] GetLastError () returned 0x0 [0114.869] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x172, lpOverlapped=0x0) returned 1 [0114.870] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x180, lpOverlapped=0x0) returned 1 [0114.870] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.870] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.871] SetEndOfFile (hFile=0x1c0) returned 1 [0114.871] CloseHandle (hObject=0x1c0) returned 1 [0114.871] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.871] SetEndOfFile (hFile=0x22c) returned 1 [0114.872] CloseHandle (hObject=0x22c) returned 1 [0114.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif")) returned 1 [0114.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.872] lstrlenW (lpString=".doc") returned 4 [0114.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.872] lstrlenW (lpString=".docx") returned 5 [0114.872] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.872] lstrlenW (lpString=".pdf") returned 4 [0114.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.872] lstrlenW (lpString=".xls") returned 4 [0114.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.872] lstrlenW (lpString=".xlsx") returned 5 [0114.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.872] lstrlenW (lpString=".ppt") returned 4 [0114.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.872] lstrlenW (lpString=".zip") returned 4 [0114.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".rar") returned 4 [0114.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".bz2") returned 4 [0114.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.873] lstrlenW (lpString=".7z") returned 3 [0114.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.873] lstrlenW (lpString=".dbf") returned 4 [0114.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.873] lstrlenW (lpString=".1cd") returned 4 [0114.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.873] lstrlenW (lpString=".jpg") returned 4 [0114.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".pdf") returned 4 [0114.873] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".xls") returned 4 [0114.873] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".xlsx") returned 5 [0114.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.873] lstrlenW (lpString=".ppt") returned 4 [0114.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.873] lstrlenW (lpString=".zip") returned 4 [0114.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".rar") returned 4 [0114.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.873] lstrlenW (lpString=".bz2") returned 4 [0114.874] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.874] lstrlenW (lpString=".7z") returned 3 [0114.874] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.874] lstrlenW (lpString=".dbf") returned 4 [0114.874] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.874] lstrlenW (lpString=".1cd") returned 4 [0114.874] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 63 [0114.874] lstrlenW (lpString=".jpg") returned 4 [0114.874] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.874] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") [0114.875] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=595) returned 1 [0114.875] CloseHandle (hObject=0x22c) returned 1 [0114.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif")) returned 0x20 [0114.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.875] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.875] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.876] GetLastError () returned 0x0 [0114.876] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x253, lpOverlapped=0x0) returned 1 [0114.877] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x260, lpOverlapped=0x0) returned 1 [0114.878] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.878] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.878] SetEndOfFile (hFile=0x1c0) returned 1 [0114.878] CloseHandle (hObject=0x1c0) returned 1 [0114.878] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.878] SetEndOfFile (hFile=0x22c) returned 1 [0114.879] CloseHandle (hObject=0x22c) returned 1 [0114.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif")) returned 1 [0114.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.879] lstrlenW (lpString=".doc") returned 4 [0114.879] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.879] lstrlenW (lpString=".docx") returned 5 [0114.879] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.879] lstrlenW (lpString=".pdf") returned 4 [0114.879] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.879] lstrlenW (lpString=".xls") returned 4 [0114.879] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.879] lstrlenW (lpString=".xlsx") returned 5 [0114.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.879] lstrlenW (lpString=".ppt") returned 4 [0114.880] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.880] lstrlenW (lpString=".zip") returned 4 [0114.880] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".rar") returned 4 [0114.880] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".bz2") returned 4 [0114.880] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.880] lstrlenW (lpString=".7z") returned 3 [0114.880] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.880] lstrlenW (lpString=".dbf") returned 4 [0114.880] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.880] lstrlenW (lpString=".1cd") returned 4 [0114.880] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.880] lstrlenW (lpString=".jpg") returned 4 [0114.880] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".pdf") returned 4 [0114.880] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".xls") returned 4 [0114.880] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".xlsx") returned 5 [0114.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.880] lstrlenW (lpString=".ppt") returned 4 [0114.880] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.880] lstrlenW (lpString=".zip") returned 4 [0114.880] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".rar") returned 4 [0114.880] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.880] lstrlenW (lpString=".bz2") returned 4 [0114.880] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.881] lstrlenW (lpString=".7z") returned 3 [0114.881] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.881] lstrlenW (lpString=".dbf") returned 4 [0114.881] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.881] lstrlenW (lpString=".1cd") returned 4 [0114.881] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 63 [0114.881] lstrlenW (lpString=".jpg") returned 4 [0114.881] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.881] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") [0114.881] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1237) returned 1 [0114.881] CloseHandle (hObject=0x22c) returned 1 [0114.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif")) returned 0x20 [0114.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.882] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.882] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.882] GetLastError () returned 0x0 [0114.883] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x4d5, lpOverlapped=0x0) returned 1 [0114.884] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0114.885] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.885] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.885] SetEndOfFile (hFile=0x1c0) returned 1 [0114.885] CloseHandle (hObject=0x1c0) returned 1 [0114.885] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.885] SetEndOfFile (hFile=0x22c) returned 1 [0114.886] CloseHandle (hObject=0x22c) returned 1 [0114.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif")) returned 1 [0114.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.886] lstrlenW (lpString=".doc") returned 4 [0114.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.887] lstrlenW (lpString=".docx") returned 5 [0114.887] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.887] lstrlenW (lpString=".pdf") returned 4 [0114.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".xls") returned 4 [0114.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".xlsx") returned 5 [0114.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.887] lstrlenW (lpString=".ppt") returned 4 [0114.887] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.887] lstrlenW (lpString=".zip") returned 4 [0114.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".rar") returned 4 [0114.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".bz2") returned 4 [0114.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.887] lstrlenW (lpString=".7z") returned 3 [0114.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.887] lstrlenW (lpString=".dbf") returned 4 [0114.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.887] lstrlenW (lpString=".1cd") returned 4 [0114.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.887] lstrlenW (lpString=".jpg") returned 4 [0114.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".pdf") returned 4 [0114.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".xls") returned 4 [0114.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.887] lstrlenW (lpString=".xlsx") returned 5 [0114.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.888] lstrlenW (lpString=".ppt") returned 4 [0114.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.888] lstrlenW (lpString=".zip") returned 4 [0114.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.888] lstrlenW (lpString=".rar") returned 4 [0114.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.888] lstrlenW (lpString=".bz2") returned 4 [0114.888] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.888] lstrlenW (lpString=".7z") returned 3 [0114.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.888] lstrlenW (lpString=".dbf") returned 4 [0114.888] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.888] lstrlenW (lpString=".1cd") returned 4 [0114.888] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 63 [0114.888] lstrlenW (lpString=".jpg") returned 4 [0114.888] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.888] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") [0114.889] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=799) returned 1 [0114.889] CloseHandle (hObject=0x22c) returned 1 [0114.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif")) returned 0x20 [0114.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.889] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.889] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.890] GetLastError () returned 0x0 [0114.890] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x31f, lpOverlapped=0x0) returned 1 [0114.892] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x320, lpOverlapped=0x0) returned 1 [0114.893] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.893] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.893] SetEndOfFile (hFile=0x1c0) returned 1 [0114.893] CloseHandle (hObject=0x1c0) returned 1 [0114.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.893] SetEndOfFile (hFile=0x22c) returned 1 [0114.894] CloseHandle (hObject=0x22c) returned 1 [0114.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif")) returned 1 [0114.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.894] lstrlenW (lpString=".doc") returned 4 [0114.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.895] lstrlenW (lpString=".docx") returned 5 [0114.895] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.895] lstrlenW (lpString=".pdf") returned 4 [0114.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".xls") returned 4 [0114.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".xlsx") returned 5 [0114.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.895] lstrlenW (lpString=".ppt") returned 4 [0114.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.895] lstrlenW (lpString=".zip") returned 4 [0114.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".rar") returned 4 [0114.895] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".bz2") returned 4 [0114.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.895] lstrlenW (lpString=".7z") returned 3 [0114.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.895] lstrlenW (lpString=".dbf") returned 4 [0114.895] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.895] lstrlenW (lpString=".1cd") returned 4 [0114.895] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.895] lstrlenW (lpString=".jpg") returned 4 [0114.895] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".pdf") returned 4 [0114.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".xls") returned 4 [0114.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.895] lstrlenW (lpString=".xlsx") returned 5 [0114.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.896] lstrlenW (lpString=".ppt") returned 4 [0114.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.896] lstrlenW (lpString=".zip") returned 4 [0114.896] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.896] lstrlenW (lpString=".rar") returned 4 [0114.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.896] lstrlenW (lpString=".bz2") returned 4 [0114.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.896] lstrlenW (lpString=".7z") returned 3 [0114.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.896] lstrlenW (lpString=".dbf") returned 4 [0114.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.896] lstrlenW (lpString=".1cd") returned 4 [0114.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 63 [0114.896] lstrlenW (lpString=".jpg") returned 4 [0114.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.896] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") [0114.897] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1452) returned 1 [0114.897] CloseHandle (hObject=0x22c) returned 1 [0114.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif")) returned 0x20 [0114.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0114.897] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.897] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.898] GetLastError () returned 0x0 [0114.898] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0114.899] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0114.900] ReadFile (in: hFile=0x22c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.900] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.900] SetEndOfFile (hFile=0x1c0) returned 1 [0114.900] CloseHandle (hObject=0x1c0) returned 1 [0114.901] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.901] SetEndOfFile (hFile=0x22c) returned 1 [0114.901] CloseHandle (hObject=0x22c) returned 1 [0114.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif")) returned 1 [0114.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.902] lstrlenW (lpString=".doc") returned 4 [0114.902] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.902] lstrlenW (lpString=".docx") returned 5 [0114.902] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.902] lstrlenW (lpString=".pdf") returned 4 [0114.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.902] lstrlenW (lpString=".xls") returned 4 [0114.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.902] lstrlenW (lpString=".xlsx") returned 5 [0114.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.902] lstrlenW (lpString=".ppt") returned 4 [0114.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.902] lstrlenW (lpString=".zip") returned 4 [0114.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.902] lstrlenW (lpString=".rar") returned 4 [0114.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.902] lstrlenW (lpString=".bz2") returned 4 [0114.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.902] lstrlenW (lpString=".7z") returned 3 [0114.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.902] lstrlenW (lpString=".dbf") returned 4 [0114.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".1cd") returned 4 [0114.903] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".jpg") returned 4 [0114.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString=".pdf") returned 4 [0114.903] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString=".xls") returned 4 [0114.903] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString=".xlsx") returned 5 [0114.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.903] lstrlenW (lpString=".ppt") returned 4 [0114.903] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".zip") returned 4 [0114.903] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString=".rar") returned 4 [0114.903] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.903] lstrlenW (lpString=".bz2") returned 4 [0114.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.903] lstrlenW (lpString=".7z") returned 3 [0114.903] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".dbf") returned 4 [0114.903] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".1cd") returned 4 [0114.903] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 63 [0114.903] lstrlenW (lpString=".jpg") returned 4 [0114.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.903] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") [0114.944] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=738) returned 1 [0114.944] CloseHandle (hObject=0x180) returned 1 [0114.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif")) returned 0x20 [0114.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.944] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.944] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.945] GetLastError () returned 0x0 [0114.945] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2e2, lpOverlapped=0x0) returned 1 [0114.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0114.948] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.948] SetEndOfFile (hFile=0x1a0) returned 1 [0114.948] CloseHandle (hObject=0x1a0) returned 1 [0114.948] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.948] SetEndOfFile (hFile=0x180) returned 1 [0114.949] CloseHandle (hObject=0x180) returned 1 [0114.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif")) returned 1 [0114.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.949] lstrlenW (lpString=".doc") returned 4 [0114.949] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.949] lstrlenW (lpString=".docx") returned 5 [0114.949] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.949] lstrlenW (lpString=".pdf") returned 4 [0114.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".xls") returned 4 [0114.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".xlsx") returned 5 [0114.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.950] lstrlenW (lpString=".ppt") returned 4 [0114.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.950] lstrlenW (lpString=".zip") returned 4 [0114.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".rar") returned 4 [0114.950] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".bz2") returned 4 [0114.950] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.950] lstrlenW (lpString=".7z") returned 3 [0114.950] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.950] lstrlenW (lpString=".dbf") returned 4 [0114.950] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.950] lstrlenW (lpString=".1cd") returned 4 [0114.950] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.950] lstrlenW (lpString=".jpg") returned 4 [0114.950] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".pdf") returned 4 [0114.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".xls") returned 4 [0114.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.950] lstrlenW (lpString=".xlsx") returned 5 [0114.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.950] lstrlenW (lpString=".ppt") returned 4 [0114.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.951] lstrlenW (lpString=".zip") returned 4 [0114.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.951] lstrlenW (lpString=".rar") returned 4 [0114.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.951] lstrlenW (lpString=".bz2") returned 4 [0114.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.951] lstrlenW (lpString=".7z") returned 3 [0114.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.951] lstrlenW (lpString=".dbf") returned 4 [0114.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.951] lstrlenW (lpString=".1cd") returned 4 [0114.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 63 [0114.951] lstrlenW (lpString=".jpg") returned 4 [0114.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.951] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") [0114.952] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=727) returned 1 [0114.952] CloseHandle (hObject=0x180) returned 1 [0114.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif")) returned 0x20 [0114.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.953] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.953] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.953] GetLastError () returned 0x0 [0114.953] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2d7, lpOverlapped=0x0) returned 1 [0114.955] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0114.956] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.956] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.956] SetEndOfFile (hFile=0x1a0) returned 1 [0114.956] CloseHandle (hObject=0x1a0) returned 1 [0114.956] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.956] SetEndOfFile (hFile=0x180) returned 1 [0114.957] CloseHandle (hObject=0x180) returned 1 [0114.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif")) returned 1 [0114.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.957] lstrlenW (lpString=".doc") returned 4 [0114.957] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.957] lstrlenW (lpString=".docx") returned 5 [0114.957] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.957] lstrlenW (lpString=".pdf") returned 4 [0114.957] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.957] lstrlenW (lpString=".xls") returned 4 [0114.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".xlsx") returned 5 [0114.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.958] lstrlenW (lpString=".ppt") returned 4 [0114.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.958] lstrlenW (lpString=".zip") returned 4 [0114.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".rar") returned 4 [0114.958] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".bz2") returned 4 [0114.958] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.958] lstrlenW (lpString=".7z") returned 3 [0114.958] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.958] lstrlenW (lpString=".dbf") returned 4 [0114.958] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.958] lstrlenW (lpString=".1cd") returned 4 [0114.958] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.958] lstrlenW (lpString=".jpg") returned 4 [0114.958] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".pdf") returned 4 [0114.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".xls") returned 4 [0114.958] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString=".xlsx") returned 5 [0114.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.958] lstrlenW (lpString=".ppt") returned 4 [0114.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.958] lstrlenW (lpString=".zip") returned 4 [0114.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.959] lstrlenW (lpString=".rar") returned 4 [0114.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.959] lstrlenW (lpString=".bz2") returned 4 [0114.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.959] lstrlenW (lpString=".7z") returned 3 [0114.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.959] lstrlenW (lpString=".dbf") returned 4 [0114.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.959] lstrlenW (lpString=".1cd") returned 4 [0114.959] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 63 [0114.959] lstrlenW (lpString=".jpg") returned 4 [0114.959] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.959] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") [0114.960] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=948) returned 1 [0114.960] CloseHandle (hObject=0x180) returned 1 [0114.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif")) returned 0x20 [0114.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.960] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.960] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.961] GetLastError () returned 0x0 [0114.961] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3b4, lpOverlapped=0x0) returned 1 [0114.962] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0114.963] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.963] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.963] SetEndOfFile (hFile=0x1a0) returned 1 [0114.963] CloseHandle (hObject=0x1a0) returned 1 [0114.963] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.963] SetEndOfFile (hFile=0x180) returned 1 [0114.964] CloseHandle (hObject=0x180) returned 1 [0114.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif")) returned 1 [0114.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.964] lstrlenW (lpString=".doc") returned 4 [0114.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.964] lstrlenW (lpString=".docx") returned 5 [0114.964] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.965] lstrlenW (lpString=".pdf") returned 4 [0114.965] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".xls") returned 4 [0114.965] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".xlsx") returned 5 [0114.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.965] lstrlenW (lpString=".ppt") returned 4 [0114.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.965] lstrlenW (lpString=".zip") returned 4 [0114.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".rar") returned 4 [0114.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".bz2") returned 4 [0114.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.965] lstrlenW (lpString=".7z") returned 3 [0114.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.965] lstrlenW (lpString=".dbf") returned 4 [0114.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.965] lstrlenW (lpString=".1cd") returned 4 [0114.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.965] lstrlenW (lpString=".jpg") returned 4 [0114.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".pdf") returned 4 [0114.965] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".xls") returned 4 [0114.965] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.965] lstrlenW (lpString=".xlsx") returned 5 [0114.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.966] lstrlenW (lpString=".ppt") returned 4 [0114.966] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.966] lstrlenW (lpString=".zip") returned 4 [0114.966] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.966] lstrlenW (lpString=".rar") returned 4 [0114.966] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.966] lstrlenW (lpString=".bz2") returned 4 [0114.966] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.966] lstrlenW (lpString=".7z") returned 3 [0114.966] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.966] lstrlenW (lpString=".dbf") returned 4 [0114.966] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.966] lstrlenW (lpString=".1cd") returned 4 [0114.966] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 63 [0114.966] lstrlenW (lpString=".jpg") returned 4 [0114.966] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.966] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") [0114.967] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1172) returned 1 [0114.967] CloseHandle (hObject=0x180) returned 1 [0114.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif")) returned 0x20 [0114.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.968] GetLastError () returned 0x0 [0114.968] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x494, lpOverlapped=0x0) returned 1 [0114.969] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x4a0, lpOverlapped=0x0) returned 1 [0114.970] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.970] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.970] SetEndOfFile (hFile=0x1a0) returned 1 [0114.971] CloseHandle (hObject=0x1a0) returned 1 [0114.971] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.971] SetEndOfFile (hFile=0x180) returned 1 [0114.971] CloseHandle (hObject=0x180) returned 1 [0114.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif")) returned 1 [0114.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.972] lstrlenW (lpString=".doc") returned 4 [0114.972] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.972] lstrlenW (lpString=".docx") returned 5 [0114.972] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0114.972] lstrlenW (lpString=".pdf") returned 4 [0114.972] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.972] lstrlenW (lpString=".xls") returned 4 [0114.972] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.972] lstrlenW (lpString=".xlsx") returned 5 [0114.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.972] lstrlenW (lpString=".ppt") returned 4 [0114.972] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.972] lstrlenW (lpString=".zip") returned 4 [0114.972] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.972] lstrlenW (lpString=".rar") returned 4 [0114.972] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.972] lstrlenW (lpString=".bz2") returned 4 [0114.972] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.972] lstrlenW (lpString=".7z") returned 3 [0114.972] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.972] lstrlenW (lpString=".dbf") returned 4 [0114.972] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".1cd") returned 4 [0114.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".jpg") returned 4 [0114.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString=".pdf") returned 4 [0114.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString=".xls") returned 4 [0114.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString=".xlsx") returned 5 [0114.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0114.973] lstrlenW (lpString=".ppt") returned 4 [0114.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".zip") returned 4 [0114.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString=".rar") returned 4 [0114.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.973] lstrlenW (lpString=".bz2") returned 4 [0114.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.973] lstrlenW (lpString=".7z") returned 3 [0114.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".dbf") returned 4 [0114.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".1cd") returned 4 [0114.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 63 [0114.973] lstrlenW (lpString=".jpg") returned 4 [0114.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.974] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") [0114.974] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=953) returned 1 [0114.974] CloseHandle (hObject=0x180) returned 1 [0114.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif")) returned 0x20 [0114.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.975] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.975] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.976] GetLastError () returned 0x0 [0114.976] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3b9, lpOverlapped=0x0) returned 1 [0115.116] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0115.152] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.152] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.160] SetEndOfFile (hFile=0x1a0) returned 1 [0115.160] CloseHandle (hObject=0x1a0) returned 1 [0115.160] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.160] SetEndOfFile (hFile=0x180) returned 1 [0115.167] CloseHandle (hObject=0x180) returned 1 [0115.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif")) returned 1 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString=".doc") returned 4 [0115.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.181] lstrlenW (lpString=".docx") returned 5 [0115.181] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.181] lstrlenW (lpString=".pdf") returned 4 [0115.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.181] lstrlenW (lpString=".xls") returned 4 [0115.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.181] lstrlenW (lpString=".xlsx") returned 5 [0115.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.181] lstrlenW (lpString=".ppt") returned 4 [0115.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString=".zip") returned 4 [0115.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.181] lstrlenW (lpString=".rar") returned 4 [0115.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.181] lstrlenW (lpString=".bz2") returned 4 [0115.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.181] lstrlenW (lpString=".7z") returned 3 [0115.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString=".dbf") returned 4 [0115.181] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString=".1cd") returned 4 [0115.181] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.181] lstrlenW (lpString=".jpg") returned 4 [0115.181] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString=".pdf") returned 4 [0115.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString=".xls") returned 4 [0115.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString=".xlsx") returned 5 [0115.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.182] lstrlenW (lpString=".ppt") returned 4 [0115.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.182] lstrlenW (lpString=".zip") returned 4 [0115.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString=".rar") returned 4 [0115.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.182] lstrlenW (lpString=".bz2") returned 4 [0115.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.182] lstrlenW (lpString=".7z") returned 3 [0115.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.182] lstrlenW (lpString=".dbf") returned 4 [0115.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.182] lstrlenW (lpString=".1cd") returned 4 [0115.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 63 [0115.182] lstrlenW (lpString=".jpg") returned 4 [0115.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.182] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") [0115.183] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=7039) returned 1 [0115.183] CloseHandle (hObject=0x180) returned 1 [0115.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 0x20 [0115.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.183] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.183] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.184] GetLastError () returned 0x0 [0115.184] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1b7f, lpOverlapped=0x0) returned 1 [0115.186] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0115.187] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.187] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.187] SetEndOfFile (hFile=0x1a0) returned 1 [0115.187] CloseHandle (hObject=0x1a0) returned 1 [0115.187] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.187] SetEndOfFile (hFile=0x180) returned 1 [0115.188] CloseHandle (hObject=0x180) returned 1 [0115.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 1 [0115.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.188] lstrlenW (lpString=".doc") returned 4 [0115.188] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.188] lstrlenW (lpString=".docx") returned 5 [0115.188] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0115.188] lstrlenW (lpString=".pdf") returned 4 [0115.188] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.188] lstrlenW (lpString=".xls") returned 4 [0115.188] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.188] lstrlenW (lpString=".xlsx") returned 5 [0115.189] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0115.189] lstrlenW (lpString=".ppt") returned 4 [0115.189] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.189] lstrlenW (lpString=".zip") returned 4 [0115.189] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".rar") returned 4 [0115.189] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".bz2") returned 4 [0115.189] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString=".7z") returned 3 [0115.189] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.189] lstrlenW (lpString=".dbf") returned 4 [0115.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.189] lstrlenW (lpString=".1cd") returned 4 [0115.189] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 76 [0115.189] lstrlenW (lpString=".jpg") returned 4 [0115.189] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.189] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") [0115.190] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1709) returned 1 [0115.190] CloseHandle (hObject=0x180) returned 1 [0115.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 0x20 [0115.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.190] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.190] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.191] GetLastError () returned 0x0 [0115.191] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x6ad, lpOverlapped=0x0) returned 1 [0115.192] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0115.193] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.193] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.194] SetEndOfFile (hFile=0x1a0) returned 1 [0115.194] CloseHandle (hObject=0x1a0) returned 1 [0115.194] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.194] SetEndOfFile (hFile=0x180) returned 1 [0115.194] CloseHandle (hObject=0x180) returned 1 [0115.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 1 [0115.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.195] lstrlenW (lpString=".doc") returned 4 [0115.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.195] lstrlenW (lpString=".docx") returned 5 [0115.195] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0115.195] lstrlenW (lpString=".pdf") returned 4 [0115.195] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.195] lstrlenW (lpString=".xls") returned 4 [0115.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.195] lstrlenW (lpString=".xlsx") returned 5 [0115.195] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0115.195] lstrlenW (lpString=".ppt") returned 4 [0115.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.195] lstrlenW (lpString=".zip") returned 4 [0115.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.195] lstrlenW (lpString=".rar") returned 4 [0115.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.195] lstrlenW (lpString=".bz2") returned 4 [0115.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.195] lstrlenW (lpString=".7z") returned 3 [0115.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.196] lstrlenW (lpString=".dbf") returned 4 [0115.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.196] lstrlenW (lpString=".1cd") returned 4 [0115.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 76 [0115.196] lstrlenW (lpString=".jpg") returned 4 [0115.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.196] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") [0115.196] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1695) returned 1 [0115.196] CloseHandle (hObject=0x180) returned 1 [0115.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 0x20 [0115.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.197] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.197] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.198] GetLastError () returned 0x0 [0115.198] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x69f, lpOverlapped=0x0) returned 1 [0115.200] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0115.201] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.201] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.201] SetEndOfFile (hFile=0x1a0) returned 1 [0115.201] CloseHandle (hObject=0x1a0) returned 1 [0115.201] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.201] SetEndOfFile (hFile=0x180) returned 1 [0115.202] CloseHandle (hObject=0x180) returned 1 [0115.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 1 [0115.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.203] lstrlenW (lpString=".doc") returned 4 [0115.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.203] lstrlenW (lpString=".docx") returned 5 [0115.203] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0115.203] lstrlenW (lpString=".pdf") returned 4 [0115.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.203] lstrlenW (lpString=".xls") returned 4 [0115.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.203] lstrlenW (lpString=".xlsx") returned 5 [0115.203] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0115.203] lstrlenW (lpString=".ppt") returned 4 [0115.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.203] lstrlenW (lpString=".zip") returned 4 [0115.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.203] lstrlenW (lpString=".rar") returned 4 [0115.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.203] lstrlenW (lpString=".bz2") returned 4 [0115.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.203] lstrlenW (lpString=".7z") returned 3 [0115.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.203] lstrlenW (lpString=".dbf") returned 4 [0115.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.203] lstrlenW (lpString=".1cd") returned 4 [0115.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 76 [0115.203] lstrlenW (lpString=".jpg") returned 4 [0115.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.203] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") [0115.204] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=4682) returned 1 [0115.204] CloseHandle (hObject=0x180) returned 1 [0115.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 0x20 [0115.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.204] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.204] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.205] GetLastError () returned 0x0 [0115.205] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x124a, lpOverlapped=0x0) returned 1 [0115.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1250, lpOverlapped=0x0) returned 1 [0115.208] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.208] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.208] SetEndOfFile (hFile=0x1a0) returned 1 [0115.208] CloseHandle (hObject=0x1a0) returned 1 [0115.208] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.208] SetEndOfFile (hFile=0x180) returned 1 [0115.209] CloseHandle (hObject=0x180) returned 1 [0115.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 1 [0115.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.209] lstrlenW (lpString=".doc") returned 4 [0115.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.209] lstrlenW (lpString=".docx") returned 5 [0115.209] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.209] lstrlenW (lpString=".pdf") returned 4 [0115.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.209] lstrlenW (lpString=".xls") returned 4 [0115.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.209] lstrlenW (lpString=".xlsx") returned 5 [0115.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.209] lstrlenW (lpString=".ppt") returned 4 [0115.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.210] lstrlenW (lpString=".zip") returned 4 [0115.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.210] lstrlenW (lpString=".rar") returned 4 [0115.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.210] lstrlenW (lpString=".bz2") returned 4 [0115.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.210] lstrlenW (lpString=".7z") returned 3 [0115.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.210] lstrlenW (lpString=".dbf") returned 4 [0115.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.210] lstrlenW (lpString=".1cd") returned 4 [0115.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 76 [0115.210] lstrlenW (lpString=".jpg") returned 4 [0115.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.210] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") [0115.211] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=8215) returned 1 [0115.211] CloseHandle (hObject=0x180) returned 1 [0115.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 0x20 [0115.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.211] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.211] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.212] GetLastError () returned 0x0 [0115.212] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x2017, lpOverlapped=0x0) returned 1 [0115.360] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x2020, lpOverlapped=0x0) returned 1 [0115.361] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.361] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.361] SetEndOfFile (hFile=0x1a0) returned 1 [0115.381] CloseHandle (hObject=0x1a0) returned 1 [0115.396] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.404] SetEndOfFile (hFile=0x180) returned 1 [0115.405] CloseHandle (hObject=0x180) returned 1 [0115.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 1 [0115.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.405] lstrlenW (lpString=".doc") returned 4 [0115.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.405] lstrlenW (lpString=".docx") returned 5 [0115.406] lstrcmpiW (lpString1=".docx", lpString2="L.GIF") returned -1 [0115.406] lstrlenW (lpString=".pdf") returned 4 [0115.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.406] lstrlenW (lpString=".xls") returned 4 [0115.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.406] lstrlenW (lpString=".xlsx") returned 5 [0115.406] lstrcmpiW (lpString1=".xlsx", lpString2="L.GIF") returned -1 [0115.406] lstrlenW (lpString=".ppt") returned 4 [0115.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.406] lstrlenW (lpString=".zip") returned 4 [0115.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.406] lstrlenW (lpString=".rar") returned 4 [0115.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.406] lstrlenW (lpString=".bz2") returned 4 [0115.406] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.406] lstrlenW (lpString=".7z") returned 3 [0115.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.406] lstrlenW (lpString=".dbf") returned 4 [0115.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.406] lstrlenW (lpString=".1cd") returned 4 [0115.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 76 [0115.406] lstrlenW (lpString=".jpg") returned 4 [0115.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.406] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") [0115.407] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2454) returned 1 [0115.407] CloseHandle (hObject=0x180) returned 1 [0115.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 0x20 [0115.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.408] GetLastError () returned 0x0 [0115.408] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x996, lpOverlapped=0x0) returned 1 [0115.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0115.411] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.411] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.411] SetEndOfFile (hFile=0x1a0) returned 1 [0115.411] CloseHandle (hObject=0x1a0) returned 1 [0115.411] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.411] SetEndOfFile (hFile=0x180) returned 1 [0115.412] CloseHandle (hObject=0x180) returned 1 [0115.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.412] lstrlenW (lpString=".doc") returned 4 [0115.412] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.412] lstrlenW (lpString=".docx") returned 5 [0115.412] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.412] lstrlenW (lpString=".pdf") returned 4 [0115.413] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".xls") returned 4 [0115.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".xlsx") returned 5 [0115.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.413] lstrlenW (lpString=".ppt") returned 4 [0115.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.413] lstrlenW (lpString=".zip") returned 4 [0115.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".rar") returned 4 [0115.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".bz2") returned 4 [0115.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.413] lstrlenW (lpString=".7z") returned 3 [0115.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.413] lstrlenW (lpString=".dbf") returned 4 [0115.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.413] lstrlenW (lpString=".1cd") returned 4 [0115.413] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.413] lstrlenW (lpString=".jpg") returned 4 [0115.413] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".pdf") returned 4 [0115.413] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.413] lstrlenW (lpString=".xls") returned 4 [0115.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.414] lstrlenW (lpString=".xlsx") returned 5 [0115.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.414] lstrlenW (lpString=".ppt") returned 4 [0115.414] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.414] lstrlenW (lpString=".zip") returned 4 [0115.414] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.414] lstrlenW (lpString=".rar") returned 4 [0115.414] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.414] lstrlenW (lpString=".bz2") returned 4 [0115.414] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.414] lstrlenW (lpString=".7z") returned 3 [0115.414] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.414] lstrlenW (lpString=".dbf") returned 4 [0115.414] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.414] lstrlenW (lpString=".1cd") returned 4 [0115.414] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 76 [0115.414] lstrlenW (lpString=".jpg") returned 4 [0115.414] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.414] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") [0115.415] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2316) returned 1 [0115.415] CloseHandle (hObject=0x180) returned 1 [0115.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 0x20 [0115.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.415] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.415] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.417] GetLastError () returned 0x0 [0115.417] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x90c, lpOverlapped=0x0) returned 1 [0115.419] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x910, lpOverlapped=0x0) returned 1 [0115.420] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.420] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.420] SetEndOfFile (hFile=0x1a0) returned 1 [0115.420] CloseHandle (hObject=0x1a0) returned 1 [0115.420] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.420] SetEndOfFile (hFile=0x180) returned 1 [0115.421] CloseHandle (hObject=0x180) returned 1 [0115.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.422] lstrlenW (lpString=".doc") returned 4 [0115.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.422] lstrlenW (lpString=".docx") returned 5 [0115.422] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.422] lstrlenW (lpString=".pdf") returned 4 [0115.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.422] lstrlenW (lpString=".xls") returned 4 [0115.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.422] lstrlenW (lpString=".xlsx") returned 5 [0115.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.422] lstrlenW (lpString=".ppt") returned 4 [0115.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.422] lstrlenW (lpString=".zip") returned 4 [0115.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.422] lstrlenW (lpString=".rar") returned 4 [0115.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.422] lstrlenW (lpString=".bz2") returned 4 [0115.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.422] lstrlenW (lpString=".7z") returned 3 [0115.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.422] lstrlenW (lpString=".dbf") returned 4 [0115.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".1cd") returned 4 [0115.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".jpg") returned 4 [0115.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString=".pdf") returned 4 [0115.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString=".xls") returned 4 [0115.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString=".xlsx") returned 5 [0115.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.423] lstrlenW (lpString=".ppt") returned 4 [0115.423] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".zip") returned 4 [0115.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString=".rar") returned 4 [0115.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.423] lstrlenW (lpString=".bz2") returned 4 [0115.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.423] lstrlenW (lpString=".7z") returned 3 [0115.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".dbf") returned 4 [0115.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".1cd") returned 4 [0115.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 76 [0115.423] lstrlenW (lpString=".jpg") returned 4 [0115.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.424] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") [0115.424] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1409) returned 1 [0115.424] CloseHandle (hObject=0x180) returned 1 [0115.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 0x20 [0115.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.425] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.425] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.426] GetLastError () returned 0x0 [0115.426] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x581, lpOverlapped=0x0) returned 1 [0115.427] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x590, lpOverlapped=0x0) returned 1 [0115.428] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.428] SetEndOfFile (hFile=0x1a0) returned 1 [0115.429] CloseHandle (hObject=0x1a0) returned 1 [0115.429] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.429] SetEndOfFile (hFile=0x180) returned 1 [0115.429] CloseHandle (hObject=0x180) returned 1 [0115.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 1 [0115.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.430] lstrlenW (lpString=".doc") returned 4 [0115.430] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.430] lstrlenW (lpString=".docx") returned 5 [0115.430] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.430] lstrlenW (lpString=".pdf") returned 4 [0115.430] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.430] lstrlenW (lpString=".xls") returned 4 [0115.430] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.430] lstrlenW (lpString=".xlsx") returned 5 [0115.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.430] lstrlenW (lpString=".ppt") returned 4 [0115.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.430] lstrlenW (lpString=".zip") returned 4 [0115.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.430] lstrlenW (lpString=".rar") returned 4 [0115.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.430] lstrlenW (lpString=".bz2") returned 4 [0115.430] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.430] lstrlenW (lpString=".7z") returned 3 [0115.430] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.430] lstrlenW (lpString=".dbf") returned 4 [0115.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.431] lstrlenW (lpString=".1cd") returned 4 [0115.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.431] lstrlenW (lpString=".jpg") returned 4 [0115.431] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString=".pdf") returned 4 [0115.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString=".xls") returned 4 [0115.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString=".xlsx") returned 5 [0115.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.431] lstrlenW (lpString=".ppt") returned 4 [0115.431] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.431] lstrlenW (lpString=".zip") returned 4 [0115.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString=".rar") returned 4 [0115.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.431] lstrlenW (lpString=".bz2") returned 4 [0115.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.431] lstrlenW (lpString=".7z") returned 3 [0115.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.431] lstrlenW (lpString=".dbf") returned 4 [0115.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.431] lstrlenW (lpString=".1cd") returned 4 [0115.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 76 [0115.432] lstrlenW (lpString=".jpg") returned 4 [0115.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.432] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") [0115.432] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=5626) returned 1 [0115.432] CloseHandle (hObject=0x180) returned 1 [0115.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 0x20 [0115.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.433] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.433] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0115.433] GetLastError () returned 0x0 [0115.433] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x15fa, lpOverlapped=0x0) returned 1 [0115.435] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x1600, lpOverlapped=0x0) returned 1 [0115.436] ReadFile (in: hFile=0x180, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.436] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.436] SetEndOfFile (hFile=0x1a0) returned 1 [0115.436] CloseHandle (hObject=0x1a0) returned 1 [0115.436] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.436] SetEndOfFile (hFile=0x180) returned 1 [0115.437] CloseHandle (hObject=0x180) returned 1 [0115.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 1 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString=".doc") returned 4 [0115.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.438] lstrlenW (lpString=".docx") returned 5 [0115.438] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0115.438] lstrlenW (lpString=".pdf") returned 4 [0115.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.438] lstrlenW (lpString=".xls") returned 4 [0115.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.438] lstrlenW (lpString=".xlsx") returned 5 [0115.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.438] lstrlenW (lpString=".ppt") returned 4 [0115.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString=".zip") returned 4 [0115.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.438] lstrlenW (lpString=".rar") returned 4 [0115.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.438] lstrlenW (lpString=".bz2") returned 4 [0115.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.438] lstrlenW (lpString=".7z") returned 3 [0115.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString=".dbf") returned 4 [0115.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString=".1cd") returned 4 [0115.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.438] lstrlenW (lpString=".jpg") returned 4 [0115.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString=".pdf") returned 4 [0115.439] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString=".xls") returned 4 [0115.439] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString=".xlsx") returned 5 [0115.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0115.439] lstrlenW (lpString=".ppt") returned 4 [0115.439] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.439] lstrlenW (lpString=".zip") returned 4 [0115.439] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString=".rar") returned 4 [0115.439] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.439] lstrlenW (lpString=".bz2") returned 4 [0115.439] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.439] lstrlenW (lpString=".7z") returned 3 [0115.439] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.439] lstrlenW (lpString=".dbf") returned 4 [0115.439] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.439] lstrlenW (lpString=".1cd") returned 4 [0115.439] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 76 [0115.439] lstrlenW (lpString=".jpg") returned 4 [0115.439] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.439] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") [0116.266] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=1007) returned 1 [0116.266] CloseHandle (hObject=0x168) returned 1 [0116.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 0x20 [0116.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0116.266] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.266] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0116.267] GetLastError () returned 0x0 [0116.267] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3ef, lpOverlapped=0x0) returned 1 [0116.408] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3f0, lpOverlapped=0x0) returned 1 [0116.409] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.409] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.409] SetEndOfFile (hFile=0x1ec) returned 1 [0116.409] CloseHandle (hObject=0x1ec) returned 1 [0116.409] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.409] SetEndOfFile (hFile=0x168) returned 1 [0116.410] CloseHandle (hObject=0x168) returned 1 [0116.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 1 [0116.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.410] lstrlenW (lpString=".doc") returned 4 [0116.410] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0116.410] lstrlenW (lpString=".docx") returned 5 [0116.410] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0116.411] lstrlenW (lpString=".pdf") returned 4 [0116.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".xls") returned 4 [0116.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".xlsx") returned 5 [0116.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.411] lstrlenW (lpString=".ppt") returned 4 [0116.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.411] lstrlenW (lpString=".zip") returned 4 [0116.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".rar") returned 4 [0116.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".bz2") returned 4 [0116.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.411] lstrlenW (lpString=".7z") returned 3 [0116.411] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.411] lstrlenW (lpString=".dbf") returned 4 [0116.411] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.411] lstrlenW (lpString=".1cd") returned 4 [0116.411] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.411] lstrlenW (lpString=".jpg") returned 4 [0116.411] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".pdf") returned 4 [0116.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".xls") returned 4 [0116.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString=".xlsx") returned 5 [0116.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0116.411] lstrlenW (lpString=".ppt") returned 4 [0116.411] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.412] lstrlenW (lpString=".zip") returned 4 [0116.412] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0116.412] lstrlenW (lpString=".rar") returned 4 [0116.412] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0116.412] lstrlenW (lpString=".bz2") returned 4 [0116.412] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0116.412] lstrlenW (lpString=".7z") returned 3 [0116.412] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0116.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.412] lstrlenW (lpString=".dbf") returned 4 [0116.412] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0116.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.412] lstrlenW (lpString=".1cd") returned 4 [0116.412] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0116.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 76 [0116.412] lstrlenW (lpString=".jpg") returned 4 [0116.412] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.412] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") [0116.731] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=74765) returned 1 [0116.731] CloseHandle (hObject=0x15c) returned 1 [0116.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) returned 0x20 [0116.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0116.731] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.731] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.732] GetLastError () returned 0x0 [0116.732] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1240d, lpOverlapped=0x0) returned 1 [0117.180] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x12410, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x12410, lpOverlapped=0x0) returned 1 [0117.181] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.181] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.182] SetEndOfFile (hFile=0x1f4) returned 1 [0117.182] CloseHandle (hObject=0x1f4) returned 1 [0117.182] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.182] SetEndOfFile (hFile=0x15c) returned 1 [0117.183] CloseHandle (hObject=0x15c) returned 1 [0117.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) returned 1 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString=".doc") returned 4 [0117.184] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".docx") returned 5 [0117.184] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.184] lstrlenW (lpString=".pdf") returned 4 [0117.184] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".xls") returned 4 [0117.184] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".xlsx") returned 5 [0117.184] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.184] lstrlenW (lpString=".ppt") returned 4 [0117.184] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString=".zip") returned 4 [0117.184] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".rar") returned 4 [0117.184] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".bz2") returned 4 [0117.184] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString=".7z") returned 3 [0117.184] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString=".dbf") returned 4 [0117.184] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString=".1cd") returned 4 [0117.184] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 67 [0117.184] lstrlenW (lpString=".jpg") returned 4 [0117.184] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.185] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") [0117.185] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=49784) returned 1 [0117.185] CloseHandle (hObject=0x15c) returned 1 [0117.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx")) returned 0x20 [0117.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0117.186] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.186] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.187] GetLastError () returned 0x0 [0117.187] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0xc278, lpOverlapped=0x0) returned 1 [0117.221] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xc280, lpOverlapped=0x0) returned 1 [0117.223] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.223] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0117.223] SetEndOfFile (hFile=0x1f4) returned 1 [0117.223] CloseHandle (hObject=0x1f4) returned 1 [0117.223] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.223] SetEndOfFile (hFile=0x15c) returned 1 [0117.224] CloseHandle (hObject=0x15c) returned 1 [0117.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx")) returned 1 [0117.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.227] lstrlenW (lpString=".doc") returned 4 [0117.227] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.227] lstrlenW (lpString=".docx") returned 5 [0117.227] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.227] lstrlenW (lpString=".pdf") returned 4 [0117.227] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.227] lstrlenW (lpString=".xls") returned 4 [0117.227] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.227] lstrlenW (lpString=".xlsx") returned 5 [0117.227] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.227] lstrlenW (lpString=".ppt") returned 4 [0117.227] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.228] lstrlenW (lpString=".zip") returned 4 [0117.228] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString=".rar") returned 4 [0117.228] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString=".bz2") returned 4 [0117.228] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString=".7z") returned 3 [0117.228] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.228] lstrlenW (lpString=".dbf") returned 4 [0117.228] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.228] lstrlenW (lpString=".1cd") returned 4 [0117.228] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 67 [0117.228] lstrlenW (lpString=".jpg") returned 4 [0117.228] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.228] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") [0117.229] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=65704) returned 1 [0117.229] CloseHandle (hObject=0x15c) returned 1 [0117.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx")) returned 0x20 [0117.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0117.229] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.229] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.230] GetLastError () returned 0x0 [0117.230] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x100a8, lpOverlapped=0x0) returned 1 [0117.254] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x100b0, lpOverlapped=0x0) returned 1 [0117.256] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.256] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0117.256] SetEndOfFile (hFile=0x1f4) returned 1 [0117.290] CloseHandle (hObject=0x1f4) returned 1 [0117.290] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.291] SetEndOfFile (hFile=0x15c) returned 1 [0117.307] CloseHandle (hObject=0x15c) returned 1 [0117.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx")) returned 1 [0117.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.308] lstrlenW (lpString=".doc") returned 4 [0117.308] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".docx") returned 5 [0117.308] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.308] lstrlenW (lpString=".pdf") returned 4 [0117.308] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".xls") returned 4 [0117.308] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".xlsx") returned 5 [0117.308] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.308] lstrlenW (lpString=".ppt") returned 4 [0117.308] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.308] lstrlenW (lpString=".zip") returned 4 [0117.308] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".rar") returned 4 [0117.308] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".bz2") returned 4 [0117.308] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString=".7z") returned 3 [0117.308] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.308] lstrlenW (lpString=".dbf") returned 4 [0117.308] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.308] lstrlenW (lpString=".1cd") returned 4 [0117.309] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 62 [0117.309] lstrlenW (lpString=".jpg") returned 4 [0117.309] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.309] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") [0117.309] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=245451) returned 1 [0117.309] CloseHandle (hObject=0x15c) returned 1 [0117.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx")) returned 0x20 [0117.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0117.310] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.310] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.310] GetLastError () returned 0x0 [0117.310] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3becb, lpOverlapped=0x0) returned 1 [0117.488] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3bed0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3bed0, lpOverlapped=0x0) returned 1 [0117.493] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.493] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.493] SetEndOfFile (hFile=0x1f4) returned 1 [0117.493] CloseHandle (hObject=0x1f4) returned 1 [0117.494] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.494] SetEndOfFile (hFile=0x15c) returned 1 [0117.496] CloseHandle (hObject=0x15c) returned 1 [0117.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx")) returned 1 [0117.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.496] lstrlenW (lpString=".doc") returned 4 [0117.496] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.496] lstrlenW (lpString=".docx") returned 5 [0117.497] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.497] lstrlenW (lpString=".pdf") returned 4 [0117.497] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString=".xls") returned 4 [0117.497] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString=".xlsx") returned 5 [0117.497] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.497] lstrlenW (lpString=".ppt") returned 4 [0117.497] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.497] lstrlenW (lpString=".zip") returned 4 [0117.497] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString=".rar") returned 4 [0117.497] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString=".bz2") returned 4 [0117.497] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString=".7z") returned 3 [0117.497] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.497] lstrlenW (lpString=".dbf") returned 4 [0117.497] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.497] lstrlenW (lpString=".1cd") returned 4 [0117.497] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 65 [0117.497] lstrlenW (lpString=".jpg") returned 4 [0117.497] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.497] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") [0117.498] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=87051) returned 1 [0117.498] CloseHandle (hObject=0x15c) returned 1 [0117.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx")) returned 0x20 [0117.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0117.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.499] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.499] GetLastError () returned 0x0 [0117.500] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x1540b, lpOverlapped=0x0) returned 1 [0117.502] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x15410, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x15410, lpOverlapped=0x0) returned 1 [0117.504] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.504] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.504] SetEndOfFile (hFile=0x1f4) returned 1 [0117.505] CloseHandle (hObject=0x1f4) returned 1 [0117.505] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.505] SetEndOfFile (hFile=0x15c) returned 1 [0117.506] CloseHandle (hObject=0x15c) returned 1 [0117.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx")) returned 1 [0117.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.513] lstrlenW (lpString=".doc") returned 4 [0117.513] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".docx") returned 5 [0117.513] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.513] lstrlenW (lpString=".pdf") returned 4 [0117.513] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".xls") returned 4 [0117.513] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".xlsx") returned 5 [0117.513] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.513] lstrlenW (lpString=".ppt") returned 4 [0117.513] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.513] lstrlenW (lpString=".zip") returned 4 [0117.513] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".rar") returned 4 [0117.513] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".bz2") returned 4 [0117.513] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.513] lstrlenW (lpString=".7z") returned 3 [0117.513] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.513] lstrlenW (lpString=".dbf") returned 4 [0117.513] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.514] lstrlenW (lpString=".1cd") returned 4 [0117.514] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 64 [0117.514] lstrlenW (lpString=".jpg") returned 4 [0117.514] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.514] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") [0117.515] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=270822) returned 1 [0117.515] CloseHandle (hObject=0x15c) returned 1 [0117.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx")) returned 0x20 [0117.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0117.515] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.515] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.516] GetLastError () returned 0x0 [0117.516] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x421e6, lpOverlapped=0x0) returned 1 [0117.669] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x421f0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x421f0, lpOverlapped=0x0) returned 1 [0117.673] ReadFile (in: hFile=0x15c, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.673] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0117.674] SetEndOfFile (hFile=0x1f4) returned 1 [0117.674] CloseHandle (hObject=0x1f4) returned 1 [0117.674] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.674] SetEndOfFile (hFile=0x15c) returned 1 [0117.677] CloseHandle (hObject=0x15c) returned 1 [0117.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx")) returned 1 [0117.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.677] lstrlenW (lpString=".doc") returned 4 [0117.677] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0117.677] lstrlenW (lpString=".docx") returned 5 [0117.677] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0117.677] lstrlenW (lpString=".pdf") returned 4 [0117.677] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0117.677] lstrlenW (lpString=".xls") returned 4 [0117.677] lstrcmpiW (lpString1=".xls", lpString2="thmx") returned -1 [0117.677] lstrlenW (lpString=".xlsx") returned 5 [0117.677] lstrcmpiW (lpString1=".xlsx", lpString2=".thmx") returned 1 [0117.677] lstrlenW (lpString=".ppt") returned 4 [0117.677] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0117.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.677] lstrlenW (lpString=".zip") returned 4 [0117.678] lstrcmpiW (lpString1=".zip", lpString2="thmx") returned -1 [0117.678] lstrlenW (lpString=".rar") returned 4 [0117.678] lstrcmpiW (lpString1=".rar", lpString2="thmx") returned -1 [0117.678] lstrlenW (lpString=".bz2") returned 4 [0117.678] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0117.678] lstrlenW (lpString=".7z") returned 3 [0117.678] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0117.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.678] lstrlenW (lpString=".dbf") returned 4 [0117.678] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0117.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.678] lstrlenW (lpString=".1cd") returned 4 [0117.678] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0117.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 63 [0117.678] lstrlenW (lpString=".jpg") returned 4 [0117.678] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0117.678] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") [0118.351] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=965) returned 1 [0118.351] CloseHandle (hObject=0x168) returned 1 [0118.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml")) returned 0x20 [0118.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.365] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.365] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.395] GetLastError () returned 0x0 [0118.395] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c5, lpOverlapped=0x0) returned 1 [0118.396] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.397] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.397] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0118.398] SetEndOfFile (hFile=0x180) returned 1 [0118.398] CloseHandle (hObject=0x180) returned 1 [0118.398] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.398] SetEndOfFile (hFile=0x168) returned 1 [0118.399] CloseHandle (hObject=0x168) returned 1 [0118.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml")) returned 1 [0118.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.399] lstrlenW (lpString=".doc") returned 4 [0118.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.399] lstrlenW (lpString=".docx") returned 5 [0118.399] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0118.399] lstrlenW (lpString=".pdf") returned 4 [0118.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.399] lstrlenW (lpString=".xls") returned 4 [0118.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString=".xlsx") returned 5 [0118.400] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0118.400] lstrlenW (lpString=".ppt") returned 4 [0118.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.400] lstrlenW (lpString=".zip") returned 4 [0118.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.400] lstrlenW (lpString=".rar") returned 4 [0118.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString=".bz2") returned 4 [0118.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString=".7z") returned 3 [0118.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.400] lstrlenW (lpString=".dbf") returned 4 [0118.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.400] lstrlenW (lpString=".1cd") returned 4 [0118.400] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 80 [0118.400] lstrlenW (lpString=".jpg") returned 4 [0118.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.400] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") [0118.401] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=960) returned 1 [0118.401] CloseHandle (hObject=0x168) returned 1 [0118.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml")) returned 0x20 [0118.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.401] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.401] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.402] GetLastError () returned 0x0 [0118.402] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c0, lpOverlapped=0x0) returned 1 [0118.403] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.404] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.404] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0118.404] SetEndOfFile (hFile=0x180) returned 1 [0118.405] CloseHandle (hObject=0x180) returned 1 [0118.405] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.405] SetEndOfFile (hFile=0x168) returned 1 [0118.405] CloseHandle (hObject=0x168) returned 1 [0118.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml")) returned 1 [0118.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.406] lstrlenW (lpString=".doc") returned 4 [0118.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.406] lstrlenW (lpString=".docx") returned 5 [0118.406] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0118.406] lstrlenW (lpString=".pdf") returned 4 [0118.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.406] lstrlenW (lpString=".xls") returned 4 [0118.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.406] lstrlenW (lpString=".xlsx") returned 5 [0118.406] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0118.406] lstrlenW (lpString=".ppt") returned 4 [0118.406] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.406] lstrlenW (lpString=".zip") returned 4 [0118.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.406] lstrlenW (lpString=".rar") returned 4 [0118.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.406] lstrlenW (lpString=".bz2") returned 4 [0118.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.407] lstrlenW (lpString=".7z") returned 3 [0118.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.407] lstrlenW (lpString=".dbf") returned 4 [0118.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.407] lstrlenW (lpString=".1cd") returned 4 [0118.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 75 [0118.407] lstrlenW (lpString=".jpg") returned 4 [0118.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.407] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") [0118.408] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=961) returned 1 [0118.408] CloseHandle (hObject=0x168) returned 1 [0118.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml")) returned 0x20 [0118.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.408] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.408] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.409] GetLastError () returned 0x0 [0118.409] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c1, lpOverlapped=0x0) returned 1 [0118.411] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.412] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.412] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0118.412] SetEndOfFile (hFile=0x180) returned 1 [0118.412] CloseHandle (hObject=0x180) returned 1 [0118.412] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.412] SetEndOfFile (hFile=0x168) returned 1 [0118.413] CloseHandle (hObject=0x168) returned 1 [0118.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml")) returned 1 [0118.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.413] lstrlenW (lpString=".doc") returned 4 [0118.413] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.413] lstrlenW (lpString=".docx") returned 5 [0118.413] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0118.413] lstrlenW (lpString=".pdf") returned 4 [0118.413] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.413] lstrlenW (lpString=".xls") returned 4 [0118.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.413] lstrlenW (lpString=".xlsx") returned 5 [0118.413] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0118.414] lstrlenW (lpString=".ppt") returned 4 [0118.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.414] lstrlenW (lpString=".zip") returned 4 [0118.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.414] lstrlenW (lpString=".rar") returned 4 [0118.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.414] lstrlenW (lpString=".bz2") returned 4 [0118.414] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.414] lstrlenW (lpString=".7z") returned 3 [0118.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.414] lstrlenW (lpString=".dbf") returned 4 [0118.414] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.414] lstrlenW (lpString=".1cd") returned 4 [0118.414] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 76 [0118.414] lstrlenW (lpString=".jpg") returned 4 [0118.414] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.414] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") [0118.415] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=964) returned 1 [0118.415] CloseHandle (hObject=0x168) returned 1 [0118.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml")) returned 0x20 [0118.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.415] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.415] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.416] GetLastError () returned 0x0 [0118.416] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c4, lpOverlapped=0x0) returned 1 [0118.417] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.418] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.418] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xee, lpOverlapped=0x0) returned 1 [0118.418] SetEndOfFile (hFile=0x180) returned 1 [0118.418] CloseHandle (hObject=0x180) returned 1 [0118.419] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.419] SetEndOfFile (hFile=0x168) returned 1 [0118.419] CloseHandle (hObject=0x168) returned 1 [0118.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml")) returned 1 [0118.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.420] lstrlenW (lpString=".doc") returned 4 [0118.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString=".docx") returned 5 [0118.420] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0118.420] lstrlenW (lpString=".pdf") returned 4 [0118.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString=".xls") returned 4 [0118.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString=".xlsx") returned 5 [0118.420] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0118.420] lstrlenW (lpString=".ppt") returned 4 [0118.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.420] lstrlenW (lpString=".zip") returned 4 [0118.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.420] lstrlenW (lpString=".rar") returned 4 [0118.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString=".bz2") returned 4 [0118.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.420] lstrlenW (lpString=".7z") returned 3 [0118.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.420] lstrlenW (lpString=".dbf") returned 4 [0118.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.421] lstrlenW (lpString=".1cd") returned 4 [0118.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 79 [0118.421] lstrlenW (lpString=".jpg") returned 4 [0118.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.421] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") [0118.421] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=962) returned 1 [0118.421] CloseHandle (hObject=0x168) returned 1 [0118.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml")) returned 0x20 [0118.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.422] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.422] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.422] GetLastError () returned 0x0 [0118.422] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x3c2, lpOverlapped=0x0) returned 1 [0118.424] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0118.425] ReadFile (in: hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesRead=0x322fed4*=0x0, lpOverlapped=0x0) returned 1 [0118.425] WriteFile (in: hFile=0x180, lpBuffer=0x3d50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x322fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d50020*, lpNumberOfBytesWritten=0x322fc9c*=0xea, lpOverlapped=0x0) returned 1 [0118.425] SetEndOfFile (hFile=0x180) returned 1 [0118.426] CloseHandle (hObject=0x180) returned 1 [0118.426] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.426] SetEndOfFile (hFile=0x168) returned 1 [0118.426] CloseHandle (hObject=0x168) returned 1 [0118.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0118.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml")) returned 1 [0118.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.427] lstrlenW (lpString=".doc") returned 4 [0118.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString=".docx") returned 5 [0118.427] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0118.427] lstrlenW (lpString=".pdf") returned 4 [0118.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString=".xls") returned 4 [0118.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString=".xlsx") returned 5 [0118.427] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0118.427] lstrlenW (lpString=".ppt") returned 4 [0118.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.427] lstrlenW (lpString=".zip") returned 4 [0118.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.427] lstrlenW (lpString=".rar") returned 4 [0118.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString=".bz2") returned 4 [0118.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.427] lstrlenW (lpString=".7z") returned 3 [0118.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.428] lstrlenW (lpString=".dbf") returned 4 [0118.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.428] lstrlenW (lpString=".1cd") returned 4 [0118.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 77 [0118.428] lstrlenW (lpString=".jpg") returned 4 [0118.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.428] RtlInitUnicodeStringEx (DestinationString=0x322fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") [0118.428] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=960) returned 1 [0118.428] CloseHandle (hObject=0x168) returned 1 [0118.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml")) returned 0x20 [0118.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0118.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0118.429] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.429] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fec8 | out: lpNewFilePointer=0x0) returned 1 [0118.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.430] GetLastError () returned 0x0 [0118.430] ReadFile (hFile=0x168, lpBuffer=0x3d50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x322fed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0x9e0 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x37b02b0 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x37c02b8 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641270 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6416e0 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x641288 [0033.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3e60020 [0033.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6412a0 [0033.727] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6412a0, Size=0x20) returned 0x629f70 [0033.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6412a0 [0033.727] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6412a0, Size=0x20) returned 0x629f48 [0033.727] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.727] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.727] Wow64DisableWow64FsRedirection (in: OldValue=0x336ff58 | out: OldValue=0x336ff58*=0x0) returned 1 [0033.727] lstrlenW (lpString="kernel32.dll") returned 12 [0033.727] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f70 | out: hHeap=0x5c0000) returned 1 [0033.727] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.727] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629f48 | out: hHeap=0x5c0000) returned 1 [0033.727] Sleep (dwMilliseconds=0x64) [0033.918] lstrcmpiW (lpString1=".ttf", lpString2=".zoh") returned -1 [0033.918] lstrlenW (lpString="kor_boot.ttf") returned 12 [0033.918] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.398] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2371360) returned 1 [0034.398] CloseHandle (hObject=0x194) returned 1 [0034.398] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0034.406] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.406] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0034.407] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.407] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.407] lstrlenW (lpString=".doc") returned 4 [0034.407] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.407] lstrlenW (lpString=".docx") returned 5 [0034.407] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.407] lstrlenW (lpString=".pdf") returned 4 [0034.407] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.407] lstrlenW (lpString=".xls") returned 4 [0034.407] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.407] lstrlenW (lpString=".xlsx") returned 5 [0034.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.407] lstrlenW (lpString=".ppt") returned 4 [0034.407] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.414] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.414] lstrlenW (lpString=".zip") returned 4 [0034.414] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.414] lstrlenW (lpString=".rar") returned 4 [0034.414] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.414] lstrlenW (lpString=".bz2") returned 4 [0034.424] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.424] lstrlenW (lpString=".7z") returned 3 [0034.424] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString=".dbf") returned 4 [0034.425] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString=".1cd") returned 4 [0034.425] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString=".jpg") returned 4 [0034.425] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString=".doc") returned 4 [0034.425] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString=".docx") returned 5 [0034.425] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.425] lstrlenW (lpString=".pdf") returned 4 [0034.425] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString=".xls") returned 4 [0034.425] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.425] lstrlenW (lpString=".xlsx") returned 5 [0034.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.425] lstrlenW (lpString=".ppt") returned 4 [0034.425] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.425] lstrlenW (lpString=".zip") returned 4 [0034.425] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.425] lstrlenW (lpString=".rar") returned 4 [0034.425] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString=".bz2") returned 4 [0034.425] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.425] lstrlenW (lpString=".7z") returned 3 [0034.425] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.426] lstrlenW (lpString=".dbf") returned 4 [0034.426] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.426] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.426] lstrlenW (lpString=".1cd") returned 4 [0034.426] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.426] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0034.426] lstrlenW (lpString=".jpg") returned 4 [0034.426] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.426] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0034.426] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0034.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.426] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2506240) returned 1 [0034.426] CloseHandle (hObject=0x194) returned 1 [0034.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0034.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0034.426] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0034.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.427] ReadFile (in: hFile=0x194, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.434] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.434] ReadFile (in: hFile=0x194, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.448] ReadFile (in: hFile=0x194, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.469] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.469] WriteFile (in: hFile=0x194, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0034.863] SetEndOfFile (hFile=0x194) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4008600 [0034.863] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.863] WriteFile (in: hFile=0x194, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.864] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.865] WriteFile (in: hFile=0x194, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.870] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.870] WriteFile (in: hFile=0x194, lpBuffer=0x4008600*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4008600*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.873] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0034.873] CloseHandle (hObject=0x194) returned 1 [0036.149] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0036.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.150] lstrlenW (lpString=".doc") returned 4 [0036.150] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.150] lstrlenW (lpString=".docx") returned 5 [0036.150] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.150] lstrlenW (lpString=".pdf") returned 4 [0036.150] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.150] lstrlenW (lpString=".xls") returned 4 [0036.150] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.150] lstrlenW (lpString=".xlsx") returned 5 [0036.150] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.150] lstrlenW (lpString=".ppt") returned 4 [0036.150] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.150] lstrlenW (lpString=".zip") returned 4 [0036.150] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.150] lstrlenW (lpString=".rar") returned 4 [0036.150] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.150] lstrlenW (lpString=".bz2") returned 4 [0036.150] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.150] lstrlenW (lpString=".7z") returned 3 [0036.150] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.150] lstrlenW (lpString=".dbf") returned 4 [0036.150] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.150] lstrlenW (lpString=".1cd") returned 4 [0036.151] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString=".jpg") returned 4 [0036.151] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString=".doc") returned 4 [0036.151] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.151] lstrlenW (lpString=".docx") returned 5 [0036.151] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.151] lstrlenW (lpString=".pdf") returned 4 [0036.151] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.151] lstrlenW (lpString=".xls") returned 4 [0036.151] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.151] lstrlenW (lpString=".xlsx") returned 5 [0036.151] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.151] lstrlenW (lpString=".ppt") returned 4 [0036.151] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString=".zip") returned 4 [0036.151] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.151] lstrlenW (lpString=".rar") returned 4 [0036.151] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.151] lstrlenW (lpString=".bz2") returned 4 [0036.151] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.151] lstrlenW (lpString=".7z") returned 3 [0036.151] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString=".dbf") returned 4 [0036.151] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.151] lstrlenW (lpString=".1cd") returned 4 [0036.151] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.152] lstrlenW (lpString=".jpg") returned 4 [0036.152] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.152] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0036.152] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0036.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0036.152] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2513920) returned 1 [0036.152] CloseHandle (hObject=0x194) returned 1 [0036.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0036.152] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0036.152] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0036.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0036.153] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.153] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.153] ReadFile (in: hFile=0x194, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.245] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.245] ReadFile (in: hFile=0x194, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.266] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.266] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.267] ReadFile (in: hFile=0x194, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.364] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.365] WriteFile (in: hFile=0x194, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0036.696] SetEndOfFile (hFile=0x194) returned 1 [0036.696] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0036.696] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.696] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.698] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.704] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.704] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.707] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.707] CloseHandle (hObject=0x194) returned 1 [0037.545] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0037.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.545] lstrlenW (lpString=".doc") returned 4 [0037.545] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.545] lstrlenW (lpString=".docx") returned 5 [0037.545] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.545] lstrlenW (lpString=".pdf") returned 4 [0037.546] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.546] lstrlenW (lpString=".xls") returned 4 [0037.546] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.546] lstrlenW (lpString=".xlsx") returned 5 [0037.546] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.546] lstrlenW (lpString=".ppt") returned 4 [0037.546] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString=".zip") returned 4 [0037.546] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.546] lstrlenW (lpString=".rar") returned 4 [0037.546] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.546] lstrlenW (lpString=".bz2") returned 4 [0037.546] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.546] lstrlenW (lpString=".7z") returned 3 [0037.546] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString=".dbf") returned 4 [0037.546] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString=".1cd") returned 4 [0037.546] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString=".jpg") returned 4 [0037.546] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.546] lstrlenW (lpString=".doc") returned 4 [0037.546] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.546] lstrlenW (lpString=".docx") returned 5 [0037.546] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.546] lstrlenW (lpString=".pdf") returned 4 [0037.546] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.547] lstrlenW (lpString=".xls") returned 4 [0037.547] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.547] lstrlenW (lpString=".xlsx") returned 5 [0037.547] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.547] lstrlenW (lpString=".ppt") returned 4 [0037.547] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.547] lstrlenW (lpString=".zip") returned 4 [0037.547] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.547] lstrlenW (lpString=".rar") returned 4 [0037.547] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.547] lstrlenW (lpString=".bz2") returned 4 [0037.547] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.547] lstrlenW (lpString=".7z") returned 3 [0037.547] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.547] lstrlenW (lpString=".dbf") returned 4 [0037.547] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.547] lstrlenW (lpString=".1cd") returned 4 [0037.547] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0037.547] lstrlenW (lpString=".jpg") returned 4 [0037.547] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.547] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0037.547] lstrlenW (lpString="OutlkLR.cab") returned 11 [0037.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0037.548] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14819276) returned 1 [0037.548] CloseHandle (hObject=0x194) returned 1 [0037.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0037.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0037.548] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0037.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0037.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.549] ReadFile (in: hFile=0x194, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.555] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.555] ReadFile (in: hFile=0x194, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.565] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.565] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.565] ReadFile (in: hFile=0x194, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.584] WriteFile (in: hFile=0x194, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0037.802] SetEndOfFile (hFile=0x194) returned 1 [0037.802] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0037.806] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.806] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.807] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.808] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.808] WriteFile (in: hFile=0x194, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.809] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.809] CloseHandle (hObject=0x194) returned 1 [0040.302] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0040.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString=".doc") returned 4 [0040.303] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString=".docx") returned 5 [0040.303] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.303] lstrlenW (lpString=".pdf") returned 4 [0040.303] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString=".xls") returned 4 [0040.303] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString=".xlsx") returned 5 [0040.303] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.303] lstrlenW (lpString=".ppt") returned 4 [0040.303] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString=".zip") returned 4 [0040.303] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString=".rar") returned 4 [0040.303] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString=".bz2") returned 4 [0040.303] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.303] lstrlenW (lpString=".7z") returned 3 [0040.303] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString=".dbf") returned 4 [0040.303] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString=".1cd") returned 4 [0040.303] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString=".jpg") returned 4 [0040.303] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.304] lstrlenW (lpString=".doc") returned 4 [0040.304] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString=".docx") returned 5 [0040.304] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.304] lstrlenW (lpString=".pdf") returned 4 [0040.304] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString=".xls") returned 4 [0040.304] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString=".xlsx") returned 5 [0040.304] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.304] lstrlenW (lpString=".ppt") returned 4 [0040.304] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.304] lstrlenW (lpString=".zip") returned 4 [0040.304] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString=".rar") returned 4 [0040.304] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString=".bz2") returned 4 [0040.304] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.304] lstrlenW (lpString=".7z") returned 3 [0040.304] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.304] lstrlenW (lpString=".dbf") returned 4 [0040.304] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.304] lstrlenW (lpString=".1cd") returned 4 [0040.304] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.304] lstrlenW (lpString=".jpg") returned 4 [0040.304] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.305] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0040.305] lstrlenW (lpString="Proof.cab") returned 9 [0040.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.577] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=13642474) returned 1 [0040.577] CloseHandle (hObject=0x1c0) returned 1 [0040.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0040.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0040.577] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0040.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.737] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.737] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.737] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.115] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.115] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.249] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.249] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.249] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.332] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.332] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.344] SetEndOfFile (hFile=0x1c0) returned 1 [0041.344] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4078620 [0041.348] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.348] WriteFile (in: hFile=0x1c0, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.349] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.349] WriteFile (in: hFile=0x1c0, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.350] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.350] WriteFile (in: hFile=0x1c0, lpBuffer=0x4078620*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4078620*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.523] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4078620 | out: hHeap=0x5c0000) returned 1 [0041.525] CloseHandle (hObject=0x1c0) returned 1 [0043.617] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0043.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.617] lstrlenW (lpString=".doc") returned 4 [0043.617] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.617] lstrlenW (lpString=".docx") returned 5 [0043.617] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.617] lstrlenW (lpString=".pdf") returned 4 [0043.617] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.617] lstrlenW (lpString=".xls") returned 4 [0043.618] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString=".xlsx") returned 5 [0043.618] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.618] lstrlenW (lpString=".ppt") returned 4 [0043.618] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString=".zip") returned 4 [0043.618] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString=".rar") returned 4 [0043.618] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString=".bz2") returned 4 [0043.618] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.618] lstrlenW (lpString=".7z") returned 3 [0043.618] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString=".dbf") returned 4 [0043.618] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString=".1cd") returned 4 [0043.618] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString=".jpg") returned 4 [0043.618] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.618] lstrlenW (lpString=".doc") returned 4 [0043.618] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString=".docx") returned 5 [0043.618] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.618] lstrlenW (lpString=".pdf") returned 4 [0043.618] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.618] lstrlenW (lpString=".xls") returned 4 [0043.619] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.619] lstrlenW (lpString=".xlsx") returned 5 [0043.619] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.619] lstrlenW (lpString=".ppt") returned 4 [0043.619] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.619] lstrlenW (lpString=".zip") returned 4 [0043.619] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.619] lstrlenW (lpString=".rar") returned 4 [0043.619] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.619] lstrlenW (lpString=".bz2") returned 4 [0043.619] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.619] lstrlenW (lpString=".7z") returned 3 [0043.619] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.619] lstrlenW (lpString=".dbf") returned 4 [0043.619] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.619] lstrlenW (lpString=".1cd") returned 4 [0043.619] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.619] lstrlenW (lpString=".jpg") returned 4 [0043.619] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.619] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0043.619] lstrlenW (lpString="VisioLR.cab") returned 11 [0043.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0043.626] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=50823389) returned 1 [0043.626] CloseHandle (hObject=0x1c0) returned 1 [0043.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0043.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0043.626] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0043.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0043.679] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.679] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.679] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.814] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.814] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.824] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.824] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.824] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.845] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.845] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0043.967] SetEndOfFile (hFile=0x1c0) returned 1 [0043.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0043.967] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.967] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.159] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.159] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.160] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.160] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0044.162] CloseHandle (hObject=0x1c0) returned 1 [0044.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0044.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.163] lstrlenW (lpString=".doc") returned 4 [0044.163] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString=".docx") returned 5 [0044.163] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.163] lstrlenW (lpString=".pdf") returned 4 [0044.163] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString=".xls") returned 4 [0044.163] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString=".xlsx") returned 5 [0044.163] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.163] lstrlenW (lpString=".ppt") returned 4 [0044.163] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.163] lstrlenW (lpString=".zip") returned 4 [0044.163] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString=".rar") returned 4 [0044.163] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.163] lstrlenW (lpString=".bz2") returned 4 [0044.163] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.164] lstrlenW (lpString=".7z") returned 3 [0044.164] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString=".dbf") returned 4 [0044.164] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString=".1cd") returned 4 [0044.164] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString=".jpg") returned 4 [0044.164] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString=".doc") returned 4 [0044.164] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString=".docx") returned 5 [0044.164] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.164] lstrlenW (lpString=".pdf") returned 4 [0044.164] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString=".xls") returned 4 [0044.164] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString=".xlsx") returned 5 [0044.164] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.164] lstrlenW (lpString=".ppt") returned 4 [0044.164] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.164] lstrlenW (lpString=".zip") returned 4 [0044.164] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString=".rar") returned 4 [0044.164] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.164] lstrlenW (lpString=".bz2") returned 4 [0044.164] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.165] lstrlenW (lpString=".7z") returned 3 [0044.165] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.165] lstrlenW (lpString=".dbf") returned 4 [0044.165] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.165] lstrlenW (lpString=".1cd") returned 4 [0044.165] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0044.165] lstrlenW (lpString=".jpg") returned 4 [0044.165] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.165] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0044.165] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0044.165] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.165] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2503680) returned 1 [0044.165] CloseHandle (hObject=0x1c0) returned 1 [0044.165] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0044.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.166] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0044.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.166] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.166] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.166] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.208] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.208] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.219] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.235] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.235] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.452] SetEndOfFile (hFile=0x1c0) returned 1 [0044.453] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4088630 [0044.491] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.491] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.590] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.591] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.596] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.596] WriteFile (in: hFile=0x1c0, lpBuffer=0x4088630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4088630*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.599] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4088630 | out: hHeap=0x5c0000) returned 1 [0044.599] CloseHandle (hObject=0x1c0) returned 1 [0044.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0044.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.600] lstrlenW (lpString=".doc") returned 4 [0044.600] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.600] lstrlenW (lpString=".docx") returned 5 [0044.600] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.600] lstrlenW (lpString=".pdf") returned 4 [0044.600] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.600] lstrlenW (lpString=".xls") returned 4 [0044.600] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.600] lstrlenW (lpString=".xlsx") returned 5 [0044.600] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.600] lstrlenW (lpString=".ppt") returned 4 [0044.600] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.600] lstrlenW (lpString=".zip") returned 4 [0044.600] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.600] lstrlenW (lpString=".rar") returned 4 [0044.600] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.600] lstrlenW (lpString=".bz2") returned 4 [0044.600] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.600] lstrlenW (lpString=".7z") returned 3 [0044.600] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.600] lstrlenW (lpString=".dbf") returned 4 [0044.600] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString=".1cd") returned 4 [0044.601] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString=".jpg") returned 4 [0044.601] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString=".doc") returned 4 [0044.601] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString=".docx") returned 5 [0044.601] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.601] lstrlenW (lpString=".pdf") returned 4 [0044.601] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.601] lstrlenW (lpString=".xls") returned 4 [0044.601] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.601] lstrlenW (lpString=".xlsx") returned 5 [0044.601] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.601] lstrlenW (lpString=".ppt") returned 4 [0044.601] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString=".zip") returned 4 [0044.601] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.601] lstrlenW (lpString=".rar") returned 4 [0044.601] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.601] lstrlenW (lpString=".bz2") returned 4 [0044.601] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString=".7z") returned 3 [0044.601] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.601] lstrlenW (lpString=".dbf") returned 4 [0044.601] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.602] lstrlenW (lpString=".1cd") returned 4 [0044.602] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0044.602] lstrlenW (lpString=".jpg") returned 4 [0044.602] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.602] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0044.602] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0044.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.637] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2511872) returned 1 [0044.637] CloseHandle (hObject=0x188) returned 1 [0044.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0044.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.638] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0044.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.638] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.638] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.638] ReadFile (in: hFile=0x188, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.645] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.645] ReadFile (in: hFile=0x188, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.681] ReadFile (in: hFile=0x188, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.700] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.700] WriteFile (in: hFile=0x188, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.954] SetEndOfFile (hFile=0x188) returned 1 [0044.954] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4128668 [0044.955] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.955] WriteFile (in: hFile=0x188, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.956] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.956] WriteFile (in: hFile=0x188, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.962] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.962] WriteFile (in: hFile=0x188, lpBuffer=0x4128668*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4128668*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4128668 | out: hHeap=0x5c0000) returned 1 [0044.965] CloseHandle (hObject=0x188) returned 1 [0044.965] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0044.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.965] lstrlenW (lpString=".doc") returned 4 [0044.965] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString=".docx") returned 5 [0044.966] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.966] lstrlenW (lpString=".pdf") returned 4 [0044.966] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.966] lstrlenW (lpString=".xls") returned 4 [0044.966] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.966] lstrlenW (lpString=".xlsx") returned 5 [0044.966] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.966] lstrlenW (lpString=".ppt") returned 4 [0044.966] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString=".zip") returned 4 [0044.966] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.966] lstrlenW (lpString=".rar") returned 4 [0044.966] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.966] lstrlenW (lpString=".bz2") returned 4 [0044.966] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString=".7z") returned 3 [0044.966] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString=".dbf") returned 4 [0044.966] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString=".1cd") returned 4 [0044.966] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString=".jpg") returned 4 [0044.966] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.966] lstrlenW (lpString=".doc") returned 4 [0044.966] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.966] lstrlenW (lpString=".docx") returned 5 [0044.967] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.967] lstrlenW (lpString=".pdf") returned 4 [0044.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.967] lstrlenW (lpString=".xls") returned 4 [0044.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.967] lstrlenW (lpString=".xlsx") returned 5 [0044.967] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.967] lstrlenW (lpString=".ppt") returned 4 [0044.967] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.967] lstrlenW (lpString=".zip") returned 4 [0044.967] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.967] lstrlenW (lpString=".rar") returned 4 [0044.967] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.967] lstrlenW (lpString=".bz2") returned 4 [0044.967] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.967] lstrlenW (lpString=".7z") returned 3 [0044.967] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.967] lstrlenW (lpString=".dbf") returned 4 [0044.967] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.967] lstrlenW (lpString=".1cd") returned 4 [0044.967] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.967] lstrlenW (lpString=".jpg") returned 4 [0044.967] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.967] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0044.967] lstrlenW (lpString="GrooveLR.cab") returned 12 [0044.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.968] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4095519) returned 1 [0044.968] CloseHandle (hObject=0x188) returned 1 [0044.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0044.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0044.968] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0044.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.969] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.969] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.969] ReadFile (in: hFile=0x188, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.972] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.972] ReadFile (in: hFile=0x188, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.985] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.292] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.292] ReadFile (in: hFile=0x188, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.326] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.326] WriteFile (in: hFile=0x188, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.497] SetEndOfFile (hFile=0x188) returned 1 [0045.497] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4108008 [0045.564] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.564] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.565] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.565] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.568] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.568] WriteFile (in: hFile=0x188, lpBuffer=0x4108008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4108008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.570] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4108008 | out: hHeap=0x5c0000) returned 1 [0045.570] CloseHandle (hObject=0x188) returned 1 [0045.570] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0045.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.570] lstrlenW (lpString=".doc") returned 4 [0045.570] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.570] lstrlenW (lpString=".docx") returned 5 [0045.570] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.570] lstrlenW (lpString=".pdf") returned 4 [0045.570] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.570] lstrlenW (lpString=".xls") returned 4 [0045.570] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.570] lstrlenW (lpString=".xlsx") returned 5 [0045.570] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.570] lstrlenW (lpString=".ppt") returned 4 [0045.570] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString=".zip") returned 4 [0045.571] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString=".rar") returned 4 [0045.571] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString=".bz2") returned 4 [0045.571] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.571] lstrlenW (lpString=".7z") returned 3 [0045.571] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString=".dbf") returned 4 [0045.571] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString=".1cd") returned 4 [0045.571] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString=".jpg") returned 4 [0045.571] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.571] lstrlenW (lpString=".doc") returned 4 [0045.571] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString=".docx") returned 5 [0045.571] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.571] lstrlenW (lpString=".pdf") returned 4 [0045.571] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString=".xls") returned 4 [0045.571] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.571] lstrlenW (lpString=".xlsx") returned 5 [0045.571] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.571] lstrlenW (lpString=".ppt") returned 4 [0045.572] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.572] lstrlenW (lpString=".zip") returned 4 [0045.572] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.572] lstrlenW (lpString=".rar") returned 4 [0045.572] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.572] lstrlenW (lpString=".bz2") returned 4 [0045.572] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.572] lstrlenW (lpString=".7z") returned 3 [0045.572] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.572] lstrlenW (lpString=".dbf") returned 4 [0045.572] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.572] lstrlenW (lpString=".1cd") returned 4 [0045.572] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0045.572] lstrlenW (lpString=".jpg") returned 4 [0045.572] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.572] lstrcmpiW (lpString1=".manifest", lpString2=".zoh") returned -1 [0045.572] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0045.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.430] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1857) returned 1 [0046.430] CloseHandle (hObject=0x1c0) returned 1 [0046.430] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0046.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.431] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.431] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.431] GetLastError () returned 0x0 [0046.431] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x741, lpOverlapped=0x0) returned 1 [0046.435] WriteFile (in: hFile=0x204, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x750, lpOverlapped=0x0) returned 1 [0046.436] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.436] WriteFile (in: hFile=0x204, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0046.436] SetEndOfFile (hFile=0x204) returned 1 [0046.437] CloseHandle (hObject=0x204) returned 1 [0046.437] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.437] SetEndOfFile (hFile=0x1c0) returned 1 [0046.438] CloseHandle (hObject=0x1c0) returned 1 [0046.438] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.438] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0046.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.438] lstrlenW (lpString=".doc") returned 4 [0046.438] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.438] lstrlenW (lpString=".docx") returned 5 [0046.438] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.438] lstrlenW (lpString=".pdf") returned 4 [0046.438] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.438] lstrlenW (lpString=".xls") returned 4 [0046.438] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.438] lstrlenW (lpString=".xlsx") returned 5 [0046.438] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.438] lstrlenW (lpString=".ppt") returned 4 [0046.438] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString=".zip") returned 4 [0046.439] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString=".rar") returned 4 [0046.439] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString=".bz2") returned 4 [0046.439] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString=".7z") returned 3 [0046.439] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString=".dbf") returned 4 [0046.439] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString=".1cd") returned 4 [0046.439] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString=".jpg") returned 4 [0046.439] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.439] lstrlenW (lpString=".doc") returned 4 [0046.439] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString=".docx") returned 5 [0046.439] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.439] lstrlenW (lpString=".pdf") returned 4 [0046.439] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.439] lstrlenW (lpString=".xls") returned 4 [0046.439] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString=".xlsx") returned 5 [0046.440] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.440] lstrlenW (lpString=".ppt") returned 4 [0046.440] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.440] lstrlenW (lpString=".zip") returned 4 [0046.440] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString=".rar") returned 4 [0046.440] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString=".bz2") returned 4 [0046.440] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString=".7z") returned 3 [0046.440] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.440] lstrlenW (lpString=".dbf") returned 4 [0046.440] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.440] lstrlenW (lpString=".1cd") returned 4 [0046.440] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.440] lstrlenW (lpString=".jpg") returned 4 [0046.440] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.440] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0046.440] lstrlenW (lpString="msvcr90.dll") returned 11 [0046.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.441] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=655872) returned 1 [0046.441] CloseHandle (hObject=0x1c0) returned 1 [0046.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0046.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.441] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.441] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.441] GetLastError () returned 0x0 [0046.441] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x204, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0046.568] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.568] WriteFile (in: hFile=0x204, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.569] SetEndOfFile (hFile=0x204) returned 1 [0046.569] CloseHandle (hObject=0x204) returned 1 [0046.569] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.569] SetEndOfFile (hFile=0x1c0) returned 1 [0046.574] CloseHandle (hObject=0x1c0) returned 1 [0046.574] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.575] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".doc") returned 4 [0046.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".docx") returned 5 [0046.575] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.575] lstrlenW (lpString=".pdf") returned 4 [0046.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".xls") returned 4 [0046.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".xlsx") returned 5 [0046.575] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.575] lstrlenW (lpString=".ppt") returned 4 [0046.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".zip") returned 4 [0046.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.576] lstrlenW (lpString=".rar") returned 4 [0046.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.576] lstrlenW (lpString=".bz2") returned 4 [0046.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString=".7z") returned 3 [0046.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".dbf") returned 4 [0046.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".1cd") returned 4 [0046.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".jpg") returned 4 [0046.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.577] lstrlenW (lpString=".doc") returned 4 [0046.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.577] lstrlenW (lpString=".docx") returned 5 [0046.751] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.751] lstrlenW (lpString=".pdf") returned 4 [0046.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.751] lstrlenW (lpString=".xls") returned 4 [0046.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.751] lstrlenW (lpString=".xlsx") returned 5 [0046.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.751] lstrlenW (lpString=".ppt") returned 4 [0046.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.752] lstrlenW (lpString=".zip") returned 4 [0046.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.752] lstrlenW (lpString=".rar") returned 4 [0046.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.752] lstrlenW (lpString=".bz2") returned 4 [0046.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.752] lstrlenW (lpString=".7z") returned 3 [0046.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.752] lstrlenW (lpString=".dbf") returned 4 [0046.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.752] lstrlenW (lpString=".1cd") returned 4 [0046.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.752] lstrlenW (lpString=".jpg") returned 4 [0046.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.752] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0046.752] lstrlenW (lpString="osetupui.dll") returned 12 [0046.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.753] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=191872) returned 1 [0046.753] CloseHandle (hObject=0x208) returned 1 [0046.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0046.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.753] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.753] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.753] GetLastError () returned 0x0 [0046.753] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0046.895] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0046.899] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.899] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.899] SetEndOfFile (hFile=0x16c) returned 1 [0046.899] CloseHandle (hObject=0x16c) returned 1 [0046.899] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.899] SetEndOfFile (hFile=0x208) returned 1 [0046.901] CloseHandle (hObject=0x208) returned 1 [0046.901] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0046.901] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString=".doc") returned 4 [0046.902] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString=".docx") returned 5 [0046.902] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0046.902] lstrlenW (lpString=".pdf") returned 4 [0046.902] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString=".xls") returned 4 [0046.902] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString=".xlsx") returned 5 [0046.902] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0046.902] lstrlenW (lpString=".ppt") returned 4 [0046.902] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString=".zip") returned 4 [0046.902] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString=".rar") returned 4 [0046.902] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.902] lstrlenW (lpString=".bz2") returned 4 [0046.902] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.902] lstrlenW (lpString=".7z") returned 3 [0046.902] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString=".dbf") returned 4 [0046.902] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString=".1cd") returned 4 [0046.902] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.902] lstrlenW (lpString=".jpg") returned 4 [0046.903] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.903] lstrlenW (lpString=".doc") returned 4 [0046.903] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString=".docx") returned 5 [0046.903] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0046.903] lstrlenW (lpString=".pdf") returned 4 [0046.903] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString=".xls") returned 4 [0046.903] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString=".xlsx") returned 5 [0046.903] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0046.903] lstrlenW (lpString=".ppt") returned 4 [0046.903] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.903] lstrlenW (lpString=".zip") returned 4 [0046.903] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString=".rar") returned 4 [0046.903] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.903] lstrlenW (lpString=".bz2") returned 4 [0046.903] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.903] lstrlenW (lpString=".7z") returned 3 [0046.903] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.903] lstrlenW (lpString=".dbf") returned 4 [0046.903] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.903] lstrlenW (lpString=".1cd") returned 4 [0046.904] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.904] lstrlenW (lpString=".jpg") returned 4 [0046.904] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.904] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0046.904] lstrlenW (lpString="AccLR.cab") returned 9 [0046.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.904] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=28016276) returned 1 [0046.904] CloseHandle (hObject=0x208) returned 1 [0046.905] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0046.905] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0046.905] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0046.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.905] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.905] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.905] ReadFile (in: hFile=0x208, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.920] ReadFile (in: hFile=0x208, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.932] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.932] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.932] ReadFile (in: hFile=0x208, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.960] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.960] WriteFile (in: hFile=0x208, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0047.540] SetEndOfFile (hFile=0x208) returned 1 [0047.540] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4118010 [0047.541] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.541] WriteFile (in: hFile=0x208, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.542] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.542] WriteFile (in: hFile=0x208, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.552] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.552] WriteFile (in: hFile=0x208, lpBuffer=0x4118010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4118010*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.554] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4118010 | out: hHeap=0x5c0000) returned 1 [0047.554] CloseHandle (hObject=0x208) returned 1 [0047.555] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0047.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.555] lstrlenW (lpString=".doc") returned 4 [0047.555] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.555] lstrlenW (lpString=".docx") returned 5 [0047.555] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.555] lstrlenW (lpString=".pdf") returned 4 [0047.555] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.555] lstrlenW (lpString=".xls") returned 4 [0047.555] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.555] lstrlenW (lpString=".xlsx") returned 5 [0047.555] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.555] lstrlenW (lpString=".ppt") returned 4 [0047.555] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.555] lstrlenW (lpString=".zip") returned 4 [0047.555] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.555] lstrlenW (lpString=".rar") returned 4 [0047.555] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString=".bz2") returned 4 [0047.556] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.556] lstrlenW (lpString=".7z") returned 3 [0047.556] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.556] lstrlenW (lpString=".dbf") returned 4 [0047.556] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.556] lstrlenW (lpString=".1cd") returned 4 [0047.556] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.556] lstrlenW (lpString=".jpg") returned 4 [0047.556] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.556] lstrlenW (lpString=".doc") returned 4 [0047.556] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString=".docx") returned 5 [0047.556] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.556] lstrlenW (lpString=".pdf") returned 4 [0047.556] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString=".xls") returned 4 [0047.556] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.556] lstrlenW (lpString=".xlsx") returned 5 [0047.556] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.556] lstrlenW (lpString=".ppt") returned 4 [0047.556] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.557] lstrlenW (lpString=".zip") returned 4 [0047.557] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.557] lstrlenW (lpString=".rar") returned 4 [0047.557] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.557] lstrlenW (lpString=".bz2") returned 4 [0047.557] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.557] lstrlenW (lpString=".7z") returned 3 [0047.557] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.557] lstrlenW (lpString=".dbf") returned 4 [0047.557] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.557] lstrlenW (lpString=".1cd") returned 4 [0047.557] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.557] lstrlenW (lpString=".jpg") returned 4 [0047.557] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.557] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0047.557] lstrlenW (lpString="ose.exe") returned 7 [0047.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.558] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=174440) returned 1 [0047.558] CloseHandle (hObject=0x208) returned 1 [0047.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0047.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0047.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.558] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.558] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.559] GetLastError () returned 0x0 [0047.559] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.099] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.102] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.103] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.103] SetEndOfFile (hFile=0x214) returned 1 [0048.103] CloseHandle (hObject=0x214) returned 1 [0048.103] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.103] SetEndOfFile (hFile=0x208) returned 1 [0048.105] CloseHandle (hObject=0x208) returned 1 [0048.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.105] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.106] lstrlenW (lpString=".doc") returned 4 [0048.106] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.106] lstrlenW (lpString=".docx") returned 5 [0048.106] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.106] lstrlenW (lpString=".pdf") returned 4 [0048.106] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.106] lstrlenW (lpString=".xls") returned 4 [0048.106] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.106] lstrlenW (lpString=".xlsx") returned 5 [0048.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.106] lstrlenW (lpString=".ppt") returned 4 [0048.106] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.106] lstrlenW (lpString=".zip") returned 4 [0048.106] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.106] lstrlenW (lpString=".rar") returned 4 [0048.106] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.106] lstrlenW (lpString=".bz2") returned 4 [0048.106] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.106] lstrlenW (lpString=".7z") returned 3 [0048.106] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString=".dbf") returned 4 [0048.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString=".1cd") returned 4 [0048.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString=".jpg") returned 4 [0048.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString=".doc") returned 4 [0048.107] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.107] lstrlenW (lpString=".docx") returned 5 [0048.107] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.107] lstrlenW (lpString=".pdf") returned 4 [0048.107] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString=".xls") returned 4 [0048.107] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString=".xlsx") returned 5 [0048.107] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.107] lstrlenW (lpString=".ppt") returned 4 [0048.107] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.107] lstrlenW (lpString=".zip") returned 4 [0048.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString=".rar") returned 4 [0048.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.107] lstrlenW (lpString=".bz2") returned 4 [0048.108] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.108] lstrlenW (lpString=".7z") returned 3 [0048.108] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.108] lstrlenW (lpString=".dbf") returned 4 [0048.108] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.108] lstrlenW (lpString=".1cd") returned 4 [0048.108] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.108] lstrlenW (lpString=".jpg") returned 4 [0048.108] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.108] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0048.108] lstrlenW (lpString="PidGenX.dll") returned 11 [0048.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.108] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1463568) returned 1 [0048.108] CloseHandle (hObject=0x208) returned 1 [0048.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0048.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.109] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.109] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.109] GetLastError () returned 0x0 [0048.109] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0048.423] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0048.444] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x65520, lpOverlapped=0x0) returned 1 [0048.507] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0048.517] ReadFile (in: hFile=0x208, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.517] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x214) returned 1 [0048.518] CloseHandle (hObject=0x214) returned 1 [0048.518] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x208) returned 1 [0048.522] CloseHandle (hObject=0x208) returned 1 [0048.522] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0048.522] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0048.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.522] lstrlenW (lpString=".doc") returned 4 [0048.522] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.522] lstrlenW (lpString=".docx") returned 5 [0048.522] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.522] lstrlenW (lpString=".pdf") returned 4 [0048.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.522] lstrlenW (lpString=".xls") returned 4 [0048.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.522] lstrlenW (lpString=".xlsx") returned 5 [0048.522] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.522] lstrlenW (lpString=".ppt") returned 4 [0048.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".zip") returned 4 [0048.523] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString=".rar") returned 4 [0048.523] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString=".bz2") returned 4 [0048.523] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.523] lstrlenW (lpString=".7z") returned 3 [0048.523] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".dbf") returned 4 [0048.523] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".1cd") returned 4 [0048.523] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".jpg") returned 4 [0048.523] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".doc") returned 4 [0048.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString=".docx") returned 5 [0048.523] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.523] lstrlenW (lpString=".pdf") returned 4 [0048.523] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString=".xls") returned 4 [0048.523] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString=".xlsx") returned 5 [0048.523] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.523] lstrlenW (lpString=".ppt") returned 4 [0048.523] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.523] lstrlenW (lpString=".zip") returned 4 [0048.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.524] lstrlenW (lpString=".rar") returned 4 [0048.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.524] lstrlenW (lpString=".bz2") returned 4 [0048.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.524] lstrlenW (lpString=".7z") returned 3 [0048.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.524] lstrlenW (lpString=".dbf") returned 4 [0048.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.524] lstrlenW (lpString=".1cd") returned 4 [0048.524] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.524] lstrlenW (lpString=".jpg") returned 4 [0048.524] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.524] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0048.524] lstrlenW (lpString="ProPrWW.cab") returned 11 [0048.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.744] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=177720283) returned 1 [0048.744] CloseHandle (hObject=0x18c) returned 1 [0048.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0048.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0048.745] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0048.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.755] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.755] ReadFile (in: hFile=0x18c, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.783] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.783] ReadFile (in: hFile=0x18c, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.789] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.789] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.789] ReadFile (in: hFile=0x18c, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.806] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x18c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0049.024] SetEndOfFile (hFile=0x18c) returned 1 [0049.357] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0049.361] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x18c, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.846] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.846] WriteFile (in: hFile=0x18c, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.847] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.847] WriteFile (in: hFile=0x18c, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.849] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0049.852] CloseHandle (hObject=0x18c) returned 1 [0049.852] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0049.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.852] lstrlenW (lpString=".doc") returned 4 [0049.852] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.852] lstrlenW (lpString=".docx") returned 5 [0049.852] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.852] lstrlenW (lpString=".pdf") returned 4 [0049.852] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.852] lstrlenW (lpString=".xls") returned 4 [0049.852] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString=".xlsx") returned 5 [0049.853] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.853] lstrlenW (lpString=".ppt") returned 4 [0049.853] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString=".zip") returned 4 [0049.853] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString=".rar") returned 4 [0049.853] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString=".bz2") returned 4 [0049.853] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.853] lstrlenW (lpString=".7z") returned 3 [0049.853] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString=".dbf") returned 4 [0049.853] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString=".1cd") returned 4 [0049.853] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString=".jpg") returned 4 [0049.853] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.853] lstrlenW (lpString=".doc") returned 4 [0049.854] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString=".docx") returned 5 [0049.854] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.854] lstrlenW (lpString=".pdf") returned 4 [0049.854] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString=".xls") returned 4 [0049.854] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString=".xlsx") returned 5 [0049.854] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.854] lstrlenW (lpString=".ppt") returned 4 [0049.854] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.854] lstrlenW (lpString=".zip") returned 4 [0049.854] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString=".rar") returned 4 [0049.854] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString=".bz2") returned 4 [0049.854] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.854] lstrlenW (lpString=".7z") returned 3 [0049.854] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.854] lstrlenW (lpString=".dbf") returned 4 [0049.854] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.854] lstrlenW (lpString=".1cd") returned 4 [0049.854] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.854] lstrlenW (lpString=".jpg") returned 4 [0049.854] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.855] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0049.855] lstrlenW (lpString="osetup.dll") returned 10 [0049.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.470] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7378792) returned 1 [0050.470] CloseHandle (hObject=0x208) returned 1 [0050.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0050.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.470] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0050.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.478] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.478] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.478] ReadFile (in: hFile=0x208, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.511] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.511] ReadFile (in: hFile=0x208, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.517] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.517] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.517] ReadFile (in: hFile=0x208, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.541] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.541] WriteFile (in: hFile=0x208, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0050.696] SetEndOfFile (hFile=0x208) returned 1 [0050.696] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0050.696] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.696] WriteFile (in: hFile=0x208, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.697] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.697] WriteFile (in: hFile=0x208, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.699] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.699] WriteFile (in: hFile=0x208, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.701] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0050.701] CloseHandle (hObject=0x208) returned 1 [0050.701] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.701] lstrlenW (lpString=".doc") returned 4 [0050.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.701] lstrlenW (lpString=".docx") returned 5 [0050.701] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.701] lstrlenW (lpString=".pdf") returned 4 [0050.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.701] lstrlenW (lpString=".xls") returned 4 [0050.701] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.701] lstrlenW (lpString=".xlsx") returned 5 [0050.702] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.702] lstrlenW (lpString=".ppt") returned 4 [0050.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString=".zip") returned 4 [0050.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString=".rar") returned 4 [0050.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString=".bz2") returned 4 [0050.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.702] lstrlenW (lpString=".7z") returned 3 [0050.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString=".dbf") returned 4 [0050.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString=".1cd") returned 4 [0050.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString=".jpg") returned 4 [0050.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.702] lstrlenW (lpString=".doc") returned 4 [0050.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString=".docx") returned 5 [0050.702] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.702] lstrlenW (lpString=".pdf") returned 4 [0050.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString=".xls") returned 4 [0050.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.702] lstrlenW (lpString=".xlsx") returned 5 [0050.703] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.703] lstrlenW (lpString=".ppt") returned 4 [0050.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.703] lstrlenW (lpString=".zip") returned 4 [0050.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.703] lstrlenW (lpString=".rar") returned 4 [0050.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.703] lstrlenW (lpString=".bz2") returned 4 [0050.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.703] lstrlenW (lpString=".7z") returned 3 [0050.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.703] lstrlenW (lpString=".dbf") returned 4 [0050.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.703] lstrlenW (lpString=".1cd") returned 4 [0050.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.703] lstrlenW (lpString=".jpg") returned 4 [0050.703] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.703] lstrcmpiW (lpString1=".cab", lpString2=".zoh") returned -1 [0050.703] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0050.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.776] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=162970271) returned 1 [0050.776] CloseHandle (hObject=0x188) returned 1 [0050.783] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0050.784] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0050.784] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0050.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.784] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.784] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.784] ReadFile (in: hFile=0x188, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.834] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.834] ReadFile (in: hFile=0x188, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.889] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.889] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.889] ReadFile (in: hFile=0x188, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.919] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.919] WriteFile (in: hFile=0x188, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.937] SetEndOfFile (hFile=0x188) returned 1 [0050.937] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4048610 [0050.940] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.940] WriteFile (in: hFile=0x188, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.941] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.941] WriteFile (in: hFile=0x188, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.944] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.944] WriteFile (in: hFile=0x188, lpBuffer=0x4048610*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x4048610*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.998] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0050.998] CloseHandle (hObject=0x188) returned 1 [0050.998] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0050.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.999] lstrlenW (lpString=".doc") returned 4 [0050.999] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString=".docx") returned 5 [0050.999] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0050.999] lstrlenW (lpString=".pdf") returned 4 [0050.999] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString=".xls") returned 4 [0050.999] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString=".xlsx") returned 5 [0050.999] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0050.999] lstrlenW (lpString=".ppt") returned 4 [0050.999] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0050.999] lstrlenW (lpString=".zip") returned 4 [0050.999] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString=".rar") returned 4 [0050.999] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.999] lstrlenW (lpString=".bz2") returned 4 [0050.999] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.999] lstrlenW (lpString=".7z") returned 3 [0050.999] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString=".dbf") returned 4 [0051.000] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString=".1cd") returned 4 [0051.000] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString=".jpg") returned 4 [0051.000] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString=".doc") returned 4 [0051.000] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString=".docx") returned 5 [0051.000] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.000] lstrlenW (lpString=".pdf") returned 4 [0051.000] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString=".xls") returned 4 [0051.000] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString=".xlsx") returned 5 [0051.000] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.000] lstrlenW (lpString=".ppt") returned 4 [0051.000] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.000] lstrlenW (lpString=".zip") returned 4 [0051.001] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.001] lstrlenW (lpString=".rar") returned 4 [0051.001] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.001] lstrlenW (lpString=".bz2") returned 4 [0051.001] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.001] lstrlenW (lpString=".7z") returned 3 [0051.001] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.001] lstrlenW (lpString=".dbf") returned 4 [0051.001] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.001] lstrlenW (lpString=".1cd") returned 4 [0051.001] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.001] lstrlenW (lpString=".jpg") returned 4 [0051.001] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.001] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0051.001] lstrlenW (lpString="Office32WW.msi") returned 14 [0051.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.002] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1992192) returned 1 [0051.002] CloseHandle (hObject=0x188) returned 1 [0051.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0051.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.002] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0051.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.002] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.002] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.003] ReadFile (in: hFile=0x188, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.018] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.018] ReadFile (in: hFile=0x188, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.040] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.040] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.040] ReadFile (in: hFile=0x188, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.099] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.099] WriteFile (in: hFile=0x188, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0051.124] SetEndOfFile (hFile=0x188) returned 1 [0051.124] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0051.128] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.128] WriteFile (in: hFile=0x188, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.130] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.130] WriteFile (in: hFile=0x188, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.132] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.132] WriteFile (in: hFile=0x188, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.337] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0051.338] CloseHandle (hObject=0x188) returned 1 [0051.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.648] lstrlenW (lpString=".doc") returned 4 [0051.648] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.648] lstrlenW (lpString=".docx") returned 5 [0051.648] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.648] lstrlenW (lpString=".pdf") returned 4 [0051.648] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.648] lstrlenW (lpString=".xls") returned 4 [0051.648] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.648] lstrlenW (lpString=".xlsx") returned 5 [0051.648] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.648] lstrlenW (lpString=".ppt") returned 4 [0051.648] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.648] lstrlenW (lpString=".zip") returned 4 [0051.648] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.648] lstrlenW (lpString=".rar") returned 4 [0051.648] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString=".bz2") returned 4 [0051.649] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.649] lstrlenW (lpString=".7z") returned 3 [0051.649] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString=".dbf") returned 4 [0051.649] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString=".1cd") returned 4 [0051.649] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString=".jpg") returned 4 [0051.649] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString=".doc") returned 4 [0051.649] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.649] lstrlenW (lpString=".docx") returned 5 [0051.649] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.649] lstrlenW (lpString=".pdf") returned 4 [0051.649] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString=".xls") returned 4 [0051.649] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString=".xlsx") returned 5 [0051.649] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.649] lstrlenW (lpString=".ppt") returned 4 [0051.649] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.649] lstrlenW (lpString=".zip") returned 4 [0051.649] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString=".rar") returned 4 [0051.649] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.649] lstrlenW (lpString=".bz2") returned 4 [0051.650] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.650] lstrlenW (lpString=".7z") returned 3 [0051.650] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.650] lstrlenW (lpString=".dbf") returned 4 [0051.650] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.650] lstrlenW (lpString=".1cd") returned 4 [0051.650] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.650] lstrlenW (lpString=".jpg") returned 4 [0051.650] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.650] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0051.650] lstrlenW (lpString="PidGenX.dll") returned 11 [0051.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.650] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1463568) returned 1 [0051.650] CloseHandle (hObject=0x1f0) returned 1 [0051.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0051.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.651] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.651] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.651] GetLastError () returned 0x0 [0051.651] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.716] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.732] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x65520, lpOverlapped=0x0) returned 1 [0051.745] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0051.757] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.757] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.757] SetEndOfFile (hFile=0x210) returned 1 [0051.757] CloseHandle (hObject=0x210) returned 1 [0051.757] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.757] SetEndOfFile (hFile=0x1f0) returned 1 [0051.761] CloseHandle (hObject=0x1f0) returned 1 [0051.761] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0051.761] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0051.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString=".doc") returned 4 [0051.762] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString=".docx") returned 5 [0051.762] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.762] lstrlenW (lpString=".pdf") returned 4 [0051.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString=".xls") returned 4 [0051.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString=".xlsx") returned 5 [0051.762] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.762] lstrlenW (lpString=".ppt") returned 4 [0051.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString=".zip") returned 4 [0051.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString=".rar") returned 4 [0051.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString=".bz2") returned 4 [0051.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.762] lstrlenW (lpString=".7z") returned 3 [0051.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString=".dbf") returned 4 [0051.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString=".1cd") returned 4 [0051.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString=".jpg") returned 4 [0051.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.763] lstrlenW (lpString=".doc") returned 4 [0051.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".docx") returned 5 [0051.763] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.763] lstrlenW (lpString=".pdf") returned 4 [0051.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".xls") returned 4 [0051.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".xlsx") returned 5 [0051.763] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.763] lstrlenW (lpString=".ppt") returned 4 [0051.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.763] lstrlenW (lpString=".zip") returned 4 [0051.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".rar") returned 4 [0051.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".bz2") returned 4 [0051.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.763] lstrlenW (lpString=".7z") returned 3 [0051.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.763] lstrlenW (lpString=".dbf") returned 4 [0051.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.763] lstrlenW (lpString=".1cd") returned 4 [0051.763] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.763] lstrlenW (lpString=".jpg") returned 4 [0051.763] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.763] lstrcmpiW (lpString1=".xrm-ms", lpString2=".zoh") returned -1 [0051.764] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0051.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.764] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=715834) returned 1 [0051.764] CloseHandle (hObject=0x1f0) returned 1 [0051.764] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0051.764] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0051.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.764] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.764] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.765] GetLastError () returned 0x0 [0051.765] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0051.984] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0052.005] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.005] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x104, lpOverlapped=0x0) returned 1 [0052.006] SetEndOfFile (hFile=0x210) returned 1 [0052.006] CloseHandle (hObject=0x210) returned 1 [0052.006] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.006] SetEndOfFile (hFile=0x1f0) returned 1 [0052.012] CloseHandle (hObject=0x1f0) returned 1 [0052.012] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0052.012] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0052.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.012] lstrlenW (lpString=".doc") returned 4 [0052.012] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.012] lstrlenW (lpString=".docx") returned 5 [0052.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.013] lstrlenW (lpString=".pdf") returned 4 [0052.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".xls") returned 4 [0052.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".xlsx") returned 5 [0052.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.013] lstrlenW (lpString=".ppt") returned 4 [0052.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString=".zip") returned 4 [0052.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".rar") returned 4 [0052.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".bz2") returned 4 [0052.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".7z") returned 3 [0052.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString=".dbf") returned 4 [0052.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString=".1cd") returned 4 [0052.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString=".jpg") returned 4 [0052.013] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.013] lstrlenW (lpString=".doc") returned 4 [0052.013] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.013] lstrlenW (lpString=".docx") returned 5 [0052.014] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.014] lstrlenW (lpString=".pdf") returned 4 [0052.014] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString=".xls") returned 4 [0052.014] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString=".xlsx") returned 5 [0052.014] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.014] lstrlenW (lpString=".ppt") returned 4 [0052.014] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.014] lstrlenW (lpString=".zip") returned 4 [0052.014] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString=".rar") returned 4 [0052.014] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString=".bz2") returned 4 [0052.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString=".7z") returned 3 [0052.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.014] lstrlenW (lpString=".dbf") returned 4 [0052.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.014] lstrlenW (lpString=".1cd") returned 4 [0052.014] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.014] lstrlenW (lpString=".jpg") returned 4 [0052.014] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.014] lstrcmpiW (lpString1=".msi", lpString2=".zoh") returned -1 [0052.015] lstrlenW (lpString="VisiorWW.msi") returned 12 [0052.015] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.015] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12060672) returned 1 [0052.015] CloseHandle (hObject=0x1f0) returned 1 [0052.015] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0052.015] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.015] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0052.016] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.016] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.205] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.205] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.212] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.212] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.213] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.228] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.228] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.315] SetEndOfFile (hFile=0x1f0) returned 1 [0052.315] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0052.319] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.319] WriteFile (in: hFile=0x1f0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.321] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.321] WriteFile (in: hFile=0x1f0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.327] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.327] WriteFile (in: hFile=0x1f0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.329] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0052.329] CloseHandle (hObject=0x1f0) returned 1 [0052.329] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x2020) returned 1 [0052.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.330] lstrlenW (lpString=".doc") returned 4 [0052.330] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.330] lstrlenW (lpString=".docx") returned 5 [0052.330] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.330] lstrlenW (lpString=".pdf") returned 4 [0052.330] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.330] lstrlenW (lpString=".xls") returned 4 [0052.330] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.330] lstrlenW (lpString=".xlsx") returned 5 [0052.330] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.330] lstrlenW (lpString=".ppt") returned 4 [0052.330] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.330] lstrlenW (lpString=".zip") returned 4 [0052.330] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.330] lstrlenW (lpString=".rar") returned 4 [0052.330] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.330] lstrlenW (lpString=".bz2") returned 4 [0052.330] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.330] lstrlenW (lpString=".7z") returned 3 [0052.330] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.330] lstrlenW (lpString=".dbf") returned 4 [0052.330] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString=".1cd") returned 4 [0052.331] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString=".jpg") returned 4 [0052.331] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString=".doc") returned 4 [0052.331] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.331] lstrlenW (lpString=".docx") returned 5 [0052.331] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.331] lstrlenW (lpString=".pdf") returned 4 [0052.331] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.331] lstrlenW (lpString=".xls") returned 4 [0052.331] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.331] lstrlenW (lpString=".xlsx") returned 5 [0052.331] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.331] lstrlenW (lpString=".ppt") returned 4 [0052.331] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString=".zip") returned 4 [0052.331] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.331] lstrlenW (lpString=".rar") returned 4 [0052.331] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.331] lstrlenW (lpString=".bz2") returned 4 [0052.331] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.331] lstrlenW (lpString=".7z") returned 3 [0052.331] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.331] lstrlenW (lpString=".dbf") returned 4 [0052.331] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.332] lstrlenW (lpString=".1cd") returned 4 [0052.332] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.332] lstrlenW (lpString=".jpg") returned 4 [0052.332] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.332] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0052.332] lstrlenW (lpString="EEINTL.DLL") returned 10 [0052.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.333] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=64096) returned 1 [0052.333] CloseHandle (hObject=0x1f0) returned 1 [0052.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0052.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.334] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.334] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0052.336] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0052.338] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.338] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.338] SetEndOfFile (hFile=0x220) returned 1 [0052.338] CloseHandle (hObject=0x220) returned 1 [0052.338] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.338] SetEndOfFile (hFile=0x1f0) returned 1 [0052.340] CloseHandle (hObject=0x1f0) returned 1 [0052.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0052.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.340] lstrlenW (lpString=".doc") returned 4 [0052.340] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.340] lstrlenW (lpString=".docx") returned 5 [0052.340] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.340] lstrlenW (lpString=".pdf") returned 4 [0052.340] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.340] lstrlenW (lpString=".xls") returned 4 [0052.340] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.340] lstrlenW (lpString=".xlsx") returned 5 [0052.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.340] lstrlenW (lpString=".ppt") returned 4 [0052.340] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.340] lstrlenW (lpString=".zip") returned 4 [0052.340] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString=".rar") returned 4 [0052.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString=".bz2") returned 4 [0052.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.341] lstrlenW (lpString=".7z") returned 3 [0052.341] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString=".dbf") returned 4 [0052.341] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString=".1cd") returned 4 [0052.341] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString=".jpg") returned 4 [0052.341] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString=".doc") returned 4 [0052.341] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString=".docx") returned 5 [0052.341] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.341] lstrlenW (lpString=".pdf") returned 4 [0052.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString=".xls") returned 4 [0052.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString=".xlsx") returned 5 [0052.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.341] lstrlenW (lpString=".ppt") returned 4 [0052.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.341] lstrlenW (lpString=".zip") returned 4 [0052.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.342] lstrlenW (lpString=".rar") returned 4 [0052.342] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.342] lstrlenW (lpString=".bz2") returned 4 [0052.342] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.342] lstrlenW (lpString=".7z") returned 3 [0052.342] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.342] lstrlenW (lpString=".dbf") returned 4 [0052.342] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.342] lstrlenW (lpString=".1cd") returned 4 [0052.342] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.342] lstrlenW (lpString=".jpg") returned 4 [0052.342] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.342] lstrcmpiW (lpString1=".CNT", lpString2=".zoh") returned -1 [0052.342] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0052.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.450] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2557) returned 1 [0052.450] CloseHandle (hObject=0x220) returned 1 [0052.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0052.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.451] GetLastError () returned 0x0 [0052.451] ReadFile (in: hFile=0x220, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0052.453] WriteFile (in: hFile=0x218, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0052.454] ReadFile (in: hFile=0x220, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.454] WriteFile (in: hFile=0x218, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.454] SetEndOfFile (hFile=0x218) returned 1 [0052.454] CloseHandle (hObject=0x218) returned 1 [0052.454] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.454] SetEndOfFile (hFile=0x220) returned 1 [0052.455] CloseHandle (hObject=0x220) returned 1 [0052.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString=".doc") returned 4 [0052.456] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString=".docx") returned 5 [0052.456] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.456] lstrlenW (lpString=".pdf") returned 4 [0052.456] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString=".xls") returned 4 [0052.456] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString=".xlsx") returned 5 [0052.456] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.456] lstrlenW (lpString=".ppt") returned 4 [0052.456] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString=".zip") returned 4 [0052.456] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString=".rar") returned 4 [0052.456] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString=".bz2") returned 4 [0052.456] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.456] lstrlenW (lpString=".7z") returned 3 [0052.456] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString=".dbf") returned 4 [0052.456] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString=".1cd") returned 4 [0052.456] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.456] lstrlenW (lpString=".jpg") returned 4 [0052.456] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString=".doc") returned 4 [0052.457] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString=".docx") returned 5 [0052.457] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.457] lstrlenW (lpString=".pdf") returned 4 [0052.457] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString=".xls") returned 4 [0052.457] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString=".xlsx") returned 5 [0052.457] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.457] lstrlenW (lpString=".ppt") returned 4 [0052.457] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString=".zip") returned 4 [0052.457] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString=".rar") returned 4 [0052.457] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString=".bz2") returned 4 [0052.457] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.457] lstrlenW (lpString=".7z") returned 3 [0052.457] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString=".dbf") returned 4 [0052.457] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString=".1cd") returned 4 [0052.457] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.457] lstrlenW (lpString=".jpg") returned 4 [0052.457] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.458] lstrcmpiW (lpString1=".EXE", lpString2=".zoh") returned -1 [0052.458] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0052.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.458] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=543304) returned 1 [0052.458] CloseHandle (hObject=0x220) returned 1 [0052.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0052.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.458] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.458] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0052.459] GetLastError () returned 0x0 [0052.459] ReadFile (in: hFile=0x220, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0052.471] WriteFile (in: hFile=0x218, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0052.481] ReadFile (in: hFile=0x220, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.481] WriteFile (in: hFile=0x218, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.481] SetEndOfFile (hFile=0x218) returned 1 [0052.481] CloseHandle (hObject=0x218) returned 1 [0052.481] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.481] SetEndOfFile (hFile=0x220) returned 1 [0052.486] CloseHandle (hObject=0x220) returned 1 [0052.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0052.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.489] lstrlenW (lpString=".doc") returned 4 [0052.489] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.489] lstrlenW (lpString=".docx") returned 5 [0052.489] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.489] lstrlenW (lpString=".pdf") returned 4 [0052.489] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.584] lstrlenW (lpString=".xls") returned 4 [0052.584] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.584] lstrlenW (lpString=".xlsx") returned 5 [0052.584] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.584] lstrlenW (lpString=".ppt") returned 4 [0052.584] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.584] lstrlenW (lpString=".zip") returned 4 [0052.584] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.584] lstrlenW (lpString=".rar") returned 4 [0052.584] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.584] lstrlenW (lpString=".bz2") returned 4 [0052.584] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.584] lstrlenW (lpString=".7z") returned 3 [0052.584] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.584] lstrlenW (lpString=".dbf") returned 4 [0052.584] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.584] lstrlenW (lpString=".1cd") returned 4 [0052.584] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.584] lstrlenW (lpString=".jpg") returned 4 [0052.584] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString=".doc") returned 4 [0052.585] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.585] lstrlenW (lpString=".docx") returned 5 [0052.585] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.585] lstrlenW (lpString=".pdf") returned 4 [0052.585] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString=".xls") returned 4 [0052.585] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString=".xlsx") returned 5 [0052.585] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.585] lstrlenW (lpString=".ppt") returned 4 [0052.585] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString=".zip") returned 4 [0052.585] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString=".rar") returned 4 [0052.585] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.585] lstrlenW (lpString=".bz2") returned 4 [0052.585] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.585] lstrlenW (lpString=".7z") returned 3 [0052.585] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString=".dbf") returned 4 [0052.585] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString=".1cd") returned 4 [0052.585] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.585] lstrlenW (lpString=".jpg") returned 4 [0052.585] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.586] lstrcmpiW (lpString1=".manifest", lpString2=".zoh") returned -1 [0052.586] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0052.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.586] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=566) returned 1 [0052.586] CloseHandle (hObject=0x160) returned 1 [0052.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0052.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.587] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.587] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.587] GetLastError () returned 0x0 [0052.587] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x236, lpOverlapped=0x0) returned 1 [0052.588] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x240, lpOverlapped=0x0) returned 1 [0052.589] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.589] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0052.589] SetEndOfFile (hFile=0x220) returned 1 [0052.589] CloseHandle (hObject=0x220) returned 1 [0052.589] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.589] SetEndOfFile (hFile=0x160) returned 1 [0052.590] CloseHandle (hObject=0x160) returned 1 [0052.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.590] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString=".doc") returned 4 [0052.591] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".docx") returned 5 [0052.591] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.591] lstrlenW (lpString=".pdf") returned 4 [0052.591] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".xls") returned 4 [0052.591] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".xlsx") returned 5 [0052.591] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.591] lstrlenW (lpString=".ppt") returned 4 [0052.591] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString=".zip") returned 4 [0052.591] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".rar") returned 4 [0052.591] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".bz2") returned 4 [0052.591] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString=".7z") returned 3 [0052.591] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString=".dbf") returned 4 [0052.591] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString=".1cd") returned 4 [0052.591] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.591] lstrlenW (lpString=".jpg") returned 4 [0052.591] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString=".doc") returned 4 [0052.592] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".docx") returned 5 [0052.592] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.592] lstrlenW (lpString=".pdf") returned 4 [0052.592] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".xls") returned 4 [0052.592] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".xlsx") returned 5 [0052.592] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.592] lstrlenW (lpString=".ppt") returned 4 [0052.592] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString=".zip") returned 4 [0052.592] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".rar") returned 4 [0052.592] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".bz2") returned 4 [0052.592] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString=".7z") returned 3 [0052.592] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString=".dbf") returned 4 [0052.592] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString=".1cd") returned 4 [0052.592] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.592] lstrlenW (lpString=".jpg") returned 4 [0052.592] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.593] lstrcmpiW (lpString1=".HLP", lpString2=".zoh") returned -1 [0052.593] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0052.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.593] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=176311) returned 1 [0052.593] CloseHandle (hObject=0x160) returned 1 [0052.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0052.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.593] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.593] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.594] GetLastError () returned 0x0 [0052.594] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0052.599] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0052.602] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.602] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.602] SetEndOfFile (hFile=0x220) returned 1 [0052.602] CloseHandle (hObject=0x220) returned 1 [0052.602] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.602] SetEndOfFile (hFile=0x160) returned 1 [0052.604] CloseHandle (hObject=0x160) returned 1 [0052.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0052.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.604] lstrlenW (lpString=".doc") returned 4 [0052.604] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.604] lstrlenW (lpString=".docx") returned 5 [0052.604] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.604] lstrlenW (lpString=".pdf") returned 4 [0052.604] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.604] lstrlenW (lpString=".xls") returned 4 [0052.604] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.604] lstrlenW (lpString=".xlsx") returned 5 [0052.604] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.604] lstrlenW (lpString=".ppt") returned 4 [0052.605] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString=".zip") returned 4 [0052.605] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString=".rar") returned 4 [0052.605] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString=".bz2") returned 4 [0052.605] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.605] lstrlenW (lpString=".7z") returned 3 [0052.605] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString=".dbf") returned 4 [0052.605] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString=".1cd") returned 4 [0052.605] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString=".jpg") returned 4 [0052.605] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.605] lstrlenW (lpString=".doc") returned 4 [0052.605] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.605] lstrlenW (lpString=".docx") returned 5 [0052.605] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.605] lstrlenW (lpString=".pdf") returned 4 [0052.605] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString=".xls") returned 4 [0052.605] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.605] lstrlenW (lpString=".xlsx") returned 5 [0052.605] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.605] lstrlenW (lpString=".ppt") returned 4 [0052.606] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.606] lstrlenW (lpString=".zip") returned 4 [0052.606] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.606] lstrlenW (lpString=".rar") returned 4 [0052.606] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.606] lstrlenW (lpString=".bz2") returned 4 [0052.606] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.606] lstrlenW (lpString=".7z") returned 3 [0052.606] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.606] lstrlenW (lpString=".dbf") returned 4 [0052.606] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.606] lstrlenW (lpString=".1cd") returned 4 [0052.606] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.606] lstrlenW (lpString=".jpg") returned 4 [0052.606] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.606] lstrcmpiW (lpString1=".TTF", lpString2=".zoh") returned -1 [0052.606] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0052.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.607] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7656) returned 1 [0052.607] CloseHandle (hObject=0x160) returned 1 [0052.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0052.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.607] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.607] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.608] GetLastError () returned 0x0 [0052.608] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0052.611] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0052.612] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.612] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.612] SetEndOfFile (hFile=0x220) returned 1 [0052.612] CloseHandle (hObject=0x220) returned 1 [0052.612] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.612] SetEndOfFile (hFile=0x160) returned 1 [0052.613] CloseHandle (hObject=0x160) returned 1 [0052.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString=".doc") returned 4 [0052.614] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString=".docx") returned 5 [0052.614] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.614] lstrlenW (lpString=".pdf") returned 4 [0052.614] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString=".xls") returned 4 [0052.614] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.614] lstrlenW (lpString=".xlsx") returned 5 [0052.614] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.614] lstrlenW (lpString=".ppt") returned 4 [0052.614] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString=".zip") returned 4 [0052.614] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.614] lstrlenW (lpString=".rar") returned 4 [0052.614] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString=".bz2") returned 4 [0052.614] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString=".7z") returned 3 [0052.614] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString=".dbf") returned 4 [0052.614] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString=".1cd") returned 4 [0052.614] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.614] lstrlenW (lpString=".jpg") returned 4 [0052.614] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString=".doc") returned 4 [0052.615] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString=".docx") returned 5 [0052.615] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.615] lstrlenW (lpString=".pdf") returned 4 [0052.615] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString=".xls") returned 4 [0052.615] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.615] lstrlenW (lpString=".xlsx") returned 5 [0052.615] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.615] lstrlenW (lpString=".ppt") returned 4 [0052.615] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString=".zip") returned 4 [0052.615] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.615] lstrlenW (lpString=".rar") returned 4 [0052.615] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString=".bz2") returned 4 [0052.615] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString=".7z") returned 3 [0052.615] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString=".dbf") returned 4 [0052.615] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString=".1cd") returned 4 [0052.615] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.615] lstrlenW (lpString=".jpg") returned 4 [0052.615] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.616] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0052.616] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0052.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.616] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=31104) returned 1 [0052.616] CloseHandle (hObject=0x160) returned 1 [0052.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0052.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0052.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.617] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.617] GetLastError () returned 0x0 [0052.617] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7980, lpOverlapped=0x0) returned 1 [0052.678] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0052.679] ReadFile (in: hFile=0x160, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.679] WriteFile (in: hFile=0x220, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.680] SetEndOfFile (hFile=0x220) returned 1 [0052.680] CloseHandle (hObject=0x220) returned 1 [0052.680] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.680] SetEndOfFile (hFile=0x160) returned 1 [0052.681] CloseHandle (hObject=0x160) returned 1 [0052.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0052.681] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0052.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.681] lstrlenW (lpString=".doc") returned 4 [0052.681] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.681] lstrlenW (lpString=".docx") returned 5 [0052.681] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.682] lstrlenW (lpString=".pdf") returned 4 [0052.682] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString=".xls") returned 4 [0052.682] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString=".xlsx") returned 5 [0052.682] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.682] lstrlenW (lpString=".ppt") returned 4 [0052.682] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString=".zip") returned 4 [0052.682] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString=".rar") returned 4 [0052.682] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString=".bz2") returned 4 [0052.682] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.682] lstrlenW (lpString=".7z") returned 3 [0052.682] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString=".dbf") returned 4 [0052.682] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString=".1cd") returned 4 [0052.682] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString=".jpg") returned 4 [0052.682] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.682] lstrlenW (lpString=".doc") returned 4 [0052.682] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.682] lstrlenW (lpString=".docx") returned 5 [0052.682] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.683] lstrlenW (lpString=".pdf") returned 4 [0052.683] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.683] lstrlenW (lpString=".xls") returned 4 [0052.683] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.683] lstrlenW (lpString=".xlsx") returned 5 [0052.683] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.683] lstrlenW (lpString=".ppt") returned 4 [0052.683] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.683] lstrlenW (lpString=".zip") returned 4 [0052.683] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.683] lstrlenW (lpString=".rar") returned 4 [0052.683] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.683] lstrlenW (lpString=".bz2") returned 4 [0052.683] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.683] lstrlenW (lpString=".7z") returned 3 [0052.683] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.683] lstrlenW (lpString=".dbf") returned 4 [0052.683] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.683] lstrlenW (lpString=".1cd") returned 4 [0052.683] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.683] lstrlenW (lpString=".jpg") returned 4 [0052.683] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.683] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0052.683] lstrlenW (lpString="odffilt.dll") returned 11 [0052.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0053.178] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1312656) returned 1 [0053.178] CloseHandle (hObject=0x1f8) returned 1 [0053.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0053.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0053.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0053.178] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.178] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.190] GetLastError () returned 0x0 [0054.190] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.253] WriteFile (in: hFile=0x208, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.826] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0054.838] WriteFile (in: hFile=0x208, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0054.846] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.847] WriteFile (in: hFile=0x208, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.847] SetEndOfFile (hFile=0x208) returned 1 [0054.847] CloseHandle (hObject=0x208) returned 1 [0054.847] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.847] SetEndOfFile (hFile=0x1f8) returned 1 [0054.850] CloseHandle (hObject=0x1f8) returned 1 [0054.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0054.850] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0054.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.850] lstrlenW (lpString=".doc") returned 4 [0054.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".docx") returned 5 [0054.851] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.851] lstrlenW (lpString=".pdf") returned 4 [0054.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".xls") returned 4 [0054.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".xlsx") returned 5 [0054.851] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.851] lstrlenW (lpString=".ppt") returned 4 [0054.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.851] lstrlenW (lpString=".zip") returned 4 [0054.851] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".rar") returned 4 [0054.851] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".bz2") returned 4 [0054.851] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.851] lstrlenW (lpString=".7z") returned 3 [0054.851] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.851] lstrlenW (lpString=".dbf") returned 4 [0054.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.851] lstrlenW (lpString=".1cd") returned 4 [0054.851] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.851] lstrlenW (lpString=".jpg") returned 4 [0054.851] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.852] lstrlenW (lpString=".doc") returned 4 [0054.852] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString=".docx") returned 5 [0054.852] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.852] lstrlenW (lpString=".pdf") returned 4 [0054.852] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString=".xls") returned 4 [0054.852] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString=".xlsx") returned 5 [0054.852] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.852] lstrlenW (lpString=".ppt") returned 4 [0054.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.852] lstrlenW (lpString=".zip") returned 4 [0054.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString=".rar") returned 4 [0054.852] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.852] lstrlenW (lpString=".bz2") returned 4 [0054.852] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.852] lstrlenW (lpString=".7z") returned 3 [0054.852] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.852] lstrlenW (lpString=".dbf") returned 4 [0054.852] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.852] lstrlenW (lpString=".1cd") returned 4 [0054.852] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.852] lstrlenW (lpString=".jpg") returned 4 [0054.852] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.853] lstrcmpiW (lpString1=".FLT", lpString2=".zoh") returned -1 [0054.853] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0054.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.416] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=320384) returned 1 [0056.416] CloseHandle (hObject=0x1ec) returned 1 [0056.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0056.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.416] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.416] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.417] GetLastError () returned 0x0 [0056.417] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0056.432] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0056.438] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.438] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.438] SetEndOfFile (hFile=0x22c) returned 1 [0056.439] CloseHandle (hObject=0x22c) returned 1 [0056.439] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.439] SetEndOfFile (hFile=0x1ec) returned 1 [0056.442] CloseHandle (hObject=0x1ec) returned 1 [0056.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.442] lstrlenW (lpString=".doc") returned 4 [0056.442] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.442] lstrlenW (lpString=".docx") returned 5 [0056.442] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.442] lstrlenW (lpString=".pdf") returned 4 [0056.442] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.442] lstrlenW (lpString=".xls") returned 4 [0056.443] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString=".xlsx") returned 5 [0056.443] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.443] lstrlenW (lpString=".ppt") returned 4 [0056.443] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString=".zip") returned 4 [0056.443] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString=".rar") returned 4 [0056.443] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString=".bz2") returned 4 [0056.443] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.443] lstrlenW (lpString=".7z") returned 3 [0056.443] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString=".dbf") returned 4 [0056.443] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString=".1cd") returned 4 [0056.443] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString=".jpg") returned 4 [0056.443] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.443] lstrlenW (lpString=".doc") returned 4 [0056.443] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.443] lstrlenW (lpString=".docx") returned 5 [0056.443] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.443] lstrlenW (lpString=".pdf") returned 4 [0056.443] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString=".xls") returned 4 [0056.443] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.443] lstrlenW (lpString=".xlsx") returned 5 [0056.444] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.444] lstrlenW (lpString=".ppt") returned 4 [0056.444] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.444] lstrlenW (lpString=".zip") returned 4 [0056.444] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.444] lstrlenW (lpString=".rar") returned 4 [0056.444] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.444] lstrlenW (lpString=".bz2") returned 4 [0056.444] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.444] lstrlenW (lpString=".7z") returned 3 [0056.444] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.444] lstrlenW (lpString=".dbf") returned 4 [0056.444] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.444] lstrlenW (lpString=".1cd") returned 4 [0056.444] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0056.444] lstrlenW (lpString=".jpg") returned 4 [0056.444] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.444] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0056.444] lstrlenW (lpString="hxds.dll") returned 8 [0056.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.446] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1257984) returned 1 [0056.446] CloseHandle (hObject=0x1ec) returned 1 [0056.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0056.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.446] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.446] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0056.447] GetLastError () returned 0x0 [0056.447] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0056.564] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0056.580] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x33210, lpOverlapped=0x0) returned 1 [0056.590] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0056.710] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.710] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0056.710] SetEndOfFile (hFile=0x22c) returned 1 [0056.710] CloseHandle (hObject=0x22c) returned 1 [0056.715] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.716] SetEndOfFile (hFile=0x1ec) returned 1 [0056.938] CloseHandle (hObject=0x1ec) returned 1 [0056.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0056.938] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0056.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.938] lstrlenW (lpString=".doc") returned 4 [0056.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.938] lstrlenW (lpString=".docx") returned 5 [0056.938] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.939] lstrlenW (lpString=".pdf") returned 4 [0056.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString=".xls") returned 4 [0056.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString=".xlsx") returned 5 [0056.939] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.939] lstrlenW (lpString=".ppt") returned 4 [0056.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString=".zip") returned 4 [0056.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString=".rar") returned 4 [0056.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString=".bz2") returned 4 [0056.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.939] lstrlenW (lpString=".7z") returned 3 [0056.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString=".dbf") returned 4 [0056.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString=".1cd") returned 4 [0056.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString=".jpg") returned 4 [0056.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.939] lstrlenW (lpString=".doc") returned 4 [0056.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.939] lstrlenW (lpString=".docx") returned 5 [0056.939] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.939] lstrlenW (lpString=".pdf") returned 4 [0056.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.940] lstrlenW (lpString=".xls") returned 4 [0056.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.940] lstrlenW (lpString=".xlsx") returned 5 [0056.940] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.940] lstrlenW (lpString=".ppt") returned 4 [0056.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.940] lstrlenW (lpString=".zip") returned 4 [0056.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.940] lstrlenW (lpString=".rar") returned 4 [0056.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.940] lstrlenW (lpString=".bz2") returned 4 [0056.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.940] lstrlenW (lpString=".7z") returned 3 [0056.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.940] lstrlenW (lpString=".dbf") returned 4 [0056.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.940] lstrlenW (lpString=".1cd") returned 4 [0056.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0056.940] lstrlenW (lpString=".jpg") returned 4 [0056.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.940] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.940] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.954] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4096) returned 1 [0056.954] CloseHandle (hObject=0x1ec) returned 1 [0056.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0056.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.955] lstrlenW (lpString=".doc") returned 4 [0056.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.955] lstrlenW (lpString=".docx") returned 5 [0056.955] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.955] lstrlenW (lpString=".pdf") returned 4 [0056.955] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.955] lstrlenW (lpString=".xls") returned 4 [0056.955] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.955] lstrlenW (lpString=".xlsx") returned 5 [0056.955] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.955] lstrlenW (lpString=".ppt") returned 4 [0056.955] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.955] lstrlenW (lpString=".zip") returned 4 [0056.955] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.955] lstrlenW (lpString=".rar") returned 4 [0056.955] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.955] lstrlenW (lpString=".bz2") returned 4 [0056.955] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.955] lstrlenW (lpString=".7z") returned 3 [0056.955] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.955] lstrlenW (lpString=".dbf") returned 4 [0056.955] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".1cd") returned 4 [0056.956] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".jpg") returned 4 [0056.956] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".doc") returned 4 [0056.956] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.956] lstrlenW (lpString=".docx") returned 5 [0056.956] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.956] lstrlenW (lpString=".pdf") returned 4 [0056.956] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.956] lstrlenW (lpString=".xls") returned 4 [0056.956] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.956] lstrlenW (lpString=".xlsx") returned 5 [0056.956] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.956] lstrlenW (lpString=".ppt") returned 4 [0056.956] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".zip") returned 4 [0056.956] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.956] lstrlenW (lpString=".rar") returned 4 [0056.956] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.956] lstrlenW (lpString=".bz2") returned 4 [0056.956] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.956] lstrlenW (lpString=".7z") returned 3 [0056.956] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".dbf") returned 4 [0056.956] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.956] lstrlenW (lpString=".1cd") returned 4 [0056.957] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0056.957] lstrlenW (lpString=".jpg") returned 4 [0056.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.957] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.957] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0056.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.957] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4608) returned 1 [0056.957] CloseHandle (hObject=0x1ec) returned 1 [0056.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0056.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString=".doc") returned 4 [0056.958] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.958] lstrlenW (lpString=".docx") returned 5 [0056.958] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.958] lstrlenW (lpString=".pdf") returned 4 [0056.958] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.958] lstrlenW (lpString=".xls") returned 4 [0056.958] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.958] lstrlenW (lpString=".xlsx") returned 5 [0056.958] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.958] lstrlenW (lpString=".ppt") returned 4 [0056.958] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString=".zip") returned 4 [0056.958] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.958] lstrlenW (lpString=".rar") returned 4 [0056.958] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.958] lstrlenW (lpString=".bz2") returned 4 [0056.958] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.958] lstrlenW (lpString=".7z") returned 3 [0056.958] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString=".dbf") returned 4 [0056.958] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString=".1cd") returned 4 [0056.958] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.958] lstrlenW (lpString=".jpg") returned 4 [0056.958] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString=".doc") returned 4 [0056.959] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.959] lstrlenW (lpString=".docx") returned 5 [0056.959] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.959] lstrlenW (lpString=".pdf") returned 4 [0056.959] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.959] lstrlenW (lpString=".xls") returned 4 [0056.959] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.959] lstrlenW (lpString=".xlsx") returned 5 [0056.959] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.959] lstrlenW (lpString=".ppt") returned 4 [0056.959] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString=".zip") returned 4 [0056.959] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.959] lstrlenW (lpString=".rar") returned 4 [0056.959] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.959] lstrlenW (lpString=".bz2") returned 4 [0056.959] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.959] lstrlenW (lpString=".7z") returned 3 [0056.959] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString=".dbf") returned 4 [0056.959] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString=".1cd") returned 4 [0056.959] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0056.959] lstrlenW (lpString=".jpg") returned 4 [0056.959] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.960] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.960] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0056.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.988] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9216) returned 1 [0056.988] CloseHandle (hObject=0x190) returned 1 [0056.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0056.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.989] lstrlenW (lpString=".doc") returned 4 [0056.989] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.989] lstrlenW (lpString=".docx") returned 5 [0056.989] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0056.989] lstrlenW (lpString=".pdf") returned 4 [0056.989] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.989] lstrlenW (lpString=".xls") returned 4 [0056.989] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.989] lstrlenW (lpString=".xlsx") returned 5 [0056.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0056.989] lstrlenW (lpString=".ppt") returned 4 [0056.989] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.989] lstrlenW (lpString=".zip") returned 4 [0056.989] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.989] lstrlenW (lpString=".rar") returned 4 [0056.989] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.989] lstrlenW (lpString=".bz2") returned 4 [0056.989] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.989] lstrlenW (lpString=".7z") returned 3 [0056.989] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.989] lstrlenW (lpString=".dbf") returned 4 [0056.989] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.989] lstrlenW (lpString=".1cd") returned 4 [0056.989] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString=".jpg") returned 4 [0056.990] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString=".doc") returned 4 [0056.990] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.990] lstrlenW (lpString=".docx") returned 5 [0056.990] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0056.990] lstrlenW (lpString=".pdf") returned 4 [0056.990] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.990] lstrlenW (lpString=".xls") returned 4 [0056.990] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.990] lstrlenW (lpString=".xlsx") returned 5 [0056.990] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0056.990] lstrlenW (lpString=".ppt") returned 4 [0056.990] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString=".zip") returned 4 [0056.990] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.990] lstrlenW (lpString=".rar") returned 4 [0056.990] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.990] lstrlenW (lpString=".bz2") returned 4 [0056.990] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.990] lstrlenW (lpString=".7z") returned 3 [0056.990] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString=".dbf") returned 4 [0056.990] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.990] lstrlenW (lpString=".1cd") returned 4 [0056.990] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0056.991] lstrlenW (lpString=".jpg") returned 4 [0056.991] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.991] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0056.991] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0056.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.991] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=40960) returned 1 [0056.991] CloseHandle (hObject=0x190) returned 1 [0056.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0056.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".doc") returned 4 [0056.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString=".docx") returned 5 [0056.992] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0056.992] lstrlenW (lpString=".pdf") returned 4 [0056.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString=".xls") returned 4 [0056.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString=".xlsx") returned 5 [0056.992] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0056.992] lstrlenW (lpString=".ppt") returned 4 [0056.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".zip") returned 4 [0056.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString=".rar") returned 4 [0056.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString=".bz2") returned 4 [0056.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.992] lstrlenW (lpString=".7z") returned 3 [0056.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".dbf") returned 4 [0056.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".1cd") returned 4 [0056.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".jpg") returned 4 [0056.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.992] lstrlenW (lpString=".doc") returned 4 [0056.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString=".docx") returned 5 [0056.993] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0056.993] lstrlenW (lpString=".pdf") returned 4 [0056.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString=".xls") returned 4 [0056.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString=".xlsx") returned 5 [0056.993] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0056.993] lstrlenW (lpString=".ppt") returned 4 [0056.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.993] lstrlenW (lpString=".zip") returned 4 [0056.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString=".rar") returned 4 [0056.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.993] lstrlenW (lpString=".bz2") returned 4 [0056.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.993] lstrlenW (lpString=".7z") returned 3 [0056.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.993] lstrlenW (lpString=".dbf") returned 4 [0056.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.993] lstrlenW (lpString=".1cd") returned 4 [0056.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0056.993] lstrlenW (lpString=".jpg") returned 4 [0056.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.994] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0056.994] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0056.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.994] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=94720) returned 1 [0056.994] CloseHandle (hObject=0x190) returned 1 [0056.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0056.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.994] lstrlenW (lpString=".doc") returned 4 [0056.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.994] lstrlenW (lpString=".docx") returned 5 [0056.994] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0056.994] lstrlenW (lpString=".pdf") returned 4 [0056.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.994] lstrlenW (lpString=".xls") returned 4 [0056.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString=".xlsx") returned 5 [0056.995] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0056.995] lstrlenW (lpString=".ppt") returned 4 [0056.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString=".zip") returned 4 [0056.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString=".rar") returned 4 [0056.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString=".bz2") returned 4 [0056.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.995] lstrlenW (lpString=".7z") returned 3 [0056.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString=".dbf") returned 4 [0056.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString=".1cd") returned 4 [0056.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString=".jpg") returned 4 [0056.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.995] lstrlenW (lpString=".doc") returned 4 [0056.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString=".docx") returned 5 [0056.995] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0056.995] lstrlenW (lpString=".pdf") returned 4 [0056.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.995] lstrlenW (lpString=".xls") returned 4 [0056.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.996] lstrlenW (lpString=".xlsx") returned 5 [0056.996] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0056.996] lstrlenW (lpString=".ppt") returned 4 [0056.996] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.996] lstrlenW (lpString=".zip") returned 4 [0056.996] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.996] lstrlenW (lpString=".rar") returned 4 [0056.996] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.996] lstrlenW (lpString=".bz2") returned 4 [0056.996] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.996] lstrlenW (lpString=".7z") returned 3 [0056.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.996] lstrlenW (lpString=".dbf") returned 4 [0056.996] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.996] lstrlenW (lpString=".1cd") returned 4 [0056.996] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0056.996] lstrlenW (lpString=".jpg") returned 4 [0056.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.996] lstrcmpiW (lpString1=".mui", lpString2=".zoh") returned -1 [0056.996] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.997] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0056.997] CloseHandle (hObject=0x190) returned 1 [0056.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0056.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0056.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0056.998] lstrlenW (lpString=".doc") returned 4 [0056.998] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.998] lstrlenW (lpString=".docx") returned 5 [0056.998] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.998] lstrlenW (lpString=".pdf") returned 4 [0056.998] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.998] lstrlenW (lpString=".xls") returned 4 [0056.998] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.998] lstrlenW (lpString=".xlsx") returned 5 [0056.998] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.998] lstrlenW (lpString=".ppt") returned 4 [0056.998] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0056.998] lstrlenW (lpString=".zip") returned 4 [0056.998] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.998] lstrlenW (lpString=".rar") returned 4 [0056.998] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.998] lstrlenW (lpString=".bz2") returned 4 [0056.998] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.998] lstrlenW (lpString=".7z") returned 3 [0056.998] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0056.999] lstrlenW (lpString=".dbf") returned 4 [0056.999] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.999] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0056.999] CloseHandle (hObject=0x190) returned 1 [0056.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0056.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0056.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.000] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1367552) returned 1 [0057.000] CloseHandle (hObject=0x190) returned 1 [0057.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0057.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.000] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.000] CloseHandle (hObject=0x190) returned 1 [0057.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0057.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.108] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4096) returned 1 [0057.108] CloseHandle (hObject=0x1fc) returned 1 [0057.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0057.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.109] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.109] CloseHandle (hObject=0x1fc) returned 1 [0057.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0057.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.132] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4096) returned 1 [0057.132] CloseHandle (hObject=0x22c) returned 1 [0057.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0057.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.133] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=169984) returned 1 [0057.133] CloseHandle (hObject=0x22c) returned 1 [0057.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0057.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.183] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.183] CloseHandle (hObject=0x1fc) returned 1 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.184] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.184] CloseHandle (hObject=0x1fc) returned 1 [0057.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0057.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.184] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.184] CloseHandle (hObject=0x1fc) returned 1 [0057.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0057.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.185] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.185] CloseHandle (hObject=0x1fc) returned 1 [0057.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0057.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.187] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.187] CloseHandle (hObject=0x1fc) returned 1 [0057.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0057.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.187] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=40448) returned 1 [0057.187] CloseHandle (hObject=0x1fc) returned 1 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.188] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=448000) returned 1 [0057.188] CloseHandle (hObject=0x1fc) returned 1 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.189] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=224256) returned 1 [0057.189] CloseHandle (hObject=0x1fc) returned 1 [0057.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0057.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.190] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.190] CloseHandle (hObject=0x1fc) returned 1 [0057.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0057.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.191] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=110592) returned 1 [0057.191] CloseHandle (hObject=0x1fc) returned 1 [0057.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0057.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.191] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=544768) returned 1 [0057.192] CloseHandle (hObject=0x1fc) returned 1 [0057.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0057.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.192] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12288) returned 1 [0057.192] CloseHandle (hObject=0x1fc) returned 1 [0057.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0057.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.193] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1246720) returned 1 [0057.193] CloseHandle (hObject=0x1fc) returned 1 [0057.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0057.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.193] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=503296) returned 1 [0057.193] CloseHandle (hObject=0x1fc) returned 1 [0057.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0057.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.194] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=101376) returned 1 [0057.194] CloseHandle (hObject=0x1fc) returned 1 [0057.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0057.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.195] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4096) returned 1 [0057.195] CloseHandle (hObject=0x1fc) returned 1 [0057.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0057.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.195] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.195] CloseHandle (hObject=0x1fc) returned 1 [0057.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0057.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.197] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.197] CloseHandle (hObject=0x1fc) returned 1 [0057.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0057.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.198] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0057.198] CloseHandle (hObject=0x1fc) returned 1 [0057.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0057.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.198] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=419232) returned 1 [0057.198] CloseHandle (hObject=0x1fc) returned 1 [0057.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0057.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0057.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.199] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.199] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0057.199] GetLastError () returned 0x0 [0057.199] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0057.408] WriteFile (in: hFile=0x1bc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0057.415] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.415] WriteFile (in: hFile=0x1bc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.415] SetEndOfFile (hFile=0x1bc) returned 1 [0057.415] CloseHandle (hObject=0x1bc) returned 1 [0057.415] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.415] SetEndOfFile (hFile=0x1fc) returned 1 [0057.419] CloseHandle (hObject=0x1fc) returned 1 [0057.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0057.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString=".doc") returned 4 [0057.420] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString=".docx") returned 5 [0057.420] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.420] lstrlenW (lpString=".pdf") returned 4 [0057.420] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString=".xls") returned 4 [0057.420] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString=".xlsx") returned 5 [0057.420] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.420] lstrlenW (lpString=".ppt") returned 4 [0057.420] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString=".zip") returned 4 [0057.420] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString=".rar") returned 4 [0057.420] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.420] lstrlenW (lpString=".bz2") returned 4 [0057.420] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.420] lstrlenW (lpString=".7z") returned 3 [0057.420] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString=".dbf") returned 4 [0057.420] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString=".1cd") returned 4 [0057.420] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.420] lstrlenW (lpString=".jpg") returned 4 [0057.420] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString=".doc") returned 4 [0057.421] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString=".docx") returned 5 [0057.421] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.421] lstrlenW (lpString=".pdf") returned 4 [0057.421] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString=".xls") returned 4 [0057.421] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString=".xlsx") returned 5 [0057.421] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.421] lstrlenW (lpString=".ppt") returned 4 [0057.421] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString=".zip") returned 4 [0057.421] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString=".rar") returned 4 [0057.421] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.421] lstrlenW (lpString=".bz2") returned 4 [0057.421] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.421] lstrlenW (lpString=".7z") returned 3 [0057.421] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString=".dbf") returned 4 [0057.421] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString=".1cd") returned 4 [0057.421] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.421] lstrlenW (lpString=".jpg") returned 4 [0057.421] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.422] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0057.422] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0057.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.473] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=41864) returned 1 [0058.473] CloseHandle (hObject=0x190) returned 1 [0058.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0058.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.473] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.474] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0058.474] GetLastError () returned 0x0 [0058.474] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa388, lpOverlapped=0x0) returned 1 [0058.477] WriteFile (in: hFile=0x1bc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0058.478] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.478] WriteFile (in: hFile=0x1bc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.479] SetEndOfFile (hFile=0x1bc) returned 1 [0058.479] CloseHandle (hObject=0x1bc) returned 1 [0058.479] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.479] SetEndOfFile (hFile=0x190) returned 1 [0058.480] CloseHandle (hObject=0x190) returned 1 [0058.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.480] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0058.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.481] lstrlenW (lpString=".doc") returned 4 [0058.481] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString=".docx") returned 5 [0058.481] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0058.481] lstrlenW (lpString=".pdf") returned 4 [0058.481] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString=".xls") returned 4 [0058.481] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString=".xlsx") returned 5 [0058.481] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0058.481] lstrlenW (lpString=".ppt") returned 4 [0058.481] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.481] lstrlenW (lpString=".zip") returned 4 [0058.481] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString=".rar") returned 4 [0058.481] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.481] lstrlenW (lpString=".bz2") returned 4 [0058.481] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.481] lstrlenW (lpString=".7z") returned 3 [0058.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString=".dbf") returned 4 [0058.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString=".1cd") returned 4 [0058.482] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString=".jpg") returned 4 [0058.482] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString=".doc") returned 4 [0058.482] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".docx") returned 5 [0058.482] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0058.482] lstrlenW (lpString=".pdf") returned 4 [0058.482] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".xls") returned 4 [0058.482] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".xlsx") returned 5 [0058.482] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0058.482] lstrlenW (lpString=".ppt") returned 4 [0058.482] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.482] lstrlenW (lpString=".zip") returned 4 [0058.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".rar") returned 4 [0058.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".bz2") returned 4 [0058.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString=".7z") returned 3 [0058.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.483] lstrlenW (lpString=".dbf") returned 4 [0058.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.483] lstrlenW (lpString=".1cd") returned 4 [0058.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.483] lstrlenW (lpString=".jpg") returned 4 [0058.483] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.483] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.483] lstrlenW (lpString="ACECORE.DLL") returned 11 [0058.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.484] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3213192) returned 1 [0058.484] CloseHandle (hObject=0x190) returned 1 [0058.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0058.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0058.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.485] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.485] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.485] ReadFile (in: hFile=0x190, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.489] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.489] ReadFile (in: hFile=0x190, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.498] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.498] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.498] ReadFile (in: hFile=0x190, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.599] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.599] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.612] SetEndOfFile (hFile=0x190) returned 1 [0058.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0058.612] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.613] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.614] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.614] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.618] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.618] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.624] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0058.624] CloseHandle (hObject=0x190) returned 1 [0058.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.625] lstrlenW (lpString=".doc") returned 4 [0058.625] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString=".docx") returned 5 [0058.625] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0058.625] lstrlenW (lpString=".pdf") returned 4 [0058.625] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString=".xls") returned 4 [0058.625] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString=".xlsx") returned 5 [0058.625] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0058.625] lstrlenW (lpString=".ppt") returned 4 [0058.625] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.625] lstrlenW (lpString=".zip") returned 4 [0058.625] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString=".rar") returned 4 [0058.625] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.625] lstrlenW (lpString=".bz2") returned 4 [0058.625] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.625] lstrlenW (lpString=".7z") returned 3 [0058.625] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.625] lstrlenW (lpString=".dbf") returned 4 [0058.625] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.625] lstrlenW (lpString=".1cd") returned 4 [0058.625] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString=".jpg") returned 4 [0058.626] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString=".doc") returned 4 [0058.626] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString=".docx") returned 5 [0058.626] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0058.626] lstrlenW (lpString=".pdf") returned 4 [0058.626] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString=".xls") returned 4 [0058.626] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString=".xlsx") returned 5 [0058.626] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0058.626] lstrlenW (lpString=".ppt") returned 4 [0058.626] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString=".zip") returned 4 [0058.626] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString=".rar") returned 4 [0058.626] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.626] lstrlenW (lpString=".bz2") returned 4 [0058.626] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.626] lstrlenW (lpString=".7z") returned 3 [0058.626] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString=".dbf") returned 4 [0058.626] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.626] lstrlenW (lpString=".1cd") returned 4 [0058.626] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.627] lstrlenW (lpString=".jpg") returned 4 [0058.627] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.627] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0058.627] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0058.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.627] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=442272) returned 1 [0058.627] CloseHandle (hObject=0x190) returned 1 [0058.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0058.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0058.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.628] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.628] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.628] GetLastError () returned 0x0 [0058.628] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0058.847] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0058.855] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.855] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.855] SetEndOfFile (hFile=0x1f4) returned 1 [0058.855] CloseHandle (hObject=0x1f4) returned 1 [0058.856] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.856] SetEndOfFile (hFile=0x190) returned 1 [0058.859] CloseHandle (hObject=0x190) returned 1 [0058.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0058.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0059.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.184] lstrlenW (lpString=".doc") returned 4 [0059.184] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.184] lstrlenW (lpString=".docx") returned 5 [0059.184] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0059.185] lstrlenW (lpString=".pdf") returned 4 [0059.185] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString=".xls") returned 4 [0059.185] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString=".xlsx") returned 5 [0059.185] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0059.185] lstrlenW (lpString=".ppt") returned 4 [0059.185] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString=".zip") returned 4 [0059.185] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString=".rar") returned 4 [0059.185] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString=".bz2") returned 4 [0059.185] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.185] lstrlenW (lpString=".7z") returned 3 [0059.185] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString=".dbf") returned 4 [0059.185] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString=".1cd") returned 4 [0059.185] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString=".jpg") returned 4 [0059.185] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.185] lstrlenW (lpString=".doc") returned 4 [0059.185] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.185] lstrlenW (lpString=".docx") returned 5 [0059.185] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0059.186] lstrlenW (lpString=".pdf") returned 4 [0059.186] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.186] lstrlenW (lpString=".xls") returned 4 [0059.186] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.186] lstrlenW (lpString=".xlsx") returned 5 [0059.186] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0059.186] lstrlenW (lpString=".ppt") returned 4 [0059.186] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.186] lstrlenW (lpString=".zip") returned 4 [0059.186] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.186] lstrlenW (lpString=".rar") returned 4 [0059.186] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.186] lstrlenW (lpString=".bz2") returned 4 [0059.186] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.186] lstrlenW (lpString=".7z") returned 3 [0059.186] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.186] lstrlenW (lpString=".dbf") returned 4 [0059.186] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.186] lstrlenW (lpString=".1cd") returned 4 [0059.186] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0059.186] lstrlenW (lpString=".jpg") returned 4 [0059.186] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.186] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.186] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0059.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.372] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=55744) returned 1 [0059.372] CloseHandle (hObject=0x154) returned 1 [0059.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0059.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.372] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.372] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.373] GetLastError () returned 0x0 [0059.373] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0059.375] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0059.377] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.377] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.377] SetEndOfFile (hFile=0x1f4) returned 1 [0059.377] CloseHandle (hObject=0x1f4) returned 1 [0059.377] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.377] SetEndOfFile (hFile=0x154) returned 1 [0059.378] CloseHandle (hObject=0x154) returned 1 [0059.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0059.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.379] lstrlenW (lpString=".doc") returned 4 [0059.379] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.379] lstrlenW (lpString=".docx") returned 5 [0059.379] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.379] lstrlenW (lpString=".pdf") returned 4 [0059.379] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.379] lstrlenW (lpString=".xls") returned 4 [0059.379] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.379] lstrlenW (lpString=".xlsx") returned 5 [0059.379] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.379] lstrlenW (lpString=".ppt") returned 4 [0059.379] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.379] lstrlenW (lpString=".zip") returned 4 [0059.379] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.379] lstrlenW (lpString=".rar") returned 4 [0059.379] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".bz2") returned 4 [0059.380] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.380] lstrlenW (lpString=".7z") returned 3 [0059.380] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString=".dbf") returned 4 [0059.380] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString=".1cd") returned 4 [0059.380] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString=".jpg") returned 4 [0059.380] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString=".doc") returned 4 [0059.380] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".docx") returned 5 [0059.380] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.380] lstrlenW (lpString=".pdf") returned 4 [0059.380] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".xls") returned 4 [0059.380] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".xlsx") returned 5 [0059.380] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.380] lstrlenW (lpString=".ppt") returned 4 [0059.380] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.380] lstrlenW (lpString=".zip") returned 4 [0059.380] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".rar") returned 4 [0059.380] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.380] lstrlenW (lpString=".bz2") returned 4 [0059.381] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.381] lstrlenW (lpString=".7z") returned 3 [0059.381] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.381] lstrlenW (lpString=".dbf") returned 4 [0059.381] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.381] lstrlenW (lpString=".1cd") returned 4 [0059.381] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.381] lstrlenW (lpString=".jpg") returned 4 [0059.381] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.381] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.381] lstrlenW (lpString="ACEREP.DLL") returned 10 [0059.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.381] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=691616) returned 1 [0059.381] CloseHandle (hObject=0x154) returned 1 [0059.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0059.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0059.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0059.382] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.382] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.382] GetLastError () returned 0x0 [0059.382] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0059.397] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0059.408] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.408] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.408] SetEndOfFile (hFile=0x1f4) returned 1 [0059.408] CloseHandle (hObject=0x1f4) returned 1 [0059.408] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.408] SetEndOfFile (hFile=0x154) returned 1 [0059.414] CloseHandle (hObject=0x154) returned 1 [0059.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0059.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0059.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString=".doc") returned 4 [0059.415] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString=".docx") returned 5 [0059.415] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0059.415] lstrlenW (lpString=".pdf") returned 4 [0059.415] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString=".xls") returned 4 [0059.415] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString=".xlsx") returned 5 [0059.415] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0059.415] lstrlenW (lpString=".ppt") returned 4 [0059.415] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString=".zip") returned 4 [0059.415] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString=".rar") returned 4 [0059.415] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString=".bz2") returned 4 [0059.415] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.415] lstrlenW (lpString=".7z") returned 3 [0059.415] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString=".dbf") returned 4 [0059.415] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString=".1cd") returned 4 [0059.415] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.415] lstrlenW (lpString=".jpg") returned 4 [0059.415] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.500] lstrlenW (lpString=".doc") returned 4 [0059.500] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.500] lstrlenW (lpString=".docx") returned 5 [0059.500] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0059.500] lstrlenW (lpString=".pdf") returned 4 [0059.500] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.501] lstrlenW (lpString=".xls") returned 4 [0059.501] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.501] lstrlenW (lpString=".xlsx") returned 5 [0059.501] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0059.501] lstrlenW (lpString=".ppt") returned 4 [0059.501] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.501] lstrlenW (lpString=".zip") returned 4 [0059.501] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.501] lstrlenW (lpString=".rar") returned 4 [0059.501] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.501] lstrlenW (lpString=".bz2") returned 4 [0059.501] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.501] lstrlenW (lpString=".7z") returned 3 [0059.501] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.501] lstrlenW (lpString=".dbf") returned 4 [0059.501] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.501] lstrlenW (lpString=".1cd") returned 4 [0059.501] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.501] lstrlenW (lpString=".jpg") returned 4 [0059.501] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.502] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0059.502] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0059.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.498] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=502168) returned 1 [0060.498] CloseHandle (hObject=0x150) returned 1 [0060.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0060.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.499] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.499] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0060.512] GetLastError () returned 0x0 [0060.513] ReadFile (in: hFile=0x150, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7a998, lpOverlapped=0x0) returned 1 [0060.524] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0060.533] ReadFile (in: hFile=0x150, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.533] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.533] SetEndOfFile (hFile=0x16c) returned 1 [0060.533] CloseHandle (hObject=0x16c) returned 1 [0060.534] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.534] SetEndOfFile (hFile=0x150) returned 1 [0060.538] CloseHandle (hObject=0x150) returned 1 [0060.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.538] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.538] lstrlenW (lpString=".doc") returned 4 [0060.538] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.538] lstrlenW (lpString=".docx") returned 5 [0060.538] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.538] lstrlenW (lpString=".pdf") returned 4 [0060.538] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.538] lstrlenW (lpString=".xls") returned 4 [0060.538] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.538] lstrlenW (lpString=".xlsx") returned 5 [0060.539] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.539] lstrlenW (lpString=".ppt") returned 4 [0060.539] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.539] lstrlenW (lpString=".zip") returned 4 [0060.539] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.539] lstrlenW (lpString=".rar") returned 4 [0060.539] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.539] lstrlenW (lpString=".bz2") returned 4 [0060.539] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.539] lstrlenW (lpString=".7z") returned 3 [0060.539] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.539] lstrlenW (lpString=".dbf") returned 4 [0060.539] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.539] lstrlenW (lpString=".1cd") returned 4 [0060.539] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".jpg") returned 4 [0060.540] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".doc") returned 4 [0060.540] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString=".docx") returned 5 [0060.540] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.540] lstrlenW (lpString=".pdf") returned 4 [0060.540] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString=".xls") returned 4 [0060.540] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString=".xlsx") returned 5 [0060.540] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.540] lstrlenW (lpString=".ppt") returned 4 [0060.540] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".zip") returned 4 [0060.540] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString=".rar") returned 4 [0060.540] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.540] lstrlenW (lpString=".bz2") returned 4 [0060.540] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.540] lstrlenW (lpString=".7z") returned 3 [0060.540] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".dbf") returned 4 [0060.540] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".1cd") returned 4 [0060.540] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.540] lstrlenW (lpString=".jpg") returned 4 [0060.541] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.541] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0060.541] lstrlenW (lpString="CsiSoap.dll") returned 11 [0060.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.541] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1784192) returned 1 [0060.541] CloseHandle (hObject=0x150) returned 1 [0060.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0060.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0060.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.542] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.542] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.542] ReadFile (in: hFile=0x150, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.769] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.769] ReadFile (in: hFile=0x150, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.778] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.779] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.779] ReadFile (in: hFile=0x150, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.795] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.795] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0060.890] SetEndOfFile (hFile=0x150) returned 1 [0060.927] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0060.927] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.927] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.928] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.928] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.930] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.930] WriteFile (in: hFile=0x150, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.932] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0060.932] CloseHandle (hObject=0x150) returned 1 [0060.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.933] lstrlenW (lpString=".doc") returned 4 [0060.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".docx") returned 5 [0060.933] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.933] lstrlenW (lpString=".pdf") returned 4 [0060.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".xls") returned 4 [0060.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".xlsx") returned 5 [0060.933] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.933] lstrlenW (lpString=".ppt") returned 4 [0060.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.933] lstrlenW (lpString=".zip") returned 4 [0060.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".rar") returned 4 [0060.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".bz2") returned 4 [0060.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.933] lstrlenW (lpString=".7z") returned 3 [0060.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString=".dbf") returned 4 [0060.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString=".1cd") returned 4 [0060.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString=".jpg") returned 4 [0060.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString=".doc") returned 4 [0060.934] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".docx") returned 5 [0060.934] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.934] lstrlenW (lpString=".pdf") returned 4 [0060.934] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".xls") returned 4 [0060.934] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".xlsx") returned 5 [0060.934] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.934] lstrlenW (lpString=".ppt") returned 4 [0060.934] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.934] lstrlenW (lpString=".zip") returned 4 [0060.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".rar") returned 4 [0060.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.934] lstrlenW (lpString=".bz2") returned 4 [0060.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.934] lstrlenW (lpString=".7z") returned 3 [0060.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.935] lstrlenW (lpString=".dbf") returned 4 [0060.935] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.935] lstrlenW (lpString=".1cd") returned 4 [0060.935] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.935] lstrlenW (lpString=".jpg") returned 4 [0060.935] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.935] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0060.935] lstrlenW (lpString="IACOM2.DLL") returned 10 [0060.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0060.959] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4289376) returned 1 [0060.959] CloseHandle (hObject=0x150) returned 1 [0060.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0060.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0060.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0061.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0061.737] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.737] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.738] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.819] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.819] ReadFile (in: hFile=0x22c, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.829] ReadFile (in: hFile=0x22c, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.877] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.877] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0061.892] SetEndOfFile (hFile=0x22c) returned 1 [0061.892] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0061.892] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.894] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.894] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.018] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.018] WriteFile (in: hFile=0x22c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.020] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0062.020] CloseHandle (hObject=0x22c) returned 1 [0062.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.020] lstrlenW (lpString=".doc") returned 4 [0062.020] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.020] lstrlenW (lpString=".docx") returned 5 [0062.020] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0062.020] lstrlenW (lpString=".pdf") returned 4 [0062.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.020] lstrlenW (lpString=".xls") returned 4 [0062.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.020] lstrlenW (lpString=".xlsx") returned 5 [0062.020] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0062.020] lstrlenW (lpString=".ppt") returned 4 [0062.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString=".zip") returned 4 [0062.021] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.021] lstrlenW (lpString=".rar") returned 4 [0062.021] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.021] lstrlenW (lpString=".bz2") returned 4 [0062.021] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.021] lstrlenW (lpString=".7z") returned 3 [0062.021] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString=".dbf") returned 4 [0062.021] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString=".1cd") returned 4 [0062.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString=".jpg") returned 4 [0062.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.021] lstrlenW (lpString=".doc") returned 4 [0062.021] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.021] lstrlenW (lpString=".docx") returned 5 [0062.021] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0062.021] lstrlenW (lpString=".pdf") returned 4 [0062.021] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.021] lstrlenW (lpString=".xls") returned 4 [0062.022] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.022] lstrlenW (lpString=".xlsx") returned 5 [0062.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0062.022] lstrlenW (lpString=".ppt") returned 4 [0062.022] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.022] lstrlenW (lpString=".zip") returned 4 [0062.022] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.022] lstrlenW (lpString=".rar") returned 4 [0062.022] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.022] lstrlenW (lpString=".bz2") returned 4 [0062.022] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.022] lstrlenW (lpString=".7z") returned 3 [0062.022] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.022] lstrlenW (lpString=".dbf") returned 4 [0062.022] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.022] lstrlenW (lpString=".1cd") returned 4 [0062.022] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0062.022] lstrlenW (lpString=".jpg") returned 4 [0062.022] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.022] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.022] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0062.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.023] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=56192) returned 1 [0062.023] CloseHandle (hObject=0x22c) returned 1 [0062.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0062.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.023] lstrlenW (lpString=".doc") returned 4 [0062.023] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.023] lstrlenW (lpString=".docx") returned 5 [0062.023] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0062.023] lstrlenW (lpString=".pdf") returned 4 [0062.023] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.023] lstrlenW (lpString=".xls") returned 4 [0062.023] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.023] lstrlenW (lpString=".xlsx") returned 5 [0062.023] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0062.023] lstrlenW (lpString=".ppt") returned 4 [0062.023] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.023] lstrlenW (lpString=".zip") returned 4 [0062.023] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.023] lstrlenW (lpString=".rar") returned 4 [0062.024] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString=".bz2") returned 4 [0062.024] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.024] lstrlenW (lpString=".7z") returned 3 [0062.024] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString=".dbf") returned 4 [0062.024] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString=".1cd") returned 4 [0062.024] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString=".jpg") returned 4 [0062.024] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString=".doc") returned 4 [0062.024] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString=".docx") returned 5 [0062.024] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0062.024] lstrlenW (lpString=".pdf") returned 4 [0062.024] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString=".xls") returned 4 [0062.024] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString=".xlsx") returned 5 [0062.024] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0062.024] lstrlenW (lpString=".ppt") returned 4 [0062.024] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.024] lstrlenW (lpString=".zip") returned 4 [0062.024] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.024] lstrlenW (lpString=".rar") returned 4 [0062.024] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.025] lstrlenW (lpString=".bz2") returned 4 [0062.025] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.025] lstrlenW (lpString=".7z") returned 3 [0062.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.025] lstrlenW (lpString=".dbf") returned 4 [0062.025] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.025] lstrlenW (lpString=".1cd") returned 4 [0062.025] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0062.025] lstrlenW (lpString=".jpg") returned 4 [0062.025] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.025] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0062.025] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0062.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.025] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1198464) returned 1 [0062.026] CloseHandle (hObject=0x22c) returned 1 [0062.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0062.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.026] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.026] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.026] GetLastError () returned 0x0 [0062.026] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0062.059] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0062.222] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x24990, lpOverlapped=0x0) returned 1 [0062.232] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x249a0, lpOverlapped=0x0) returned 1 [0062.237] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.237] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.237] SetEndOfFile (hFile=0x214) returned 1 [0062.246] CloseHandle (hObject=0x214) returned 1 [0062.246] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.246] SetEndOfFile (hFile=0x22c) returned 1 [0062.247] CloseHandle (hObject=0x22c) returned 1 [0062.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0062.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0062.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.416] lstrlenW (lpString=".doc") returned 4 [0062.417] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString=".docx") returned 5 [0062.417] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.417] lstrlenW (lpString=".pdf") returned 4 [0062.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString=".xls") returned 4 [0062.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString=".xlsx") returned 5 [0062.417] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.417] lstrlenW (lpString=".ppt") returned 4 [0062.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.417] lstrlenW (lpString=".zip") returned 4 [0062.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString=".rar") returned 4 [0062.417] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString=".bz2") returned 4 [0062.417] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.417] lstrlenW (lpString=".7z") returned 3 [0062.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.417] lstrlenW (lpString=".dbf") returned 4 [0062.417] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.417] lstrlenW (lpString=".1cd") returned 4 [0062.417] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.417] lstrlenW (lpString=".jpg") returned 4 [0062.417] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString=".doc") returned 4 [0062.418] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString=".docx") returned 5 [0062.418] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.418] lstrlenW (lpString=".pdf") returned 4 [0062.418] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString=".xls") returned 4 [0062.418] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString=".xlsx") returned 5 [0062.418] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.418] lstrlenW (lpString=".ppt") returned 4 [0062.418] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString=".zip") returned 4 [0062.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString=".rar") returned 4 [0062.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.418] lstrlenW (lpString=".bz2") returned 4 [0062.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.418] lstrlenW (lpString=".7z") returned 3 [0062.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString=".dbf") returned 4 [0062.418] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString=".1cd") returned 4 [0062.418] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.418] lstrlenW (lpString=".jpg") returned 4 [0062.418] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.419] lstrcmpiW (lpString1=".exe", lpString2=".zoh") returned -1 [0062.419] lstrlenW (lpString="Oarpmany.exe") returned 12 [0062.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.671] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=232840) returned 1 [0062.682] CloseHandle (hObject=0x22c) returned 1 [0062.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0062.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0062.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0062.709] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.714] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.739] GetLastError () returned 0x0 [0062.740] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x38d88, lpOverlapped=0x0) returned 1 [0062.826] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x38d90, lpOverlapped=0x0) returned 1 [0062.829] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.829] WriteFile (in: hFile=0x214, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.830] SetEndOfFile (hFile=0x214) returned 1 [0062.830] CloseHandle (hObject=0x214) returned 1 [0062.830] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.830] SetEndOfFile (hFile=0x22c) returned 1 [0062.832] CloseHandle (hObject=0x22c) returned 1 [0063.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0063.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.401] lstrlenW (lpString=".doc") returned 4 [0063.401] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.401] lstrlenW (lpString=".docx") returned 5 [0063.401] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0063.401] lstrlenW (lpString=".pdf") returned 4 [0063.402] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString=".xls") returned 4 [0063.402] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString=".xlsx") returned 5 [0063.402] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0063.402] lstrlenW (lpString=".ppt") returned 4 [0063.402] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString=".zip") returned 4 [0063.402] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString=".rar") returned 4 [0063.402] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString=".bz2") returned 4 [0063.402] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.402] lstrlenW (lpString=".7z") returned 3 [0063.402] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString=".dbf") returned 4 [0063.402] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString=".1cd") returned 4 [0063.402] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString=".jpg") returned 4 [0063.402] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.402] lstrlenW (lpString=".doc") returned 4 [0063.402] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.402] lstrlenW (lpString=".docx") returned 5 [0063.402] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0063.403] lstrlenW (lpString=".pdf") returned 4 [0063.403] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.403] lstrlenW (lpString=".xls") returned 4 [0063.403] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.403] lstrlenW (lpString=".xlsx") returned 5 [0063.403] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0063.403] lstrlenW (lpString=".ppt") returned 4 [0063.403] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.403] lstrlenW (lpString=".zip") returned 4 [0063.403] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.403] lstrlenW (lpString=".rar") returned 4 [0063.403] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.403] lstrlenW (lpString=".bz2") returned 4 [0063.403] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.403] lstrlenW (lpString=".7z") returned 3 [0063.403] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.403] lstrlenW (lpString=".dbf") returned 4 [0063.403] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.403] lstrlenW (lpString=".1cd") returned 4 [0063.403] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0063.403] lstrlenW (lpString=".jpg") returned 4 [0063.403] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.403] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0063.403] lstrlenW (lpString="OSetupPS.dll") returned 12 [0063.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.404] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=47520) returned 1 [0063.404] CloseHandle (hObject=0x22c) returned 1 [0063.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0063.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.404] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.404] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0063.405] GetLastError () returned 0x0 [0063.405] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb9a0, lpOverlapped=0x0) returned 1 [0063.412] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb9b0, lpOverlapped=0x0) returned 1 [0063.413] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.413] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.413] SetEndOfFile (hFile=0x190) returned 1 [0063.413] CloseHandle (hObject=0x190) returned 1 [0063.414] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.414] SetEndOfFile (hFile=0x22c) returned 1 [0063.415] CloseHandle (hObject=0x22c) returned 1 [0063.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0063.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.415] lstrlenW (lpString=".doc") returned 4 [0063.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString=".docx") returned 5 [0063.415] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0063.415] lstrlenW (lpString=".pdf") returned 4 [0063.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString=".xls") returned 4 [0063.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString=".xlsx") returned 5 [0063.415] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0063.415] lstrlenW (lpString=".ppt") returned 4 [0063.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.415] lstrlenW (lpString=".zip") returned 4 [0063.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString=".rar") returned 4 [0063.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.415] lstrlenW (lpString=".bz2") returned 4 [0063.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.416] lstrlenW (lpString=".7z") returned 3 [0063.416] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString=".dbf") returned 4 [0063.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString=".1cd") returned 4 [0063.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString=".jpg") returned 4 [0063.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString=".doc") returned 4 [0063.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString=".docx") returned 5 [0063.416] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0063.416] lstrlenW (lpString=".pdf") returned 4 [0063.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString=".xls") returned 4 [0063.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString=".xlsx") returned 5 [0063.416] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0063.416] lstrlenW (lpString=".ppt") returned 4 [0063.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.416] lstrlenW (lpString=".zip") returned 4 [0063.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString=".rar") returned 4 [0063.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.416] lstrlenW (lpString=".bz2") returned 4 [0063.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.417] lstrlenW (lpString=".7z") returned 3 [0063.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.417] lstrlenW (lpString=".dbf") returned 4 [0063.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.417] lstrlenW (lpString=".1cd") returned 4 [0063.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.417] lstrlenW (lpString=".jpg") returned 4 [0063.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.417] lstrcmpiW (lpString1=".dll", lpString2=".zoh") returned -1 [0063.417] lstrlenW (lpString="pidgenx.dll") returned 11 [0063.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0063.431] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1463568) returned 1 [0063.431] CloseHandle (hObject=0x1ec) returned 1 [0063.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0063.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0063.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0063.431] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.431] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0063.431] GetLastError () returned 0x0 [0063.431] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.659] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.762] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x65520, lpOverlapped=0x0) returned 1 [0063.776] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0063.889] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.889] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.889] SetEndOfFile (hFile=0x1fc) returned 1 [0063.889] CloseHandle (hObject=0x1fc) returned 1 [0063.889] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.889] SetEndOfFile (hFile=0x1ec) returned 1 [0063.893] CloseHandle (hObject=0x1ec) returned 1 [0063.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0063.893] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0063.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString=".doc") returned 4 [0063.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString=".docx") returned 5 [0063.894] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0063.894] lstrlenW (lpString=".pdf") returned 4 [0063.894] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString=".xls") returned 4 [0063.894] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString=".xlsx") returned 5 [0063.894] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0063.894] lstrlenW (lpString=".ppt") returned 4 [0063.894] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString=".zip") returned 4 [0063.894] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString=".rar") returned 4 [0063.894] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.894] lstrlenW (lpString=".bz2") returned 4 [0063.894] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.894] lstrlenW (lpString=".7z") returned 3 [0063.894] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString=".dbf") returned 4 [0063.894] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString=".1cd") returned 4 [0063.894] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.894] lstrlenW (lpString=".jpg") returned 4 [0063.894] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.895] lstrlenW (lpString=".doc") returned 4 [0063.895] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString=".docx") returned 5 [0063.895] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0063.895] lstrlenW (lpString=".pdf") returned 4 [0063.895] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString=".xls") returned 4 [0063.895] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString=".xlsx") returned 5 [0063.895] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0063.895] lstrlenW (lpString=".ppt") returned 4 [0063.895] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.895] lstrlenW (lpString=".zip") returned 4 [0063.895] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString=".rar") returned 4 [0063.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.895] lstrlenW (lpString=".bz2") returned 4 [0063.895] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.895] lstrlenW (lpString=".7z") returned 3 [0063.895] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.895] lstrlenW (lpString=".dbf") returned 4 [0063.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.895] lstrlenW (lpString=".1cd") returned 4 [0063.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.896] lstrlenW (lpString=".jpg") returned 4 [0063.896] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.896] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0063.896] lstrlenW (lpString="PRJRES.DLL") returned 10 [0063.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0064.012] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3943312) returned 1 [0064.012] CloseHandle (hObject=0x158) returned 1 [0064.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0064.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0064.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0064.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0064.788] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.788] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.788] ReadFile (in: hFile=0x158, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.791] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.791] ReadFile (in: hFile=0x158, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.796] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.796] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.796] ReadFile (in: hFile=0x158, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.811] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.811] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0065.047] SetEndOfFile (hFile=0x158) returned 1 [0065.148] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0065.148] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.148] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.150] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.150] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.152] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.152] WriteFile (in: hFile=0x158, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0065.154] CloseHandle (hObject=0x158) returned 1 [0065.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0065.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.154] lstrlenW (lpString=".doc") returned 4 [0065.154] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".docx") returned 5 [0065.155] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0065.155] lstrlenW (lpString=".pdf") returned 4 [0065.155] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".xls") returned 4 [0065.155] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".xlsx") returned 5 [0065.155] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0065.155] lstrlenW (lpString=".ppt") returned 4 [0065.155] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString=".zip") returned 4 [0065.155] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".rar") returned 4 [0065.155] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".bz2") returned 4 [0065.155] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.155] lstrlenW (lpString=".7z") returned 3 [0065.155] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString=".dbf") returned 4 [0065.155] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString=".1cd") returned 4 [0065.155] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString=".jpg") returned 4 [0065.155] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.155] lstrlenW (lpString=".doc") returned 4 [0065.155] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.155] lstrlenW (lpString=".docx") returned 5 [0065.156] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0065.156] lstrlenW (lpString=".pdf") returned 4 [0065.156] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.156] lstrlenW (lpString=".xls") returned 4 [0065.156] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.156] lstrlenW (lpString=".xlsx") returned 5 [0065.156] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0065.156] lstrlenW (lpString=".ppt") returned 4 [0065.156] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.156] lstrlenW (lpString=".zip") returned 4 [0065.156] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.156] lstrlenW (lpString=".rar") returned 4 [0065.156] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.156] lstrlenW (lpString=".bz2") returned 4 [0065.156] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.156] lstrlenW (lpString=".7z") returned 3 [0065.156] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.156] lstrlenW (lpString=".dbf") returned 4 [0065.156] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.156] lstrlenW (lpString=".1cd") returned 4 [0065.156] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0065.156] lstrlenW (lpString=".jpg") returned 4 [0065.156] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.157] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0065.157] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0065.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.137] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=49488) returned 1 [0066.137] CloseHandle (hObject=0x190) returned 1 [0066.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0066.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.137] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.138] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.138] GetLastError () returned 0x0 [0066.138] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xc150, lpOverlapped=0x0) returned 1 [0066.187] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xc160, lpOverlapped=0x0) returned 1 [0066.189] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.189] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.189] SetEndOfFile (hFile=0x1f4) returned 1 [0066.189] CloseHandle (hObject=0x1f4) returned 1 [0066.189] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.189] SetEndOfFile (hFile=0x190) returned 1 [0066.190] CloseHandle (hObject=0x190) returned 1 [0066.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1 [0066.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".doc") returned 4 [0066.191] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString=".docx") returned 5 [0066.191] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0066.191] lstrlenW (lpString=".pdf") returned 4 [0066.191] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString=".xls") returned 4 [0066.191] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString=".xlsx") returned 5 [0066.191] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0066.191] lstrlenW (lpString=".ppt") returned 4 [0066.191] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".zip") returned 4 [0066.191] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString=".rar") returned 4 [0066.191] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString=".bz2") returned 4 [0066.191] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.191] lstrlenW (lpString=".7z") returned 3 [0066.191] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".dbf") returned 4 [0066.191] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".1cd") returned 4 [0066.191] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".jpg") returned 4 [0066.191] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.191] lstrlenW (lpString=".doc") returned 4 [0066.192] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString=".docx") returned 5 [0066.192] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0066.192] lstrlenW (lpString=".pdf") returned 4 [0066.192] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString=".xls") returned 4 [0066.192] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString=".xlsx") returned 5 [0066.192] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0066.192] lstrlenW (lpString=".ppt") returned 4 [0066.192] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.192] lstrlenW (lpString=".zip") returned 4 [0066.192] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString=".rar") returned 4 [0066.192] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.192] lstrlenW (lpString=".bz2") returned 4 [0066.192] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.192] lstrlenW (lpString=".7z") returned 3 [0066.192] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.192] lstrlenW (lpString=".dbf") returned 4 [0066.192] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.192] lstrlenW (lpString=".1cd") returned 4 [0066.192] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0066.192] lstrlenW (lpString=".jpg") returned 4 [0066.192] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.192] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0066.193] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0066.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.193] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=146192) returned 1 [0066.193] CloseHandle (hObject=0x190) returned 1 [0066.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0066.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.193] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.193] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.194] GetLastError () returned 0x0 [0066.194] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x23b10, lpOverlapped=0x0) returned 1 [0066.198] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x23b20, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x23b20, lpOverlapped=0x0) returned 1 [0066.203] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.203] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.204] SetEndOfFile (hFile=0x1f4) returned 1 [0066.204] CloseHandle (hObject=0x1f4) returned 1 [0066.204] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.204] SetEndOfFile (hFile=0x190) returned 1 [0066.205] CloseHandle (hObject=0x190) returned 1 [0066.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.206] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1 [0066.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.206] lstrlenW (lpString=".doc") returned 4 [0066.206] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString=".docx") returned 5 [0066.206] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0066.206] lstrlenW (lpString=".pdf") returned 4 [0066.206] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString=".xls") returned 4 [0066.206] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString=".xlsx") returned 5 [0066.206] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0066.206] lstrlenW (lpString=".ppt") returned 4 [0066.206] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.206] lstrlenW (lpString=".zip") returned 4 [0066.206] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString=".rar") returned 4 [0066.206] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.206] lstrlenW (lpString=".bz2") returned 4 [0066.206] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.206] lstrlenW (lpString=".7z") returned 3 [0066.206] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString=".dbf") returned 4 [0066.207] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString=".1cd") returned 4 [0066.207] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString=".jpg") returned 4 [0066.207] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString=".doc") returned 4 [0066.207] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString=".docx") returned 5 [0066.207] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0066.207] lstrlenW (lpString=".pdf") returned 4 [0066.207] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString=".xls") returned 4 [0066.207] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString=".xlsx") returned 5 [0066.207] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0066.207] lstrlenW (lpString=".ppt") returned 4 [0066.207] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.207] lstrlenW (lpString=".zip") returned 4 [0066.207] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString=".rar") returned 4 [0066.207] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.207] lstrlenW (lpString=".bz2") returned 4 [0066.207] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.207] lstrlenW (lpString=".7z") returned 3 [0066.207] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.208] lstrlenW (lpString=".dbf") returned 4 [0066.208] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.208] lstrlenW (lpString=".1cd") returned 4 [0066.208] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0066.208] lstrlenW (lpString=".jpg") returned 4 [0066.208] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.208] lstrcmpiW (lpString1=".MOF", lpString2=".zoh") returned -1 [0066.208] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0066.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.209] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=47710) returned 1 [0066.209] CloseHandle (hObject=0x190) returned 1 [0066.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0066.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.209] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.209] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.209] GetLastError () returned 0x0 [0066.210] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xba5e, lpOverlapped=0x0) returned 1 [0066.214] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xba60, lpOverlapped=0x0) returned 1 [0066.215] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.215] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.215] SetEndOfFile (hFile=0x1f4) returned 1 [0066.216] CloseHandle (hObject=0x1f4) returned 1 [0066.216] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.216] SetEndOfFile (hFile=0x190) returned 1 [0066.217] CloseHandle (hObject=0x190) returned 1 [0066.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.217] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1 [0066.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.217] lstrlenW (lpString=".doc") returned 4 [0066.217] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0066.217] lstrlenW (lpString=".docx") returned 5 [0066.217] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0066.217] lstrlenW (lpString=".pdf") returned 4 [0066.217] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0066.217] lstrlenW (lpString=".xls") returned 4 [0066.217] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0066.217] lstrlenW (lpString=".xlsx") returned 5 [0066.217] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0066.217] lstrlenW (lpString=".ppt") returned 4 [0066.217] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".zip") returned 4 [0066.218] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString=".rar") returned 4 [0066.218] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString=".bz2") returned 4 [0066.218] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0066.218] lstrlenW (lpString=".7z") returned 3 [0066.218] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".dbf") returned 4 [0066.218] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".1cd") returned 4 [0066.218] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".jpg") returned 4 [0066.218] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".doc") returned 4 [0066.218] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0066.218] lstrlenW (lpString=".docx") returned 5 [0066.218] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0066.218] lstrlenW (lpString=".pdf") returned 4 [0066.218] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString=".xls") returned 4 [0066.218] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString=".xlsx") returned 5 [0066.218] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0066.218] lstrlenW (lpString=".ppt") returned 4 [0066.218] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0066.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.218] lstrlenW (lpString=".zip") returned 4 [0066.219] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0066.219] lstrlenW (lpString=".rar") returned 4 [0066.219] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0066.219] lstrlenW (lpString=".bz2") returned 4 [0066.219] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0066.219] lstrlenW (lpString=".7z") returned 3 [0066.219] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0066.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.219] lstrlenW (lpString=".dbf") returned 4 [0066.219] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0066.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.219] lstrlenW (lpString=".1cd") returned 4 [0066.219] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0066.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0066.219] lstrlenW (lpString=".jpg") returned 4 [0066.219] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0066.219] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0066.219] lstrlenW (lpString="MSLID.DLL") returned 9 [0066.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.220] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=591168) returned 1 [0066.220] CloseHandle (hObject=0x190) returned 1 [0066.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0066.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.221] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.221] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.554] GetLastError () returned 0x0 [0066.554] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x90540, lpOverlapped=0x0) returned 1 [0066.567] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x90550, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x90550, lpOverlapped=0x0) returned 1 [0066.577] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.577] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.577] SetEndOfFile (hFile=0x1c8) returned 1 [0066.577] CloseHandle (hObject=0x1c8) returned 1 [0066.577] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.577] SetEndOfFile (hFile=0x190) returned 1 [0066.582] CloseHandle (hObject=0x190) returned 1 [0066.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0066.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1 [0066.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.583] lstrlenW (lpString=".doc") returned 4 [0066.583] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString=".docx") returned 5 [0066.583] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0066.583] lstrlenW (lpString=".pdf") returned 4 [0066.583] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString=".xls") returned 4 [0066.583] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString=".xlsx") returned 5 [0066.583] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0066.583] lstrlenW (lpString=".ppt") returned 4 [0066.583] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.583] lstrlenW (lpString=".zip") returned 4 [0066.583] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString=".rar") returned 4 [0066.583] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.583] lstrlenW (lpString=".bz2") returned 4 [0066.583] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.583] lstrlenW (lpString=".7z") returned 3 [0066.583] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString=".dbf") returned 4 [0066.584] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString=".1cd") returned 4 [0066.584] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString=".jpg") returned 4 [0066.584] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString=".doc") returned 4 [0066.584] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString=".docx") returned 5 [0066.584] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0066.584] lstrlenW (lpString=".pdf") returned 4 [0066.584] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString=".xls") returned 4 [0066.584] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString=".xlsx") returned 5 [0066.584] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0066.584] lstrlenW (lpString=".ppt") returned 4 [0066.584] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.584] lstrlenW (lpString=".zip") returned 4 [0066.584] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString=".rar") returned 4 [0066.584] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.584] lstrlenW (lpString=".bz2") returned 4 [0066.584] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.584] lstrlenW (lpString=".7z") returned 3 [0066.584] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.585] lstrlenW (lpString=".dbf") returned 4 [0066.585] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.585] lstrlenW (lpString=".1cd") returned 4 [0066.585] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0066.585] lstrlenW (lpString=".jpg") returned 4 [0066.585] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.585] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0066.585] lstrlenW (lpString="STINTL.DLL") returned 10 [0066.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.585] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=17280) returned 1 [0066.586] CloseHandle (hObject=0x190) returned 1 [0066.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0066.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0066.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0066.586] GetLastError () returned 0x0 [0066.586] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4380, lpOverlapped=0x0) returned 1 [0067.408] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4390, lpOverlapped=0x0) returned 1 [0067.432] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.432] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0067.432] SetEndOfFile (hFile=0x1c8) returned 1 [0067.432] CloseHandle (hObject=0x1c8) returned 1 [0067.432] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.432] SetEndOfFile (hFile=0x190) returned 1 [0067.433] CloseHandle (hObject=0x190) returned 1 [0067.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1 [0067.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.434] lstrlenW (lpString=".doc") returned 4 [0067.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.434] lstrlenW (lpString=".docx") returned 5 [0067.434] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0067.434] lstrlenW (lpString=".pdf") returned 4 [0067.434] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.434] lstrlenW (lpString=".xls") returned 4 [0067.434] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.434] lstrlenW (lpString=".xlsx") returned 5 [0067.434] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0067.434] lstrlenW (lpString=".ppt") returned 4 [0067.434] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.434] lstrlenW (lpString=".zip") returned 4 [0067.434] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.434] lstrlenW (lpString=".rar") returned 4 [0067.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString=".bz2") returned 4 [0067.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.435] lstrlenW (lpString=".7z") returned 3 [0067.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString=".dbf") returned 4 [0067.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString=".1cd") returned 4 [0067.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString=".jpg") returned 4 [0067.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString=".doc") returned 4 [0067.435] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString=".docx") returned 5 [0067.435] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0067.435] lstrlenW (lpString=".pdf") returned 4 [0067.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString=".xls") returned 4 [0067.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString=".xlsx") returned 5 [0067.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0067.435] lstrlenW (lpString=".ppt") returned 4 [0067.435] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.435] lstrlenW (lpString=".zip") returned 4 [0067.436] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.436] lstrlenW (lpString=".rar") returned 4 [0067.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.436] lstrlenW (lpString=".bz2") returned 4 [0067.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.436] lstrlenW (lpString=".7z") returned 3 [0067.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.436] lstrlenW (lpString=".dbf") returned 4 [0067.436] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.436] lstrlenW (lpString=".1cd") returned 4 [0067.436] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0067.436] lstrlenW (lpString=".jpg") returned 4 [0067.436] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.436] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.436] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0067.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.480] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=159104) returned 1 [0067.480] CloseHandle (hObject=0x190) returned 1 [0067.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0067.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.496] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.496] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.510] GetLastError () returned 0x0 [0067.510] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x26d80, lpOverlapped=0x0) returned 1 [0067.516] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x26d90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x26d90, lpOverlapped=0x0) returned 1 [0067.519] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.520] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0067.520] SetEndOfFile (hFile=0x1c8) returned 1 [0067.520] CloseHandle (hObject=0x1c8) returned 1 [0067.520] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.520] SetEndOfFile (hFile=0x190) returned 1 [0067.521] CloseHandle (hObject=0x190) returned 1 [0067.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1 [0067.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.522] lstrlenW (lpString=".doc") returned 4 [0067.522] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString=".docx") returned 5 [0067.522] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0067.522] lstrlenW (lpString=".pdf") returned 4 [0067.522] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString=".xls") returned 4 [0067.522] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString=".xlsx") returned 5 [0067.522] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0067.522] lstrlenW (lpString=".ppt") returned 4 [0067.522] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.522] lstrlenW (lpString=".zip") returned 4 [0067.522] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString=".rar") returned 4 [0067.522] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.522] lstrlenW (lpString=".bz2") returned 4 [0067.522] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.522] lstrlenW (lpString=".7z") returned 3 [0067.522] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.522] lstrlenW (lpString=".dbf") returned 4 [0067.523] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString=".1cd") returned 4 [0067.523] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString=".jpg") returned 4 [0067.523] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString=".doc") returned 4 [0067.523] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString=".docx") returned 5 [0067.523] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0067.523] lstrlenW (lpString=".pdf") returned 4 [0067.523] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString=".xls") returned 4 [0067.523] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString=".xlsx") returned 5 [0067.523] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0067.523] lstrlenW (lpString=".ppt") returned 4 [0067.523] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString=".zip") returned 4 [0067.523] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString=".rar") returned 4 [0067.523] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.523] lstrlenW (lpString=".bz2") returned 4 [0067.523] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.523] lstrlenW (lpString=".7z") returned 3 [0067.523] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.523] lstrlenW (lpString=".dbf") returned 4 [0067.523] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.524] lstrlenW (lpString=".1cd") returned 4 [0067.524] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0067.524] lstrlenW (lpString=".jpg") returned 4 [0067.524] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.524] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.524] lstrlenW (lpString="METCONV.DLL") returned 11 [0067.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.525] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=110976) returned 1 [0067.525] CloseHandle (hObject=0x190) returned 1 [0067.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0067.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.525] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.525] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.526] GetLastError () returned 0x0 [0067.526] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1b180, lpOverlapped=0x0) returned 1 [0067.531] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1b190, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1b190, lpOverlapped=0x0) returned 1 [0067.533] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.533] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0067.534] SetEndOfFile (hFile=0x1c8) returned 1 [0067.534] CloseHandle (hObject=0x1c8) returned 1 [0067.534] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.534] SetEndOfFile (hFile=0x190) returned 1 [0067.535] CloseHandle (hObject=0x190) returned 1 [0067.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1 [0067.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.536] lstrlenW (lpString=".doc") returned 4 [0067.536] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString=".docx") returned 5 [0067.536] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0067.536] lstrlenW (lpString=".pdf") returned 4 [0067.536] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString=".xls") returned 4 [0067.536] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString=".xlsx") returned 5 [0067.536] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0067.536] lstrlenW (lpString=".ppt") returned 4 [0067.536] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.536] lstrlenW (lpString=".zip") returned 4 [0067.536] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString=".rar") returned 4 [0067.536] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.536] lstrlenW (lpString=".bz2") returned 4 [0067.536] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.536] lstrlenW (lpString=".7z") returned 3 [0067.536] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.536] lstrlenW (lpString=".dbf") returned 4 [0067.536] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.536] lstrlenW (lpString=".1cd") returned 4 [0067.536] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.536] lstrlenW (lpString=".jpg") returned 4 [0067.536] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString=".doc") returned 4 [0067.537] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString=".docx") returned 5 [0067.537] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0067.537] lstrlenW (lpString=".pdf") returned 4 [0067.537] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString=".xls") returned 4 [0067.537] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString=".xlsx") returned 5 [0067.537] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0067.537] lstrlenW (lpString=".ppt") returned 4 [0067.537] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString=".zip") returned 4 [0067.537] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString=".rar") returned 4 [0067.537] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.537] lstrlenW (lpString=".bz2") returned 4 [0067.537] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.537] lstrlenW (lpString=".7z") returned 3 [0067.537] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString=".dbf") returned 4 [0067.537] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString=".1cd") returned 4 [0067.537] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0067.537] lstrlenW (lpString=".jpg") returned 4 [0067.538] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.538] lstrcmpiW (lpString1=".DLL", lpString2=".zoh") returned -1 [0067.538] lstrlenW (lpString="MOFL.DLL") returned 8 [0067.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.539] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=364928) returned 1 [0067.539] CloseHandle (hObject=0x190) returned 1 [0067.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0067.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0067.539] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.539] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0067.539] GetLastError () returned 0x0 [0067.539] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x59180, lpOverlapped=0x0) returned 1 [0067.548] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x59190, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x59190, lpOverlapped=0x0) returned 1 [0067.556] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.556] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0067.556] SetEndOfFile (hFile=0x1c8) returned 1 [0067.556] CloseHandle (hObject=0x1c8) returned 1 [0067.556] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.556] SetEndOfFile (hFile=0x190) returned 1 [0067.742] CloseHandle (hObject=0x190) returned 1 [0067.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0067.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1 [0067.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.742] lstrlenW (lpString=".doc") returned 4 [0067.742] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.742] lstrlenW (lpString=".docx") returned 5 [0067.742] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0067.742] lstrlenW (lpString=".pdf") returned 4 [0067.742] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.742] lstrlenW (lpString=".xls") returned 4 [0067.742] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.742] lstrlenW (lpString=".xlsx") returned 5 [0067.742] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0067.742] lstrlenW (lpString=".ppt") returned 4 [0067.743] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString=".zip") returned 4 [0067.743] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString=".rar") returned 4 [0067.743] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString=".bz2") returned 4 [0067.743] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.743] lstrlenW (lpString=".7z") returned 3 [0067.743] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString=".dbf") returned 4 [0067.743] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString=".1cd") returned 4 [0067.743] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString=".jpg") returned 4 [0067.743] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.743] lstrlenW (lpString=".doc") returned 4 [0067.743] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString=".docx") returned 5 [0067.743] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0067.743] lstrlenW (lpString=".pdf") returned 4 [0067.743] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString=".xls") returned 4 [0067.743] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.743] lstrlenW (lpString=".xlsx") returned 5 [0067.743] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0067.743] lstrlenW (lpString=".ppt") returned 4 [0067.743] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.744] lstrlenW (lpString=".zip") returned 4 [0067.744] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.744] lstrlenW (lpString=".rar") returned 4 [0067.744] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.744] lstrlenW (lpString=".bz2") returned 4 [0067.744] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.744] lstrlenW (lpString=".7z") returned 3 [0067.744] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.744] lstrlenW (lpString=".dbf") returned 4 [0067.744] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.744] lstrlenW (lpString=".1cd") returned 4 [0067.744] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0067.744] lstrlenW (lpString=".jpg") returned 4 [0067.744] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.744] lstrcmpiW (lpString1=".CNV", lpString2=".zoh") returned -1 [0067.744] lstrlenW (lpString="WPFT532.CNV") returned 11 [0067.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.778] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=196976) returned 1 [0067.778] CloseHandle (hObject=0x1f4) returned 1 [0067.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0067.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0067.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.778] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.778] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0067.778] GetLastError () returned 0x0 [0067.778] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x30170, lpOverlapped=0x0) returned 1 [0068.249] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x30180, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x30180, lpOverlapped=0x0) returned 1 [0068.252] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.252] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.252] SetEndOfFile (hFile=0x160) returned 1 [0068.252] CloseHandle (hObject=0x160) returned 1 [0068.252] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.252] SetEndOfFile (hFile=0x1f4) returned 1 [0068.254] CloseHandle (hObject=0x1f4) returned 1 [0068.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.255] lstrlenW (lpString=".doc") returned 4 [0068.255] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0068.255] lstrlenW (lpString=".docx") returned 5 [0068.255] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0068.255] lstrlenW (lpString=".pdf") returned 4 [0068.255] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0068.255] lstrlenW (lpString=".xls") returned 4 [0068.255] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0068.255] lstrlenW (lpString=".xlsx") returned 5 [0068.255] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0068.255] lstrlenW (lpString=".ppt") returned 4 [0068.255] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.255] lstrlenW (lpString=".zip") returned 4 [0068.255] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0068.255] lstrlenW (lpString=".rar") returned 4 [0068.255] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString=".bz2") returned 4 [0068.256] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0068.256] lstrlenW (lpString=".7z") returned 3 [0068.256] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString=".dbf") returned 4 [0068.256] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString=".1cd") returned 4 [0068.256] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString=".jpg") returned 4 [0068.256] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString=".doc") returned 4 [0068.256] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString=".docx") returned 5 [0068.256] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0068.256] lstrlenW (lpString=".pdf") returned 4 [0068.256] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString=".xls") returned 4 [0068.256] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString=".xlsx") returned 5 [0068.256] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0068.256] lstrlenW (lpString=".ppt") returned 4 [0068.256] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.256] lstrlenW (lpString=".zip") returned 4 [0068.256] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0068.256] lstrlenW (lpString=".rar") returned 4 [0068.256] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0068.257] lstrlenW (lpString=".bz2") returned 4 [0068.257] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0068.257] lstrlenW (lpString=".7z") returned 3 [0068.257] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.257] lstrlenW (lpString=".dbf") returned 4 [0068.257] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.257] lstrlenW (lpString=".1cd") returned 4 [0068.257] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0068.257] lstrlenW (lpString=".jpg") returned 4 [0068.257] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0068.257] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.257] lstrlenW (lpString="BLENDS.ELM") returned 10 [0068.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.258] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=69047) returned 1 [0068.258] CloseHandle (hObject=0x1f4) returned 1 [0068.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0068.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.258] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.258] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.258] GetLastError () returned 0x0 [0068.258] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x10db7, lpOverlapped=0x0) returned 1 [0068.345] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10dc0, lpOverlapped=0x0) returned 1 [0068.347] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.347] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.347] SetEndOfFile (hFile=0x160) returned 1 [0068.347] CloseHandle (hObject=0x160) returned 1 [0068.347] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.347] SetEndOfFile (hFile=0x1f4) returned 1 [0068.349] CloseHandle (hObject=0x1f4) returned 1 [0068.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.349] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1 [0068.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.349] lstrlenW (lpString=".doc") returned 4 [0068.349] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.349] lstrlenW (lpString=".docx") returned 5 [0068.349] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.349] lstrlenW (lpString=".pdf") returned 4 [0068.349] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.349] lstrlenW (lpString=".xls") returned 4 [0068.349] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.349] lstrlenW (lpString=".xlsx") returned 5 [0068.349] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.349] lstrlenW (lpString=".ppt") returned 4 [0068.349] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.349] lstrlenW (lpString=".zip") returned 4 [0068.349] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.349] lstrlenW (lpString=".rar") returned 4 [0068.350] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString=".bz2") returned 4 [0068.350] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.350] lstrlenW (lpString=".7z") returned 3 [0068.350] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString=".dbf") returned 4 [0068.350] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString=".1cd") returned 4 [0068.350] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString=".jpg") returned 4 [0068.350] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString=".doc") returned 4 [0068.350] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.350] lstrlenW (lpString=".docx") returned 5 [0068.350] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.350] lstrlenW (lpString=".pdf") returned 4 [0068.350] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString=".xls") returned 4 [0068.350] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString=".xlsx") returned 5 [0068.350] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.350] lstrlenW (lpString=".ppt") returned 4 [0068.350] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.350] lstrlenW (lpString=".zip") returned 4 [0068.350] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.350] lstrlenW (lpString=".rar") returned 4 [0068.350] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.351] lstrlenW (lpString=".bz2") returned 4 [0068.351] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.351] lstrlenW (lpString=".7z") returned 3 [0068.351] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.351] lstrlenW (lpString=".dbf") returned 4 [0068.351] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.351] lstrlenW (lpString=".1cd") returned 4 [0068.351] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0068.351] lstrlenW (lpString=".jpg") returned 4 [0068.351] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.351] lstrcmpiW (lpString1=".ELM", lpString2=".zoh") returned -1 [0068.351] lstrlenW (lpString="CANYON.ELM") returned 10 [0068.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.351] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=44745) returned 1 [0068.352] CloseHandle (hObject=0x1f4) returned 1 [0068.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0068.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.352] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.352] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.352] GetLastError () returned 0x0 [0068.352] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xaec9, lpOverlapped=0x0) returned 1 [0068.362] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xaed0, lpOverlapped=0x0) returned 1 [0068.404] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.404] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0068.404] SetEndOfFile (hFile=0x160) returned 1 [0068.433] CloseHandle (hObject=0x160) returned 1 [0068.433] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.433] SetEndOfFile (hFile=0x1f4) returned 1 [0068.434] CloseHandle (hObject=0x1f4) returned 1 [0068.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.435] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 1 [0068.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.435] lstrlenW (lpString=".doc") returned 4 [0068.435] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.435] lstrlenW (lpString=".docx") returned 5 [0068.435] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0068.435] lstrlenW (lpString=".pdf") returned 4 [0068.435] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.435] lstrlenW (lpString=".xls") returned 4 [0068.435] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.435] lstrlenW (lpString=".xlsx") returned 5 [0068.435] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0068.435] lstrlenW (lpString=".ppt") returned 4 [0068.435] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.435] lstrlenW (lpString=".zip") returned 4 [0068.435] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.435] lstrlenW (lpString=".rar") returned 4 [0068.435] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.435] lstrlenW (lpString=".bz2") returned 4 [0068.435] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.435] lstrlenW (lpString=".7z") returned 3 [0068.435] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.435] lstrlenW (lpString=".dbf") returned 4 [0068.435] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.436] lstrlenW (lpString=".1cd") returned 4 [0068.436] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0068.436] lstrlenW (lpString=".jpg") returned 4 [0068.436] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.436] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") [0068.436] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=610) returned 1 [0068.436] CloseHandle (hObject=0x1f4) returned 1 [0068.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20 [0068.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.436] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.436] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.437] GetLastError () returned 0x0 [0068.437] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x262, lpOverlapped=0x0) returned 1 [0068.438] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x270, lpOverlapped=0x0) returned 1 [0068.439] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.439] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.439] SetEndOfFile (hFile=0x160) returned 1 [0068.439] CloseHandle (hObject=0x160) returned 1 [0068.439] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.439] SetEndOfFile (hFile=0x1f4) returned 1 [0068.440] CloseHandle (hObject=0x1f4) returned 1 [0068.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 1 [0068.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.440] lstrlenW (lpString=".doc") returned 4 [0068.440] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.440] lstrlenW (lpString=".docx") returned 5 [0068.440] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0068.440] lstrlenW (lpString=".pdf") returned 4 [0068.440] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.440] lstrlenW (lpString=".xls") returned 4 [0068.440] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.440] lstrlenW (lpString=".xlsx") returned 5 [0068.440] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0068.441] lstrlenW (lpString=".ppt") returned 4 [0068.441] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.441] lstrlenW (lpString=".zip") returned 4 [0068.441] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.441] lstrlenW (lpString=".rar") returned 4 [0068.441] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.441] lstrlenW (lpString=".bz2") returned 4 [0068.441] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.441] lstrlenW (lpString=".7z") returned 3 [0068.441] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.441] lstrlenW (lpString=".dbf") returned 4 [0068.441] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.441] lstrlenW (lpString=".1cd") returned 4 [0068.441] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0068.441] lstrlenW (lpString=".jpg") returned 4 [0068.441] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.441] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") [0068.442] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=54803) returned 1 [0068.442] CloseHandle (hObject=0x1f4) returned 1 [0068.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20 [0068.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.443] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.443] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.443] GetLastError () returned 0x0 [0068.443] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd613, lpOverlapped=0x0) returned 1 [0068.759] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd620, lpOverlapped=0x0) returned 1 [0068.761] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.761] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.761] SetEndOfFile (hFile=0x160) returned 1 [0068.762] CloseHandle (hObject=0x160) returned 1 [0068.762] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.762] SetEndOfFile (hFile=0x1f4) returned 1 [0068.763] CloseHandle (hObject=0x1f4) returned 1 [0068.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 1 [0068.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.763] lstrlenW (lpString=".doc") returned 4 [0068.763] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0068.763] lstrlenW (lpString=".docx") returned 5 [0068.763] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0068.763] lstrlenW (lpString=".pdf") returned 4 [0068.763] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0068.763] lstrlenW (lpString=".xls") returned 4 [0068.763] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0068.763] lstrlenW (lpString=".xlsx") returned 5 [0068.763] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0068.764] lstrlenW (lpString=".ppt") returned 4 [0068.764] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0068.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.764] lstrlenW (lpString=".zip") returned 4 [0068.764] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0068.764] lstrlenW (lpString=".rar") returned 4 [0068.764] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0068.764] lstrlenW (lpString=".bz2") returned 4 [0068.764] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0068.764] lstrlenW (lpString=".7z") returned 3 [0068.764] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0068.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.764] lstrlenW (lpString=".dbf") returned 4 [0068.764] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0068.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.764] lstrlenW (lpString=".1cd") returned 4 [0068.764] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0068.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0068.764] lstrlenW (lpString=".jpg") returned 4 [0068.764] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0068.764] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") [0068.765] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=569) returned 1 [0068.765] CloseHandle (hObject=0x1f4) returned 1 [0068.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0068.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0068.766] GetLastError () returned 0x0 [0068.766] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x239, lpOverlapped=0x0) returned 1 [0068.767] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x240, lpOverlapped=0x0) returned 1 [0068.767] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.767] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.768] SetEndOfFile (hFile=0x160) returned 1 [0068.768] CloseHandle (hObject=0x160) returned 1 [0068.768] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.768] SetEndOfFile (hFile=0x1f4) returned 1 [0068.769] CloseHandle (hObject=0x1f4) returned 1 [0068.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.769] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 1 [0068.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.769] lstrlenW (lpString=".doc") returned 4 [0068.769] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0068.769] lstrlenW (lpString=".docx") returned 5 [0068.769] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0068.769] lstrlenW (lpString=".pdf") returned 4 [0068.769] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0068.769] lstrlenW (lpString=".xls") returned 4 [0068.769] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0068.769] lstrlenW (lpString=".xlsx") returned 5 [0068.769] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0068.769] lstrlenW (lpString=".ppt") returned 4 [0068.769] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0068.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.769] lstrlenW (lpString=".zip") returned 4 [0068.770] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0068.770] lstrlenW (lpString=".rar") returned 4 [0068.770] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0068.770] lstrlenW (lpString=".bz2") returned 4 [0068.770] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0068.770] lstrlenW (lpString=".7z") returned 3 [0068.770] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0068.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.770] lstrlenW (lpString=".dbf") returned 4 [0068.770] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0068.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.770] lstrlenW (lpString=".1cd") returned 4 [0068.770] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0068.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0068.770] lstrlenW (lpString=".jpg") returned 4 [0068.770] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0068.770] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") [0068.945] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=45262) returned 1 [0068.945] CloseHandle (hObject=0x1c8) returned 1 [0068.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0068.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0068.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0068.945] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.945] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.946] GetLastError () returned 0x0 [0068.946] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb0ce, lpOverlapped=0x0) returned 1 [0068.950] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb0d0, lpOverlapped=0x0) returned 1 [0068.953] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.953] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0068.953] SetEndOfFile (hFile=0x1fc) returned 1 [0068.953] CloseHandle (hObject=0x1fc) returned 1 [0068.953] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.954] SetEndOfFile (hFile=0x1c8) returned 1 [0068.954] CloseHandle (hObject=0x1c8) returned 1 [0068.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0068.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 1 [0068.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0068.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0068.988] lstrlenW (lpString=".doc") returned 4 [0069.097] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.100] lstrlenW (lpString=".docx") returned 5 [0069.100] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0069.100] lstrlenW (lpString=".pdf") returned 4 [0069.100] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.100] lstrlenW (lpString=".xls") returned 4 [0069.100] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.101] lstrlenW (lpString=".xlsx") returned 5 [0069.101] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0069.101] lstrlenW (lpString=".ppt") returned 4 [0069.101] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0069.102] lstrlenW (lpString=".zip") returned 4 [0069.102] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.102] lstrlenW (lpString=".rar") returned 4 [0069.102] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.102] lstrlenW (lpString=".bz2") returned 4 [0069.102] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.102] lstrlenW (lpString=".7z") returned 3 [0069.102] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0069.105] lstrlenW (lpString=".dbf") returned 4 [0069.105] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0069.106] lstrlenW (lpString=".1cd") returned 4 [0069.106] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0069.106] lstrlenW (lpString=".jpg") returned 4 [0069.106] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.106] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") [0069.112] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=595) returned 1 [0069.112] CloseHandle (hObject=0x1c8) returned 1 [0069.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20 [0069.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0069.114] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.114] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.115] GetLastError () returned 0x0 [0069.115] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x253, lpOverlapped=0x0) returned 1 [0069.116] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x260, lpOverlapped=0x0) returned 1 [0069.117] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.117] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.117] SetEndOfFile (hFile=0x1fc) returned 1 [0069.117] CloseHandle (hObject=0x1fc) returned 1 [0069.117] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.117] SetEndOfFile (hFile=0x1c8) returned 1 [0069.118] CloseHandle (hObject=0x1c8) returned 1 [0069.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.118] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 1 [0069.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.119] lstrlenW (lpString=".doc") returned 4 [0069.119] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.119] lstrlenW (lpString=".docx") returned 5 [0069.119] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.119] lstrlenW (lpString=".pdf") returned 4 [0069.119] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.119] lstrlenW (lpString=".xls") returned 4 [0069.119] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.119] lstrlenW (lpString=".xlsx") returned 5 [0069.119] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.119] lstrlenW (lpString=".ppt") returned 4 [0069.119] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.119] lstrlenW (lpString=".zip") returned 4 [0069.119] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.119] lstrlenW (lpString=".rar") returned 4 [0069.119] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.119] lstrlenW (lpString=".bz2") returned 4 [0069.119] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.119] lstrlenW (lpString=".7z") returned 3 [0069.119] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.119] lstrlenW (lpString=".dbf") returned 4 [0069.119] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.119] lstrlenW (lpString=".1cd") returned 4 [0069.119] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0069.119] lstrlenW (lpString=".jpg") returned 4 [0069.119] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.119] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") [0069.120] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=47352) returned 1 [0069.120] CloseHandle (hObject=0x1c8) returned 1 [0069.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20 [0069.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0069.120] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.120] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.123] GetLastError () returned 0x0 [0069.123] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb8f8, lpOverlapped=0x0) returned 1 [0069.142] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb900, lpOverlapped=0x0) returned 1 [0069.144] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.144] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0069.144] SetEndOfFile (hFile=0x1fc) returned 1 [0069.144] CloseHandle (hObject=0x1fc) returned 1 [0069.144] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.144] SetEndOfFile (hFile=0x1c8) returned 1 [0069.145] CloseHandle (hObject=0x1c8) returned 1 [0069.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.145] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 1 [0069.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.145] lstrlenW (lpString=".doc") returned 4 [0069.145] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.146] lstrlenW (lpString=".docx") returned 5 [0069.146] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.146] lstrlenW (lpString=".pdf") returned 4 [0069.146] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.146] lstrlenW (lpString=".xls") returned 4 [0069.146] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.146] lstrlenW (lpString=".xlsx") returned 5 [0069.146] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.146] lstrlenW (lpString=".ppt") returned 4 [0069.146] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.146] lstrlenW (lpString=".zip") returned 4 [0069.146] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.146] lstrlenW (lpString=".rar") returned 4 [0069.146] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.146] lstrlenW (lpString=".bz2") returned 4 [0069.146] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.146] lstrlenW (lpString=".7z") returned 3 [0069.146] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.146] lstrlenW (lpString=".dbf") returned 4 [0069.146] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.146] lstrlenW (lpString=".1cd") returned 4 [0069.146] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0069.146] lstrlenW (lpString=".jpg") returned 4 [0069.146] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.146] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") [0069.147] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=77294) returned 1 [0069.147] CloseHandle (hObject=0x1c8) returned 1 [0069.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20 [0069.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0069.147] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.147] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.148] GetLastError () returned 0x0 [0069.148] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x12dee, lpOverlapped=0x0) returned 1 [0069.151] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x12df0, lpOverlapped=0x0) returned 1 [0069.152] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.152] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.153] SetEndOfFile (hFile=0x1fc) returned 1 [0069.153] CloseHandle (hObject=0x1fc) returned 1 [0069.153] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.153] SetEndOfFile (hFile=0x1c8) returned 1 [0069.154] CloseHandle (hObject=0x1c8) returned 1 [0069.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.154] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 1 [0069.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.154] lstrlenW (lpString=".doc") returned 4 [0069.154] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.154] lstrlenW (lpString=".docx") returned 5 [0069.154] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0069.154] lstrlenW (lpString=".pdf") returned 4 [0069.155] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.155] lstrlenW (lpString=".xls") returned 4 [0069.155] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.155] lstrlenW (lpString=".xlsx") returned 5 [0069.155] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0069.155] lstrlenW (lpString=".ppt") returned 4 [0069.155] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.155] lstrlenW (lpString=".zip") returned 4 [0069.155] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.155] lstrlenW (lpString=".rar") returned 4 [0069.155] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.155] lstrlenW (lpString=".bz2") returned 4 [0069.155] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.155] lstrlenW (lpString=".7z") returned 3 [0069.155] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.155] lstrlenW (lpString=".dbf") returned 4 [0069.155] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.155] lstrlenW (lpString=".1cd") returned 4 [0069.155] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0069.155] lstrlenW (lpString=".jpg") returned 4 [0069.155] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.155] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") [0069.209] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=547) returned 1 [0069.209] CloseHandle (hObject=0x16c) returned 1 [0069.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0069.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.209] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.209] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0069.210] GetLastError () returned 0x0 [0069.210] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x223, lpOverlapped=0x0) returned 1 [0069.210] WriteFile (in: hFile=0x154, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x230, lpOverlapped=0x0) returned 1 [0069.211] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.211] WriteFile (in: hFile=0x154, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.211] SetEndOfFile (hFile=0x154) returned 1 [0069.212] CloseHandle (hObject=0x154) returned 1 [0069.212] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.212] SetEndOfFile (hFile=0x16c) returned 1 [0069.212] CloseHandle (hObject=0x16c) returned 1 [0069.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.213] lstrlenW (lpString=".doc") returned 4 [0069.213] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.213] lstrlenW (lpString=".docx") returned 5 [0069.213] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0069.213] lstrlenW (lpString=".pdf") returned 4 [0069.213] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.213] lstrlenW (lpString=".xls") returned 4 [0069.213] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.213] lstrlenW (lpString=".xlsx") returned 5 [0069.213] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0069.213] lstrlenW (lpString=".ppt") returned 4 [0069.213] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.213] lstrlenW (lpString=".zip") returned 4 [0069.213] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.213] lstrlenW (lpString=".rar") returned 4 [0069.213] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.213] lstrlenW (lpString=".bz2") returned 4 [0069.213] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.213] lstrlenW (lpString=".7z") returned 3 [0069.213] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.213] lstrlenW (lpString=".dbf") returned 4 [0069.214] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.214] lstrlenW (lpString=".1cd") returned 4 [0069.214] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0069.214] lstrlenW (lpString=".jpg") returned 4 [0069.214] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.214] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") [0069.320] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=68048) returned 1 [0069.320] CloseHandle (hObject=0x1c0) returned 1 [0069.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0069.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.321] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.321] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.321] GetLastError () returned 0x0 [0069.321] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x109d0, lpOverlapped=0x0) returned 1 [0069.357] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x109e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x109e0, lpOverlapped=0x0) returned 1 [0069.358] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.359] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0069.359] SetEndOfFile (hFile=0x1f0) returned 1 [0069.359] CloseHandle (hObject=0x1f0) returned 1 [0069.359] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.359] SetEndOfFile (hFile=0x1c0) returned 1 [0069.360] CloseHandle (hObject=0x1c0) returned 1 [0069.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.360] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 1 [0069.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.360] lstrlenW (lpString=".doc") returned 4 [0069.360] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0069.361] lstrlenW (lpString=".docx") returned 5 [0069.361] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0069.361] lstrlenW (lpString=".pdf") returned 4 [0069.361] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0069.361] lstrlenW (lpString=".xls") returned 4 [0069.361] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0069.361] lstrlenW (lpString=".xlsx") returned 5 [0069.361] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0069.361] lstrlenW (lpString=".ppt") returned 4 [0069.361] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0069.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.361] lstrlenW (lpString=".zip") returned 4 [0069.361] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0069.361] lstrlenW (lpString=".rar") returned 4 [0069.361] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0069.361] lstrlenW (lpString=".bz2") returned 4 [0069.361] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0069.361] lstrlenW (lpString=".7z") returned 3 [0069.361] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0069.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.361] lstrlenW (lpString=".dbf") returned 4 [0069.361] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0069.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.361] lstrlenW (lpString=".1cd") returned 4 [0069.361] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0069.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0069.361] lstrlenW (lpString=".jpg") returned 4 [0069.361] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0069.361] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") [0069.523] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=587) returned 1 [0069.523] CloseHandle (hObject=0x158) returned 1 [0069.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20 [0069.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0069.523] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.523] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.524] GetLastError () returned 0x0 [0069.524] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x24b, lpOverlapped=0x0) returned 1 [0069.525] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x250, lpOverlapped=0x0) returned 1 [0069.526] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.526] SetEndOfFile (hFile=0x1ec) returned 1 [0069.526] CloseHandle (hObject=0x1ec) returned 1 [0069.526] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.526] SetEndOfFile (hFile=0x158) returned 1 [0069.527] CloseHandle (hObject=0x158) returned 1 [0069.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 1 [0069.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.527] lstrlenW (lpString=".doc") returned 4 [0069.527] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.527] lstrlenW (lpString=".docx") returned 5 [0069.527] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0069.527] lstrlenW (lpString=".pdf") returned 4 [0069.527] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.527] lstrlenW (lpString=".xls") returned 4 [0069.527] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.527] lstrlenW (lpString=".xlsx") returned 5 [0069.528] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0069.528] lstrlenW (lpString=".ppt") returned 4 [0069.528] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.528] lstrlenW (lpString=".zip") returned 4 [0069.528] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.528] lstrlenW (lpString=".rar") returned 4 [0069.528] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.528] lstrlenW (lpString=".bz2") returned 4 [0069.528] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.528] lstrlenW (lpString=".7z") returned 3 [0069.528] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.528] lstrlenW (lpString=".dbf") returned 4 [0069.528] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.528] lstrlenW (lpString=".1cd") returned 4 [0069.528] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0069.528] lstrlenW (lpString=".jpg") returned 4 [0069.528] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.528] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") [0069.926] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=484) returned 1 [0069.926] CloseHandle (hObject=0x1c0) returned 1 [0069.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20 [0069.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0069.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.927] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.927] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.927] GetLastError () returned 0x0 [0069.927] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1e4, lpOverlapped=0x0) returned 1 [0069.928] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1f0, lpOverlapped=0x0) returned 1 [0069.929] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.929] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0069.929] SetEndOfFile (hFile=0x1f0) returned 1 [0069.929] CloseHandle (hObject=0x1f0) returned 1 [0069.929] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.930] SetEndOfFile (hFile=0x1c0) returned 1 [0069.930] CloseHandle (hObject=0x1c0) returned 1 [0069.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0069.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 1 [0069.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.931] lstrlenW (lpString=".doc") returned 4 [0069.931] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0069.931] lstrlenW (lpString=".docx") returned 5 [0069.931] lstrcmpiW (lpString1=".docx", lpString2="A.INF") returned -1 [0069.931] lstrlenW (lpString=".pdf") returned 4 [0069.931] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0069.931] lstrlenW (lpString=".xls") returned 4 [0069.931] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0069.931] lstrlenW (lpString=".xlsx") returned 5 [0069.931] lstrcmpiW (lpString1=".xlsx", lpString2="A.INF") returned -1 [0069.931] lstrlenW (lpString=".ppt") returned 4 [0069.931] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0069.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.931] lstrlenW (lpString=".zip") returned 4 [0069.931] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0069.931] lstrlenW (lpString=".rar") returned 4 [0069.931] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0069.931] lstrlenW (lpString=".bz2") returned 4 [0069.931] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0069.931] lstrlenW (lpString=".7z") returned 3 [0069.931] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0069.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.931] lstrlenW (lpString=".dbf") returned 4 [0069.932] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0069.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.932] lstrlenW (lpString=".1cd") returned 4 [0069.932] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0069.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0069.932] lstrlenW (lpString=".jpg") returned 4 [0069.932] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0069.932] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") [0070.082] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=555) returned 1 [0070.082] CloseHandle (hObject=0x154) returned 1 [0070.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0070.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.082] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.082] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0070.083] GetLastError () returned 0x0 [0070.083] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x22b, lpOverlapped=0x0) returned 1 [0070.084] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x230, lpOverlapped=0x0) returned 1 [0070.648] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.648] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.648] SetEndOfFile (hFile=0x22c) returned 1 [0070.649] CloseHandle (hObject=0x22c) returned 1 [0070.649] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.649] SetEndOfFile (hFile=0x154) returned 1 [0070.649] CloseHandle (hObject=0x154) returned 1 [0070.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.650] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 1 [0070.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.650] lstrlenW (lpString=".doc") returned 4 [0070.650] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0070.650] lstrlenW (lpString=".docx") returned 5 [0070.650] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0070.650] lstrlenW (lpString=".pdf") returned 4 [0070.650] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0070.650] lstrlenW (lpString=".xls") returned 4 [0070.650] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0070.650] lstrlenW (lpString=".xlsx") returned 5 [0070.650] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0070.650] lstrlenW (lpString=".ppt") returned 4 [0070.650] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0070.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.650] lstrlenW (lpString=".zip") returned 4 [0070.650] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0070.650] lstrlenW (lpString=".rar") returned 4 [0070.650] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0070.650] lstrlenW (lpString=".bz2") returned 4 [0070.650] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0070.650] lstrlenW (lpString=".7z") returned 3 [0070.650] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0070.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.650] lstrlenW (lpString=".dbf") returned 4 [0070.651] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0070.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.651] lstrlenW (lpString=".1cd") returned 4 [0070.651] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0070.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0070.651] lstrlenW (lpString=".jpg") returned 4 [0070.651] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0070.651] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") [0070.652] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=229888) returned 1 [0070.652] CloseHandle (hObject=0x154) returned 1 [0070.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20 [0070.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.652] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.652] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0070.653] GetLastError () returned 0x0 [0070.653] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x38200, lpOverlapped=0x0) returned 1 [0070.659] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x38210, lpOverlapped=0x0) returned 1 [0070.664] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.664] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.664] SetEndOfFile (hFile=0x22c) returned 1 [0070.665] CloseHandle (hObject=0x22c) returned 1 [0070.665] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.665] SetEndOfFile (hFile=0x154) returned 1 [0070.667] CloseHandle (hObject=0x154) returned 1 [0070.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0070.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 1 [0070.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.667] lstrlenW (lpString=".doc") returned 4 [0070.667] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0070.667] lstrlenW (lpString=".docx") returned 5 [0070.667] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0070.667] lstrlenW (lpString=".pdf") returned 4 [0070.667] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0070.667] lstrlenW (lpString=".xls") returned 4 [0070.667] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0070.667] lstrlenW (lpString=".xlsx") returned 5 [0070.667] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0070.667] lstrlenW (lpString=".ppt") returned 4 [0070.668] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0070.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.668] lstrlenW (lpString=".zip") returned 4 [0070.668] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0070.668] lstrlenW (lpString=".rar") returned 4 [0070.668] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0070.668] lstrlenW (lpString=".bz2") returned 4 [0070.668] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0070.668] lstrlenW (lpString=".7z") returned 3 [0070.668] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0070.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.668] lstrlenW (lpString=".dbf") returned 4 [0070.668] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0070.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.668] lstrlenW (lpString=".1cd") returned 4 [0070.668] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0070.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0070.668] lstrlenW (lpString=".jpg") returned 4 [0070.668] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0070.668] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") [0070.669] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1046514) returned 1 [0070.669] CloseHandle (hObject=0x154) returned 1 [0070.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0070.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0070.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0070.669] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.669] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0070.671] GetLastError () returned 0x0 [0070.671] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xff7f2, lpOverlapped=0x0) returned 1 [0071.052] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xff800, lpOverlapped=0x0) returned 1 [0071.071] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.071] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.071] SetEndOfFile (hFile=0x22c) returned 1 [0071.071] CloseHandle (hObject=0x22c) returned 1 [0071.071] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.071] SetEndOfFile (hFile=0x154) returned 1 [0071.079] CloseHandle (hObject=0x154) returned 1 [0071.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.079] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 1 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.079] lstrlenW (lpString=".doc") returned 4 [0071.080] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0071.080] lstrlenW (lpString=".docx") returned 5 [0071.080] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1 [0071.080] lstrlenW (lpString=".pdf") returned 4 [0071.080] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0071.080] lstrlenW (lpString=".xls") returned 4 [0071.080] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0071.080] lstrlenW (lpString=".xlsx") returned 5 [0071.080] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1 [0071.080] lstrlenW (lpString=".ppt") returned 4 [0071.080] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.080] lstrlenW (lpString=".zip") returned 4 [0071.080] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0071.080] lstrlenW (lpString=".rar") returned 4 [0071.080] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0071.080] lstrlenW (lpString=".bz2") returned 4 [0071.080] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0071.080] lstrlenW (lpString=".7z") returned 3 [0071.080] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.080] lstrlenW (lpString=".dbf") returned 4 [0071.080] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.080] lstrlenW (lpString=".1cd") returned 4 [0071.080] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0071.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0071.080] lstrlenW (lpString=".jpg") returned 4 [0071.080] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0071.080] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") [0071.081] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=840364) returned 1 [0071.081] CloseHandle (hObject=0x154) returned 1 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.081] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0071.594] GetLastError () returned 0x0 [0071.594] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcd2ac, lpOverlapped=0x0) returned 1 [0071.611] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xcd2b0, lpOverlapped=0x0) returned 1 [0071.628] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.628] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.628] SetEndOfFile (hFile=0x180) returned 1 [0071.628] CloseHandle (hObject=0x180) returned 1 [0071.628] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.628] SetEndOfFile (hFile=0x154) returned 1 [0071.838] CloseHandle (hObject=0x154) returned 1 [0071.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 1 [0071.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.838] lstrlenW (lpString=".doc") returned 4 [0071.838] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0071.838] lstrlenW (lpString=".docx") returned 5 [0071.838] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1 [0071.838] lstrlenW (lpString=".pdf") returned 4 [0071.838] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0071.838] lstrlenW (lpString=".xls") returned 4 [0071.838] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0071.838] lstrlenW (lpString=".xlsx") returned 5 [0071.838] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1 [0071.838] lstrlenW (lpString=".ppt") returned 4 [0071.838] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0071.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.838] lstrlenW (lpString=".zip") returned 4 [0071.839] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0071.839] lstrlenW (lpString=".rar") returned 4 [0071.839] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0071.839] lstrlenW (lpString=".bz2") returned 4 [0071.839] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0071.839] lstrlenW (lpString=".7z") returned 3 [0071.839] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.839] lstrlenW (lpString=".dbf") returned 4 [0071.839] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.839] lstrlenW (lpString=".1cd") returned 4 [0071.839] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 73 [0071.839] lstrlenW (lpString=".jpg") returned 4 [0071.839] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0071.839] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") [0071.840] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1110528) returned 1 [0071.840] CloseHandle (hObject=0x154) returned 1 [0071.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0071.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.840] lstrlenW (lpString=".doc") returned 4 [0071.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.840] lstrlenW (lpString=".docx") returned 5 [0071.840] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0071.840] lstrlenW (lpString=".pdf") returned 4 [0071.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.840] lstrlenW (lpString=".xls") returned 4 [0071.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.840] lstrlenW (lpString=".xlsx") returned 5 [0071.840] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0071.840] lstrlenW (lpString=".ppt") returned 4 [0071.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.840] lstrlenW (lpString=".zip") returned 4 [0071.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.841] lstrlenW (lpString=".rar") returned 4 [0071.841] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.841] lstrlenW (lpString=".bz2") returned 4 [0071.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.841] lstrlenW (lpString=".7z") returned 3 [0071.841] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.841] lstrlenW (lpString=".dbf") returned 4 [0071.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.841] lstrlenW (lpString=".1cd") returned 4 [0071.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 58 [0071.841] lstrlenW (lpString=".jpg") returned 4 [0071.841] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.841] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") [0071.842] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=324330) returned 1 [0071.842] CloseHandle (hObject=0x154) returned 1 [0071.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20 [0071.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.842] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.843] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.843] GetLastError () returned 0x0 [0071.843] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4f2ea, lpOverlapped=0x0) returned 1 [0071.864] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4f2f0, lpOverlapped=0x0) returned 1 [0071.869] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.870] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.870] SetEndOfFile (hFile=0x160) returned 1 [0071.870] CloseHandle (hObject=0x160) returned 1 [0071.870] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.870] SetEndOfFile (hFile=0x154) returned 1 [0071.873] CloseHandle (hObject=0x154) returned 1 [0071.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0071.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 1 [0071.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.873] lstrlenW (lpString=".doc") returned 4 [0071.873] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0071.873] lstrlenW (lpString=".docx") returned 5 [0071.873] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0071.873] lstrlenW (lpString=".pdf") returned 4 [0071.873] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0071.873] lstrlenW (lpString=".xls") returned 4 [0071.873] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0071.874] lstrlenW (lpString=".xlsx") returned 5 [0071.874] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0071.874] lstrlenW (lpString=".ppt") returned 4 [0071.874] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0071.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.874] lstrlenW (lpString=".zip") returned 4 [0071.874] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0071.874] lstrlenW (lpString=".rar") returned 4 [0071.874] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0071.874] lstrlenW (lpString=".bz2") returned 4 [0071.874] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0071.874] lstrlenW (lpString=".7z") returned 3 [0071.874] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0071.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.874] lstrlenW (lpString=".dbf") returned 4 [0071.874] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0071.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.874] lstrlenW (lpString=".1cd") returned 4 [0071.874] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0071.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 77 [0071.874] lstrlenW (lpString=".jpg") returned 4 [0071.874] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0071.874] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") [0071.874] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=436710) returned 1 [0071.875] CloseHandle (hObject=0x154) returned 1 [0071.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20 [0071.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0071.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0071.875] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.875] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0071.875] GetLastError () returned 0x0 [0071.875] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6a9e6, lpOverlapped=0x0) returned 1 [0071.902] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6a9f0, lpOverlapped=0x0) returned 1 [0071.909] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.909] WriteFile (in: hFile=0x160, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.909] SetEndOfFile (hFile=0x160) returned 1 [0071.909] CloseHandle (hObject=0x160) returned 1 [0071.909] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.909] SetEndOfFile (hFile=0x154) returned 1 [0072.069] CloseHandle (hObject=0x154) returned 1 [0072.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 1 [0072.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.069] lstrlenW (lpString=".doc") returned 4 [0072.070] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString=".docx") returned 5 [0072.070] lstrcmpiW (lpString1=".docx", lpString2="T.SHX") returned -1 [0072.070] lstrlenW (lpString=".pdf") returned 4 [0072.070] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString=".xls") returned 4 [0072.070] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0072.070] lstrlenW (lpString=".xlsx") returned 5 [0072.070] lstrcmpiW (lpString1=".xlsx", lpString2="T.SHX") returned -1 [0072.070] lstrlenW (lpString=".ppt") returned 4 [0072.070] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.070] lstrlenW (lpString=".zip") returned 4 [0072.070] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0072.070] lstrlenW (lpString=".rar") returned 4 [0072.070] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString=".bz2") returned 4 [0072.070] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString=".7z") returned 3 [0072.070] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0072.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.070] lstrlenW (lpString=".dbf") returned 4 [0072.070] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.070] lstrlenW (lpString=".1cd") returned 4 [0072.070] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0072.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 77 [0072.070] lstrlenW (lpString=".jpg") returned 4 [0072.070] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0072.070] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") [0072.072] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10080) returned 1 [0072.072] CloseHandle (hObject=0x154) returned 1 [0072.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0072.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0072.072] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.072] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0072.461] GetLastError () returned 0x0 [0072.462] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2760, lpOverlapped=0x0) returned 1 [0072.474] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2770, lpOverlapped=0x0) returned 1 [0072.475] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.475] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0072.475] SetEndOfFile (hFile=0x1c0) returned 1 [0072.475] CloseHandle (hObject=0x1c0) returned 1 [0072.475] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.475] SetEndOfFile (hFile=0x154) returned 1 [0072.476] CloseHandle (hObject=0x154) returned 1 [0072.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.476] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0072.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString=".doc") returned 4 [0072.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString=".docx") returned 5 [0072.477] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0072.477] lstrlenW (lpString=".pdf") returned 4 [0072.477] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString=".xls") returned 4 [0072.477] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString=".xlsx") returned 5 [0072.477] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0072.477] lstrlenW (lpString=".ppt") returned 4 [0072.477] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString=".zip") returned 4 [0072.477] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString=".rar") returned 4 [0072.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.477] lstrlenW (lpString=".bz2") returned 4 [0072.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.477] lstrlenW (lpString=".7z") returned 3 [0072.477] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString=".dbf") returned 4 [0072.477] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString=".1cd") returned 4 [0072.477] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0072.477] lstrlenW (lpString=".jpg") returned 4 [0072.477] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.478] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") [0072.481] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10632) returned 1 [0072.481] CloseHandle (hObject=0x180) returned 1 [0072.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 0x20 [0072.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.481] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.481] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0072.482] GetLastError () returned 0x0 [0072.482] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2988, lpOverlapped=0x0) returned 1 [0072.495] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0072.496] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.496] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.496] SetEndOfFile (hFile=0x1fc) returned 1 [0072.496] CloseHandle (hObject=0x1fc) returned 1 [0072.496] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.496] SetEndOfFile (hFile=0x180) returned 1 [0072.497] CloseHandle (hObject=0x180) returned 1 [0072.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 1 [0072.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.498] lstrlenW (lpString=".doc") returned 4 [0072.498] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString=".docx") returned 5 [0072.498] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0072.498] lstrlenW (lpString=".pdf") returned 4 [0072.498] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString=".xls") returned 4 [0072.498] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString=".xlsx") returned 5 [0072.498] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0072.498] lstrlenW (lpString=".ppt") returned 4 [0072.498] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.498] lstrlenW (lpString=".zip") returned 4 [0072.498] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString=".rar") returned 4 [0072.498] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.498] lstrlenW (lpString=".bz2") returned 4 [0072.498] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.498] lstrlenW (lpString=".7z") returned 3 [0072.498] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.498] lstrlenW (lpString=".dbf") returned 4 [0072.498] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.498] lstrlenW (lpString=".1cd") returned 4 [0072.499] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 76 [0072.499] lstrlenW (lpString=".jpg") returned 4 [0072.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.499] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") [0072.499] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2522488) returned 1 [0072.499] CloseHandle (hObject=0x180) returned 1 [0072.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0x20 [0072.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0072.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0072.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.500] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.500] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.500] ReadFile (in: hFile=0x180, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.510] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.510] ReadFile (in: hFile=0x180, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.524] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0072.524] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x227d78, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.524] ReadFile (in: hFile=0x180, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.684] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.684] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0072.700] SetEndOfFile (hFile=0x180) returned 1 [0072.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0072.700] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.700] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.702] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcd47d, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.702] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.707] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x227d78, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.707] WriteFile (in: hFile=0x180, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.710] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0072.710] CloseHandle (hObject=0x180) returned 1 [0072.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0072.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.711] lstrlenW (lpString=".doc") returned 4 [0072.711] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString=".docx") returned 5 [0072.711] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0072.711] lstrlenW (lpString=".pdf") returned 4 [0072.711] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString=".xls") returned 4 [0072.711] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString=".xlsx") returned 5 [0072.711] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0072.711] lstrlenW (lpString=".ppt") returned 4 [0072.711] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.711] lstrlenW (lpString=".zip") returned 4 [0072.711] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString=".rar") returned 4 [0072.711] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.711] lstrlenW (lpString=".bz2") returned 4 [0072.711] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.711] lstrlenW (lpString=".7z") returned 3 [0072.711] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.711] lstrlenW (lpString=".dbf") returned 4 [0072.712] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.712] lstrlenW (lpString=".1cd") returned 4 [0072.712] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 88 [0072.712] lstrlenW (lpString=".jpg") returned 4 [0072.712] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.712] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") [0073.940] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=98304) returned 1 [0073.940] CloseHandle (hObject=0x150) returned 1 [0073.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0073.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.940] lstrlenW (lpString=".doc") returned 4 [0073.940] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0073.940] lstrlenW (lpString=".docx") returned 5 [0073.940] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0073.940] lstrlenW (lpString=".pdf") returned 4 [0073.940] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0073.940] lstrlenW (lpString=".xls") returned 4 [0073.940] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0073.940] lstrlenW (lpString=".xlsx") returned 5 [0073.941] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0073.941] lstrlenW (lpString=".ppt") returned 4 [0073.941] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0073.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.941] lstrlenW (lpString=".zip") returned 4 [0073.941] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0073.941] lstrlenW (lpString=".rar") returned 4 [0073.941] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0073.941] lstrlenW (lpString=".bz2") returned 4 [0073.941] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0073.941] lstrlenW (lpString=".7z") returned 3 [0073.941] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0073.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.941] lstrlenW (lpString=".dbf") returned 4 [0073.941] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0073.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.941] lstrlenW (lpString=".1cd") returned 4 [0073.941] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0073.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0073.941] lstrlenW (lpString=".jpg") returned 4 [0073.941] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0073.941] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") [0073.942] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=61440) returned 1 [0073.942] CloseHandle (hObject=0x150) returned 1 [0073.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0073.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.942] lstrlenW (lpString=".doc") returned 4 [0073.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.942] lstrlenW (lpString=".docx") returned 5 [0073.942] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0073.942] lstrlenW (lpString=".pdf") returned 4 [0073.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.942] lstrlenW (lpString=".xls") returned 4 [0073.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.942] lstrlenW (lpString=".xlsx") returned 5 [0073.942] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0073.942] lstrlenW (lpString=".ppt") returned 4 [0073.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.942] lstrlenW (lpString=".zip") returned 4 [0073.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.943] lstrlenW (lpString=".rar") returned 4 [0073.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.943] lstrlenW (lpString=".bz2") returned 4 [0073.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.943] lstrlenW (lpString=".7z") returned 3 [0073.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.943] lstrlenW (lpString=".dbf") returned 4 [0073.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.943] lstrlenW (lpString=".1cd") returned 4 [0073.943] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0073.943] lstrlenW (lpString=".jpg") returned 4 [0073.943] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.943] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") [0073.943] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=495616) returned 1 [0073.943] CloseHandle (hObject=0x150) returned 1 [0073.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0073.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.944] lstrlenW (lpString=".doc") returned 4 [0073.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString=".docx") returned 5 [0073.944] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0073.944] lstrlenW (lpString=".pdf") returned 4 [0073.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString=".xls") returned 4 [0073.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString=".xlsx") returned 5 [0073.944] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0073.944] lstrlenW (lpString=".ppt") returned 4 [0073.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.944] lstrlenW (lpString=".zip") returned 4 [0073.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString=".rar") returned 4 [0073.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.944] lstrlenW (lpString=".bz2") returned 4 [0073.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.944] lstrlenW (lpString=".7z") returned 3 [0073.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.944] lstrlenW (lpString=".dbf") returned 4 [0073.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.944] lstrlenW (lpString=".1cd") returned 4 [0073.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0073.945] lstrlenW (lpString=".jpg") returned 4 [0073.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.945] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") [0073.945] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=28672) returned 1 [0073.945] CloseHandle (hObject=0x150) returned 1 [0073.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0073.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.945] lstrlenW (lpString=".doc") returned 4 [0073.945] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0073.945] lstrlenW (lpString=".docx") returned 5 [0073.946] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0073.946] lstrlenW (lpString=".pdf") returned 4 [0073.946] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString=".xls") returned 4 [0073.946] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0073.946] lstrlenW (lpString=".xlsx") returned 5 [0073.946] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0073.946] lstrlenW (lpString=".ppt") returned 4 [0073.946] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.946] lstrlenW (lpString=".zip") returned 4 [0073.946] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0073.946] lstrlenW (lpString=".rar") returned 4 [0073.946] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString=".bz2") returned 4 [0073.946] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString=".7z") returned 3 [0073.946] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.946] lstrlenW (lpString=".dbf") returned 4 [0073.946] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.946] lstrlenW (lpString=".1cd") returned 4 [0073.946] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0073.946] lstrlenW (lpString=".jpg") returned 4 [0073.946] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0073.946] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") [0073.947] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=106496) returned 1 [0073.947] CloseHandle (hObject=0x150) returned 1 [0073.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0073.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.947] lstrlenW (lpString=".doc") returned 4 [0073.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.947] lstrlenW (lpString=".docx") returned 5 [0073.947] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0073.947] lstrlenW (lpString=".pdf") returned 4 [0073.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.947] lstrlenW (lpString=".xls") returned 4 [0073.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.947] lstrlenW (lpString=".xlsx") returned 5 [0073.947] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0073.947] lstrlenW (lpString=".ppt") returned 4 [0073.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.947] lstrlenW (lpString=".zip") returned 4 [0073.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.947] lstrlenW (lpString=".rar") returned 4 [0073.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.948] lstrlenW (lpString=".bz2") returned 4 [0073.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.948] lstrlenW (lpString=".7z") returned 3 [0073.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.948] lstrlenW (lpString=".dbf") returned 4 [0073.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.948] lstrlenW (lpString=".1cd") returned 4 [0073.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0073.948] lstrlenW (lpString=".jpg") returned 4 [0073.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.948] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") [0073.949] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=29184) returned 1 [0073.949] CloseHandle (hObject=0x150) returned 1 [0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.949] lstrlenW (lpString=".doc") returned 4 [0073.949] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.949] lstrlenW (lpString=".docx") returned 5 [0073.949] lstrcmpiW (lpString1=".docx", lpString2="B.dll") returned -1 [0073.949] lstrlenW (lpString=".pdf") returned 4 [0073.949] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.949] lstrlenW (lpString=".xls") returned 4 [0073.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.949] lstrlenW (lpString=".xlsx") returned 5 [0073.949] lstrcmpiW (lpString1=".xlsx", lpString2="B.dll") returned -1 [0073.949] lstrlenW (lpString=".ppt") returned 4 [0073.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.950] lstrlenW (lpString=".zip") returned 4 [0073.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.950] lstrlenW (lpString=".rar") returned 4 [0073.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.950] lstrlenW (lpString=".bz2") returned 4 [0073.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.950] lstrlenW (lpString=".7z") returned 3 [0073.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.950] lstrlenW (lpString=".dbf") returned 4 [0073.950] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.950] lstrlenW (lpString=".1cd") returned 4 [0073.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0073.950] lstrlenW (lpString=".jpg") returned 4 [0073.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.950] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") [0073.950] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=93696) returned 1 [0073.951] CloseHandle (hObject=0x150) returned 1 [0073.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0073.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.951] lstrlenW (lpString=".doc") returned 4 [0073.951] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.951] lstrlenW (lpString=".docx") returned 5 [0073.951] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.951] lstrlenW (lpString=".pdf") returned 4 [0073.951] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.951] lstrlenW (lpString=".xls") returned 4 [0073.951] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.951] lstrlenW (lpString=".xlsx") returned 5 [0073.951] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.951] lstrlenW (lpString=".ppt") returned 4 [0073.951] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.951] lstrlenW (lpString=".zip") returned 4 [0073.951] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.951] lstrlenW (lpString=".rar") returned 4 [0073.951] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.951] lstrlenW (lpString=".bz2") returned 4 [0073.951] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.951] lstrlenW (lpString=".7z") returned 3 [0073.951] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.952] lstrlenW (lpString=".dbf") returned 4 [0073.952] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.952] lstrlenW (lpString=".1cd") returned 4 [0073.952] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0073.952] lstrlenW (lpString=".jpg") returned 4 [0073.952] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.952] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") [0073.953] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9728) returned 1 [0073.953] CloseHandle (hObject=0x150) returned 1 [0073.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0073.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.954] lstrlenW (lpString=".doc") returned 4 [0073.954] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.954] lstrlenW (lpString=".docx") returned 5 [0073.954] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.954] lstrlenW (lpString=".pdf") returned 4 [0073.954] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.954] lstrlenW (lpString=".xls") returned 4 [0073.954] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.954] lstrlenW (lpString=".xlsx") returned 5 [0073.954] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.954] lstrlenW (lpString=".ppt") returned 4 [0073.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.954] lstrlenW (lpString=".zip") returned 4 [0073.954] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.954] lstrlenW (lpString=".rar") returned 4 [0073.954] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.954] lstrlenW (lpString=".bz2") returned 4 [0073.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.954] lstrlenW (lpString=".7z") returned 3 [0073.954] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.954] lstrlenW (lpString=".dbf") returned 4 [0073.954] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.955] lstrlenW (lpString=".1cd") returned 4 [0073.955] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0073.955] lstrlenW (lpString=".jpg") returned 4 [0073.955] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.955] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") [0073.955] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5120) returned 1 [0073.955] CloseHandle (hObject=0x150) returned 1 [0073.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0x20 [0073.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.955] lstrlenW (lpString=".doc") returned 4 [0073.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.955] lstrlenW (lpString=".docx") returned 5 [0073.956] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.956] lstrlenW (lpString=".pdf") returned 4 [0073.956] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.956] lstrlenW (lpString=".xls") returned 4 [0073.956] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.956] lstrlenW (lpString=".xlsx") returned 5 [0073.956] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.956] lstrlenW (lpString=".ppt") returned 4 [0073.956] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.956] lstrlenW (lpString=".zip") returned 4 [0073.956] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.956] lstrlenW (lpString=".rar") returned 4 [0073.956] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.956] lstrlenW (lpString=".bz2") returned 4 [0073.956] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.956] lstrlenW (lpString=".7z") returned 3 [0073.956] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.956] lstrlenW (lpString=".dbf") returned 4 [0073.956] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.956] lstrlenW (lpString=".1cd") returned 4 [0073.956] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 64 [0073.956] lstrlenW (lpString=".jpg") returned 4 [0073.956] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.956] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") [0073.957] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5632) returned 1 [0073.957] CloseHandle (hObject=0x150) returned 1 [0073.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0073.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.957] lstrlenW (lpString=".doc") returned 4 [0073.957] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.957] lstrlenW (lpString=".docx") returned 5 [0073.957] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.957] lstrlenW (lpString=".pdf") returned 4 [0073.957] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.957] lstrlenW (lpString=".xls") returned 4 [0073.957] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.957] lstrlenW (lpString=".xlsx") returned 5 [0073.957] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.957] lstrlenW (lpString=".ppt") returned 4 [0073.957] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.958] lstrlenW (lpString=".zip") returned 4 [0073.958] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.958] lstrlenW (lpString=".rar") returned 4 [0073.958] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.958] lstrlenW (lpString=".bz2") returned 4 [0073.958] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.958] lstrlenW (lpString=".7z") returned 3 [0073.958] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.958] lstrlenW (lpString=".dbf") returned 4 [0073.958] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.958] lstrlenW (lpString=".1cd") returned 4 [0073.958] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0073.958] lstrlenW (lpString=".jpg") returned 4 [0073.958] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.958] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") [0073.959] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=13824) returned 1 [0073.959] CloseHandle (hObject=0x150) returned 1 [0073.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0073.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.959] lstrlenW (lpString=".doc") returned 4 [0073.959] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.959] lstrlenW (lpString=".docx") returned 5 [0073.959] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.959] lstrlenW (lpString=".pdf") returned 4 [0073.959] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.959] lstrlenW (lpString=".xls") returned 4 [0073.959] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.960] lstrlenW (lpString=".xlsx") returned 5 [0073.960] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.960] lstrlenW (lpString=".ppt") returned 4 [0073.960] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.960] lstrlenW (lpString=".zip") returned 4 [0073.960] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.960] lstrlenW (lpString=".rar") returned 4 [0073.960] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.960] lstrlenW (lpString=".bz2") returned 4 [0073.960] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.960] lstrlenW (lpString=".7z") returned 3 [0073.960] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.960] lstrlenW (lpString=".dbf") returned 4 [0073.960] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.960] lstrlenW (lpString=".1cd") returned 4 [0073.960] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 64 [0073.960] lstrlenW (lpString=".jpg") returned 4 [0073.960] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.960] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") [0073.960] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7168) returned 1 [0073.961] CloseHandle (hObject=0x150) returned 1 [0073.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0073.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.961] lstrlenW (lpString=".doc") returned 4 [0073.961] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.961] lstrlenW (lpString=".docx") returned 5 [0073.961] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.961] lstrlenW (lpString=".pdf") returned 4 [0073.961] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.961] lstrlenW (lpString=".xls") returned 4 [0073.961] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.961] lstrlenW (lpString=".xlsx") returned 5 [0073.961] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.961] lstrlenW (lpString=".ppt") returned 4 [0073.961] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.961] lstrlenW (lpString=".zip") returned 4 [0073.961] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.961] lstrlenW (lpString=".rar") returned 4 [0073.961] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.961] lstrlenW (lpString=".bz2") returned 4 [0073.961] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.961] lstrlenW (lpString=".7z") returned 3 [0073.961] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.962] lstrlenW (lpString=".dbf") returned 4 [0073.962] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.962] lstrlenW (lpString=".1cd") returned 4 [0073.962] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0073.962] lstrlenW (lpString=".jpg") returned 4 [0073.962] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.962] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") [0073.962] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5632) returned 1 [0073.962] CloseHandle (hObject=0x150) returned 1 [0073.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0073.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.962] lstrlenW (lpString=".doc") returned 4 [0073.963] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.963] lstrlenW (lpString=".docx") returned 5 [0073.963] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.963] lstrlenW (lpString=".pdf") returned 4 [0073.963] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.963] lstrlenW (lpString=".xls") returned 4 [0073.963] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.963] lstrlenW (lpString=".xlsx") returned 5 [0073.963] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.963] lstrlenW (lpString=".ppt") returned 4 [0073.963] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.963] lstrlenW (lpString=".zip") returned 4 [0073.963] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.963] lstrlenW (lpString=".rar") returned 4 [0073.963] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.963] lstrlenW (lpString=".bz2") returned 4 [0073.963] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.963] lstrlenW (lpString=".7z") returned 3 [0073.963] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.963] lstrlenW (lpString=".dbf") returned 4 [0073.963] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.963] lstrlenW (lpString=".1cd") returned 4 [0073.963] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 65 [0073.963] lstrlenW (lpString=".jpg") returned 4 [0073.963] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.963] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") [0073.964] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=518) returned 1 [0073.964] CloseHandle (hObject=0x150) returned 1 [0073.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0073.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 54 [0073.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 54 [0073.965] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") [0073.965] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=588) returned 1 [0073.965] CloseHandle (hObject=0x150) returned 1 [0073.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0073.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.965] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") [0073.966] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=749568) returned 1 [0073.966] CloseHandle (hObject=0x150) returned 1 [0073.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0073.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.966] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") [0073.967] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0073.967] CloseHandle (hObject=0x150) returned 1 [0073.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0073.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.967] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") [0073.971] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114688) returned 1 [0073.971] CloseHandle (hObject=0x150) returned 1 [0073.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll")) returned 0x20 [0073.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.972] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") [0073.972] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0073.972] CloseHandle (hObject=0x150) returned 1 [0073.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll")) returned 0x20 [0073.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.972] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") [0073.973] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=258048) returned 1 [0073.973] CloseHandle (hObject=0x150) returned 1 [0073.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0073.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.973] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") [0073.974] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0073.974] CloseHandle (hObject=0x150) returned 1 [0073.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0073.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.979] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") [0073.980] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=98304) returned 1 [0073.980] CloseHandle (hObject=0x150) returned 1 [0073.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll")) returned 0x20 [0073.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.993] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") [0073.996] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=303104) returned 1 [0073.996] CloseHandle (hObject=0x150) returned 1 [0073.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0073.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.998] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") [0073.998] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0073.998] CloseHandle (hObject=0x150) returned 1 [0073.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0073.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0073.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.999] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") [0073.999] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0074.000] CloseHandle (hObject=0x150) returned 1 [0074.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0074.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.000] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") [0074.000] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=389120) returned 1 [0074.000] CloseHandle (hObject=0x150) returned 1 [0074.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0074.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.001] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") [0074.001] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=249856) returned 1 [0074.001] CloseHandle (hObject=0x150) returned 1 [0074.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0074.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.006] lstrlenW (lpString=".doc") returned 4 [0074.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.006] lstrlenW (lpString=".docx") returned 5 [0074.006] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0074.006] lstrlenW (lpString=".pdf") returned 4 [0074.007] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.007] lstrlenW (lpString=".xls") returned 4 [0074.007] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.007] lstrlenW (lpString=".xlsx") returned 5 [0074.007] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0074.007] lstrlenW (lpString=".ppt") returned 4 [0074.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.007] lstrlenW (lpString=".zip") returned 4 [0074.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.007] lstrlenW (lpString=".rar") returned 4 [0074.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString=".bz2") returned 4 [0074.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.011] lstrlenW (lpString=".7z") returned 3 [0074.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.011] lstrlenW (lpString=".dbf") returned 4 [0074.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.011] lstrlenW (lpString=".1cd") returned 4 [0074.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.011] lstrlenW (lpString=".jpg") returned 4 [0074.011] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.011] lstrlenW (lpString=".doc") returned 4 [0074.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString=".docx") returned 5 [0074.011] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0074.011] lstrlenW (lpString=".pdf") returned 4 [0074.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString=".xls") returned 4 [0074.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString=".xlsx") returned 5 [0074.011] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0074.011] lstrlenW (lpString=".ppt") returned 4 [0074.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.012] lstrlenW (lpString=".zip") returned 4 [0074.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.012] lstrlenW (lpString=".rar") returned 4 [0074.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.012] lstrlenW (lpString=".bz2") returned 4 [0074.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.012] lstrlenW (lpString=".7z") returned 3 [0074.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.012] lstrlenW (lpString=".dbf") returned 4 [0074.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.012] lstrlenW (lpString=".1cd") returned 4 [0074.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 54 [0074.012] lstrlenW (lpString=".jpg") returned 4 [0074.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.012] lstrlenW (lpString="msdaremr.dll") returned 12 [0074.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.012] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8192) returned 1 [0074.012] CloseHandle (hObject=0x150) returned 1 [0074.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0074.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.013] lstrlenW (lpString=".doc") returned 4 [0074.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".docx") returned 5 [0074.013] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.013] lstrlenW (lpString=".pdf") returned 4 [0074.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".xls") returned 4 [0074.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".xlsx") returned 5 [0074.013] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.013] lstrlenW (lpString=".ppt") returned 4 [0074.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.013] lstrlenW (lpString=".zip") returned 4 [0074.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".rar") returned 4 [0074.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".bz2") returned 4 [0074.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.013] lstrlenW (lpString=".7z") returned 3 [0074.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".dbf") returned 4 [0074.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".1cd") returned 4 [0074.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".jpg") returned 4 [0074.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".doc") returned 4 [0074.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString=".docx") returned 5 [0074.014] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.014] lstrlenW (lpString=".pdf") returned 4 [0074.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString=".xls") returned 4 [0074.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString=".xlsx") returned 5 [0074.014] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.014] lstrlenW (lpString=".ppt") returned 4 [0074.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".zip") returned 4 [0074.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString=".rar") returned 4 [0074.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.014] lstrlenW (lpString=".bz2") returned 4 [0074.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.014] lstrlenW (lpString=".7z") returned 3 [0074.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.014] lstrlenW (lpString=".dbf") returned 4 [0074.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.015] lstrlenW (lpString=".1cd") returned 4 [0074.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 55 [0074.015] lstrlenW (lpString=".jpg") returned 4 [0074.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.015] lstrlenW (lpString="msdfmap.dll") returned 11 [0074.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.015] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=57344) returned 1 [0074.015] CloseHandle (hObject=0x150) returned 1 [0074.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0074.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.015] lstrlenW (lpString=".doc") returned 4 [0074.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString=".docx") returned 5 [0074.016] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0074.016] lstrlenW (lpString=".pdf") returned 4 [0074.016] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString=".xls") returned 4 [0074.016] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString=".xlsx") returned 5 [0074.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0074.016] lstrlenW (lpString=".ppt") returned 4 [0074.016] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString=".zip") returned 4 [0074.016] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString=".rar") returned 4 [0074.016] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString=".bz2") returned 4 [0074.016] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.016] lstrlenW (lpString=".7z") returned 3 [0074.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString=".dbf") returned 4 [0074.016] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString=".1cd") returned 4 [0074.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString=".jpg") returned 4 [0074.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.016] lstrlenW (lpString=".doc") returned 4 [0074.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString=".docx") returned 5 [0074.017] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0074.017] lstrlenW (lpString=".pdf") returned 4 [0074.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString=".xls") returned 4 [0074.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString=".xlsx") returned 5 [0074.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0074.017] lstrlenW (lpString=".ppt") returned 4 [0074.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.017] lstrlenW (lpString=".zip") returned 4 [0074.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString=".rar") returned 4 [0074.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString=".bz2") returned 4 [0074.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.017] lstrlenW (lpString=".7z") returned 3 [0074.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.017] lstrlenW (lpString=".dbf") returned 4 [0074.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.017] lstrlenW (lpString=".1cd") returned 4 [0074.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 54 [0074.017] lstrlenW (lpString=".jpg") returned 4 [0074.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.017] lstrlenW (lpString="MSMAPI32.DLL") returned 12 [0074.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.024] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=58752) returned 1 [0074.024] CloseHandle (hObject=0x150) returned 1 [0074.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 0x20 [0074.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.025] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.025] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.025] GetLastError () returned 0x0 [0074.025] ReadFile (in: hFile=0x150, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xe580, lpOverlapped=0x0) returned 1 [0074.029] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0074.031] ReadFile (in: hFile=0x150, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.031] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.031] SetEndOfFile (hFile=0x1ec) returned 1 [0074.031] CloseHandle (hObject=0x1ec) returned 1 [0074.031] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.031] SetEndOfFile (hFile=0x150) returned 1 [0074.032] CloseHandle (hObject=0x150) returned 1 [0074.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 1 [0074.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.033] lstrlenW (lpString=".doc") returned 4 [0074.033] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.033] lstrlenW (lpString=".docx") returned 5 [0074.033] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0074.033] lstrlenW (lpString=".pdf") returned 4 [0074.033] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.033] lstrlenW (lpString=".xls") returned 4 [0074.033] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.033] lstrlenW (lpString=".xlsx") returned 5 [0074.033] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0074.033] lstrlenW (lpString=".ppt") returned 4 [0074.033] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".zip") returned 4 [0074.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString=".rar") returned 4 [0074.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString=".bz2") returned 4 [0074.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.034] lstrlenW (lpString=".7z") returned 3 [0074.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".dbf") returned 4 [0074.034] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".1cd") returned 4 [0074.034] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".jpg") returned 4 [0074.034] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".doc") returned 4 [0074.034] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString=".docx") returned 5 [0074.034] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0074.034] lstrlenW (lpString=".pdf") returned 4 [0074.034] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString=".xls") returned 4 [0074.034] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString=".xlsx") returned 5 [0074.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0074.034] lstrlenW (lpString=".ppt") returned 4 [0074.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.034] lstrlenW (lpString=".zip") returned 4 [0074.035] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.035] lstrlenW (lpString=".rar") returned 4 [0074.035] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.035] lstrlenW (lpString=".bz2") returned 4 [0074.035] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.035] lstrlenW (lpString=".7z") returned 3 [0074.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.035] lstrlenW (lpString=".dbf") returned 4 [0074.035] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.035] lstrlenW (lpString=".1cd") returned 4 [0074.035] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 61 [0074.035] lstrlenW (lpString=".jpg") returned 4 [0074.035] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.035] lstrlenW (lpString="msdasqlr.dll.mui") returned 16 [0074.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.037] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5632) returned 1 [0074.037] CloseHandle (hObject=0x150) returned 1 [0074.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0074.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString=".doc") returned 4 [0074.042] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.042] lstrlenW (lpString=".docx") returned 5 [0074.042] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.042] lstrlenW (lpString=".pdf") returned 4 [0074.042] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.042] lstrlenW (lpString=".xls") returned 4 [0074.042] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.042] lstrlenW (lpString=".xlsx") returned 5 [0074.042] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.042] lstrlenW (lpString=".ppt") returned 4 [0074.042] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString=".zip") returned 4 [0074.042] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.042] lstrlenW (lpString=".rar") returned 4 [0074.042] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.042] lstrlenW (lpString=".bz2") returned 4 [0074.042] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.042] lstrlenW (lpString=".7z") returned 3 [0074.042] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString=".dbf") returned 4 [0074.042] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString=".1cd") returned 4 [0074.042] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.042] lstrlenW (lpString=".jpg") returned 4 [0074.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString=".doc") returned 4 [0074.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.043] lstrlenW (lpString=".docx") returned 5 [0074.043] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.043] lstrlenW (lpString=".pdf") returned 4 [0074.043] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.043] lstrlenW (lpString=".xls") returned 4 [0074.043] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.043] lstrlenW (lpString=".xlsx") returned 5 [0074.043] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.043] lstrlenW (lpString=".ppt") returned 4 [0074.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString=".zip") returned 4 [0074.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.043] lstrlenW (lpString=".rar") returned 4 [0074.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.043] lstrlenW (lpString=".bz2") returned 4 [0074.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.043] lstrlenW (lpString=".7z") returned 3 [0074.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString=".dbf") returned 4 [0074.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString=".1cd") returned 4 [0074.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 66 [0074.043] lstrlenW (lpString=".jpg") returned 4 [0074.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.044] lstrlenW (lpString="oledb32r.dll.mui") returned 16 [0074.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.118] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=47616) returned 1 [0074.118] CloseHandle (hObject=0x150) returned 1 [0074.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0074.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.118] lstrlenW (lpString=".doc") returned 4 [0074.118] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.118] lstrlenW (lpString=".docx") returned 5 [0074.118] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.118] lstrlenW (lpString=".pdf") returned 4 [0074.118] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.118] lstrlenW (lpString=".xls") returned 4 [0074.118] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.118] lstrlenW (lpString=".xlsx") returned 5 [0074.118] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.118] lstrlenW (lpString=".ppt") returned 4 [0074.118] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".zip") returned 4 [0074.119] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.119] lstrlenW (lpString=".rar") returned 4 [0074.119] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.119] lstrlenW (lpString=".bz2") returned 4 [0074.119] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.119] lstrlenW (lpString=".7z") returned 3 [0074.119] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".dbf") returned 4 [0074.119] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".1cd") returned 4 [0074.119] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".jpg") returned 4 [0074.119] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".doc") returned 4 [0074.119] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.119] lstrlenW (lpString=".docx") returned 5 [0074.119] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.119] lstrlenW (lpString=".pdf") returned 4 [0074.119] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.119] lstrlenW (lpString=".xls") returned 4 [0074.119] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.119] lstrlenW (lpString=".xlsx") returned 5 [0074.119] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.119] lstrlenW (lpString=".ppt") returned 4 [0074.119] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.119] lstrlenW (lpString=".zip") returned 4 [0074.119] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.120] lstrlenW (lpString=".rar") returned 4 [0074.120] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.120] lstrlenW (lpString=".bz2") returned 4 [0074.120] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.120] lstrlenW (lpString=".7z") returned 3 [0074.120] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.120] lstrlenW (lpString=".dbf") returned 4 [0074.120] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.120] lstrlenW (lpString=".1cd") returned 4 [0074.120] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0074.120] lstrlenW (lpString=".jpg") returned 4 [0074.120] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.120] lstrlenW (lpString="wab32.dll") returned 9 [0074.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.120] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=886784) returned 1 [0074.120] CloseHandle (hObject=0x150) returned 1 [0074.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0074.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.121] lstrlenW (lpString=".doc") returned 4 [0074.121] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString=".docx") returned 5 [0074.121] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0074.121] lstrlenW (lpString=".pdf") returned 4 [0074.121] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString=".xls") returned 4 [0074.121] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString=".xlsx") returned 5 [0074.121] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0074.121] lstrlenW (lpString=".ppt") returned 4 [0074.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.121] lstrlenW (lpString=".zip") returned 4 [0074.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString=".rar") returned 4 [0074.121] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.121] lstrlenW (lpString=".bz2") returned 4 [0074.121] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.121] lstrlenW (lpString=".7z") returned 3 [0074.121] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.121] lstrlenW (lpString=".dbf") returned 4 [0074.121] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString=".1cd") returned 4 [0074.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString=".jpg") returned 4 [0074.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString=".doc") returned 4 [0074.122] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString=".docx") returned 5 [0074.122] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0074.122] lstrlenW (lpString=".pdf") returned 4 [0074.122] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString=".xls") returned 4 [0074.122] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString=".xlsx") returned 5 [0074.122] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0074.122] lstrlenW (lpString=".ppt") returned 4 [0074.122] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString=".zip") returned 4 [0074.122] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString=".rar") returned 4 [0074.122] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.122] lstrlenW (lpString=".bz2") returned 4 [0074.122] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.122] lstrlenW (lpString=".7z") returned 3 [0074.122] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.122] lstrlenW (lpString=".dbf") returned 4 [0074.122] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.123] lstrlenW (lpString=".1cd") returned 4 [0074.123] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0074.123] lstrlenW (lpString=".jpg") returned 4 [0074.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.123] lstrlenW (lpString="wab32res.dll") returned 12 [0074.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.123] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1098752) returned 1 [0074.123] CloseHandle (hObject=0x150) returned 1 [0074.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0074.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.123] lstrlenW (lpString=".doc") returned 4 [0074.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".docx") returned 5 [0074.124] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0074.124] lstrlenW (lpString=".pdf") returned 4 [0074.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".xls") returned 4 [0074.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".xlsx") returned 5 [0074.124] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0074.124] lstrlenW (lpString=".ppt") returned 4 [0074.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString=".zip") returned 4 [0074.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".rar") returned 4 [0074.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".bz2") returned 4 [0074.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.124] lstrlenW (lpString=".7z") returned 3 [0074.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString=".dbf") returned 4 [0074.124] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString=".1cd") returned 4 [0074.124] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString=".jpg") returned 4 [0074.124] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.124] lstrlenW (lpString=".doc") returned 4 [0074.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.124] lstrlenW (lpString=".docx") returned 5 [0074.125] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0074.125] lstrlenW (lpString=".pdf") returned 4 [0074.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.125] lstrlenW (lpString=".xls") returned 4 [0074.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.125] lstrlenW (lpString=".xlsx") returned 5 [0074.125] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0074.125] lstrlenW (lpString=".ppt") returned 4 [0074.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.125] lstrlenW (lpString=".zip") returned 4 [0074.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.125] lstrlenW (lpString=".rar") returned 4 [0074.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.125] lstrlenW (lpString=".bz2") returned 4 [0074.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.125] lstrlenW (lpString=".7z") returned 3 [0074.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.125] lstrlenW (lpString=".dbf") returned 4 [0074.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.125] lstrlenW (lpString=".1cd") returned 4 [0074.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0074.125] lstrlenW (lpString=".jpg") returned 4 [0074.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.126] lstrlenW (lpString="audiodepthconverter.ax") returned 22 [0074.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.177] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=50688) returned 1 [0074.177] CloseHandle (hObject=0x150) returned 1 [0074.177] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20 [0074.177] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.177] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.177] lstrlenW (lpString=".doc") returned 4 [0074.177] lstrcmpiW (lpString1=".doc", lpString2="r.ax") returned -1 [0074.177] lstrlenW (lpString=".docx") returned 5 [0074.177] lstrcmpiW (lpString1=".docx", lpString2="er.ax") returned -1 [0074.177] lstrlenW (lpString=".pdf") returned 4 [0074.177] lstrcmpiW (lpString1=".pdf", lpString2="r.ax") returned -1 [0074.177] lstrlenW (lpString=".xls") returned 4 [0074.177] lstrcmpiW (lpString1=".xls", lpString2="r.ax") returned -1 [0074.177] lstrlenW (lpString=".xlsx") returned 5 [0074.177] lstrcmpiW (lpString1=".xlsx", lpString2="er.ax") returned -1 [0074.177] lstrlenW (lpString=".ppt") returned 4 [0074.177] lstrcmpiW (lpString1=".ppt", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString=".zip") returned 4 [0074.178] lstrcmpiW (lpString1=".zip", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".rar") returned 4 [0074.178] lstrcmpiW (lpString1=".rar", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".bz2") returned 4 [0074.178] lstrcmpiW (lpString1=".bz2", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".7z") returned 3 [0074.178] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString=".dbf") returned 4 [0074.178] lstrcmpiW (lpString1=".dbf", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString=".1cd") returned 4 [0074.178] lstrcmpiW (lpString1=".1cd", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString=".jpg") returned 4 [0074.178] lstrcmpiW (lpString1=".jpg", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.178] lstrlenW (lpString=".doc") returned 4 [0074.178] lstrcmpiW (lpString1=".doc", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".docx") returned 5 [0074.178] lstrcmpiW (lpString1=".docx", lpString2="er.ax") returned -1 [0074.178] lstrlenW (lpString=".pdf") returned 4 [0074.178] lstrcmpiW (lpString1=".pdf", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".xls") returned 4 [0074.178] lstrcmpiW (lpString1=".xls", lpString2="r.ax") returned -1 [0074.178] lstrlenW (lpString=".xlsx") returned 5 [0074.178] lstrcmpiW (lpString1=".xlsx", lpString2="er.ax") returned -1 [0074.178] lstrlenW (lpString=".ppt") returned 4 [0074.178] lstrcmpiW (lpString1=".ppt", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.179] lstrlenW (lpString=".zip") returned 4 [0074.179] lstrcmpiW (lpString1=".zip", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString=".rar") returned 4 [0074.179] lstrcmpiW (lpString1=".rar", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString=".bz2") returned 4 [0074.179] lstrcmpiW (lpString1=".bz2", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString=".7z") returned 3 [0074.179] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0074.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.179] lstrlenW (lpString=".dbf") returned 4 [0074.179] lstrcmpiW (lpString1=".dbf", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.179] lstrlenW (lpString=".1cd") returned 4 [0074.179] lstrcmpiW (lpString1=".1cd", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 49 [0074.179] lstrlenW (lpString=".jpg") returned 4 [0074.179] lstrcmpiW (lpString1=".jpg", lpString2="r.ax") returned -1 [0074.179] lstrlenW (lpString="DVDMaker.exe") returned 12 [0074.179] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0074.180] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2258432) returned 1 [0074.180] CloseHandle (hObject=0x150) returned 1 [0074.180] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0x20 [0074.180] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.180] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0 [0074.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39 [0074.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39 [0074.180] lstrlenW (lpString=".doc") returned 4 [0074.180] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0074.180] lstrlenW (lpString=".docx") returned 5 [0074.180] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0074.180] lstrlenW (lpString=".pdf") returned 4 [0074.180] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0074.180] lstrlenW (lpString=".xls") returned 4 [0074.180] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0074.180] lstrlenW (lpString=".xlsx") returned 5 [0074.180] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0074.180] lstrlenW (lpString=".ppt") returned 4 [0074.181] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0074.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39 [0074.181] lstrlenW (lpString=".zip") returned 4 [0074.181] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0074.181] lstrlenW (lpString=".rar") returned 4 [0074.181] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0074.181] lstrlenW (lpString=".bz2") returned 4 [0074.181] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0074.181] lstrlenW (lpString=".7z") returned 3 [0074.181] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0074.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 39 [0074.181] lstrlenW (lpString=".dbf") returned 4 [0074.181] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0074.181] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") [0074.181] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=51712) returned 1 [0074.181] CloseHandle (hObject=0x150) returned 1 [0074.182] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20 [0074.182] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.182] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.182] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") [0074.182] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12288) returned 1 [0074.182] CloseHandle (hObject=0x150) returned 1 [0074.182] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0074.183] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.183] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.183] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") [0074.184] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7168) returned 1 [0074.184] CloseHandle (hObject=0x150) returned 1 [0074.184] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0074.184] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.184] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") [0074.184] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=56760) returned 1 [0074.185] CloseHandle (hObject=0x150) returned 1 [0074.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20 [0074.185] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.185] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.185] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") [0074.228] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=41472) returned 1 [0074.228] CloseHandle (hObject=0x1c0) returned 1 [0074.228] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0074.228] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.228] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.228] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui") [0074.377] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2048) returned 1 [0074.377] CloseHandle (hObject=0x1fc) returned 1 [0074.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui")) returned 0x20 [0074.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.377] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.377] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") [0074.377] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12338536) returned 1 [0074.377] CloseHandle (hObject=0x1fc) returned 1 [0074.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0x20 [0074.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0074.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0074.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0074.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.379] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.475] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.475] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.577] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.577] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb84568, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.577] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.671] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.671] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0074.690] SetEndOfFile (hFile=0x1fc) returned 1 [0074.690] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0074.690] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.690] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.692] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3ec1cd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.692] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb84568, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0074.697] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.699] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0074.699] CloseHandle (hObject=0x1fc) returned 1 [0074.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0074.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.699] lstrlenW (lpString=".doc") returned 4 [0074.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.699] lstrlenW (lpString=".docx") returned 5 [0074.699] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0074.699] lstrlenW (lpString=".pdf") returned 4 [0074.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.699] lstrlenW (lpString=".xls") returned 4 [0074.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.699] lstrlenW (lpString=".xlsx") returned 5 [0074.699] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0074.699] lstrlenW (lpString=".ppt") returned 4 [0074.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".zip") returned 4 [0074.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString=".rar") returned 4 [0074.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString=".bz2") returned 4 [0074.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.700] lstrlenW (lpString=".7z") returned 3 [0074.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".dbf") returned 4 [0074.700] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".1cd") returned 4 [0074.700] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".jpg") returned 4 [0074.700] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".doc") returned 4 [0074.700] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString=".docx") returned 5 [0074.700] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0074.700] lstrlenW (lpString=".pdf") returned 4 [0074.700] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString=".xls") returned 4 [0074.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString=".xlsx") returned 5 [0074.700] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0074.700] lstrlenW (lpString=".ppt") returned 4 [0074.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.700] lstrlenW (lpString=".zip") returned 4 [0074.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.701] lstrlenW (lpString=".rar") returned 4 [0074.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.701] lstrlenW (lpString=".bz2") returned 4 [0074.701] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.701] lstrlenW (lpString=".7z") returned 3 [0074.701] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.701] lstrlenW (lpString=".dbf") returned 4 [0074.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.701] lstrlenW (lpString=".1cd") returned 4 [0074.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0074.701] lstrlenW (lpString=".jpg") returned 4 [0074.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.701] lstrlenW (lpString="msmdsrv.rll") returned 11 [0074.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.208] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=666456) returned 1 [0075.208] CloseHandle (hObject=0x154) returned 1 [0075.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0075.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.209] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.209] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.251] GetLastError () returned 0x0 [0075.251] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0075.299] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0075.310] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.310] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.310] SetEndOfFile (hFile=0x158) returned 1 [0075.310] CloseHandle (hObject=0x158) returned 1 [0075.310] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.310] SetEndOfFile (hFile=0x154) returned 1 [0075.316] CloseHandle (hObject=0x154) returned 1 [0075.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0075.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.316] lstrlenW (lpString=".doc") returned 4 [0075.316] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0075.316] lstrlenW (lpString=".docx") returned 5 [0075.316] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0075.316] lstrlenW (lpString=".pdf") returned 4 [0075.316] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0075.316] lstrlenW (lpString=".xls") returned 4 [0075.316] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0075.316] lstrlenW (lpString=".xlsx") returned 5 [0075.316] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0075.316] lstrlenW (lpString=".ppt") returned 4 [0075.316] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0075.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.316] lstrlenW (lpString=".zip") returned 4 [0075.316] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0075.316] lstrlenW (lpString=".rar") returned 4 [0075.316] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0075.316] lstrlenW (lpString=".bz2") returned 4 [0075.317] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0075.317] lstrlenW (lpString=".7z") returned 3 [0075.317] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0075.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.317] lstrlenW (lpString=".dbf") returned 4 [0075.317] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0075.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.317] lstrlenW (lpString=".1cd") returned 4 [0075.317] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0075.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0075.317] lstrlenW (lpString=".jpg") returned 4 [0075.317] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0075.317] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") [0075.317] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6165) returned 1 [0075.317] CloseHandle (hObject=0x154) returned 1 [0075.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0075.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.318] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.318] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0075.318] GetLastError () returned 0x0 [0075.318] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1815, lpOverlapped=0x0) returned 1 [0075.333] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0075.334] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.334] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.334] SetEndOfFile (hFile=0x158) returned 1 [0075.335] CloseHandle (hObject=0x158) returned 1 [0075.337] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.337] SetEndOfFile (hFile=0x154) returned 1 [0075.348] CloseHandle (hObject=0x154) returned 1 [0075.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0075.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.349] lstrlenW (lpString=".doc") returned 4 [0075.349] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.349] lstrlenW (lpString=".docx") returned 5 [0075.349] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.349] lstrlenW (lpString=".pdf") returned 4 [0075.349] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.349] lstrlenW (lpString=".xls") returned 4 [0075.349] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.349] lstrlenW (lpString=".xlsx") returned 5 [0075.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.353] lstrlenW (lpString=".ppt") returned 4 [0075.353] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.353] lstrlenW (lpString=".zip") returned 4 [0075.353] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.353] lstrlenW (lpString=".rar") returned 4 [0075.353] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.353] lstrlenW (lpString=".bz2") returned 4 [0075.353] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.353] lstrlenW (lpString=".7z") returned 3 [0075.353] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.353] lstrlenW (lpString=".dbf") returned 4 [0075.353] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.353] lstrlenW (lpString=".1cd") returned 4 [0075.353] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0075.353] lstrlenW (lpString=".jpg") returned 4 [0075.380] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.380] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") [0075.380] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10562) returned 1 [0075.380] CloseHandle (hObject=0x154) returned 1 [0075.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0075.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.387] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.387] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.388] GetLastError () returned 0x0 [0075.388] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2942, lpOverlapped=0x0) returned 1 [0075.403] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0075.404] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.404] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.405] SetEndOfFile (hFile=0x180) returned 1 [0075.407] CloseHandle (hObject=0x180) returned 1 [0075.407] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.407] SetEndOfFile (hFile=0x154) returned 1 [0075.408] CloseHandle (hObject=0x154) returned 1 [0075.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0075.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.408] lstrlenW (lpString=".doc") returned 4 [0075.409] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.409] lstrlenW (lpString=".docx") returned 5 [0075.409] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.409] lstrlenW (lpString=".pdf") returned 4 [0075.409] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.409] lstrlenW (lpString=".xls") returned 4 [0075.409] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.409] lstrlenW (lpString=".xlsx") returned 5 [0075.409] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.409] lstrlenW (lpString=".ppt") returned 4 [0075.409] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.409] lstrlenW (lpString=".zip") returned 4 [0075.409] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.409] lstrlenW (lpString=".rar") returned 4 [0075.409] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.409] lstrlenW (lpString=".bz2") returned 4 [0075.409] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.409] lstrlenW (lpString=".7z") returned 3 [0075.409] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.409] lstrlenW (lpString=".dbf") returned 4 [0075.409] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.409] lstrlenW (lpString=".1cd") returned 4 [0075.409] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0075.409] lstrlenW (lpString=".jpg") returned 4 [0075.409] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.409] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") [0075.410] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4846) returned 1 [0075.410] CloseHandle (hObject=0x154) returned 1 [0075.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0075.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.411] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.411] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.411] GetLastError () returned 0x0 [0075.411] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0075.694] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0075.695] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.695] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.695] SetEndOfFile (hFile=0x180) returned 1 [0075.695] CloseHandle (hObject=0x180) returned 1 [0075.695] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.695] SetEndOfFile (hFile=0x154) returned 1 [0075.696] CloseHandle (hObject=0x154) returned 1 [0075.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0075.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.696] lstrlenW (lpString=".doc") returned 4 [0075.696] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.696] lstrlenW (lpString=".docx") returned 5 [0075.697] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.697] lstrlenW (lpString=".pdf") returned 4 [0075.697] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.697] lstrlenW (lpString=".xls") returned 4 [0075.697] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.697] lstrlenW (lpString=".xlsx") returned 5 [0075.697] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.697] lstrlenW (lpString=".ppt") returned 4 [0075.697] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.697] lstrlenW (lpString=".zip") returned 4 [0075.697] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.697] lstrlenW (lpString=".rar") returned 4 [0075.697] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.697] lstrlenW (lpString=".bz2") returned 4 [0075.697] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.697] lstrlenW (lpString=".7z") returned 3 [0075.697] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.697] lstrlenW (lpString=".dbf") returned 4 [0075.697] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.697] lstrlenW (lpString=".1cd") returned 4 [0075.697] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0075.697] lstrlenW (lpString=".jpg") returned 4 [0075.697] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.697] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") [0075.699] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12981) returned 1 [0075.699] CloseHandle (hObject=0x154) returned 1 [0075.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0075.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.699] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.699] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.700] GetLastError () returned 0x0 [0075.700] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0075.721] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0075.723] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.723] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.724] SetEndOfFile (hFile=0x180) returned 1 [0075.724] CloseHandle (hObject=0x180) returned 1 [0075.724] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.724] SetEndOfFile (hFile=0x154) returned 1 [0075.725] CloseHandle (hObject=0x154) returned 1 [0075.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.729] lstrlenW (lpString=".doc") returned 4 [0075.729] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.729] lstrlenW (lpString=".docx") returned 5 [0075.729] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.729] lstrlenW (lpString=".pdf") returned 4 [0075.729] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.729] lstrlenW (lpString=".xls") returned 4 [0075.729] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.729] lstrlenW (lpString=".xlsx") returned 5 [0075.730] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.730] lstrlenW (lpString=".ppt") returned 4 [0075.730] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.730] lstrlenW (lpString=".zip") returned 4 [0075.730] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.730] lstrlenW (lpString=".rar") returned 4 [0075.730] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.730] lstrlenW (lpString=".bz2") returned 4 [0075.730] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.730] lstrlenW (lpString=".7z") returned 3 [0075.730] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.730] lstrlenW (lpString=".dbf") returned 4 [0075.730] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.730] lstrlenW (lpString=".1cd") returned 4 [0075.730] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0075.730] lstrlenW (lpString=".jpg") returned 4 [0075.730] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.730] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") [0075.777] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7567) returned 1 [0075.778] CloseHandle (hObject=0x154) returned 1 [0075.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0075.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.779] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.779] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.779] GetLastError () returned 0x0 [0075.779] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0075.800] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0075.801] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.801] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.801] SetEndOfFile (hFile=0x180) returned 1 [0075.801] CloseHandle (hObject=0x180) returned 1 [0075.801] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.801] SetEndOfFile (hFile=0x154) returned 1 [0075.802] CloseHandle (hObject=0x154) returned 1 [0075.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0075.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.802] lstrlenW (lpString=".doc") returned 4 [0075.802] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.802] lstrlenW (lpString=".docx") returned 5 [0075.802] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.803] lstrlenW (lpString=".pdf") returned 4 [0075.803] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.803] lstrlenW (lpString=".xls") returned 4 [0075.803] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.803] lstrlenW (lpString=".xlsx") returned 5 [0075.803] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.803] lstrlenW (lpString=".ppt") returned 4 [0075.803] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.803] lstrlenW (lpString=".zip") returned 4 [0075.803] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.803] lstrlenW (lpString=".rar") returned 4 [0075.803] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.803] lstrlenW (lpString=".bz2") returned 4 [0075.803] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.803] lstrlenW (lpString=".7z") returned 3 [0075.803] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.803] lstrlenW (lpString=".dbf") returned 4 [0075.803] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.803] lstrlenW (lpString=".1cd") returned 4 [0075.803] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0075.803] lstrlenW (lpString=".jpg") returned 4 [0075.803] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.803] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") [0075.812] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6880) returned 1 [0075.812] CloseHandle (hObject=0x154) returned 1 [0075.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0075.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.819] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.819] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.819] GetLastError () returned 0x0 [0075.819] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0075.825] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0075.826] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.826] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.826] SetEndOfFile (hFile=0x180) returned 1 [0075.827] CloseHandle (hObject=0x180) returned 1 [0075.827] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.827] SetEndOfFile (hFile=0x154) returned 1 [0075.828] CloseHandle (hObject=0x154) returned 1 [0075.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.828] lstrlenW (lpString=".doc") returned 4 [0075.828] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.828] lstrlenW (lpString=".docx") returned 5 [0075.828] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.828] lstrlenW (lpString=".pdf") returned 4 [0075.828] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.828] lstrlenW (lpString=".xls") returned 4 [0075.828] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.828] lstrlenW (lpString=".xlsx") returned 5 [0075.828] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.828] lstrlenW (lpString=".ppt") returned 4 [0075.828] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.828] lstrlenW (lpString=".zip") returned 4 [0075.829] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.829] lstrlenW (lpString=".rar") returned 4 [0075.829] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.829] lstrlenW (lpString=".bz2") returned 4 [0075.829] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.829] lstrlenW (lpString=".7z") returned 3 [0075.829] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.829] lstrlenW (lpString=".dbf") returned 4 [0075.829] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.829] lstrlenW (lpString=".1cd") returned 4 [0075.829] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0075.829] lstrlenW (lpString=".jpg") returned 4 [0075.829] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.829] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") [0075.829] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6763) returned 1 [0075.829] CloseHandle (hObject=0x154) returned 1 [0075.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0075.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.830] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.830] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.830] GetLastError () returned 0x0 [0075.830] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0075.838] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.839] SetEndOfFile (hFile=0x180) returned 1 [0075.839] CloseHandle (hObject=0x180) returned 1 [0075.839] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.839] SetEndOfFile (hFile=0x154) returned 1 [0075.840] CloseHandle (hObject=0x154) returned 1 [0075.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0075.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.840] lstrlenW (lpString=".doc") returned 4 [0075.840] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.840] lstrlenW (lpString=".docx") returned 5 [0075.840] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0075.840] lstrlenW (lpString=".pdf") returned 4 [0075.840] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.840] lstrlenW (lpString=".xls") returned 4 [0075.840] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.840] lstrlenW (lpString=".xlsx") returned 5 [0075.840] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0075.840] lstrlenW (lpString=".ppt") returned 4 [0075.840] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.840] lstrlenW (lpString=".zip") returned 4 [0075.840] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.840] lstrlenW (lpString=".rar") returned 4 [0075.841] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.841] lstrlenW (lpString=".bz2") returned 4 [0075.841] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.841] lstrlenW (lpString=".7z") returned 3 [0075.841] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.841] lstrlenW (lpString=".dbf") returned 4 [0075.841] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.841] lstrlenW (lpString=".1cd") returned 4 [0075.841] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0075.841] lstrlenW (lpString=".jpg") returned 4 [0075.841] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.841] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") [0075.841] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5714) returned 1 [0075.841] CloseHandle (hObject=0x154) returned 1 [0075.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0075.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.842] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.842] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.842] GetLastError () returned 0x0 [0075.842] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1652, lpOverlapped=0x0) returned 1 [0075.852] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0075.853] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.853] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.854] SetEndOfFile (hFile=0x180) returned 1 [0075.854] CloseHandle (hObject=0x180) returned 1 [0075.854] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.854] SetEndOfFile (hFile=0x154) returned 1 [0075.855] CloseHandle (hObject=0x154) returned 1 [0075.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.855] lstrlenW (lpString=".doc") returned 4 [0075.855] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.855] lstrlenW (lpString=".docx") returned 5 [0075.855] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0075.855] lstrlenW (lpString=".pdf") returned 4 [0075.855] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.855] lstrlenW (lpString=".xls") returned 4 [0075.855] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.855] lstrlenW (lpString=".xlsx") returned 5 [0075.855] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0075.855] lstrlenW (lpString=".ppt") returned 4 [0075.855] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.855] lstrlenW (lpString=".zip") returned 4 [0075.855] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.855] lstrlenW (lpString=".rar") returned 4 [0075.855] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.856] lstrlenW (lpString=".bz2") returned 4 [0075.856] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.856] lstrlenW (lpString=".7z") returned 3 [0075.856] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.856] lstrlenW (lpString=".dbf") returned 4 [0075.856] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.856] lstrlenW (lpString=".1cd") returned 4 [0075.856] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0075.856] lstrlenW (lpString=".jpg") returned 4 [0075.856] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.856] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") [0075.857] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6070) returned 1 [0075.857] CloseHandle (hObject=0x154) returned 1 [0075.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0075.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0075.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0075.857] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.857] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.858] GetLastError () returned 0x0 [0075.858] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x17b6, lpOverlapped=0x0) returned 1 [0075.861] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0075.868] ReadFile (in: hFile=0x154, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.869] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.869] SetEndOfFile (hFile=0x180) returned 1 [0075.869] CloseHandle (hObject=0x180) returned 1 [0075.869] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.869] SetEndOfFile (hFile=0x154) returned 1 [0075.870] CloseHandle (hObject=0x154) returned 1 [0075.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0075.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.870] lstrlenW (lpString=".doc") returned 4 [0075.870] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0075.870] lstrlenW (lpString=".docx") returned 5 [0075.870] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0075.870] lstrlenW (lpString=".pdf") returned 4 [0075.870] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0075.870] lstrlenW (lpString=".xls") returned 4 [0075.870] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0075.870] lstrlenW (lpString=".xlsx") returned 5 [0075.870] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0075.870] lstrlenW (lpString=".ppt") returned 4 [0075.870] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0075.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.871] lstrlenW (lpString=".zip") returned 4 [0075.871] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0075.871] lstrlenW (lpString=".rar") returned 4 [0075.871] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0075.871] lstrlenW (lpString=".bz2") returned 4 [0075.871] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0075.871] lstrlenW (lpString=".7z") returned 3 [0075.871] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0075.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.871] lstrlenW (lpString=".dbf") returned 4 [0075.871] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0075.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.871] lstrlenW (lpString=".1cd") returned 4 [0075.871] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0075.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0075.871] lstrlenW (lpString=".jpg") returned 4 [0075.871] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0075.871] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") [0076.009] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6020) returned 1 [0076.009] CloseHandle (hObject=0x16c) returned 1 [0076.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0076.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0076.070] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.070] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.094] GetLastError () returned 0x0 [0076.094] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1784, lpOverlapped=0x0) returned 1 [0076.104] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0076.105] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.105] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.105] SetEndOfFile (hFile=0x1ec) returned 1 [0076.105] CloseHandle (hObject=0x1ec) returned 1 [0076.105] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.105] SetEndOfFile (hFile=0x16c) returned 1 [0076.106] CloseHandle (hObject=0x16c) returned 1 [0076.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0076.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.107] lstrlenW (lpString=".doc") returned 4 [0076.107] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.107] lstrlenW (lpString=".docx") returned 5 [0076.107] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0076.107] lstrlenW (lpString=".pdf") returned 4 [0076.107] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.107] lstrlenW (lpString=".xls") returned 4 [0076.107] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.107] lstrlenW (lpString=".xlsx") returned 5 [0076.107] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0076.107] lstrlenW (lpString=".ppt") returned 4 [0076.107] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.107] lstrlenW (lpString=".zip") returned 4 [0076.107] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.107] lstrlenW (lpString=".rar") returned 4 [0076.107] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.107] lstrlenW (lpString=".bz2") returned 4 [0076.107] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.107] lstrlenW (lpString=".7z") returned 3 [0076.107] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.107] lstrlenW (lpString=".dbf") returned 4 [0076.107] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.107] lstrlenW (lpString=".1cd") returned 4 [0076.107] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0076.108] lstrlenW (lpString=".jpg") returned 4 [0076.108] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.108] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") [0076.108] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6392) returned 1 [0076.108] CloseHandle (hObject=0x16c) returned 1 [0076.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0076.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0076.108] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.108] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.109] GetLastError () returned 0x0 [0076.109] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0076.110] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0076.111] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.111] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.111] SetEndOfFile (hFile=0x1ec) returned 1 [0076.111] CloseHandle (hObject=0x1ec) returned 1 [0076.112] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.112] SetEndOfFile (hFile=0x16c) returned 1 [0076.112] CloseHandle (hObject=0x16c) returned 1 [0076.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.113] lstrlenW (lpString=".doc") returned 4 [0076.113] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.113] lstrlenW (lpString=".docx") returned 5 [0076.113] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.113] lstrlenW (lpString=".pdf") returned 4 [0076.113] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.113] lstrlenW (lpString=".xls") returned 4 [0076.113] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.113] lstrlenW (lpString=".xlsx") returned 5 [0076.113] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.113] lstrlenW (lpString=".ppt") returned 4 [0076.113] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.113] lstrlenW (lpString=".zip") returned 4 [0076.113] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.113] lstrlenW (lpString=".rar") returned 4 [0076.113] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.113] lstrlenW (lpString=".bz2") returned 4 [0076.113] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.113] lstrlenW (lpString=".7z") returned 3 [0076.113] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.113] lstrlenW (lpString=".dbf") returned 4 [0076.113] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.114] lstrlenW (lpString=".1cd") returned 4 [0076.114] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0076.114] lstrlenW (lpString=".jpg") returned 4 [0076.114] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.114] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") [0076.114] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4219) returned 1 [0076.114] CloseHandle (hObject=0x16c) returned 1 [0076.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0076.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0076.114] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.114] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.115] GetLastError () returned 0x0 [0076.115] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x107b, lpOverlapped=0x0) returned 1 [0076.147] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0076.148] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.148] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.148] SetEndOfFile (hFile=0x1ec) returned 1 [0076.149] CloseHandle (hObject=0x1ec) returned 1 [0076.149] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.149] SetEndOfFile (hFile=0x16c) returned 1 [0076.149] CloseHandle (hObject=0x16c) returned 1 [0076.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0076.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.150] lstrlenW (lpString=".doc") returned 4 [0076.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.150] lstrlenW (lpString=".docx") returned 5 [0076.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.150] lstrlenW (lpString=".pdf") returned 4 [0076.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.150] lstrlenW (lpString=".xls") returned 4 [0076.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.150] lstrlenW (lpString=".xlsx") returned 5 [0076.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.150] lstrlenW (lpString=".ppt") returned 4 [0076.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.150] lstrlenW (lpString=".zip") returned 4 [0076.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.150] lstrlenW (lpString=".rar") returned 4 [0076.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.150] lstrlenW (lpString=".bz2") returned 4 [0076.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.151] lstrlenW (lpString=".7z") returned 3 [0076.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.151] lstrlenW (lpString=".dbf") returned 4 [0076.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.151] lstrlenW (lpString=".1cd") returned 4 [0076.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0076.151] lstrlenW (lpString=".jpg") returned 4 [0076.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.151] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") [0076.151] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14044) returned 1 [0076.151] CloseHandle (hObject=0x16c) returned 1 [0076.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0076.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0076.152] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.152] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.152] GetLastError () returned 0x0 [0076.152] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0076.174] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0076.175] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.175] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.175] SetEndOfFile (hFile=0x1ec) returned 1 [0076.175] CloseHandle (hObject=0x1ec) returned 1 [0076.175] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.175] SetEndOfFile (hFile=0x16c) returned 1 [0076.176] CloseHandle (hObject=0x16c) returned 1 [0076.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString=".doc") returned 4 [0076.177] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.177] lstrlenW (lpString=".docx") returned 5 [0076.177] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.177] lstrlenW (lpString=".pdf") returned 4 [0076.177] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.177] lstrlenW (lpString=".xls") returned 4 [0076.177] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.177] lstrlenW (lpString=".xlsx") returned 5 [0076.177] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.177] lstrlenW (lpString=".ppt") returned 4 [0076.177] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString=".zip") returned 4 [0076.177] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.177] lstrlenW (lpString=".rar") returned 4 [0076.177] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.177] lstrlenW (lpString=".bz2") returned 4 [0076.177] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.177] lstrlenW (lpString=".7z") returned 3 [0076.177] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString=".dbf") returned 4 [0076.177] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString=".1cd") returned 4 [0076.177] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0076.177] lstrlenW (lpString=".jpg") returned 4 [0076.178] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.178] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") [0076.179] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4961) returned 1 [0076.179] CloseHandle (hObject=0x16c) returned 1 [0076.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0076.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0076.179] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.179] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.180] GetLastError () returned 0x0 [0076.180] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1361, lpOverlapped=0x0) returned 1 [0076.206] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0076.207] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.208] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.208] SetEndOfFile (hFile=0x1ec) returned 1 [0076.208] CloseHandle (hObject=0x1ec) returned 1 [0076.208] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.208] SetEndOfFile (hFile=0x16c) returned 1 [0076.209] CloseHandle (hObject=0x16c) returned 1 [0076.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.209] lstrlenW (lpString=".doc") returned 4 [0076.210] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0076.210] lstrlenW (lpString=".docx") returned 5 [0076.210] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0076.210] lstrlenW (lpString=".pdf") returned 4 [0076.210] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0076.210] lstrlenW (lpString=".xls") returned 4 [0076.210] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0076.210] lstrlenW (lpString=".xlsx") returned 5 [0076.210] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0076.210] lstrlenW (lpString=".ppt") returned 4 [0076.210] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.210] lstrlenW (lpString=".zip") returned 4 [0076.210] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0076.210] lstrlenW (lpString=".rar") returned 4 [0076.210] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0076.210] lstrlenW (lpString=".bz2") returned 4 [0076.210] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0076.210] lstrlenW (lpString=".7z") returned 3 [0076.210] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.210] lstrlenW (lpString=".dbf") returned 4 [0076.210] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.210] lstrlenW (lpString=".1cd") returned 4 [0076.210] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0076.210] lstrlenW (lpString=".jpg") returned 4 [0076.210] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0076.210] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") [0076.279] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=21089) returned 1 [0076.279] CloseHandle (hObject=0x1fc) returned 1 [0076.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0076.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.280] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.280] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.280] GetLastError () returned 0x0 [0076.280] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x5261, lpOverlapped=0x0) returned 1 [0076.678] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0076.689] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.690] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.690] SetEndOfFile (hFile=0x1c0) returned 1 [0076.777] CloseHandle (hObject=0x1c0) returned 1 [0076.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.777] SetEndOfFile (hFile=0x1fc) returned 1 [0076.779] CloseHandle (hObject=0x1fc) returned 1 [0076.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0076.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.785] lstrlenW (lpString=".doc") returned 4 [0076.785] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.785] lstrlenW (lpString=".docx") returned 5 [0076.785] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.785] lstrlenW (lpString=".pdf") returned 4 [0076.786] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString=".xls") returned 4 [0076.786] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString=".xlsx") returned 5 [0076.786] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.786] lstrlenW (lpString=".ppt") returned 4 [0076.786] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.786] lstrlenW (lpString=".zip") returned 4 [0076.786] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString=".rar") returned 4 [0076.786] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString=".bz2") returned 4 [0076.786] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString=".7z") returned 3 [0076.786] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.786] lstrlenW (lpString=".dbf") returned 4 [0076.786] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.786] lstrlenW (lpString=".1cd") returned 4 [0076.786] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0076.786] lstrlenW (lpString=".jpg") returned 4 [0076.786] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.786] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") [0076.807] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=32818) returned 1 [0076.807] CloseHandle (hObject=0x1c8) returned 1 [0076.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0076.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.807] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.807] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.821] GetLastError () returned 0x0 [0076.821] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x8032, lpOverlapped=0x0) returned 1 [0076.842] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x8040, lpOverlapped=0x0) returned 1 [0076.844] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.844] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.844] SetEndOfFile (hFile=0x190) returned 1 [0076.844] CloseHandle (hObject=0x190) returned 1 [0076.844] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.845] SetEndOfFile (hFile=0x1c8) returned 1 [0076.845] CloseHandle (hObject=0x1c8) returned 1 [0076.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0076.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.848] lstrlenW (lpString=".doc") returned 4 [0076.848] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".docx") returned 5 [0076.849] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.849] lstrlenW (lpString=".pdf") returned 4 [0076.849] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".xls") returned 4 [0076.849] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".xlsx") returned 5 [0076.849] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.849] lstrlenW (lpString=".ppt") returned 4 [0076.849] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.849] lstrlenW (lpString=".zip") returned 4 [0076.849] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".rar") returned 4 [0076.849] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".bz2") returned 4 [0076.849] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString=".7z") returned 3 [0076.849] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.849] lstrlenW (lpString=".dbf") returned 4 [0076.849] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.849] lstrlenW (lpString=".1cd") returned 4 [0076.849] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0076.849] lstrlenW (lpString=".jpg") returned 4 [0076.849] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.849] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") [0076.863] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=314017) returned 1 [0076.863] CloseHandle (hObject=0x1c8) returned 1 [0076.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0076.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.863] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.863] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.863] GetLastError () returned 0x0 [0076.863] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0076.881] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0076.886] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.886] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.887] SetEndOfFile (hFile=0x190) returned 1 [0076.887] CloseHandle (hObject=0x190) returned 1 [0076.887] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.887] SetEndOfFile (hFile=0x1c8) returned 1 [0076.890] CloseHandle (hObject=0x1c8) returned 1 [0076.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0076.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.890] lstrlenW (lpString=".doc") returned 4 [0076.890] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.890] lstrlenW (lpString=".docx") returned 5 [0076.890] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.891] lstrlenW (lpString=".pdf") returned 4 [0076.891] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString=".xls") returned 4 [0076.891] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString=".xlsx") returned 5 [0076.891] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.891] lstrlenW (lpString=".ppt") returned 4 [0076.891] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.891] lstrlenW (lpString=".zip") returned 4 [0076.891] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString=".rar") returned 4 [0076.891] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString=".bz2") returned 4 [0076.891] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString=".7z") returned 3 [0076.891] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.891] lstrlenW (lpString=".dbf") returned 4 [0076.891] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.891] lstrlenW (lpString=".1cd") returned 4 [0076.891] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0076.891] lstrlenW (lpString=".jpg") returned 4 [0076.891] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.891] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") [0076.892] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24611) returned 1 [0076.892] CloseHandle (hObject=0x1c8) returned 1 [0076.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0076.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.893] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.893] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0076.893] GetLastError () returned 0x0 [0076.893] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6023, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0076.936] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.936] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0076.936] SetEndOfFile (hFile=0x190) returned 1 [0076.936] CloseHandle (hObject=0x190) returned 1 [0076.936] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.936] SetEndOfFile (hFile=0x1c8) returned 1 [0076.937] CloseHandle (hObject=0x1c8) returned 1 [0076.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0076.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.938] lstrlenW (lpString=".doc") returned 4 [0076.938] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".docx") returned 5 [0076.938] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.938] lstrlenW (lpString=".pdf") returned 4 [0076.938] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".xls") returned 4 [0076.938] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".xlsx") returned 5 [0076.938] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.938] lstrlenW (lpString=".ppt") returned 4 [0076.938] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.938] lstrlenW (lpString=".zip") returned 4 [0076.938] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".rar") returned 4 [0076.938] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".bz2") returned 4 [0076.938] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString=".7z") returned 3 [0076.938] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.938] lstrlenW (lpString=".dbf") returned 4 [0076.938] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.939] lstrlenW (lpString=".1cd") returned 4 [0076.939] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0076.939] lstrlenW (lpString=".jpg") returned 4 [0076.939] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.939] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") [0076.968] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=16350) returned 1 [0076.968] CloseHandle (hObject=0x210) returned 1 [0076.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0076.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0076.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0076.968] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.969] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.969] GetLastError () returned 0x0 [0076.969] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3fde, lpOverlapped=0x0) returned 1 [0076.972] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0076.973] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.973] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.973] SetEndOfFile (hFile=0x1c8) returned 1 [0076.973] CloseHandle (hObject=0x1c8) returned 1 [0076.973] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.973] SetEndOfFile (hFile=0x210) returned 1 [0076.974] CloseHandle (hObject=0x210) returned 1 [0076.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0076.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0076.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.974] lstrlenW (lpString=".doc") returned 4 [0076.974] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0076.974] lstrlenW (lpString=".docx") returned 5 [0076.974] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0076.975] lstrlenW (lpString=".pdf") returned 4 [0076.975] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString=".xls") returned 4 [0076.975] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString=".xlsx") returned 5 [0076.975] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0076.975] lstrlenW (lpString=".ppt") returned 4 [0076.975] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.975] lstrlenW (lpString=".zip") returned 4 [0076.975] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString=".rar") returned 4 [0076.975] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString=".bz2") returned 4 [0076.975] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString=".7z") returned 3 [0076.975] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0076.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.975] lstrlenW (lpString=".dbf") returned 4 [0076.975] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.975] lstrlenW (lpString=".1cd") returned 4 [0076.975] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0076.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0076.975] lstrlenW (lpString=".jpg") returned 4 [0076.975] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0076.975] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") [0077.626] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=26648) returned 1 [0077.626] CloseHandle (hObject=0x1f0) returned 1 [0077.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0077.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0077.626] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.626] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0077.626] GetLastError () returned 0x0 [0077.626] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6818, lpOverlapped=0x0) returned 1 [0077.628] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6820, lpOverlapped=0x0) returned 1 [0077.629] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.629] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.629] SetEndOfFile (hFile=0x15c) returned 1 [0077.629] CloseHandle (hObject=0x15c) returned 1 [0077.630] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.630] SetEndOfFile (hFile=0x1f0) returned 1 [0077.630] CloseHandle (hObject=0x1f0) returned 1 [0077.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0077.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.631] lstrlenW (lpString=".doc") returned 4 [0077.631] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".docx") returned 5 [0077.631] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.631] lstrlenW (lpString=".pdf") returned 4 [0077.631] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".xls") returned 4 [0077.631] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".xlsx") returned 5 [0077.631] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.631] lstrlenW (lpString=".ppt") returned 4 [0077.631] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.631] lstrlenW (lpString=".zip") returned 4 [0077.631] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".rar") returned 4 [0077.631] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".bz2") returned 4 [0077.631] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.631] lstrlenW (lpString=".7z") returned 3 [0077.632] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.632] lstrlenW (lpString=".dbf") returned 4 [0077.632] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.632] lstrlenW (lpString=".1cd") returned 4 [0077.632] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0077.632] lstrlenW (lpString=".jpg") returned 4 [0077.632] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.632] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") [0077.653] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=43193) returned 1 [0077.654] CloseHandle (hObject=0x16c) returned 1 [0077.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0077.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0077.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0077.654] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.654] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0077.654] GetLastError () returned 0x0 [0077.654] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0077.933] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0077.935] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.935] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0077.935] SetEndOfFile (hFile=0x1ec) returned 1 [0077.935] CloseHandle (hObject=0x1ec) returned 1 [0077.935] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.935] SetEndOfFile (hFile=0x16c) returned 1 [0077.936] CloseHandle (hObject=0x16c) returned 1 [0077.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0077.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0077.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.945] lstrlenW (lpString=".doc") returned 4 [0077.945] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0077.945] lstrlenW (lpString=".docx") returned 5 [0077.945] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0077.945] lstrlenW (lpString=".pdf") returned 4 [0077.945] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0077.945] lstrlenW (lpString=".xls") returned 4 [0077.945] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0077.945] lstrlenW (lpString=".xlsx") returned 5 [0077.945] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0077.945] lstrlenW (lpString=".ppt") returned 4 [0077.946] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.946] lstrlenW (lpString=".zip") returned 4 [0077.946] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString=".rar") returned 4 [0077.946] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString=".bz2") returned 4 [0077.946] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString=".7z") returned 3 [0077.946] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0077.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.946] lstrlenW (lpString=".dbf") returned 4 [0077.946] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.946] lstrlenW (lpString=".1cd") returned 4 [0077.946] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0077.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0077.946] lstrlenW (lpString=".jpg") returned 4 [0077.946] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0077.946] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") [0078.766] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=21423) returned 1 [0078.766] CloseHandle (hObject=0x1c8) returned 1 [0078.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0078.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.178] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.178] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0079.179] GetLastError () returned 0x0 [0079.179] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x53af, lpOverlapped=0x0) returned 1 [0079.189] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0079.190] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.190] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0079.190] SetEndOfFile (hFile=0x16c) returned 1 [0079.195] CloseHandle (hObject=0x16c) returned 1 [0079.195] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.195] SetEndOfFile (hFile=0x210) returned 1 [0079.204] CloseHandle (hObject=0x210) returned 1 [0079.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0079.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.204] lstrlenW (lpString=".doc") returned 4 [0079.204] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.204] lstrlenW (lpString=".docx") returned 5 [0079.204] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.204] lstrlenW (lpString=".pdf") returned 4 [0079.204] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.204] lstrlenW (lpString=".xls") returned 4 [0079.204] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString=".xlsx") returned 5 [0079.205] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.205] lstrlenW (lpString=".ppt") returned 4 [0079.205] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.205] lstrlenW (lpString=".zip") returned 4 [0079.205] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString=".rar") returned 4 [0079.205] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString=".bz2") returned 4 [0079.205] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString=".7z") returned 3 [0079.205] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.205] lstrlenW (lpString=".dbf") returned 4 [0079.205] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.205] lstrlenW (lpString=".1cd") returned 4 [0079.205] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0079.205] lstrlenW (lpString=".jpg") returned 4 [0079.205] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.205] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") [0079.206] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=19611) returned 1 [0079.206] CloseHandle (hObject=0x210) returned 1 [0079.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0079.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.206] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.207] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0079.207] GetLastError () returned 0x0 [0079.207] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0079.209] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0079.210] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.210] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0079.210] SetEndOfFile (hFile=0x16c) returned 1 [0079.210] CloseHandle (hObject=0x16c) returned 1 [0079.210] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.210] SetEndOfFile (hFile=0x210) returned 1 [0079.211] CloseHandle (hObject=0x210) returned 1 [0079.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0079.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.211] lstrlenW (lpString=".doc") returned 4 [0079.211] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".docx") returned 5 [0079.212] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.212] lstrlenW (lpString=".pdf") returned 4 [0079.212] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".xls") returned 4 [0079.212] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".xlsx") returned 5 [0079.212] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.212] lstrlenW (lpString=".ppt") returned 4 [0079.212] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.212] lstrlenW (lpString=".zip") returned 4 [0079.212] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".rar") returned 4 [0079.212] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".bz2") returned 4 [0079.212] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString=".7z") returned 3 [0079.212] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.212] lstrlenW (lpString=".dbf") returned 4 [0079.212] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.213] lstrlenW (lpString=".1cd") returned 4 [0079.213] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0079.213] lstrlenW (lpString=".jpg") returned 4 [0079.213] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.213] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") [0079.214] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=31224) returned 1 [0079.214] CloseHandle (hObject=0x210) returned 1 [0079.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0079.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.214] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.214] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0079.214] GetLastError () returned 0x0 [0079.214] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x79f8, lpOverlapped=0x0) returned 1 [0079.283] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0079.285] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.285] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0079.285] SetEndOfFile (hFile=0x16c) returned 1 [0079.285] CloseHandle (hObject=0x16c) returned 1 [0079.285] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.285] SetEndOfFile (hFile=0x210) returned 1 [0079.286] CloseHandle (hObject=0x210) returned 1 [0079.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0079.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString=".doc") returned 4 [0079.287] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".docx") returned 5 [0079.287] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0079.287] lstrlenW (lpString=".pdf") returned 4 [0079.287] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".xls") returned 4 [0079.287] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".xlsx") returned 5 [0079.287] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0079.287] lstrlenW (lpString=".ppt") returned 4 [0079.287] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString=".zip") returned 4 [0079.287] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".rar") returned 4 [0079.287] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".bz2") returned 4 [0079.287] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString=".7z") returned 3 [0079.287] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0079.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString=".dbf") returned 4 [0079.287] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString=".1cd") returned 4 [0079.287] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0079.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0079.287] lstrlenW (lpString=".jpg") returned 4 [0079.287] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0079.288] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") [0079.288] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=394200) returned 1 [0079.288] CloseHandle (hObject=0x210) returned 1 [0079.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0079.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.288] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.288] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0079.289] GetLastError () returned 0x0 [0079.289] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x603d8, lpOverlapped=0x0) returned 1 [0079.339] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0079.346] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.347] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.347] SetEndOfFile (hFile=0x16c) returned 1 [0079.347] CloseHandle (hObject=0x16c) returned 1 [0079.347] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.347] SetEndOfFile (hFile=0x210) returned 1 [0079.351] CloseHandle (hObject=0x210) returned 1 [0079.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0079.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.351] lstrlenW (lpString=".doc") returned 4 [0079.351] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0079.351] lstrlenW (lpString=".docx") returned 5 [0079.351] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0079.351] lstrlenW (lpString=".pdf") returned 4 [0079.351] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0079.351] lstrlenW (lpString=".xls") returned 4 [0079.351] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0079.351] lstrlenW (lpString=".xlsx") returned 5 [0079.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0079.351] lstrlenW (lpString=".ppt") returned 4 [0079.351] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0079.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.351] lstrlenW (lpString=".zip") returned 4 [0079.351] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0079.351] lstrlenW (lpString=".rar") returned 4 [0079.352] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0079.352] lstrlenW (lpString=".bz2") returned 4 [0079.352] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0079.352] lstrlenW (lpString=".7z") returned 3 [0079.352] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0079.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.352] lstrlenW (lpString=".dbf") returned 4 [0079.352] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0079.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.352] lstrlenW (lpString=".1cd") returned 4 [0079.352] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0079.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0079.352] lstrlenW (lpString=".jpg") returned 4 [0079.352] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0079.352] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") [0079.554] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=15264) returned 1 [0079.554] CloseHandle (hObject=0x210) returned 1 [0079.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0079.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.554] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.554] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.723] GetLastError () returned 0x0 [0079.723] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3ba0, lpOverlapped=0x0) returned 1 [0079.724] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3bb0, lpOverlapped=0x0) returned 1 [0079.725] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.725] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.726] SetEndOfFile (hFile=0x22c) returned 1 [0079.726] CloseHandle (hObject=0x22c) returned 1 [0079.726] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.726] SetEndOfFile (hFile=0x210) returned 1 [0079.727] CloseHandle (hObject=0x210) returned 1 [0079.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 1 [0079.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.727] lstrlenW (lpString=".doc") returned 4 [0079.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.727] lstrlenW (lpString=".docx") returned 5 [0079.727] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0079.727] lstrlenW (lpString=".pdf") returned 4 [0079.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.727] lstrlenW (lpString=".xls") returned 4 [0079.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.727] lstrlenW (lpString=".xlsx") returned 5 [0079.727] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0079.727] lstrlenW (lpString=".ppt") returned 4 [0079.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.728] lstrlenW (lpString=".zip") returned 4 [0079.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.728] lstrlenW (lpString=".rar") returned 4 [0079.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.728] lstrlenW (lpString=".bz2") returned 4 [0079.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.728] lstrlenW (lpString=".7z") returned 3 [0079.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.728] lstrlenW (lpString=".dbf") returned 4 [0079.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.728] lstrlenW (lpString=".1cd") returned 4 [0079.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0079.728] lstrlenW (lpString=".jpg") returned 4 [0079.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.728] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") [0079.733] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=275856) returned 1 [0079.733] CloseHandle (hObject=0x210) returned 1 [0079.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0079.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.734] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.734] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.735] GetLastError () returned 0x0 [0079.735] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x43590, lpOverlapped=0x0) returned 1 [0079.742] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x435a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x435a0, lpOverlapped=0x0) returned 1 [0079.748] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.748] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.748] SetEndOfFile (hFile=0x22c) returned 1 [0079.748] CloseHandle (hObject=0x22c) returned 1 [0079.748] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.748] SetEndOfFile (hFile=0x210) returned 1 [0079.751] CloseHandle (hObject=0x210) returned 1 [0079.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 1 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString=".doc") returned 4 [0079.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString=".docx") returned 5 [0079.752] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0079.752] lstrlenW (lpString=".pdf") returned 4 [0079.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString=".xls") returned 4 [0079.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString=".xlsx") returned 5 [0079.752] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0079.752] lstrlenW (lpString=".ppt") returned 4 [0079.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString=".zip") returned 4 [0079.752] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString=".rar") returned 4 [0079.752] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.752] lstrlenW (lpString=".bz2") returned 4 [0079.752] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.752] lstrlenW (lpString=".7z") returned 3 [0079.752] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString=".dbf") returned 4 [0079.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString=".1cd") returned 4 [0079.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0079.752] lstrlenW (lpString=".jpg") returned 4 [0079.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.753] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") [0079.754] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=69496) returned 1 [0079.754] CloseHandle (hObject=0x210) returned 1 [0079.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0079.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0079.754] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.754] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.755] GetLastError () returned 0x0 [0079.755] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x10f78, lpOverlapped=0x0) returned 1 [0079.758] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0079.760] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.760] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0079.760] SetEndOfFile (hFile=0x22c) returned 1 [0079.760] CloseHandle (hObject=0x22c) returned 1 [0079.760] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.760] SetEndOfFile (hFile=0x210) returned 1 [0079.761] CloseHandle (hObject=0x210) returned 1 [0079.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0079.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.762] lstrlenW (lpString=".doc") returned 4 [0079.762] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0079.762] lstrlenW (lpString=".docx") returned 5 [0079.762] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0079.762] lstrlenW (lpString=".pdf") returned 4 [0079.762] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0079.762] lstrlenW (lpString=".xls") returned 4 [0079.762] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0079.762] lstrlenW (lpString=".xlsx") returned 5 [0079.762] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0079.762] lstrlenW (lpString=".ppt") returned 4 [0079.762] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0079.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.762] lstrlenW (lpString=".zip") returned 4 [0079.762] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0079.762] lstrlenW (lpString=".rar") returned 4 [0079.762] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0079.762] lstrlenW (lpString=".bz2") returned 4 [0079.763] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0079.763] lstrlenW (lpString=".7z") returned 3 [0079.763] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0079.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.763] lstrlenW (lpString=".dbf") returned 4 [0079.763] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0079.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.763] lstrlenW (lpString=".1cd") returned 4 [0079.763] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0079.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0079.763] lstrlenW (lpString=".jpg") returned 4 [0079.763] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0079.763] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") [0079.825] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=41864) returned 1 [0079.825] CloseHandle (hObject=0x158) returned 1 [0079.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0079.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.826] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.826] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.826] GetLastError () returned 0x0 [0079.827] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa388, lpOverlapped=0x0) returned 1 [0079.829] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0079.830] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.830] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.830] SetEndOfFile (hFile=0x180) returned 1 [0079.830] CloseHandle (hObject=0x180) returned 1 [0079.830] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.831] SetEndOfFile (hFile=0x158) returned 1 [0079.832] CloseHandle (hObject=0x158) returned 1 [0079.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0079.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.832] lstrlenW (lpString=".doc") returned 4 [0079.832] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0079.832] lstrlenW (lpString=".docx") returned 5 [0079.832] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0079.832] lstrlenW (lpString=".pdf") returned 4 [0079.832] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0079.832] lstrlenW (lpString=".xls") returned 4 [0079.832] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0079.832] lstrlenW (lpString=".xlsx") returned 5 [0079.832] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0079.832] lstrlenW (lpString=".ppt") returned 4 [0079.832] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0079.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.832] lstrlenW (lpString=".zip") returned 4 [0079.832] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0079.833] lstrlenW (lpString=".rar") returned 4 [0079.833] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0079.833] lstrlenW (lpString=".bz2") returned 4 [0079.833] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0079.833] lstrlenW (lpString=".7z") returned 3 [0079.833] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0079.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.833] lstrlenW (lpString=".dbf") returned 4 [0079.833] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0079.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.833] lstrlenW (lpString=".1cd") returned 4 [0079.833] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0079.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0079.833] lstrlenW (lpString=".jpg") returned 4 [0079.833] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0079.833] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") [0079.834] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1694) returned 1 [0079.834] CloseHandle (hObject=0x158) returned 1 [0079.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0079.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.834] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.834] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.835] GetLastError () returned 0x0 [0079.835] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x69e, lpOverlapped=0x0) returned 1 [0079.836] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0079.837] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.837] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.837] SetEndOfFile (hFile=0x180) returned 1 [0079.837] CloseHandle (hObject=0x180) returned 1 [0079.837] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.837] SetEndOfFile (hFile=0x158) returned 1 [0079.838] CloseHandle (hObject=0x158) returned 1 [0079.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0079.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.838] lstrlenW (lpString=".doc") returned 4 [0079.839] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString=".docx") returned 5 [0079.839] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0079.839] lstrlenW (lpString=".pdf") returned 4 [0079.839] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString=".xls") returned 4 [0079.839] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0079.839] lstrlenW (lpString=".xlsx") returned 5 [0079.839] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0079.839] lstrlenW (lpString=".ppt") returned 4 [0079.839] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.839] lstrlenW (lpString=".zip") returned 4 [0079.839] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0079.839] lstrlenW (lpString=".rar") returned 4 [0079.839] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString=".bz2") returned 4 [0079.839] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString=".7z") returned 3 [0079.839] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0079.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.839] lstrlenW (lpString=".dbf") returned 4 [0079.839] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.839] lstrlenW (lpString=".1cd") returned 4 [0079.839] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0079.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0079.839] lstrlenW (lpString=".jpg") returned 4 [0079.839] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0079.839] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") [0079.840] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24960) returned 1 [0079.840] CloseHandle (hObject=0x158) returned 1 [0079.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0079.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.840] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.840] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.841] GetLastError () returned 0x0 [0079.841] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6180, lpOverlapped=0x0) returned 1 [0079.843] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0079.844] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.844] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0079.844] SetEndOfFile (hFile=0x180) returned 1 [0079.844] CloseHandle (hObject=0x180) returned 1 [0079.844] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.845] SetEndOfFile (hFile=0x158) returned 1 [0079.845] CloseHandle (hObject=0x158) returned 1 [0079.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 1 [0079.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.846] lstrlenW (lpString=".doc") returned 4 [0079.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString=".docx") returned 5 [0079.846] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0079.846] lstrlenW (lpString=".pdf") returned 4 [0079.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString=".xls") returned 4 [0079.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString=".xlsx") returned 5 [0079.846] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0079.846] lstrlenW (lpString=".ppt") returned 4 [0079.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.846] lstrlenW (lpString=".zip") returned 4 [0079.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString=".rar") returned 4 [0079.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.846] lstrlenW (lpString=".bz2") returned 4 [0079.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.846] lstrlenW (lpString=".7z") returned 3 [0079.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.847] lstrlenW (lpString=".dbf") returned 4 [0079.847] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.847] lstrlenW (lpString=".1cd") returned 4 [0079.847] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0079.847] lstrlenW (lpString=".jpg") returned 4 [0079.847] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.847] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") [0079.847] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10104) returned 1 [0079.847] CloseHandle (hObject=0x158) returned 1 [0079.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0079.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0079.848] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.848] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0079.848] GetLastError () returned 0x0 [0079.848] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2778, lpOverlapped=0x0) returned 1 [0079.850] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2780, lpOverlapped=0x0) returned 1 [0079.851] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.851] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0079.851] SetEndOfFile (hFile=0x180) returned 1 [0079.851] CloseHandle (hObject=0x180) returned 1 [0079.851] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.851] SetEndOfFile (hFile=0x158) returned 1 [0079.852] CloseHandle (hObject=0x158) returned 1 [0079.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 1 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString=".doc") returned 4 [0079.853] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString=".docx") returned 5 [0079.853] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0079.853] lstrlenW (lpString=".pdf") returned 4 [0079.853] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString=".xls") returned 4 [0079.853] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString=".xlsx") returned 5 [0079.853] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0079.853] lstrlenW (lpString=".ppt") returned 4 [0079.853] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString=".zip") returned 4 [0079.853] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString=".rar") returned 4 [0079.853] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0079.853] lstrlenW (lpString=".bz2") returned 4 [0079.853] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.853] lstrlenW (lpString=".7z") returned 3 [0079.853] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString=".dbf") returned 4 [0079.853] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString=".1cd") returned 4 [0079.853] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0079.853] lstrlenW (lpString=".jpg") returned 4 [0079.853] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.854] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") [0079.948] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=45968) returned 1 [0079.948] CloseHandle (hObject=0x22c) returned 1 [0079.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0079.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0079.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0079.961] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.961] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0079.972] GetLastError () returned 0x0 [0079.972] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb390, lpOverlapped=0x0) returned 1 [0079.980] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0079.984] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.984] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0079.984] SetEndOfFile (hFile=0x15c) returned 1 [0079.984] CloseHandle (hObject=0x15c) returned 1 [0079.984] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.984] SetEndOfFile (hFile=0x22c) returned 1 [0079.985] CloseHandle (hObject=0x22c) returned 1 [0079.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0079.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0080.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.081] lstrlenW (lpString=".doc") returned 4 [0080.081] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString=".docx") returned 5 [0080.082] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0080.082] lstrlenW (lpString=".pdf") returned 4 [0080.082] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString=".xls") returned 4 [0080.082] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0080.082] lstrlenW (lpString=".xlsx") returned 5 [0080.082] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0080.082] lstrlenW (lpString=".ppt") returned 4 [0080.082] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.082] lstrlenW (lpString=".zip") returned 4 [0080.082] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0080.082] lstrlenW (lpString=".rar") returned 4 [0080.082] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString=".bz2") returned 4 [0080.082] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString=".7z") returned 3 [0080.082] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0080.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.082] lstrlenW (lpString=".dbf") returned 4 [0080.082] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.082] lstrlenW (lpString=".1cd") returned 4 [0080.082] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0080.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0080.082] lstrlenW (lpString=".jpg") returned 4 [0080.082] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0080.082] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") [0080.984] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=16224) returned 1 [0080.987] CloseHandle (hObject=0x158) returned 1 [0081.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20 [0081.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0081.015] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.015] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0081.016] GetLastError () returned 0x0 [0081.016] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3f60, lpOverlapped=0x0) returned 1 [0081.026] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3f70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3f70, lpOverlapped=0x0) returned 1 [0081.027] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.027] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.027] SetEndOfFile (hFile=0x158) returned 1 [0081.027] CloseHandle (hObject=0x158) returned 1 [0081.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.028] SetEndOfFile (hFile=0x22c) returned 1 [0081.028] CloseHandle (hObject=0x22c) returned 1 [0081.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 1 [0081.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.029] lstrlenW (lpString=".doc") returned 4 [0081.029] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString=".docx") returned 5 [0081.029] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0081.029] lstrlenW (lpString=".pdf") returned 4 [0081.029] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString=".xls") returned 4 [0081.029] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString=".xlsx") returned 5 [0081.029] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0081.029] lstrlenW (lpString=".ppt") returned 4 [0081.029] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.029] lstrlenW (lpString=".zip") returned 4 [0081.029] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString=".rar") returned 4 [0081.029] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0081.029] lstrlenW (lpString=".bz2") returned 4 [0081.030] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0081.030] lstrlenW (lpString=".7z") returned 3 [0081.030] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0081.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.030] lstrlenW (lpString=".dbf") returned 4 [0081.030] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0081.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.030] lstrlenW (lpString=".1cd") returned 4 [0081.030] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0081.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0081.030] lstrlenW (lpString=".jpg") returned 4 [0081.030] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0081.030] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") [0081.030] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=621) returned 1 [0081.031] CloseHandle (hObject=0x22c) returned 1 [0081.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0081.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0081.031] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.031] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0081.031] GetLastError () returned 0x0 [0081.032] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x26d, lpOverlapped=0x0) returned 1 [0081.058] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x270, lpOverlapped=0x0) returned 1 [0081.059] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.059] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xee, lpOverlapped=0x0) returned 1 [0081.059] SetEndOfFile (hFile=0x158) returned 1 [0081.059] CloseHandle (hObject=0x158) returned 1 [0081.059] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.059] SetEndOfFile (hFile=0x22c) returned 1 [0081.060] CloseHandle (hObject=0x22c) returned 1 [0081.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0081.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1 [0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.812] lstrlenW (lpString=".doc") returned 4 [0081.812] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0081.812] lstrlenW (lpString=".docx") returned 5 [0081.812] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0081.812] lstrlenW (lpString=".pdf") returned 4 [0081.812] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0081.812] lstrlenW (lpString=".xls") returned 4 [0081.812] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0081.812] lstrlenW (lpString=".xlsx") returned 5 [0081.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0081.812] lstrlenW (lpString=".ppt") returned 4 [0081.812] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0081.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.812] lstrlenW (lpString=".zip") returned 4 [0081.812] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0081.812] lstrlenW (lpString=".rar") returned 4 [0081.812] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0081.812] lstrlenW (lpString=".bz2") returned 4 [0081.812] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0081.812] lstrlenW (lpString=".7z") returned 3 [0081.813] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0081.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.813] lstrlenW (lpString=".dbf") returned 4 [0081.813] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0081.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.813] lstrlenW (lpString=".1cd") returned 4 [0081.813] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0081.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0081.813] lstrlenW (lpString=".jpg") returned 4 [0081.813] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0081.813] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") [0081.983] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=81768) returned 1 [0081.983] CloseHandle (hObject=0x22c) returned 1 [0081.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0081.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0081.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0081.984] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.984] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0081.984] GetLastError () returned 0x0 [0081.984] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x13f68, lpOverlapped=0x0) returned 1 [0082.009] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0082.011] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.011] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.011] SetEndOfFile (hFile=0x158) returned 1 [0082.011] CloseHandle (hObject=0x158) returned 1 [0082.012] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.012] SetEndOfFile (hFile=0x22c) returned 1 [0082.013] CloseHandle (hObject=0x22c) returned 1 [0082.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1 [0082.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.258] lstrlenW (lpString=".doc") returned 4 [0082.258] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0082.258] lstrlenW (lpString=".docx") returned 5 [0082.258] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0082.258] lstrlenW (lpString=".pdf") returned 4 [0082.258] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0082.258] lstrlenW (lpString=".xls") returned 4 [0082.258] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0082.258] lstrlenW (lpString=".xlsx") returned 5 [0082.258] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0082.258] lstrlenW (lpString=".ppt") returned 4 [0082.258] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.276] lstrlenW (lpString=".zip") returned 4 [0082.276] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0082.276] lstrlenW (lpString=".rar") returned 4 [0082.276] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0082.276] lstrlenW (lpString=".bz2") returned 4 [0082.276] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0082.276] lstrlenW (lpString=".7z") returned 3 [0082.276] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.276] lstrlenW (lpString=".dbf") returned 4 [0082.276] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.277] lstrlenW (lpString=".1cd") returned 4 [0082.277] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0082.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0082.277] lstrlenW (lpString=".jpg") returned 4 [0082.277] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0082.324] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") [0082.344] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=205) returned 1 [0082.344] CloseHandle (hObject=0x180) returned 1 [0082.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0082.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0082.358] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.358] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0082.368] GetLastError () returned 0x0 [0082.368] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcd, lpOverlapped=0x0) returned 1 [0082.380] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0082.381] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.381] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.381] SetEndOfFile (hFile=0x1c8) returned 1 [0082.381] CloseHandle (hObject=0x1c8) returned 1 [0082.381] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.381] SetEndOfFile (hFile=0x180) returned 1 [0082.382] CloseHandle (hObject=0x180) returned 1 [0082.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0082.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1 [0082.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.382] lstrlenW (lpString=".doc") returned 4 [0082.382] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0082.382] lstrlenW (lpString=".docx") returned 5 [0082.382] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0082.382] lstrlenW (lpString=".pdf") returned 4 [0082.382] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0082.382] lstrlenW (lpString=".xls") returned 4 [0082.382] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0082.382] lstrlenW (lpString=".xlsx") returned 5 [0082.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0082.382] lstrlenW (lpString=".ppt") returned 4 [0082.382] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0082.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.382] lstrlenW (lpString=".zip") returned 4 [0082.383] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0082.383] lstrlenW (lpString=".rar") returned 4 [0082.383] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0082.383] lstrlenW (lpString=".bz2") returned 4 [0082.383] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0082.383] lstrlenW (lpString=".7z") returned 3 [0082.383] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0082.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.383] lstrlenW (lpString=".dbf") returned 4 [0082.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0082.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.383] lstrlenW (lpString=".1cd") returned 4 [0082.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0082.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0082.383] lstrlenW (lpString=".jpg") returned 4 [0082.383] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0082.383] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") [0082.777] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2278416) returned 1 [0082.777] CloseHandle (hObject=0x190) returned 1 [0082.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0082.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0082.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0082.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.816] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0082.816] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0082.816] ReadFile (in: hFile=0x190, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.120] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb96b0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.122] ReadFile (in: hFile=0x190, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.127] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0083.127] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1ec410, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.127] ReadFile (in: hFile=0x190, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.314] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.314] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0083.327] SetEndOfFile (hFile=0x190) returned 1 [0083.327] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0083.328] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.328] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.329] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb96b0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.329] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.568] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1ec410, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.568] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.569] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0083.569] CloseHandle (hObject=0x190) returned 1 [0083.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString=".doc") returned 4 [0083.570] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0083.570] lstrlenW (lpString=".docx") returned 5 [0083.570] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0083.570] lstrlenW (lpString=".pdf") returned 4 [0083.570] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0083.570] lstrlenW (lpString=".xls") returned 4 [0083.570] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0083.570] lstrlenW (lpString=".xlsx") returned 5 [0083.570] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0083.570] lstrlenW (lpString=".ppt") returned 4 [0083.570] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString=".zip") returned 4 [0083.570] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0083.570] lstrlenW (lpString=".rar") returned 4 [0083.570] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0083.570] lstrlenW (lpString=".bz2") returned 4 [0083.570] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0083.570] lstrlenW (lpString=".7z") returned 3 [0083.570] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString=".dbf") returned 4 [0083.570] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString=".1cd") returned 4 [0083.570] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0083.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0083.570] lstrlenW (lpString=".jpg") returned 4 [0083.570] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0083.571] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") [0083.571] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=255920) returned 1 [0083.571] CloseHandle (hObject=0x190) returned 1 [0083.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20 [0083.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.572] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.572] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0083.573] GetLastError () returned 0x0 [0083.573] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3e7b0, lpOverlapped=0x0) returned 1 [0083.581] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3e7c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3e7c0, lpOverlapped=0x0) returned 1 [0083.585] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.585] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xee, lpOverlapped=0x0) returned 1 [0083.586] SetEndOfFile (hFile=0x1c8) returned 1 [0083.586] CloseHandle (hObject=0x1c8) returned 1 [0083.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.586] SetEndOfFile (hFile=0x190) returned 1 [0083.588] CloseHandle (hObject=0x190) returned 1 [0083.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 1 [0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.588] lstrlenW (lpString=".doc") returned 4 [0083.588] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0083.588] lstrlenW (lpString=".docx") returned 5 [0083.589] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0083.589] lstrlenW (lpString=".pdf") returned 4 [0083.589] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0083.589] lstrlenW (lpString=".xls") returned 4 [0083.589] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0083.589] lstrlenW (lpString=".xlsx") returned 5 [0083.589] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0083.589] lstrlenW (lpString=".ppt") returned 4 [0083.589] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.589] lstrlenW (lpString=".zip") returned 4 [0083.589] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0083.589] lstrlenW (lpString=".rar") returned 4 [0083.589] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0083.589] lstrlenW (lpString=".bz2") returned 4 [0083.589] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0083.589] lstrlenW (lpString=".7z") returned 3 [0083.589] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.589] lstrlenW (lpString=".dbf") returned 4 [0083.589] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.589] lstrlenW (lpString=".1cd") returned 4 [0083.589] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0083.589] lstrlenW (lpString=".jpg") returned 4 [0083.589] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0083.589] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") [0083.590] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=249535) returned 1 [0083.590] CloseHandle (hObject=0x190) returned 1 [0083.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20 [0083.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0083.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0083.591] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.591] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0083.591] GetLastError () returned 0x0 [0083.591] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0083.597] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3cec0, lpOverlapped=0x0) returned 1 [0083.602] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.602] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0083.602] SetEndOfFile (hFile=0x1c8) returned 1 [0083.602] CloseHandle (hObject=0x1c8) returned 1 [0083.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.602] SetEndOfFile (hFile=0x190) returned 1 [0083.604] CloseHandle (hObject=0x190) returned 1 [0083.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0083.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1 [0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.605] lstrlenW (lpString=".doc") returned 4 [0083.605] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0083.605] lstrlenW (lpString=".docx") returned 5 [0083.605] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0083.605] lstrlenW (lpString=".pdf") returned 4 [0083.605] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0083.605] lstrlenW (lpString=".xls") returned 4 [0083.605] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0083.605] lstrlenW (lpString=".xlsx") returned 5 [0083.605] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0083.605] lstrlenW (lpString=".ppt") returned 4 [0083.605] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.605] lstrlenW (lpString=".zip") returned 4 [0083.605] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0083.605] lstrlenW (lpString=".rar") returned 4 [0083.605] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0083.605] lstrlenW (lpString=".bz2") returned 4 [0083.606] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0083.606] lstrlenW (lpString=".7z") returned 3 [0083.606] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.606] lstrlenW (lpString=".dbf") returned 4 [0083.606] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.606] lstrlenW (lpString=".1cd") returned 4 [0083.606] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0083.606] lstrlenW (lpString=".jpg") returned 4 [0083.606] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0083.606] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") [0084.339] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=39296) returned 1 [0084.339] CloseHandle (hObject=0x1fc) returned 1 [0084.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20 [0084.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0084.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0084.620] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.620] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.131] GetLastError () returned 0x0 [0085.131] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9980, lpOverlapped=0x0) returned 1 [0085.206] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x9990, lpOverlapped=0x0) returned 1 [0085.207] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.207] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0085.207] SetEndOfFile (hFile=0x158) returned 1 [0085.208] CloseHandle (hObject=0x158) returned 1 [0085.208] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.208] SetEndOfFile (hFile=0x210) returned 1 [0085.209] CloseHandle (hObject=0x210) returned 1 [0085.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1 [0085.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.209] lstrlenW (lpString=".doc") returned 4 [0085.209] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0085.209] lstrlenW (lpString=".docx") returned 5 [0085.209] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0085.209] lstrlenW (lpString=".pdf") returned 4 [0085.209] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0085.209] lstrlenW (lpString=".xls") returned 4 [0085.209] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0085.209] lstrlenW (lpString=".xlsx") returned 5 [0085.209] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0085.209] lstrlenW (lpString=".ppt") returned 4 [0085.210] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0085.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.210] lstrlenW (lpString=".zip") returned 4 [0085.210] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0085.210] lstrlenW (lpString=".rar") returned 4 [0085.210] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0085.210] lstrlenW (lpString=".bz2") returned 4 [0085.210] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0085.210] lstrlenW (lpString=".7z") returned 3 [0085.210] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0085.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.210] lstrlenW (lpString=".dbf") returned 4 [0085.210] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0085.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.210] lstrlenW (lpString=".1cd") returned 4 [0085.210] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0085.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0085.210] lstrlenW (lpString=".jpg") returned 4 [0085.210] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0085.210] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") [0085.211] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0085.211] CloseHandle (hObject=0x210) returned 1 [0085.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20 [0085.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.211] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.211] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.212] GetLastError () returned 0x0 [0085.212] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0085.213] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.214] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.214] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0085.214] SetEndOfFile (hFile=0x158) returned 1 [0085.214] CloseHandle (hObject=0x158) returned 1 [0085.214] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.214] SetEndOfFile (hFile=0x210) returned 1 [0085.215] CloseHandle (hObject=0x210) returned 1 [0085.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1 [0085.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString=".doc") returned 4 [0085.216] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.216] lstrlenW (lpString=".docx") returned 5 [0085.216] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.216] lstrlenW (lpString=".pdf") returned 4 [0085.216] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.216] lstrlenW (lpString=".xls") returned 4 [0085.216] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.216] lstrlenW (lpString=".xlsx") returned 5 [0085.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.216] lstrlenW (lpString=".ppt") returned 4 [0085.216] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString=".zip") returned 4 [0085.216] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.216] lstrlenW (lpString=".rar") returned 4 [0085.216] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.216] lstrlenW (lpString=".bz2") returned 4 [0085.216] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.216] lstrlenW (lpString=".7z") returned 3 [0085.216] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString=".dbf") returned 4 [0085.216] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString=".1cd") returned 4 [0085.216] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0085.216] lstrlenW (lpString=".jpg") returned 4 [0085.216] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.216] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") [0085.217] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0085.217] CloseHandle (hObject=0x210) returned 1 [0085.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20 [0085.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.217] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.217] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.218] GetLastError () returned 0x0 [0085.218] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0085.219] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.220] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.220] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0085.220] SetEndOfFile (hFile=0x158) returned 1 [0085.220] CloseHandle (hObject=0x158) returned 1 [0085.220] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.220] SetEndOfFile (hFile=0x210) returned 1 [0085.221] CloseHandle (hObject=0x210) returned 1 [0085.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.222] lstrlenW (lpString=".doc") returned 4 [0085.222] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.222] lstrlenW (lpString=".docx") returned 5 [0085.222] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.222] lstrlenW (lpString=".pdf") returned 4 [0085.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.222] lstrlenW (lpString=".xls") returned 4 [0085.222] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.222] lstrlenW (lpString=".xlsx") returned 5 [0085.222] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.222] lstrlenW (lpString=".ppt") returned 4 [0085.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.222] lstrlenW (lpString=".zip") returned 4 [0085.222] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.222] lstrlenW (lpString=".rar") returned 4 [0085.222] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.222] lstrlenW (lpString=".bz2") returned 4 [0085.222] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.222] lstrlenW (lpString=".7z") returned 3 [0085.222] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.222] lstrlenW (lpString=".dbf") returned 4 [0085.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.222] lstrlenW (lpString=".1cd") returned 4 [0085.223] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0085.223] lstrlenW (lpString=".jpg") returned 4 [0085.223] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.223] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") [0085.223] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1212288) returned 1 [0085.223] CloseHandle (hObject=0x210) returned 1 [0085.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20 [0085.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.224] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.224] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.224] GetLastError () returned 0x0 [0085.224] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0085.264] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0085.285] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x27f90, lpOverlapped=0x0) returned 1 [0085.295] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x27fa0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x27fa0, lpOverlapped=0x0) returned 1 [0085.397] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.397] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.397] SetEndOfFile (hFile=0x158) returned 1 [0085.397] CloseHandle (hObject=0x158) returned 1 [0085.397] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.397] SetEndOfFile (hFile=0x210) returned 1 [0085.399] CloseHandle (hObject=0x210) returned 1 [0085.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 1 [0085.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString=".doc") returned 4 [0085.400] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString=".docx") returned 5 [0085.400] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0085.400] lstrlenW (lpString=".pdf") returned 4 [0085.400] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString=".xls") returned 4 [0085.400] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString=".xlsx") returned 5 [0085.400] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0085.400] lstrlenW (lpString=".ppt") returned 4 [0085.400] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString=".zip") returned 4 [0085.400] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString=".rar") returned 4 [0085.400] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0085.400] lstrlenW (lpString=".bz2") returned 4 [0085.400] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0085.400] lstrlenW (lpString=".7z") returned 3 [0085.400] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0085.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString=".dbf") returned 4 [0085.400] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0085.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString=".1cd") returned 4 [0085.400] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0085.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0085.400] lstrlenW (lpString=".jpg") returned 4 [0085.400] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0085.400] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") [0085.401] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=641) returned 1 [0085.401] CloseHandle (hObject=0x210) returned 1 [0085.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20 [0085.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.401] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.401] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0085.402] GetLastError () returned 0x0 [0085.402] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x281, lpOverlapped=0x0) returned 1 [0085.425] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x290, lpOverlapped=0x0) returned 1 [0085.427] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.427] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0085.428] SetEndOfFile (hFile=0x158) returned 1 [0085.428] CloseHandle (hObject=0x158) returned 1 [0085.428] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.428] SetEndOfFile (hFile=0x210) returned 1 [0085.428] CloseHandle (hObject=0x210) returned 1 [0085.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1 [0085.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.429] lstrlenW (lpString=".doc") returned 4 [0085.429] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0085.429] lstrlenW (lpString=".docx") returned 5 [0085.429] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0085.429] lstrlenW (lpString=".pdf") returned 4 [0085.429] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0085.429] lstrlenW (lpString=".xls") returned 4 [0085.429] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0085.429] lstrlenW (lpString=".xlsx") returned 5 [0085.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0085.429] lstrlenW (lpString=".ppt") returned 4 [0085.429] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0085.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.429] lstrlenW (lpString=".zip") returned 4 [0085.429] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0085.429] lstrlenW (lpString=".rar") returned 4 [0085.429] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0085.429] lstrlenW (lpString=".bz2") returned 4 [0085.430] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0085.430] lstrlenW (lpString=".7z") returned 3 [0085.430] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0085.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.430] lstrlenW (lpString=".dbf") returned 4 [0085.430] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0085.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.430] lstrlenW (lpString=".1cd") returned 4 [0085.430] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0085.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0085.430] lstrlenW (lpString=".jpg") returned 4 [0085.430] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0085.430] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") [0085.430] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1886518) returned 1 [0085.430] CloseHandle (hObject=0x210) returned 1 [0085.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20 [0085.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0085.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0085.432] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0085.432] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.432] ReadFile (in: hFile=0x210, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.437] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x99867, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.437] ReadFile (in: hFile=0x210, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.445] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.446] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x18c936, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.446] ReadFile (in: hFile=0x210, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.497] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.497] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0085.649] SetEndOfFile (hFile=0x210) returned 1 [0085.776] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0085.776] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.776] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.777] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x99867, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.777] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.779] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x18c936, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.779] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0085.781] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0085.781] CloseHandle (hObject=0x210) returned 1 [0085.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.782] lstrlenW (lpString=".doc") returned 4 [0085.782] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.782] lstrlenW (lpString=".docx") returned 5 [0085.782] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0085.782] lstrlenW (lpString=".pdf") returned 4 [0085.782] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.782] lstrlenW (lpString=".xls") returned 4 [0085.782] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.782] lstrlenW (lpString=".xlsx") returned 5 [0085.782] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0085.782] lstrlenW (lpString=".ppt") returned 4 [0085.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.782] lstrlenW (lpString=".zip") returned 4 [0085.782] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.782] lstrlenW (lpString=".rar") returned 4 [0085.782] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.782] lstrlenW (lpString=".bz2") returned 4 [0085.782] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.782] lstrlenW (lpString=".7z") returned 3 [0085.782] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.782] lstrlenW (lpString=".dbf") returned 4 [0085.782] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.783] lstrlenW (lpString=".1cd") returned 4 [0085.783] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0085.783] lstrlenW (lpString=".jpg") returned 4 [0085.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.783] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") [0085.898] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0085.898] CloseHandle (hObject=0x15c) returned 1 [0085.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20 [0085.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.899] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.899] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.922] GetLastError () returned 0x0 [0085.922] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0085.923] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0085.923] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.924] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0085.924] SetEndOfFile (hFile=0x1c0) returned 1 [0085.924] CloseHandle (hObject=0x1c0) returned 1 [0085.924] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.924] SetEndOfFile (hFile=0x15c) returned 1 [0085.925] CloseHandle (hObject=0x15c) returned 1 [0085.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1 [0085.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.925] lstrlenW (lpString=".doc") returned 4 [0085.925] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0085.925] lstrlenW (lpString=".docx") returned 5 [0085.925] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0085.925] lstrlenW (lpString=".pdf") returned 4 [0085.925] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0085.925] lstrlenW (lpString=".xls") returned 4 [0085.925] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0085.925] lstrlenW (lpString=".xlsx") returned 5 [0085.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0085.925] lstrlenW (lpString=".ppt") returned 4 [0085.925] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0085.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.925] lstrlenW (lpString=".zip") returned 4 [0085.926] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0085.926] lstrlenW (lpString=".rar") returned 4 [0085.926] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0085.926] lstrlenW (lpString=".bz2") returned 4 [0085.926] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0085.926] lstrlenW (lpString=".7z") returned 3 [0085.926] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0085.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.926] lstrlenW (lpString=".dbf") returned 4 [0085.926] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0085.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.926] lstrlenW (lpString=".1cd") returned 4 [0085.926] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0085.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0085.926] lstrlenW (lpString=".jpg") returned 4 [0085.926] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0085.926] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") [0085.927] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=457988) returned 1 [0085.927] CloseHandle (hObject=0x15c) returned 1 [0085.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20 [0085.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0085.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0085.927] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.927] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.928] GetLastError () returned 0x0 [0085.928] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0085.938] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6fd10, lpOverlapped=0x0) returned 1 [0085.945] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.945] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0085.945] SetEndOfFile (hFile=0x1c0) returned 1 [0085.945] CloseHandle (hObject=0x1c0) returned 1 [0085.945] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.945] SetEndOfFile (hFile=0x15c) returned 1 [0085.949] CloseHandle (hObject=0x15c) returned 1 [0085.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0085.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1 [0085.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.949] lstrlenW (lpString=".doc") returned 4 [0085.949] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0085.949] lstrlenW (lpString=".docx") returned 5 [0085.949] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0085.950] lstrlenW (lpString=".pdf") returned 4 [0085.950] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0085.950] lstrlenW (lpString=".xls") returned 4 [0085.950] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0085.950] lstrlenW (lpString=".xlsx") returned 5 [0085.950] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0085.950] lstrlenW (lpString=".ppt") returned 4 [0085.950] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0085.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.950] lstrlenW (lpString=".zip") returned 4 [0085.950] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0085.950] lstrlenW (lpString=".rar") returned 4 [0085.950] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0085.950] lstrlenW (lpString=".bz2") returned 4 [0085.950] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0085.950] lstrlenW (lpString=".7z") returned 3 [0085.950] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0085.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.950] lstrlenW (lpString=".dbf") returned 4 [0085.950] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0085.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.950] lstrlenW (lpString=".1cd") returned 4 [0085.950] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0085.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0085.950] lstrlenW (lpString=".jpg") returned 4 [0085.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0085.950] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") [0086.010] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=129432) returned 1 [0086.010] CloseHandle (hObject=0x1fc) returned 1 [0086.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 0x20 [0086.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.010] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.010] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.011] GetLastError () returned 0x0 [0086.011] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1f998, lpOverlapped=0x0) returned 1 [0086.015] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1f9a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1f9a0, lpOverlapped=0x0) returned 1 [0086.017] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.017] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0086.017] SetEndOfFile (hFile=0x1f0) returned 1 [0086.017] CloseHandle (hObject=0x1f0) returned 1 [0086.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.018] SetEndOfFile (hFile=0x1fc) returned 1 [0086.019] CloseHandle (hObject=0x1fc) returned 1 [0086.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 1 [0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.019] lstrlenW (lpString=".doc") returned 4 [0086.019] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString=".docx") returned 5 [0086.020] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0086.020] lstrlenW (lpString=".pdf") returned 4 [0086.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString=".xls") returned 4 [0086.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString=".xlsx") returned 5 [0086.020] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0086.020] lstrlenW (lpString=".ppt") returned 4 [0086.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.020] lstrlenW (lpString=".zip") returned 4 [0086.020] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString=".rar") returned 4 [0086.020] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0086.020] lstrlenW (lpString=".bz2") returned 4 [0086.020] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0086.020] lstrlenW (lpString=".7z") returned 3 [0086.020] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0086.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.020] lstrlenW (lpString=".dbf") returned 4 [0086.020] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0086.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.020] lstrlenW (lpString=".1cd") returned 4 [0086.020] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0086.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0086.020] lstrlenW (lpString=".jpg") returned 4 [0086.020] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0086.020] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") [0086.021] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=611) returned 1 [0086.021] CloseHandle (hObject=0x1fc) returned 1 [0086.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20 [0086.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.022] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.022] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.022] GetLastError () returned 0x0 [0086.022] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x263, lpOverlapped=0x0) returned 1 [0086.023] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x270, lpOverlapped=0x0) returned 1 [0086.024] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.024] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0086.025] SetEndOfFile (hFile=0x1f0) returned 1 [0086.025] CloseHandle (hObject=0x1f0) returned 1 [0086.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.025] SetEndOfFile (hFile=0x1fc) returned 1 [0086.026] CloseHandle (hObject=0x1fc) returned 1 [0086.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1 [0086.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.026] lstrlenW (lpString=".doc") returned 4 [0086.026] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0086.026] lstrlenW (lpString=".docx") returned 5 [0086.026] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0086.026] lstrlenW (lpString=".pdf") returned 4 [0086.026] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0086.026] lstrlenW (lpString=".xls") returned 4 [0086.026] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0086.026] lstrlenW (lpString=".xlsx") returned 5 [0086.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0086.026] lstrlenW (lpString=".ppt") returned 4 [0086.026] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.027] lstrlenW (lpString=".zip") returned 4 [0086.027] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0086.027] lstrlenW (lpString=".rar") returned 4 [0086.027] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0086.027] lstrlenW (lpString=".bz2") returned 4 [0086.027] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0086.027] lstrlenW (lpString=".7z") returned 3 [0086.027] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.027] lstrlenW (lpString=".dbf") returned 4 [0086.027] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.027] lstrlenW (lpString=".1cd") returned 4 [0086.027] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0086.027] lstrlenW (lpString=".jpg") returned 4 [0086.027] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0086.027] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") [0086.028] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=203) returned 1 [0086.028] CloseHandle (hObject=0x1fc) returned 1 [0086.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20 [0086.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.028] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.028] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.031] GetLastError () returned 0x0 [0086.031] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcb, lpOverlapped=0x0) returned 1 [0086.033] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0086.034] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.034] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0086.035] SetEndOfFile (hFile=0x1f0) returned 1 [0086.035] CloseHandle (hObject=0x1f0) returned 1 [0086.035] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.035] SetEndOfFile (hFile=0x1fc) returned 1 [0086.036] CloseHandle (hObject=0x1fc) returned 1 [0086.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1 [0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.036] lstrlenW (lpString=".doc") returned 4 [0086.036] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0086.036] lstrlenW (lpString=".docx") returned 5 [0086.036] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0086.036] lstrlenW (lpString=".pdf") returned 4 [0086.036] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0086.036] lstrlenW (lpString=".xls") returned 4 [0086.036] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0086.036] lstrlenW (lpString=".xlsx") returned 5 [0086.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0086.036] lstrlenW (lpString=".ppt") returned 4 [0086.036] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0086.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.037] lstrlenW (lpString=".zip") returned 4 [0086.037] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0086.037] lstrlenW (lpString=".rar") returned 4 [0086.037] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0086.037] lstrlenW (lpString=".bz2") returned 4 [0086.037] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0086.037] lstrlenW (lpString=".7z") returned 3 [0086.037] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0086.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.037] lstrlenW (lpString=".dbf") returned 4 [0086.037] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0086.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.037] lstrlenW (lpString=".1cd") returned 4 [0086.037] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0086.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0086.037] lstrlenW (lpString=".jpg") returned 4 [0086.037] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0086.037] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") [0086.038] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0086.038] CloseHandle (hObject=0x1fc) returned 1 [0086.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20 [0086.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0086.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0086.039] GetLastError () returned 0x0 [0086.039] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0086.040] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0086.127] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.127] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xee, lpOverlapped=0x0) returned 1 [0086.127] SetEndOfFile (hFile=0x1f0) returned 1 [0086.405] CloseHandle (hObject=0x1f0) returned 1 [0086.414] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.414] SetEndOfFile (hFile=0x1fc) returned 1 [0086.419] CloseHandle (hObject=0x1fc) returned 1 [0086.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0086.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1 [0086.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.422] lstrlenW (lpString=".doc") returned 4 [0086.422] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0086.423] lstrlenW (lpString=".docx") returned 5 [0086.450] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0086.450] lstrlenW (lpString=".pdf") returned 4 [0086.450] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0086.451] lstrlenW (lpString=".xls") returned 4 [0086.451] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0086.451] lstrlenW (lpString=".xlsx") returned 5 [0086.451] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0086.451] lstrlenW (lpString=".ppt") returned 4 [0086.451] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.451] lstrlenW (lpString=".zip") returned 4 [0086.451] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0086.451] lstrlenW (lpString=".rar") returned 4 [0086.451] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0086.451] lstrlenW (lpString=".bz2") returned 4 [0086.451] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0086.451] lstrlenW (lpString=".7z") returned 3 [0086.451] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.451] lstrlenW (lpString=".dbf") returned 4 [0086.451] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.451] lstrlenW (lpString=".1cd") returned 4 [0086.451] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0086.451] lstrlenW (lpString=".jpg") returned 4 [0086.451] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0086.451] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") [0087.018] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9704) returned 1 [0087.018] CloseHandle (hObject=0x190) returned 1 [0087.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 0x20 [0087.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.018] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.018] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.019] GetLastError () returned 0x0 [0087.019] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x25e8, lpOverlapped=0x0) returned 1 [0087.021] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0087.023] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.023] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0087.023] SetEndOfFile (hFile=0x150) returned 1 [0087.023] CloseHandle (hObject=0x150) returned 1 [0087.023] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.023] SetEndOfFile (hFile=0x190) returned 1 [0087.024] CloseHandle (hObject=0x190) returned 1 [0087.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 1 [0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.024] lstrlenW (lpString=".doc") returned 4 [0087.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.024] lstrlenW (lpString=".docx") returned 5 [0087.024] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0087.024] lstrlenW (lpString=".pdf") returned 4 [0087.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.024] lstrlenW (lpString=".xls") returned 4 [0087.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.024] lstrlenW (lpString=".xlsx") returned 5 [0087.024] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0087.024] lstrlenW (lpString=".ppt") returned 4 [0087.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.025] lstrlenW (lpString=".zip") returned 4 [0087.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.025] lstrlenW (lpString=".rar") returned 4 [0087.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.025] lstrlenW (lpString=".bz2") returned 4 [0087.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.025] lstrlenW (lpString=".7z") returned 3 [0087.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.025] lstrlenW (lpString=".dbf") returned 4 [0087.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.025] lstrlenW (lpString=".1cd") returned 4 [0087.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0087.025] lstrlenW (lpString=".jpg") returned 4 [0087.025] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.025] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") [0087.026] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=631) returned 1 [0087.026] CloseHandle (hObject=0x190) returned 1 [0087.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 0x20 [0087.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.026] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.026] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.027] GetLastError () returned 0x0 [0087.027] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x277, lpOverlapped=0x0) returned 1 [0087.029] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x280, lpOverlapped=0x0) returned 1 [0087.029] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.030] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0087.030] SetEndOfFile (hFile=0x150) returned 1 [0087.030] CloseHandle (hObject=0x150) returned 1 [0087.030] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.030] SetEndOfFile (hFile=0x190) returned 1 [0087.031] CloseHandle (hObject=0x190) returned 1 [0087.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1 [0087.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.031] lstrlenW (lpString=".doc") returned 4 [0087.031] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0087.031] lstrlenW (lpString=".docx") returned 5 [0087.031] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0087.031] lstrlenW (lpString=".pdf") returned 4 [0087.031] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0087.031] lstrlenW (lpString=".xls") returned 4 [0087.031] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0087.031] lstrlenW (lpString=".xlsx") returned 5 [0087.031] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0087.031] lstrlenW (lpString=".ppt") returned 4 [0087.031] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0087.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.031] lstrlenW (lpString=".zip") returned 4 [0087.031] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0087.031] lstrlenW (lpString=".rar") returned 4 [0087.031] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0087.032] lstrlenW (lpString=".bz2") returned 4 [0087.032] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0087.032] lstrlenW (lpString=".7z") returned 3 [0087.032] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0087.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.032] lstrlenW (lpString=".dbf") returned 4 [0087.032] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0087.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.032] lstrlenW (lpString=".1cd") returned 4 [0087.032] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0087.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0087.032] lstrlenW (lpString=".jpg") returned 4 [0087.032] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0087.032] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") [0087.033] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=207) returned 1 [0087.033] CloseHandle (hObject=0x190) returned 1 [0087.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20 [0087.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.034] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.034] GetLastError () returned 0x0 [0087.034] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcf, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0087.036] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.036] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0087.036] SetEndOfFile (hFile=0x150) returned 1 [0087.036] CloseHandle (hObject=0x150) returned 1 [0087.036] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.036] SetEndOfFile (hFile=0x190) returned 1 [0087.037] CloseHandle (hObject=0x190) returned 1 [0087.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1 [0087.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.037] lstrlenW (lpString=".doc") returned 4 [0087.038] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0087.038] lstrlenW (lpString=".docx") returned 5 [0087.038] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0087.038] lstrlenW (lpString=".pdf") returned 4 [0087.038] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0087.038] lstrlenW (lpString=".xls") returned 4 [0087.038] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0087.038] lstrlenW (lpString=".xlsx") returned 5 [0087.038] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0087.038] lstrlenW (lpString=".ppt") returned 4 [0087.038] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0087.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.038] lstrlenW (lpString=".zip") returned 4 [0087.038] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0087.038] lstrlenW (lpString=".rar") returned 4 [0087.038] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0087.038] lstrlenW (lpString=".bz2") returned 4 [0087.038] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0087.038] lstrlenW (lpString=".7z") returned 3 [0087.038] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0087.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.038] lstrlenW (lpString=".dbf") returned 4 [0087.038] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0087.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.038] lstrlenW (lpString=".1cd") returned 4 [0087.038] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0087.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0087.038] lstrlenW (lpString=".jpg") returned 4 [0087.038] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0087.038] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") [0087.039] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0087.039] CloseHandle (hObject=0x190) returned 1 [0087.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20 [0087.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.039] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.039] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.040] GetLastError () returned 0x0 [0087.040] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0087.041] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0087.042] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.042] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0087.042] SetEndOfFile (hFile=0x150) returned 1 [0087.043] CloseHandle (hObject=0x150) returned 1 [0087.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.043] SetEndOfFile (hFile=0x190) returned 1 [0087.044] CloseHandle (hObject=0x190) returned 1 [0087.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1 [0087.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.044] lstrlenW (lpString=".doc") returned 4 [0087.044] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0087.044] lstrlenW (lpString=".docx") returned 5 [0087.044] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0087.044] lstrlenW (lpString=".pdf") returned 4 [0087.044] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0087.044] lstrlenW (lpString=".xls") returned 4 [0087.044] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0087.044] lstrlenW (lpString=".xlsx") returned 5 [0087.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0087.044] lstrlenW (lpString=".ppt") returned 4 [0087.044] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0087.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.044] lstrlenW (lpString=".zip") returned 4 [0087.044] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0087.044] lstrlenW (lpString=".rar") returned 4 [0087.045] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0087.045] lstrlenW (lpString=".bz2") returned 4 [0087.045] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0087.045] lstrlenW (lpString=".7z") returned 3 [0087.045] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0087.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.045] lstrlenW (lpString=".dbf") returned 4 [0087.045] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0087.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.045] lstrlenW (lpString=".1cd") returned 4 [0087.045] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0087.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0087.045] lstrlenW (lpString=".jpg") returned 4 [0087.045] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0087.045] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") [0087.045] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0087.046] CloseHandle (hObject=0x190) returned 1 [0087.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20 [0087.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.046] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.046] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0087.047] GetLastError () returned 0x0 [0087.047] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0087.047] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0087.048] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.048] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0087.049] SetEndOfFile (hFile=0x150) returned 1 [0087.049] CloseHandle (hObject=0x150) returned 1 [0087.049] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.049] SetEndOfFile (hFile=0x190) returned 1 [0087.049] CloseHandle (hObject=0x190) returned 1 [0087.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1 [0087.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.050] lstrlenW (lpString=".doc") returned 4 [0087.050] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0087.050] lstrlenW (lpString=".docx") returned 5 [0087.050] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0087.050] lstrlenW (lpString=".pdf") returned 4 [0087.050] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0087.050] lstrlenW (lpString=".xls") returned 4 [0087.050] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0087.050] lstrlenW (lpString=".xlsx") returned 5 [0087.050] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0087.050] lstrlenW (lpString=".ppt") returned 4 [0087.050] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0087.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.050] lstrlenW (lpString=".zip") returned 4 [0087.050] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0087.050] lstrlenW (lpString=".rar") returned 4 [0087.050] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0087.050] lstrlenW (lpString=".bz2") returned 4 [0087.050] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0087.050] lstrlenW (lpString=".7z") returned 3 [0087.050] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0087.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.051] lstrlenW (lpString=".dbf") returned 4 [0087.051] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0087.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.051] lstrlenW (lpString=".1cd") returned 4 [0087.051] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0087.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0087.051] lstrlenW (lpString=".jpg") returned 4 [0087.051] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0087.051] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") [0087.051] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3415952) returned 1 [0087.051] CloseHandle (hObject=0x190) returned 1 [0087.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20 [0087.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0087.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0087.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0087.052] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0087.053] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0087.053] ReadFile (in: hFile=0x190, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0087.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x115fda, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0087.226] ReadFile (in: hFile=0x190, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0087.236] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0087.236] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x301f90, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0087.236] ReadFile (in: hFile=0x190, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0087.254] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0087.374] SetEndOfFile (hFile=0x190) returned 1 [0087.389] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0087.389] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.389] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.426] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x115fda, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.426] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.430] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x301f90, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.430] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0087.435] CloseHandle (hObject=0x190) returned 1 [0087.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0087.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.435] lstrlenW (lpString=".doc") returned 4 [0087.435] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0087.435] lstrlenW (lpString=".docx") returned 5 [0087.435] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0087.435] lstrlenW (lpString=".pdf") returned 4 [0087.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0087.435] lstrlenW (lpString=".xls") returned 4 [0087.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0087.435] lstrlenW (lpString=".xlsx") returned 5 [0087.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0087.435] lstrlenW (lpString=".ppt") returned 4 [0087.435] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0087.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.435] lstrlenW (lpString=".zip") returned 4 [0087.435] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0087.435] lstrlenW (lpString=".rar") returned 4 [0087.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0087.436] lstrlenW (lpString=".bz2") returned 4 [0087.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0087.436] lstrlenW (lpString=".7z") returned 3 [0087.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0087.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.436] lstrlenW (lpString=".dbf") returned 4 [0087.436] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0087.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.436] lstrlenW (lpString=".1cd") returned 4 [0087.436] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0087.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0087.436] lstrlenW (lpString=".jpg") returned 4 [0087.436] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0087.436] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") [0088.212] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2416) returned 1 [0088.212] CloseHandle (hObject=0x1c0) returned 1 [0088.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 0x20 [0088.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.213] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.213] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.457] GetLastError () returned 0x0 [0088.457] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x970, lpOverlapped=0x0) returned 1 [0088.459] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x980, lpOverlapped=0x0) returned 1 [0088.460] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.460] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0088.460] SetEndOfFile (hFile=0x16c) returned 1 [0088.460] CloseHandle (hObject=0x16c) returned 1 [0088.460] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.461] SetEndOfFile (hFile=0x1c0) returned 1 [0088.461] CloseHandle (hObject=0x1c0) returned 1 [0088.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 1 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.462] lstrlenW (lpString=".doc") returned 4 [0088.462] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0088.462] lstrlenW (lpString=".docx") returned 5 [0088.462] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0088.462] lstrlenW (lpString=".pdf") returned 4 [0088.462] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0088.462] lstrlenW (lpString=".xls") returned 4 [0088.462] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0088.462] lstrlenW (lpString=".xlsx") returned 5 [0088.462] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0088.462] lstrlenW (lpString=".ppt") returned 4 [0088.462] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.462] lstrlenW (lpString=".zip") returned 4 [0088.462] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0088.462] lstrlenW (lpString=".rar") returned 4 [0088.462] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0088.462] lstrlenW (lpString=".bz2") returned 4 [0088.462] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0088.462] lstrlenW (lpString=".7z") returned 3 [0088.462] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.462] lstrlenW (lpString=".dbf") returned 4 [0088.462] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.462] lstrlenW (lpString=".1cd") returned 4 [0088.462] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0088.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0088.463] lstrlenW (lpString=".jpg") returned 4 [0088.463] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0088.463] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") [0088.464] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=119680) returned 1 [0088.464] CloseHandle (hObject=0x1c0) returned 1 [0088.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20 [0088.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.464] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.464] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.465] GetLastError () returned 0x0 [0088.465] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1d380, lpOverlapped=0x0) returned 1 [0088.469] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1d390, lpOverlapped=0x0) returned 1 [0088.472] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.472] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0088.472] SetEndOfFile (hFile=0x16c) returned 1 [0088.472] CloseHandle (hObject=0x16c) returned 1 [0088.472] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.472] SetEndOfFile (hFile=0x1c0) returned 1 [0088.473] CloseHandle (hObject=0x1c0) returned 1 [0088.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1 [0088.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.474] lstrlenW (lpString=".doc") returned 4 [0088.474] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".docx") returned 5 [0088.474] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.474] lstrlenW (lpString=".pdf") returned 4 [0088.474] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".xls") returned 4 [0088.474] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".xlsx") returned 5 [0088.474] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.474] lstrlenW (lpString=".ppt") returned 4 [0088.474] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.474] lstrlenW (lpString=".zip") returned 4 [0088.474] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".rar") returned 4 [0088.474] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".bz2") returned 4 [0088.474] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.474] lstrlenW (lpString=".7z") returned 3 [0088.474] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".dbf") returned 4 [0088.475] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".1cd") returned 4 [0088.475] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".jpg") returned 4 [0088.475] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".docx") returned 5 [0088.475] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.475] lstrlenW (lpString=".pdf") returned 4 [0088.475] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".xls") returned 4 [0088.475] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".xlsx") returned 5 [0088.475] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.475] lstrlenW (lpString=".ppt") returned 4 [0088.475] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".zip") returned 4 [0088.475] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".rar") returned 4 [0088.475] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".bz2") returned 4 [0088.475] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString=".7z") returned 3 [0088.475] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".dbf") returned 4 [0088.475] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.475] lstrlenW (lpString=".1cd") returned 4 [0088.476] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0088.476] lstrlenW (lpString=".jpg") returned 4 [0088.476] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.476] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") [0088.476] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=290688) returned 1 [0088.476] CloseHandle (hObject=0x1c0) returned 1 [0088.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 0x20 [0088.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.477] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.477] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0088.477] GetLastError () returned 0x0 [0088.477] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x46f80, lpOverlapped=0x0) returned 1 [0088.484] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x46f90, lpOverlapped=0x0) returned 1 [0088.489] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.489] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0088.490] SetEndOfFile (hFile=0x16c) returned 1 [0088.490] CloseHandle (hObject=0x16c) returned 1 [0088.490] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.490] SetEndOfFile (hFile=0x1c0) returned 1 [0088.493] CloseHandle (hObject=0x1c0) returned 1 [0088.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1 [0088.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.493] lstrlenW (lpString=".doc") returned 4 [0088.493] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0088.493] lstrlenW (lpString=".docx") returned 5 [0088.493] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.493] lstrlenW (lpString=".pdf") returned 4 [0088.493] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.494] lstrlenW (lpString=".xls") returned 4 [0088.494] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.494] lstrlenW (lpString=".xlsx") returned 5 [0088.494] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.494] lstrlenW (lpString=".ppt") returned 4 [0088.494] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.494] lstrlenW (lpString=".zip") returned 4 [0088.494] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.494] lstrlenW (lpString=".rar") returned 4 [0088.579] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.579] lstrlenW (lpString=".bz2") returned 4 [0088.579] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.579] lstrlenW (lpString=".7z") returned 3 [0088.579] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.579] lstrlenW (lpString=".dbf") returned 4 [0088.579] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.579] lstrlenW (lpString=".1cd") returned 4 [0088.588] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.588] lstrlenW (lpString=".jpg") returned 4 [0088.588] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.588] lstrlenW (lpString=".docx") returned 5 [0088.588] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0088.588] lstrlenW (lpString=".pdf") returned 4 [0088.588] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0088.593] lstrlenW (lpString=".xls") returned 4 [0088.594] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0088.594] lstrlenW (lpString=".xlsx") returned 5 [0088.619] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0088.619] lstrlenW (lpString=".ppt") returned 4 [0088.619] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.619] lstrlenW (lpString=".zip") returned 4 [0088.619] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0088.619] lstrlenW (lpString=".rar") returned 4 [0088.619] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0088.619] lstrlenW (lpString=".bz2") returned 4 [0088.619] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0088.619] lstrlenW (lpString=".7z") returned 3 [0088.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.619] lstrlenW (lpString=".dbf") returned 4 [0088.619] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.619] lstrlenW (lpString=".1cd") returned 4 [0088.619] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0088.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0088.620] lstrlenW (lpString=".jpg") returned 4 [0088.620] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0088.620] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") [0088.621] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5000295) returned 1 [0088.621] CloseHandle (hObject=0x190) returned 1 [0088.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20 [0088.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0088.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0088.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0088.622] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0088.622] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.622] ReadFile (in: hFile=0x190, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.625] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x196ecd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.625] ReadFile (in: hFile=0x190, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.631] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0088.631] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x484c67, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0088.632] ReadFile (in: hFile=0x190, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.647] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.647] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0088.827] SetEndOfFile (hFile=0x190) returned 1 [0088.827] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0088.827] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.827] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.828] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x196ecd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.828] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.830] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x484c67, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0088.831] WriteFile (in: hFile=0x190, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0088.833] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0088.833] CloseHandle (hObject=0x190) returned 1 [0088.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0088.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.833] lstrlenW (lpString=".doc") returned 4 [0088.833] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0088.833] lstrlenW (lpString=".docx") returned 5 [0088.833] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0088.833] lstrlenW (lpString=".pdf") returned 4 [0088.833] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0088.833] lstrlenW (lpString=".xls") returned 4 [0088.833] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0088.833] lstrlenW (lpString=".xlsx") returned 5 [0088.833] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0088.833] lstrlenW (lpString=".ppt") returned 4 [0088.833] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0088.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.833] lstrlenW (lpString=".zip") returned 4 [0088.833] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0088.833] lstrlenW (lpString=".rar") returned 4 [0088.833] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0088.833] lstrlenW (lpString=".bz2") returned 4 [0088.833] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0088.833] lstrlenW (lpString=".7z") returned 3 [0088.834] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0088.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.834] lstrlenW (lpString=".dbf") returned 4 [0088.834] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0088.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.834] lstrlenW (lpString=".1cd") returned 4 [0088.834] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0088.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0088.834] lstrlenW (lpString=".jpg") returned 4 [0088.834] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0088.834] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") [0089.121] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=154496) returned 1 [0089.121] CloseHandle (hObject=0x180) returned 1 [0089.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20 [0089.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.122] GetLastError () returned 0x0 [0089.122] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x25b80, lpOverlapped=0x0) returned 1 [0089.127] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x25b90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x25b90, lpOverlapped=0x0) returned 1 [0089.130] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.130] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0089.130] SetEndOfFile (hFile=0x190) returned 1 [0089.130] CloseHandle (hObject=0x190) returned 1 [0089.130] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.130] SetEndOfFile (hFile=0x180) returned 1 [0089.132] CloseHandle (hObject=0x180) returned 1 [0089.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 1 [0089.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.132] lstrlenW (lpString=".doc") returned 4 [0089.132] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0089.132] lstrlenW (lpString=".docx") returned 5 [0089.133] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0089.133] lstrlenW (lpString=".pdf") returned 4 [0089.133] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0089.133] lstrlenW (lpString=".xls") returned 4 [0089.133] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0089.133] lstrlenW (lpString=".xlsx") returned 5 [0089.133] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0089.133] lstrlenW (lpString=".ppt") returned 4 [0089.133] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0089.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.133] lstrlenW (lpString=".zip") returned 4 [0089.133] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0089.133] lstrlenW (lpString=".rar") returned 4 [0089.133] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0089.133] lstrlenW (lpString=".bz2") returned 4 [0089.133] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0089.133] lstrlenW (lpString=".7z") returned 3 [0089.133] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.133] lstrlenW (lpString=".dbf") returned 4 [0089.133] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0089.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.133] lstrlenW (lpString=".1cd") returned 4 [0089.133] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0089.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0089.133] lstrlenW (lpString=".jpg") returned 4 [0089.133] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0089.133] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") [0089.143] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10624) returned 1 [0089.143] CloseHandle (hObject=0x180) returned 1 [0089.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 0x20 [0089.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.143] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.143] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0089.144] GetLastError () returned 0x0 [0089.144] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2980, lpOverlapped=0x0) returned 1 [0089.146] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0089.147] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.147] WriteFile (in: hFile=0x190, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.147] SetEndOfFile (hFile=0x190) returned 1 [0089.147] CloseHandle (hObject=0x190) returned 1 [0089.147] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.147] SetEndOfFile (hFile=0x180) returned 1 [0089.148] CloseHandle (hObject=0x180) returned 1 [0089.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 1 [0089.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.148] lstrlenW (lpString=".doc") returned 4 [0089.148] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0089.148] lstrlenW (lpString=".docx") returned 5 [0089.148] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0089.148] lstrlenW (lpString=".pdf") returned 4 [0089.148] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0089.148] lstrlenW (lpString=".xls") returned 4 [0089.148] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0089.148] lstrlenW (lpString=".xlsx") returned 5 [0089.148] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0089.149] lstrlenW (lpString=".ppt") returned 4 [0089.149] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0089.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.149] lstrlenW (lpString=".zip") returned 4 [0089.149] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0089.149] lstrlenW (lpString=".rar") returned 4 [0089.149] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0089.149] lstrlenW (lpString=".bz2") returned 4 [0089.149] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0089.149] lstrlenW (lpString=".7z") returned 3 [0089.149] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.149] lstrlenW (lpString=".dbf") returned 4 [0089.149] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0089.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.149] lstrlenW (lpString=".1cd") returned 4 [0089.149] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0089.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0089.149] lstrlenW (lpString=".jpg") returned 4 [0089.149] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0089.149] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") [0089.150] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5042788) returned 1 [0089.150] CloseHandle (hObject=0x180) returned 1 [0089.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20 [0089.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0089.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.151] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0089.151] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.151] ReadFile (in: hFile=0x180, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.155] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x19a621, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.155] ReadFile (in: hFile=0x180, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0089.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x48f264, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0089.161] ReadFile (in: hFile=0x180, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.177] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.177] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0089.338] SetEndOfFile (hFile=0x180) returned 1 [0089.338] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0089.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.342] WriteFile (in: hFile=0x180, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.344] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x19a621, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.344] WriteFile (in: hFile=0x180, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.346] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x48f264, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0089.346] WriteFile (in: hFile=0x180, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.348] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0089.348] CloseHandle (hObject=0x180) returned 1 [0089.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString=".doc") returned 4 [0089.349] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0089.349] lstrlenW (lpString=".docx") returned 5 [0089.349] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0089.349] lstrlenW (lpString=".pdf") returned 4 [0089.349] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0089.349] lstrlenW (lpString=".xls") returned 4 [0089.349] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0089.349] lstrlenW (lpString=".xlsx") returned 5 [0089.349] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0089.349] lstrlenW (lpString=".ppt") returned 4 [0089.349] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0089.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString=".zip") returned 4 [0089.349] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0089.349] lstrlenW (lpString=".rar") returned 4 [0089.349] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0089.349] lstrlenW (lpString=".bz2") returned 4 [0089.349] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0089.349] lstrlenW (lpString=".7z") returned 3 [0089.349] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0089.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString=".dbf") returned 4 [0089.349] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0089.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString=".1cd") returned 4 [0089.349] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0089.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0089.349] lstrlenW (lpString=".jpg") returned 4 [0089.349] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0089.350] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") [0089.350] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=38272) returned 1 [0089.351] CloseHandle (hObject=0x180) returned 1 [0089.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0089.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.351] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.351] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0089.546] GetLastError () returned 0x0 [0089.546] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9580, lpOverlapped=0x0) returned 1 [0089.592] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x9590, lpOverlapped=0x0) returned 1 [0089.594] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.594] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0089.594] SetEndOfFile (hFile=0x150) returned 1 [0089.598] CloseHandle (hObject=0x150) returned 1 [0089.598] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.598] SetEndOfFile (hFile=0x180) returned 1 [0089.612] CloseHandle (hObject=0x180) returned 1 [0089.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1 [0089.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.621] lstrlenW (lpString=".doc") returned 4 [0089.621] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0089.626] lstrlenW (lpString=".docx") returned 5 [0089.626] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.626] lstrlenW (lpString=".pdf") returned 4 [0089.626] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.626] lstrlenW (lpString=".xls") returned 4 [0089.626] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.626] lstrlenW (lpString=".xlsx") returned 5 [0089.626] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.626] lstrlenW (lpString=".ppt") returned 4 [0089.626] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.626] lstrlenW (lpString=".zip") returned 4 [0089.626] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.664] lstrlenW (lpString=".rar") returned 4 [0089.664] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.664] lstrlenW (lpString=".bz2") returned 4 [0089.664] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.664] lstrlenW (lpString=".7z") returned 3 [0089.664] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.664] lstrlenW (lpString=".dbf") returned 4 [0089.664] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.664] lstrlenW (lpString=".1cd") returned 4 [0089.664] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.664] lstrlenW (lpString=".jpg") returned 4 [0089.664] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".docx") returned 5 [0089.665] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.665] lstrlenW (lpString=".pdf") returned 4 [0089.665] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".xls") returned 4 [0089.665] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".xlsx") returned 5 [0089.665] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.665] lstrlenW (lpString=".ppt") returned 4 [0089.665] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.665] lstrlenW (lpString=".zip") returned 4 [0089.665] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".rar") returned 4 [0089.665] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".bz2") returned 4 [0089.665] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString=".7z") returned 3 [0089.665] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.665] lstrlenW (lpString=".dbf") returned 4 [0089.665] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.665] lstrlenW (lpString=".1cd") returned 4 [0089.665] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0089.665] lstrlenW (lpString=".jpg") returned 4 [0089.665] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.665] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") [0089.666] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=67968) returned 1 [0089.666] CloseHandle (hObject=0x180) returned 1 [0089.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 0x20 [0089.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.980] GetLastError () returned 0x0 [0089.980] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x10980, lpOverlapped=0x0) returned 1 [0089.983] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10990, lpOverlapped=0x0) returned 1 [0089.985] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.985] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0089.985] SetEndOfFile (hFile=0x1c8) returned 1 [0089.985] CloseHandle (hObject=0x1c8) returned 1 [0089.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.985] SetEndOfFile (hFile=0x180) returned 1 [0089.987] CloseHandle (hObject=0x180) returned 1 [0089.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.987] lstrlenW (lpString=".doc") returned 4 [0089.987] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0089.987] lstrlenW (lpString=".docx") returned 5 [0089.987] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.987] lstrlenW (lpString=".pdf") returned 4 [0089.987] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.987] lstrlenW (lpString=".xls") returned 4 [0089.987] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.987] lstrlenW (lpString=".xlsx") returned 5 [0089.987] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.987] lstrlenW (lpString=".ppt") returned 4 [0089.987] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.987] lstrlenW (lpString=".zip") returned 4 [0089.987] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".rar") returned 4 [0089.988] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".bz2") returned 4 [0089.988] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".7z") returned 3 [0089.988] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.988] lstrlenW (lpString=".dbf") returned 4 [0089.988] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.988] lstrlenW (lpString=".1cd") returned 4 [0089.988] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.988] lstrlenW (lpString=".jpg") returned 4 [0089.988] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".docx") returned 5 [0089.988] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0089.988] lstrlenW (lpString=".pdf") returned 4 [0089.988] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".xls") returned 4 [0089.988] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".xlsx") returned 5 [0089.988] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0089.988] lstrlenW (lpString=".ppt") returned 4 [0089.988] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.988] lstrlenW (lpString=".zip") returned 4 [0089.988] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".rar") returned 4 [0089.988] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0089.988] lstrlenW (lpString=".bz2") returned 4 [0089.989] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0089.989] lstrlenW (lpString=".7z") returned 3 [0089.989] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.989] lstrlenW (lpString=".dbf") returned 4 [0089.989] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0089.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.989] lstrlenW (lpString=".1cd") returned 4 [0089.989] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0089.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0089.989] lstrlenW (lpString=".jpg") returned 4 [0089.989] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0089.989] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") [0089.990] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=28160) returned 1 [0089.990] CloseHandle (hObject=0x180) returned 1 [0089.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20 [0089.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0089.990] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.990] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.991] GetLastError () returned 0x0 [0089.991] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6e00, lpOverlapped=0x0) returned 1 [0089.994] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6e10, lpOverlapped=0x0) returned 1 [0089.995] ReadFile (in: hFile=0x180, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.995] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.995] SetEndOfFile (hFile=0x1c8) returned 1 [0089.995] CloseHandle (hObject=0x1c8) returned 1 [0089.996] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.996] SetEndOfFile (hFile=0x180) returned 1 [0089.996] CloseHandle (hObject=0x180) returned 1 [0089.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0089.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.997] lstrlenW (lpString=".doc") returned 4 [0089.997] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0089.997] lstrlenW (lpString=".docx") returned 5 [0089.997] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0089.997] lstrlenW (lpString=".pdf") returned 4 [0089.997] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0089.997] lstrlenW (lpString=".xls") returned 4 [0089.997] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0089.997] lstrlenW (lpString=".xlsx") returned 5 [0089.997] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0089.997] lstrlenW (lpString=".ppt") returned 4 [0089.997] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.997] lstrlenW (lpString=".zip") returned 4 [0089.997] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0089.997] lstrlenW (lpString=".rar") returned 4 [0089.997] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0089.997] lstrlenW (lpString=".bz2") returned 4 [0089.997] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0089.998] lstrlenW (lpString=".7z") returned 3 [0089.998] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0089.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.998] lstrlenW (lpString=".dbf") returned 4 [0089.998] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0089.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.998] lstrlenW (lpString=".1cd") returned 4 [0089.998] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0089.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0089.998] lstrlenW (lpString=".jpg") returned 4 [0089.998] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0089.998] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") [0089.999] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=171368) returned 1 [0089.999] CloseHandle (hObject=0x1c0) returned 1 [0089.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20 [0089.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0089.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0089.999] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.999] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.000] GetLastError () returned 0x0 [0090.000] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x29d68, lpOverlapped=0x0) returned 1 [0090.005] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x29d70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x29d70, lpOverlapped=0x0) returned 1 [0090.008] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.008] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.008] SetEndOfFile (hFile=0x180) returned 1 [0090.008] CloseHandle (hObject=0x180) returned 1 [0090.008] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.008] SetEndOfFile (hFile=0x1c0) returned 1 [0090.010] CloseHandle (hObject=0x1c0) returned 1 [0090.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 1 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString=".doc") returned 4 [0090.011] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString=".docx") returned 5 [0090.011] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0090.011] lstrlenW (lpString=".pdf") returned 4 [0090.011] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString=".xls") returned 4 [0090.011] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString=".xlsx") returned 5 [0090.011] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0090.011] lstrlenW (lpString=".ppt") returned 4 [0090.011] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString=".zip") returned 4 [0090.011] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString=".rar") returned 4 [0090.011] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.011] lstrlenW (lpString=".bz2") returned 4 [0090.011] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.011] lstrlenW (lpString=".7z") returned 3 [0090.011] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString=".dbf") returned 4 [0090.011] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString=".1cd") returned 4 [0090.011] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0090.011] lstrlenW (lpString=".jpg") returned 4 [0090.011] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.012] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") [0090.012] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=173952) returned 1 [0090.012] CloseHandle (hObject=0x1c0) returned 1 [0090.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 0x20 [0090.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.012] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.013] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0090.013] GetLastError () returned 0x0 [0090.013] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2a780, lpOverlapped=0x0) returned 1 [0090.026] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2a790, lpOverlapped=0x0) returned 1 [0090.029] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.029] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0090.029] SetEndOfFile (hFile=0x180) returned 1 [0090.240] CloseHandle (hObject=0x180) returned 1 [0090.240] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.240] SetEndOfFile (hFile=0x1c0) returned 1 [0090.242] CloseHandle (hObject=0x1c0) returned 1 [0090.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString=".doc") returned 4 [0090.243] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".docx") returned 5 [0090.243] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.243] lstrlenW (lpString=".pdf") returned 4 [0090.243] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".xls") returned 4 [0090.243] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".xlsx") returned 5 [0090.243] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.243] lstrlenW (lpString=".ppt") returned 4 [0090.243] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString=".zip") returned 4 [0090.243] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".rar") returned 4 [0090.243] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".bz2") returned 4 [0090.243] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString=".7z") returned 3 [0090.243] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString=".dbf") returned 4 [0090.243] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString=".1cd") returned 4 [0090.243] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.243] lstrlenW (lpString=".jpg") returned 4 [0090.243] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".docx") returned 5 [0090.244] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.244] lstrlenW (lpString=".pdf") returned 4 [0090.244] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".xls") returned 4 [0090.244] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".xlsx") returned 5 [0090.244] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.244] lstrlenW (lpString=".ppt") returned 4 [0090.244] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.244] lstrlenW (lpString=".zip") returned 4 [0090.244] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".rar") returned 4 [0090.244] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".bz2") returned 4 [0090.244] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString=".7z") returned 3 [0090.244] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.244] lstrlenW (lpString=".dbf") returned 4 [0090.244] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.244] lstrlenW (lpString=".1cd") returned 4 [0090.244] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0090.244] lstrlenW (lpString=".jpg") returned 4 [0090.244] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.244] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") [0090.282] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=397828) returned 1 [0090.282] CloseHandle (hObject=0x1c8) returned 1 [0090.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 0x20 [0090.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.283] GetLastError () returned 0x0 [0090.283] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x61204, lpOverlapped=0x0) returned 1 [0090.292] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x61210, lpOverlapped=0x0) returned 1 [0090.300] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.300] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.300] SetEndOfFile (hFile=0x158) returned 1 [0090.300] CloseHandle (hObject=0x158) returned 1 [0090.300] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.300] SetEndOfFile (hFile=0x1c8) returned 1 [0090.304] CloseHandle (hObject=0x1c8) returned 1 [0090.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1 [0090.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.304] lstrlenW (lpString=".doc") returned 4 [0090.304] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0090.304] lstrlenW (lpString=".docx") returned 5 [0090.304] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0090.304] lstrlenW (lpString=".pdf") returned 4 [0090.304] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0090.304] lstrlenW (lpString=".xls") returned 4 [0090.304] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0090.304] lstrlenW (lpString=".xlsx") returned 5 [0090.304] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0090.304] lstrlenW (lpString=".ppt") returned 4 [0090.304] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0090.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.304] lstrlenW (lpString=".zip") returned 4 [0090.304] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0090.304] lstrlenW (lpString=".rar") returned 4 [0090.305] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0090.305] lstrlenW (lpString=".bz2") returned 4 [0090.305] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0090.305] lstrlenW (lpString=".7z") returned 3 [0090.305] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0090.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.305] lstrlenW (lpString=".dbf") returned 4 [0090.305] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0090.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.305] lstrlenW (lpString=".1cd") returned 4 [0090.305] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0090.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0090.305] lstrlenW (lpString=".jpg") returned 4 [0090.305] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0090.305] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") [0090.306] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=631) returned 1 [0090.306] CloseHandle (hObject=0x1c8) returned 1 [0090.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 0x20 [0090.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.306] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.306] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.307] GetLastError () returned 0x0 [0090.307] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x277, lpOverlapped=0x0) returned 1 [0090.309] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x280, lpOverlapped=0x0) returned 1 [0090.310] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.310] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0090.310] SetEndOfFile (hFile=0x158) returned 1 [0090.310] CloseHandle (hObject=0x158) returned 1 [0090.310] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.310] SetEndOfFile (hFile=0x1c8) returned 1 [0090.311] CloseHandle (hObject=0x1c8) returned 1 [0090.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1 [0090.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.311] lstrlenW (lpString=".doc") returned 4 [0090.311] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0090.311] lstrlenW (lpString=".docx") returned 5 [0090.311] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0090.311] lstrlenW (lpString=".pdf") returned 4 [0090.311] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0090.312] lstrlenW (lpString=".xls") returned 4 [0090.312] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0090.312] lstrlenW (lpString=".xlsx") returned 5 [0090.312] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0090.312] lstrlenW (lpString=".ppt") returned 4 [0090.312] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0090.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.312] lstrlenW (lpString=".zip") returned 4 [0090.312] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0090.312] lstrlenW (lpString=".rar") returned 4 [0090.312] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0090.312] lstrlenW (lpString=".bz2") returned 4 [0090.312] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0090.312] lstrlenW (lpString=".7z") returned 3 [0090.312] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0090.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.312] lstrlenW (lpString=".dbf") returned 4 [0090.312] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0090.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.312] lstrlenW (lpString=".1cd") returned 4 [0090.312] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0090.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0090.312] lstrlenW (lpString=".jpg") returned 4 [0090.312] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0090.312] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") [0090.313] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=207) returned 1 [0090.313] CloseHandle (hObject=0x1c8) returned 1 [0090.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20 [0090.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.313] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.313] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.314] GetLastError () returned 0x0 [0090.314] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcf, lpOverlapped=0x0) returned 1 [0090.315] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0090.316] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.316] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0090.316] SetEndOfFile (hFile=0x158) returned 1 [0090.317] CloseHandle (hObject=0x158) returned 1 [0090.317] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.317] SetEndOfFile (hFile=0x1c8) returned 1 [0090.317] CloseHandle (hObject=0x1c8) returned 1 [0090.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1 [0090.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.318] lstrlenW (lpString=".doc") returned 4 [0090.318] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0090.318] lstrlenW (lpString=".docx") returned 5 [0090.318] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0090.318] lstrlenW (lpString=".pdf") returned 4 [0090.318] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0090.318] lstrlenW (lpString=".xls") returned 4 [0090.318] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0090.318] lstrlenW (lpString=".xlsx") returned 5 [0090.318] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0090.318] lstrlenW (lpString=".ppt") returned 4 [0090.318] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0090.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.318] lstrlenW (lpString=".zip") returned 4 [0090.318] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0090.318] lstrlenW (lpString=".rar") returned 4 [0090.318] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0090.318] lstrlenW (lpString=".bz2") returned 4 [0090.318] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0090.318] lstrlenW (lpString=".7z") returned 3 [0090.318] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0090.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.319] lstrlenW (lpString=".dbf") returned 4 [0090.319] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0090.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.319] lstrlenW (lpString=".1cd") returned 4 [0090.319] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0090.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0090.319] lstrlenW (lpString=".jpg") returned 4 [0090.319] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0090.319] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") [0090.319] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0090.320] CloseHandle (hObject=0x1c8) returned 1 [0090.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20 [0090.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.320] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.320] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.320] GetLastError () returned 0x0 [0090.321] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0090.321] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.322] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.322] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0090.322] SetEndOfFile (hFile=0x158) returned 1 [0090.323] CloseHandle (hObject=0x158) returned 1 [0090.323] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.323] SetEndOfFile (hFile=0x1c8) returned 1 [0090.323] CloseHandle (hObject=0x1c8) returned 1 [0090.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.324] lstrlenW (lpString=".doc") returned 4 [0090.324] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.324] lstrlenW (lpString=".docx") returned 5 [0090.324] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.324] lstrlenW (lpString=".pdf") returned 4 [0090.324] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.324] lstrlenW (lpString=".xls") returned 4 [0090.324] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.324] lstrlenW (lpString=".xlsx") returned 5 [0090.324] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.324] lstrlenW (lpString=".ppt") returned 4 [0090.324] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.324] lstrlenW (lpString=".zip") returned 4 [0090.324] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.324] lstrlenW (lpString=".rar") returned 4 [0090.324] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.324] lstrlenW (lpString=".bz2") returned 4 [0090.324] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.324] lstrlenW (lpString=".7z") returned 3 [0090.324] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.325] lstrlenW (lpString=".dbf") returned 4 [0090.325] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.325] lstrlenW (lpString=".1cd") returned 4 [0090.325] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0090.325] lstrlenW (lpString=".jpg") returned 4 [0090.325] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.325] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") [0090.325] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0090.325] CloseHandle (hObject=0x1c8) returned 1 [0090.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20 [0090.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.326] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.326] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.327] GetLastError () returned 0x0 [0090.327] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0090.327] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.328] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.328] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0090.328] SetEndOfFile (hFile=0x158) returned 1 [0090.329] CloseHandle (hObject=0x158) returned 1 [0090.329] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.329] SetEndOfFile (hFile=0x1c8) returned 1 [0090.329] CloseHandle (hObject=0x1c8) returned 1 [0090.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1 [0090.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.330] lstrlenW (lpString=".doc") returned 4 [0090.330] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.330] lstrlenW (lpString=".docx") returned 5 [0090.330] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.330] lstrlenW (lpString=".pdf") returned 4 [0090.330] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.330] lstrlenW (lpString=".xls") returned 4 [0090.330] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.330] lstrlenW (lpString=".xlsx") returned 5 [0090.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.330] lstrlenW (lpString=".ppt") returned 4 [0090.330] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.330] lstrlenW (lpString=".zip") returned 4 [0090.330] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.330] lstrlenW (lpString=".rar") returned 4 [0090.330] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.330] lstrlenW (lpString=".bz2") returned 4 [0090.330] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.330] lstrlenW (lpString=".7z") returned 3 [0090.331] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.331] lstrlenW (lpString=".dbf") returned 4 [0090.331] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.331] lstrlenW (lpString=".1cd") returned 4 [0090.331] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0090.331] lstrlenW (lpString=".jpg") returned 4 [0090.331] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.331] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") [0090.333] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=68984) returned 1 [0090.333] CloseHandle (hObject=0x1c8) returned 1 [0090.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20 [0090.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.333] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.333] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.334] GetLastError () returned 0x0 [0090.334] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x10d78, lpOverlapped=0x0) returned 1 [0090.337] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10d80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10d80, lpOverlapped=0x0) returned 1 [0090.339] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.339] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0090.339] SetEndOfFile (hFile=0x158) returned 1 [0090.339] CloseHandle (hObject=0x158) returned 1 [0090.339] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.340] SetEndOfFile (hFile=0x1c8) returned 1 [0090.341] CloseHandle (hObject=0x1c8) returned 1 [0090.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 1 [0090.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.341] lstrlenW (lpString=".doc") returned 4 [0090.341] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.341] lstrlenW (lpString=".docx") returned 5 [0090.341] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0090.341] lstrlenW (lpString=".pdf") returned 4 [0090.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.341] lstrlenW (lpString=".xls") returned 4 [0090.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.341] lstrlenW (lpString=".xlsx") returned 5 [0090.341] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0090.341] lstrlenW (lpString=".ppt") returned 4 [0090.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.342] lstrlenW (lpString=".zip") returned 4 [0090.342] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.342] lstrlenW (lpString=".rar") returned 4 [0090.342] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.342] lstrlenW (lpString=".bz2") returned 4 [0090.342] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.342] lstrlenW (lpString=".7z") returned 3 [0090.342] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.342] lstrlenW (lpString=".dbf") returned 4 [0090.342] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.342] lstrlenW (lpString=".1cd") returned 4 [0090.342] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0090.342] lstrlenW (lpString=".jpg") returned 4 [0090.342] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.342] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") [0090.343] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=11648) returned 1 [0090.343] CloseHandle (hObject=0x1c8) returned 1 [0090.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20 [0090.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.343] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.343] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.344] GetLastError () returned 0x0 [0090.344] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2d80, lpOverlapped=0x0) returned 1 [0090.350] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0090.351] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.351] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0090.351] SetEndOfFile (hFile=0x158) returned 1 [0090.351] CloseHandle (hObject=0x158) returned 1 [0090.351] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.351] SetEndOfFile (hFile=0x1c8) returned 1 [0090.354] CloseHandle (hObject=0x1c8) returned 1 [0090.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1 [0090.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.355] lstrlenW (lpString=".doc") returned 4 [0090.355] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".docx") returned 5 [0090.355] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.355] lstrlenW (lpString=".pdf") returned 4 [0090.355] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".xls") returned 4 [0090.355] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".xlsx") returned 5 [0090.355] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.355] lstrlenW (lpString=".ppt") returned 4 [0090.355] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.355] lstrlenW (lpString=".zip") returned 4 [0090.355] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".rar") returned 4 [0090.355] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".bz2") returned 4 [0090.355] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.355] lstrlenW (lpString=".7z") returned 3 [0090.355] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.355] lstrlenW (lpString=".dbf") returned 4 [0090.355] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.356] lstrlenW (lpString=".1cd") returned 4 [0090.356] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.356] lstrlenW (lpString=".jpg") returned 4 [0090.356] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".docx") returned 5 [0090.356] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.356] lstrlenW (lpString=".pdf") returned 4 [0090.356] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".xls") returned 4 [0090.356] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".xlsx") returned 5 [0090.356] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.356] lstrlenW (lpString=".ppt") returned 4 [0090.356] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.356] lstrlenW (lpString=".zip") returned 4 [0090.356] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".rar") returned 4 [0090.356] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".bz2") returned 4 [0090.356] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString=".7z") returned 3 [0090.356] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.356] lstrlenW (lpString=".dbf") returned 4 [0090.356] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.356] lstrlenW (lpString=".1cd") returned 4 [0090.357] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0090.357] lstrlenW (lpString=".jpg") returned 4 [0090.357] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.357] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") [0090.357] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=42352) returned 1 [0090.357] CloseHandle (hObject=0x1c8) returned 1 [0090.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20 [0090.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.358] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.358] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0090.358] GetLastError () returned 0x0 [0090.358] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa570, lpOverlapped=0x0) returned 1 [0090.436] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa580, lpOverlapped=0x0) returned 1 [0090.437] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.437] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.437] SetEndOfFile (hFile=0x158) returned 1 [0090.490] CloseHandle (hObject=0x158) returned 1 [0090.490] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.490] SetEndOfFile (hFile=0x1c8) returned 1 [0090.491] CloseHandle (hObject=0x1c8) returned 1 [0090.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1 [0090.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.541] lstrlenW (lpString=".doc") returned 4 [0090.541] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0090.541] lstrlenW (lpString=".docx") returned 5 [0090.541] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0090.541] lstrlenW (lpString=".pdf") returned 4 [0090.541] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0090.541] lstrlenW (lpString=".xls") returned 4 [0090.541] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0090.541] lstrlenW (lpString=".xlsx") returned 5 [0090.541] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0090.541] lstrlenW (lpString=".ppt") returned 4 [0090.541] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0090.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.541] lstrlenW (lpString=".zip") returned 4 [0090.542] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0090.542] lstrlenW (lpString=".rar") returned 4 [0090.542] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0090.542] lstrlenW (lpString=".bz2") returned 4 [0090.542] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0090.542] lstrlenW (lpString=".7z") returned 3 [0090.542] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0090.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.542] lstrlenW (lpString=".dbf") returned 4 [0090.542] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0090.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.542] lstrlenW (lpString=".1cd") returned 4 [0090.542] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0090.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0090.542] lstrlenW (lpString=".jpg") returned 4 [0090.542] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0090.542] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") [0090.584] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=61312) returned 1 [0090.584] CloseHandle (hObject=0x1c8) returned 1 [0090.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20 [0090.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.584] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.584] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.585] GetLastError () returned 0x0 [0090.585] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xef80, lpOverlapped=0x0) returned 1 [0090.588] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xef90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xef90, lpOverlapped=0x0) returned 1 [0090.589] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.589] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0090.590] SetEndOfFile (hFile=0x1c0) returned 1 [0090.590] CloseHandle (hObject=0x1c0) returned 1 [0090.590] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.590] SetEndOfFile (hFile=0x1c8) returned 1 [0090.591] CloseHandle (hObject=0x1c8) returned 1 [0090.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 1 [0090.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.592] lstrlenW (lpString=".doc") returned 4 [0090.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString=".docx") returned 5 [0090.592] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0090.592] lstrlenW (lpString=".pdf") returned 4 [0090.592] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString=".xls") returned 4 [0090.592] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString=".xlsx") returned 5 [0090.592] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0090.592] lstrlenW (lpString=".ppt") returned 4 [0090.592] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.592] lstrlenW (lpString=".zip") returned 4 [0090.592] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString=".rar") returned 4 [0090.592] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.592] lstrlenW (lpString=".bz2") returned 4 [0090.592] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.592] lstrlenW (lpString=".7z") returned 3 [0090.592] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.592] lstrlenW (lpString=".dbf") returned 4 [0090.592] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.592] lstrlenW (lpString=".1cd") returned 4 [0090.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0090.592] lstrlenW (lpString=".jpg") returned 4 [0090.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.592] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") [0090.594] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1868) returned 1 [0090.594] CloseHandle (hObject=0x1c8) returned 1 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 0x20 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.594] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.594] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.595] GetLastError () returned 0x0 [0090.595] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x74c, lpOverlapped=0x0) returned 1 [0090.597] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x750, lpOverlapped=0x0) returned 1 [0090.598] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.598] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0090.598] SetEndOfFile (hFile=0x1c0) returned 1 [0090.598] CloseHandle (hObject=0x1c0) returned 1 [0090.598] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.598] SetEndOfFile (hFile=0x1c8) returned 1 [0090.599] CloseHandle (hObject=0x1c8) returned 1 [0090.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1 [0090.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.599] lstrlenW (lpString=".doc") returned 4 [0090.599] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0090.599] lstrlenW (lpString=".docx") returned 5 [0090.599] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0090.599] lstrlenW (lpString=".pdf") returned 4 [0090.600] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString=".xls") returned 4 [0090.600] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0090.600] lstrlenW (lpString=".xlsx") returned 5 [0090.600] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0090.600] lstrlenW (lpString=".ppt") returned 4 [0090.600] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.600] lstrlenW (lpString=".zip") returned 4 [0090.600] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0090.600] lstrlenW (lpString=".rar") returned 4 [0090.600] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString=".bz2") returned 4 [0090.600] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString=".7z") returned 3 [0090.600] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.600] lstrlenW (lpString=".dbf") returned 4 [0090.600] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.600] lstrlenW (lpString=".1cd") returned 4 [0090.600] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0090.600] lstrlenW (lpString=".jpg") returned 4 [0090.600] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0090.600] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") [0090.602] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=37264) returned 1 [0090.602] CloseHandle (hObject=0x1c8) returned 1 [0090.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20 [0090.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.602] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.602] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.603] GetLastError () returned 0x0 [0090.603] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9190, lpOverlapped=0x0) returned 1 [0090.605] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x91a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x91a0, lpOverlapped=0x0) returned 1 [0090.607] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.607] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.607] SetEndOfFile (hFile=0x1c0) returned 1 [0090.607] CloseHandle (hObject=0x1c0) returned 1 [0090.607] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.607] SetEndOfFile (hFile=0x1c8) returned 1 [0090.608] CloseHandle (hObject=0x1c8) returned 1 [0090.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 1 [0090.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.608] lstrlenW (lpString=".doc") returned 4 [0090.608] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.608] lstrlenW (lpString=".docx") returned 5 [0090.608] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0090.609] lstrlenW (lpString=".pdf") returned 4 [0090.609] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.609] lstrlenW (lpString=".xls") returned 4 [0090.609] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.609] lstrlenW (lpString=".xlsx") returned 5 [0090.609] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0090.609] lstrlenW (lpString=".ppt") returned 4 [0090.609] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.609] lstrlenW (lpString=".zip") returned 4 [0090.609] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.609] lstrlenW (lpString=".rar") returned 4 [0090.609] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.609] lstrlenW (lpString=".bz2") returned 4 [0090.609] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.609] lstrlenW (lpString=".7z") returned 3 [0090.609] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.609] lstrlenW (lpString=".dbf") returned 4 [0090.609] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.609] lstrlenW (lpString=".1cd") returned 4 [0090.609] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0090.609] lstrlenW (lpString=".jpg") returned 4 [0090.609] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.609] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") [0090.610] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=19328) returned 1 [0090.610] CloseHandle (hObject=0x1c8) returned 1 [0090.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 0x20 [0090.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.610] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.610] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.611] GetLastError () returned 0x0 [0090.611] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0090.613] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0090.614] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.614] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0090.614] SetEndOfFile (hFile=0x1c0) returned 1 [0090.614] CloseHandle (hObject=0x1c0) returned 1 [0090.614] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.614] SetEndOfFile (hFile=0x1c8) returned 1 [0090.615] CloseHandle (hObject=0x1c8) returned 1 [0090.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1 [0090.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.741] lstrlenW (lpString=".doc") returned 4 [0090.741] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0090.741] lstrlenW (lpString=".docx") returned 5 [0090.741] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.741] lstrlenW (lpString=".pdf") returned 4 [0090.741] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.741] lstrlenW (lpString=".xls") returned 4 [0090.742] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString=".xlsx") returned 5 [0090.742] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.742] lstrlenW (lpString=".ppt") returned 4 [0090.742] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.742] lstrlenW (lpString=".zip") returned 4 [0090.742] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString=".rar") returned 4 [0090.742] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString=".bz2") returned 4 [0090.742] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString=".7z") returned 3 [0090.742] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.742] lstrlenW (lpString=".dbf") returned 4 [0090.742] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.742] lstrlenW (lpString=".1cd") returned 4 [0090.742] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.742] lstrlenW (lpString=".jpg") returned 4 [0090.743] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".docx") returned 5 [0090.743] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0090.743] lstrlenW (lpString=".pdf") returned 4 [0090.743] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".xls") returned 4 [0090.743] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".xlsx") returned 5 [0090.743] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0090.743] lstrlenW (lpString=".ppt") returned 4 [0090.743] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.743] lstrlenW (lpString=".zip") returned 4 [0090.743] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".rar") returned 4 [0090.743] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".bz2") returned 4 [0090.743] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString=".7z") returned 3 [0090.743] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.743] lstrlenW (lpString=".dbf") returned 4 [0090.743] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.743] lstrlenW (lpString=".1cd") returned 4 [0090.743] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0090.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0090.743] lstrlenW (lpString=".jpg") returned 4 [0090.743] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0090.743] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") [0090.744] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=641) returned 1 [0090.745] CloseHandle (hObject=0x1c8) returned 1 [0090.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 0x20 [0090.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.745] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.745] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.746] GetLastError () returned 0x0 [0090.746] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x281, lpOverlapped=0x0) returned 1 [0090.831] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x290, lpOverlapped=0x0) returned 1 [0090.832] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.832] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0090.833] SetEndOfFile (hFile=0x150) returned 1 [0090.833] CloseHandle (hObject=0x150) returned 1 [0090.833] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.833] SetEndOfFile (hFile=0x1c8) returned 1 [0090.834] CloseHandle (hObject=0x1c8) returned 1 [0090.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1 [0090.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.834] lstrlenW (lpString=".doc") returned 4 [0090.834] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0090.834] lstrlenW (lpString=".docx") returned 5 [0090.834] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0090.834] lstrlenW (lpString=".pdf") returned 4 [0090.834] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0090.834] lstrlenW (lpString=".xls") returned 4 [0090.834] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0090.834] lstrlenW (lpString=".xlsx") returned 5 [0090.834] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0090.834] lstrlenW (lpString=".ppt") returned 4 [0090.834] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0090.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.835] lstrlenW (lpString=".zip") returned 4 [0090.835] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0090.835] lstrlenW (lpString=".rar") returned 4 [0090.835] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0090.835] lstrlenW (lpString=".bz2") returned 4 [0090.835] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0090.835] lstrlenW (lpString=".7z") returned 3 [0090.835] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0090.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.835] lstrlenW (lpString=".dbf") returned 4 [0090.835] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0090.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.835] lstrlenW (lpString=".1cd") returned 4 [0090.835] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0090.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0090.835] lstrlenW (lpString=".jpg") returned 4 [0090.835] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0090.835] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") [0090.836] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=676) returned 1 [0090.836] CloseHandle (hObject=0x1c8) returned 1 [0090.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 0x20 [0090.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.836] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.836] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.837] GetLastError () returned 0x0 [0090.837] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2a4, lpOverlapped=0x0) returned 1 [0090.898] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0090.899] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.899] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x104, lpOverlapped=0x0) returned 1 [0090.899] SetEndOfFile (hFile=0x150) returned 1 [0090.899] CloseHandle (hObject=0x150) returned 1 [0090.899] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.900] SetEndOfFile (hFile=0x1c8) returned 1 [0090.900] CloseHandle (hObject=0x1c8) returned 1 [0090.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1 [0090.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.901] lstrlenW (lpString=".doc") returned 4 [0090.901] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0090.901] lstrlenW (lpString=".docx") returned 5 [0090.901] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0090.901] lstrlenW (lpString=".pdf") returned 4 [0090.901] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0090.901] lstrlenW (lpString=".xls") returned 4 [0090.901] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0090.901] lstrlenW (lpString=".xlsx") returned 5 [0090.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0090.901] lstrlenW (lpString=".ppt") returned 4 [0090.901] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0090.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.901] lstrlenW (lpString=".zip") returned 4 [0090.901] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0090.901] lstrlenW (lpString=".rar") returned 4 [0090.901] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0090.901] lstrlenW (lpString=".bz2") returned 4 [0090.901] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0090.901] lstrlenW (lpString=".7z") returned 3 [0090.901] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0090.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.901] lstrlenW (lpString=".dbf") returned 4 [0090.901] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0090.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.902] lstrlenW (lpString=".1cd") returned 4 [0090.902] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0090.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0090.902] lstrlenW (lpString=".jpg") returned 4 [0090.902] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0090.902] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") [0090.903] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=216) returned 1 [0090.903] CloseHandle (hObject=0x1c8) returned 1 [0090.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20 [0090.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.903] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.903] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.904] GetLastError () returned 0x0 [0090.904] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd8, lpOverlapped=0x0) returned 1 [0090.905] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0090.906] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.906] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x104, lpOverlapped=0x0) returned 1 [0090.906] SetEndOfFile (hFile=0x150) returned 1 [0090.906] CloseHandle (hObject=0x150) returned 1 [0090.906] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.906] SetEndOfFile (hFile=0x1c8) returned 1 [0090.907] CloseHandle (hObject=0x1c8) returned 1 [0090.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.908] lstrlenW (lpString=".doc") returned 4 [0090.908] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0090.908] lstrlenW (lpString=".docx") returned 5 [0090.908] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0090.908] lstrlenW (lpString=".pdf") returned 4 [0090.908] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0090.908] lstrlenW (lpString=".xls") returned 4 [0090.908] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0090.908] lstrlenW (lpString=".xlsx") returned 5 [0090.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0090.908] lstrlenW (lpString=".ppt") returned 4 [0090.908] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.908] lstrlenW (lpString=".zip") returned 4 [0090.908] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0090.908] lstrlenW (lpString=".rar") returned 4 [0090.908] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0090.908] lstrlenW (lpString=".bz2") returned 4 [0090.908] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0090.908] lstrlenW (lpString=".7z") returned 3 [0090.908] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.908] lstrlenW (lpString=".dbf") returned 4 [0090.908] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.908] lstrlenW (lpString=".1cd") returned 4 [0090.908] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0090.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0090.909] lstrlenW (lpString=".jpg") returned 4 [0090.909] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0090.909] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") [0090.909] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0090.910] CloseHandle (hObject=0x1c8) returned 1 [0090.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20 [0090.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.910] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.910] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.911] GetLastError () returned 0x0 [0090.911] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0090.912] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.913] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.913] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x108, lpOverlapped=0x0) returned 1 [0090.913] SetEndOfFile (hFile=0x150) returned 1 [0090.913] CloseHandle (hObject=0x150) returned 1 [0090.913] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.913] SetEndOfFile (hFile=0x1c8) returned 1 [0090.914] CloseHandle (hObject=0x1c8) returned 1 [0090.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.914] lstrlenW (lpString=".doc") returned 4 [0090.914] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.914] lstrlenW (lpString=".docx") returned 5 [0090.914] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.914] lstrlenW (lpString=".pdf") returned 4 [0090.914] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.914] lstrlenW (lpString=".xls") returned 4 [0090.915] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.915] lstrlenW (lpString=".xlsx") returned 5 [0090.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.915] lstrlenW (lpString=".ppt") returned 4 [0090.915] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.915] lstrlenW (lpString=".zip") returned 4 [0090.915] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.915] lstrlenW (lpString=".rar") returned 4 [0090.915] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.915] lstrlenW (lpString=".bz2") returned 4 [0090.915] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.915] lstrlenW (lpString=".7z") returned 3 [0090.915] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.915] lstrlenW (lpString=".dbf") returned 4 [0090.915] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.915] lstrlenW (lpString=".1cd") returned 4 [0090.915] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0090.915] lstrlenW (lpString=".jpg") returned 4 [0090.915] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.915] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") [0090.916] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0090.916] CloseHandle (hObject=0x1c8) returned 1 [0090.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20 [0090.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.916] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.916] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.917] GetLastError () returned 0x0 [0090.917] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0090.918] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0090.919] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.919] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x108, lpOverlapped=0x0) returned 1 [0090.919] SetEndOfFile (hFile=0x150) returned 1 [0090.919] CloseHandle (hObject=0x150) returned 1 [0090.919] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.919] SetEndOfFile (hFile=0x1c8) returned 1 [0090.920] CloseHandle (hObject=0x1c8) returned 1 [0090.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0090.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.920] lstrlenW (lpString=".doc") returned 4 [0090.921] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0090.921] lstrlenW (lpString=".docx") returned 5 [0090.921] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0090.921] lstrlenW (lpString=".pdf") returned 4 [0090.921] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0090.921] lstrlenW (lpString=".xls") returned 4 [0090.921] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0090.921] lstrlenW (lpString=".xlsx") returned 5 [0090.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0090.921] lstrlenW (lpString=".ppt") returned 4 [0090.921] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.921] lstrlenW (lpString=".zip") returned 4 [0090.921] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0090.921] lstrlenW (lpString=".rar") returned 4 [0090.921] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0090.921] lstrlenW (lpString=".bz2") returned 4 [0090.921] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0090.921] lstrlenW (lpString=".7z") returned 3 [0090.921] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.921] lstrlenW (lpString=".dbf") returned 4 [0090.921] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.921] lstrlenW (lpString=".1cd") returned 4 [0090.921] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0090.921] lstrlenW (lpString=".jpg") returned 4 [0090.921] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0090.921] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") [0090.922] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=621) returned 1 [0090.922] CloseHandle (hObject=0x1c8) returned 1 [0090.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20 [0090.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0090.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0090.922] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.922] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0090.923] GetLastError () returned 0x0 [0090.923] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x26d, lpOverlapped=0x0) returned 1 [0091.032] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x270, lpOverlapped=0x0) returned 1 [0091.041] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.042] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xee, lpOverlapped=0x0) returned 1 [0091.042] SetEndOfFile (hFile=0x150) returned 1 [0091.042] CloseHandle (hObject=0x150) returned 1 [0091.068] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.068] SetEndOfFile (hFile=0x1c8) returned 1 [0091.069] CloseHandle (hObject=0x1c8) returned 1 [0091.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.070] lstrlenW (lpString=".doc") returned 4 [0091.070] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0091.070] lstrlenW (lpString=".docx") returned 5 [0091.070] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0091.070] lstrlenW (lpString=".pdf") returned 4 [0091.070] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0091.070] lstrlenW (lpString=".xls") returned 4 [0091.070] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0091.070] lstrlenW (lpString=".xlsx") returned 5 [0091.070] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0091.070] lstrlenW (lpString=".ppt") returned 4 [0091.070] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.070] lstrlenW (lpString=".zip") returned 4 [0091.070] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0091.070] lstrlenW (lpString=".rar") returned 4 [0091.070] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0091.070] lstrlenW (lpString=".bz2") returned 4 [0091.070] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0091.070] lstrlenW (lpString=".7z") returned 3 [0091.070] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.070] lstrlenW (lpString=".dbf") returned 4 [0091.070] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.070] lstrlenW (lpString=".1cd") returned 4 [0091.070] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0091.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0091.071] lstrlenW (lpString=".jpg") returned 4 [0091.071] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0091.071] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") [0091.072] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=641) returned 1 [0091.072] CloseHandle (hObject=0x1c8) returned 1 [0091.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 0x20 [0091.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0091.073] GetLastError () returned 0x0 [0091.073] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x281, lpOverlapped=0x0) returned 1 [0091.075] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x290, lpOverlapped=0x0) returned 1 [0091.076] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.076] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.076] SetEndOfFile (hFile=0x150) returned 1 [0091.076] CloseHandle (hObject=0x150) returned 1 [0091.076] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.076] SetEndOfFile (hFile=0x1c8) returned 1 [0091.077] CloseHandle (hObject=0x1c8) returned 1 [0091.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString=".doc") returned 4 [0091.078] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0091.078] lstrlenW (lpString=".docx") returned 5 [0091.078] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0091.078] lstrlenW (lpString=".pdf") returned 4 [0091.078] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0091.078] lstrlenW (lpString=".xls") returned 4 [0091.078] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0091.078] lstrlenW (lpString=".xlsx") returned 5 [0091.078] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0091.078] lstrlenW (lpString=".ppt") returned 4 [0091.078] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString=".zip") returned 4 [0091.078] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0091.078] lstrlenW (lpString=".rar") returned 4 [0091.078] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0091.078] lstrlenW (lpString=".bz2") returned 4 [0091.078] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0091.078] lstrlenW (lpString=".7z") returned 3 [0091.078] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString=".dbf") returned 4 [0091.078] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString=".1cd") returned 4 [0091.078] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0091.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0091.078] lstrlenW (lpString=".jpg") returned 4 [0091.079] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0091.079] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") [0091.079] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=209) returned 1 [0091.079] CloseHandle (hObject=0x1c8) returned 1 [0091.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20 [0091.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.080] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.080] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0091.080] GetLastError () returned 0x0 [0091.080] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd1, lpOverlapped=0x0) returned 1 [0091.081] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0091.082] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.082] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.082] SetEndOfFile (hFile=0x150) returned 1 [0091.082] CloseHandle (hObject=0x150) returned 1 [0091.082] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.082] SetEndOfFile (hFile=0x1c8) returned 1 [0091.083] CloseHandle (hObject=0x1c8) returned 1 [0091.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1 [0091.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.084] lstrlenW (lpString=".doc") returned 4 [0091.084] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0091.084] lstrlenW (lpString=".docx") returned 5 [0091.084] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0091.084] lstrlenW (lpString=".pdf") returned 4 [0091.084] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0091.084] lstrlenW (lpString=".xls") returned 4 [0091.084] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0091.084] lstrlenW (lpString=".xlsx") returned 5 [0091.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0091.084] lstrlenW (lpString=".ppt") returned 4 [0091.084] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0091.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.084] lstrlenW (lpString=".zip") returned 4 [0091.084] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0091.084] lstrlenW (lpString=".rar") returned 4 [0091.084] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0091.084] lstrlenW (lpString=".bz2") returned 4 [0091.084] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0091.084] lstrlenW (lpString=".7z") returned 3 [0091.084] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0091.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.084] lstrlenW (lpString=".dbf") returned 4 [0091.084] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0091.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.085] lstrlenW (lpString=".1cd") returned 4 [0091.085] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0091.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0091.085] lstrlenW (lpString=".jpg") returned 4 [0091.085] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0091.085] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") [0091.085] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0091.085] CloseHandle (hObject=0x1c8) returned 1 [0091.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20 [0091.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.086] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.086] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0091.086] GetLastError () returned 0x0 [0091.086] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0091.087] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.088] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.088] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.088] SetEndOfFile (hFile=0x150) returned 1 [0091.088] CloseHandle (hObject=0x150) returned 1 [0091.088] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.089] SetEndOfFile (hFile=0x1c8) returned 1 [0091.089] CloseHandle (hObject=0x1c8) returned 1 [0091.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.092] lstrlenW (lpString=".doc") returned 4 [0091.092] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.092] lstrlenW (lpString=".docx") returned 5 [0091.092] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.092] lstrlenW (lpString=".pdf") returned 4 [0091.092] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.092] lstrlenW (lpString=".xls") returned 4 [0091.092] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.092] lstrlenW (lpString=".xlsx") returned 5 [0091.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.092] lstrlenW (lpString=".ppt") returned 4 [0091.092] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.092] lstrlenW (lpString=".zip") returned 4 [0091.092] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.092] lstrlenW (lpString=".rar") returned 4 [0091.092] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.093] lstrlenW (lpString=".bz2") returned 4 [0091.093] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.093] lstrlenW (lpString=".7z") returned 3 [0091.093] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.093] lstrlenW (lpString=".dbf") returned 4 [0091.093] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.093] lstrlenW (lpString=".1cd") returned 4 [0091.093] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0091.093] lstrlenW (lpString=".jpg") returned 4 [0091.093] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.093] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") [0091.094] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0091.094] CloseHandle (hObject=0x1c8) returned 1 [0091.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20 [0091.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.094] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.094] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0091.095] GetLastError () returned 0x0 [0091.095] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0091.096] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.096] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.096] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0091.097] SetEndOfFile (hFile=0x150) returned 1 [0091.097] CloseHandle (hObject=0x150) returned 1 [0091.097] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.097] SetEndOfFile (hFile=0x1c8) returned 1 [0091.098] CloseHandle (hObject=0x1c8) returned 1 [0091.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.098] lstrlenW (lpString=".doc") returned 4 [0091.098] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.098] lstrlenW (lpString=".docx") returned 5 [0091.098] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.098] lstrlenW (lpString=".pdf") returned 4 [0091.098] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.098] lstrlenW (lpString=".xls") returned 4 [0091.098] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.098] lstrlenW (lpString=".xlsx") returned 5 [0091.098] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.098] lstrlenW (lpString=".ppt") returned 4 [0091.099] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.099] lstrlenW (lpString=".zip") returned 4 [0091.099] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.099] lstrlenW (lpString=".rar") returned 4 [0091.099] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.099] lstrlenW (lpString=".bz2") returned 4 [0091.099] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.099] lstrlenW (lpString=".7z") returned 3 [0091.099] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.099] lstrlenW (lpString=".dbf") returned 4 [0091.099] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.099] lstrlenW (lpString=".1cd") returned 4 [0091.099] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0091.099] lstrlenW (lpString=".jpg") returned 4 [0091.099] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.167] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") [0091.168] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=641) returned 1 [0091.168] CloseHandle (hObject=0x190) returned 1 [0091.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 0x20 [0091.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.168] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.168] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.169] GetLastError () returned 0x0 [0091.169] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x281, lpOverlapped=0x0) returned 1 [0091.246] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x290, lpOverlapped=0x0) returned 1 [0091.247] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.248] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.248] SetEndOfFile (hFile=0x1f0) returned 1 [0091.248] CloseHandle (hObject=0x1f0) returned 1 [0091.248] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.248] SetEndOfFile (hFile=0x190) returned 1 [0091.249] CloseHandle (hObject=0x190) returned 1 [0091.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1 [0091.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.249] lstrlenW (lpString=".doc") returned 4 [0091.249] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0091.249] lstrlenW (lpString=".docx") returned 5 [0091.249] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0091.249] lstrlenW (lpString=".pdf") returned 4 [0091.249] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0091.249] lstrlenW (lpString=".xls") returned 4 [0091.249] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0091.249] lstrlenW (lpString=".xlsx") returned 5 [0091.249] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0091.250] lstrlenW (lpString=".ppt") returned 4 [0091.250] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.250] lstrlenW (lpString=".zip") returned 4 [0091.250] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0091.250] lstrlenW (lpString=".rar") returned 4 [0091.250] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0091.250] lstrlenW (lpString=".bz2") returned 4 [0091.250] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0091.250] lstrlenW (lpString=".7z") returned 3 [0091.250] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.250] lstrlenW (lpString=".dbf") returned 4 [0091.250] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.250] lstrlenW (lpString=".1cd") returned 4 [0091.250] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0091.250] lstrlenW (lpString=".jpg") returned 4 [0091.250] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0091.250] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") [0091.251] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=153) returned 1 [0091.251] CloseHandle (hObject=0x190) returned 1 [0091.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0091.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.251] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.251] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.252] GetLastError () returned 0x0 [0091.252] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x99, lpOverlapped=0x0) returned 1 [0091.253] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0091.254] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.254] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0091.254] SetEndOfFile (hFile=0x1f0) returned 1 [0091.254] CloseHandle (hObject=0x1f0) returned 1 [0091.254] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.254] SetEndOfFile (hFile=0x190) returned 1 [0091.255] CloseHandle (hObject=0x190) returned 1 [0091.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1 [0091.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.256] lstrlenW (lpString=".doc") returned 4 [0091.256] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".docx") returned 5 [0091.256] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0091.256] lstrlenW (lpString=".pdf") returned 4 [0091.256] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".xls") returned 4 [0091.256] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".xlsx") returned 5 [0091.256] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0091.256] lstrlenW (lpString=".ppt") returned 4 [0091.256] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.256] lstrlenW (lpString=".zip") returned 4 [0091.256] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".rar") returned 4 [0091.256] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".bz2") returned 4 [0091.256] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0091.256] lstrlenW (lpString=".7z") returned 3 [0091.256] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0091.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.256] lstrlenW (lpString=".dbf") returned 4 [0091.256] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0091.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.257] lstrlenW (lpString=".1cd") returned 4 [0091.257] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0091.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0091.257] lstrlenW (lpString=".jpg") returned 4 [0091.257] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0091.257] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") [0091.257] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=668544) returned 1 [0091.257] CloseHandle (hObject=0x190) returned 1 [0091.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20 [0091.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0091.258] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.258] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0091.258] GetLastError () returned 0x0 [0091.258] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa3380, lpOverlapped=0x0) returned 1 [0091.280] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa3390, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa3390, lpOverlapped=0x0) returned 1 [0091.412] ReadFile (in: hFile=0x190, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.413] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.413] SetEndOfFile (hFile=0x1f0) returned 1 [0091.413] CloseHandle (hObject=0x1f0) returned 1 [0091.413] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.413] SetEndOfFile (hFile=0x190) returned 1 [0091.418] CloseHandle (hObject=0x190) returned 1 [0091.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 1 [0091.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.492] lstrlenW (lpString=".doc") returned 4 [0091.492] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0091.492] lstrlenW (lpString=".docx") returned 5 [0091.492] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0091.492] lstrlenW (lpString=".pdf") returned 4 [0091.492] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0091.492] lstrlenW (lpString=".xls") returned 4 [0091.492] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0091.492] lstrlenW (lpString=".xlsx") returned 5 [0091.492] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0091.492] lstrlenW (lpString=".ppt") returned 4 [0091.492] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0091.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.492] lstrlenW (lpString=".zip") returned 4 [0091.492] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0091.493] lstrlenW (lpString=".rar") returned 4 [0091.493] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0091.493] lstrlenW (lpString=".bz2") returned 4 [0091.493] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0091.493] lstrlenW (lpString=".7z") returned 3 [0091.493] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0091.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.493] lstrlenW (lpString=".dbf") returned 4 [0091.493] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0091.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.493] lstrlenW (lpString=".1cd") returned 4 [0091.493] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0091.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0091.493] lstrlenW (lpString=".jpg") returned 4 [0091.493] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0091.493] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") [0091.532] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=207) returned 1 [0091.532] CloseHandle (hObject=0x15c) returned 1 [0091.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20 [0091.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.532] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.532] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.533] GetLastError () returned 0x0 [0091.533] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcf, lpOverlapped=0x0) returned 1 [0091.534] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0091.534] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.534] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0091.535] SetEndOfFile (hFile=0x158) returned 1 [0091.535] CloseHandle (hObject=0x158) returned 1 [0091.535] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.535] SetEndOfFile (hFile=0x15c) returned 1 [0091.535] CloseHandle (hObject=0x15c) returned 1 [0091.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString=".doc") returned 4 [0091.537] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0091.537] lstrlenW (lpString=".docx") returned 5 [0091.537] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0091.537] lstrlenW (lpString=".pdf") returned 4 [0091.537] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0091.537] lstrlenW (lpString=".xls") returned 4 [0091.537] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0091.537] lstrlenW (lpString=".xlsx") returned 5 [0091.537] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0091.537] lstrlenW (lpString=".ppt") returned 4 [0091.537] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString=".zip") returned 4 [0091.537] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0091.537] lstrlenW (lpString=".rar") returned 4 [0091.537] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0091.537] lstrlenW (lpString=".bz2") returned 4 [0091.537] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0091.537] lstrlenW (lpString=".7z") returned 3 [0091.537] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString=".dbf") returned 4 [0091.537] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString=".1cd") returned 4 [0091.537] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0091.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0091.537] lstrlenW (lpString=".jpg") returned 4 [0091.538] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0091.538] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") [0091.538] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0091.538] CloseHandle (hObject=0x15c) returned 1 [0091.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20 [0091.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.538] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.539] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.539] GetLastError () returned 0x0 [0091.539] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0091.540] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.541] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.541] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.541] SetEndOfFile (hFile=0x158) returned 1 [0091.542] CloseHandle (hObject=0x158) returned 1 [0091.542] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.542] SetEndOfFile (hFile=0x15c) returned 1 [0091.542] CloseHandle (hObject=0x15c) returned 1 [0091.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.543] lstrlenW (lpString=".doc") returned 4 [0091.543] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.543] lstrlenW (lpString=".docx") returned 5 [0091.543] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.543] lstrlenW (lpString=".pdf") returned 4 [0091.543] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.543] lstrlenW (lpString=".xls") returned 4 [0091.543] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.543] lstrlenW (lpString=".xlsx") returned 5 [0091.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.543] lstrlenW (lpString=".ppt") returned 4 [0091.543] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.543] lstrlenW (lpString=".zip") returned 4 [0091.543] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.543] lstrlenW (lpString=".rar") returned 4 [0091.543] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.543] lstrlenW (lpString=".bz2") returned 4 [0091.543] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.543] lstrlenW (lpString=".7z") returned 3 [0091.543] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.543] lstrlenW (lpString=".dbf") returned 4 [0091.543] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.544] lstrlenW (lpString=".1cd") returned 4 [0091.544] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0091.544] lstrlenW (lpString=".jpg") returned 4 [0091.544] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.544] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") [0091.544] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0091.544] CloseHandle (hObject=0x15c) returned 1 [0091.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20 [0091.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.545] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.545] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.545] GetLastError () returned 0x0 [0091.545] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0091.546] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0091.547] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.547] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0091.547] SetEndOfFile (hFile=0x158) returned 1 [0091.547] CloseHandle (hObject=0x158) returned 1 [0091.547] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.547] SetEndOfFile (hFile=0x15c) returned 1 [0091.548] CloseHandle (hObject=0x15c) returned 1 [0091.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString=".doc") returned 4 [0091.549] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0091.549] lstrlenW (lpString=".docx") returned 5 [0091.549] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0091.549] lstrlenW (lpString=".pdf") returned 4 [0091.549] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0091.549] lstrlenW (lpString=".xls") returned 4 [0091.549] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0091.549] lstrlenW (lpString=".xlsx") returned 5 [0091.549] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0091.549] lstrlenW (lpString=".ppt") returned 4 [0091.549] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString=".zip") returned 4 [0091.549] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0091.549] lstrlenW (lpString=".rar") returned 4 [0091.549] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0091.549] lstrlenW (lpString=".bz2") returned 4 [0091.549] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0091.549] lstrlenW (lpString=".7z") returned 3 [0091.549] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString=".dbf") returned 4 [0091.549] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString=".1cd") returned 4 [0091.549] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0091.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0091.549] lstrlenW (lpString=".jpg") returned 4 [0091.550] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0091.550] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") [0091.551] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1544) returned 1 [0091.551] CloseHandle (hObject=0x15c) returned 1 [0091.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20 [0091.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.551] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.551] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0091.552] GetLastError () returned 0x0 [0091.552] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x608, lpOverlapped=0x0) returned 1 [0091.553] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x610, lpOverlapped=0x0) returned 1 [0091.554] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.554] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0091.555] SetEndOfFile (hFile=0x158) returned 1 [0091.555] CloseHandle (hObject=0x158) returned 1 [0091.555] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.555] SetEndOfFile (hFile=0x15c) returned 1 [0091.555] CloseHandle (hObject=0x15c) returned 1 [0091.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.556] lstrlenW (lpString=".doc") returned 4 [0091.556] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0091.556] lstrlenW (lpString=".docx") returned 5 [0091.556] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0091.556] lstrlenW (lpString=".pdf") returned 4 [0091.556] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0091.556] lstrlenW (lpString=".xls") returned 4 [0091.556] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0091.556] lstrlenW (lpString=".xlsx") returned 5 [0091.556] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0091.556] lstrlenW (lpString=".ppt") returned 4 [0091.556] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.556] lstrlenW (lpString=".zip") returned 4 [0091.556] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0091.556] lstrlenW (lpString=".rar") returned 4 [0091.556] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0091.556] lstrlenW (lpString=".bz2") returned 4 [0091.556] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0091.556] lstrlenW (lpString=".7z") returned 3 [0091.557] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0091.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.557] lstrlenW (lpString=".dbf") returned 4 [0091.557] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0091.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.557] lstrlenW (lpString=".1cd") returned 4 [0091.557] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0091.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0091.557] lstrlenW (lpString=".jpg") returned 4 [0091.557] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0091.557] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") [0091.558] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7438482) returned 1 [0091.558] CloseHandle (hObject=0x15c) returned 1 [0091.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20 [0091.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0091.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0091.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0091.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0091.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.559] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x25d586, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.563] ReadFile (in: hFile=0x15c, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.569] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.569] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x6d8092, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.569] ReadFile (in: hFile=0x15c, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.981] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.981] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0091.994] SetEndOfFile (hFile=0x15c) returned 1 [0091.994] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0091.994] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.994] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.996] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x25d586, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.996] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.998] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x6d8092, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.998] WriteFile (in: hFile=0x15c, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0091.999] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0091.999] CloseHandle (hObject=0x15c) returned 1 [0091.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0091.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0091.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0091.999] lstrlenW (lpString=".doc") returned 4 [0091.999] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0092.000] lstrlenW (lpString=".docx") returned 5 [0092.000] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0092.000] lstrlenW (lpString=".pdf") returned 4 [0092.000] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0092.000] lstrlenW (lpString=".xls") returned 4 [0092.000] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0092.000] lstrlenW (lpString=".xlsx") returned 5 [0092.000] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0092.000] lstrlenW (lpString=".ppt") returned 4 [0092.000] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0092.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0092.000] lstrlenW (lpString=".zip") returned 4 [0092.000] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0092.000] lstrlenW (lpString=".rar") returned 4 [0092.000] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0092.000] lstrlenW (lpString=".bz2") returned 4 [0092.000] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0092.000] lstrlenW (lpString=".7z") returned 3 [0092.000] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0092.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0092.000] lstrlenW (lpString=".dbf") returned 4 [0092.000] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0092.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0092.000] lstrlenW (lpString=".1cd") returned 4 [0092.000] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0092.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0092.000] lstrlenW (lpString=".jpg") returned 4 [0092.000] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0092.000] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") [0092.076] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=207) returned 1 [0092.076] CloseHandle (hObject=0x210) returned 1 [0092.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20 [0092.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.076] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.076] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.077] GetLastError () returned 0x0 [0092.077] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcf, lpOverlapped=0x0) returned 1 [0092.078] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0092.078] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.079] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0092.079] SetEndOfFile (hFile=0x150) returned 1 [0092.079] CloseHandle (hObject=0x150) returned 1 [0092.079] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.079] SetEndOfFile (hFile=0x210) returned 1 [0092.080] CloseHandle (hObject=0x210) returned 1 [0092.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1 [0092.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.080] lstrlenW (lpString=".doc") returned 4 [0092.080] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0092.080] lstrlenW (lpString=".docx") returned 5 [0092.080] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0092.080] lstrlenW (lpString=".pdf") returned 4 [0092.080] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0092.080] lstrlenW (lpString=".xls") returned 4 [0092.080] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0092.080] lstrlenW (lpString=".xlsx") returned 5 [0092.080] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0092.080] lstrlenW (lpString=".ppt") returned 4 [0092.080] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0092.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.080] lstrlenW (lpString=".zip") returned 4 [0092.080] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0092.080] lstrlenW (lpString=".rar") returned 4 [0092.080] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0092.080] lstrlenW (lpString=".bz2") returned 4 [0092.081] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0092.081] lstrlenW (lpString=".7z") returned 3 [0092.081] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0092.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.081] lstrlenW (lpString=".dbf") returned 4 [0092.081] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0092.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.081] lstrlenW (lpString=".1cd") returned 4 [0092.081] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0092.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0092.081] lstrlenW (lpString=".jpg") returned 4 [0092.081] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0092.081] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") [0092.081] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=114) returned 1 [0092.082] CloseHandle (hObject=0x210) returned 1 [0092.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20 [0092.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.082] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.082] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.083] GetLastError () returned 0x0 [0092.083] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x72, lpOverlapped=0x0) returned 1 [0092.084] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0092.084] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.084] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0092.084] SetEndOfFile (hFile=0x150) returned 1 [0092.085] CloseHandle (hObject=0x150) returned 1 [0092.085] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.085] SetEndOfFile (hFile=0x210) returned 1 [0092.085] CloseHandle (hObject=0x210) returned 1 [0092.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1 [0092.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.086] lstrlenW (lpString=".doc") returned 4 [0092.086] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0092.086] lstrlenW (lpString=".docx") returned 5 [0092.086] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0092.086] lstrlenW (lpString=".pdf") returned 4 [0092.086] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0092.086] lstrlenW (lpString=".xls") returned 4 [0092.086] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0092.086] lstrlenW (lpString=".xlsx") returned 5 [0092.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0092.086] lstrlenW (lpString=".ppt") returned 4 [0092.086] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0092.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.086] lstrlenW (lpString=".zip") returned 4 [0092.086] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0092.086] lstrlenW (lpString=".rar") returned 4 [0092.086] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0092.086] lstrlenW (lpString=".bz2") returned 4 [0092.086] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0092.086] lstrlenW (lpString=".7z") returned 3 [0092.086] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0092.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.087] lstrlenW (lpString=".dbf") returned 4 [0092.087] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0092.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.087] lstrlenW (lpString=".1cd") returned 4 [0092.087] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0092.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0092.087] lstrlenW (lpString=".jpg") returned 4 [0092.087] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0092.087] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") [0092.087] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=113) returned 1 [0092.087] CloseHandle (hObject=0x210) returned 1 [0092.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20 [0092.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.088] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.088] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.088] GetLastError () returned 0x0 [0092.088] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x71, lpOverlapped=0x0) returned 1 [0092.089] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x80, lpOverlapped=0x0) returned 1 [0092.092] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.092] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0092.092] SetEndOfFile (hFile=0x150) returned 1 [0092.093] CloseHandle (hObject=0x150) returned 1 [0092.093] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.093] SetEndOfFile (hFile=0x210) returned 1 [0092.093] CloseHandle (hObject=0x210) returned 1 [0092.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1 [0092.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.094] lstrlenW (lpString=".doc") returned 4 [0092.094] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0092.094] lstrlenW (lpString=".docx") returned 5 [0092.094] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0092.094] lstrlenW (lpString=".pdf") returned 4 [0092.094] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0092.094] lstrlenW (lpString=".xls") returned 4 [0092.094] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0092.094] lstrlenW (lpString=".xlsx") returned 5 [0092.094] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0092.094] lstrlenW (lpString=".ppt") returned 4 [0092.094] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0092.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.094] lstrlenW (lpString=".zip") returned 4 [0092.094] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0092.094] lstrlenW (lpString=".rar") returned 4 [0092.094] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0092.094] lstrlenW (lpString=".bz2") returned 4 [0092.094] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0092.094] lstrlenW (lpString=".7z") returned 3 [0092.094] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0092.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.094] lstrlenW (lpString=".dbf") returned 4 [0092.095] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0092.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.095] lstrlenW (lpString=".1cd") returned 4 [0092.095] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0092.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0092.095] lstrlenW (lpString=".jpg") returned 4 [0092.095] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0092.095] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") [0092.095] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=42336) returned 1 [0092.095] CloseHandle (hObject=0x210) returned 1 [0092.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20 [0092.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.096] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.096] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.096] GetLastError () returned 0x0 [0092.096] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa560, lpOverlapped=0x0) returned 1 [0092.101] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa570, lpOverlapped=0x0) returned 1 [0092.102] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.102] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.102] SetEndOfFile (hFile=0x150) returned 1 [0092.102] CloseHandle (hObject=0x150) returned 1 [0092.102] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.103] SetEndOfFile (hFile=0x210) returned 1 [0092.103] CloseHandle (hObject=0x210) returned 1 [0092.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1 [0092.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.104] lstrlenW (lpString=".doc") returned 4 [0092.104] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0092.104] lstrlenW (lpString=".docx") returned 5 [0092.104] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0092.104] lstrlenW (lpString=".pdf") returned 4 [0092.104] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0092.104] lstrlenW (lpString=".xls") returned 4 [0092.104] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0092.104] lstrlenW (lpString=".xlsx") returned 5 [0092.104] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0092.104] lstrlenW (lpString=".ppt") returned 4 [0092.104] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0092.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.104] lstrlenW (lpString=".zip") returned 4 [0092.104] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0092.104] lstrlenW (lpString=".rar") returned 4 [0092.104] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0092.104] lstrlenW (lpString=".bz2") returned 4 [0092.104] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0092.104] lstrlenW (lpString=".7z") returned 3 [0092.105] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0092.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.105] lstrlenW (lpString=".dbf") returned 4 [0092.105] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0092.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.105] lstrlenW (lpString=".1cd") returned 4 [0092.105] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0092.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0092.105] lstrlenW (lpString=".jpg") returned 4 [0092.105] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0092.105] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") [0092.106] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=901464) returned 1 [0092.106] CloseHandle (hObject=0x210) returned 1 [0092.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20 [0092.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.106] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.106] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0092.107] GetLastError () returned 0x0 [0092.107] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xdc158, lpOverlapped=0x0) returned 1 [0092.338] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xdc160, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xdc160, lpOverlapped=0x0) returned 1 [0092.352] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.352] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0092.352] SetEndOfFile (hFile=0x150) returned 1 [0092.352] CloseHandle (hObject=0x150) returned 1 [0092.352] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.352] SetEndOfFile (hFile=0x210) returned 1 [0092.360] CloseHandle (hObject=0x210) returned 1 [0092.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 1 [0092.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.360] lstrlenW (lpString=".doc") returned 4 [0092.360] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.360] lstrlenW (lpString=".docx") returned 5 [0092.360] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0092.360] lstrlenW (lpString=".pdf") returned 4 [0092.360] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.361] lstrlenW (lpString=".xls") returned 4 [0092.361] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.361] lstrlenW (lpString=".xlsx") returned 5 [0092.361] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0092.361] lstrlenW (lpString=".ppt") returned 4 [0092.361] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.361] lstrlenW (lpString=".zip") returned 4 [0092.361] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.361] lstrlenW (lpString=".rar") returned 4 [0092.361] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.361] lstrlenW (lpString=".bz2") returned 4 [0092.361] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.361] lstrlenW (lpString=".7z") returned 3 [0092.361] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.361] lstrlenW (lpString=".dbf") returned 4 [0092.361] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.361] lstrlenW (lpString=".1cd") returned 4 [0092.361] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0092.361] lstrlenW (lpString=".jpg") returned 4 [0092.361] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.361] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") [0092.667] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=177536) returned 1 [0092.667] CloseHandle (hObject=0x1c0) returned 1 [0092.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 0x20 [0092.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.668] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.691] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.692] GetLastError () returned 0x0 [0092.692] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2b580, lpOverlapped=0x0) returned 1 [0092.745] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2b590, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2b590, lpOverlapped=0x0) returned 1 [0092.748] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.748] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.748] SetEndOfFile (hFile=0x1fc) returned 1 [0092.748] CloseHandle (hObject=0x1fc) returned 1 [0092.748] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.748] SetEndOfFile (hFile=0x1c0) returned 1 [0092.750] CloseHandle (hObject=0x1c0) returned 1 [0092.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 1 [0092.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.750] lstrlenW (lpString=".doc") returned 4 [0092.750] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.750] lstrlenW (lpString=".docx") returned 5 [0092.750] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0092.750] lstrlenW (lpString=".pdf") returned 4 [0092.750] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.750] lstrlenW (lpString=".xls") returned 4 [0092.750] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.750] lstrlenW (lpString=".xlsx") returned 5 [0092.751] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0092.751] lstrlenW (lpString=".ppt") returned 4 [0092.751] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.751] lstrlenW (lpString=".zip") returned 4 [0092.751] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.751] lstrlenW (lpString=".rar") returned 4 [0092.751] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.751] lstrlenW (lpString=".bz2") returned 4 [0092.751] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.751] lstrlenW (lpString=".7z") returned 3 [0092.751] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.751] lstrlenW (lpString=".dbf") returned 4 [0092.751] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.751] lstrlenW (lpString=".1cd") returned 4 [0092.751] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0092.751] lstrlenW (lpString=".jpg") returned 4 [0092.751] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.751] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") [0092.752] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4532616) returned 1 [0092.752] CloseHandle (hObject=0x1c0) returned 1 [0092.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0x20 [0092.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0092.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0092.753] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0092.753] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.753] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.784] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x170dd8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.784] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.789] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0092.789] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x412988, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.790] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.812] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.812] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0092.870] SetEndOfFile (hFile=0x1c0) returned 1 [0092.874] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0092.874] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.874] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.876] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x170dd8, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.876] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.878] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x412988, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.878] WriteFile (in: hFile=0x1c0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.885] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0092.885] CloseHandle (hObject=0x1c0) returned 1 [0092.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0092.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.885] lstrlenW (lpString=".doc") returned 4 [0092.885] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString=".docx") returned 5 [0092.885] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0092.885] lstrlenW (lpString=".pdf") returned 4 [0092.885] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString=".xls") returned 4 [0092.885] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString=".xlsx") returned 5 [0092.885] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0092.885] lstrlenW (lpString=".ppt") returned 4 [0092.885] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.885] lstrlenW (lpString=".zip") returned 4 [0092.885] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString=".rar") returned 4 [0092.885] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0092.885] lstrlenW (lpString=".bz2") returned 4 [0092.885] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0092.885] lstrlenW (lpString=".7z") returned 3 [0092.886] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0092.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.886] lstrlenW (lpString=".dbf") returned 4 [0092.886] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0092.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.886] lstrlenW (lpString=".1cd") returned 4 [0092.886] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0092.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0092.886] lstrlenW (lpString=".jpg") returned 4 [0092.886] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0092.886] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") [0092.946] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=744888) returned 1 [0092.946] CloseHandle (hObject=0x1c8) returned 1 [0092.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll")) returned 0x20 [0092.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0092.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0092.946] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.946] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0092.959] GetLastError () returned 0x0 [0092.959] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0092.975] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0093.287] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.287] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0093.287] SetEndOfFile (hFile=0x210) returned 1 [0093.287] CloseHandle (hObject=0x210) returned 1 [0093.287] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.287] SetEndOfFile (hFile=0x1c8) returned 1 [0093.293] CloseHandle (hObject=0x1c8) returned 1 [0093.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll")) returned 1 [0093.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.294] lstrlenW (lpString=".doc") returned 4 [0093.294] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString=".docx") returned 5 [0093.294] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0093.294] lstrlenW (lpString=".pdf") returned 4 [0093.294] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString=".xls") returned 4 [0093.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString=".xlsx") returned 5 [0093.294] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0093.294] lstrlenW (lpString=".ppt") returned 4 [0093.294] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.294] lstrlenW (lpString=".zip") returned 4 [0093.294] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString=".rar") returned 4 [0093.294] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0093.294] lstrlenW (lpString=".bz2") returned 4 [0093.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0093.294] lstrlenW (lpString=".7z") returned 3 [0093.294] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0093.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.295] lstrlenW (lpString=".dbf") returned 4 [0093.295] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0093.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.295] lstrlenW (lpString=".1cd") returned 4 [0093.295] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0093.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0093.295] lstrlenW (lpString=".jpg") returned 4 [0093.295] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0093.295] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") [0093.776] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7168) returned 1 [0093.776] CloseHandle (hObject=0x158) returned 1 [0093.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20 [0093.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.776] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.776] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.777] GetLastError () returned 0x0 [0093.777] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1c00, lpOverlapped=0x0) returned 1 [0093.779] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0093.780] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.780] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0093.780] SetEndOfFile (hFile=0x1fc) returned 1 [0093.780] CloseHandle (hObject=0x1fc) returned 1 [0093.780] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.780] SetEndOfFile (hFile=0x158) returned 1 [0093.781] CloseHandle (hObject=0x158) returned 1 [0093.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 1 [0093.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.781] lstrlenW (lpString=".doc") returned 4 [0093.781] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0093.781] lstrlenW (lpString=".docx") returned 5 [0093.781] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0093.781] lstrlenW (lpString=".pdf") returned 4 [0093.781] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0093.781] lstrlenW (lpString=".xls") returned 4 [0093.781] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0093.781] lstrlenW (lpString=".xlsx") returned 5 [0093.782] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0093.782] lstrlenW (lpString=".ppt") returned 4 [0093.782] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.782] lstrlenW (lpString=".zip") returned 4 [0093.782] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0093.782] lstrlenW (lpString=".rar") returned 4 [0093.782] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0093.782] lstrlenW (lpString=".bz2") returned 4 [0093.782] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0093.782] lstrlenW (lpString=".7z") returned 3 [0093.782] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.782] lstrlenW (lpString=".dbf") returned 4 [0093.782] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.782] lstrlenW (lpString=".1cd") returned 4 [0093.782] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0093.782] lstrlenW (lpString=".jpg") returned 4 [0093.782] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0093.782] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") [0093.783] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1926) returned 1 [0093.783] CloseHandle (hObject=0x158) returned 1 [0093.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0093.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.784] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.784] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.784] GetLastError () returned 0x0 [0093.784] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x786, lpOverlapped=0x0) returned 1 [0093.786] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x790, lpOverlapped=0x0) returned 1 [0093.786] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.786] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0093.787] SetEndOfFile (hFile=0x1fc) returned 1 [0093.787] CloseHandle (hObject=0x1fc) returned 1 [0093.787] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.787] SetEndOfFile (hFile=0x158) returned 1 [0093.787] CloseHandle (hObject=0x158) returned 1 [0093.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1 [0093.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.788] lstrlenW (lpString=".doc") returned 4 [0093.788] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0093.788] lstrlenW (lpString=".docx") returned 5 [0093.788] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0093.788] lstrlenW (lpString=".pdf") returned 4 [0093.788] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0093.788] lstrlenW (lpString=".xls") returned 4 [0093.788] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0093.788] lstrlenW (lpString=".xlsx") returned 5 [0093.788] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0093.788] lstrlenW (lpString=".ppt") returned 4 [0093.788] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0093.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.788] lstrlenW (lpString=".zip") returned 4 [0093.788] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0093.788] lstrlenW (lpString=".rar") returned 4 [0093.788] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0093.788] lstrlenW (lpString=".bz2") returned 4 [0093.788] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0093.788] lstrlenW (lpString=".7z") returned 3 [0093.788] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.789] lstrlenW (lpString=".dbf") returned 4 [0093.789] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.789] lstrlenW (lpString=".1cd") returned 4 [0093.789] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0093.789] lstrlenW (lpString=".jpg") returned 4 [0093.789] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0093.789] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") [0093.789] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=850) returned 1 [0093.789] CloseHandle (hObject=0x158) returned 1 [0093.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0093.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.790] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.790] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.790] GetLastError () returned 0x0 [0093.790] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x352, lpOverlapped=0x0) returned 1 [0093.792] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x360, lpOverlapped=0x0) returned 1 [0093.793] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.793] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0093.793] SetEndOfFile (hFile=0x1fc) returned 1 [0093.793] CloseHandle (hObject=0x1fc) returned 1 [0093.793] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.794] SetEndOfFile (hFile=0x158) returned 1 [0093.794] CloseHandle (hObject=0x158) returned 1 [0093.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString=".doc") returned 4 [0093.795] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0093.795] lstrlenW (lpString=".docx") returned 5 [0093.795] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0093.795] lstrlenW (lpString=".pdf") returned 4 [0093.795] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0093.795] lstrlenW (lpString=".xls") returned 4 [0093.795] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0093.795] lstrlenW (lpString=".xlsx") returned 5 [0093.795] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0093.795] lstrlenW (lpString=".ppt") returned 4 [0093.795] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString=".zip") returned 4 [0093.795] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0093.795] lstrlenW (lpString=".rar") returned 4 [0093.795] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0093.795] lstrlenW (lpString=".bz2") returned 4 [0093.795] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0093.795] lstrlenW (lpString=".7z") returned 3 [0093.795] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString=".dbf") returned 4 [0093.795] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString=".1cd") returned 4 [0093.795] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0093.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0093.795] lstrlenW (lpString=".jpg") returned 4 [0093.796] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0093.796] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") [0093.797] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=80760) returned 1 [0093.797] CloseHandle (hObject=0x158) returned 1 [0093.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 0x20 [0093.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.797] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.797] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.797] GetLastError () returned 0x0 [0093.798] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x13b78, lpOverlapped=0x0) returned 1 [0093.800] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x13b80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x13b80, lpOverlapped=0x0) returned 1 [0093.802] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.802] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0093.802] SetEndOfFile (hFile=0x1fc) returned 1 [0093.802] CloseHandle (hObject=0x1fc) returned 1 [0093.802] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.802] SetEndOfFile (hFile=0x158) returned 1 [0093.804] CloseHandle (hObject=0x158) returned 1 [0093.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 1 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.804] lstrlenW (lpString=".doc") returned 4 [0093.804] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0093.804] lstrlenW (lpString=".docx") returned 5 [0093.804] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0093.804] lstrlenW (lpString=".pdf") returned 4 [0093.804] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0093.804] lstrlenW (lpString=".xls") returned 4 [0093.804] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0093.804] lstrlenW (lpString=".xlsx") returned 5 [0093.804] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0093.804] lstrlenW (lpString=".ppt") returned 4 [0093.804] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.804] lstrlenW (lpString=".zip") returned 4 [0093.804] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0093.804] lstrlenW (lpString=".rar") returned 4 [0093.804] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0093.805] lstrlenW (lpString=".bz2") returned 4 [0093.805] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0093.805] lstrlenW (lpString=".7z") returned 3 [0093.805] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.805] lstrlenW (lpString=".dbf") returned 4 [0093.805] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.805] lstrlenW (lpString=".1cd") returned 4 [0093.805] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0093.805] lstrlenW (lpString=".jpg") returned 4 [0093.805] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0093.805] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") [0093.805] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=626) returned 1 [0093.805] CloseHandle (hObject=0x158) returned 1 [0093.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0093.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0093.806] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.806] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0093.806] GetLastError () returned 0x0 [0093.806] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x272, lpOverlapped=0x0) returned 1 [0093.807] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x280, lpOverlapped=0x0) returned 1 [0093.808] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.808] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.808] SetEndOfFile (hFile=0x1fc) returned 1 [0093.808] CloseHandle (hObject=0x1fc) returned 1 [0093.808] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.808] SetEndOfFile (hFile=0x158) returned 1 [0093.809] CloseHandle (hObject=0x158) returned 1 [0093.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString=".doc") returned 4 [0093.810] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0093.810] lstrlenW (lpString=".docx") returned 5 [0093.810] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0093.810] lstrlenW (lpString=".pdf") returned 4 [0093.810] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0093.810] lstrlenW (lpString=".xls") returned 4 [0093.810] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0093.810] lstrlenW (lpString=".xlsx") returned 5 [0093.810] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0093.810] lstrlenW (lpString=".ppt") returned 4 [0093.810] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString=".zip") returned 4 [0093.810] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0093.810] lstrlenW (lpString=".rar") returned 4 [0093.810] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0093.810] lstrlenW (lpString=".bz2") returned 4 [0093.810] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0093.810] lstrlenW (lpString=".7z") returned 3 [0093.810] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString=".dbf") returned 4 [0093.810] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString=".1cd") returned 4 [0093.810] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0093.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0093.810] lstrlenW (lpString=".jpg") returned 4 [0093.810] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0093.811] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") [0093.816] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1549152) returned 1 [0093.816] CloseHandle (hObject=0x1c0) returned 1 [0093.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20 [0093.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0093.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0093.824] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.825] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0093.861] GetLastError () returned 0x0 [0093.861] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0093.886] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0093.906] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7a370, lpOverlapped=0x0) returned 1 [0093.928] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7a380, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7a380, lpOverlapped=0x0) returned 1 [0093.940] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.940] WriteFile (in: hFile=0x150, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0093.940] SetEndOfFile (hFile=0x150) returned 1 [0093.940] CloseHandle (hObject=0x150) returned 1 [0093.940] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.940] SetEndOfFile (hFile=0x1c0) returned 1 [0093.945] CloseHandle (hObject=0x1c0) returned 1 [0093.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0093.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.945] lstrlenW (lpString=".doc") returned 4 [0093.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.945] lstrlenW (lpString=".docx") returned 5 [0093.945] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0093.945] lstrlenW (lpString=".pdf") returned 4 [0093.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.945] lstrlenW (lpString=".xls") returned 4 [0093.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.945] lstrlenW (lpString=".xlsx") returned 5 [0093.945] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0093.945] lstrlenW (lpString=".ppt") returned 4 [0093.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.945] lstrlenW (lpString=".zip") returned 4 [0093.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.946] lstrlenW (lpString=".rar") returned 4 [0093.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.946] lstrlenW (lpString=".bz2") returned 4 [0093.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.946] lstrlenW (lpString=".7z") returned 3 [0093.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.946] lstrlenW (lpString=".dbf") returned 4 [0093.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.946] lstrlenW (lpString=".1cd") returned 4 [0093.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0093.946] lstrlenW (lpString=".jpg") returned 4 [0093.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.946] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") [0094.263] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=796552) returned 1 [0094.263] CloseHandle (hObject=0x16c) returned 1 [0094.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 0x20 [0094.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.264] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.267] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.299] GetLastError () returned 0x0 [0094.299] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xc2788, lpOverlapped=0x0) returned 1 [0094.316] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc2790, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xc2790, lpOverlapped=0x0) returned 1 [0094.333] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.333] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.333] SetEndOfFile (hFile=0x1fc) returned 1 [0094.333] CloseHandle (hObject=0x1fc) returned 1 [0094.333] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.333] SetEndOfFile (hFile=0x16c) returned 1 [0094.340] CloseHandle (hObject=0x16c) returned 1 [0094.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 1 [0094.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.341] lstrlenW (lpString=".doc") returned 4 [0094.341] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString=".docx") returned 5 [0094.341] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0094.341] lstrlenW (lpString=".pdf") returned 4 [0094.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString=".xls") returned 4 [0094.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString=".xlsx") returned 5 [0094.341] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0094.341] lstrlenW (lpString=".ppt") returned 4 [0094.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.341] lstrlenW (lpString=".zip") returned 4 [0094.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString=".rar") returned 4 [0094.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.341] lstrlenW (lpString=".bz2") returned 4 [0094.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.342] lstrlenW (lpString=".7z") returned 3 [0094.342] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.342] lstrlenW (lpString=".dbf") returned 4 [0094.342] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.342] lstrlenW (lpString=".1cd") returned 4 [0094.342] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0094.342] lstrlenW (lpString=".jpg") returned 4 [0094.342] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.342] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") [0094.343] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=69000) returned 1 [0094.343] CloseHandle (hObject=0x16c) returned 1 [0094.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 0x20 [0094.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.343] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.343] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.472] GetLastError () returned 0x0 [0094.472] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x10d88, lpOverlapped=0x0) returned 1 [0094.553] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10d90, lpOverlapped=0x0) returned 1 [0094.555] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.555] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.555] SetEndOfFile (hFile=0x1fc) returned 1 [0094.555] CloseHandle (hObject=0x1fc) returned 1 [0094.555] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.555] SetEndOfFile (hFile=0x16c) returned 1 [0094.556] CloseHandle (hObject=0x16c) returned 1 [0094.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 1 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString=".doc") returned 4 [0094.557] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString=".docx") returned 5 [0094.557] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0094.557] lstrlenW (lpString=".pdf") returned 4 [0094.557] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString=".xls") returned 4 [0094.557] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString=".xlsx") returned 5 [0094.557] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0094.557] lstrlenW (lpString=".ppt") returned 4 [0094.557] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString=".zip") returned 4 [0094.557] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString=".rar") returned 4 [0094.557] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0094.557] lstrlenW (lpString=".bz2") returned 4 [0094.557] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0094.557] lstrlenW (lpString=".7z") returned 3 [0094.557] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString=".dbf") returned 4 [0094.557] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString=".1cd") returned 4 [0094.557] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0094.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0094.557] lstrlenW (lpString=".jpg") returned 4 [0094.557] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0094.558] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") [0094.558] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=167808) returned 1 [0094.558] CloseHandle (hObject=0x16c) returned 1 [0094.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll")) returned 0x20 [0094.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.558] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.559] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.559] GetLastError () returned 0x0 [0094.559] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x28f80, lpOverlapped=0x0) returned 1 [0094.618] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x28f90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x28f90, lpOverlapped=0x0) returned 1 [0094.622] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.622] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.622] SetEndOfFile (hFile=0x1fc) returned 1 [0094.622] CloseHandle (hObject=0x1fc) returned 1 [0094.622] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.622] SetEndOfFile (hFile=0x16c) returned 1 [0094.624] CloseHandle (hObject=0x16c) returned 1 [0094.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll")) returned 1 [0094.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.624] lstrlenW (lpString=".doc") returned 4 [0094.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0094.624] lstrlenW (lpString=".docx") returned 5 [0094.624] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0094.624] lstrlenW (lpString=".pdf") returned 4 [0094.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0094.624] lstrlenW (lpString=".xls") returned 4 [0094.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0094.624] lstrlenW (lpString=".xlsx") returned 5 [0094.624] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0094.624] lstrlenW (lpString=".ppt") returned 4 [0094.625] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0094.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.625] lstrlenW (lpString=".zip") returned 4 [0094.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0094.625] lstrlenW (lpString=".rar") returned 4 [0094.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0094.625] lstrlenW (lpString=".bz2") returned 4 [0094.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0094.625] lstrlenW (lpString=".7z") returned 3 [0094.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0094.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.625] lstrlenW (lpString=".dbf") returned 4 [0094.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0094.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.625] lstrlenW (lpString=".1cd") returned 4 [0094.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0094.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0094.625] lstrlenW (lpString=".jpg") returned 4 [0094.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0094.625] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") [0094.627] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=32246) returned 1 [0094.627] CloseHandle (hObject=0x16c) returned 1 [0094.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 0x20 [0094.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.627] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.627] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.628] GetLastError () returned 0x0 [0094.628] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7df6, lpOverlapped=0x0) returned 1 [0094.645] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0094.646] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.646] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0094.646] SetEndOfFile (hFile=0x1fc) returned 1 [0094.646] CloseHandle (hObject=0x1fc) returned 1 [0094.646] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.646] SetEndOfFile (hFile=0x16c) returned 1 [0094.647] CloseHandle (hObject=0x16c) returned 1 [0094.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1 [0094.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.648] lstrlenW (lpString=".doc") returned 4 [0094.648] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".docx") returned 5 [0094.648] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0094.648] lstrlenW (lpString=".pdf") returned 4 [0094.648] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".xls") returned 4 [0094.648] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".xlsx") returned 5 [0094.648] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0094.648] lstrlenW (lpString=".ppt") returned 4 [0094.648] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.648] lstrlenW (lpString=".zip") returned 4 [0094.648] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".rar") returned 4 [0094.648] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".bz2") returned 4 [0094.648] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString=".7z") returned 3 [0094.648] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.648] lstrlenW (lpString=".dbf") returned 4 [0094.648] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.648] lstrlenW (lpString=".1cd") returned 4 [0094.649] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0094.649] lstrlenW (lpString=".jpg") returned 4 [0094.649] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.649] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") [0094.657] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=30920) returned 1 [0094.657] CloseHandle (hObject=0x1c8) returned 1 [0094.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0094.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.657] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.657] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.658] GetLastError () returned 0x0 [0094.658] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x78c8, lpOverlapped=0x0) returned 1 [0094.664] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x78d0, lpOverlapped=0x0) returned 1 [0094.666] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.666] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.666] SetEndOfFile (hFile=0x16c) returned 1 [0094.666] CloseHandle (hObject=0x16c) returned 1 [0094.666] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.666] SetEndOfFile (hFile=0x1c8) returned 1 [0094.667] CloseHandle (hObject=0x1c8) returned 1 [0094.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0094.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1 [0094.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.667] lstrlenW (lpString=".doc") returned 4 [0094.667] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0094.667] lstrlenW (lpString=".docx") returned 5 [0094.667] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0094.667] lstrlenW (lpString=".pdf") returned 4 [0094.667] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0094.667] lstrlenW (lpString=".xls") returned 4 [0094.668] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString=".xlsx") returned 5 [0094.668] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0094.668] lstrlenW (lpString=".ppt") returned 4 [0094.668] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.668] lstrlenW (lpString=".zip") returned 4 [0094.668] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString=".rar") returned 4 [0094.668] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString=".bz2") returned 4 [0094.668] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString=".7z") returned 3 [0094.668] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.668] lstrlenW (lpString=".dbf") returned 4 [0094.668] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.668] lstrlenW (lpString=".1cd") returned 4 [0094.668] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0094.668] lstrlenW (lpString=".jpg") returned 4 [0094.668] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0094.668] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") [0094.669] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=28368) returned 1 [0094.669] CloseHandle (hObject=0x1c8) returned 1 [0094.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0094.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0094.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.669] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.669] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0094.670] GetLastError () returned 0x0 [0094.670] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0094.873] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6ee0, lpOverlapped=0x0) returned 1 [0094.881] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.881] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.881] SetEndOfFile (hFile=0x16c) returned 1 [0095.118] CloseHandle (hObject=0x16c) returned 1 [0095.119] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.119] SetEndOfFile (hFile=0x1c8) returned 1 [0095.119] CloseHandle (hObject=0x1c8) returned 1 [0095.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1 [0095.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.125] lstrlenW (lpString=".doc") returned 4 [0095.125] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.125] lstrlenW (lpString=".docx") returned 5 [0095.125] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0095.126] lstrlenW (lpString=".pdf") returned 4 [0095.126] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString=".xls") returned 4 [0095.126] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString=".xlsx") returned 5 [0095.126] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0095.126] lstrlenW (lpString=".ppt") returned 4 [0095.126] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.126] lstrlenW (lpString=".zip") returned 4 [0095.126] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString=".rar") returned 4 [0095.126] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString=".bz2") returned 4 [0095.126] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString=".7z") returned 3 [0095.126] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.126] lstrlenW (lpString=".dbf") returned 4 [0095.126] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.126] lstrlenW (lpString=".1cd") returned 4 [0095.126] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0095.126] lstrlenW (lpString=".jpg") returned 4 [0095.126] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.126] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") [0095.153] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=55222) returned 1 [0095.153] CloseHandle (hObject=0x22c) returned 1 [0095.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0095.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.162] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.162] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0095.178] GetLastError () returned 0x0 [0095.178] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0095.218] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd7c0, lpOverlapped=0x0) returned 1 [0095.220] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.220] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.220] SetEndOfFile (hFile=0x16c) returned 1 [0095.220] CloseHandle (hObject=0x16c) returned 1 [0095.220] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.221] SetEndOfFile (hFile=0x22c) returned 1 [0095.222] CloseHandle (hObject=0x22c) returned 1 [0095.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1 [0095.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.222] lstrlenW (lpString=".doc") returned 4 [0095.222] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0095.222] lstrlenW (lpString=".docx") returned 5 [0095.222] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0095.222] lstrlenW (lpString=".pdf") returned 4 [0095.222] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0095.222] lstrlenW (lpString=".xls") returned 4 [0095.222] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0095.222] lstrlenW (lpString=".xlsx") returned 5 [0095.222] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0095.222] lstrlenW (lpString=".ppt") returned 4 [0095.222] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0095.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.222] lstrlenW (lpString=".zip") returned 4 [0095.222] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0095.222] lstrlenW (lpString=".rar") returned 4 [0095.222] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0095.223] lstrlenW (lpString=".bz2") returned 4 [0095.223] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0095.223] lstrlenW (lpString=".7z") returned 3 [0095.223] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0095.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.223] lstrlenW (lpString=".dbf") returned 4 [0095.223] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0095.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.223] lstrlenW (lpString=".1cd") returned 4 [0095.223] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0095.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0095.223] lstrlenW (lpString=".jpg") returned 4 [0095.223] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0095.223] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") [0095.486] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=531800) returned 1 [0095.486] CloseHandle (hObject=0x19c) returned 1 [0095.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 0x20 [0095.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.487] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.488] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.489] GetLastError () returned 0x0 [0095.489] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x81d58, lpOverlapped=0x0) returned 1 [0095.500] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x81d60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x81d60, lpOverlapped=0x0) returned 1 [0095.510] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.510] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.510] SetEndOfFile (hFile=0x1c8) returned 1 [0095.510] CloseHandle (hObject=0x1c8) returned 1 [0095.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.510] SetEndOfFile (hFile=0x19c) returned 1 [0095.515] CloseHandle (hObject=0x19c) returned 1 [0095.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 1 [0095.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.516] lstrlenW (lpString=".doc") returned 4 [0095.516] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString=".docx") returned 5 [0095.516] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0095.516] lstrlenW (lpString=".pdf") returned 4 [0095.516] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString=".xls") returned 4 [0095.516] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString=".xlsx") returned 5 [0095.516] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0095.516] lstrlenW (lpString=".ppt") returned 4 [0095.516] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.516] lstrlenW (lpString=".zip") returned 4 [0095.516] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString=".rar") returned 4 [0095.516] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0095.516] lstrlenW (lpString=".bz2") returned 4 [0095.516] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0095.516] lstrlenW (lpString=".7z") returned 3 [0095.516] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0095.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.516] lstrlenW (lpString=".dbf") returned 4 [0095.516] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0095.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.516] lstrlenW (lpString=".1cd") returned 4 [0095.516] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0095.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0095.517] lstrlenW (lpString=".jpg") returned 4 [0095.517] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0095.517] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") [0095.518] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=225632) returned 1 [0095.518] CloseHandle (hObject=0x19c) returned 1 [0095.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 0x20 [0095.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.519] GetLastError () returned 0x0 [0095.519] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x37160, lpOverlapped=0x0) returned 1 [0095.624] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x37170, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x37170, lpOverlapped=0x0) returned 1 [0095.628] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.628] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.628] SetEndOfFile (hFile=0x1c8) returned 1 [0095.628] CloseHandle (hObject=0x1c8) returned 1 [0095.628] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.628] SetEndOfFile (hFile=0x19c) returned 1 [0095.630] CloseHandle (hObject=0x19c) returned 1 [0095.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 1 [0095.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.630] lstrlenW (lpString=".doc") returned 4 [0095.630] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0095.631] lstrlenW (lpString=".docx") returned 5 [0095.631] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0095.631] lstrlenW (lpString=".pdf") returned 4 [0095.631] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0095.631] lstrlenW (lpString=".xls") returned 4 [0095.631] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0095.631] lstrlenW (lpString=".xlsx") returned 5 [0095.631] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0095.631] lstrlenW (lpString=".ppt") returned 4 [0095.631] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0095.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.631] lstrlenW (lpString=".zip") returned 4 [0095.631] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0095.631] lstrlenW (lpString=".rar") returned 4 [0095.631] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0095.631] lstrlenW (lpString=".bz2") returned 4 [0095.631] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0095.631] lstrlenW (lpString=".7z") returned 3 [0095.631] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0095.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.631] lstrlenW (lpString=".dbf") returned 4 [0095.631] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0095.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.631] lstrlenW (lpString=".1cd") returned 4 [0095.631] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0095.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0095.631] lstrlenW (lpString=".jpg") returned 4 [0095.631] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0095.631] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") [0095.742] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=11664) returned 1 [0095.742] CloseHandle (hObject=0x1c8) returned 1 [0095.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0095.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.743] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.743] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.743] GetLastError () returned 0x0 [0095.743] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2d90, lpOverlapped=0x0) returned 1 [0095.805] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0095.806] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.806] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.806] SetEndOfFile (hFile=0x210) returned 1 [0095.807] CloseHandle (hObject=0x210) returned 1 [0095.807] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.807] SetEndOfFile (hFile=0x1c8) returned 1 [0095.808] CloseHandle (hObject=0x1c8) returned 1 [0095.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.808] lstrlenW (lpString=".doc") returned 4 [0095.808] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0095.808] lstrlenW (lpString=".docx") returned 5 [0095.808] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0095.808] lstrlenW (lpString=".pdf") returned 4 [0095.808] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0095.808] lstrlenW (lpString=".xls") returned 4 [0095.808] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0095.808] lstrlenW (lpString=".xlsx") returned 5 [0095.808] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0095.808] lstrlenW (lpString=".ppt") returned 4 [0095.808] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.808] lstrlenW (lpString=".zip") returned 4 [0095.808] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0095.808] lstrlenW (lpString=".rar") returned 4 [0095.808] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0095.808] lstrlenW (lpString=".bz2") returned 4 [0095.808] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0095.809] lstrlenW (lpString=".7z") returned 3 [0095.809] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.809] lstrlenW (lpString=".dbf") returned 4 [0095.809] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.809] lstrlenW (lpString=".1cd") returned 4 [0095.809] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0095.809] lstrlenW (lpString=".jpg") returned 4 [0095.809] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0095.809] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") [0095.810] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10160) returned 1 [0095.810] CloseHandle (hObject=0x1c8) returned 1 [0095.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0095.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.810] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.810] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.811] GetLastError () returned 0x0 [0095.811] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0095.846] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0095.847] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.848] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.848] SetEndOfFile (hFile=0x210) returned 1 [0095.854] CloseHandle (hObject=0x210) returned 1 [0095.854] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.854] SetEndOfFile (hFile=0x1c8) returned 1 [0095.855] CloseHandle (hObject=0x1c8) returned 1 [0095.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1 [0095.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.886] lstrlenW (lpString=".doc") returned 4 [0095.886] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.886] lstrlenW (lpString=".docx") returned 5 [0095.886] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0095.886] lstrlenW (lpString=".pdf") returned 4 [0095.887] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.887] lstrlenW (lpString=".xls") returned 4 [0095.887] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.887] lstrlenW (lpString=".xlsx") returned 5 [0095.887] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0095.887] lstrlenW (lpString=".ppt") returned 4 [0095.887] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.887] lstrlenW (lpString=".zip") returned 4 [0095.887] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.887] lstrlenW (lpString=".rar") returned 4 [0095.887] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.887] lstrlenW (lpString=".bz2") returned 4 [0095.887] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.887] lstrlenW (lpString=".7z") returned 3 [0095.887] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.887] lstrlenW (lpString=".dbf") returned 4 [0095.887] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.887] lstrlenW (lpString=".1cd") returned 4 [0095.887] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0095.887] lstrlenW (lpString=".jpg") returned 4 [0095.887] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.887] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") [0095.906] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=12704) returned 1 [0095.906] CloseHandle (hObject=0x19c) returned 1 [0095.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0095.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.920] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.920] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0095.921] GetLastError () returned 0x0 [0095.921] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x31a0, lpOverlapped=0x0) returned 1 [0095.944] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x31b0, lpOverlapped=0x0) returned 1 [0095.945] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.945] SetEndOfFile (hFile=0x1b8) returned 1 [0095.945] CloseHandle (hObject=0x1b8) returned 1 [0095.945] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.945] SetEndOfFile (hFile=0x19c) returned 1 [0095.946] CloseHandle (hObject=0x19c) returned 1 [0095.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString=".doc") returned 4 [0095.947] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString=".docx") returned 5 [0095.947] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0095.947] lstrlenW (lpString=".pdf") returned 4 [0095.947] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString=".xls") returned 4 [0095.947] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0095.947] lstrlenW (lpString=".xlsx") returned 5 [0095.947] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0095.947] lstrlenW (lpString=".ppt") returned 4 [0095.947] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString=".zip") returned 4 [0095.947] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0095.947] lstrlenW (lpString=".rar") returned 4 [0095.947] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString=".bz2") returned 4 [0095.947] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString=".7z") returned 3 [0095.947] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString=".dbf") returned 4 [0095.947] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString=".1cd") returned 4 [0095.947] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0095.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0095.947] lstrlenW (lpString=".jpg") returned 4 [0095.948] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0095.948] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") [0095.956] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=31136) returned 1 [0095.956] CloseHandle (hObject=0x19c) returned 1 [0095.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0095.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.957] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.957] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0095.957] GetLastError () returned 0x0 [0095.958] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x79a0, lpOverlapped=0x0) returned 1 [0095.960] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x79b0, lpOverlapped=0x0) returned 1 [0095.961] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.961] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.961] SetEndOfFile (hFile=0x1b8) returned 1 [0095.961] CloseHandle (hObject=0x1b8) returned 1 [0095.961] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.962] SetEndOfFile (hFile=0x19c) returned 1 [0095.962] CloseHandle (hObject=0x19c) returned 1 [0095.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0095.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1 [0095.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.963] lstrlenW (lpString=".doc") returned 4 [0095.963] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0095.963] lstrlenW (lpString=".docx") returned 5 [0095.963] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0095.963] lstrlenW (lpString=".pdf") returned 4 [0095.963] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0095.963] lstrlenW (lpString=".xls") returned 4 [0095.963] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0095.963] lstrlenW (lpString=".xlsx") returned 5 [0095.963] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0095.963] lstrlenW (lpString=".ppt") returned 4 [0095.963] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0095.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.963] lstrlenW (lpString=".zip") returned 4 [0095.963] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0095.963] lstrlenW (lpString=".rar") returned 4 [0095.963] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0095.963] lstrlenW (lpString=".bz2") returned 4 [0095.963] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0095.963] lstrlenW (lpString=".7z") returned 3 [0095.964] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0095.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.964] lstrlenW (lpString=".dbf") returned 4 [0095.964] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0095.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.964] lstrlenW (lpString=".1cd") returned 4 [0095.964] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0095.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0095.964] lstrlenW (lpString=".jpg") returned 4 [0095.964] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0095.964] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") [0095.964] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=23424) returned 1 [0095.964] CloseHandle (hObject=0x19c) returned 1 [0095.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0095.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0095.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.965] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.965] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0095.965] GetLastError () returned 0x0 [0095.965] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x5b80, lpOverlapped=0x0) returned 1 [0096.034] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x5b90, lpOverlapped=0x0) returned 1 [0096.035] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.035] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.035] SetEndOfFile (hFile=0x1b8) returned 1 [0096.035] CloseHandle (hObject=0x1b8) returned 1 [0096.035] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.035] SetEndOfFile (hFile=0x19c) returned 1 [0096.036] CloseHandle (hObject=0x19c) returned 1 [0096.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1 [0096.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString=".doc") returned 4 [0096.094] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString=".docx") returned 5 [0096.094] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0096.094] lstrlenW (lpString=".pdf") returned 4 [0096.094] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString=".xls") returned 4 [0096.094] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.094] lstrlenW (lpString=".xlsx") returned 5 [0096.094] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0096.094] lstrlenW (lpString=".ppt") returned 4 [0096.094] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString=".zip") returned 4 [0096.094] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.094] lstrlenW (lpString=".rar") returned 4 [0096.094] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString=".bz2") returned 4 [0096.094] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString=".7z") returned 3 [0096.094] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString=".dbf") returned 4 [0096.094] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString=".1cd") returned 4 [0096.094] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0096.094] lstrlenW (lpString=".jpg") returned 4 [0096.094] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.094] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") [0096.111] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=50568) returned 1 [0096.111] CloseHandle (hObject=0x1ec) returned 1 [0096.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0096.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.111] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.111] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.112] GetLastError () returned 0x0 [0096.112] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xc588, lpOverlapped=0x0) returned 1 [0096.115] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xc590, lpOverlapped=0x0) returned 1 [0096.116] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.116] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.116] SetEndOfFile (hFile=0x1f4) returned 1 [0096.116] CloseHandle (hObject=0x1f4) returned 1 [0096.116] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.117] SetEndOfFile (hFile=0x1ec) returned 1 [0096.118] CloseHandle (hObject=0x1ec) returned 1 [0096.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1 [0096.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.120] lstrlenW (lpString=".doc") returned 4 [0096.120] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0096.120] lstrlenW (lpString=".docx") returned 5 [0096.121] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0096.121] lstrlenW (lpString=".pdf") returned 4 [0096.121] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString=".xls") returned 4 [0096.121] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0096.121] lstrlenW (lpString=".xlsx") returned 5 [0096.121] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0096.121] lstrlenW (lpString=".ppt") returned 4 [0096.121] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.121] lstrlenW (lpString=".zip") returned 4 [0096.121] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0096.121] lstrlenW (lpString=".rar") returned 4 [0096.121] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString=".bz2") returned 4 [0096.121] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString=".7z") returned 3 [0096.121] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0096.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.121] lstrlenW (lpString=".dbf") returned 4 [0096.121] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.121] lstrlenW (lpString=".1cd") returned 4 [0096.121] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0096.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0096.121] lstrlenW (lpString=".jpg") returned 4 [0096.121] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0096.121] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") [0096.122] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=99688) returned 1 [0096.122] CloseHandle (hObject=0x1ec) returned 1 [0096.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20 [0096.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.122] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.122] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.123] GetLastError () returned 0x0 [0096.123] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x18568, lpOverlapped=0x0) returned 1 [0096.126] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x18570, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x18570, lpOverlapped=0x0) returned 1 [0096.128] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.128] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0096.129] SetEndOfFile (hFile=0x1f4) returned 1 [0096.129] CloseHandle (hObject=0x1f4) returned 1 [0096.129] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.129] SetEndOfFile (hFile=0x1ec) returned 1 [0096.130] CloseHandle (hObject=0x1ec) returned 1 [0096.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 1 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString=".doc") returned 4 [0096.131] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString=".docx") returned 5 [0096.131] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0096.131] lstrlenW (lpString=".pdf") returned 4 [0096.131] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString=".xls") returned 4 [0096.131] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString=".xlsx") returned 5 [0096.131] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0096.131] lstrlenW (lpString=".ppt") returned 4 [0096.131] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString=".zip") returned 4 [0096.131] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString=".rar") returned 4 [0096.131] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.131] lstrlenW (lpString=".bz2") returned 4 [0096.131] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.131] lstrlenW (lpString=".7z") returned 3 [0096.131] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString=".dbf") returned 4 [0096.131] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString=".1cd") returned 4 [0096.131] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0096.131] lstrlenW (lpString=".jpg") returned 4 [0096.131] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.132] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") [0096.132] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=130944) returned 1 [0096.132] CloseHandle (hObject=0x1ec) returned 1 [0096.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 0x20 [0096.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.132] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.132] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0096.133] GetLastError () returned 0x0 [0096.133] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1ff80, lpOverlapped=0x0) returned 1 [0096.137] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1ff90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1ff90, lpOverlapped=0x0) returned 1 [0096.149] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.149] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.149] SetEndOfFile (hFile=0x1f4) returned 1 [0096.149] CloseHandle (hObject=0x1f4) returned 1 [0096.149] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.149] SetEndOfFile (hFile=0x1ec) returned 1 [0096.151] CloseHandle (hObject=0x1ec) returned 1 [0096.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 1 [0096.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.151] lstrlenW (lpString=".doc") returned 4 [0096.151] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.151] lstrlenW (lpString=".docx") returned 5 [0096.151] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0096.151] lstrlenW (lpString=".pdf") returned 4 [0096.151] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.151] lstrlenW (lpString=".xls") returned 4 [0096.151] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.151] lstrlenW (lpString=".xlsx") returned 5 [0096.151] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0096.152] lstrlenW (lpString=".ppt") returned 4 [0096.152] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.152] lstrlenW (lpString=".zip") returned 4 [0096.152] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.152] lstrlenW (lpString=".rar") returned 4 [0096.152] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.152] lstrlenW (lpString=".bz2") returned 4 [0096.152] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.152] lstrlenW (lpString=".7z") returned 3 [0096.152] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.152] lstrlenW (lpString=".dbf") returned 4 [0096.152] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.152] lstrlenW (lpString=".1cd") returned 4 [0096.152] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0096.152] lstrlenW (lpString=".jpg") returned 4 [0096.152] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.152] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") [0096.153] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=594352) returned 1 [0096.153] CloseHandle (hObject=0x1ec) returned 1 [0096.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 0x20 [0096.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.153] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.153] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0096.203] GetLastError () returned 0x0 [0096.203] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x911b0, lpOverlapped=0x0) returned 1 [0096.217] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x911c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x911c0, lpOverlapped=0x0) returned 1 [0096.229] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.229] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0096.229] SetEndOfFile (hFile=0x1b8) returned 1 [0096.229] CloseHandle (hObject=0x1b8) returned 1 [0096.229] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.229] SetEndOfFile (hFile=0x1ec) returned 1 [0096.234] CloseHandle (hObject=0x1ec) returned 1 [0096.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.235] lstrlenW (lpString=".doc") returned 4 [0096.235] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString=".docx") returned 5 [0096.235] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0096.235] lstrlenW (lpString=".pdf") returned 4 [0096.235] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString=".xls") returned 4 [0096.235] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString=".xlsx") returned 5 [0096.235] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0096.235] lstrlenW (lpString=".ppt") returned 4 [0096.235] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.235] lstrlenW (lpString=".zip") returned 4 [0096.235] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString=".rar") returned 4 [0096.235] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.235] lstrlenW (lpString=".bz2") returned 4 [0096.235] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.235] lstrlenW (lpString=".7z") returned 3 [0096.235] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.236] lstrlenW (lpString=".dbf") returned 4 [0096.236] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.236] lstrlenW (lpString=".1cd") returned 4 [0096.236] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0096.236] lstrlenW (lpString=".jpg") returned 4 [0096.236] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.236] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") [0096.237] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1343) returned 1 [0096.237] CloseHandle (hObject=0x1ec) returned 1 [0096.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0096.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0096.237] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.237] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0096.239] GetLastError () returned 0x0 [0096.239] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x53f, lpOverlapped=0x0) returned 1 [0096.495] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x540, lpOverlapped=0x0) returned 1 [0096.496] ReadFile (in: hFile=0x1ec, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.496] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0096.496] SetEndOfFile (hFile=0x1b8) returned 1 [0096.496] CloseHandle (hObject=0x1b8) returned 1 [0096.496] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.496] SetEndOfFile (hFile=0x1ec) returned 1 [0096.497] CloseHandle (hObject=0x1ec) returned 1 [0096.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString=".doc") returned 4 [0096.498] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".docx") returned 5 [0096.498] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0096.498] lstrlenW (lpString=".pdf") returned 4 [0096.498] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".xls") returned 4 [0096.498] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".xlsx") returned 5 [0096.498] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0096.498] lstrlenW (lpString=".ppt") returned 4 [0096.498] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString=".zip") returned 4 [0096.498] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".rar") returned 4 [0096.498] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".bz2") returned 4 [0096.498] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString=".7z") returned 3 [0096.498] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString=".dbf") returned 4 [0096.498] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString=".1cd") returned 4 [0096.498] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0096.498] lstrlenW (lpString=".jpg") returned 4 [0096.498] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0096.498] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") [0096.532] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=99272) returned 1 [0096.533] CloseHandle (hObject=0x1fc) returned 1 [0096.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 0x20 [0096.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.560] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.560] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.561] GetLastError () returned 0x0 [0096.561] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x183c8, lpOverlapped=0x0) returned 1 [0096.567] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x183d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x183d0, lpOverlapped=0x0) returned 1 [0096.581] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.581] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.581] SetEndOfFile (hFile=0x22c) returned 1 [0096.581] CloseHandle (hObject=0x22c) returned 1 [0096.581] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.581] SetEndOfFile (hFile=0x1fc) returned 1 [0096.582] CloseHandle (hObject=0x1fc) returned 1 [0096.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 1 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.583] lstrlenW (lpString=".doc") returned 4 [0096.583] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString=".docx") returned 5 [0096.583] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0096.583] lstrlenW (lpString=".pdf") returned 4 [0096.583] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString=".xls") returned 4 [0096.583] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString=".xlsx") returned 5 [0096.583] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0096.583] lstrlenW (lpString=".ppt") returned 4 [0096.583] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.583] lstrlenW (lpString=".zip") returned 4 [0096.583] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString=".rar") returned 4 [0096.583] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.583] lstrlenW (lpString=".bz2") returned 4 [0096.583] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.583] lstrlenW (lpString=".7z") returned 3 [0096.583] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.583] lstrlenW (lpString=".dbf") returned 4 [0096.583] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.584] lstrlenW (lpString=".1cd") returned 4 [0096.584] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0096.584] lstrlenW (lpString=".jpg") returned 4 [0096.584] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.584] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") [0096.587] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=108904) returned 1 [0096.587] CloseHandle (hObject=0x210) returned 1 [0096.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 0x20 [0096.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0096.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0096.588] GetLastError () returned 0x0 [0096.588] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1a968, lpOverlapped=0x0) returned 1 [0096.628] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1a970, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1a970, lpOverlapped=0x0) returned 1 [0096.631] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.631] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.641] SetEndOfFile (hFile=0x1a0) returned 1 [0096.641] CloseHandle (hObject=0x1a0) returned 1 [0096.641] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.641] SetEndOfFile (hFile=0x210) returned 1 [0096.642] CloseHandle (hObject=0x210) returned 1 [0096.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 1 [0096.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.643] lstrlenW (lpString=".doc") returned 4 [0096.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString=".docx") returned 5 [0096.643] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0096.643] lstrlenW (lpString=".pdf") returned 4 [0096.643] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString=".xls") returned 4 [0096.643] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString=".xlsx") returned 5 [0096.643] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0096.643] lstrlenW (lpString=".ppt") returned 4 [0096.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.643] lstrlenW (lpString=".zip") returned 4 [0096.643] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString=".rar") returned 4 [0096.643] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.643] lstrlenW (lpString=".bz2") returned 4 [0096.643] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.643] lstrlenW (lpString=".7z") returned 3 [0096.643] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.644] lstrlenW (lpString=".dbf") returned 4 [0096.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.644] lstrlenW (lpString=".1cd") returned 4 [0096.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0096.644] lstrlenW (lpString=".jpg") returned 4 [0096.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.644] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") [0096.645] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=116592) returned 1 [0096.645] CloseHandle (hObject=0x210) returned 1 [0096.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll")) returned 0x20 [0096.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0096.646] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.646] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0096.646] GetLastError () returned 0x0 [0096.646] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1c770, lpOverlapped=0x0) returned 1 [0096.650] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1c780, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1c780, lpOverlapped=0x0) returned 1 [0096.652] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.653] SetEndOfFile (hFile=0x1a0) returned 1 [0096.653] CloseHandle (hObject=0x1a0) returned 1 [0096.653] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.653] SetEndOfFile (hFile=0x210) returned 1 [0096.654] CloseHandle (hObject=0x210) returned 1 [0096.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll")) returned 1 [0096.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.655] lstrlenW (lpString=".doc") returned 4 [0096.655] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString=".docx") returned 5 [0096.655] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0096.655] lstrlenW (lpString=".pdf") returned 4 [0096.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString=".xls") returned 4 [0096.655] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString=".xlsx") returned 5 [0096.655] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0096.655] lstrlenW (lpString=".ppt") returned 4 [0096.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.655] lstrlenW (lpString=".zip") returned 4 [0096.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString=".rar") returned 4 [0096.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.655] lstrlenW (lpString=".bz2") returned 4 [0096.655] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.655] lstrlenW (lpString=".7z") returned 3 [0096.655] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.656] lstrlenW (lpString=".dbf") returned 4 [0096.656] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.656] lstrlenW (lpString=".1cd") returned 4 [0096.656] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0096.656] lstrlenW (lpString=".jpg") returned 4 [0096.656] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.656] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") [0096.656] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1757048) returned 1 [0096.657] CloseHandle (hObject=0x210) returned 1 [0096.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll")) returned 0x20 [0096.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0096.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0096.658] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0096.658] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.658] ReadFile (in: hFile=0x210, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.663] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8efd2, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.663] ReadFile (in: hFile=0x210, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.668] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0096.668] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x16cf78, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.668] ReadFile (in: hFile=0x210, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.684] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.812] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0096.833] SetEndOfFile (hFile=0x210) returned 1 [0096.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0096.834] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.834] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.835] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8efd2, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.835] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.837] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x16cf78, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.837] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.839] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0096.839] CloseHandle (hObject=0x210) returned 1 [0096.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0096.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.839] lstrlenW (lpString=".doc") returned 4 [0096.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0096.839] lstrlenW (lpString=".docx") returned 5 [0096.839] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0096.840] lstrlenW (lpString=".pdf") returned 4 [0096.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0096.840] lstrlenW (lpString=".xls") returned 4 [0096.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0096.840] lstrlenW (lpString=".xlsx") returned 5 [0096.840] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0096.840] lstrlenW (lpString=".ppt") returned 4 [0096.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0096.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.840] lstrlenW (lpString=".zip") returned 4 [0096.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0096.840] lstrlenW (lpString=".rar") returned 4 [0096.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0096.840] lstrlenW (lpString=".bz2") returned 4 [0096.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0096.840] lstrlenW (lpString=".7z") returned 3 [0096.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0096.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.840] lstrlenW (lpString=".dbf") returned 4 [0096.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0096.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.840] lstrlenW (lpString=".1cd") returned 4 [0096.840] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0096.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0096.840] lstrlenW (lpString=".jpg") returned 4 [0096.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0096.840] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") [0096.920] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=44424) returned 1 [0096.931] CloseHandle (hObject=0x210) returned 1 [0096.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll")) returned 0x20 [0096.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0096.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0096.934] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.934] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0096.950] GetLastError () returned 0x0 [0096.950] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xad88, lpOverlapped=0x0) returned 1 [0096.997] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xad90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xad90, lpOverlapped=0x0) returned 1 [0096.998] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.998] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.998] SetEndOfFile (hFile=0x1c0) returned 1 [0096.998] CloseHandle (hObject=0x1c0) returned 1 [0096.999] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.999] SetEndOfFile (hFile=0x210) returned 1 [0097.098] CloseHandle (hObject=0x210) returned 1 [0097.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll")) returned 1 [0097.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.099] lstrlenW (lpString=".doc") returned 4 [0097.099] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString=".docx") returned 5 [0097.099] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0097.099] lstrlenW (lpString=".pdf") returned 4 [0097.099] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString=".xls") returned 4 [0097.099] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString=".xlsx") returned 5 [0097.099] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0097.099] lstrlenW (lpString=".ppt") returned 4 [0097.099] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.099] lstrlenW (lpString=".zip") returned 4 [0097.099] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString=".rar") returned 4 [0097.099] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.099] lstrlenW (lpString=".bz2") returned 4 [0097.099] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.099] lstrlenW (lpString=".7z") returned 3 [0097.099] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.099] lstrlenW (lpString=".dbf") returned 4 [0097.099] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.099] lstrlenW (lpString=".1cd") returned 4 [0097.100] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 54 [0097.100] lstrlenW (lpString=".jpg") returned 4 [0097.100] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.100] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") [0097.100] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=219520) returned 1 [0097.100] CloseHandle (hObject=0x210) returned 1 [0097.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 0x20 [0097.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.101] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.101] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0097.101] GetLastError () returned 0x0 [0097.101] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x35980, lpOverlapped=0x0) returned 1 [0097.241] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x35990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x35990, lpOverlapped=0x0) returned 1 [0097.246] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.246] WriteFile (in: hFile=0x16c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.246] SetEndOfFile (hFile=0x16c) returned 1 [0097.247] CloseHandle (hObject=0x16c) returned 1 [0097.247] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.247] SetEndOfFile (hFile=0x210) returned 1 [0097.249] CloseHandle (hObject=0x210) returned 1 [0097.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 1 [0097.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.249] lstrlenW (lpString=".doc") returned 4 [0097.249] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.249] lstrlenW (lpString=".docx") returned 5 [0097.249] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0097.249] lstrlenW (lpString=".pdf") returned 4 [0097.249] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.249] lstrlenW (lpString=".xls") returned 4 [0097.249] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.249] lstrlenW (lpString=".xlsx") returned 5 [0097.249] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0097.249] lstrlenW (lpString=".ppt") returned 4 [0097.249] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.250] lstrlenW (lpString=".zip") returned 4 [0097.250] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.250] lstrlenW (lpString=".rar") returned 4 [0097.250] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.250] lstrlenW (lpString=".bz2") returned 4 [0097.250] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.250] lstrlenW (lpString=".7z") returned 3 [0097.250] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.250] lstrlenW (lpString=".dbf") returned 4 [0097.250] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.250] lstrlenW (lpString=".1cd") returned 4 [0097.250] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0097.250] lstrlenW (lpString=".jpg") returned 4 [0097.250] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.250] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") [0097.288] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24994656) returned 1 [0097.288] CloseHandle (hObject=0x1b4) returned 1 [0097.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20 [0097.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0097.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.290] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0097.290] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.290] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.294] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x7f2120, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.294] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.305] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0097.305] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x1796360, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.305] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.321] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.321] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0097.347] SetEndOfFile (hFile=0x1b4) returned 1 [0097.347] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0097.348] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.348] WriteFile (in: hFile=0x1b4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.349] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x7f2120, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.349] WriteFile (in: hFile=0x1b4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.353] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x1796360, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.354] WriteFile (in: hFile=0x1b4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.356] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0097.356] CloseHandle (hObject=0x1b4) returned 1 [0097.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.356] lstrlenW (lpString=".doc") returned 4 [0097.356] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0097.356] lstrlenW (lpString=".docx") returned 5 [0097.356] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0097.356] lstrlenW (lpString=".pdf") returned 4 [0097.356] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0097.356] lstrlenW (lpString=".xls") returned 4 [0097.356] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0097.356] lstrlenW (lpString=".xlsx") returned 5 [0097.356] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0097.356] lstrlenW (lpString=".ppt") returned 4 [0097.356] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0097.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.356] lstrlenW (lpString=".zip") returned 4 [0097.356] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0097.356] lstrlenW (lpString=".rar") returned 4 [0097.356] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0097.356] lstrlenW (lpString=".bz2") returned 4 [0097.356] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0097.356] lstrlenW (lpString=".7z") returned 3 [0097.357] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0097.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.357] lstrlenW (lpString=".dbf") returned 4 [0097.357] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0097.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.357] lstrlenW (lpString=".1cd") returned 4 [0097.357] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0097.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0097.357] lstrlenW (lpString=".jpg") returned 4 [0097.357] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0097.357] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") [0097.358] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=48480) returned 1 [0097.358] CloseHandle (hObject=0x1b4) returned 1 [0097.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 0x20 [0097.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.358] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.358] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.360] GetLastError () returned 0x0 [0097.360] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbd60, lpOverlapped=0x0) returned 1 [0097.362] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0097.365] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.365] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0097.365] SetEndOfFile (hFile=0x1c0) returned 1 [0097.365] CloseHandle (hObject=0x1c0) returned 1 [0097.365] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.365] SetEndOfFile (hFile=0x1b4) returned 1 [0097.366] CloseHandle (hObject=0x1b4) returned 1 [0097.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 1 [0097.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString=".doc") returned 4 [0097.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString=".docx") returned 5 [0097.367] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0097.367] lstrlenW (lpString=".pdf") returned 4 [0097.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString=".xls") returned 4 [0097.367] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString=".xlsx") returned 5 [0097.367] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0097.367] lstrlenW (lpString=".ppt") returned 4 [0097.367] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString=".zip") returned 4 [0097.367] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString=".rar") returned 4 [0097.367] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.367] lstrlenW (lpString=".bz2") returned 4 [0097.367] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.367] lstrlenW (lpString=".7z") returned 3 [0097.367] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString=".dbf") returned 4 [0097.367] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString=".1cd") returned 4 [0097.367] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0097.367] lstrlenW (lpString=".jpg") returned 4 [0097.367] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.368] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") [0097.368] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=474960) returned 1 [0097.368] CloseHandle (hObject=0x1b4) returned 1 [0097.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 0x20 [0097.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.369] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.369] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.369] GetLastError () returned 0x0 [0097.369] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x73f50, lpOverlapped=0x0) returned 1 [0097.381] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x73f60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x73f60, lpOverlapped=0x0) returned 1 [0097.391] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.391] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.391] SetEndOfFile (hFile=0x1c0) returned 1 [0097.391] CloseHandle (hObject=0x1c0) returned 1 [0097.391] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.391] SetEndOfFile (hFile=0x1b4) returned 1 [0097.395] CloseHandle (hObject=0x1b4) returned 1 [0097.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0097.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 1 [0097.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.395] lstrlenW (lpString=".doc") returned 4 [0097.395] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0097.395] lstrlenW (lpString=".docx") returned 5 [0097.396] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0097.396] lstrlenW (lpString=".pdf") returned 4 [0097.396] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0097.396] lstrlenW (lpString=".xls") returned 4 [0097.396] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0097.396] lstrlenW (lpString=".xlsx") returned 5 [0097.396] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0097.396] lstrlenW (lpString=".ppt") returned 4 [0097.396] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0097.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.396] lstrlenW (lpString=".zip") returned 4 [0097.396] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0097.396] lstrlenW (lpString=".rar") returned 4 [0097.396] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0097.396] lstrlenW (lpString=".bz2") returned 4 [0097.396] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0097.396] lstrlenW (lpString=".7z") returned 3 [0097.396] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0097.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.396] lstrlenW (lpString=".dbf") returned 4 [0097.396] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0097.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.396] lstrlenW (lpString=".1cd") returned 4 [0097.396] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0097.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0097.396] lstrlenW (lpString=".jpg") returned 4 [0097.396] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0097.396] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") [0097.398] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=340904) returned 1 [0097.398] CloseHandle (hObject=0x1b4) returned 1 [0097.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 0x20 [0097.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0097.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.399] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.399] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0097.400] GetLastError () returned 0x0 [0097.400] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x533a8, lpOverlapped=0x0) returned 1 [0097.410] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x533b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x533b0, lpOverlapped=0x0) returned 1 [0097.416] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.416] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.416] SetEndOfFile (hFile=0x1c0) returned 1 [0097.416] CloseHandle (hObject=0x1c0) returned 1 [0097.416] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.417] SetEndOfFile (hFile=0x1b4) returned 1 [0097.775] CloseHandle (hObject=0x1b4) returned 1 [0098.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 1 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString=".doc") returned 4 [0098.095] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString=".docx") returned 5 [0098.095] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0098.095] lstrlenW (lpString=".pdf") returned 4 [0098.095] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString=".xls") returned 4 [0098.095] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString=".xlsx") returned 5 [0098.095] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0098.095] lstrlenW (lpString=".ppt") returned 4 [0098.095] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString=".zip") returned 4 [0098.095] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString=".rar") returned 4 [0098.095] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.095] lstrlenW (lpString=".bz2") returned 4 [0098.095] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.095] lstrlenW (lpString=".7z") returned 3 [0098.095] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString=".dbf") returned 4 [0098.095] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString=".1cd") returned 4 [0098.095] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0098.095] lstrlenW (lpString=".jpg") returned 4 [0098.095] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.096] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") [0098.096] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0098.096] CloseHandle (hObject=0x16c) returned 1 [0098.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 0x20 [0098.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.096] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.096] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.097] GetLastError () returned 0x0 [0098.097] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.099] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.099] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.100] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.100] SetEndOfFile (hFile=0x1ec) returned 1 [0098.100] CloseHandle (hObject=0x1ec) returned 1 [0098.100] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.100] SetEndOfFile (hFile=0x16c) returned 1 [0098.101] CloseHandle (hObject=0x16c) returned 1 [0098.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 1 [0098.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.101] lstrlenW (lpString=".doc") returned 4 [0098.101] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.101] lstrlenW (lpString=".docx") returned 5 [0098.101] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.101] lstrlenW (lpString=".pdf") returned 4 [0098.101] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.101] lstrlenW (lpString=".xls") returned 4 [0098.101] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.101] lstrlenW (lpString=".xlsx") returned 5 [0098.101] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.101] lstrlenW (lpString=".ppt") returned 4 [0098.102] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.102] lstrlenW (lpString=".zip") returned 4 [0098.102] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.102] lstrlenW (lpString=".rar") returned 4 [0098.102] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.102] lstrlenW (lpString=".bz2") returned 4 [0098.102] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.102] lstrlenW (lpString=".7z") returned 3 [0098.102] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.102] lstrlenW (lpString=".dbf") returned 4 [0098.102] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.102] lstrlenW (lpString=".1cd") returned 4 [0098.102] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0098.102] lstrlenW (lpString=".jpg") returned 4 [0098.102] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.102] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") [0098.103] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0098.103] CloseHandle (hObject=0x16c) returned 1 [0098.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 0x20 [0098.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.103] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.103] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.103] GetLastError () returned 0x0 [0098.104] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.105] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.106] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.106] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.106] SetEndOfFile (hFile=0x1ec) returned 1 [0098.106] CloseHandle (hObject=0x1ec) returned 1 [0098.106] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.106] SetEndOfFile (hFile=0x16c) returned 1 [0098.107] CloseHandle (hObject=0x16c) returned 1 [0098.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 1 [0098.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.107] lstrlenW (lpString=".doc") returned 4 [0098.108] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.108] lstrlenW (lpString=".docx") returned 5 [0098.108] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.108] lstrlenW (lpString=".pdf") returned 4 [0098.108] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.108] lstrlenW (lpString=".xls") returned 4 [0098.108] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.108] lstrlenW (lpString=".xlsx") returned 5 [0098.108] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.108] lstrlenW (lpString=".ppt") returned 4 [0098.108] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.108] lstrlenW (lpString=".zip") returned 4 [0098.108] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.108] lstrlenW (lpString=".rar") returned 4 [0098.108] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.108] lstrlenW (lpString=".bz2") returned 4 [0098.108] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.108] lstrlenW (lpString=".7z") returned 3 [0098.108] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.108] lstrlenW (lpString=".dbf") returned 4 [0098.108] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.108] lstrlenW (lpString=".1cd") returned 4 [0098.108] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0098.108] lstrlenW (lpString=".jpg") returned 4 [0098.108] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.108] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") [0098.110] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=616) returned 1 [0098.110] CloseHandle (hObject=0x16c) returned 1 [0098.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 0x20 [0098.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.110] GetLastError () returned 0x0 [0098.111] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x268, lpOverlapped=0x0) returned 1 [0098.111] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x270, lpOverlapped=0x0) returned 1 [0098.112] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.112] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.112] SetEndOfFile (hFile=0x1ec) returned 1 [0098.112] CloseHandle (hObject=0x1ec) returned 1 [0098.113] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.113] SetEndOfFile (hFile=0x16c) returned 1 [0098.113] CloseHandle (hObject=0x16c) returned 1 [0098.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 1 [0098.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.114] lstrlenW (lpString=".doc") returned 4 [0098.114] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString=".docx") returned 5 [0098.114] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0098.114] lstrlenW (lpString=".pdf") returned 4 [0098.114] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString=".xls") returned 4 [0098.114] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString=".xlsx") returned 5 [0098.114] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0098.114] lstrlenW (lpString=".ppt") returned 4 [0098.114] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.114] lstrlenW (lpString=".zip") returned 4 [0098.114] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString=".rar") returned 4 [0098.114] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString=".bz2") returned 4 [0098.114] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.114] lstrlenW (lpString=".7z") returned 3 [0098.114] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.114] lstrlenW (lpString=".dbf") returned 4 [0098.114] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.115] lstrlenW (lpString=".1cd") returned 4 [0098.115] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0098.115] lstrlenW (lpString=".jpg") returned 4 [0098.115] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.115] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") [0098.115] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=25214) returned 1 [0098.115] CloseHandle (hObject=0x16c) returned 1 [0098.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 0x20 [0098.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.115] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.116] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.116] GetLastError () returned 0x0 [0098.116] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x627e, lpOverlapped=0x0) returned 1 [0098.118] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6280, lpOverlapped=0x0) returned 1 [0098.120] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.120] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.120] SetEndOfFile (hFile=0x1ec) returned 1 [0098.120] CloseHandle (hObject=0x1ec) returned 1 [0098.120] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.120] SetEndOfFile (hFile=0x16c) returned 1 [0098.121] CloseHandle (hObject=0x16c) returned 1 [0098.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 1 [0098.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.121] lstrlenW (lpString=".doc") returned 4 [0098.121] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.121] lstrlenW (lpString=".docx") returned 5 [0098.121] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.121] lstrlenW (lpString=".pdf") returned 4 [0098.121] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.121] lstrlenW (lpString=".xls") returned 4 [0098.121] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.121] lstrlenW (lpString=".xlsx") returned 5 [0098.122] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.122] lstrlenW (lpString=".ppt") returned 4 [0098.122] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.122] lstrlenW (lpString=".zip") returned 4 [0098.122] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.122] lstrlenW (lpString=".rar") returned 4 [0098.122] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.122] lstrlenW (lpString=".bz2") returned 4 [0098.122] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.122] lstrlenW (lpString=".7z") returned 3 [0098.122] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.122] lstrlenW (lpString=".dbf") returned 4 [0098.122] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.122] lstrlenW (lpString=".1cd") returned 4 [0098.122] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0098.122] lstrlenW (lpString=".jpg") returned 4 [0098.122] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.122] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") [0098.123] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0098.123] CloseHandle (hObject=0x16c) returned 1 [0098.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 0x20 [0098.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.123] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.123] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.124] GetLastError () returned 0x0 [0098.124] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0098.125] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0098.126] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.126] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.126] SetEndOfFile (hFile=0x1ec) returned 1 [0098.129] CloseHandle (hObject=0x1ec) returned 1 [0098.129] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.129] SetEndOfFile (hFile=0x16c) returned 1 [0098.129] CloseHandle (hObject=0x16c) returned 1 [0098.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 1 [0098.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.130] lstrlenW (lpString=".doc") returned 4 [0098.130] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.130] lstrlenW (lpString=".docx") returned 5 [0098.130] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.130] lstrlenW (lpString=".pdf") returned 4 [0098.130] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.130] lstrlenW (lpString=".xls") returned 4 [0098.130] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.130] lstrlenW (lpString=".xlsx") returned 5 [0098.130] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.130] lstrlenW (lpString=".ppt") returned 4 [0098.130] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.130] lstrlenW (lpString=".zip") returned 4 [0098.130] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.130] lstrlenW (lpString=".rar") returned 4 [0098.130] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.130] lstrlenW (lpString=".bz2") returned 4 [0098.130] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.130] lstrlenW (lpString=".7z") returned 3 [0098.131] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.131] lstrlenW (lpString=".dbf") returned 4 [0098.131] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.131] lstrlenW (lpString=".1cd") returned 4 [0098.131] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0098.131] lstrlenW (lpString=".jpg") returned 4 [0098.131] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.131] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") [0098.131] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=795) returned 1 [0098.131] CloseHandle (hObject=0x16c) returned 1 [0098.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 0x20 [0098.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.132] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.132] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0098.132] GetLastError () returned 0x0 [0098.132] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x31b, lpOverlapped=0x0) returned 1 [0098.212] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x320, lpOverlapped=0x0) returned 1 [0098.213] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.213] WriteFile (in: hFile=0x1ec, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0098.213] SetEndOfFile (hFile=0x1ec) returned 1 [0098.220] CloseHandle (hObject=0x1ec) returned 1 [0098.220] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.220] SetEndOfFile (hFile=0x16c) returned 1 [0098.221] CloseHandle (hObject=0x16c) returned 1 [0098.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 1 [0098.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.360] lstrlenW (lpString=".doc") returned 4 [0098.360] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0098.360] lstrlenW (lpString=".docx") returned 5 [0098.360] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0098.360] lstrlenW (lpString=".pdf") returned 4 [0098.360] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0098.360] lstrlenW (lpString=".xls") returned 4 [0098.360] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0098.360] lstrlenW (lpString=".xlsx") returned 5 [0098.360] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0098.360] lstrlenW (lpString=".ppt") returned 4 [0098.360] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0098.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.360] lstrlenW (lpString=".zip") returned 4 [0098.360] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0098.360] lstrlenW (lpString=".rar") returned 4 [0098.360] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0098.361] lstrlenW (lpString=".bz2") returned 4 [0098.361] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0098.361] lstrlenW (lpString=".7z") returned 3 [0098.361] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.361] lstrlenW (lpString=".dbf") returned 4 [0098.361] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.361] lstrlenW (lpString=".1cd") returned 4 [0098.361] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0098.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0098.361] lstrlenW (lpString=".jpg") returned 4 [0098.361] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0098.361] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") [0098.453] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2238) returned 1 [0098.453] CloseHandle (hObject=0x16c) returned 1 [0098.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 0x20 [0098.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.454] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.454] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0098.457] GetLastError () returned 0x0 [0098.457] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x8be, lpOverlapped=0x0) returned 1 [0098.459] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0098.460] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.460] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0098.460] SetEndOfFile (hFile=0x168) returned 1 [0098.460] CloseHandle (hObject=0x168) returned 1 [0098.460] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.460] SetEndOfFile (hFile=0x16c) returned 1 [0098.461] CloseHandle (hObject=0x16c) returned 1 [0098.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 1 [0098.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.461] lstrlenW (lpString=".doc") returned 4 [0098.461] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.461] lstrlenW (lpString=".docx") returned 5 [0098.461] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0098.461] lstrlenW (lpString=".pdf") returned 4 [0098.461] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.461] lstrlenW (lpString=".xls") returned 4 [0098.461] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.461] lstrlenW (lpString=".xlsx") returned 5 [0098.461] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0098.461] lstrlenW (lpString=".ppt") returned 4 [0098.461] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.462] lstrlenW (lpString=".zip") returned 4 [0098.462] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.462] lstrlenW (lpString=".rar") returned 4 [0098.462] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.462] lstrlenW (lpString=".bz2") returned 4 [0098.462] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.462] lstrlenW (lpString=".7z") returned 3 [0098.462] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.462] lstrlenW (lpString=".dbf") returned 4 [0098.462] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.462] lstrlenW (lpString=".1cd") returned 4 [0098.462] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0098.462] lstrlenW (lpString=".jpg") returned 4 [0098.462] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.462] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") [0098.463] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0098.463] CloseHandle (hObject=0x16c) returned 1 [0098.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 0x20 [0098.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0098.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0098.463] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.463] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0098.464] GetLastError () returned 0x0 [0098.464] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0098.489] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0098.489] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.490] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.490] SetEndOfFile (hFile=0x168) returned 1 [0098.708] CloseHandle (hObject=0x168) returned 1 [0098.775] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.775] SetEndOfFile (hFile=0x16c) returned 1 [0098.776] CloseHandle (hObject=0x16c) returned 1 [0098.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0098.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 1 [0098.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.782] lstrlenW (lpString=".doc") returned 4 [0098.782] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0098.782] lstrlenW (lpString=".docx") returned 5 [0098.782] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0098.782] lstrlenW (lpString=".pdf") returned 4 [0098.782] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0098.782] lstrlenW (lpString=".xls") returned 4 [0098.782] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0098.782] lstrlenW (lpString=".xlsx") returned 5 [0098.782] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0098.782] lstrlenW (lpString=".ppt") returned 4 [0098.782] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0098.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.782] lstrlenW (lpString=".zip") returned 4 [0098.782] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0098.782] lstrlenW (lpString=".rar") returned 4 [0098.782] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0098.782] lstrlenW (lpString=".bz2") returned 4 [0098.782] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0098.782] lstrlenW (lpString=".7z") returned 3 [0098.782] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0098.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.782] lstrlenW (lpString=".dbf") returned 4 [0098.782] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0098.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.783] lstrlenW (lpString=".1cd") returned 4 [0098.783] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0098.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0098.783] lstrlenW (lpString=".jpg") returned 4 [0098.783] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0098.783] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") [0099.247] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0099.247] CloseHandle (hObject=0x22c) returned 1 [0099.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 0x20 [0099.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.247] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.247] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.248] GetLastError () returned 0x0 [0099.248] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0099.249] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.250] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.250] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.250] SetEndOfFile (hFile=0x168) returned 1 [0099.250] CloseHandle (hObject=0x168) returned 1 [0099.251] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.251] SetEndOfFile (hFile=0x22c) returned 1 [0099.251] CloseHandle (hObject=0x22c) returned 1 [0099.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 1 [0099.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.252] lstrlenW (lpString=".doc") returned 4 [0099.252] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.252] lstrlenW (lpString=".docx") returned 5 [0099.252] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.252] lstrlenW (lpString=".pdf") returned 4 [0099.252] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.252] lstrlenW (lpString=".xls") returned 4 [0099.252] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.252] lstrlenW (lpString=".xlsx") returned 5 [0099.252] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.252] lstrlenW (lpString=".ppt") returned 4 [0099.252] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.252] lstrlenW (lpString=".zip") returned 4 [0099.252] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.252] lstrlenW (lpString=".rar") returned 4 [0099.252] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.252] lstrlenW (lpString=".bz2") returned 4 [0099.252] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.252] lstrlenW (lpString=".7z") returned 3 [0099.252] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.252] lstrlenW (lpString=".dbf") returned 4 [0099.252] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.252] lstrlenW (lpString=".1cd") returned 4 [0099.253] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0099.253] lstrlenW (lpString=".jpg") returned 4 [0099.253] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.253] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") [0099.253] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0099.253] CloseHandle (hObject=0x22c) returned 1 [0099.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 0x20 [0099.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.254] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.254] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0099.254] GetLastError () returned 0x0 [0099.254] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.264] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.265] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.266] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.266] SetEndOfFile (hFile=0x168) returned 1 [0099.266] CloseHandle (hObject=0x168) returned 1 [0099.266] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.266] SetEndOfFile (hFile=0x22c) returned 1 [0099.267] CloseHandle (hObject=0x22c) returned 1 [0099.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 1 [0099.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.267] lstrlenW (lpString=".doc") returned 4 [0099.267] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.267] lstrlenW (lpString=".docx") returned 5 [0099.267] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.267] lstrlenW (lpString=".pdf") returned 4 [0099.267] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.267] lstrlenW (lpString=".xls") returned 4 [0099.267] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.267] lstrlenW (lpString=".xlsx") returned 5 [0099.267] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.267] lstrlenW (lpString=".ppt") returned 4 [0099.267] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.267] lstrlenW (lpString=".zip") returned 4 [0099.268] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.268] lstrlenW (lpString=".rar") returned 4 [0099.268] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.268] lstrlenW (lpString=".bz2") returned 4 [0099.268] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.268] lstrlenW (lpString=".7z") returned 3 [0099.268] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.268] lstrlenW (lpString=".dbf") returned 4 [0099.268] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.268] lstrlenW (lpString=".1cd") returned 4 [0099.268] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0099.268] lstrlenW (lpString=".jpg") returned 4 [0099.268] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.268] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") [0099.270] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=807) returned 1 [0099.270] CloseHandle (hObject=0x22c) returned 1 [0099.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 0x20 [0099.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.270] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.270] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.431] GetLastError () returned 0x0 [0099.431] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x327, lpOverlapped=0x0) returned 1 [0099.433] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x330, lpOverlapped=0x0) returned 1 [0099.434] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.434] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.434] SetEndOfFile (hFile=0x1c0) returned 1 [0099.434] CloseHandle (hObject=0x1c0) returned 1 [0099.434] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.434] SetEndOfFile (hFile=0x22c) returned 1 [0099.435] CloseHandle (hObject=0x22c) returned 1 [0099.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 1 [0099.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.435] lstrlenW (lpString=".doc") returned 4 [0099.435] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.435] lstrlenW (lpString=".docx") returned 5 [0099.435] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0099.435] lstrlenW (lpString=".pdf") returned 4 [0099.436] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString=".xls") returned 4 [0099.436] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString=".xlsx") returned 5 [0099.436] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0099.436] lstrlenW (lpString=".ppt") returned 4 [0099.436] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.436] lstrlenW (lpString=".zip") returned 4 [0099.436] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString=".rar") returned 4 [0099.436] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString=".bz2") returned 4 [0099.436] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.436] lstrlenW (lpString=".7z") returned 3 [0099.436] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.436] lstrlenW (lpString=".dbf") returned 4 [0099.436] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.436] lstrlenW (lpString=".1cd") returned 4 [0099.436] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0099.436] lstrlenW (lpString=".jpg") returned 4 [0099.436] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.436] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") [0099.437] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0099.437] CloseHandle (hObject=0x22c) returned 1 [0099.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 0x20 [0099.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.437] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.437] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.438] GetLastError () returned 0x0 [0099.438] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0099.440] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.441] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.441] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.441] SetEndOfFile (hFile=0x1c0) returned 1 [0099.441] CloseHandle (hObject=0x1c0) returned 1 [0099.441] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.441] SetEndOfFile (hFile=0x22c) returned 1 [0099.442] CloseHandle (hObject=0x22c) returned 1 [0099.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 1 [0099.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.442] lstrlenW (lpString=".doc") returned 4 [0099.442] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.442] lstrlenW (lpString=".docx") returned 5 [0099.443] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.443] lstrlenW (lpString=".pdf") returned 4 [0099.443] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.443] lstrlenW (lpString=".xls") returned 4 [0099.443] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.443] lstrlenW (lpString=".xlsx") returned 5 [0099.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.443] lstrlenW (lpString=".ppt") returned 4 [0099.443] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.443] lstrlenW (lpString=".zip") returned 4 [0099.443] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.443] lstrlenW (lpString=".rar") returned 4 [0099.443] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.443] lstrlenW (lpString=".bz2") returned 4 [0099.443] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.443] lstrlenW (lpString=".7z") returned 3 [0099.443] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.443] lstrlenW (lpString=".dbf") returned 4 [0099.443] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.443] lstrlenW (lpString=".1cd") returned 4 [0099.443] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0099.443] lstrlenW (lpString=".jpg") returned 4 [0099.443] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.443] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") [0099.444] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0099.444] CloseHandle (hObject=0x22c) returned 1 [0099.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 0x20 [0099.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.444] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.444] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.445] GetLastError () returned 0x0 [0099.445] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.447] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.448] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.448] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.448] SetEndOfFile (hFile=0x1c0) returned 1 [0099.449] CloseHandle (hObject=0x1c0) returned 1 [0099.449] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.449] SetEndOfFile (hFile=0x22c) returned 1 [0099.449] CloseHandle (hObject=0x22c) returned 1 [0099.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 1 [0099.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.450] lstrlenW (lpString=".doc") returned 4 [0099.450] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.450] lstrlenW (lpString=".docx") returned 5 [0099.450] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.450] lstrlenW (lpString=".pdf") returned 4 [0099.450] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.450] lstrlenW (lpString=".xls") returned 4 [0099.450] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.450] lstrlenW (lpString=".xlsx") returned 5 [0099.450] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.450] lstrlenW (lpString=".ppt") returned 4 [0099.450] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.450] lstrlenW (lpString=".zip") returned 4 [0099.450] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.450] lstrlenW (lpString=".rar") returned 4 [0099.450] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.450] lstrlenW (lpString=".bz2") returned 4 [0099.450] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.450] lstrlenW (lpString=".7z") returned 3 [0099.451] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.451] lstrlenW (lpString=".dbf") returned 4 [0099.451] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.451] lstrlenW (lpString=".1cd") returned 4 [0099.451] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0099.451] lstrlenW (lpString=".jpg") returned 4 [0099.451] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.451] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") [0099.451] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0099.451] CloseHandle (hObject=0x22c) returned 1 [0099.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 0x20 [0099.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.452] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.452] GetLastError () returned 0x0 [0099.452] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0099.454] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.455] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.455] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0099.455] SetEndOfFile (hFile=0x1c0) returned 1 [0099.455] CloseHandle (hObject=0x1c0) returned 1 [0099.455] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.455] SetEndOfFile (hFile=0x22c) returned 1 [0099.456] CloseHandle (hObject=0x22c) returned 1 [0099.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 1 [0099.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.456] lstrlenW (lpString=".doc") returned 4 [0099.456] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.456] lstrlenW (lpString=".docx") returned 5 [0099.456] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.456] lstrlenW (lpString=".pdf") returned 4 [0099.456] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.456] lstrlenW (lpString=".xls") returned 4 [0099.456] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.456] lstrlenW (lpString=".xlsx") returned 5 [0099.457] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.457] lstrlenW (lpString=".ppt") returned 4 [0099.457] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.457] lstrlenW (lpString=".zip") returned 4 [0099.457] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.457] lstrlenW (lpString=".rar") returned 4 [0099.457] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.457] lstrlenW (lpString=".bz2") returned 4 [0099.457] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.457] lstrlenW (lpString=".7z") returned 3 [0099.457] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.457] lstrlenW (lpString=".dbf") returned 4 [0099.457] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.457] lstrlenW (lpString=".1cd") returned 4 [0099.457] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0099.457] lstrlenW (lpString=".jpg") returned 4 [0099.457] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.457] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") [0099.458] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=797) returned 1 [0099.458] CloseHandle (hObject=0x22c) returned 1 [0099.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 0x20 [0099.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.459] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.459] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.459] GetLastError () returned 0x0 [0099.459] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x31d, lpOverlapped=0x0) returned 1 [0099.460] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x320, lpOverlapped=0x0) returned 1 [0099.462] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.462] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.462] SetEndOfFile (hFile=0x1c0) returned 1 [0099.462] CloseHandle (hObject=0x1c0) returned 1 [0099.462] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.462] SetEndOfFile (hFile=0x22c) returned 1 [0099.463] CloseHandle (hObject=0x22c) returned 1 [0099.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 1 [0099.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.463] lstrlenW (lpString=".doc") returned 4 [0099.463] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.463] lstrlenW (lpString=".docx") returned 5 [0099.463] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0099.463] lstrlenW (lpString=".pdf") returned 4 [0099.463] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.463] lstrlenW (lpString=".xls") returned 4 [0099.463] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.463] lstrlenW (lpString=".xlsx") returned 5 [0099.463] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0099.463] lstrlenW (lpString=".ppt") returned 4 [0099.463] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.463] lstrlenW (lpString=".zip") returned 4 [0099.464] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.464] lstrlenW (lpString=".rar") returned 4 [0099.464] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.464] lstrlenW (lpString=".bz2") returned 4 [0099.464] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.464] lstrlenW (lpString=".7z") returned 3 [0099.464] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.464] lstrlenW (lpString=".dbf") returned 4 [0099.464] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.464] lstrlenW (lpString=".1cd") returned 4 [0099.464] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0099.464] lstrlenW (lpString=".jpg") returned 4 [0099.464] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.464] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") [0099.465] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1078) returned 1 [0099.465] CloseHandle (hObject=0x22c) returned 1 [0099.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 0x20 [0099.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.465] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.465] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.465] GetLastError () returned 0x0 [0099.465] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x436, lpOverlapped=0x0) returned 1 [0099.467] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.468] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.468] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.468] SetEndOfFile (hFile=0x1c0) returned 1 [0099.468] CloseHandle (hObject=0x1c0) returned 1 [0099.468] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.468] SetEndOfFile (hFile=0x22c) returned 1 [0099.469] CloseHandle (hObject=0x22c) returned 1 [0099.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 1 [0099.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.469] lstrlenW (lpString=".doc") returned 4 [0099.469] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.469] lstrlenW (lpString=".docx") returned 5 [0099.469] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0099.469] lstrlenW (lpString=".pdf") returned 4 [0099.470] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.470] lstrlenW (lpString=".xls") returned 4 [0099.470] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.470] lstrlenW (lpString=".xlsx") returned 5 [0099.470] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0099.470] lstrlenW (lpString=".ppt") returned 4 [0099.470] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.470] lstrlenW (lpString=".zip") returned 4 [0099.470] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.470] lstrlenW (lpString=".rar") returned 4 [0099.470] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.470] lstrlenW (lpString=".bz2") returned 4 [0099.470] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.470] lstrlenW (lpString=".7z") returned 3 [0099.470] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.470] lstrlenW (lpString=".dbf") returned 4 [0099.470] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.470] lstrlenW (lpString=".1cd") returned 4 [0099.470] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0099.470] lstrlenW (lpString=".jpg") returned 4 [0099.470] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.470] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") [0099.471] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0099.471] CloseHandle (hObject=0x22c) returned 1 [0099.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 0x20 [0099.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.471] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.472] GetLastError () returned 0x0 [0099.472] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.473] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.474] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.474] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.474] SetEndOfFile (hFile=0x1c0) returned 1 [0099.475] CloseHandle (hObject=0x1c0) returned 1 [0099.475] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.475] SetEndOfFile (hFile=0x22c) returned 1 [0099.475] CloseHandle (hObject=0x22c) returned 1 [0099.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 1 [0099.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.476] lstrlenW (lpString=".doc") returned 4 [0099.476] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.476] lstrlenW (lpString=".docx") returned 5 [0099.476] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.476] lstrlenW (lpString=".pdf") returned 4 [0099.476] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.476] lstrlenW (lpString=".xls") returned 4 [0099.476] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.476] lstrlenW (lpString=".xlsx") returned 5 [0099.476] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.476] lstrlenW (lpString=".ppt") returned 4 [0099.476] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.476] lstrlenW (lpString=".zip") returned 4 [0099.476] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.476] lstrlenW (lpString=".rar") returned 4 [0099.476] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.476] lstrlenW (lpString=".bz2") returned 4 [0099.476] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.477] lstrlenW (lpString=".7z") returned 3 [0099.477] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.477] lstrlenW (lpString=".dbf") returned 4 [0099.477] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.477] lstrlenW (lpString=".1cd") returned 4 [0099.477] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0099.477] lstrlenW (lpString=".jpg") returned 4 [0099.477] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.477] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") [0099.477] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2998) returned 1 [0099.477] CloseHandle (hObject=0x22c) returned 1 [0099.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico")) returned 0x20 [0099.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.478] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.478] GetLastError () returned 0x0 [0099.478] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0099.480] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0099.481] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.481] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0099.481] SetEndOfFile (hFile=0x1c0) returned 1 [0099.481] CloseHandle (hObject=0x1c0) returned 1 [0099.481] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.481] SetEndOfFile (hFile=0x22c) returned 1 [0099.482] CloseHandle (hObject=0x22c) returned 1 [0099.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico")) returned 1 [0099.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.483] lstrlenW (lpString=".doc") returned 4 [0099.483] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.483] lstrlenW (lpString=".docx") returned 5 [0099.483] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0099.483] lstrlenW (lpString=".pdf") returned 4 [0099.483] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.483] lstrlenW (lpString=".xls") returned 4 [0099.483] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.483] lstrlenW (lpString=".xlsx") returned 5 [0099.483] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0099.483] lstrlenW (lpString=".ppt") returned 4 [0099.483] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.483] lstrlenW (lpString=".zip") returned 4 [0099.483] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.483] lstrlenW (lpString=".rar") returned 4 [0099.483] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.483] lstrlenW (lpString=".bz2") returned 4 [0099.483] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.483] lstrlenW (lpString=".7z") returned 3 [0099.483] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.483] lstrlenW (lpString=".dbf") returned 4 [0099.483] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.483] lstrlenW (lpString=".1cd") returned 4 [0099.483] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0099.483] lstrlenW (lpString=".jpg") returned 4 [0099.483] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.483] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") [0099.484] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=806) returned 1 [0099.484] CloseHandle (hObject=0x22c) returned 1 [0099.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 0x20 [0099.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.485] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.485] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.485] GetLastError () returned 0x0 [0099.485] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x326, lpOverlapped=0x0) returned 1 [0099.487] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x330, lpOverlapped=0x0) returned 1 [0099.488] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.488] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0099.488] SetEndOfFile (hFile=0x1c0) returned 1 [0099.488] CloseHandle (hObject=0x1c0) returned 1 [0099.488] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.488] SetEndOfFile (hFile=0x22c) returned 1 [0099.489] CloseHandle (hObject=0x22c) returned 1 [0099.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 1 [0099.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.489] lstrlenW (lpString=".doc") returned 4 [0099.489] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0099.489] lstrlenW (lpString=".docx") returned 5 [0099.489] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0099.490] lstrlenW (lpString=".pdf") returned 4 [0099.490] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString=".xls") returned 4 [0099.490] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString=".xlsx") returned 5 [0099.490] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0099.490] lstrlenW (lpString=".ppt") returned 4 [0099.490] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.490] lstrlenW (lpString=".zip") returned 4 [0099.490] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString=".rar") returned 4 [0099.490] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString=".bz2") returned 4 [0099.490] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0099.490] lstrlenW (lpString=".7z") returned 3 [0099.490] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.490] lstrlenW (lpString=".dbf") returned 4 [0099.490] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.490] lstrlenW (lpString=".1cd") returned 4 [0099.490] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0099.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0099.490] lstrlenW (lpString=".jpg") returned 4 [0099.490] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0099.490] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") [0099.491] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=559411) returned 1 [0099.491] CloseHandle (hObject=0x22c) returned 1 [0099.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 0x20 [0099.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.491] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.491] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0099.492] GetLastError () returned 0x0 [0099.492] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x88933, lpOverlapped=0x0) returned 1 [0099.505] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x88940, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x88940, lpOverlapped=0x0) returned 1 [0099.516] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.516] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.516] SetEndOfFile (hFile=0x1c0) returned 1 [0099.516] CloseHandle (hObject=0x1c0) returned 1 [0099.516] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.517] SetEndOfFile (hFile=0x22c) returned 1 [0099.522] CloseHandle (hObject=0x22c) returned 1 [0099.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0099.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 1 [0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.522] lstrlenW (lpString=".doc") returned 4 [0099.522] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0099.522] lstrlenW (lpString=".docx") returned 5 [0099.522] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0099.522] lstrlenW (lpString=".pdf") returned 4 [0099.522] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0099.522] lstrlenW (lpString=".xls") returned 4 [0099.522] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0099.522] lstrlenW (lpString=".xlsx") returned 5 [0099.522] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0099.522] lstrlenW (lpString=".ppt") returned 4 [0099.522] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0099.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.522] lstrlenW (lpString=".zip") returned 4 [0099.522] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0099.522] lstrlenW (lpString=".rar") returned 4 [0099.523] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0099.523] lstrlenW (lpString=".bz2") returned 4 [0099.523] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0099.523] lstrlenW (lpString=".7z") returned 3 [0099.523] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0099.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.523] lstrlenW (lpString=".dbf") returned 4 [0099.523] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0099.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.523] lstrlenW (lpString=".1cd") returned 4 [0099.523] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0099.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0099.523] lstrlenW (lpString=".jpg") returned 4 [0099.523] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0099.523] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") [0099.827] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1561448) returned 1 [0099.827] CloseHandle (hObject=0x1fc) returned 1 [0099.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll")) returned 0x20 [0099.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0099.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0099.827] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.827] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0099.828] GetLastError () returned 0x0 [0099.828] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0099.887] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0100.075] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7d378, lpOverlapped=0x0) returned 1 [0100.090] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7d380, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7d380, lpOverlapped=0x0) returned 1 [0100.175] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.176] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0100.176] SetEndOfFile (hFile=0x158) returned 1 [0100.176] CloseHandle (hObject=0x158) returned 1 [0100.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.176] SetEndOfFile (hFile=0x1fc) returned 1 [0100.180] CloseHandle (hObject=0x1fc) returned 1 [0100.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll")) returned 1 [0100.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.428] lstrlenW (lpString=".doc") returned 4 [0100.428] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.428] lstrlenW (lpString=".docx") returned 5 [0100.428] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0100.428] lstrlenW (lpString=".pdf") returned 4 [0100.428] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.428] lstrlenW (lpString=".xls") returned 4 [0100.428] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.428] lstrlenW (lpString=".xlsx") returned 5 [0100.428] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0100.428] lstrlenW (lpString=".ppt") returned 4 [0100.429] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.429] lstrlenW (lpString=".zip") returned 4 [0100.429] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.429] lstrlenW (lpString=".rar") returned 4 [0100.429] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.429] lstrlenW (lpString=".bz2") returned 4 [0100.429] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.429] lstrlenW (lpString=".7z") returned 3 [0100.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.429] lstrlenW (lpString=".dbf") returned 4 [0100.429] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.429] lstrlenW (lpString=".1cd") returned 4 [0100.429] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0100.429] lstrlenW (lpString=".jpg") returned 4 [0100.429] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.429] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") [0100.430] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=149723) returned 1 [0100.430] CloseHandle (hObject=0x1fc) returned 1 [0100.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt")) returned 0x20 [0100.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.431] GetLastError () returned 0x0 [0100.431] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x248db, lpOverlapped=0x0) returned 1 [0100.435] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x248e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x248e0, lpOverlapped=0x0) returned 1 [0100.438] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.439] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x100, lpOverlapped=0x0) returned 1 [0100.439] SetEndOfFile (hFile=0x158) returned 1 [0100.439] CloseHandle (hObject=0x158) returned 1 [0100.439] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.439] SetEndOfFile (hFile=0x1fc) returned 1 [0100.440] CloseHandle (hObject=0x1fc) returned 1 [0100.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt")) returned 1 [0100.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.441] lstrlenW (lpString=".doc") returned 4 [0100.441] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.441] lstrlenW (lpString=".docx") returned 5 [0100.441] lstrcmpiW (lpString1=".docx", lpString2="n.fdt") returned -1 [0100.441] lstrlenW (lpString=".pdf") returned 4 [0100.441] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.441] lstrlenW (lpString=".xls") returned 4 [0100.441] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.441] lstrlenW (lpString=".xlsx") returned 5 [0100.441] lstrcmpiW (lpString1=".xlsx", lpString2="n.fdt") returned -1 [0100.441] lstrlenW (lpString=".ppt") returned 4 [0100.441] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.441] lstrlenW (lpString=".zip") returned 4 [0100.441] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.441] lstrlenW (lpString=".rar") returned 4 [0100.441] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.441] lstrlenW (lpString=".bz2") returned 4 [0100.441] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.441] lstrlenW (lpString=".7z") returned 3 [0100.442] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.442] lstrlenW (lpString=".dbf") returned 4 [0100.442] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.442] lstrlenW (lpString=".1cd") returned 4 [0100.442] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0100.442] lstrlenW (lpString=".jpg") returned 4 [0100.442] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.442] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") [0100.443] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=97645) returned 1 [0100.443] CloseHandle (hObject=0x1fc) returned 1 [0100.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt")) returned 0x20 [0100.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.443] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.443] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.444] GetLastError () returned 0x0 [0100.444] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x17d6d, lpOverlapped=0x0) returned 1 [0100.447] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x17d70, lpOverlapped=0x0) returned 1 [0100.449] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.449] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.449] SetEndOfFile (hFile=0x158) returned 1 [0100.450] CloseHandle (hObject=0x158) returned 1 [0100.450] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.450] SetEndOfFile (hFile=0x1fc) returned 1 [0100.451] CloseHandle (hObject=0x1fc) returned 1 [0100.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt")) returned 1 [0100.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.451] lstrlenW (lpString=".doc") returned 4 [0100.451] lstrcmpiW (lpString1=".doc", lpString2=".FDT") returned -1 [0100.451] lstrlenW (lpString=".docx") returned 5 [0100.452] lstrcmpiW (lpString1=".docx", lpString2="S.FDT") returned -1 [0100.452] lstrlenW (lpString=".pdf") returned 4 [0100.452] lstrcmpiW (lpString1=".pdf", lpString2=".FDT") returned 1 [0100.452] lstrlenW (lpString=".xls") returned 4 [0100.452] lstrcmpiW (lpString1=".xls", lpString2=".FDT") returned 1 [0100.452] lstrlenW (lpString=".xlsx") returned 5 [0100.452] lstrcmpiW (lpString1=".xlsx", lpString2="S.FDT") returned -1 [0100.452] lstrlenW (lpString=".ppt") returned 4 [0100.452] lstrcmpiW (lpString1=".ppt", lpString2=".FDT") returned 1 [0100.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.452] lstrlenW (lpString=".zip") returned 4 [0100.452] lstrcmpiW (lpString1=".zip", lpString2=".FDT") returned 1 [0100.452] lstrlenW (lpString=".rar") returned 4 [0100.452] lstrcmpiW (lpString1=".rar", lpString2=".FDT") returned 1 [0100.452] lstrlenW (lpString=".bz2") returned 4 [0100.452] lstrcmpiW (lpString1=".bz2", lpString2=".FDT") returned -1 [0100.452] lstrlenW (lpString=".7z") returned 3 [0100.452] lstrcmpiW (lpString1=".7z", lpString2="FDT") returned -1 [0100.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.452] lstrlenW (lpString=".dbf") returned 4 [0100.452] lstrcmpiW (lpString1=".dbf", lpString2=".FDT") returned -1 [0100.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.452] lstrlenW (lpString=".1cd") returned 4 [0100.452] lstrcmpiW (lpString1=".1cd", lpString2=".FDT") returned -1 [0100.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0100.452] lstrlenW (lpString=".jpg") returned 4 [0100.452] lstrcmpiW (lpString1=".jpg", lpString2=".FDT") returned 1 [0100.452] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") [0100.453] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=92979) returned 1 [0100.453] CloseHandle (hObject=0x1fc) returned 1 [0100.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt")) returned 0x20 [0100.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.453] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.453] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0100.454] GetLastError () returned 0x0 [0100.454] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x16b33, lpOverlapped=0x0) returned 1 [0100.457] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x16b40, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x16b40, lpOverlapped=0x0) returned 1 [0100.460] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.460] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0100.460] SetEndOfFile (hFile=0x158) returned 1 [0100.460] CloseHandle (hObject=0x158) returned 1 [0100.460] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.460] SetEndOfFile (hFile=0x1fc) returned 1 [0100.461] CloseHandle (hObject=0x1fc) returned 1 [0100.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt")) returned 1 [0100.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.462] lstrlenW (lpString=".doc") returned 4 [0100.462] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.462] lstrlenW (lpString=".docx") returned 5 [0100.462] lstrcmpiW (lpString1=".docx", lpString2="y.fdt") returned -1 [0100.462] lstrlenW (lpString=".pdf") returned 4 [0100.462] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.462] lstrlenW (lpString=".xls") returned 4 [0100.462] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.462] lstrlenW (lpString=".xlsx") returned 5 [0100.462] lstrcmpiW (lpString1=".xlsx", lpString2="y.fdt") returned -1 [0100.462] lstrlenW (lpString=".ppt") returned 4 [0100.462] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.462] lstrlenW (lpString=".zip") returned 4 [0100.462] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.462] lstrlenW (lpString=".rar") returned 4 [0100.462] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.462] lstrlenW (lpString=".bz2") returned 4 [0100.462] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.462] lstrlenW (lpString=".7z") returned 3 [0100.462] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.462] lstrlenW (lpString=".dbf") returned 4 [0100.462] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.462] lstrlenW (lpString=".1cd") returned 4 [0100.462] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0100.463] lstrlenW (lpString=".jpg") returned 4 [0100.463] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.463] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") [0100.662] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=102061) returned 1 [0100.662] CloseHandle (hObject=0x16c) returned 1 [0100.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt")) returned 0x20 [0100.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0100.662] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.662] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.663] GetLastError () returned 0x0 [0100.663] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x18ead, lpOverlapped=0x0) returned 1 [0100.667] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x18eb0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x18eb0, lpOverlapped=0x0) returned 1 [0100.669] ReadFile (in: hFile=0x16c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.669] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0100.669] SetEndOfFile (hFile=0x1fc) returned 1 [0100.669] CloseHandle (hObject=0x1fc) returned 1 [0100.669] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.669] SetEndOfFile (hFile=0x16c) returned 1 [0100.671] CloseHandle (hObject=0x16c) returned 1 [0100.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt")) returned 1 [0100.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.671] lstrlenW (lpString=".doc") returned 4 [0100.671] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0100.671] lstrlenW (lpString=".docx") returned 5 [0100.671] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0100.671] lstrlenW (lpString=".pdf") returned 4 [0100.671] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0100.671] lstrlenW (lpString=".xls") returned 4 [0100.671] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0100.671] lstrlenW (lpString=".xlsx") returned 5 [0100.671] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0100.671] lstrlenW (lpString=".ppt") returned 4 [0100.672] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0100.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.672] lstrlenW (lpString=".zip") returned 4 [0100.672] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0100.672] lstrlenW (lpString=".rar") returned 4 [0100.672] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0100.672] lstrlenW (lpString=".bz2") returned 4 [0100.672] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0100.672] lstrlenW (lpString=".7z") returned 3 [0100.672] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0100.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.672] lstrlenW (lpString=".dbf") returned 4 [0100.672] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0100.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.672] lstrlenW (lpString=".1cd") returned 4 [0100.672] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0100.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0100.672] lstrlenW (lpString=".jpg") returned 4 [0100.672] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0100.672] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") [0100.680] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=318) returned 1 [0100.680] CloseHandle (hObject=0x1fc) returned 1 [0100.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico")) returned 0x20 [0100.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0100.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.681] GetLastError () returned 0x0 [0100.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.682] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.683] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.683] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.683] SetEndOfFile (hFile=0x19c) returned 1 [0100.684] CloseHandle (hObject=0x19c) returned 1 [0100.684] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.684] SetEndOfFile (hFile=0x1fc) returned 1 [0100.684] CloseHandle (hObject=0x1fc) returned 1 [0100.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico")) returned 1 [0100.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.685] lstrlenW (lpString=".doc") returned 4 [0100.685] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.685] lstrlenW (lpString=".docx") returned 5 [0100.685] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0100.685] lstrlenW (lpString=".pdf") returned 4 [0100.685] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.685] lstrlenW (lpString=".xls") returned 4 [0100.685] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.685] lstrlenW (lpString=".xlsx") returned 5 [0100.685] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0100.685] lstrlenW (lpString=".ppt") returned 4 [0100.685] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.685] lstrlenW (lpString=".zip") returned 4 [0100.685] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.685] lstrlenW (lpString=".rar") returned 4 [0100.685] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.685] lstrlenW (lpString=".bz2") returned 4 [0100.685] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.685] lstrlenW (lpString=".7z") returned 3 [0100.686] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.686] lstrlenW (lpString=".dbf") returned 4 [0100.686] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.686] lstrlenW (lpString=".1cd") returned 4 [0100.686] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0100.686] lstrlenW (lpString=".jpg") returned 4 [0100.686] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.686] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") [0100.725] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=318) returned 1 [0100.726] CloseHandle (hObject=0x210) returned 1 [0100.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico")) returned 0x20 [0100.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.726] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.726] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0100.727] GetLastError () returned 0x0 [0100.727] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x13e, lpOverlapped=0x0) returned 1 [0100.728] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x140, lpOverlapped=0x0) returned 1 [0100.729] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.729] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.729] SetEndOfFile (hFile=0x168) returned 1 [0100.729] CloseHandle (hObject=0x168) returned 1 [0100.729] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.729] SetEndOfFile (hFile=0x210) returned 1 [0100.730] CloseHandle (hObject=0x210) returned 1 [0100.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico")) returned 1 [0100.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.730] lstrlenW (lpString=".doc") returned 4 [0100.730] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.730] lstrlenW (lpString=".docx") returned 5 [0100.730] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0100.730] lstrlenW (lpString=".pdf") returned 4 [0100.730] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.730] lstrlenW (lpString=".xls") returned 4 [0100.731] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.731] lstrlenW (lpString=".xlsx") returned 5 [0100.731] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0100.731] lstrlenW (lpString=".ppt") returned 4 [0100.731] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.731] lstrlenW (lpString=".zip") returned 4 [0100.731] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.731] lstrlenW (lpString=".rar") returned 4 [0100.731] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.731] lstrlenW (lpString=".bz2") returned 4 [0100.731] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.731] lstrlenW (lpString=".7z") returned 3 [0100.731] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.731] lstrlenW (lpString=".dbf") returned 4 [0100.731] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.731] lstrlenW (lpString=".1cd") returned 4 [0100.731] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0100.731] lstrlenW (lpString=".jpg") returned 4 [0100.731] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.731] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") [0100.905] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1718) returned 1 [0100.905] CloseHandle (hObject=0x1c0) returned 1 [0100.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico")) returned 0x20 [0100.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0100.906] GetLastError () returned 0x0 [0100.906] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6b6, lpOverlapped=0x0) returned 1 [0100.914] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0100.915] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.915] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0100.915] SetEndOfFile (hFile=0x1a0) returned 1 [0100.915] CloseHandle (hObject=0x1a0) returned 1 [0100.915] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.915] SetEndOfFile (hFile=0x1c0) returned 1 [0100.916] CloseHandle (hObject=0x1c0) returned 1 [0100.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico")) returned 1 [0100.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.916] lstrlenW (lpString=".doc") returned 4 [0100.916] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0100.916] lstrlenW (lpString=".docx") returned 5 [0100.917] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0100.917] lstrlenW (lpString=".pdf") returned 4 [0100.917] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0100.917] lstrlenW (lpString=".xls") returned 4 [0100.917] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0100.917] lstrlenW (lpString=".xlsx") returned 5 [0100.917] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0100.917] lstrlenW (lpString=".ppt") returned 4 [0100.917] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.917] lstrlenW (lpString=".zip") returned 4 [0100.917] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0100.917] lstrlenW (lpString=".rar") returned 4 [0100.917] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0100.917] lstrlenW (lpString=".bz2") returned 4 [0100.917] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0100.917] lstrlenW (lpString=".7z") returned 3 [0100.917] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.917] lstrlenW (lpString=".dbf") returned 4 [0100.917] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.917] lstrlenW (lpString=".1cd") returned 4 [0100.917] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0100.917] lstrlenW (lpString=".jpg") returned 4 [0100.917] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0100.917] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") [0100.918] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2862) returned 1 [0100.918] CloseHandle (hObject=0x1c0) returned 1 [0100.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico")) returned 0x20 [0100.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.918] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.918] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0100.919] GetLastError () returned 0x0 [0100.919] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0100.926] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0100.927] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.928] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0100.928] SetEndOfFile (hFile=0x1a0) returned 1 [0100.928] CloseHandle (hObject=0x1a0) returned 1 [0100.928] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.928] SetEndOfFile (hFile=0x1c0) returned 1 [0100.929] CloseHandle (hObject=0x1c0) returned 1 [0100.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico")) returned 1 [0100.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.929] lstrlenW (lpString=".doc") returned 4 [0100.929] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0100.929] lstrlenW (lpString=".docx") returned 5 [0100.929] lstrcmpiW (lpString1=".docx", lpString2="o.ico") returned -1 [0100.929] lstrlenW (lpString=".pdf") returned 4 [0100.929] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0100.929] lstrlenW (lpString=".xls") returned 4 [0100.929] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0100.929] lstrlenW (lpString=".xlsx") returned 5 [0100.929] lstrcmpiW (lpString1=".xlsx", lpString2="o.ico") returned -1 [0100.929] lstrlenW (lpString=".ppt") returned 4 [0100.929] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.930] lstrlenW (lpString=".zip") returned 4 [0100.930] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0100.930] lstrlenW (lpString=".rar") returned 4 [0100.930] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0100.930] lstrlenW (lpString=".bz2") returned 4 [0100.930] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0100.930] lstrlenW (lpString=".7z") returned 3 [0100.930] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.930] lstrlenW (lpString=".dbf") returned 4 [0100.930] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.930] lstrlenW (lpString=".1cd") returned 4 [0100.930] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0100.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0100.930] lstrlenW (lpString=".jpg") returned 4 [0100.930] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0100.930] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") [0100.931] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2550) returned 1 [0100.931] CloseHandle (hObject=0x1c0) returned 1 [0100.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico")) returned 0x20 [0100.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.931] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.931] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.946] GetLastError () returned 0x0 [0100.946] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9f6, lpOverlapped=0x0) returned 1 [0100.955] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0100.956] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.956] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0100.956] SetEndOfFile (hFile=0x210) returned 1 [0100.957] CloseHandle (hObject=0x210) returned 1 [0100.957] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.957] SetEndOfFile (hFile=0x1c0) returned 1 [0100.958] CloseHandle (hObject=0x1c0) returned 1 [0100.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico")) returned 1 [0100.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.958] lstrlenW (lpString=".doc") returned 4 [0100.958] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0100.958] lstrlenW (lpString=".docx") returned 5 [0100.958] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0100.958] lstrlenW (lpString=".pdf") returned 4 [0100.958] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0100.958] lstrlenW (lpString=".xls") returned 4 [0100.958] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0100.958] lstrlenW (lpString=".xlsx") returned 5 [0100.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0100.958] lstrlenW (lpString=".ppt") returned 4 [0100.959] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0100.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.959] lstrlenW (lpString=".zip") returned 4 [0100.959] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0100.959] lstrlenW (lpString=".rar") returned 4 [0100.959] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0100.959] lstrlenW (lpString=".bz2") returned 4 [0100.959] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0100.959] lstrlenW (lpString=".7z") returned 3 [0100.959] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0100.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.959] lstrlenW (lpString=".dbf") returned 4 [0100.959] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0100.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.959] lstrlenW (lpString=".1cd") returned 4 [0100.959] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0100.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0100.959] lstrlenW (lpString=".jpg") returned 4 [0100.959] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0100.959] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") [0100.960] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3438) returned 1 [0100.960] CloseHandle (hObject=0x1c0) returned 1 [0100.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico")) returned 0x20 [0100.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.960] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.960] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.961] GetLastError () returned 0x0 [0100.961] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd6e, lpOverlapped=0x0) returned 1 [0100.962] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd70, lpOverlapped=0x0) returned 1 [0100.963] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.963] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0100.963] SetEndOfFile (hFile=0x210) returned 1 [0100.964] CloseHandle (hObject=0x210) returned 1 [0100.964] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.964] SetEndOfFile (hFile=0x1c0) returned 1 [0100.964] CloseHandle (hObject=0x1c0) returned 1 [0100.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico")) returned 1 [0100.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.965] lstrlenW (lpString=".doc") returned 4 [0100.965] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.965] lstrlenW (lpString=".docx") returned 5 [0100.965] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0100.965] lstrlenW (lpString=".pdf") returned 4 [0100.965] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.965] lstrlenW (lpString=".xls") returned 4 [0100.965] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.965] lstrlenW (lpString=".xlsx") returned 5 [0100.965] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0100.965] lstrlenW (lpString=".ppt") returned 4 [0100.965] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.966] lstrlenW (lpString=".zip") returned 4 [0100.966] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.966] lstrlenW (lpString=".rar") returned 4 [0100.966] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.966] lstrlenW (lpString=".bz2") returned 4 [0100.966] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.966] lstrlenW (lpString=".7z") returned 3 [0100.966] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.966] lstrlenW (lpString=".dbf") returned 4 [0100.966] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.966] lstrlenW (lpString=".1cd") returned 4 [0100.966] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0100.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0100.966] lstrlenW (lpString=".jpg") returned 4 [0100.966] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0100.966] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") [0100.967] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3438) returned 1 [0100.967] CloseHandle (hObject=0x1c0) returned 1 [0100.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico")) returned 0x20 [0100.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0100.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0100.968] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.968] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.968] GetLastError () returned 0x0 [0100.968] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd6e, lpOverlapped=0x0) returned 1 [0100.970] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd70, lpOverlapped=0x0) returned 1 [0100.971] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.971] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.972] SetEndOfFile (hFile=0x210) returned 1 [0100.972] CloseHandle (hObject=0x210) returned 1 [0100.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.972] SetEndOfFile (hFile=0x1c0) returned 1 [0100.973] CloseHandle (hObject=0x1c0) returned 1 [0100.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0100.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico")) returned 1 [0100.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0100.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0100.973] lstrlenW (lpString=".doc") returned 4 [0100.973] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0100.973] lstrlenW (lpString=".docx") returned 5 [0100.973] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0100.973] lstrlenW (lpString=".pdf") returned 4 [0100.973] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0100.973] lstrlenW (lpString=".xls") returned 4 [0100.973] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0100.973] lstrlenW (lpString=".xlsx") returned 5 [0100.973] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0100.973] lstrlenW (lpString=".ppt") returned 4 [0100.973] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0100.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0100.974] lstrlenW (lpString=".zip") returned 4 [0100.974] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0100.974] lstrlenW (lpString=".rar") returned 4 [0100.974] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0100.974] lstrlenW (lpString=".bz2") returned 4 [0100.974] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0100.974] lstrlenW (lpString=".7z") returned 3 [0100.974] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0101.054] lstrlenW (lpString=".dbf") returned 4 [0101.054] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0101.054] lstrlenW (lpString=".1cd") returned 4 [0101.054] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0101.054] lstrlenW (lpString=".jpg") returned 4 [0101.054] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0101.054] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") [0101.074] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3438) returned 1 [0101.087] CloseHandle (hObject=0x158) returned 1 [0101.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico")) returned 0x20 [0101.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.087] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.087] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.088] GetLastError () returned 0x0 [0101.088] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd6e, lpOverlapped=0x0) returned 1 [0101.090] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd70, lpOverlapped=0x0) returned 1 [0101.091] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.091] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0101.091] SetEndOfFile (hFile=0x1fc) returned 1 [0101.091] CloseHandle (hObject=0x1fc) returned 1 [0101.091] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.091] SetEndOfFile (hFile=0x158) returned 1 [0101.092] CloseHandle (hObject=0x158) returned 1 [0101.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico")) returned 1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.092] lstrlenW (lpString=".doc") returned 4 [0101.092] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.092] lstrlenW (lpString=".docx") returned 5 [0101.092] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0101.092] lstrlenW (lpString=".pdf") returned 4 [0101.092] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.092] lstrlenW (lpString=".xls") returned 4 [0101.093] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString=".xlsx") returned 5 [0101.093] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0101.093] lstrlenW (lpString=".ppt") returned 4 [0101.093] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.093] lstrlenW (lpString=".zip") returned 4 [0101.093] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString=".rar") returned 4 [0101.093] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.093] lstrlenW (lpString=".bz2") returned 4 [0101.093] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString=".7z") returned 3 [0101.093] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.093] lstrlenW (lpString=".dbf") returned 4 [0101.093] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.093] lstrlenW (lpString=".1cd") returned 4 [0101.093] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0101.093] lstrlenW (lpString=".jpg") returned 4 [0101.093] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.093] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") [0101.094] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2862) returned 1 [0101.094] CloseHandle (hObject=0x158) returned 1 [0101.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico")) returned 0x20 [0101.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.094] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.094] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.095] GetLastError () returned 0x0 [0101.095] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.097] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.098] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.098] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0101.098] SetEndOfFile (hFile=0x1fc) returned 1 [0101.098] CloseHandle (hObject=0x1fc) returned 1 [0101.098] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.098] SetEndOfFile (hFile=0x158) returned 1 [0101.099] CloseHandle (hObject=0x158) returned 1 [0101.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico")) returned 1 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString=".doc") returned 4 [0101.100] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.100] lstrlenW (lpString=".docx") returned 5 [0101.100] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0101.100] lstrlenW (lpString=".pdf") returned 4 [0101.100] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.100] lstrlenW (lpString=".xls") returned 4 [0101.100] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.100] lstrlenW (lpString=".xlsx") returned 5 [0101.100] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0101.100] lstrlenW (lpString=".ppt") returned 4 [0101.100] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString=".zip") returned 4 [0101.100] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.100] lstrlenW (lpString=".rar") returned 4 [0101.100] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.100] lstrlenW (lpString=".bz2") returned 4 [0101.100] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.100] lstrlenW (lpString=".7z") returned 3 [0101.100] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString=".dbf") returned 4 [0101.100] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString=".1cd") returned 4 [0101.100] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0101.100] lstrlenW (lpString=".jpg") returned 4 [0101.100] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.101] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") [0101.101] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2550) returned 1 [0101.101] CloseHandle (hObject=0x158) returned 1 [0101.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico")) returned 0x20 [0101.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.101] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.102] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.102] GetLastError () returned 0x0 [0101.102] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9f6, lpOverlapped=0x0) returned 1 [0101.104] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0101.105] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.105] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0101.105] SetEndOfFile (hFile=0x1fc) returned 1 [0101.105] CloseHandle (hObject=0x1fc) returned 1 [0101.105] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.105] SetEndOfFile (hFile=0x158) returned 1 [0101.106] CloseHandle (hObject=0x158) returned 1 [0101.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico")) returned 1 [0101.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.107] lstrlenW (lpString=".doc") returned 4 [0101.107] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.107] lstrlenW (lpString=".docx") returned 5 [0101.107] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0101.107] lstrlenW (lpString=".pdf") returned 4 [0101.107] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.107] lstrlenW (lpString=".xls") returned 4 [0101.107] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.107] lstrlenW (lpString=".xlsx") returned 5 [0101.107] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0101.107] lstrlenW (lpString=".ppt") returned 4 [0101.107] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.107] lstrlenW (lpString=".zip") returned 4 [0101.107] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.107] lstrlenW (lpString=".rar") returned 4 [0101.107] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.107] lstrlenW (lpString=".bz2") returned 4 [0101.107] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.107] lstrlenW (lpString=".7z") returned 3 [0101.107] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.107] lstrlenW (lpString=".dbf") returned 4 [0101.107] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.107] lstrlenW (lpString=".1cd") returned 4 [0101.107] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0101.108] lstrlenW (lpString=".jpg") returned 4 [0101.108] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.108] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") [0101.109] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2862) returned 1 [0101.109] CloseHandle (hObject=0x158) returned 1 [0101.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico")) returned 0x20 [0101.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.109] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.109] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.111] GetLastError () returned 0x0 [0101.111] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.112] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.113] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.113] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0101.113] SetEndOfFile (hFile=0x1fc) returned 1 [0101.113] CloseHandle (hObject=0x1fc) returned 1 [0101.113] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.113] SetEndOfFile (hFile=0x158) returned 1 [0101.114] CloseHandle (hObject=0x158) returned 1 [0101.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico")) returned 1 [0101.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.115] lstrlenW (lpString=".doc") returned 4 [0101.115] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.115] lstrlenW (lpString=".docx") returned 5 [0101.115] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0101.115] lstrlenW (lpString=".pdf") returned 4 [0101.115] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.115] lstrlenW (lpString=".xls") returned 4 [0101.115] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.115] lstrlenW (lpString=".xlsx") returned 5 [0101.115] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0101.115] lstrlenW (lpString=".ppt") returned 4 [0101.115] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.115] lstrlenW (lpString=".zip") returned 4 [0101.115] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.115] lstrlenW (lpString=".rar") returned 4 [0101.115] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.115] lstrlenW (lpString=".bz2") returned 4 [0101.115] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.115] lstrlenW (lpString=".7z") returned 3 [0101.115] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.115] lstrlenW (lpString=".dbf") returned 4 [0101.116] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.116] lstrlenW (lpString=".1cd") returned 4 [0101.116] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0101.116] lstrlenW (lpString=".jpg") returned 4 [0101.116] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.116] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") [0101.116] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2862) returned 1 [0101.117] CloseHandle (hObject=0x158) returned 1 [0101.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico")) returned 0x20 [0101.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0101.117] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.117] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.118] GetLastError () returned 0x0 [0101.118] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.119] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.120] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.120] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0101.120] SetEndOfFile (hFile=0x1fc) returned 1 [0101.120] CloseHandle (hObject=0x1fc) returned 1 [0101.120] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.121] SetEndOfFile (hFile=0x158) returned 1 [0101.121] CloseHandle (hObject=0x158) returned 1 [0101.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico")) returned 1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.122] lstrlenW (lpString=".doc") returned 4 [0101.122] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.122] lstrlenW (lpString=".docx") returned 5 [0101.122] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0101.122] lstrlenW (lpString=".pdf") returned 4 [0101.122] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.122] lstrlenW (lpString=".xls") returned 4 [0101.122] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.122] lstrlenW (lpString=".xlsx") returned 5 [0101.122] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0101.122] lstrlenW (lpString=".ppt") returned 4 [0101.122] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.122] lstrlenW (lpString=".zip") returned 4 [0101.122] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.122] lstrlenW (lpString=".rar") returned 4 [0101.122] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.122] lstrlenW (lpString=".bz2") returned 4 [0101.122] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.122] lstrlenW (lpString=".7z") returned 3 [0101.122] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.122] lstrlenW (lpString=".dbf") returned 4 [0101.122] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.122] lstrlenW (lpString=".1cd") returned 4 [0101.123] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0101.123] lstrlenW (lpString=".jpg") returned 4 [0101.123] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.123] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") [0101.171] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2862) returned 1 [0101.171] CloseHandle (hObject=0x1a0) returned 1 [0101.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico")) returned 0x20 [0101.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.171] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.171] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.172] GetLastError () returned 0x0 [0101.172] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0101.174] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0101.175] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.175] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x100, lpOverlapped=0x0) returned 1 [0101.175] SetEndOfFile (hFile=0x19c) returned 1 [0101.175] CloseHandle (hObject=0x19c) returned 1 [0101.175] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.175] SetEndOfFile (hFile=0x1a0) returned 1 [0101.176] CloseHandle (hObject=0x1a0) returned 1 [0101.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico")) returned 1 [0101.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.177] lstrlenW (lpString=".doc") returned 4 [0101.177] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.177] lstrlenW (lpString=".docx") returned 5 [0101.177] lstrcmpiW (lpString1=".docx", lpString2="b.ico") returned -1 [0101.177] lstrlenW (lpString=".pdf") returned 4 [0101.177] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.177] lstrlenW (lpString=".xls") returned 4 [0101.177] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0101.177] lstrlenW (lpString=".xlsx") returned 5 [0101.177] lstrcmpiW (lpString1=".xlsx", lpString2="b.ico") returned -1 [0101.177] lstrlenW (lpString=".ppt") returned 4 [0101.177] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.177] lstrlenW (lpString=".zip") returned 4 [0101.177] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0101.177] lstrlenW (lpString=".rar") returned 4 [0101.178] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.178] lstrlenW (lpString=".bz2") returned 4 [0101.178] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.178] lstrlenW (lpString=".7z") returned 3 [0101.178] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.178] lstrlenW (lpString=".dbf") returned 4 [0101.178] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.178] lstrlenW (lpString=".1cd") returned 4 [0101.178] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0101.178] lstrlenW (lpString=".jpg") returned 4 [0101.178] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.178] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") [0101.179] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10134) returned 1 [0101.179] CloseHandle (hObject=0x1a0) returned 1 [0101.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico")) returned 0x20 [0101.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.180] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.180] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.180] GetLastError () returned 0x0 [0101.180] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2796, lpOverlapped=0x0) returned 1 [0101.182] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0101.183] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.183] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.183] SetEndOfFile (hFile=0x19c) returned 1 [0101.183] CloseHandle (hObject=0x19c) returned 1 [0101.186] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.186] SetEndOfFile (hFile=0x1a0) returned 1 [0101.186] CloseHandle (hObject=0x1a0) returned 1 [0101.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico")) returned 1 [0101.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.187] lstrlenW (lpString=".doc") returned 4 [0101.187] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0101.187] lstrlenW (lpString=".docx") returned 5 [0101.187] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0101.187] lstrlenW (lpString=".pdf") returned 4 [0101.187] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0101.187] lstrlenW (lpString=".xls") returned 4 [0101.187] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0101.187] lstrlenW (lpString=".xlsx") returned 5 [0101.187] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0101.187] lstrlenW (lpString=".ppt") returned 4 [0101.187] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0101.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.187] lstrlenW (lpString=".zip") returned 4 [0101.187] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0101.187] lstrlenW (lpString=".rar") returned 4 [0101.187] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0101.187] lstrlenW (lpString=".bz2") returned 4 [0101.187] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0101.187] lstrlenW (lpString=".7z") returned 3 [0101.187] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0101.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.188] lstrlenW (lpString=".dbf") returned 4 [0101.188] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0101.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.188] lstrlenW (lpString=".1cd") returned 4 [0101.188] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0101.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0101.188] lstrlenW (lpString=".jpg") returned 4 [0101.188] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0101.188] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") [0101.189] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9062) returned 1 [0101.189] CloseHandle (hObject=0x1a0) returned 1 [0101.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico")) returned 0x20 [0101.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.189] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.189] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.190] GetLastError () returned 0x0 [0101.190] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2366, lpOverlapped=0x0) returned 1 [0101.238] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2370, lpOverlapped=0x0) returned 1 [0101.239] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0101.239] SetEndOfFile (hFile=0x19c) returned 1 [0101.240] CloseHandle (hObject=0x19c) returned 1 [0101.240] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.240] SetEndOfFile (hFile=0x1a0) returned 1 [0101.240] CloseHandle (hObject=0x1a0) returned 1 [0101.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico")) returned 1 [0101.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.241] lstrlenW (lpString=".doc") returned 4 [0101.241] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0101.241] lstrlenW (lpString=".docx") returned 5 [0101.241] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0101.241] lstrlenW (lpString=".pdf") returned 4 [0101.241] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0101.241] lstrlenW (lpString=".xls") returned 4 [0101.241] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0101.241] lstrlenW (lpString=".xlsx") returned 5 [0101.241] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0101.241] lstrlenW (lpString=".ppt") returned 4 [0101.241] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0101.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.241] lstrlenW (lpString=".zip") returned 4 [0101.242] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0101.242] lstrlenW (lpString=".rar") returned 4 [0101.242] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0101.242] lstrlenW (lpString=".bz2") returned 4 [0101.242] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0101.242] lstrlenW (lpString=".7z") returned 3 [0101.242] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0101.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.242] lstrlenW (lpString=".dbf") returned 4 [0101.242] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0101.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.242] lstrlenW (lpString=".1cd") returned 4 [0101.242] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0101.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0101.242] lstrlenW (lpString=".jpg") returned 4 [0101.242] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0101.242] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") [0101.243] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6722448) returned 1 [0101.243] CloseHandle (hObject=0x1a0) returned 1 [0101.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll")) returned 0x20 [0101.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0101.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll")) returned 1 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString=".doc") returned 4 [0101.246] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString=".docx") returned 5 [0101.246] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0101.246] lstrlenW (lpString=".pdf") returned 4 [0101.246] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString=".xls") returned 4 [0101.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString=".xlsx") returned 5 [0101.246] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0101.246] lstrlenW (lpString=".ppt") returned 4 [0101.246] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString=".zip") returned 4 [0101.246] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString=".rar") returned 4 [0101.246] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.246] lstrlenW (lpString=".bz2") returned 4 [0101.246] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.246] lstrlenW (lpString=".7z") returned 3 [0101.246] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString=".dbf") returned 4 [0101.246] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString=".1cd") returned 4 [0101.246] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0101.246] lstrlenW (lpString=".jpg") returned 4 [0101.246] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.247] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") [0101.247] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1371528) returned 1 [0101.247] CloseHandle (hObject=0x1a0) returned 1 [0101.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe")) returned 0x20 [0101.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0101.248] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.248] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0101.248] GetLastError () returned 0x0 [0101.248] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0101.449] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0101.467] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4ed98, lpOverlapped=0x0) returned 1 [0101.531] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4eda0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4eda0, lpOverlapped=0x0) returned 1 [0101.542] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.542] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.542] SetEndOfFile (hFile=0x19c) returned 1 [0101.686] CloseHandle (hObject=0x19c) returned 1 [0101.686] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.687] SetEndOfFile (hFile=0x1a0) returned 1 [0101.721] CloseHandle (hObject=0x1a0) returned 1 [0101.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0101.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe")) returned 1 [0101.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.732] lstrlenW (lpString=".doc") returned 4 [0101.732] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0101.732] lstrlenW (lpString=".docx") returned 5 [0101.732] lstrcmpiW (lpString1=".docx", lpString2="N.EXE") returned -1 [0101.732] lstrlenW (lpString=".pdf") returned 4 [0101.732] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0101.732] lstrlenW (lpString=".xls") returned 4 [0101.732] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0101.732] lstrlenW (lpString=".xlsx") returned 5 [0101.732] lstrcmpiW (lpString1=".xlsx", lpString2="N.EXE") returned -1 [0101.732] lstrlenW (lpString=".ppt") returned 4 [0101.732] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0101.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.733] lstrlenW (lpString=".zip") returned 4 [0101.733] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0101.733] lstrlenW (lpString=".rar") returned 4 [0101.733] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0101.733] lstrlenW (lpString=".bz2") returned 4 [0101.733] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0101.733] lstrlenW (lpString=".7z") returned 3 [0101.733] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0101.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.733] lstrlenW (lpString=".dbf") returned 4 [0101.733] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0101.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.733] lstrlenW (lpString=".1cd") returned 4 [0101.733] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0101.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0101.733] lstrlenW (lpString=".jpg") returned 4 [0101.733] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0101.733] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") [0101.808] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=42864) returned 1 [0101.808] CloseHandle (hObject=0x1fc) returned 1 [0101.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll")) returned 0x20 [0101.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0101.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0101.809] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.809] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0101.949] GetLastError () returned 0x0 [0101.949] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa770, lpOverlapped=0x0) returned 1 [0102.005] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa780, lpOverlapped=0x0) returned 1 [0102.006] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.006] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x10e, lpOverlapped=0x0) returned 1 [0102.006] SetEndOfFile (hFile=0x1c0) returned 1 [0102.006] CloseHandle (hObject=0x1c0) returned 1 [0102.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.007] SetEndOfFile (hFile=0x1fc) returned 1 [0102.008] CloseHandle (hObject=0x1fc) returned 1 [0102.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll")) returned 1 [0102.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.008] lstrlenW (lpString=".doc") returned 4 [0102.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.008] lstrlenW (lpString=".docx") returned 5 [0102.008] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0102.008] lstrlenW (lpString=".pdf") returned 4 [0102.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.008] lstrlenW (lpString=".xls") returned 4 [0102.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.008] lstrlenW (lpString=".xlsx") returned 5 [0102.008] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0102.008] lstrlenW (lpString=".ppt") returned 4 [0102.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.008] lstrlenW (lpString=".zip") returned 4 [0102.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.008] lstrlenW (lpString=".rar") returned 4 [0102.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.009] lstrlenW (lpString=".bz2") returned 4 [0102.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.009] lstrlenW (lpString=".7z") returned 3 [0102.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.009] lstrlenW (lpString=".dbf") returned 4 [0102.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.009] lstrlenW (lpString=".1cd") returned 4 [0102.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0102.009] lstrlenW (lpString=".jpg") returned 4 [0102.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.009] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") [0102.030] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9063792) returned 1 [0102.031] CloseHandle (hObject=0x1fc) returned 1 [0102.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll")) returned 0x20 [0102.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0102.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0102.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0102.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0102.166] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.169] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2e19d0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0102.169] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0102.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x864d70, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0102.183] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0102.198] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.199] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0102.299] SetEndOfFile (hFile=0x1fc) returned 1 [0102.302] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0102.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0102.302] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2e19d0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0102.304] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.309] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x864d70, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0102.309] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0102.311] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0102.311] CloseHandle (hObject=0x1fc) returned 1 [0102.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString=".doc") returned 4 [0102.312] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString=".docx") returned 5 [0102.312] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0102.312] lstrlenW (lpString=".pdf") returned 4 [0102.312] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString=".xls") returned 4 [0102.312] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString=".xlsx") returned 5 [0102.312] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0102.312] lstrlenW (lpString=".ppt") returned 4 [0102.312] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString=".zip") returned 4 [0102.312] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString=".rar") returned 4 [0102.312] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.312] lstrlenW (lpString=".bz2") returned 4 [0102.312] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.312] lstrlenW (lpString=".7z") returned 3 [0102.312] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString=".dbf") returned 4 [0102.312] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString=".1cd") returned 4 [0102.312] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 55 [0102.312] lstrlenW (lpString=".jpg") returned 4 [0102.312] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.313] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") [0102.342] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=409504) returned 1 [0102.342] CloseHandle (hObject=0x22c) returned 1 [0102.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl")) returned 0x20 [0102.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.342] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.342] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0102.343] GetLastError () returned 0x0 [0102.343] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x63fa0, lpOverlapped=0x0) returned 1 [0102.384] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x63fb0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x63fb0, lpOverlapped=0x0) returned 1 [0102.392] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.392] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.392] SetEndOfFile (hFile=0x1a0) returned 1 [0102.392] CloseHandle (hObject=0x1a0) returned 1 [0102.392] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.392] SetEndOfFile (hFile=0x22c) returned 1 [0102.592] CloseHandle (hObject=0x22c) returned 1 [0102.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl")) returned 1 [0102.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.592] lstrlenW (lpString=".doc") returned 4 [0102.592] lstrcmpiW (lpString1=".doc", lpString2=".PDL") returned -1 [0102.592] lstrlenW (lpString=".docx") returned 5 [0102.592] lstrcmpiW (lpString1=".docx", lpString2="E.PDL") returned -1 [0102.592] lstrlenW (lpString=".pdf") returned 4 [0102.592] lstrcmpiW (lpString1=".pdf", lpString2=".PDL") returned -1 [0102.592] lstrlenW (lpString=".xls") returned 4 [0102.592] lstrcmpiW (lpString1=".xls", lpString2=".PDL") returned 1 [0102.593] lstrlenW (lpString=".xlsx") returned 5 [0102.593] lstrcmpiW (lpString1=".xlsx", lpString2="E.PDL") returned -1 [0102.593] lstrlenW (lpString=".ppt") returned 4 [0102.593] lstrcmpiW (lpString1=".ppt", lpString2=".PDL") returned 1 [0102.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.593] lstrlenW (lpString=".zip") returned 4 [0102.593] lstrcmpiW (lpString1=".zip", lpString2=".PDL") returned 1 [0102.593] lstrlenW (lpString=".rar") returned 4 [0102.593] lstrcmpiW (lpString1=".rar", lpString2=".PDL") returned 1 [0102.593] lstrlenW (lpString=".bz2") returned 4 [0102.593] lstrcmpiW (lpString1=".bz2", lpString2=".PDL") returned -1 [0102.593] lstrlenW (lpString=".7z") returned 3 [0102.593] lstrcmpiW (lpString1=".7z", lpString2="PDL") returned -1 [0102.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.593] lstrlenW (lpString=".dbf") returned 4 [0102.593] lstrcmpiW (lpString1=".dbf", lpString2=".PDL") returned -1 [0102.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.593] lstrlenW (lpString=".1cd") returned 4 [0102.593] lstrcmpiW (lpString1=".1cd", lpString2=".PDL") returned -1 [0102.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 55 [0102.593] lstrlenW (lpString=".jpg") returned 4 [0102.593] lstrcmpiW (lpString1=".jpg", lpString2=".PDL") returned -1 [0102.593] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") [0102.594] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=221528) returned 1 [0102.594] CloseHandle (hObject=0x22c) returned 1 [0102.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll")) returned 0x20 [0102.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.594] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.594] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0102.595] GetLastError () returned 0x0 [0102.595] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x36158, lpOverlapped=0x0) returned 1 [0102.652] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x36160, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x36160, lpOverlapped=0x0) returned 1 [0102.657] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.657] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.657] SetEndOfFile (hFile=0x1c8) returned 1 [0102.657] CloseHandle (hObject=0x1c8) returned 1 [0102.657] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.657] SetEndOfFile (hFile=0x22c) returned 1 [0102.660] CloseHandle (hObject=0x22c) returned 1 [0102.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll")) returned 1 [0102.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.660] lstrlenW (lpString=".doc") returned 4 [0102.660] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString=".docx") returned 5 [0102.660] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0102.660] lstrlenW (lpString=".pdf") returned 4 [0102.660] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString=".xls") returned 4 [0102.660] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString=".xlsx") returned 5 [0102.660] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0102.660] lstrlenW (lpString=".ppt") returned 4 [0102.660] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.660] lstrlenW (lpString=".zip") returned 4 [0102.660] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString=".rar") returned 4 [0102.660] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.660] lstrlenW (lpString=".bz2") returned 4 [0102.661] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.661] lstrlenW (lpString=".7z") returned 3 [0102.661] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.661] lstrlenW (lpString=".dbf") returned 4 [0102.661] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.661] lstrlenW (lpString=".1cd") returned 4 [0102.661] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 70 [0102.661] lstrlenW (lpString=".jpg") returned 4 [0102.661] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.661] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") [0102.662] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=46480) returned 1 [0102.662] CloseHandle (hObject=0x22c) returned 1 [0102.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl")) returned 0x20 [0102.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.662] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.662] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0102.663] GetLastError () returned 0x0 [0102.663] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xb590, lpOverlapped=0x0) returned 1 [0102.711] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0102.713] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.713] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.713] SetEndOfFile (hFile=0x1c8) returned 1 [0102.713] CloseHandle (hObject=0x1c8) returned 1 [0102.713] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.713] SetEndOfFile (hFile=0x22c) returned 1 [0102.714] CloseHandle (hObject=0x22c) returned 1 [0102.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl")) returned 1 [0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.715] lstrlenW (lpString=".doc") returned 4 [0102.715] lstrcmpiW (lpString1=".doc", lpString2=".MDL") returned -1 [0102.715] lstrlenW (lpString=".docx") returned 5 [0102.715] lstrcmpiW (lpString1=".docx", lpString2="L.MDL") returned -1 [0102.715] lstrlenW (lpString=".pdf") returned 4 [0102.715] lstrcmpiW (lpString1=".pdf", lpString2=".MDL") returned 1 [0102.715] lstrlenW (lpString=".xls") returned 4 [0102.715] lstrcmpiW (lpString1=".xls", lpString2=".MDL") returned 1 [0102.715] lstrlenW (lpString=".xlsx") returned 5 [0102.715] lstrcmpiW (lpString1=".xlsx", lpString2="L.MDL") returned -1 [0102.715] lstrlenW (lpString=".ppt") returned 4 [0102.715] lstrcmpiW (lpString1=".ppt", lpString2=".MDL") returned 1 [0102.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.715] lstrlenW (lpString=".zip") returned 4 [0102.715] lstrcmpiW (lpString1=".zip", lpString2=".MDL") returned 1 [0102.715] lstrlenW (lpString=".rar") returned 4 [0102.715] lstrcmpiW (lpString1=".rar", lpString2=".MDL") returned 1 [0102.715] lstrlenW (lpString=".bz2") returned 4 [0102.715] lstrcmpiW (lpString1=".bz2", lpString2=".MDL") returned -1 [0102.716] lstrlenW (lpString=".7z") returned 3 [0102.716] lstrcmpiW (lpString1=".7z", lpString2="MDL") returned -1 [0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.716] lstrlenW (lpString=".dbf") returned 4 [0102.716] lstrcmpiW (lpString1=".dbf", lpString2=".MDL") returned -1 [0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.716] lstrlenW (lpString=".1cd") returned 4 [0102.716] lstrcmpiW (lpString1=".1cd", lpString2=".MDL") returned -1 [0102.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 55 [0102.716] lstrlenW (lpString=".jpg") returned 4 [0102.716] lstrcmpiW (lpString1=".jpg", lpString2=".MDL") returned -1 [0102.716] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") [0102.717] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=490920) returned 1 [0102.717] CloseHandle (hObject=0x22c) returned 1 [0102.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll")) returned 0x20 [0102.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0102.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0102.717] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.718] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0102.719] GetLastError () returned 0x0 [0102.719] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x77da8, lpOverlapped=0x0) returned 1 [0102.739] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x77db0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x77db0, lpOverlapped=0x0) returned 1 [0102.752] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.752] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0102.912] SetEndOfFile (hFile=0x1c8) returned 1 [0102.966] CloseHandle (hObject=0x1c8) returned 1 [0102.966] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.966] SetEndOfFile (hFile=0x22c) returned 1 [0102.970] CloseHandle (hObject=0x22c) returned 1 [0102.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0102.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll")) returned 1 [0102.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.996] lstrlenW (lpString=".doc") returned 4 [0102.996] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString=".docx") returned 5 [0102.996] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0102.996] lstrlenW (lpString=".pdf") returned 4 [0102.996] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString=".xls") returned 4 [0102.996] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString=".xlsx") returned 5 [0102.996] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0102.996] lstrlenW (lpString=".ppt") returned 4 [0102.996] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.996] lstrlenW (lpString=".zip") returned 4 [0102.996] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString=".rar") returned 4 [0102.996] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.996] lstrlenW (lpString=".bz2") returned 4 [0102.997] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.997] lstrlenW (lpString=".7z") returned 3 [0102.997] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.997] lstrlenW (lpString=".dbf") returned 4 [0102.997] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.997] lstrlenW (lpString=".1cd") returned 4 [0102.997] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 54 [0102.997] lstrlenW (lpString=".jpg") returned 4 [0102.997] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.997] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") [0103.072] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1039208) returned 1 [0103.072] CloseHandle (hObject=0x1fc) returned 1 [0103.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll")) returned 0x20 [0103.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0103.072] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.072] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.073] GetLastError () returned 0x0 [0103.073] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xfdb68, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfdb70, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfdb70, lpOverlapped=0x0) returned 1 [0103.429] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.429] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0103.438] SetEndOfFile (hFile=0x19c) returned 1 [0103.438] CloseHandle (hObject=0x19c) returned 1 [0103.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.438] SetEndOfFile (hFile=0x1fc) returned 1 [0103.449] CloseHandle (hObject=0x1fc) returned 1 [0103.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll")) returned 1 [0103.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.449] lstrlenW (lpString=".doc") returned 4 [0103.449] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.449] lstrlenW (lpString=".docx") returned 5 [0103.449] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0103.449] lstrlenW (lpString=".pdf") returned 4 [0103.449] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.449] lstrlenW (lpString=".xls") returned 4 [0103.449] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.449] lstrlenW (lpString=".xlsx") returned 5 [0103.450] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0103.450] lstrlenW (lpString=".ppt") returned 4 [0103.450] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.450] lstrlenW (lpString=".zip") returned 4 [0103.450] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.450] lstrlenW (lpString=".rar") returned 4 [0103.450] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.450] lstrlenW (lpString=".bz2") returned 4 [0103.450] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.450] lstrlenW (lpString=".7z") returned 3 [0103.450] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.450] lstrlenW (lpString=".dbf") returned 4 [0103.450] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.450] lstrlenW (lpString=".1cd") returned 4 [0103.450] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 53 [0103.450] lstrlenW (lpString=".jpg") returned 4 [0103.450] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.450] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") [0103.451] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=423776) returned 1 [0103.451] CloseHandle (hObject=0x1fc) returned 1 [0103.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll")) returned 0x20 [0103.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0103.452] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.452] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.453] GetLastError () returned 0x0 [0103.453] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x67760, lpOverlapped=0x0) returned 1 [0103.487] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x67770, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x67770, lpOverlapped=0x0) returned 1 [0103.494] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x12a, lpOverlapped=0x0) returned 1 [0103.494] SetEndOfFile (hFile=0x19c) returned 1 [0103.494] CloseHandle (hObject=0x19c) returned 1 [0103.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.495] SetEndOfFile (hFile=0x1fc) returned 1 [0103.498] CloseHandle (hObject=0x1fc) returned 1 [0103.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll")) returned 1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.499] lstrlenW (lpString=".doc") returned 4 [0103.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString=".docx") returned 5 [0103.499] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0103.499] lstrlenW (lpString=".pdf") returned 4 [0103.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString=".xls") returned 4 [0103.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString=".xlsx") returned 5 [0103.499] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0103.499] lstrlenW (lpString=".ppt") returned 4 [0103.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.499] lstrlenW (lpString=".zip") returned 4 [0103.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString=".rar") returned 4 [0103.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.499] lstrlenW (lpString=".bz2") returned 4 [0103.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.499] lstrlenW (lpString=".7z") returned 3 [0103.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.499] lstrlenW (lpString=".dbf") returned 4 [0103.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.499] lstrlenW (lpString=".1cd") returned 4 [0103.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 86 [0103.500] lstrlenW (lpString=".jpg") returned 4 [0103.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.500] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") [0103.814] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=542560) returned 1 [0103.814] CloseHandle (hObject=0x15c) returned 1 [0103.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll")) returned 0x20 [0103.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.814] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.814] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0103.815] GetLastError () returned 0x0 [0103.815] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x84760, lpOverlapped=0x0) returned 1 [0103.827] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x84770, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x84770, lpOverlapped=0x0) returned 1 [0103.836] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.836] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0103.836] SetEndOfFile (hFile=0x1c0) returned 1 [0103.836] CloseHandle (hObject=0x1c0) returned 1 [0103.836] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.837] SetEndOfFile (hFile=0x15c) returned 1 [0103.841] CloseHandle (hObject=0x15c) returned 1 [0103.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0103.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll")) returned 1 [0103.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.842] lstrlenW (lpString=".doc") returned 4 [0103.842] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString=".docx") returned 5 [0103.842] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0103.842] lstrlenW (lpString=".pdf") returned 4 [0103.842] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString=".xls") returned 4 [0103.842] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString=".xlsx") returned 5 [0103.842] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0103.842] lstrlenW (lpString=".ppt") returned 4 [0103.842] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.842] lstrlenW (lpString=".zip") returned 4 [0103.842] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString=".rar") returned 4 [0103.842] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.842] lstrlenW (lpString=".bz2") returned 4 [0103.842] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.842] lstrlenW (lpString=".7z") returned 3 [0103.842] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.843] lstrlenW (lpString=".dbf") returned 4 [0103.843] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.843] lstrlenW (lpString=".1cd") returned 4 [0103.843] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 54 [0103.843] lstrlenW (lpString=".jpg") returned 4 [0103.843] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.843] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") [0103.844] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=652136) returned 1 [0103.844] CloseHandle (hObject=0x15c) returned 1 [0103.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll")) returned 0x20 [0103.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0103.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0103.844] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.844] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0103.845] GetLastError () returned 0x0 [0103.845] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x9f368, lpOverlapped=0x0) returned 1 [0103.965] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x9f370, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x9f370, lpOverlapped=0x0) returned 1 [0103.980] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.980] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.980] SetEndOfFile (hFile=0x1c0) returned 1 [0103.981] CloseHandle (hObject=0x1c0) returned 1 [0103.981] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.981] SetEndOfFile (hFile=0x15c) returned 1 [0104.071] CloseHandle (hObject=0x15c) returned 1 [0104.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll")) returned 1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.286] lstrlenW (lpString=".doc") returned 4 [0104.286] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.286] lstrlenW (lpString=".docx") returned 5 [0104.286] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0104.286] lstrlenW (lpString=".pdf") returned 4 [0104.286] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.286] lstrlenW (lpString=".xls") returned 4 [0104.286] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.286] lstrlenW (lpString=".xlsx") returned 5 [0104.286] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0104.286] lstrlenW (lpString=".ppt") returned 4 [0104.286] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.286] lstrlenW (lpString=".zip") returned 4 [0104.286] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.286] lstrlenW (lpString=".rar") returned 4 [0104.286] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.287] lstrlenW (lpString=".bz2") returned 4 [0104.287] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.287] lstrlenW (lpString=".7z") returned 3 [0104.287] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.287] lstrlenW (lpString=".dbf") returned 4 [0104.287] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.287] lstrlenW (lpString=".1cd") returned 4 [0104.287] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 55 [0104.287] lstrlenW (lpString=".jpg") returned 4 [0104.287] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.287] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") [0104.367] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6829) returned 1 [0104.367] CloseHandle (hObject=0x1a0) returned 1 [0104.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd")) returned 0x20 [0104.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0104.368] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.368] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.369] GetLastError () returned 0x0 [0104.369] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1aad, lpOverlapped=0x0) returned 1 [0104.385] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1ab0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1ab0, lpOverlapped=0x0) returned 1 [0104.386] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.386] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0104.386] SetEndOfFile (hFile=0x22c) returned 1 [0104.386] CloseHandle (hObject=0x22c) returned 1 [0104.386] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.386] SetEndOfFile (hFile=0x1a0) returned 1 [0104.387] CloseHandle (hObject=0x1a0) returned 1 [0104.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd")) returned 1 [0104.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.390] lstrlenW (lpString=".doc") returned 4 [0104.390] lstrcmpiW (lpString1=".doc", lpString2=".PPD") returned -1 [0104.390] lstrlenW (lpString=".docx") returned 5 [0104.390] lstrcmpiW (lpString1=".docx", lpString2="1.PPD") returned -1 [0104.390] lstrlenW (lpString=".pdf") returned 4 [0104.390] lstrcmpiW (lpString1=".pdf", lpString2=".PPD") returned -1 [0104.390] lstrlenW (lpString=".xls") returned 4 [0104.390] lstrcmpiW (lpString1=".xls", lpString2=".PPD") returned 1 [0104.391] lstrlenW (lpString=".xlsx") returned 5 [0104.391] lstrcmpiW (lpString1=".xlsx", lpString2="1.PPD") returned -1 [0104.391] lstrlenW (lpString=".ppt") returned 4 [0104.391] lstrcmpiW (lpString1=".ppt", lpString2=".PPD") returned 1 [0104.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.391] lstrlenW (lpString=".zip") returned 4 [0104.391] lstrcmpiW (lpString1=".zip", lpString2=".PPD") returned 1 [0104.391] lstrlenW (lpString=".rar") returned 4 [0104.391] lstrcmpiW (lpString1=".rar", lpString2=".PPD") returned 1 [0104.391] lstrlenW (lpString=".bz2") returned 4 [0104.391] lstrcmpiW (lpString1=".bz2", lpString2=".PPD") returned -1 [0104.391] lstrlenW (lpString=".7z") returned 3 [0104.391] lstrcmpiW (lpString1=".7z", lpString2="PPD") returned -1 [0104.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.391] lstrlenW (lpString=".dbf") returned 4 [0104.391] lstrcmpiW (lpString1=".dbf", lpString2=".PPD") returned -1 [0104.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.391] lstrlenW (lpString=".1cd") returned 4 [0104.391] lstrcmpiW (lpString1=".1cd", lpString2=".PPD") returned -1 [0104.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 54 [0104.391] lstrlenW (lpString=".jpg") returned 4 [0104.391] lstrcmpiW (lpString1=".jpg", lpString2=".PPD") returned -1 [0104.391] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") [0104.393] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2560) returned 1 [0104.393] CloseHandle (hObject=0x1a0) returned 1 [0104.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub")) returned 0x20 [0104.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0104.393] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.393] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.394] GetLastError () returned 0x0 [0104.394] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa00, lpOverlapped=0x0) returned 1 [0104.396] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0104.397] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.397] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0104.397] SetEndOfFile (hFile=0x22c) returned 1 [0104.397] CloseHandle (hObject=0x22c) returned 1 [0104.397] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.398] SetEndOfFile (hFile=0x1a0) returned 1 [0104.398] CloseHandle (hObject=0x1a0) returned 1 [0104.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub")) returned 1 [0104.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.399] lstrlenW (lpString=".doc") returned 4 [0104.399] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.399] lstrlenW (lpString=".docx") returned 5 [0104.399] lstrcmpiW (lpString1=".docx", lpString2="s.dub") returned -1 [0104.399] lstrlenW (lpString=".pdf") returned 4 [0104.399] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.399] lstrlenW (lpString=".xls") returned 4 [0104.399] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.399] lstrlenW (lpString=".xlsx") returned 5 [0104.399] lstrcmpiW (lpString1=".xlsx", lpString2="s.dub") returned -1 [0104.399] lstrlenW (lpString=".ppt") returned 4 [0104.399] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.399] lstrlenW (lpString=".zip") returned 4 [0104.399] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.399] lstrlenW (lpString=".rar") returned 4 [0104.399] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.399] lstrlenW (lpString=".bz2") returned 4 [0104.399] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.399] lstrlenW (lpString=".7z") returned 3 [0104.399] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.399] lstrlenW (lpString=".dbf") returned 4 [0104.399] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.399] lstrlenW (lpString=".1cd") returned 4 [0104.400] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 58 [0104.400] lstrlenW (lpString=".jpg") returned 4 [0104.400] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.400] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") [0104.401] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2560) returned 1 [0104.401] CloseHandle (hObject=0x1a0) returned 1 [0104.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub")) returned 0x20 [0104.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0104.401] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.401] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.402] GetLastError () returned 0x0 [0104.402] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa00, lpOverlapped=0x0) returned 1 [0104.404] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0104.404] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.405] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0104.405] SetEndOfFile (hFile=0x22c) returned 1 [0104.405] CloseHandle (hObject=0x22c) returned 1 [0104.405] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.405] SetEndOfFile (hFile=0x1a0) returned 1 [0104.406] CloseHandle (hObject=0x1a0) returned 1 [0104.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub")) returned 1 [0104.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.406] lstrlenW (lpString=".doc") returned 4 [0104.406] lstrcmpiW (lpString1=".doc", lpString2=".dub") returned -1 [0104.406] lstrlenW (lpString=".docx") returned 5 [0104.406] lstrcmpiW (lpString1=".docx", lpString2="r.dub") returned -1 [0104.406] lstrlenW (lpString=".pdf") returned 4 [0104.406] lstrcmpiW (lpString1=".pdf", lpString2=".dub") returned 1 [0104.406] lstrlenW (lpString=".xls") returned 4 [0104.406] lstrcmpiW (lpString1=".xls", lpString2=".dub") returned 1 [0104.406] lstrlenW (lpString=".xlsx") returned 5 [0104.406] lstrcmpiW (lpString1=".xlsx", lpString2="r.dub") returned -1 [0104.406] lstrlenW (lpString=".ppt") returned 4 [0104.406] lstrcmpiW (lpString1=".ppt", lpString2=".dub") returned 1 [0104.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.406] lstrlenW (lpString=".zip") returned 4 [0104.406] lstrcmpiW (lpString1=".zip", lpString2=".dub") returned 1 [0104.407] lstrlenW (lpString=".rar") returned 4 [0104.407] lstrcmpiW (lpString1=".rar", lpString2=".dub") returned 1 [0104.407] lstrlenW (lpString=".bz2") returned 4 [0104.407] lstrcmpiW (lpString1=".bz2", lpString2=".dub") returned -1 [0104.407] lstrlenW (lpString=".7z") returned 3 [0104.407] lstrcmpiW (lpString1=".7z", lpString2="dub") returned -1 [0104.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.407] lstrlenW (lpString=".dbf") returned 4 [0104.407] lstrcmpiW (lpString1=".dbf", lpString2=".dub") returned -1 [0104.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.407] lstrlenW (lpString=".1cd") returned 4 [0104.407] lstrcmpiW (lpString1=".1cd", lpString2=".dub") returned -1 [0104.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 58 [0104.407] lstrlenW (lpString=".jpg") returned 4 [0104.407] lstrcmpiW (lpString1=".jpg", lpString2=".dub") returned 1 [0104.407] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") [0104.408] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=480152) returned 1 [0104.408] CloseHandle (hObject=0x1a0) returned 1 [0104.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll")) returned 0x20 [0104.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0104.408] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.409] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0104.409] GetLastError () returned 0x0 [0104.409] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x75398, lpOverlapped=0x0) returned 1 [0104.420] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x753a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x753a0, lpOverlapped=0x0) returned 1 [0104.554] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.554] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.554] SetEndOfFile (hFile=0x22c) returned 1 [0104.554] CloseHandle (hObject=0x22c) returned 1 [0104.554] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.554] SetEndOfFile (hFile=0x1a0) returned 1 [0104.558] CloseHandle (hObject=0x1a0) returned 1 [0104.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll")) returned 1 [0104.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString=".doc") returned 4 [0104.559] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString=".docx") returned 5 [0104.559] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0104.559] lstrlenW (lpString=".pdf") returned 4 [0104.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString=".xls") returned 4 [0104.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString=".xlsx") returned 5 [0104.559] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0104.559] lstrlenW (lpString=".ppt") returned 4 [0104.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString=".zip") returned 4 [0104.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString=".rar") returned 4 [0104.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.559] lstrlenW (lpString=".bz2") returned 4 [0104.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.559] lstrlenW (lpString=".7z") returned 3 [0104.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString=".dbf") returned 4 [0104.559] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString=".1cd") returned 4 [0104.559] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 55 [0104.559] lstrlenW (lpString=".jpg") returned 4 [0104.559] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.560] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") [0104.561] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2904064) returned 1 [0104.561] CloseHandle (hObject=0x1a0) returned 1 [0104.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic")) returned 0x20 [0104.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0104.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0104.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0104.564] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0104.564] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0104.564] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.567] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xec555, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0104.567] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.578] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.578] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x285000, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0104.578] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0104.848] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.848] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0104.866] SetEndOfFile (hFile=0x1a0) returned 1 [0104.867] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0104.867] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0104.867] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.868] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xec555, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0104.868] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.873] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x285000, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0104.873] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0104.876] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0104.876] CloseHandle (hObject=0x1a0) returned 1 [0104.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0104.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.877] lstrlenW (lpString=".doc") returned 4 [0104.877] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0104.877] lstrlenW (lpString=".docx") returned 5 [0104.877] lstrcmpiW (lpString1=".docx", lpString2="b.kic") returned -1 [0104.877] lstrlenW (lpString=".pdf") returned 4 [0104.877] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0104.877] lstrlenW (lpString=".xls") returned 4 [0104.877] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0104.877] lstrlenW (lpString=".xlsx") returned 5 [0104.877] lstrcmpiW (lpString1=".xlsx", lpString2="b.kic") returned -1 [0104.877] lstrlenW (lpString=".ppt") returned 4 [0104.877] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0104.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.877] lstrlenW (lpString=".zip") returned 4 [0104.877] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0104.877] lstrlenW (lpString=".rar") returned 4 [0104.877] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0104.877] lstrlenW (lpString=".bz2") returned 4 [0104.877] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0104.877] lstrlenW (lpString=".7z") returned 3 [0104.877] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0104.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.877] lstrlenW (lpString=".dbf") returned 4 [0104.877] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0104.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.878] lstrlenW (lpString=".1cd") returned 4 [0104.878] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0104.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 54 [0104.878] lstrlenW (lpString=".jpg") returned 4 [0104.878] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0104.878] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") [0105.234] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3499942) returned 1 [0105.234] CloseHandle (hObject=0x1fc) returned 1 [0105.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic")) returned 0x20 [0105.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0105.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.236] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0105.236] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0105.236] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.240] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x11cd37, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0105.240] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.250] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0105.250] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3167a6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0105.250] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0105.269] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.269] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0105.420] SetEndOfFile (hFile=0x1fc) returned 1 [0105.420] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0105.421] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0105.421] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.422] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x11cd37, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0105.422] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3167a6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0105.426] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0105.496] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0105.496] CloseHandle (hObject=0x1fc) returned 1 [0105.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.496] lstrlenW (lpString=".doc") returned 4 [0105.496] lstrcmpiW (lpString1=".doc", lpString2=".kic") returned -1 [0105.496] lstrlenW (lpString=".docx") returned 5 [0105.496] lstrcmpiW (lpString1=".docx", lpString2="e.kic") returned -1 [0105.496] lstrlenW (lpString=".pdf") returned 4 [0105.496] lstrcmpiW (lpString1=".pdf", lpString2=".kic") returned 1 [0105.496] lstrlenW (lpString=".xls") returned 4 [0105.496] lstrcmpiW (lpString1=".xls", lpString2=".kic") returned 1 [0105.496] lstrlenW (lpString=".xlsx") returned 5 [0105.496] lstrcmpiW (lpString1=".xlsx", lpString2="e.kic") returned -1 [0105.496] lstrlenW (lpString=".ppt") returned 4 [0105.496] lstrcmpiW (lpString1=".ppt", lpString2=".kic") returned 1 [0105.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.496] lstrlenW (lpString=".zip") returned 4 [0105.496] lstrcmpiW (lpString1=".zip", lpString2=".kic") returned 1 [0105.496] lstrlenW (lpString=".rar") returned 4 [0105.496] lstrcmpiW (lpString1=".rar", lpString2=".kic") returned 1 [0105.496] lstrlenW (lpString=".bz2") returned 4 [0105.497] lstrcmpiW (lpString1=".bz2", lpString2=".kic") returned -1 [0105.497] lstrlenW (lpString=".7z") returned 3 [0105.497] lstrcmpiW (lpString1=".7z", lpString2="kic") returned -1 [0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.497] lstrlenW (lpString=".dbf") returned 4 [0105.497] lstrcmpiW (lpString1=".dbf", lpString2=".kic") returned -1 [0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.497] lstrlenW (lpString=".1cd") returned 4 [0105.497] lstrcmpiW (lpString1=".1cd", lpString2=".kic") returned -1 [0105.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 54 [0105.497] lstrlenW (lpString=".jpg") returned 4 [0105.497] lstrcmpiW (lpString1=".jpg", lpString2=".kic") returned -1 [0105.497] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") [0105.498] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=13202) returned 1 [0105.507] CloseHandle (hObject=0x1fc) returned 1 [0105.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl")) returned 0x20 [0105.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0105.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0105.525] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.527] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0105.573] GetLastError () returned 0x0 [0105.573] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3392, lpOverlapped=0x0) returned 1 [0105.866] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0105.868] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.868] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0105.868] SetEndOfFile (hFile=0x1f4) returned 1 [0105.868] CloseHandle (hObject=0x1f4) returned 1 [0105.868] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.868] SetEndOfFile (hFile=0x1fc) returned 1 [0105.869] CloseHandle (hObject=0x1fc) returned 1 [0105.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0105.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl")) returned 1 [0106.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.159] lstrlenW (lpString=".doc") returned 4 [0106.159] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0106.159] lstrlenW (lpString=".docx") returned 5 [0106.160] lstrcmpiW (lpString1=".docx", lpString2="7.ACL") returned -1 [0106.160] lstrlenW (lpString=".pdf") returned 4 [0106.160] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0106.160] lstrlenW (lpString=".xls") returned 4 [0106.160] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0106.160] lstrlenW (lpString=".xlsx") returned 5 [0106.160] lstrcmpiW (lpString1=".xlsx", lpString2="7.ACL") returned -1 [0106.160] lstrlenW (lpString=".ppt") returned 4 [0106.184] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0106.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.184] lstrlenW (lpString=".zip") returned 4 [0106.185] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0106.185] lstrlenW (lpString=".rar") returned 4 [0106.185] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0106.185] lstrlenW (lpString=".bz2") returned 4 [0106.185] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0106.185] lstrlenW (lpString=".7z") returned 3 [0106.185] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0106.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.185] lstrlenW (lpString=".dbf") returned 4 [0106.185] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0106.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.185] lstrlenW (lpString=".1cd") returned 4 [0106.185] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0106.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 54 [0106.185] lstrlenW (lpString=".jpg") returned 4 [0106.185] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0106.185] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") [0106.186] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=417144) returned 1 [0106.186] CloseHandle (hObject=0x19c) returned 1 [0106.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb")) returned 0x20 [0106.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.188] GetLastError () returned 0x0 [0106.188] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x65d78, lpOverlapped=0x0) returned 1 [0106.198] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x65d80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x65d80, lpOverlapped=0x0) returned 1 [0106.205] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.206] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0106.206] SetEndOfFile (hFile=0x158) returned 1 [0106.206] CloseHandle (hObject=0x158) returned 1 [0106.206] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.206] SetEndOfFile (hFile=0x19c) returned 1 [0106.212] CloseHandle (hObject=0x19c) returned 1 [0106.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb")) returned 1 [0106.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.212] lstrlenW (lpString=".doc") returned 4 [0106.212] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0106.212] lstrlenW (lpString=".docx") returned 5 [0106.212] lstrcmpiW (lpString1=".docx", lpString2="L.OLB") returned -1 [0106.212] lstrlenW (lpString=".pdf") returned 4 [0106.212] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0106.212] lstrlenW (lpString=".xls") returned 4 [0106.213] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0106.213] lstrlenW (lpString=".xlsx") returned 5 [0106.213] lstrcmpiW (lpString1=".xlsx", lpString2="L.OLB") returned -1 [0106.213] lstrlenW (lpString=".ppt") returned 4 [0106.213] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0106.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.213] lstrlenW (lpString=".zip") returned 4 [0106.213] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0106.213] lstrlenW (lpString=".rar") returned 4 [0106.213] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0106.213] lstrlenW (lpString=".bz2") returned 4 [0106.213] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0106.213] lstrlenW (lpString=".7z") returned 3 [0106.213] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0106.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.213] lstrlenW (lpString=".dbf") returned 4 [0106.213] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0106.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.213] lstrlenW (lpString=".1cd") returned 4 [0106.213] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0106.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 53 [0106.213] lstrlenW (lpString=".jpg") returned 4 [0106.213] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0106.213] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") [0106.215] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=284024) returned 1 [0106.215] CloseHandle (hObject=0x19c) returned 1 [0106.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll")) returned 0x20 [0106.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.215] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.215] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.216] GetLastError () returned 0x0 [0106.216] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x45578, lpOverlapped=0x0) returned 1 [0106.278] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x45580, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x45580, lpOverlapped=0x0) returned 1 [0106.283] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.283] WriteFile (in: hFile=0x158, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.283] SetEndOfFile (hFile=0x158) returned 1 [0106.341] CloseHandle (hObject=0x158) returned 1 [0106.341] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.341] SetEndOfFile (hFile=0x19c) returned 1 [0106.344] CloseHandle (hObject=0x19c) returned 1 [0106.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll")) returned 1 [0106.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.436] lstrlenW (lpString=".doc") returned 4 [0106.436] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.436] lstrlenW (lpString=".docx") returned 5 [0106.436] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0106.436] lstrlenW (lpString=".pdf") returned 4 [0106.436] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.446] lstrlenW (lpString=".xls") returned 4 [0106.446] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.446] lstrlenW (lpString=".xlsx") returned 5 [0106.446] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0106.446] lstrlenW (lpString=".ppt") returned 4 [0106.451] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.451] lstrlenW (lpString=".zip") returned 4 [0106.451] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.451] lstrlenW (lpString=".rar") returned 4 [0106.451] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.451] lstrlenW (lpString=".bz2") returned 4 [0106.451] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.451] lstrlenW (lpString=".7z") returned 3 [0106.451] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.451] lstrlenW (lpString=".dbf") returned 4 [0106.455] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.455] lstrlenW (lpString=".1cd") returned 4 [0106.455] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 54 [0106.455] lstrlenW (lpString=".jpg") returned 4 [0106.455] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.482] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") [0106.483] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1207) returned 1 [0106.484] CloseHandle (hObject=0x158) returned 1 [0106.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest")) returned 0x20 [0106.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.484] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.484] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.485] GetLastError () returned 0x0 [0106.485] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4b7, lpOverlapped=0x0) returned 1 [0106.489] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0106.491] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.491] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0106.491] SetEndOfFile (hFile=0x1fc) returned 1 [0106.491] CloseHandle (hObject=0x1fc) returned 1 [0106.491] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.491] SetEndOfFile (hFile=0x158) returned 1 [0106.492] CloseHandle (hObject=0x158) returned 1 [0106.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest")) returned 1 [0106.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.492] lstrlenW (lpString=".doc") returned 4 [0106.492] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0106.492] lstrlenW (lpString=".docx") returned 5 [0106.492] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0106.493] lstrlenW (lpString=".pdf") returned 4 [0106.493] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString=".xls") returned 4 [0106.493] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString=".xlsx") returned 5 [0106.493] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0106.493] lstrlenW (lpString=".ppt") returned 4 [0106.493] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.493] lstrlenW (lpString=".zip") returned 4 [0106.493] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString=".rar") returned 4 [0106.493] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString=".bz2") returned 4 [0106.493] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString=".7z") returned 3 [0106.493] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0106.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.493] lstrlenW (lpString=".dbf") returned 4 [0106.493] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.493] lstrlenW (lpString=".1cd") returned 4 [0106.493] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0106.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 61 [0106.493] lstrlenW (lpString=".jpg") returned 4 [0106.493] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0106.493] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") [0106.494] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=261928) returned 1 [0106.494] CloseHandle (hObject=0x158) returned 1 [0106.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb")) returned 0x20 [0106.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.494] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.494] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.495] GetLastError () returned 0x0 [0106.495] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x3ff28, lpOverlapped=0x0) returned 1 [0106.509] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x3ff30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x3ff30, lpOverlapped=0x0) returned 1 [0106.514] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.514] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0106.515] SetEndOfFile (hFile=0x1fc) returned 1 [0106.515] CloseHandle (hObject=0x1fc) returned 1 [0106.515] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.515] SetEndOfFile (hFile=0x158) returned 1 [0106.517] CloseHandle (hObject=0x158) returned 1 [0106.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb")) returned 1 [0106.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.518] lstrlenW (lpString=".doc") returned 4 [0106.518] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0106.518] lstrlenW (lpString=".docx") returned 5 [0106.518] lstrcmpiW (lpString1=".docx", lpString2="B.TLB") returned -1 [0106.518] lstrlenW (lpString=".pdf") returned 4 [0106.518] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0106.518] lstrlenW (lpString=".xls") returned 4 [0106.518] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0106.518] lstrlenW (lpString=".xlsx") returned 5 [0106.518] lstrcmpiW (lpString1=".xlsx", lpString2="B.TLB") returned -1 [0106.518] lstrlenW (lpString=".ppt") returned 4 [0106.518] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0106.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.518] lstrlenW (lpString=".zip") returned 4 [0106.518] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0106.518] lstrlenW (lpString=".rar") returned 4 [0106.518] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0106.518] lstrlenW (lpString=".bz2") returned 4 [0106.518] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0106.518] lstrlenW (lpString=".7z") returned 3 [0106.519] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.519] lstrlenW (lpString=".dbf") returned 4 [0106.519] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.519] lstrlenW (lpString=".1cd") returned 4 [0106.519] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 52 [0106.519] lstrlenW (lpString=".jpg") returned 4 [0106.519] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0106.519] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") [0106.519] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=856416) returned 1 [0106.520] CloseHandle (hObject=0x158) returned 1 [0106.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe")) returned 0x20 [0106.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.520] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.520] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0106.521] GetLastError () returned 0x0 [0106.521] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xd1160, lpOverlapped=0x0) returned 1 [0106.558] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xd1170, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xd1170, lpOverlapped=0x0) returned 1 [0106.585] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.585] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.586] SetEndOfFile (hFile=0x1fc) returned 1 [0106.586] CloseHandle (hObject=0x1fc) returned 1 [0106.586] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.586] SetEndOfFile (hFile=0x158) returned 1 [0106.905] CloseHandle (hObject=0x158) returned 1 [0106.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe")) returned 1 [0106.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.905] lstrlenW (lpString=".doc") returned 4 [0106.905] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.905] lstrlenW (lpString=".docx") returned 5 [0106.905] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0106.905] lstrlenW (lpString=".pdf") returned 4 [0106.905] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.905] lstrlenW (lpString=".xls") returned 4 [0106.905] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.905] lstrlenW (lpString=".xlsx") returned 5 [0106.905] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0106.906] lstrlenW (lpString=".ppt") returned 4 [0106.906] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.906] lstrlenW (lpString=".zip") returned 4 [0106.906] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.906] lstrlenW (lpString=".rar") returned 4 [0106.906] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.906] lstrlenW (lpString=".bz2") returned 4 [0106.906] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.906] lstrlenW (lpString=".7z") returned 3 [0106.906] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.906] lstrlenW (lpString=".dbf") returned 4 [0106.906] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.906] lstrlenW (lpString=".1cd") returned 4 [0106.906] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 54 [0106.906] lstrlenW (lpString=".jpg") returned 4 [0106.906] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.906] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") [0106.907] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=131416) returned 1 [0106.907] CloseHandle (hObject=0x158) returned 1 [0106.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe")) returned 0x20 [0106.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.907] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.907] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0106.908] GetLastError () returned 0x0 [0106.908] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x20158, lpOverlapped=0x0) returned 1 [0106.912] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x20160, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x20160, lpOverlapped=0x0) returned 1 [0106.915] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.915] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0106.915] SetEndOfFile (hFile=0x168) returned 1 [0106.915] CloseHandle (hObject=0x168) returned 1 [0106.915] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.915] SetEndOfFile (hFile=0x158) returned 1 [0106.917] CloseHandle (hObject=0x158) returned 1 [0106.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0106.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe")) returned 1 [0106.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.917] lstrlenW (lpString=".doc") returned 4 [0106.917] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0106.918] lstrlenW (lpString=".docx") returned 5 [0106.918] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0106.918] lstrlenW (lpString=".pdf") returned 4 [0106.918] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0106.918] lstrlenW (lpString=".xls") returned 4 [0106.918] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0106.918] lstrlenW (lpString=".xlsx") returned 5 [0106.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0106.918] lstrlenW (lpString=".ppt") returned 4 [0106.918] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0106.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.918] lstrlenW (lpString=".zip") returned 4 [0106.918] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0106.918] lstrlenW (lpString=".rar") returned 4 [0106.918] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0106.918] lstrlenW (lpString=".bz2") returned 4 [0106.918] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0106.918] lstrlenW (lpString=".7z") returned 3 [0106.918] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0106.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.918] lstrlenW (lpString=".dbf") returned 4 [0106.918] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0106.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.918] lstrlenW (lpString=".1cd") returned 4 [0106.918] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0106.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 53 [0106.918] lstrlenW (lpString=".jpg") returned 4 [0106.918] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0106.918] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") [0106.919] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=564056) returned 1 [0106.919] CloseHandle (hObject=0x158) returned 1 [0106.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll")) returned 0x20 [0106.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0106.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0106.919] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.920] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0106.920] GetLastError () returned 0x0 [0106.920] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x89b58, lpOverlapped=0x0) returned 1 [0106.932] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x89b60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x89b60, lpOverlapped=0x0) returned 1 [0106.943] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.943] WriteFile (in: hFile=0x168, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.943] SetEndOfFile (hFile=0x168) returned 1 [0106.944] CloseHandle (hObject=0x168) returned 1 [0106.944] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.944] SetEndOfFile (hFile=0x158) returned 1 [0107.336] CloseHandle (hObject=0x158) returned 1 [0107.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll")) returned 1 [0107.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.343] lstrlenW (lpString=".doc") returned 4 [0107.343] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.343] lstrlenW (lpString=".docx") returned 5 [0107.343] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.343] lstrlenW (lpString=".pdf") returned 4 [0107.343] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.343] lstrlenW (lpString=".xls") returned 4 [0107.343] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.343] lstrlenW (lpString=".xlsx") returned 5 [0107.343] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.344] lstrlenW (lpString=".ppt") returned 4 [0107.344] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.344] lstrlenW (lpString=".zip") returned 4 [0107.344] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.344] lstrlenW (lpString=".rar") returned 4 [0107.344] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.344] lstrlenW (lpString=".bz2") returned 4 [0107.344] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.344] lstrlenW (lpString=".7z") returned 3 [0107.344] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.344] lstrlenW (lpString=".dbf") returned 4 [0107.344] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.344] lstrlenW (lpString=".1cd") returned 4 [0107.344] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 54 [0107.344] lstrlenW (lpString=".jpg") returned 4 [0107.344] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.344] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") [0107.357] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=18304) returned 1 [0107.357] CloseHandle (hObject=0x1fc) returned 1 [0107.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll")) returned 0x20 [0107.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.368] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.368] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0107.386] GetLastError () returned 0x0 [0107.386] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x4780, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0107.463] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.463] WriteFile (in: hFile=0x22c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0107.463] SetEndOfFile (hFile=0x22c) returned 1 [0107.463] CloseHandle (hObject=0x22c) returned 1 [0107.463] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.463] SetEndOfFile (hFile=0x1fc) returned 1 [0107.464] CloseHandle (hObject=0x1fc) returned 1 [0107.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll")) returned 1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.464] lstrlenW (lpString=".doc") returned 4 [0107.465] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString=".docx") returned 5 [0107.465] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0107.465] lstrlenW (lpString=".pdf") returned 4 [0107.465] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString=".xls") returned 4 [0107.465] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString=".xlsx") returned 5 [0107.465] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0107.465] lstrlenW (lpString=".ppt") returned 4 [0107.465] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.465] lstrlenW (lpString=".zip") returned 4 [0107.465] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString=".rar") returned 4 [0107.465] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.465] lstrlenW (lpString=".bz2") returned 4 [0107.465] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.465] lstrlenW (lpString=".7z") returned 3 [0107.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.465] lstrlenW (lpString=".dbf") returned 4 [0107.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.465] lstrlenW (lpString=".1cd") returned 4 [0107.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 63 [0107.465] lstrlenW (lpString=".jpg") returned 4 [0107.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.465] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") [0107.466] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2460592) returned 1 [0107.466] CloseHandle (hObject=0x1fc) returned 1 [0107.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll")) returned 0x20 [0107.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0107.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.468] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.475] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xc83e5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.475] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.516] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.516] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x218bb0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.516] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0107.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.535] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0112, lpOverlapped=0x0) returned 1 [0107.868] SetEndOfFile (hFile=0x1fc) returned 1 [0107.868] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0107.868] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.868] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.870] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xc83e5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.870] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.876] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x218bb0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0107.876] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0107.878] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0107.878] CloseHandle (hObject=0x1fc) returned 1 [0107.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0107.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.879] lstrlenW (lpString=".doc") returned 4 [0107.879] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString=".docx") returned 5 [0107.879] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0107.879] lstrlenW (lpString=".pdf") returned 4 [0107.879] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString=".xls") returned 4 [0107.879] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString=".xlsx") returned 5 [0107.879] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0107.879] lstrlenW (lpString=".ppt") returned 4 [0107.879] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.879] lstrlenW (lpString=".zip") returned 4 [0107.879] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString=".rar") returned 4 [0107.879] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.879] lstrlenW (lpString=".bz2") returned 4 [0107.879] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.879] lstrlenW (lpString=".7z") returned 3 [0107.879] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.879] lstrlenW (lpString=".dbf") returned 4 [0107.879] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.879] lstrlenW (lpString=".1cd") returned 4 [0107.879] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 62 [0107.880] lstrlenW (lpString=".jpg") returned 4 [0107.880] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.880] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") [0107.881] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6630320) returned 1 [0107.881] CloseHandle (hObject=0x1fc) returned 1 [0107.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll")) returned 0x20 [0107.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0107.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0107.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0107.883] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0107.883] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0107.883] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.029] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x21b93a, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0108.029] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.039] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0108.039] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x612bb0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0108.039] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0108.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.058] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0108.299] SetEndOfFile (hFile=0x1fc) returned 1 [0108.511] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0108.511] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.512] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.520] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x21b93a, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.520] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.524] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x612bb0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0108.524] WriteFile (in: hFile=0x1fc, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0108.529] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0108.529] CloseHandle (hObject=0x1fc) returned 1 [0108.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString=".doc") returned 4 [0108.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString=".docx") returned 5 [0108.752] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0108.752] lstrlenW (lpString=".pdf") returned 4 [0108.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString=".xls") returned 4 [0108.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString=".xlsx") returned 5 [0108.752] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0108.752] lstrlenW (lpString=".ppt") returned 4 [0108.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString=".zip") returned 4 [0108.752] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString=".rar") returned 4 [0108.752] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.752] lstrlenW (lpString=".bz2") returned 4 [0108.752] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.752] lstrlenW (lpString=".7z") returned 3 [0108.752] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString=".dbf") returned 4 [0108.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString=".1cd") returned 4 [0108.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 60 [0108.752] lstrlenW (lpString=".jpg") returned 4 [0108.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.753] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") [0109.017] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7321) returned 1 [0109.017] CloseHandle (hObject=0x22c) returned 1 [0109.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat")) returned 0x20 [0109.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.017] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.017] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.018] GetLastError () returned 0x0 [0109.018] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1c99, lpOverlapped=0x0) returned 1 [0109.052] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0109.053] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.053] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.053] SetEndOfFile (hFile=0x180) returned 1 [0109.053] CloseHandle (hObject=0x180) returned 1 [0109.053] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.054] SetEndOfFile (hFile=0x22c) returned 1 [0109.054] CloseHandle (hObject=0x22c) returned 1 [0109.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat")) returned 1 [0109.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.055] lstrlenW (lpString=".doc") returned 4 [0109.055] lstrcmpiW (lpString1=".doc", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString=".docx") returned 5 [0109.055] lstrcmpiW (lpString1=".docx", lpString2="T.CAT") returned -1 [0109.055] lstrlenW (lpString=".pdf") returned 4 [0109.055] lstrcmpiW (lpString1=".pdf", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString=".xls") returned 4 [0109.055] lstrcmpiW (lpString1=".xls", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString=".xlsx") returned 5 [0109.055] lstrcmpiW (lpString1=".xlsx", lpString2="T.CAT") returned -1 [0109.055] lstrlenW (lpString=".ppt") returned 4 [0109.055] lstrcmpiW (lpString1=".ppt", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.055] lstrlenW (lpString=".zip") returned 4 [0109.055] lstrcmpiW (lpString1=".zip", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString=".rar") returned 4 [0109.055] lstrcmpiW (lpString1=".rar", lpString2=".CAT") returned 1 [0109.055] lstrlenW (lpString=".bz2") returned 4 [0109.055] lstrcmpiW (lpString1=".bz2", lpString2=".CAT") returned -1 [0109.055] lstrlenW (lpString=".7z") returned 3 [0109.055] lstrcmpiW (lpString1=".7z", lpString2="CAT") returned -1 [0109.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.055] lstrlenW (lpString=".dbf") returned 4 [0109.055] lstrcmpiW (lpString1=".dbf", lpString2=".CAT") returned 1 [0109.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.056] lstrlenW (lpString=".1cd") returned 4 [0109.056] lstrcmpiW (lpString1=".1cd", lpString2=".CAT") returned -1 [0109.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 55 [0109.056] lstrlenW (lpString=".jpg") returned 4 [0109.056] lstrcmpiW (lpString1=".jpg", lpString2=".CAT") returned 1 [0109.056] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") [0109.058] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=74720) returned 1 [0109.058] CloseHandle (hObject=0x22c) returned 1 [0109.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll")) returned 0x20 [0109.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.058] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.058] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.059] GetLastError () returned 0x0 [0109.059] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x123e0, lpOverlapped=0x0) returned 1 [0109.064] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x123f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x123f0, lpOverlapped=0x0) returned 1 [0109.066] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.066] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0109.067] SetEndOfFile (hFile=0x180) returned 1 [0109.067] CloseHandle (hObject=0x180) returned 1 [0109.067] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.067] SetEndOfFile (hFile=0x22c) returned 1 [0109.068] CloseHandle (hObject=0x22c) returned 1 [0109.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll")) returned 1 [0109.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.068] lstrlenW (lpString=".doc") returned 4 [0109.068] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.068] lstrlenW (lpString=".docx") returned 5 [0109.068] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0109.068] lstrlenW (lpString=".pdf") returned 4 [0109.069] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.069] lstrlenW (lpString=".xls") returned 4 [0109.069] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.069] lstrlenW (lpString=".xlsx") returned 5 [0109.069] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0109.069] lstrlenW (lpString=".ppt") returned 4 [0109.069] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.069] lstrlenW (lpString=".zip") returned 4 [0109.069] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.069] lstrlenW (lpString=".rar") returned 4 [0109.069] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.069] lstrlenW (lpString=".bz2") returned 4 [0109.069] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.069] lstrlenW (lpString=".7z") returned 3 [0109.069] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.069] lstrlenW (lpString=".dbf") returned 4 [0109.069] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.069] lstrlenW (lpString=".1cd") returned 4 [0109.069] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 53 [0109.069] lstrlenW (lpString=".jpg") returned 4 [0109.069] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.069] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") [0109.071] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=513912) returned 1 [0109.071] CloseHandle (hObject=0x22c) returned 1 [0109.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll")) returned 0x20 [0109.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0109.071] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.071] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.072] GetLastError () returned 0x0 [0109.072] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x7d778, lpOverlapped=0x0) returned 1 [0109.197] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x7d780, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x7d780, lpOverlapped=0x0) returned 1 [0109.207] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.207] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0109.207] SetEndOfFile (hFile=0x180) returned 1 [0109.350] CloseHandle (hObject=0x180) returned 1 [0109.350] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.350] SetEndOfFile (hFile=0x22c) returned 1 [0109.354] CloseHandle (hObject=0x22c) returned 1 [0109.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll")) returned 1 [0109.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.362] lstrlenW (lpString=".doc") returned 4 [0109.362] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString=".docx") returned 5 [0109.362] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0109.362] lstrlenW (lpString=".pdf") returned 4 [0109.362] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString=".xls") returned 4 [0109.362] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString=".xlsx") returned 5 [0109.362] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0109.362] lstrlenW (lpString=".ppt") returned 4 [0109.362] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.362] lstrlenW (lpString=".zip") returned 4 [0109.362] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString=".rar") returned 4 [0109.362] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.362] lstrlenW (lpString=".bz2") returned 4 [0109.362] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.362] lstrlenW (lpString=".7z") returned 3 [0109.363] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.363] lstrlenW (lpString=".dbf") returned 4 [0109.363] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.363] lstrlenW (lpString=".1cd") returned 4 [0109.363] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 53 [0109.363] lstrlenW (lpString=".jpg") returned 4 [0109.363] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.363] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") [0109.370] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=27016) returned 1 [0109.370] CloseHandle (hObject=0x1c8) returned 1 [0109.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll")) returned 0x20 [0109.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.370] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.370] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.371] GetLastError () returned 0x0 [0109.371] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6988, lpOverlapped=0x0) returned 1 [0109.374] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6990, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6990, lpOverlapped=0x0) returned 1 [0109.375] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.375] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0109.375] SetEndOfFile (hFile=0x1b8) returned 1 [0109.375] CloseHandle (hObject=0x1b8) returned 1 [0109.375] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.376] SetEndOfFile (hFile=0x1c8) returned 1 [0109.376] CloseHandle (hObject=0x1c8) returned 1 [0109.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll")) returned 1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.377] lstrlenW (lpString=".doc") returned 4 [0109.377] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString=".docx") returned 5 [0109.377] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0109.377] lstrlenW (lpString=".pdf") returned 4 [0109.377] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString=".xls") returned 4 [0109.377] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString=".xlsx") returned 5 [0109.377] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0109.377] lstrlenW (lpString=".ppt") returned 4 [0109.377] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.377] lstrlenW (lpString=".zip") returned 4 [0109.377] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString=".rar") returned 4 [0109.377] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.377] lstrlenW (lpString=".bz2") returned 4 [0109.377] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.377] lstrlenW (lpString=".7z") returned 3 [0109.377] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.377] lstrlenW (lpString=".dbf") returned 4 [0109.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.378] lstrlenW (lpString=".1cd") returned 4 [0109.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 54 [0109.378] lstrlenW (lpString=".jpg") returned 4 [0109.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.378] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") [0109.379] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=368504) returned 1 [0109.379] CloseHandle (hObject=0x1c8) returned 1 [0109.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll")) returned 0x20 [0109.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.379] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.379] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0109.380] GetLastError () returned 0x0 [0109.380] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x59f78, lpOverlapped=0x0) returned 1 [0109.427] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x59f80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x59f80, lpOverlapped=0x0) returned 1 [0109.436] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.436] WriteFile (in: hFile=0x1b8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.436] SetEndOfFile (hFile=0x1b8) returned 1 [0109.436] CloseHandle (hObject=0x1b8) returned 1 [0109.436] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.436] SetEndOfFile (hFile=0x1c8) returned 1 [0109.440] CloseHandle (hObject=0x1c8) returned 1 [0109.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll")) returned 1 [0109.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.440] lstrlenW (lpString=".doc") returned 4 [0109.440] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.440] lstrlenW (lpString=".docx") returned 5 [0109.440] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0109.440] lstrlenW (lpString=".pdf") returned 4 [0109.440] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.440] lstrlenW (lpString=".xls") returned 4 [0109.440] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.440] lstrlenW (lpString=".xlsx") returned 5 [0109.441] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0109.441] lstrlenW (lpString=".ppt") returned 4 [0109.441] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.441] lstrlenW (lpString=".zip") returned 4 [0109.441] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.441] lstrlenW (lpString=".rar") returned 4 [0109.441] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.441] lstrlenW (lpString=".bz2") returned 4 [0109.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.441] lstrlenW (lpString=".7z") returned 3 [0109.441] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.441] lstrlenW (lpString=".dbf") returned 4 [0109.441] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.441] lstrlenW (lpString=".1cd") returned 4 [0109.441] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 55 [0109.441] lstrlenW (lpString=".jpg") returned 4 [0109.441] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.441] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") [0109.442] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4500352) returned 1 [0109.442] CloseHandle (hObject=0x1c8) returned 1 [0109.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll")) returned 0x20 [0109.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0109.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.444] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0109.444] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0109.444] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.622] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x16e3d5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0109.622] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.693] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0109.693] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x40ab80, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0109.693] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0109.735] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.735] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0109.751] SetEndOfFile (hFile=0x1c8) returned 1 [0109.751] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0109.751] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.751] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.753] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x16e3d5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.753] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.755] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x40ab80, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0109.755] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0109.895] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0109.895] CloseHandle (hObject=0x1c8) returned 1 [0109.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.896] lstrlenW (lpString=".doc") returned 4 [0109.896] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString=".docx") returned 5 [0109.896] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0109.896] lstrlenW (lpString=".pdf") returned 4 [0109.896] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString=".xls") returned 4 [0109.896] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString=".xlsx") returned 5 [0109.896] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0109.896] lstrlenW (lpString=".ppt") returned 4 [0109.896] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.896] lstrlenW (lpString=".zip") returned 4 [0109.896] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString=".rar") returned 4 [0109.896] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.896] lstrlenW (lpString=".bz2") returned 4 [0109.896] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.896] lstrlenW (lpString=".7z") returned 3 [0109.896] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.898] lstrlenW (lpString=".dbf") returned 4 [0109.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.898] lstrlenW (lpString=".1cd") returned 4 [0109.898] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 55 [0109.898] lstrlenW (lpString=".jpg") returned 4 [0109.898] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.898] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") [0109.899] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=900480) returned 1 [0109.899] CloseHandle (hObject=0x1c8) returned 1 [0109.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll")) returned 0x20 [0109.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0109.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0109.900] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.900] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.901] GetLastError () returned 0x0 [0109.901] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xdbd80, lpOverlapped=0x0) returned 1 [0110.130] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xdbd90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xdbd90, lpOverlapped=0x0) returned 1 [0110.155] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.155] WriteFile (in: hFile=0x180, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.156] SetEndOfFile (hFile=0x180) returned 1 [0110.156] CloseHandle (hObject=0x180) returned 1 [0110.156] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.156] SetEndOfFile (hFile=0x1c8) returned 1 [0110.331] CloseHandle (hObject=0x1c8) returned 1 [0110.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll")) returned 1 [0110.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.331] lstrlenW (lpString=".doc") returned 4 [0110.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.331] lstrlenW (lpString=".docx") returned 5 [0110.331] lstrcmpiW (lpString1=".docx", lpString2="L.dll") returned -1 [0110.331] lstrlenW (lpString=".pdf") returned 4 [0110.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.331] lstrlenW (lpString=".xls") returned 4 [0110.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.332] lstrlenW (lpString=".xlsx") returned 5 [0110.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.dll") returned -1 [0110.332] lstrlenW (lpString=".ppt") returned 4 [0110.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.332] lstrlenW (lpString=".zip") returned 4 [0110.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.332] lstrlenW (lpString=".rar") returned 4 [0110.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.332] lstrlenW (lpString=".bz2") returned 4 [0110.332] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.332] lstrlenW (lpString=".7z") returned 3 [0110.332] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.332] lstrlenW (lpString=".dbf") returned 4 [0110.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.332] lstrlenW (lpString=".1cd") returned 4 [0110.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 55 [0110.332] lstrlenW (lpString=".jpg") returned 4 [0110.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.332] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") [0110.334] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2131296) returned 1 [0110.334] CloseHandle (hObject=0x1c8) returned 1 [0110.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe")) returned 0x20 [0110.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0110.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.335] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0110.336] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.336] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.374] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xad720, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.374] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.413] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0110.413] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1c8560, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.413] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.468] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.468] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0110.483] SetEndOfFile (hFile=0x1c8) returned 1 [0110.500] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0110.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.500] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.501] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xad720, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.502] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.503] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1c8560, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.504] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0110.505] CloseHandle (hObject=0x1c8) returned 1 [0110.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.505] lstrlenW (lpString=".doc") returned 4 [0110.505] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.505] lstrlenW (lpString=".docx") returned 5 [0110.505] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0110.505] lstrlenW (lpString=".pdf") returned 4 [0110.505] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.506] lstrlenW (lpString=".xls") returned 4 [0110.506] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.506] lstrlenW (lpString=".xlsx") returned 5 [0110.506] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0110.506] lstrlenW (lpString=".ppt") returned 4 [0110.506] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.506] lstrlenW (lpString=".zip") returned 4 [0110.506] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.506] lstrlenW (lpString=".rar") returned 4 [0110.506] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.506] lstrlenW (lpString=".bz2") returned 4 [0110.506] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.506] lstrlenW (lpString=".7z") returned 3 [0110.506] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.506] lstrlenW (lpString=".dbf") returned 4 [0110.506] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.506] lstrlenW (lpString=".1cd") returned 4 [0110.506] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 54 [0110.506] lstrlenW (lpString=".jpg") returned 4 [0110.506] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.506] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") [0110.507] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1583472) returned 1 [0110.507] CloseHandle (hObject=0x1c8) returned 1 [0110.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll")) returned 0x20 [0110.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0110.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0110.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0110.509] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0110.509] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.509] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.525] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x80dd0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.525] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.547] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0110.547] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x142970, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0110.547] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0110.602] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.603] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0110.845] SetEndOfFile (hFile=0x1c8) returned 1 [0110.937] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0110.937] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.937] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.938] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x80dd0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.938] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.940] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x142970, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0110.940] WriteFile (in: hFile=0x1c8, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0110.943] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0110.943] CloseHandle (hObject=0x1c8) returned 1 [0110.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0110.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.943] lstrlenW (lpString=".doc") returned 4 [0110.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.943] lstrlenW (lpString=".docx") returned 5 [0110.943] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0110.943] lstrlenW (lpString=".pdf") returned 4 [0110.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.943] lstrlenW (lpString=".xls") returned 4 [0110.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.944] lstrlenW (lpString=".xlsx") returned 5 [0110.944] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0110.944] lstrlenW (lpString=".ppt") returned 4 [0110.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.944] lstrlenW (lpString=".zip") returned 4 [0110.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.944] lstrlenW (lpString=".rar") returned 4 [0110.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.944] lstrlenW (lpString=".bz2") returned 4 [0110.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.944] lstrlenW (lpString=".7z") returned 3 [0110.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.944] lstrlenW (lpString=".dbf") returned 4 [0110.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.944] lstrlenW (lpString=".1cd") returned 4 [0110.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 55 [0110.944] lstrlenW (lpString=".jpg") returned 4 [0110.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.944] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") [0111.230] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=83344) returned 1 [0111.230] CloseHandle (hObject=0x210) returned 1 [0111.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe")) returned 0x20 [0111.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.230] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.230] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.231] GetLastError () returned 0x0 [0111.231] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x14590, lpOverlapped=0x0) returned 1 [0111.311] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x145a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x145a0, lpOverlapped=0x0) returned 1 [0111.313] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.314] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.314] SetEndOfFile (hFile=0x1a0) returned 1 [0111.314] CloseHandle (hObject=0x1a0) returned 1 [0111.314] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.314] SetEndOfFile (hFile=0x210) returned 1 [0111.315] CloseHandle (hObject=0x210) returned 1 [0111.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe")) returned 1 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString=".doc") returned 4 [0111.316] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0111.316] lstrlenW (lpString=".docx") returned 5 [0111.316] lstrcmpiW (lpString1=".docx", lpString2="Z.EXE") returned -1 [0111.316] lstrlenW (lpString=".pdf") returned 4 [0111.316] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0111.316] lstrlenW (lpString=".xls") returned 4 [0111.316] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0111.316] lstrlenW (lpString=".xlsx") returned 5 [0111.316] lstrcmpiW (lpString1=".xlsx", lpString2="Z.EXE") returned -1 [0111.316] lstrlenW (lpString=".ppt") returned 4 [0111.316] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString=".zip") returned 4 [0111.316] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0111.316] lstrlenW (lpString=".rar") returned 4 [0111.316] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0111.316] lstrlenW (lpString=".bz2") returned 4 [0111.316] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0111.316] lstrlenW (lpString=".7z") returned 3 [0111.316] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString=".dbf") returned 4 [0111.316] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString=".1cd") returned 4 [0111.316] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0111.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 53 [0111.316] lstrlenW (lpString=".jpg") returned 4 [0111.316] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0111.317] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") [0111.318] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=166240) returned 1 [0111.318] CloseHandle (hObject=0x210) returned 1 [0111.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll")) returned 0x20 [0111.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.318] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.318] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.319] GetLastError () returned 0x0 [0111.319] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x28960, lpOverlapped=0x0) returned 1 [0111.387] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x28970, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x28970, lpOverlapped=0x0) returned 1 [0111.391] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.391] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0111.391] SetEndOfFile (hFile=0x1a0) returned 1 [0111.391] CloseHandle (hObject=0x1a0) returned 1 [0111.391] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.392] SetEndOfFile (hFile=0x210) returned 1 [0111.393] CloseHandle (hObject=0x210) returned 1 [0111.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0111.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll")) returned 1 [0111.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.394] lstrlenW (lpString=".doc") returned 4 [0111.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString=".docx") returned 5 [0111.394] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0111.394] lstrlenW (lpString=".pdf") returned 4 [0111.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString=".xls") returned 4 [0111.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString=".xlsx") returned 5 [0111.394] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0111.394] lstrlenW (lpString=".ppt") returned 4 [0111.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.394] lstrlenW (lpString=".zip") returned 4 [0111.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString=".rar") returned 4 [0111.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.394] lstrlenW (lpString=".bz2") returned 4 [0111.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.394] lstrlenW (lpString=".7z") returned 3 [0111.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.394] lstrlenW (lpString=".dbf") returned 4 [0111.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.394] lstrlenW (lpString=".1cd") returned 4 [0111.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 54 [0111.395] lstrlenW (lpString=".jpg") returned 4 [0111.395] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.395] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") [0111.396] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24505696) returned 1 [0111.396] CloseHandle (hObject=0x210) returned 1 [0111.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe")) returned 0x20 [0111.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0111.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0111.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0111.397] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0111.397] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0111.397] ReadFile (in: hFile=0x210, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.418] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x7ca475, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0111.418] ReadFile (in: hFile=0x210, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.429] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0111.429] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x171ed60, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0111.429] ReadFile (in: hFile=0x210, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0111.561] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.562] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.067] SetEndOfFile (hFile=0x210) returned 1 [0112.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0112.067] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.067] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.069] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x7ca475, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.069] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.074] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x171ed60, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.074] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.076] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0112.076] CloseHandle (hObject=0x210) returned 1 [0112.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.076] lstrlenW (lpString=".doc") returned 4 [0112.076] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.076] lstrlenW (lpString=".docx") returned 5 [0112.076] lstrcmpiW (lpString1=".docx", lpString2="K.EXE") returned -1 [0112.076] lstrlenW (lpString=".pdf") returned 4 [0112.076] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.076] lstrlenW (lpString=".xls") returned 4 [0112.076] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.076] lstrlenW (lpString=".xlsx") returned 5 [0112.076] lstrcmpiW (lpString1=".xlsx", lpString2="K.EXE") returned -1 [0112.076] lstrlenW (lpString=".ppt") returned 4 [0112.076] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.076] lstrlenW (lpString=".zip") returned 4 [0112.077] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.077] lstrlenW (lpString=".rar") returned 4 [0112.077] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.077] lstrlenW (lpString=".bz2") returned 4 [0112.077] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.077] lstrlenW (lpString=".7z") returned 3 [0112.077] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.077] lstrlenW (lpString=".dbf") returned 4 [0112.077] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.077] lstrlenW (lpString=".1cd") returned 4 [0112.077] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 54 [0112.077] lstrlenW (lpString=".jpg") returned 4 [0112.077] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.077] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") [0112.192] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=15603560) returned 1 [0112.192] CloseHandle (hObject=0x1f4) returned 1 [0112.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll")) returned 0x20 [0112.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.193] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0112.193] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.193] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.199] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x4f5d22, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.199] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.405] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.405] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xea1768, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.405] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.420] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.421] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0112.438] SetEndOfFile (hFile=0x1f4) returned 1 [0112.438] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0112.438] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.438] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.439] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x4f5d22, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.439] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.585] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xea1768, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.585] WriteFile (in: hFile=0x1f4, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.587] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0112.590] CloseHandle (hObject=0x1f4) returned 1 [0112.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.591] lstrlenW (lpString=".doc") returned 4 [0112.591] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString=".docx") returned 5 [0112.591] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0112.591] lstrlenW (lpString=".pdf") returned 4 [0112.591] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString=".xls") returned 4 [0112.591] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString=".xlsx") returned 5 [0112.591] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0112.591] lstrlenW (lpString=".ppt") returned 4 [0112.591] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.591] lstrlenW (lpString=".zip") returned 4 [0112.591] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString=".rar") returned 4 [0112.591] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.591] lstrlenW (lpString=".bz2") returned 4 [0112.591] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.591] lstrlenW (lpString=".7z") returned 3 [0112.591] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.591] lstrlenW (lpString=".dbf") returned 4 [0112.591] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.591] lstrlenW (lpString=".1cd") returned 4 [0112.591] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 53 [0112.592] lstrlenW (lpString=".jpg") returned 4 [0112.592] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.592] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") [0112.593] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4264672) returned 1 [0112.593] CloseHandle (hObject=0x1f4) returned 1 [0112.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex")) returned 0x20 [0112.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0112.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.595] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0112.595] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.595] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.598] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x15b0f5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.598] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.603] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.603] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x3d12e0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0112.603] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0112.752] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.752] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0112.767] SetEndOfFile (hFile=0x1f4) returned 1 [0112.767] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe65e0 [0112.767] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.767] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.768] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x15b0f5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.768] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.770] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x3d12e0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0112.770] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fe65e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe65e0*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0112.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0112.772] CloseHandle (hObject=0x1f4) returned 1 [0112.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.772] lstrlenW (lpString=".doc") returned 4 [0112.772] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0112.772] lstrlenW (lpString=".docx") returned 5 [0112.772] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0112.772] lstrlenW (lpString=".pdf") returned 4 [0112.772] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0112.772] lstrlenW (lpString=".xls") returned 4 [0112.772] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0112.772] lstrlenW (lpString=".xlsx") returned 5 [0112.772] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0112.772] lstrlenW (lpString=".ppt") returned 4 [0112.772] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0112.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.772] lstrlenW (lpString=".zip") returned 4 [0112.772] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0112.773] lstrlenW (lpString=".rar") returned 4 [0112.773] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0112.773] lstrlenW (lpString=".bz2") returned 4 [0112.773] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0112.773] lstrlenW (lpString=".7z") returned 3 [0112.773] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0112.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.773] lstrlenW (lpString=".dbf") returned 4 [0112.773] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0112.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.773] lstrlenW (lpString=".1cd") returned 4 [0112.773] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0112.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 60 [0112.773] lstrlenW (lpString=".jpg") returned 4 [0112.773] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0112.773] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") [0112.816] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=475648) returned 1 [0112.817] CloseHandle (hObject=0x1b8) returned 1 [0112.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex")) returned 0x20 [0112.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.817] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.817] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.818] GetLastError () returned 0x0 [0112.818] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x74200, lpOverlapped=0x0) returned 1 [0112.829] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x74210, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x74210, lpOverlapped=0x0) returned 1 [0112.837] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.837] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.837] SetEndOfFile (hFile=0x1f4) returned 1 [0112.837] CloseHandle (hObject=0x1f4) returned 1 [0112.838] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.838] SetEndOfFile (hFile=0x1b8) returned 1 [0112.842] CloseHandle (hObject=0x1b8) returned 1 [0112.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0112.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex")) returned 1 [0112.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.842] lstrlenW (lpString=".doc") returned 4 [0112.842] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0112.842] lstrlenW (lpString=".docx") returned 5 [0112.842] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0112.842] lstrlenW (lpString=".pdf") returned 4 [0112.842] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0112.842] lstrlenW (lpString=".xls") returned 4 [0112.842] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0112.842] lstrlenW (lpString=".xlsx") returned 5 [0112.842] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0112.842] lstrlenW (lpString=".ppt") returned 4 [0112.842] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0112.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.842] lstrlenW (lpString=".zip") returned 4 [0112.842] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0112.842] lstrlenW (lpString=".rar") returned 4 [0112.842] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0112.843] lstrlenW (lpString=".bz2") returned 4 [0112.843] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0112.843] lstrlenW (lpString=".7z") returned 3 [0112.843] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0112.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.843] lstrlenW (lpString=".dbf") returned 4 [0112.843] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0112.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.843] lstrlenW (lpString=".1cd") returned 4 [0112.843] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0112.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 60 [0112.843] lstrlenW (lpString=".jpg") returned 4 [0112.843] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0112.843] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") [0112.844] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=145408) returned 1 [0112.844] CloseHandle (hObject=0x1b8) returned 1 [0112.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex")) returned 0x20 [0112.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0112.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0112.844] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.844] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.845] GetLastError () returned 0x0 [0112.845] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x23800, lpOverlapped=0x0) returned 1 [0112.857] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x23810, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x23810, lpOverlapped=0x0) returned 1 [0112.860] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.860] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.860] SetEndOfFile (hFile=0x1f4) returned 1 [0113.001] CloseHandle (hObject=0x1f4) returned 1 [0113.001] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.001] SetEndOfFile (hFile=0x1b8) returned 1 [0113.021] CloseHandle (hObject=0x1b8) returned 1 [0113.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex")) returned 1 [0113.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.033] lstrlenW (lpString=".doc") returned 4 [0113.034] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0113.034] lstrlenW (lpString=".docx") returned 5 [0113.034] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0113.034] lstrlenW (lpString=".pdf") returned 4 [0113.034] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0113.034] lstrlenW (lpString=".xls") returned 4 [0113.034] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0113.035] lstrlenW (lpString=".xlsx") returned 5 [0113.035] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0113.035] lstrlenW (lpString=".ppt") returned 4 [0113.035] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0113.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.035] lstrlenW (lpString=".zip") returned 4 [0113.036] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0113.036] lstrlenW (lpString=".rar") returned 4 [0113.036] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0113.036] lstrlenW (lpString=".bz2") returned 4 [0113.036] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0113.036] lstrlenW (lpString=".7z") returned 3 [0113.036] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0113.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.036] lstrlenW (lpString=".dbf") returned 4 [0113.036] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0113.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.036] lstrlenW (lpString=".1cd") returned 4 [0113.036] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0113.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 60 [0113.036] lstrlenW (lpString=".jpg") returned 4 [0113.036] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0113.036] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") [0113.041] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2024320) returned 1 [0113.041] CloseHandle (hObject=0x210) returned 1 [0113.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll")) returned 0x20 [0113.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0113.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0113.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0113.042] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0113.042] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.042] ReadFile (in: hFile=0x210, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.046] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.046] ReadFile (in: hFile=0x210, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.051] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0113.051] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0113.051] ReadFile (in: hFile=0x210, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0113.067] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.067] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0113.493] SetEndOfFile (hFile=0x210) returned 1 [0113.493] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0113.497] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.497] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.498] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.498] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.500] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0113.500] WriteFile (in: hFile=0x210, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0113.503] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0113.503] CloseHandle (hObject=0x210) returned 1 [0113.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0113.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.503] lstrlenW (lpString=".doc") returned 4 [0113.503] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0113.503] lstrlenW (lpString=".docx") returned 5 [0113.503] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0113.503] lstrlenW (lpString=".pdf") returned 4 [0113.503] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0113.503] lstrlenW (lpString=".xls") returned 4 [0113.503] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0113.503] lstrlenW (lpString=".xlsx") returned 5 [0113.504] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0113.504] lstrlenW (lpString=".ppt") returned 4 [0113.504] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0113.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.504] lstrlenW (lpString=".zip") returned 4 [0113.504] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0113.504] lstrlenW (lpString=".rar") returned 4 [0113.504] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0113.504] lstrlenW (lpString=".bz2") returned 4 [0113.504] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0113.504] lstrlenW (lpString=".7z") returned 3 [0113.504] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0113.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.504] lstrlenW (lpString=".dbf") returned 4 [0113.504] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0113.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.504] lstrlenW (lpString=".1cd") returned 4 [0113.504] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0113.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 60 [0113.504] lstrlenW (lpString=".jpg") returned 4 [0113.504] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0113.504] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") [0114.136] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2024320) returned 1 [0114.136] CloseHandle (hObject=0x1a0) returned 1 [0114.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll")) returned 0x20 [0114.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0114.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.137] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0114.137] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.137] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.158] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.158] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.164] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.164] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.164] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.181] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.181] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0114.247] SetEndOfFile (hFile=0x1a0) returned 1 [0114.261] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0114.261] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.261] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.289] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa4bd5, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.289] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.291] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1ae380, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.291] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.293] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0114.293] CloseHandle (hObject=0x1a0) returned 1 [0114.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString=".doc") returned 4 [0114.294] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString=".docx") returned 5 [0114.294] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0114.294] lstrlenW (lpString=".pdf") returned 4 [0114.294] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString=".xls") returned 4 [0114.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString=".xlsx") returned 5 [0114.294] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0114.294] lstrlenW (lpString=".ppt") returned 4 [0114.294] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString=".zip") returned 4 [0114.294] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString=".rar") returned 4 [0114.294] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.294] lstrlenW (lpString=".bz2") returned 4 [0114.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.294] lstrlenW (lpString=".7z") returned 3 [0114.294] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString=".dbf") returned 4 [0114.294] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString=".1cd") returned 4 [0114.294] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 60 [0114.294] lstrlenW (lpString=".jpg") returned 4 [0114.294] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.295] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") [0114.295] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=454528) returned 1 [0114.295] CloseHandle (hObject=0x1a0) returned 1 [0114.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll")) returned 0x20 [0114.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.296] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.296] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0114.297] GetLastError () returned 0x0 [0114.297] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6ef80, lpOverlapped=0x0) returned 1 [0114.315] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6ef90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6ef90, lpOverlapped=0x0) returned 1 [0114.323] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.323] WriteFile (in: hFile=0x210, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.323] SetEndOfFile (hFile=0x210) returned 1 [0114.324] CloseHandle (hObject=0x210) returned 1 [0114.324] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.324] SetEndOfFile (hFile=0x1a0) returned 1 [0114.328] CloseHandle (hObject=0x1a0) returned 1 [0114.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll")) returned 1 [0114.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.328] lstrlenW (lpString=".doc") returned 4 [0114.328] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.328] lstrlenW (lpString=".docx") returned 5 [0114.328] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0114.328] lstrlenW (lpString=".pdf") returned 4 [0114.328] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.328] lstrlenW (lpString=".xls") returned 4 [0114.328] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.328] lstrlenW (lpString=".xlsx") returned 5 [0114.328] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0114.328] lstrlenW (lpString=".ppt") returned 4 [0114.329] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.329] lstrlenW (lpString=".zip") returned 4 [0114.329] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.329] lstrlenW (lpString=".rar") returned 4 [0114.329] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.329] lstrlenW (lpString=".bz2") returned 4 [0114.329] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.329] lstrlenW (lpString=".7z") returned 3 [0114.329] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.329] lstrlenW (lpString=".dbf") returned 4 [0114.329] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.329] lstrlenW (lpString=".1cd") returned 4 [0114.329] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 60 [0114.329] lstrlenW (lpString=".jpg") returned 4 [0114.329] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.329] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") [0114.330] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=13019648) returned 1 [0114.330] CloseHandle (hObject=0x1a0) returned 1 [0114.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex")) returned 0x20 [0114.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 1 [0114.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.332] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1 [0114.332] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.332] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.336] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x4238aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.336] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.346] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.346] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xc2aa00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1 [0114.346] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1 [0114.437] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.437] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0114.456] SetEndOfFile (hFile=0x1a0) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x46a0048 [0114.456] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.456] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x4238aa, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.457] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.461] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xc2aa00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1 [0114.461] WriteFile (in: hFile=0x1a0, lpBuffer=0x46a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x46a0048*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1 [0114.466] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x46a0048 | out: hHeap=0x5c0000) returned 1 [0114.466] CloseHandle (hObject=0x1a0) returned 1 [0114.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.467] lstrlenW (lpString=".doc") returned 4 [0114.467] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0114.467] lstrlenW (lpString=".docx") returned 5 [0114.467] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0114.467] lstrlenW (lpString=".pdf") returned 4 [0114.467] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0114.467] lstrlenW (lpString=".xls") returned 4 [0114.467] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0114.467] lstrlenW (lpString=".xlsx") returned 5 [0114.467] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0114.467] lstrlenW (lpString=".ppt") returned 4 [0114.467] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0114.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.467] lstrlenW (lpString=".zip") returned 4 [0114.467] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0114.467] lstrlenW (lpString=".rar") returned 4 [0114.467] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0114.467] lstrlenW (lpString=".bz2") returned 4 [0114.467] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0114.467] lstrlenW (lpString=".7z") returned 3 [0114.467] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0114.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.467] lstrlenW (lpString=".dbf") returned 4 [0114.467] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0114.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.467] lstrlenW (lpString=".1cd") returned 4 [0114.468] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0114.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 60 [0114.468] lstrlenW (lpString=".jpg") returned 4 [0114.468] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0114.468] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") [0114.469] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=75664) returned 1 [0114.469] CloseHandle (hObject=0x1a0) returned 1 [0114.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll")) returned 0x20 [0114.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.469] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.469] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.470] GetLastError () returned 0x0 [0114.470] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x12790, lpOverlapped=0x0) returned 1 [0114.492] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x127a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x127a0, lpOverlapped=0x0) returned 1 [0114.494] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.494] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.494] SetEndOfFile (hFile=0x1c0) returned 1 [0114.494] CloseHandle (hObject=0x1c0) returned 1 [0114.494] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.494] SetEndOfFile (hFile=0x1a0) returned 1 [0114.495] CloseHandle (hObject=0x1a0) returned 1 [0114.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll")) returned 1 [0114.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.496] lstrlenW (lpString=".doc") returned 4 [0114.496] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString=".docx") returned 5 [0114.496] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0114.496] lstrlenW (lpString=".pdf") returned 4 [0114.496] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString=".xls") returned 4 [0114.496] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString=".xlsx") returned 5 [0114.496] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0114.496] lstrlenW (lpString=".ppt") returned 4 [0114.496] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.496] lstrlenW (lpString=".zip") returned 4 [0114.496] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString=".rar") returned 4 [0114.496] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.496] lstrlenW (lpString=".bz2") returned 4 [0114.496] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.496] lstrlenW (lpString=".7z") returned 3 [0114.496] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.496] lstrlenW (lpString=".dbf") returned 4 [0114.496] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.497] lstrlenW (lpString=".1cd") returned 4 [0114.497] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 54 [0114.497] lstrlenW (lpString=".jpg") returned 4 [0114.497] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.497] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") [0114.532] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1248136) returned 1 [0114.532] CloseHandle (hObject=0x1a0) returned 1 [0114.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll")) returned 0x20 [0114.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0114.532] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.532] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.534] GetLastError () returned 0x0 [0114.534] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0114.684] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0114.702] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x30b98, lpOverlapped=0x0) returned 1 [0114.713] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x30ba0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x30ba0, lpOverlapped=0x0) returned 1 [0114.808] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.808] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.808] SetEndOfFile (hFile=0x1c0) returned 1 [0114.811] CloseHandle (hObject=0x1c0) returned 1 [0114.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.811] SetEndOfFile (hFile=0x1a0) returned 1 [0114.813] CloseHandle (hObject=0x1a0) returned 1 [0114.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0114.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll")) returned 1 [0114.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.813] lstrlenW (lpString=".doc") returned 4 [0114.813] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0114.813] lstrlenW (lpString=".docx") returned 5 [0114.813] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0114.813] lstrlenW (lpString=".pdf") returned 4 [0114.813] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0114.814] lstrlenW (lpString=".xls") returned 4 [0114.814] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0114.814] lstrlenW (lpString=".xlsx") returned 5 [0114.814] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0114.814] lstrlenW (lpString=".ppt") returned 4 [0114.814] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0114.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.823] lstrlenW (lpString=".zip") returned 4 [0114.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0114.823] lstrlenW (lpString=".rar") returned 4 [0114.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0114.823] lstrlenW (lpString=".bz2") returned 4 [0114.823] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0114.823] lstrlenW (lpString=".7z") returned 3 [0114.823] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0114.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.823] lstrlenW (lpString=".dbf") returned 4 [0114.830] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0114.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.833] lstrlenW (lpString=".1cd") returned 4 [0114.833] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0114.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 54 [0114.833] lstrlenW (lpString=".jpg") returned 4 [0114.833] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0114.840] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") [0114.855] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=53172) returned 1 [0114.855] CloseHandle (hObject=0x1a0) returned 1 [0114.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr")) returned 0x20 [0114.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0114.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0114.864] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.865] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.046] GetLastError () returned 0x0 [0115.046] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xcfb4, lpOverlapped=0x0) returned 1 [0115.054] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xcfc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xcfc0, lpOverlapped=0x0) returned 1 [0115.056] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.056] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.056] SetEndOfFile (hFile=0x1f4) returned 1 [0115.056] CloseHandle (hObject=0x1f4) returned 1 [0115.056] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.056] SetEndOfFile (hFile=0x19c) returned 1 [0115.057] CloseHandle (hObject=0x19c) returned 1 [0115.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr")) returned 1 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString=".doc") returned 4 [0115.058] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".docx") returned 5 [0115.058] lstrcmpiW (lpString1=".docx", lpString2="A.BDR") returned -1 [0115.058] lstrlenW (lpString=".pdf") returned 4 [0115.058] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".xls") returned 4 [0115.058] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".xlsx") returned 5 [0115.058] lstrcmpiW (lpString1=".xlsx", lpString2="A.BDR") returned -1 [0115.058] lstrlenW (lpString=".ppt") returned 4 [0115.058] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString=".zip") returned 4 [0115.058] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".rar") returned 4 [0115.058] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".bz2") returned 4 [0115.058] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString=".7z") returned 3 [0115.058] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString=".dbf") returned 4 [0115.058] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString=".1cd") returned 4 [0115.058] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0115.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 60 [0115.058] lstrlenW (lpString=".jpg") returned 4 [0115.059] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0115.059] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") [0115.059] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=27582) returned 1 [0115.059] CloseHandle (hObject=0x19c) returned 1 [0115.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr")) returned 0x20 [0115.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.059] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.060] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.060] GetLastError () returned 0x0 [0115.060] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6bbe, lpOverlapped=0x0) returned 1 [0115.062] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6bc0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6bc0, lpOverlapped=0x0) returned 1 [0115.063] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.063] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.063] SetEndOfFile (hFile=0x1f4) returned 1 [0115.064] CloseHandle (hObject=0x1f4) returned 1 [0115.064] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.064] SetEndOfFile (hFile=0x19c) returned 1 [0115.065] CloseHandle (hObject=0x19c) returned 1 [0115.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr")) returned 1 [0115.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.065] lstrlenW (lpString=".doc") returned 4 [0115.065] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0115.065] lstrlenW (lpString=".docx") returned 5 [0115.065] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0115.065] lstrlenW (lpString=".pdf") returned 4 [0115.065] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0115.065] lstrlenW (lpString=".xls") returned 4 [0115.065] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0115.065] lstrlenW (lpString=".xlsx") returned 5 [0115.065] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0115.065] lstrlenW (lpString=".ppt") returned 4 [0115.065] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0115.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.065] lstrlenW (lpString=".zip") returned 4 [0115.065] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0115.065] lstrlenW (lpString=".rar") returned 4 [0115.066] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0115.066] lstrlenW (lpString=".bz2") returned 4 [0115.066] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0115.066] lstrlenW (lpString=".7z") returned 3 [0115.066] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0115.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.066] lstrlenW (lpString=".dbf") returned 4 [0115.066] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0115.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.066] lstrlenW (lpString=".1cd") returned 4 [0115.066] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0115.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 59 [0115.066] lstrlenW (lpString=".jpg") returned 4 [0115.066] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0115.066] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") [0115.067] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=909176) returned 1 [0115.067] CloseHandle (hObject=0x19c) returned 1 [0115.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll")) returned 0x20 [0115.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0115.067] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.067] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.068] GetLastError () returned 0x0 [0115.068] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xddf78, lpOverlapped=0x0) returned 1 [0115.086] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xddf80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xddf80, lpOverlapped=0x0) returned 1 [0115.270] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.270] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.270] SetEndOfFile (hFile=0x1f4) returned 1 [0115.270] CloseHandle (hObject=0x1f4) returned 1 [0115.270] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.270] SetEndOfFile (hFile=0x19c) returned 1 [0115.277] CloseHandle (hObject=0x19c) returned 1 [0115.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll")) returned 1 [0115.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.278] lstrlenW (lpString=".doc") returned 4 [0115.278] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.278] lstrlenW (lpString=".docx") returned 5 [0115.278] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0115.278] lstrlenW (lpString=".pdf") returned 4 [0115.278] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.278] lstrlenW (lpString=".xls") returned 4 [0115.278] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.278] lstrlenW (lpString=".xlsx") returned 5 [0115.278] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0115.278] lstrlenW (lpString=".ppt") returned 4 [0115.278] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.278] lstrlenW (lpString=".zip") returned 4 [0115.279] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.279] lstrlenW (lpString=".rar") returned 4 [0115.279] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.279] lstrlenW (lpString=".bz2") returned 4 [0115.279] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.279] lstrlenW (lpString=".7z") returned 3 [0115.279] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.279] lstrlenW (lpString=".dbf") returned 4 [0115.279] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.279] lstrlenW (lpString=".1cd") returned 4 [0115.279] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 54 [0115.279] lstrlenW (lpString=".jpg") returned 4 [0115.279] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.279] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") [0115.286] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24329) returned 1 [0115.286] CloseHandle (hObject=0x22c) returned 1 [0115.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv")) returned 0x20 [0115.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.286] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.286] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.287] GetLastError () returned 0x0 [0115.287] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x5f09, lpOverlapped=0x0) returned 1 [0115.306] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0115.308] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.308] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0115.308] SetEndOfFile (hFile=0x1c0) returned 1 [0115.308] CloseHandle (hObject=0x1c0) returned 1 [0115.308] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.309] SetEndOfFile (hFile=0x22c) returned 1 [0115.309] CloseHandle (hObject=0x22c) returned 1 [0115.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv")) returned 1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.310] lstrlenW (lpString=".doc") returned 4 [0115.310] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.310] lstrlenW (lpString=".docx") returned 5 [0115.310] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0115.310] lstrlenW (lpString=".pdf") returned 4 [0115.310] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.310] lstrlenW (lpString=".xls") returned 4 [0115.310] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.310] lstrlenW (lpString=".xlsx") returned 5 [0115.310] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0115.310] lstrlenW (lpString=".ppt") returned 4 [0115.310] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.310] lstrlenW (lpString=".zip") returned 4 [0115.310] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.310] lstrlenW (lpString=".rar") returned 4 [0115.310] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.311] lstrlenW (lpString=".bz2") returned 4 [0115.311] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.311] lstrlenW (lpString=".7z") returned 3 [0115.311] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.311] lstrlenW (lpString=".dbf") returned 4 [0115.311] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.311] lstrlenW (lpString=".1cd") returned 4 [0115.311] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 56 [0115.311] lstrlenW (lpString=".jpg") returned 4 [0115.311] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.311] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") [0115.312] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2132) returned 1 [0115.312] CloseHandle (hObject=0x22c) returned 1 [0115.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc")) returned 0x20 [0115.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.312] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.312] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.313] GetLastError () returned 0x0 [0115.313] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x854, lpOverlapped=0x0) returned 1 [0115.318] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x860, lpOverlapped=0x0) returned 1 [0115.319] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.319] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.320] SetEndOfFile (hFile=0x1c0) returned 1 [0115.320] CloseHandle (hObject=0x1c0) returned 1 [0115.320] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.320] SetEndOfFile (hFile=0x22c) returned 1 [0115.320] CloseHandle (hObject=0x22c) returned 1 [0115.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc")) returned 1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.321] lstrlenW (lpString=".doc") returned 4 [0115.321] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.321] lstrlenW (lpString=".docx") returned 5 [0115.321] lstrcmpiW (lpString1=".docx", lpString2="L.POC") returned -1 [0115.321] lstrlenW (lpString=".pdf") returned 4 [0115.321] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.321] lstrlenW (lpString=".xls") returned 4 [0115.321] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.321] lstrlenW (lpString=".xlsx") returned 5 [0115.321] lstrcmpiW (lpString1=".xlsx", lpString2="L.POC") returned -1 [0115.321] lstrlenW (lpString=".ppt") returned 4 [0115.321] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.321] lstrlenW (lpString=".zip") returned 4 [0115.321] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.321] lstrlenW (lpString=".rar") returned 4 [0115.321] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.321] lstrlenW (lpString=".bz2") returned 4 [0115.321] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.322] lstrlenW (lpString=".7z") returned 3 [0115.322] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.322] lstrlenW (lpString=".dbf") returned 4 [0115.322] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.322] lstrlenW (lpString=".1cd") returned 4 [0115.322] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 62 [0115.322] lstrlenW (lpString=".jpg") returned 4 [0115.322] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.322] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") [0115.323] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=22860) returned 1 [0115.323] CloseHandle (hObject=0x22c) returned 1 [0115.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc")) returned 0x20 [0115.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0115.323] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.323] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.324] GetLastError () returned 0x0 [0115.324] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x594c, lpOverlapped=0x0) returned 1 [0115.363] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x5950, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x5950, lpOverlapped=0x0) returned 1 [0115.364] ReadFile (in: hFile=0x22c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.364] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.365] SetEndOfFile (hFile=0x1c0) returned 1 [0115.442] CloseHandle (hObject=0x1c0) returned 1 [0115.443] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.443] SetEndOfFile (hFile=0x22c) returned 1 [0115.443] CloseHandle (hObject=0x22c) returned 1 [0115.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc")) returned 1 [0115.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.596] lstrlenW (lpString=".doc") returned 4 [0115.596] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.596] lstrlenW (lpString=".docx") returned 5 [0115.596] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0115.596] lstrlenW (lpString=".pdf") returned 4 [0115.596] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.596] lstrlenW (lpString=".xls") returned 4 [0115.596] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.596] lstrlenW (lpString=".xlsx") returned 5 [0115.596] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0115.596] lstrlenW (lpString=".ppt") returned 4 [0115.596] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.596] lstrlenW (lpString=".zip") returned 4 [0115.596] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.596] lstrlenW (lpString=".rar") returned 4 [0115.596] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.596] lstrlenW (lpString=".bz2") returned 4 [0115.614] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.614] lstrlenW (lpString=".7z") returned 3 [0115.614] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.614] lstrlenW (lpString=".dbf") returned 4 [0115.614] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.614] lstrlenW (lpString=".1cd") returned 4 [0115.614] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 59 [0115.614] lstrlenW (lpString=".jpg") returned 4 [0115.614] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.614] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") [0115.632] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=626546) returned 1 [0115.632] CloseHandle (hObject=0x1c8) returned 1 [0115.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc")) returned 0x20 [0115.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0115.633] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.633] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.633] GetLastError () returned 0x0 [0115.633] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x98f72, lpOverlapped=0x0) returned 1 [0115.647] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x98f80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x98f80, lpOverlapped=0x0) returned 1 [0115.660] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.660] WriteFile (in: hFile=0x15c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.660] SetEndOfFile (hFile=0x15c) returned 1 [0115.660] CloseHandle (hObject=0x15c) returned 1 [0115.660] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.660] SetEndOfFile (hFile=0x1c8) returned 1 [0115.666] CloseHandle (hObject=0x1c8) returned 1 [0115.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc")) returned 1 [0115.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.666] lstrlenW (lpString=".doc") returned 4 [0115.666] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0115.666] lstrlenW (lpString=".docx") returned 5 [0115.666] lstrcmpiW (lpString1=".docx", lpString2="1.POC") returned -1 [0115.666] lstrlenW (lpString=".pdf") returned 4 [0115.666] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0115.666] lstrlenW (lpString=".xls") returned 4 [0115.666] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0115.666] lstrlenW (lpString=".xlsx") returned 5 [0115.667] lstrcmpiW (lpString1=".xlsx", lpString2="1.POC") returned -1 [0115.667] lstrlenW (lpString=".ppt") returned 4 [0115.667] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0115.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.667] lstrlenW (lpString=".zip") returned 4 [0115.667] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0115.667] lstrlenW (lpString=".rar") returned 4 [0115.667] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0115.667] lstrlenW (lpString=".bz2") returned 4 [0115.667] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0115.667] lstrlenW (lpString=".7z") returned 3 [0115.667] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0115.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.667] lstrlenW (lpString=".dbf") returned 4 [0115.667] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0115.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.667] lstrlenW (lpString=".1cd") returned 4 [0115.667] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0115.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 62 [0115.667] lstrlenW (lpString=".jpg") returned 4 [0115.667] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0115.667] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") [0115.893] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=684432) returned 1 [0115.893] CloseHandle (hObject=0x15c) returned 1 [0115.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv")) returned 0x20 [0115.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.893] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.893] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.894] GetLastError () returned 0x0 [0115.894] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xa7190, lpOverlapped=0x0) returned 1 [0115.972] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xa71a0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xa71a0, lpOverlapped=0x0) returned 1 [0115.986] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.986] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.986] SetEndOfFile (hFile=0x1f4) returned 1 [0115.987] CloseHandle (hObject=0x1f4) returned 1 [0115.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.987] SetEndOfFile (hFile=0x15c) returned 1 [0115.992] CloseHandle (hObject=0x15c) returned 1 [0115.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0115.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv")) returned 1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.993] lstrlenW (lpString=".doc") returned 4 [0115.993] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0115.993] lstrlenW (lpString=".docx") returned 5 [0115.993] lstrcmpiW (lpString1=".docx", lpString2="E.DPV") returned -1 [0115.993] lstrlenW (lpString=".pdf") returned 4 [0115.993] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0115.993] lstrlenW (lpString=".xls") returned 4 [0115.993] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0115.993] lstrlenW (lpString=".xlsx") returned 5 [0115.993] lstrcmpiW (lpString1=".xlsx", lpString2="E.DPV") returned -1 [0115.993] lstrlenW (lpString=".ppt") returned 4 [0115.993] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.993] lstrlenW (lpString=".zip") returned 4 [0115.993] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0115.993] lstrlenW (lpString=".rar") returned 4 [0115.993] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0115.993] lstrlenW (lpString=".bz2") returned 4 [0115.993] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0115.994] lstrlenW (lpString=".7z") returned 3 [0115.994] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.994] lstrlenW (lpString=".dbf") returned 4 [0115.994] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.994] lstrlenW (lpString=".1cd") returned 4 [0115.994] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 62 [0115.994] lstrlenW (lpString=".jpg") returned 4 [0115.994] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0115.994] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") [0115.995] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1024) returned 1 [0115.995] CloseHandle (hObject=0x15c) returned 1 [0115.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc")) returned 0x20 [0115.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0115.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0115.995] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.995] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.996] GetLastError () returned 0x0 [0115.996] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x400, lpOverlapped=0x0) returned 1 [0116.269] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x410, lpOverlapped=0x0) returned 1 [0116.270] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.270] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.270] SetEndOfFile (hFile=0x1f4) returned 1 [0116.270] CloseHandle (hObject=0x1f4) returned 1 [0116.271] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.271] SetEndOfFile (hFile=0x15c) returned 1 [0116.271] CloseHandle (hObject=0x15c) returned 1 [0116.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc")) returned 1 [0116.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.272] lstrlenW (lpString=".doc") returned 4 [0116.272] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.272] lstrlenW (lpString=".docx") returned 5 [0116.272] lstrcmpiW (lpString1=".docx", lpString2="S.POC") returned -1 [0116.272] lstrlenW (lpString=".pdf") returned 4 [0116.272] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.272] lstrlenW (lpString=".xls") returned 4 [0116.272] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.272] lstrlenW (lpString=".xlsx") returned 5 [0116.272] lstrcmpiW (lpString1=".xlsx", lpString2="S.POC") returned -1 [0116.272] lstrlenW (lpString=".ppt") returned 4 [0116.272] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.272] lstrlenW (lpString=".zip") returned 4 [0116.272] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.272] lstrlenW (lpString=".rar") returned 4 [0116.272] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.272] lstrlenW (lpString=".bz2") returned 4 [0116.272] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.272] lstrlenW (lpString=".7z") returned 3 [0116.272] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.272] lstrlenW (lpString=".dbf") returned 4 [0116.272] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.273] lstrlenW (lpString=".1cd") returned 4 [0116.273] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 62 [0116.273] lstrlenW (lpString=".jpg") returned 4 [0116.273] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.273] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") [0116.273] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=431828) returned 1 [0116.273] CloseHandle (hObject=0x15c) returned 1 [0116.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc")) returned 0x20 [0116.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0116.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.275] GetLastError () returned 0x0 [0116.275] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x696d4, lpOverlapped=0x0) returned 1 [0116.365] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x696e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x696e0, lpOverlapped=0x0) returned 1 [0116.374] ReadFile (in: hFile=0x15c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.374] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.374] SetEndOfFile (hFile=0x1f4) returned 1 [0116.374] CloseHandle (hObject=0x1f4) returned 1 [0116.374] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.375] SetEndOfFile (hFile=0x15c) returned 1 [0116.378] CloseHandle (hObject=0x15c) returned 1 [0116.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc")) returned 1 [0116.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.404] lstrlenW (lpString=".doc") returned 4 [0116.404] lstrcmpiW (lpString1=".doc", lpString2=".POC") returned -1 [0116.404] lstrlenW (lpString=".docx") returned 5 [0116.404] lstrcmpiW (lpString1=".docx", lpString2="8.POC") returned -1 [0116.404] lstrlenW (lpString=".pdf") returned 4 [0116.404] lstrcmpiW (lpString1=".pdf", lpString2=".POC") returned -1 [0116.404] lstrlenW (lpString=".xls") returned 4 [0116.404] lstrcmpiW (lpString1=".xls", lpString2=".POC") returned 1 [0116.404] lstrlenW (lpString=".xlsx") returned 5 [0116.404] lstrcmpiW (lpString1=".xlsx", lpString2="8.POC") returned -1 [0116.404] lstrlenW (lpString=".ppt") returned 4 [0116.404] lstrcmpiW (lpString1=".ppt", lpString2=".POC") returned 1 [0116.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.404] lstrlenW (lpString=".zip") returned 4 [0116.404] lstrcmpiW (lpString1=".zip", lpString2=".POC") returned 1 [0116.404] lstrlenW (lpString=".rar") returned 4 [0116.404] lstrcmpiW (lpString1=".rar", lpString2=".POC") returned 1 [0116.404] lstrlenW (lpString=".bz2") returned 4 [0116.404] lstrcmpiW (lpString1=".bz2", lpString2=".POC") returned -1 [0116.404] lstrlenW (lpString=".7z") returned 3 [0116.404] lstrcmpiW (lpString1=".7z", lpString2="POC") returned -1 [0116.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.405] lstrlenW (lpString=".dbf") returned 4 [0116.405] lstrcmpiW (lpString1=".dbf", lpString2=".POC") returned -1 [0116.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.405] lstrlenW (lpString=".1cd") returned 4 [0116.405] lstrcmpiW (lpString1=".1cd", lpString2=".POC") returned -1 [0116.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 61 [0116.405] lstrlenW (lpString=".jpg") returned 4 [0116.405] lstrcmpiW (lpString1=".jpg", lpString2=".POC") returned -1 [0116.405] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") [0116.405] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=180703) returned 1 [0116.405] CloseHandle (hObject=0x19c) returned 1 [0116.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv")) returned 0x20 [0116.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.407] GetLastError () returned 0x0 [0116.407] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2c1df, lpOverlapped=0x0) returned 1 [0116.487] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2c1e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2c1e0, lpOverlapped=0x0) returned 1 [0116.490] ReadFile (in: hFile=0x19c, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.490] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0116.491] SetEndOfFile (hFile=0x1fc) returned 1 [0116.491] CloseHandle (hObject=0x1fc) returned 1 [0116.491] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.491] SetEndOfFile (hFile=0x19c) returned 1 [0116.492] CloseHandle (hObject=0x19c) returned 1 [0116.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv")) returned 1 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.502] lstrlenW (lpString=".doc") returned 4 [0116.502] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.502] lstrlenW (lpString=".docx") returned 5 [0116.502] lstrcmpiW (lpString1=".docx", lpString2="T.DPV") returned -1 [0116.502] lstrlenW (lpString=".pdf") returned 4 [0116.502] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.502] lstrlenW (lpString=".xls") returned 4 [0116.502] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.503] lstrlenW (lpString=".xlsx") returned 5 [0116.503] lstrcmpiW (lpString1=".xlsx", lpString2="T.DPV") returned -1 [0116.503] lstrlenW (lpString=".ppt") returned 4 [0116.503] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.503] lstrlenW (lpString=".zip") returned 4 [0116.503] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.503] lstrlenW (lpString=".rar") returned 4 [0116.503] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.503] lstrlenW (lpString=".bz2") returned 4 [0116.503] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.503] lstrlenW (lpString=".7z") returned 3 [0116.503] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.503] lstrlenW (lpString=".dbf") returned 4 [0116.503] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.503] lstrlenW (lpString=".1cd") returned 4 [0116.503] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 58 [0116.503] lstrlenW (lpString=".jpg") returned 4 [0116.503] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.503] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") [0116.600] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10248) returned 1 [0116.600] CloseHandle (hObject=0x210) returned 1 [0116.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv")) returned 0x20 [0116.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.600] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.600] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.601] GetLastError () returned 0x0 [0116.601] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2808, lpOverlapped=0x0) returned 1 [0116.609] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2810, lpOverlapped=0x0) returned 1 [0116.610] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.610] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0116.611] SetEndOfFile (hFile=0x19c) returned 1 [0116.611] CloseHandle (hObject=0x19c) returned 1 [0116.611] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.611] SetEndOfFile (hFile=0x210) returned 1 [0116.612] CloseHandle (hObject=0x210) returned 1 [0116.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv")) returned 1 [0116.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.612] lstrlenW (lpString=".doc") returned 4 [0116.612] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.612] lstrlenW (lpString=".docx") returned 5 [0116.612] lstrcmpiW (lpString1=".docx", lpString2="B.DPV") returned -1 [0116.612] lstrlenW (lpString=".pdf") returned 4 [0116.612] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.612] lstrlenW (lpString=".xls") returned 4 [0116.612] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.612] lstrlenW (lpString=".xlsx") returned 5 [0116.612] lstrcmpiW (lpString1=".xlsx", lpString2="B.DPV") returned -1 [0116.612] lstrlenW (lpString=".ppt") returned 4 [0116.612] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.612] lstrlenW (lpString=".zip") returned 4 [0116.612] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.612] lstrlenW (lpString=".rar") returned 4 [0116.612] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.613] lstrlenW (lpString=".bz2") returned 4 [0116.613] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.613] lstrlenW (lpString=".7z") returned 3 [0116.613] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.613] lstrlenW (lpString=".dbf") returned 4 [0116.613] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.613] lstrlenW (lpString=".1cd") returned 4 [0116.613] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 67 [0116.613] lstrlenW (lpString=".jpg") returned 4 [0116.613] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.613] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") [0116.614] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3072) returned 1 [0116.614] CloseHandle (hObject=0x210) returned 1 [0116.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv")) returned 0x20 [0116.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.615] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.615] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.615] GetLastError () returned 0x0 [0116.615] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xc00, lpOverlapped=0x0) returned 1 [0116.624] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0116.628] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.628] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.628] SetEndOfFile (hFile=0x19c) returned 1 [0116.630] CloseHandle (hObject=0x19c) returned 1 [0116.630] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.630] SetEndOfFile (hFile=0x210) returned 1 [0116.631] CloseHandle (hObject=0x210) returned 1 [0116.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv")) returned 1 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString=".doc") returned 4 [0116.632] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.632] lstrlenW (lpString=".docx") returned 5 [0116.632] lstrcmpiW (lpString1=".docx", lpString2="S.DPV") returned -1 [0116.632] lstrlenW (lpString=".pdf") returned 4 [0116.632] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.632] lstrlenW (lpString=".xls") returned 4 [0116.632] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.632] lstrlenW (lpString=".xlsx") returned 5 [0116.632] lstrcmpiW (lpString1=".xlsx", lpString2="S.DPV") returned -1 [0116.632] lstrlenW (lpString=".ppt") returned 4 [0116.632] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString=".zip") returned 4 [0116.632] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.632] lstrlenW (lpString=".rar") returned 4 [0116.632] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.632] lstrlenW (lpString=".bz2") returned 4 [0116.632] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.632] lstrlenW (lpString=".7z") returned 3 [0116.632] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString=".dbf") returned 4 [0116.632] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString=".1cd") returned 4 [0116.632] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 61 [0116.632] lstrlenW (lpString=".jpg") returned 4 [0116.632] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.632] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") [0116.634] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4096) returned 1 [0116.634] CloseHandle (hObject=0x210) returned 1 [0116.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv")) returned 0x20 [0116.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.634] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.634] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.635] GetLastError () returned 0x0 [0116.635] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x1000, lpOverlapped=0x0) returned 1 [0116.636] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0116.637] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.637] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.638] SetEndOfFile (hFile=0x19c) returned 1 [0116.638] CloseHandle (hObject=0x19c) returned 1 [0116.638] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.638] SetEndOfFile (hFile=0x210) returned 1 [0116.639] CloseHandle (hObject=0x210) returned 1 [0116.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv")) returned 1 [0116.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.639] lstrlenW (lpString=".doc") returned 4 [0116.639] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.639] lstrlenW (lpString=".docx") returned 5 [0116.639] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0116.639] lstrlenW (lpString=".pdf") returned 4 [0116.639] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.639] lstrlenW (lpString=".xls") returned 4 [0116.639] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.639] lstrlenW (lpString=".xlsx") returned 5 [0116.639] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0116.639] lstrlenW (lpString=".ppt") returned 4 [0116.639] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.639] lstrlenW (lpString=".zip") returned 4 [0116.639] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.639] lstrlenW (lpString=".rar") returned 4 [0116.639] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.640] lstrlenW (lpString=".bz2") returned 4 [0116.640] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.640] lstrlenW (lpString=".7z") returned 3 [0116.640] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.640] lstrlenW (lpString=".dbf") returned 4 [0116.640] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.640] lstrlenW (lpString=".1cd") returned 4 [0116.640] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 62 [0116.640] lstrlenW (lpString=".jpg") returned 4 [0116.640] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.640] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") [0116.641] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24706) returned 1 [0116.641] CloseHandle (hObject=0x210) returned 1 [0116.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv")) returned 0x20 [0116.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.641] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.641] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.642] GetLastError () returned 0x0 [0116.642] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6082, lpOverlapped=0x0) returned 1 [0116.680] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6090, lpOverlapped=0x0) returned 1 [0116.681] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.681] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.682] SetEndOfFile (hFile=0x19c) returned 1 [0116.682] CloseHandle (hObject=0x19c) returned 1 [0116.682] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.682] SetEndOfFile (hFile=0x210) returned 1 [0116.683] CloseHandle (hObject=0x210) returned 1 [0116.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv")) returned 1 [0116.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.684] lstrlenW (lpString=".doc") returned 4 [0116.684] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.684] lstrlenW (lpString=".docx") returned 5 [0116.684] lstrcmpiW (lpString1=".docx", lpString2="N.DPV") returned -1 [0116.684] lstrlenW (lpString=".pdf") returned 4 [0116.684] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.684] lstrlenW (lpString=".xls") returned 4 [0116.684] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.684] lstrlenW (lpString=".xlsx") returned 5 [0116.684] lstrcmpiW (lpString1=".xlsx", lpString2="N.DPV") returned -1 [0116.684] lstrlenW (lpString=".ppt") returned 4 [0116.684] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.684] lstrlenW (lpString=".zip") returned 4 [0116.684] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.684] lstrlenW (lpString=".rar") returned 4 [0116.684] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.684] lstrlenW (lpString=".bz2") returned 4 [0116.684] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.684] lstrlenW (lpString=".7z") returned 3 [0116.684] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.684] lstrlenW (lpString=".dbf") returned 4 [0116.684] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.684] lstrlenW (lpString=".1cd") returned 4 [0116.684] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 62 [0116.685] lstrlenW (lpString=".jpg") returned 4 [0116.685] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.685] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") [0116.685] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=11967) returned 1 [0116.685] CloseHandle (hObject=0x210) returned 1 [0116.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv")) returned 0x20 [0116.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.686] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.686] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.687] GetLastError () returned 0x0 [0116.687] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x2ebf, lpOverlapped=0x0) returned 1 [0116.694] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x2ec0, lpOverlapped=0x0) returned 1 [0116.695] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.695] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.695] SetEndOfFile (hFile=0x19c) returned 1 [0116.696] CloseHandle (hObject=0x19c) returned 1 [0116.696] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.696] SetEndOfFile (hFile=0x210) returned 1 [0116.696] CloseHandle (hObject=0x210) returned 1 [0116.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0116.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv")) returned 1 [0116.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.697] lstrlenW (lpString=".doc") returned 4 [0116.697] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0116.697] lstrlenW (lpString=".docx") returned 5 [0116.697] lstrcmpiW (lpString1=".docx", lpString2="O.DPV") returned -1 [0116.697] lstrlenW (lpString=".pdf") returned 4 [0116.697] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0116.697] lstrlenW (lpString=".xls") returned 4 [0116.697] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0116.697] lstrlenW (lpString=".xlsx") returned 5 [0116.697] lstrcmpiW (lpString1=".xlsx", lpString2="O.DPV") returned -1 [0116.697] lstrlenW (lpString=".ppt") returned 4 [0116.697] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0116.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.697] lstrlenW (lpString=".zip") returned 4 [0116.697] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0116.697] lstrlenW (lpString=".rar") returned 4 [0116.697] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0116.697] lstrlenW (lpString=".bz2") returned 4 [0116.697] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0116.698] lstrlenW (lpString=".7z") returned 3 [0116.698] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0116.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.698] lstrlenW (lpString=".dbf") returned 4 [0116.698] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0116.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.698] lstrlenW (lpString=".1cd") returned 4 [0116.698] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0116.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 60 [0116.698] lstrlenW (lpString=".jpg") returned 4 [0116.698] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0116.698] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") [0116.698] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=331668) returned 1 [0116.699] CloseHandle (hObject=0x210) returned 1 [0116.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv")) returned 0x20 [0116.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0116.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0116.699] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.699] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0116.700] GetLastError () returned 0x0 [0116.700] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x50f94, lpOverlapped=0x0) returned 1 [0117.120] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x50fa0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x50fa0, lpOverlapped=0x0) returned 1 [0117.126] ReadFile (in: hFile=0x210, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.126] WriteFile (in: hFile=0x19c, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.126] SetEndOfFile (hFile=0x19c) returned 1 [0117.126] CloseHandle (hObject=0x19c) returned 1 [0117.126] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.126] SetEndOfFile (hFile=0x210) returned 1 [0117.130] CloseHandle (hObject=0x210) returned 1 [0117.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv")) returned 1 [0117.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.219] lstrlenW (lpString=".doc") returned 4 [0117.219] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.219] lstrlenW (lpString=".docx") returned 5 [0117.219] lstrcmpiW (lpString1=".docx", lpString2="D.DPV") returned -1 [0117.219] lstrlenW (lpString=".pdf") returned 4 [0117.219] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.219] lstrlenW (lpString=".xls") returned 4 [0117.219] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.219] lstrlenW (lpString=".xlsx") returned 5 [0117.219] lstrcmpiW (lpString1=".xlsx", lpString2="D.DPV") returned -1 [0117.219] lstrlenW (lpString=".ppt") returned 4 [0117.219] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.219] lstrlenW (lpString=".zip") returned 4 [0117.220] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.220] lstrlenW (lpString=".rar") returned 4 [0117.220] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.220] lstrlenW (lpString=".bz2") returned 4 [0117.220] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.220] lstrlenW (lpString=".7z") returned 3 [0117.220] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.220] lstrlenW (lpString=".dbf") returned 4 [0117.220] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.220] lstrlenW (lpString=".1cd") returned 4 [0117.220] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 62 [0117.220] lstrlenW (lpString=".jpg") returned 4 [0117.220] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.220] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") [0117.267] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3584) returned 1 [0117.267] CloseHandle (hObject=0x158) returned 1 [0117.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv")) returned 0x20 [0117.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0117.267] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.267] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.268] GetLastError () returned 0x0 [0117.268] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xe00, lpOverlapped=0x0) returned 1 [0117.269] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0117.270] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.270] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xea, lpOverlapped=0x0) returned 1 [0117.270] SetEndOfFile (hFile=0x1fc) returned 1 [0117.270] CloseHandle (hObject=0x1fc) returned 1 [0117.270] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.270] SetEndOfFile (hFile=0x158) returned 1 [0117.271] CloseHandle (hObject=0x158) returned 1 [0117.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv")) returned 1 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString=".doc") returned 4 [0117.272] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.272] lstrlenW (lpString=".docx") returned 5 [0117.272] lstrcmpiW (lpString1=".docx", lpString2="T.DPV") returned -1 [0117.272] lstrlenW (lpString=".pdf") returned 4 [0117.272] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.272] lstrlenW (lpString=".xls") returned 4 [0117.272] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.272] lstrlenW (lpString=".xlsx") returned 5 [0117.272] lstrcmpiW (lpString1=".xlsx", lpString2="T.DPV") returned -1 [0117.272] lstrlenW (lpString=".ppt") returned 4 [0117.272] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString=".zip") returned 4 [0117.272] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.272] lstrlenW (lpString=".rar") returned 4 [0117.272] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.272] lstrlenW (lpString=".bz2") returned 4 [0117.272] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.272] lstrlenW (lpString=".7z") returned 3 [0117.272] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString=".dbf") returned 4 [0117.272] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString=".1cd") returned 4 [0117.272] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 61 [0117.272] lstrlenW (lpString=".jpg") returned 4 [0117.273] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.273] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") [0117.273] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=28295) returned 1 [0117.273] CloseHandle (hObject=0x158) returned 1 [0117.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv")) returned 0x20 [0117.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0117.274] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.274] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.274] GetLastError () returned 0x0 [0117.274] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x6e87, lpOverlapped=0x0) returned 1 [0117.276] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0x6e90, lpOverlapped=0x0) returned 1 [0117.278] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.278] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.278] SetEndOfFile (hFile=0x1fc) returned 1 [0117.278] CloseHandle (hObject=0x1fc) returned 1 [0117.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.278] SetEndOfFile (hFile=0x158) returned 1 [0117.279] CloseHandle (hObject=0x158) returned 1 [0117.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv")) returned 1 [0117.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.279] lstrlenW (lpString=".doc") returned 4 [0117.279] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0117.279] lstrlenW (lpString=".docx") returned 5 [0117.279] lstrcmpiW (lpString1=".docx", lpString2="M.DPV") returned -1 [0117.279] lstrlenW (lpString=".pdf") returned 4 [0117.279] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0117.280] lstrlenW (lpString=".xls") returned 4 [0117.280] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0117.280] lstrlenW (lpString=".xlsx") returned 5 [0117.280] lstrcmpiW (lpString1=".xlsx", lpString2="M.DPV") returned -1 [0117.280] lstrlenW (lpString=".ppt") returned 4 [0117.280] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0117.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.280] lstrlenW (lpString=".zip") returned 4 [0117.280] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0117.280] lstrlenW (lpString=".rar") returned 4 [0117.280] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0117.280] lstrlenW (lpString=".bz2") returned 4 [0117.280] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0117.280] lstrlenW (lpString=".7z") returned 3 [0117.280] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0117.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.280] lstrlenW (lpString=".dbf") returned 4 [0117.280] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0117.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.280] lstrlenW (lpString=".1cd") returned 4 [0117.280] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0117.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 62 [0117.280] lstrlenW (lpString=".jpg") returned 4 [0117.280] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0117.280] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") [0117.282] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=44609) returned 1 [0117.282] CloseHandle (hObject=0x158) returned 1 [0117.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv")) returned 0x20 [0117.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.id-9c354b42.[restdoc@protonmail.com].zoh")) returned 0xffffffff [0117.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0117.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.id-9c354b42.[restdoc@protonmail.com].zoh"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.283] GetLastError () returned 0x0 [0117.283] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0xae41, lpOverlapped=0x0) returned 1 [0117.450] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xae50, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xae50, lpOverlapped=0x0) returned 1 [0117.451] ReadFile (in: hFile=0x158, lpBuffer=0x3e60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0117.451] WriteFile (in: hFile=0x1fc, lpBuffer=0x3e60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e60020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0117.451] SetEndOfFile (hFile=0x1fc) returned 1 [0117.844] CloseHandle (hObject=0x1fc) returned 1 [0117.844] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0117.845] SetEndOfFile (hFile=0x158) returned 1 [0117.845] CloseHandle (hObject=0x158) returned 1 [0117.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id-9C354B42.[restdoc@protonmail.com].zoh", dwFileAttributes=0x20) returned 1 [0117.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv")) returned 1 [0118.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.269] lstrlenW (lpString=".doc") returned 4 [0118.269] lstrcmpiW (lpString1=".doc", lpString2=".DPV") returned -1 [0118.269] lstrlenW (lpString=".docx") returned 5 [0118.269] lstrcmpiW (lpString1=".docx", lpString2="R.DPV") returned -1 [0118.269] lstrlenW (lpString=".pdf") returned 4 [0118.269] lstrcmpiW (lpString1=".pdf", lpString2=".DPV") returned 1 [0118.269] lstrlenW (lpString=".xls") returned 4 [0118.269] lstrcmpiW (lpString1=".xls", lpString2=".DPV") returned 1 [0118.269] lstrlenW (lpString=".xlsx") returned 5 [0118.269] lstrcmpiW (lpString1=".xlsx", lpString2="R.DPV") returned -1 [0118.269] lstrlenW (lpString=".ppt") returned 4 [0118.269] lstrcmpiW (lpString1=".ppt", lpString2=".DPV") returned 1 [0118.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.269] lstrlenW (lpString=".zip") returned 4 [0118.269] lstrcmpiW (lpString1=".zip", lpString2=".DPV") returned 1 [0118.269] lstrlenW (lpString=".rar") returned 4 [0118.269] lstrcmpiW (lpString1=".rar", lpString2=".DPV") returned 1 [0118.269] lstrlenW (lpString=".bz2") returned 4 [0118.269] lstrcmpiW (lpString1=".bz2", lpString2=".DPV") returned -1 [0118.271] lstrlenW (lpString=".7z") returned 3 [0118.271] lstrcmpiW (lpString1=".7z", lpString2="DPV") returned -1 [0118.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.271] lstrlenW (lpString=".dbf") returned 4 [0118.271] lstrcmpiW (lpString1=".dbf", lpString2=".DPV") returned -1 [0118.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.271] lstrlenW (lpString=".1cd") returned 4 [0118.278] lstrcmpiW (lpString1=".1cd", lpString2=".DPV") returned -1 [0118.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 62 [0118.278] lstrlenW (lpString=".jpg") returned 4 [0118.278] lstrcmpiW (lpString1=".jpg", lpString2=".DPV") returned 1 [0118.285] RtlInitUnicodeStringEx (DestinationString=0x336fee8, SourceString="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC") Thread: id = 18 os_tid = 0x9e4 [0033.728] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x37d02c0 [0033.728] lstrlenW (lpString="C:") returned 2 [0033.728] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6b4900 [0033.728] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.728] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.728] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.728] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.728] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x37e02c8 [0033.729] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.729] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4940 [0033.729] FindNextFileW (in: hFindFile=0x6b4940, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.729] FindNextFileW (in: hFindFile=0x6b4940, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.729] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.729] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.729] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.729] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.729] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f70048 [0033.730] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.730] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b5988 [0033.730] FindNextFileW (in: hFindFile=0x6b5988, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.730] FindNextFileW (in: hFindFile=0x6b5988, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.730] lstrlenW (lpString="desktop.ini") returned 11 [0033.730] lstrlenW (lpString=".1cd") returned 4 [0033.730] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.730] lstrlenW (lpString=".3ds") returned 4 [0033.730] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.730] lstrlenW (lpString=".3fr") returned 4 [0033.731] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".3g2") returned 4 [0033.731] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".3gp") returned 4 [0033.731] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".7z") returned 3 [0033.731] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.731] lstrlenW (lpString=".accda") returned 6 [0033.731] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".accdb") returned 6 [0033.731] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".accdc") returned 6 [0033.731] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".accde") returned 6 [0033.731] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".accdt") returned 6 [0033.731] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".accdw") returned 6 [0033.731] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.731] lstrlenW (lpString=".adb") returned 4 [0033.731] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".adp") returned 4 [0033.731] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".ai") returned 3 [0033.731] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.731] lstrlenW (lpString=".ai3") returned 4 [0033.731] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".ai4") returned 4 [0033.731] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".ai5") returned 4 [0033.731] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".ai6") returned 4 [0033.731] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.731] lstrlenW (lpString=".ai7") returned 4 [0033.731] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".ai8") returned 4 [0033.732] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".anim") returned 5 [0033.732] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.732] lstrlenW (lpString=".arw") returned 4 [0033.732] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".as") returned 3 [0033.732] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.732] lstrlenW (lpString=".asa") returned 4 [0033.732] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".asc") returned 4 [0033.732] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".ascx") returned 5 [0033.732] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.732] lstrlenW (lpString=".asm") returned 4 [0033.732] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".asmx") returned 5 [0033.732] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.732] lstrlenW (lpString=".asp") returned 4 [0033.732] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".aspx") returned 5 [0033.732] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.732] lstrlenW (lpString=".asr") returned 4 [0033.732] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".asx") returned 4 [0033.732] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".avi") returned 4 [0033.732] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".avs") returned 4 [0033.732] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".backup") returned 7 [0033.732] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.732] lstrlenW (lpString=".bak") returned 4 [0033.732] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.732] lstrlenW (lpString=".bay") returned 4 [0033.733] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".bd") returned 3 [0033.733] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.733] lstrlenW (lpString=".bin") returned 4 [0033.733] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".bmp") returned 4 [0033.733] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".bz2") returned 4 [0033.733] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".c") returned 2 [0033.733] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.733] lstrlenW (lpString=".cdr") returned 4 [0033.733] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".cer") returned 4 [0033.733] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".cf") returned 3 [0033.733] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.733] lstrlenW (lpString=".cfc") returned 4 [0033.733] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".cfm") returned 4 [0033.733] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".cfml") returned 5 [0033.733] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.733] lstrlenW (lpString=".cfu") returned 4 [0033.733] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".chm") returned 4 [0033.733] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".cin") returned 4 [0033.733] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".class") returned 6 [0033.733] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.733] lstrlenW (lpString=".clx") returned 4 [0033.733] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.733] lstrlenW (lpString=".config") returned 7 [0033.733] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.734] lstrlenW (lpString=".cpp") returned 4 [0033.734] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".cr2") returned 4 [0033.734] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".crt") returned 4 [0033.734] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".crw") returned 4 [0033.734] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".cs") returned 3 [0033.734] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.734] lstrlenW (lpString=".css") returned 4 [0033.734] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".csv") returned 4 [0033.734] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".cub") returned 4 [0033.734] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dae") returned 4 [0033.734] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dat") returned 4 [0033.734] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".db") returned 3 [0033.734] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.734] lstrlenW (lpString=".dbf") returned 4 [0033.734] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dbx") returned 4 [0033.734] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dc3") returned 4 [0033.734] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dcm") returned 4 [0033.734] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dcr") returned 4 [0033.734] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".der") returned 4 [0033.734] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.734] lstrlenW (lpString=".dib") returned 4 [0033.735] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dic") returned 4 [0033.735] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dif") returned 4 [0033.735] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".divx") returned 5 [0033.735] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".djvu") returned 5 [0033.735] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".dng") returned 4 [0033.735] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".doc") returned 4 [0033.735] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".docm") returned 5 [0033.735] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".docx") returned 5 [0033.735] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".dot") returned 4 [0033.735] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dotm") returned 5 [0033.735] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".dotx") returned 5 [0033.735] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.735] lstrlenW (lpString=".dpx") returned 4 [0033.735] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dqy") returned 4 [0033.735] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dsn") returned 4 [0033.735] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dt") returned 3 [0033.735] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.735] lstrlenW (lpString=".dtd") returned 4 [0033.735] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.735] lstrlenW (lpString=".dwg") returned 4 [0033.735] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".dwt") returned 4 [0033.736] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".dx") returned 3 [0033.736] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.736] lstrlenW (lpString=".dxf") returned 4 [0033.736] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".edml") returned 5 [0033.736] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.736] lstrlenW (lpString=".efd") returned 4 [0033.736] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".elf") returned 4 [0033.736] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".emf") returned 4 [0033.736] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".emz") returned 4 [0033.736] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".epf") returned 4 [0033.736] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".eps") returned 4 [0033.736] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".epsf") returned 5 [0033.736] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.736] lstrlenW (lpString=".epsp") returned 5 [0033.736] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.736] lstrlenW (lpString=".erf") returned 4 [0033.736] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".exr") returned 4 [0033.736] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".f4v") returned 4 [0033.736] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".fido") returned 5 [0033.736] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.736] lstrlenW (lpString=".flm") returned 4 [0033.736] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.736] lstrlenW (lpString=".flv") returned 4 [0033.737] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".frm") returned 4 [0033.737] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".fxg") returned 4 [0033.737] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".geo") returned 4 [0033.737] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".gif") returned 4 [0033.737] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".grs") returned 4 [0033.737] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".gz") returned 3 [0033.737] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.737] lstrlenW (lpString=".h") returned 2 [0033.737] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.737] lstrlenW (lpString=".hdr") returned 4 [0033.737] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".hpp") returned 4 [0033.737] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".hta") returned 4 [0033.737] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".htc") returned 4 [0033.737] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".htm") returned 4 [0033.737] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".html") returned 5 [0033.737] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.737] lstrlenW (lpString=".icb") returned 4 [0033.737] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".ics") returned 4 [0033.737] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".iff") returned 4 [0033.737] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.737] lstrlenW (lpString=".inc") returned 4 [0033.737] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.738] lstrlenW (lpString=".indd") returned 5 [0033.738] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.738] lstrlenW (lpString=".ini") returned 4 [0033.738] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.738] lstrlenW (lpString="desktop.ini") returned 11 [0033.738] lstrlenW (lpString=".zoh") returned 4 [0033.738] lstrcmpiW (lpString1=".zoh", lpString2=".ini") returned 1 [0033.738] lstrlenW (lpString="desktop.ini") returned 11 [0033.738] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0033.738] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0033.738] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0033.738] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0033.738] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0033.738] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0033.738] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0033.738] lstrcmpiW (lpString1="rruzcj.exe", lpString2="desktop.ini") returned 1 [0033.738] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.738] FindNextFileW (in: hFindFile=0x6b5988, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.738] FindClose (in: hFindFile=0x6b5988 | out: hFindFile=0x6b5988) returned 1 [0033.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0033.738] FindNextFileW (in: hFindFile=0x6b4940, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.738] FindClose (in: hFindFile=0x6b4940 | out: hFindFile=0x6b4940) returned 1 [0033.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.738] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.738] lstrlenW (lpString="C:\\Boot") returned 7 [0033.738] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.739] lstrlenW (lpString="Boot") returned 4 [0033.739] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.739] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f70048 [0033.739] lstrlenW (lpString="C:\\Boot") returned 7 [0033.739] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b5948 [0033.739] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.739] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.739] lstrlenW (lpString="BCD") returned 3 [0033.739] lstrlenW (lpString=".1cd") returned 4 [0033.739] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".3ds") returned 4 [0033.739] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".3fr") returned 4 [0033.739] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".3g2") returned 4 [0033.739] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".3gp") returned 4 [0033.739] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".7z") returned 3 [0033.739] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.739] lstrlenW (lpString=".accda") returned 6 [0033.739] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.739] lstrlenW (lpString=".accdb") returned 6 [0033.739] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".accdc") returned 6 [0033.740] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".accde") returned 6 [0033.740] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".accdt") returned 6 [0033.740] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".accdw") returned 6 [0033.740] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".adb") returned 4 [0033.740] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".adp") returned 4 [0033.740] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai") returned 3 [0033.740] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.740] lstrlenW (lpString=".ai3") returned 4 [0033.740] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai4") returned 4 [0033.740] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai5") returned 4 [0033.740] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai6") returned 4 [0033.740] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai7") returned 4 [0033.740] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".ai8") returned 4 [0033.740] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".anim") returned 5 [0033.740] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".arw") returned 4 [0033.740] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.740] lstrlenW (lpString=".as") returned 3 [0033.741] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.741] lstrlenW (lpString=".asa") returned 4 [0033.741] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asc") returned 4 [0033.741] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".ascx") returned 5 [0033.741] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asm") returned 4 [0033.741] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asmx") returned 5 [0033.741] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asp") returned 4 [0033.741] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".aspx") returned 5 [0033.741] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asr") returned 4 [0033.741] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".asx") returned 4 [0033.741] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".avi") returned 4 [0033.741] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".avs") returned 4 [0033.741] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".backup") returned 7 [0033.741] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".bak") returned 4 [0033.741] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".bay") returned 4 [0033.741] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".bd") returned 3 [0033.741] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.741] lstrlenW (lpString=".bin") returned 4 [0033.741] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.741] lstrlenW (lpString=".bmp") returned 4 [0033.741] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".bz2") returned 4 [0033.742] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".c") returned 2 [0033.742] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.742] lstrlenW (lpString=".cdr") returned 4 [0033.742] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cer") returned 4 [0033.742] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cf") returned 3 [0033.742] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.742] lstrlenW (lpString=".cfc") returned 4 [0033.742] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cfm") returned 4 [0033.742] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cfml") returned 5 [0033.742] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cfu") returned 4 [0033.742] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".chm") returned 4 [0033.742] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cin") returned 4 [0033.742] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".class") returned 6 [0033.742] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".clx") returned 4 [0033.742] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".config") returned 7 [0033.742] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cpp") returned 4 [0033.742] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".cr2") returned 4 [0033.742] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".crt") returned 4 [0033.742] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.742] lstrlenW (lpString=".crw") returned 4 [0033.743] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".cs") returned 3 [0033.743] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.743] lstrlenW (lpString=".css") returned 4 [0033.743] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".csv") returned 4 [0033.743] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".cub") returned 4 [0033.743] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dae") returned 4 [0033.743] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dat") returned 4 [0033.743] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".db") returned 3 [0033.743] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.743] lstrlenW (lpString=".dbf") returned 4 [0033.743] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dbx") returned 4 [0033.743] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dc3") returned 4 [0033.743] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dcm") returned 4 [0033.743] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dcr") returned 4 [0033.743] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".der") returned 4 [0033.743] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dib") returned 4 [0033.743] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dic") returned 4 [0033.743] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".dif") returned 4 [0033.743] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.743] lstrlenW (lpString=".divx") returned 5 [0033.743] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".djvu") returned 5 [0033.744] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dng") returned 4 [0033.744] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".doc") returned 4 [0033.744] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".docm") returned 5 [0033.744] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".docx") returned 5 [0033.744] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dot") returned 4 [0033.744] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dotm") returned 5 [0033.744] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dotx") returned 5 [0033.744] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dpx") returned 4 [0033.744] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dqy") returned 4 [0033.744] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dsn") returned 4 [0033.744] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dt") returned 3 [0033.744] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.744] lstrlenW (lpString=".dtd") returned 4 [0033.744] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dwg") returned 4 [0033.744] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dwt") returned 4 [0033.744] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".dx") returned 3 [0033.744] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.744] lstrlenW (lpString=".dxf") returned 4 [0033.744] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.744] lstrlenW (lpString=".edml") returned 5 [0033.745] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".efd") returned 4 [0033.745] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".elf") returned 4 [0033.745] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".emf") returned 4 [0033.745] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".emz") returned 4 [0033.745] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".epf") returned 4 [0033.745] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".eps") returned 4 [0033.745] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".epsf") returned 5 [0033.745] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".epsp") returned 5 [0033.745] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".erf") returned 4 [0033.745] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".exr") returned 4 [0033.745] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".f4v") returned 4 [0033.745] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.745] lstrlenW (lpString=".fido") returned 5 [0033.745] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.783] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.783] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.784] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.784] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.784] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.784] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.784] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.784] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.785] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.785] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.785] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.785] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.785] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.785] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.786] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.786] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.786] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.786] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.786] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.786] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.786] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.787] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.787] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.787] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.787] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.787] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.787] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.788] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.788] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.788] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.789] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.789] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.789] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.789] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.789] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.790] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.790] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.790] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.790] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.790] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.791] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.791] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.791] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.791] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.792] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.792] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.792] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.793] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.793] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.793] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.808] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.808] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.809] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.809] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.809] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.809] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.809] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.809] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.809] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.809] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.810] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.810] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.810] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.811] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.811] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.811] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.811] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0033.811] FindNextFileW (in: hFindFile=0x6b5948, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.811] FindClose (in: hFindFile=0x6b5948 | out: hFindFile=0x6b5948) returned 1 [0033.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0033.811] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.812] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.812] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.812] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.812] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0033.812] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.813] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0033.813] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.813] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.813] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.815] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.816] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0033.817] FindNextFileW (in: hFindFile=0x6b6ec8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.817] FindNextFileW (in: hFindFile=0x6b6ec8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0033.818] FindClose (in: hFindFile=0x6b6ec8 | out: hFindFile=0x6b6ec8) returned 1 [0033.818] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0033.818] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0033.820] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.820] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0033.820] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.821] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0033.821] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0033.823] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.823] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0033.824] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.824] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0033.824] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0033.826] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.826] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0033.827] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.828] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0033.828] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0033.982] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.982] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0033.982] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.982] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0033.982] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0033.987] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.987] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0033.988] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.988] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0033.988] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0033.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd61d8 | out: hHeap=0x5c0000) returned 1 [0033.989] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0033.996] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.996] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0033.997] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0033.997] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd61d8 | out: hHeap=0x5c0000) returned 1 [0033.997] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0033.999] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.999] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0034.000] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.000] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd61d8 | out: hHeap=0x5c0000) returned 1 [0034.000] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0034.000] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.000] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.000] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0034.065] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.065] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.067] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.068] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.068] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0034.069] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.069] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0034.070] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.070] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0034.071] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.071] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0034.071] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.071] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.071] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0034.073] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.073] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0034.074] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.075] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.075] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0034.078] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.078] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0034.078] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.079] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0034.080] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.080] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0034.081] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.082] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.082] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0034.083] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.083] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.085] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.085] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0034.085] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.085] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4fa8 | out: hHeap=0x5c0000) returned 1 [0034.085] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0034.087] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.087] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0034.089] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.089] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0034.091] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.091] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0034.092] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4fa8 | out: hHeap=0x5c0000) returned 1 [0034.092] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0034.093] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.093] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.093] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0034.778] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.778] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.779] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.780] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.780] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0034.781] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.781] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.782] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.783] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0034.784] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.784] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.786] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb14c0 | out: hHeap=0x5c0000) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x6b6e88, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0034.787] FindClose (in: hFindFile=0x6b6e88 | out: hFindFile=0x6b6e88) returned 1 [0034.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0034.787] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0034.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x3fc2628, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.787] FindNextFileW (in: hFindFile=0x3fc2628, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.787] FindClose (in: hFindFile=0x3fc2628 | out: hFindFile=0x3fc2628) returned 1 [0034.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x37e02c8 | out: hHeap=0x5c0000) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0034.788] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f70048 | out: hHeap=0x5c0000) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x6b4900, lpFindFileData=0x34afd00 | out: lpFindFileData=0x34afd00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x857e99c0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x857e99c0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x857e99c0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x857e99c0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x34afa84 | out: lpFindFileData=0x34afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7e74a8e0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x7e74a8e0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc2628, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7e74a8e0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x7e74a8e0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc2628, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.788] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0034.789] FindClose (in: hFindFile=0x3fc2668 | out: hFindFile=0x3fc2668) returned 1 [0034.789] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb0068 | out: hHeap=0x5c0000) returned 1 [0034.789] FindNextFileW (in: hFindFile=0x3fc2628, lpFindFileData=0x34af808 | out: lpFindFileData=0x34af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde507ce0, ftCreationTime.dwHighDateTime=0x1d4f025, ftLastAccessTime.dwLowDateTime=0x2a2c6640, ftLastAccessTime.dwHighDateTime=0x1d4fe3d, ftLastWriteTime.dwLowDateTime=0x2a2c6640, ftLastWriteTime.dwHighDateTime=0x1d4fe3d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="first-nc-parking.exe", cAlternateFileName="FIRST-~1.EXE")) returned 1 [0034.789] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.789] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0034.790] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.790] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0034.790] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.790] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.790] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0034.790] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.790] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.791] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.791] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0034.791] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0034.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0034.791] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0034.792] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0034.792] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0034.793] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.793] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0034.794] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.794] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0034.795] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.796] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.796] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0034.796] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.796] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0034.797] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0034.797] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0034.797] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0035.673] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.673] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0035.673] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.673] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.674] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.674] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.674] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.674] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.674] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.674] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.675] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.675] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.675] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.675] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.675] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.675] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0035.676] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.676] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.676] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.676] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.676] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.677] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.677] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0035.678] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.679] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.679] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0035.679] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.679] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.679] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.679] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.679] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0035.680] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.680] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.680] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.680] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.680] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0035.680] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.681] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.681] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.681] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.681] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0035.681] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.681] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.681] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0035.681] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0035.682] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0035.683] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.683] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0035.684] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.684] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0035.684] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.684] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.684] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0035.684] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.685] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0035.685] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.685] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.685] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0035.686] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.686] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0035.687] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.688] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.688] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0035.689] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.689] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0035.689] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.690] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.690] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0035.691] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.691] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0035.691] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.692] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.692] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0035.692] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.692] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0035.692] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.692] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.692] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0035.692] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.693] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0035.847] NtSetEvent (EventHandle=0x184, PreviousState=0x0) [0035.848] NtSetEvent (EventHandle=0x1ac, PreviousState=0x0) [0035.848] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0035.848] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0035.848] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0035.848] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0036.562] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.562] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4018608 | out: hHeap=0x5c0000) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0036.562] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.562] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4008600 | out: hHeap=0x5c0000) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.562] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.563] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.563] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.563] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.563] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.564] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0036.564] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.564] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.564] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.564] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.564] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.567] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.567] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.567] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.567] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.567] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.568] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.568] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.568] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.568] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.568] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0036.569] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.569] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.569] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.569] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.569] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0036.569] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.570] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.570] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.570] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.570] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.570] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.571] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.571] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.571] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.571] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.571] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.571] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.571] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.572] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.572] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.572] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.572] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.572] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.573] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.573] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.573] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.573] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0036.573] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.574] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.574] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.574] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.574] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0036.574] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.574] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.574] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.574] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.574] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0036.575] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.575] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.575] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.575] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.575] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0036.575] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.575] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.576] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.576] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.576] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.576] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.576] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.576] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.576] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.577] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0036.577] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.577] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.577] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.577] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.577] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0036.829] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0036.829] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff85f8 | out: hHeap=0x5c0000) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0036.829] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0036.829] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.829] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0036.830] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.830] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0036.830] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0036.830] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.830] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0036.960] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.960] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0036.961] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.962] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0036.962] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0036.964] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.964] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0036.964] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.964] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0036.964] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0037.066] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.067] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0037.069] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.069] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0037.069] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.070] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0037.071] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.071] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0037.071] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.071] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.071] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0037.072] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.072] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0037.073] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.073] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0037.074] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0037.075] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.075] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0037.076] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.077] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.077] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0037.078] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.078] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0037.080] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0037.081] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.081] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0037.082] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.082] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0037.084] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0037.086] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.086] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0037.087] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0037.088] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.088] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.088] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.088] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.088] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.089] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.089] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.090] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.090] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0037.091] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.091] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0037.091] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.092] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0037.092] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.092] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0037.093] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.093] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0037.093] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.093] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.093] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0037.094] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.094] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.095] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.095] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.095] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0037.095] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.095] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.095] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.095] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.095] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0037.096] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.096] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.096] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0037.096] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.096] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0037.096] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.096] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0037.096] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0037.097] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.097] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.097] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0037.098] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.098] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0037.099] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.100] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.100] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0037.100] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.100] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0037.101] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.101] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0037.103] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.103] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.104] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.104] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0037.104] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.104] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.104] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0037.592] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.621] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.621] NtAllocateVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x34aec88*=0x4049000, ZeroBits=0x0, RegionSize=0x34aec8c*=0x53000, AllocationType=0x1000, Protect=0x4) [0037.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned 67 [0037.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc26e8 [0037.622] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.622] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x34aee18 | out: lpFindFileData=0x34aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0037.623] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.623] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0037.623] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.625] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0037.625] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.625] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.625] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0037.625] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.625] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0037.626] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.626] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.626] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0037.626] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.627] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0037.629] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.630] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.630] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0037.630] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.630] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.630] NtAllocateVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x34aef04*=0x4018000, ZeroBits=0x0, RegionSize=0x34aef08*=0x10000, AllocationType=0x1000, Protect=0x4) [0037.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0037.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc25a8 [0037.630] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.631] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.631] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.631] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.631] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0037.631] FindClose (in: hFindFile=0x3fc26a8 | out: hFindFile=0x3fc26a8) returned 1 [0037.631] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff75f0 | out: hHeap=0x5c0000) returned 1 [0037.631] FindNextFileW (in: hFindFile=0x3fc2668, lpFindFileData=0x34af58c | out: lpFindFileData=0x34af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0037.841] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.841] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0037.841] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.841] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0037.842] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.842] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.842] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0037.842] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.842] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0037.842] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.842] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.842] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0037.843] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.843] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0037.843] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.843] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.843] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0037.843] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.843] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0037.844] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.844] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0037.844] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.844] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.844] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0037.845] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.845] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0037.845] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.845] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0037.846] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.846] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0037.846] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.846] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.846] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0037.846] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.846] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0037.847] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.847] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0037.847] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.847] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4017600 | out: hHeap=0x5c0000) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x34af310 | out: lpFindFileData=0x34af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x34af094 | out: lpFindFileData=0x34af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 Thread: id = 19 os_tid = 0x9e8 [0033.747] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f80050 [0033.747] lstrlenW (lpString="C:") returned 2 [0033.747] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6b6dc8 [0033.747] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.747] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.747] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.747] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.747] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f90058 [0033.748] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.748] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b6e08 [0033.748] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.748] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.748] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.748] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.748] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.748] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3fa1068 [0033.748] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.748] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b6e48 [0033.748] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.749] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.749] lstrlenW (lpString="desktop.ini") returned 11 [0033.749] lstrlenW (lpString=".1cd") returned 4 [0033.749] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".3ds") returned 4 [0033.749] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".3fr") returned 4 [0033.749] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".3g2") returned 4 [0033.749] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".3gp") returned 4 [0033.749] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".7z") returned 3 [0033.749] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.749] lstrlenW (lpString=".accda") returned 6 [0033.749] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".accdb") returned 6 [0033.749] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".accdc") returned 6 [0033.749] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".accde") returned 6 [0033.749] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".accdt") returned 6 [0033.749] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".accdw") returned 6 [0033.749] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.749] lstrlenW (lpString=".adb") returned 4 [0033.749] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".adp") returned 4 [0033.749] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.749] lstrlenW (lpString=".ai") returned 3 [0033.750] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.750] lstrlenW (lpString=".ai3") returned 4 [0033.750] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ai4") returned 4 [0033.750] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ai5") returned 4 [0033.750] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ai6") returned 4 [0033.750] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ai7") returned 4 [0033.750] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ai8") returned 4 [0033.750] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".anim") returned 5 [0033.750] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.750] lstrlenW (lpString=".arw") returned 4 [0033.750] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".as") returned 3 [0033.750] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.750] lstrlenW (lpString=".asa") returned 4 [0033.750] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".asc") returned 4 [0033.750] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".ascx") returned 5 [0033.750] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.750] lstrlenW (lpString=".asm") returned 4 [0033.750] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".asmx") returned 5 [0033.750] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.750] lstrlenW (lpString=".asp") returned 4 [0033.750] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".aspx") returned 5 [0033.750] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.750] lstrlenW (lpString=".asr") returned 4 [0033.750] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.750] lstrlenW (lpString=".asx") returned 4 [0033.751] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".avi") returned 4 [0033.751] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".avs") returned 4 [0033.751] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".backup") returned 7 [0033.751] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.751] lstrlenW (lpString=".bak") returned 4 [0033.751] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".bay") returned 4 [0033.751] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".bd") returned 3 [0033.751] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.751] lstrlenW (lpString=".bin") returned 4 [0033.751] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".bmp") returned 4 [0033.751] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".bz2") returned 4 [0033.751] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".c") returned 2 [0033.751] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.751] lstrlenW (lpString=".cdr") returned 4 [0033.751] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".cer") returned 4 [0033.751] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".cf") returned 3 [0033.751] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.751] lstrlenW (lpString=".cfc") returned 4 [0033.751] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".cfm") returned 4 [0033.751] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".cfml") returned 5 [0033.751] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.751] lstrlenW (lpString=".cfu") returned 4 [0033.751] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.751] lstrlenW (lpString=".chm") returned 4 [0033.752] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".cin") returned 4 [0033.752] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".class") returned 6 [0033.752] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.752] lstrlenW (lpString=".clx") returned 4 [0033.752] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".config") returned 7 [0033.752] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.752] lstrlenW (lpString=".cpp") returned 4 [0033.752] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".cr2") returned 4 [0033.752] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".crt") returned 4 [0033.752] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".crw") returned 4 [0033.752] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".cs") returned 3 [0033.752] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.752] lstrlenW (lpString=".css") returned 4 [0033.752] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".csv") returned 4 [0033.752] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".cub") returned 4 [0033.752] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".dae") returned 4 [0033.752] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".dat") returned 4 [0033.752] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".db") returned 3 [0033.752] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.752] lstrlenW (lpString=".dbf") returned 4 [0033.752] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".dbx") returned 4 [0033.752] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.752] lstrlenW (lpString=".dc3") returned 4 [0033.753] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dcm") returned 4 [0033.753] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dcr") returned 4 [0033.753] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".der") returned 4 [0033.753] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dib") returned 4 [0033.753] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dic") returned 4 [0033.753] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dif") returned 4 [0033.753] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".divx") returned 5 [0033.753] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.753] lstrlenW (lpString=".djvu") returned 5 [0033.753] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.753] lstrlenW (lpString=".dng") returned 4 [0033.753] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".doc") returned 4 [0033.753] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".docm") returned 5 [0033.753] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.753] lstrlenW (lpString=".docx") returned 5 [0033.753] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.753] lstrlenW (lpString=".dot") returned 4 [0033.753] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.753] lstrlenW (lpString=".dotm") returned 5 [0033.753] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.753] lstrlenW (lpString=".dotx") returned 5 [0033.753] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.754] lstrlenW (lpString=".dpx") returned 4 [0033.754] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dqy") returned 4 [0033.754] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dsn") returned 4 [0033.754] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dt") returned 3 [0033.754] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.754] lstrlenW (lpString=".dtd") returned 4 [0033.754] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dwg") returned 4 [0033.754] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dwt") returned 4 [0033.754] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".dx") returned 3 [0033.754] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.754] lstrlenW (lpString=".dxf") returned 4 [0033.754] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".edml") returned 5 [0033.754] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.754] lstrlenW (lpString=".efd") returned 4 [0033.754] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".elf") returned 4 [0033.754] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".emf") returned 4 [0033.754] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".emz") returned 4 [0033.754] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".epf") returned 4 [0033.754] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.754] lstrlenW (lpString=".eps") returned 4 [0033.755] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".epsf") returned 5 [0033.755] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.755] lstrlenW (lpString=".epsp") returned 5 [0033.755] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.755] lstrlenW (lpString=".erf") returned 4 [0033.755] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".exr") returned 4 [0033.755] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".f4v") returned 4 [0033.755] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".fido") returned 5 [0033.755] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.755] lstrlenW (lpString=".flm") returned 4 [0033.755] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".flv") returned 4 [0033.755] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".frm") returned 4 [0033.755] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".fxg") returned 4 [0033.755] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".geo") returned 4 [0033.755] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".gif") returned 4 [0033.755] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".grs") returned 4 [0033.755] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".gz") returned 3 [0033.755] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.755] lstrlenW (lpString=".h") returned 2 [0033.755] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.755] lstrlenW (lpString=".hdr") returned 4 [0033.755] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.755] lstrlenW (lpString=".hpp") returned 4 [0033.755] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".hta") returned 4 [0033.756] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".htc") returned 4 [0033.756] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".htm") returned 4 [0033.756] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".html") returned 5 [0033.756] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.756] lstrlenW (lpString=".icb") returned 4 [0033.756] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".ics") returned 4 [0033.756] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".iff") returned 4 [0033.756] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".inc") returned 4 [0033.756] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.756] lstrlenW (lpString=".indd") returned 5 [0033.756] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.756] lstrlenW (lpString=".ini") returned 4 [0033.756] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.756] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.756] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.756] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa1068 | out: hHeap=0x5c0000) returned 1 [0033.756] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.756] FindClose (in: hFindFile=0x6b6e08 | out: hFindFile=0x6b6e08) returned 1 [0033.756] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0033.756] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.757] lstrlenW (lpString="C:\\Boot") returned 7 [0033.757] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.757] lstrlenW (lpString="Boot") returned 4 [0033.757] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.757] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f90058 [0033.757] lstrlenW (lpString="C:\\Boot") returned 7 [0033.757] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b6e08 [0033.757] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.757] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.757] lstrlenW (lpString="BCD") returned 3 [0033.757] lstrlenW (lpString=".1cd") returned 4 [0033.757] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.757] lstrlenW (lpString=".3ds") returned 4 [0033.757] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.757] lstrlenW (lpString=".3fr") returned 4 [0033.757] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.757] lstrlenW (lpString=".3g2") returned 4 [0033.757] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.757] lstrlenW (lpString=".3gp") returned 4 [0033.757] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".7z") returned 3 [0033.758] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.758] lstrlenW (lpString=".accda") returned 6 [0033.758] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".accdb") returned 6 [0033.758] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".accdc") returned 6 [0033.758] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".accde") returned 6 [0033.758] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".accdt") returned 6 [0033.758] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".accdw") returned 6 [0033.758] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".adb") returned 4 [0033.758] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".adp") returned 4 [0033.758] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai") returned 3 [0033.758] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.758] lstrlenW (lpString=".ai3") returned 4 [0033.758] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai4") returned 4 [0033.758] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai5") returned 4 [0033.758] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai6") returned 4 [0033.758] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai7") returned 4 [0033.758] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".ai8") returned 4 [0033.758] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".anim") returned 5 [0033.758] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.758] lstrlenW (lpString=".arw") returned 4 [0033.758] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".as") returned 3 [0033.759] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.759] lstrlenW (lpString=".asa") returned 4 [0033.759] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asc") returned 4 [0033.759] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".ascx") returned 5 [0033.759] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asm") returned 4 [0033.759] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asmx") returned 5 [0033.759] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asp") returned 4 [0033.759] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".aspx") returned 5 [0033.759] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asr") returned 4 [0033.759] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".asx") returned 4 [0033.759] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".avi") returned 4 [0033.759] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".avs") returned 4 [0033.759] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".backup") returned 7 [0033.759] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".bak") returned 4 [0033.759] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".bay") returned 4 [0033.759] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".bd") returned 3 [0033.759] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.759] lstrlenW (lpString=".bin") returned 4 [0033.759] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.759] lstrlenW (lpString=".bmp") returned 4 [0033.760] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".bz2") returned 4 [0033.760] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".c") returned 2 [0033.760] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.760] lstrlenW (lpString=".cdr") returned 4 [0033.760] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cer") returned 4 [0033.760] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cf") returned 3 [0033.760] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.760] lstrlenW (lpString=".cfc") returned 4 [0033.760] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cfm") returned 4 [0033.760] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cfml") returned 5 [0033.760] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cfu") returned 4 [0033.760] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".chm") returned 4 [0033.760] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cin") returned 4 [0033.760] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".class") returned 6 [0033.760] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".clx") returned 4 [0033.760] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".config") returned 7 [0033.760] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cpp") returned 4 [0033.760] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".cr2") returned 4 [0033.760] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.760] lstrlenW (lpString=".crt") returned 4 [0033.760] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".crw") returned 4 [0033.761] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".cs") returned 3 [0033.761] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.761] lstrlenW (lpString=".css") returned 4 [0033.761] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".csv") returned 4 [0033.761] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".cub") returned 4 [0033.761] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dae") returned 4 [0033.761] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dat") returned 4 [0033.761] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".db") returned 3 [0033.761] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.761] lstrlenW (lpString=".dbf") returned 4 [0033.761] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dbx") returned 4 [0033.761] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dc3") returned 4 [0033.761] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dcm") returned 4 [0033.761] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dcr") returned 4 [0033.761] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".der") returned 4 [0033.761] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dib") returned 4 [0033.761] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dic") returned 4 [0033.761] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.761] lstrlenW (lpString=".dif") returned 4 [0033.761] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".divx") returned 5 [0033.762] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".djvu") returned 5 [0033.762] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dng") returned 4 [0033.762] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".doc") returned 4 [0033.762] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".docm") returned 5 [0033.762] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".docx") returned 5 [0033.762] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dot") returned 4 [0033.762] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dotm") returned 5 [0033.762] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dotx") returned 5 [0033.762] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dpx") returned 4 [0033.762] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dqy") returned 4 [0033.762] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dsn") returned 4 [0033.762] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dt") returned 3 [0033.762] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.762] lstrlenW (lpString=".dtd") returned 4 [0033.762] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dwg") returned 4 [0033.762] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dwt") returned 4 [0033.762] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.762] lstrlenW (lpString=".dx") returned 3 [0033.762] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.762] lstrlenW (lpString=".dxf") returned 4 [0033.763] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".edml") returned 5 [0033.763] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".efd") returned 4 [0033.763] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".elf") returned 4 [0033.763] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".emf") returned 4 [0033.763] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".emz") returned 4 [0033.763] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".epf") returned 4 [0033.763] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".eps") returned 4 [0033.763] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".epsf") returned 5 [0033.763] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".epsp") returned 5 [0033.763] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".erf") returned 4 [0033.763] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".exr") returned 4 [0033.763] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".f4v") returned 4 [0033.763] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".fido") returned 5 [0033.763] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".flm") returned 4 [0033.763] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".flv") returned 4 [0033.763] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".frm") returned 4 [0033.763] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0033.763] lstrlenW (lpString=".fxg") returned 4 [0033.763] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0033.764] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.764] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.765] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.765] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.766] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.766] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.766] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.767] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.767] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.767] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.767] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.767] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.768] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.768] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.768] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.768] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.768] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.769] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.769] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.770] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.770] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.770] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.770] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.770] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.770] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.770] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.770] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.771] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.771] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.772] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.772] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.773] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.773] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.773] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.773] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.774] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.774] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.774] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.774] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.774] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.775] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.775] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.775] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.775] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.775] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.775] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.775] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.776] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.776] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.776] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.776] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.776] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.777] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.777] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.777] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.777] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.777] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.777] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.778] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.778] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.779] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.779] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.779] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.779] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.779] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.779] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.779] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.779] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.780] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.780] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.780] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.780] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.780] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.781] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.781] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.781] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.781] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.781] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.782] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.782] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.782] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.782] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.782] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.782] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.782] FindNextFileW (in: hFindFile=0x6b6e48, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.783] FindClose (in: hFindFile=0x6b6e48 | out: hFindFile=0x6b6e48) returned 1 [0033.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.783] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.817] FindNextFileW (in: hFindFile=0x6b6b78, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.819] FindNextFileW (in: hFindFile=0x6b6b78, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.828] FindClose (in: hFindFile=0x6b6b78 | out: hFindFile=0x6b6b78) returned 1 [0033.828] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.828] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.828] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.829] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.829] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.829] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.829] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.829] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.830] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.830] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x6b6e08, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.830] FindClose (in: hFindFile=0x6b6e08 | out: hFindFile=0x6b6e08) returned 1 [0033.830] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.830] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0033.830] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0033.830] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.831] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0033.831] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.831] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.831] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.917] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.917] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0033.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0033.949] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc2568 [0033.949] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.949] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0033.949] lstrlenW (lpString="ExcelLR.cab") returned 11 [0033.949] lstrlenW (lpString=".1cd") returned 4 [0033.949] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0033.949] lstrlenW (lpString=".3ds") returned 4 [0033.949] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0033.949] lstrlenW (lpString=".3fr") returned 4 [0033.949] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0033.949] lstrlenW (lpString=".3g2") returned 4 [0033.950] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".3gp") returned 4 [0033.950] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".7z") returned 3 [0033.950] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0033.950] lstrlenW (lpString=".accda") returned 6 [0033.950] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".accdb") returned 6 [0033.950] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".accdc") returned 6 [0033.950] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".accde") returned 6 [0033.950] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".accdt") returned 6 [0033.950] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".accdw") returned 6 [0033.950] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1 [0033.950] lstrlenW (lpString=".adb") returned 4 [0033.950] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".adp") returned 4 [0033.950] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai") returned 3 [0033.950] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0033.950] lstrlenW (lpString=".ai3") returned 4 [0033.950] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai4") returned 4 [0033.950] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai5") returned 4 [0033.950] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai6") returned 4 [0033.950] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai7") returned 4 [0033.950] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0033.950] lstrlenW (lpString=".ai8") returned 4 [0033.950] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".anim") returned 5 [0033.951] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1 [0033.951] lstrlenW (lpString=".arw") returned 4 [0033.951] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".as") returned 3 [0033.951] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0033.951] lstrlenW (lpString=".asa") returned 4 [0033.951] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".asc") returned 4 [0033.951] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".ascx") returned 5 [0033.951] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1 [0033.951] lstrlenW (lpString=".asm") returned 4 [0033.951] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".asmx") returned 5 [0033.951] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1 [0033.951] lstrlenW (lpString=".asp") returned 4 [0033.951] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".aspx") returned 5 [0033.951] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1 [0033.951] lstrlenW (lpString=".asr") returned 4 [0033.951] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".asx") returned 4 [0033.951] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".avi") returned 4 [0033.951] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".avs") returned 4 [0033.951] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".backup") returned 7 [0033.951] lstrcmpiW (lpString1=".backup", lpString2="lLR.cab") returned -1 [0033.951] lstrlenW (lpString=".bak") returned 4 [0033.951] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".bay") returned 4 [0033.951] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0033.951] lstrlenW (lpString=".bd") returned 3 [0033.951] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0033.951] lstrlenW (lpString=".bin") returned 4 [0033.952] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0033.952] lstrlenW (lpString=".bmp") returned 4 [0033.952] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0033.952] lstrlenW (lpString=".bz2") returned 4 [0033.952] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0033.952] lstrlenW (lpString=".c") returned 2 [0033.952] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0033.952] lstrlenW (lpString=".cdr") returned 4 [0033.952] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cer") returned 4 [0033.952] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cf") returned 3 [0033.952] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0033.952] lstrlenW (lpString=".cfc") returned 4 [0033.952] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cfm") returned 4 [0033.952] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cfml") returned 5 [0033.952] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1 [0033.952] lstrlenW (lpString=".cfu") returned 4 [0033.952] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".chm") returned 4 [0033.952] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cin") returned 4 [0033.952] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".class") returned 6 [0033.952] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1 [0033.952] lstrlenW (lpString=".clx") returned 4 [0033.952] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".config") returned 7 [0033.952] lstrcmpiW (lpString1=".config", lpString2="lLR.cab") returned -1 [0033.952] lstrlenW (lpString=".cpp") returned 4 [0033.952] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0033.952] lstrlenW (lpString=".cr2") returned 4 [0033.952] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".crt") returned 4 [0033.953] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".crw") returned 4 [0033.953] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".cs") returned 3 [0033.953] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0033.953] lstrlenW (lpString=".css") returned 4 [0033.953] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".csv") returned 4 [0033.953] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".cub") returned 4 [0033.953] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dae") returned 4 [0033.953] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dat") returned 4 [0033.953] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".db") returned 3 [0033.953] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0033.953] lstrlenW (lpString=".dbf") returned 4 [0033.953] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dbx") returned 4 [0033.953] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dc3") returned 4 [0033.953] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dcm") returned 4 [0033.953] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dcr") returned 4 [0033.953] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".der") returned 4 [0033.953] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0033.953] lstrlenW (lpString=".dib") returned 4 [0033.953] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dic") returned 4 [0033.954] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dif") returned 4 [0033.954] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".divx") returned 5 [0033.954] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".djvu") returned 5 [0033.954] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".dng") returned 4 [0033.954] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".doc") returned 4 [0033.954] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".docm") returned 5 [0033.954] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".docx") returned 5 [0033.954] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".dot") returned 4 [0033.954] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dotm") returned 5 [0033.954] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".dotx") returned 5 [0033.954] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1 [0033.954] lstrlenW (lpString=".dpx") returned 4 [0033.954] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dqy") returned 4 [0033.954] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dsn") returned 4 [0033.954] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dt") returned 3 [0033.954] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0033.954] lstrlenW (lpString=".dtd") returned 4 [0033.954] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dwg") returned 4 [0033.954] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0033.954] lstrlenW (lpString=".dwt") returned 4 [0033.955] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".dx") returned 3 [0033.955] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0033.955] lstrlenW (lpString=".dxf") returned 4 [0033.955] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".edml") returned 5 [0033.955] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1 [0033.955] lstrlenW (lpString=".efd") returned 4 [0033.955] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".elf") returned 4 [0033.955] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".emf") returned 4 [0033.955] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".emz") returned 4 [0033.955] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".epf") returned 4 [0033.955] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".eps") returned 4 [0033.955] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".epsf") returned 5 [0033.955] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1 [0033.955] lstrlenW (lpString=".epsp") returned 5 [0033.955] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1 [0033.955] lstrlenW (lpString=".erf") returned 4 [0033.955] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".exr") returned 4 [0033.955] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".f4v") returned 4 [0033.955] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".fido") returned 5 [0033.955] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1 [0033.955] lstrlenW (lpString=".flm") returned 4 [0033.955] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0033.955] lstrlenW (lpString=".flv") returned 4 [0033.956] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".frm") returned 4 [0033.956] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".fxg") returned 4 [0033.956] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".geo") returned 4 [0033.956] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".gif") returned 4 [0033.956] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".grs") returned 4 [0033.956] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".gz") returned 3 [0033.956] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0033.956] lstrlenW (lpString=".h") returned 2 [0033.956] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0033.956] lstrlenW (lpString=".hdr") returned 4 [0033.956] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".hpp") returned 4 [0033.956] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".hta") returned 4 [0033.956] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".htc") returned 4 [0033.956] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".htm") returned 4 [0033.956] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".html") returned 5 [0033.956] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1 [0033.956] lstrlenW (lpString=".icb") returned 4 [0033.956] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".ics") returned 4 [0033.956] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".iff") returned 4 [0033.956] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0033.956] lstrlenW (lpString=".inc") returned 4 [0033.956] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".indd") returned 5 [0033.957] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1 [0033.957] lstrlenW (lpString=".ini") returned 4 [0033.957] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".iqy") returned 4 [0033.957] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".j2c") returned 4 [0033.957] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".j2k") returned 4 [0033.957] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".java") returned 5 [0033.957] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1 [0033.957] lstrlenW (lpString=".jp2") returned 4 [0033.957] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".jpc") returned 4 [0033.957] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".jpe") returned 4 [0033.957] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".jpeg") returned 5 [0033.957] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1 [0033.957] lstrlenW (lpString=".jpf") returned 4 [0033.957] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".jpg") returned 4 [0033.957] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".jpx") returned 4 [0033.957] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".js") returned 3 [0033.957] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0033.957] lstrlenW (lpString=".jsf") returned 4 [0033.957] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".json") returned 5 [0033.957] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1 [0033.957] lstrlenW (lpString=".jsp") returned 4 [0033.957] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0033.957] lstrlenW (lpString=".kdc") returned 4 [0033.958] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".kmz") returned 4 [0033.958] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".kwm") returned 4 [0033.958] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".lasso") returned 6 [0033.958] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1 [0033.958] lstrlenW (lpString=".lbi") returned 4 [0033.958] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".lgf") returned 4 [0033.958] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".lgp") returned 4 [0033.958] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".log") returned 4 [0033.958] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".m1v") returned 4 [0033.958] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".m4a") returned 4 [0033.958] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".m4v") returned 4 [0033.958] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".max") returned 4 [0033.958] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".md") returned 3 [0033.958] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0033.958] lstrlenW (lpString=".mda") returned 4 [0033.958] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".mdb") returned 4 [0033.958] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0033.958] lstrlenW (lpString=".mde") returned 4 [0033.958] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mdf") returned 4 [0033.959] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mdw") returned 4 [0033.959] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mef") returned 4 [0033.959] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mft") returned 4 [0033.959] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mfw") returned 4 [0033.959] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mht") returned 4 [0033.959] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mhtml") returned 6 [0033.959] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1 [0033.959] lstrlenW (lpString=".mka") returned 4 [0033.959] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mkidx") returned 6 [0033.959] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1 [0033.959] lstrlenW (lpString=".mkv") returned 4 [0033.959] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mos") returned 4 [0033.959] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mov") returned 4 [0033.959] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mp3") returned 4 [0033.959] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mp4") returned 4 [0033.959] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mpeg") returned 5 [0033.959] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1 [0033.959] lstrlenW (lpString=".mpg") returned 4 [0033.959] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mpv") returned 4 [0033.959] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0033.959] lstrlenW (lpString=".mrw") returned 4 [0033.960] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".msg") returned 4 [0033.960] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".mxl") returned 4 [0033.960] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".myd") returned 4 [0033.960] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".myi") returned 4 [0033.960] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".nef") returned 4 [0033.960] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".nrw") returned 4 [0033.960] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".obj") returned 4 [0033.960] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".odb") returned 4 [0033.960] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".odc") returned 4 [0033.960] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".odm") returned 4 [0033.960] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".odp") returned 4 [0033.960] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".ods") returned 4 [0033.960] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".oft") returned 4 [0033.960] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".one") returned 4 [0033.960] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".onepkg") returned 7 [0033.960] lstrcmpiW (lpString1=".onepkg", lpString2="lLR.cab") returned -1 [0033.960] lstrlenW (lpString=".onetoc2") returned 8 [0033.960] lstrcmpiW (lpString1=".onetoc2", lpString2="elLR.cab") returned -1 [0033.960] lstrlenW (lpString=".opt") returned 4 [0033.960] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0033.960] lstrlenW (lpString=".oqy") returned 4 [0033.961] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".orf") returned 4 [0033.961] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".p12") returned 4 [0033.961] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".p7b") returned 4 [0033.961] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".p7c") returned 4 [0033.961] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pam") returned 4 [0033.961] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pbm") returned 4 [0033.961] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pct") returned 4 [0033.961] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pcx") returned 4 [0033.961] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pdd") returned 4 [0033.961] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pdf") returned 4 [0033.961] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pdp") returned 4 [0033.961] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pef") returned 4 [0033.961] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pem") returned 4 [0033.961] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pff") returned 4 [0033.961] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pfm") returned 4 [0033.961] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0033.961] lstrlenW (lpString=".pfx") returned 4 [0033.962] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".pgm") returned 4 [0033.962] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".php") returned 4 [0033.962] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".php3") returned 5 [0033.962] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".php4") returned 5 [0033.962] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".php5") returned 5 [0033.962] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".phtml") returned 6 [0033.962] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1 [0033.962] lstrlenW (lpString=".pict") returned 5 [0033.962] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".pl") returned 3 [0033.962] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0033.962] lstrlenW (lpString=".pls") returned 4 [0033.962] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".pm") returned 3 [0033.962] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0033.962] lstrlenW (lpString=".png") returned 4 [0033.962] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".pnm") returned 4 [0033.962] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".pot") returned 4 [0033.962] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".potm") returned 5 [0033.962] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".potx") returned 5 [0033.962] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".ppa") returned 4 [0033.962] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0033.962] lstrlenW (lpString=".ppam") returned 5 [0033.962] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1 [0033.962] lstrlenW (lpString=".ppm") returned 4 [0033.963] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pps") returned 4 [0033.963] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".ppsm") returned 5 [0033.963] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1 [0033.963] lstrlenW (lpString=".ppt") returned 4 [0033.963] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pptm") returned 5 [0033.963] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1 [0033.963] lstrlenW (lpString=".pptx") returned 5 [0033.963] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1 [0033.963] lstrlenW (lpString=".prn") returned 4 [0033.963] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".ps") returned 3 [0033.963] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0033.963] lstrlenW (lpString=".psb") returned 4 [0033.963] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".psd") returned 4 [0033.963] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pst") returned 4 [0033.963] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".ptx") returned 4 [0033.963] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pub") returned 4 [0033.963] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pwm") returned 4 [0033.963] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".pxr") returned 4 [0033.963] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0033.963] lstrlenW (lpString=".py") returned 3 [0033.963] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0033.963] lstrlenW (lpString=".qt") returned 3 [0033.963] lstrcmpiW (lpString1=".qt", lpString2="cab") returned -1 [0033.964] lstrlenW (lpString=".r3d") returned 4 [0033.964] lstrcmpiW (lpString1=".r3d", lpString2=".cab") returned 1 [0033.964] lstrlenW (lpString=".raf") returned 4 [0033.964] lstrcmpiW (lpString1=".raf", lpString2=".cab") returned 1 [0033.964] lstrlenW (lpString=".rar") returned 4 [0033.964] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0033.964] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.964] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0033.966] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.966] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0033.968] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.968] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0033.968] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0033.969] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.969] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0033.970] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.971] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0033.971] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0033.971] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.971] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0033.971] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0033.971] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0033.971] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0034.231] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.231] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0034.231] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.232] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0034.232] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4fa8 | out: hHeap=0x5c0000) returned 1 [0034.232] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0034.232] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.232] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0034.233] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4fa8 | out: hHeap=0x5c0000) returned 1 [0034.233] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0034.233] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.233] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0034.233] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4fa8 | out: hHeap=0x5c0000) returned 1 [0034.233] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0034.234] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.234] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.234] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0034.235] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.235] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.235] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.236] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0034.237] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.237] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0034.292] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.293] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.293] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0034.293] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.293] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0034.294] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.294] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.294] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0034.295] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.295] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0034.295] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.296] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.296] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0034.297] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.297] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0034.298] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.299] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.299] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0034.666] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.666] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0034.667] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.667] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.667] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0034.668] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4b58 | out: hHeap=0x5c0000) returned 1 [0034.668] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0034.670] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.670] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.670] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0034.671] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.671] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0034.672] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.672] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd4b58 | out: hHeap=0x5c0000) returned 1 [0034.672] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0034.673] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.673] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.673] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0034.742] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.742] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.743] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.743] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0034.745] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.745] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.747] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.748] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.748] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0034.749] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.749] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.751] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.752] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc4b50 | out: hHeap=0x5c0000) returned 1 [0034.752] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0034.752] FindClose (in: hFindFile=0x3fc2528 | out: hFindFile=0x3fc2528) returned 1 [0034.752] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0034.752] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0034.752] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0034.752] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0034.752] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.753] FindClose (in: hFindFile=0x3fc2528 | out: hFindFile=0x3fc2528) returned 1 [0034.753] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa0060 | out: hHeap=0x5c0000) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0034.753] FindClose (in: hFindFile=0x3fc24e8 | out: hFindFile=0x3fc24e8) returned 1 [0034.753] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f90058 | out: hHeap=0x5c0000) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x6b6dc8, lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x857e99c0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x857e99c0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x857e99c0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x857e99c0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc24e8, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7e74a8e0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x7e74a8e0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7e74a8e0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x7e74a8e0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0034.754] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0034.755] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc3920 | out: hHeap=0x5c0000) returned 1 [0034.755] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde507ce0, ftCreationTime.dwHighDateTime=0x1d4f025, ftLastAccessTime.dwLowDateTime=0x2a2c6640, ftLastAccessTime.dwHighDateTime=0x1d4fe3d, ftLastWriteTime.dwLowDateTime=0x2a2c6640, ftLastWriteTime.dwHighDateTime=0x1d4fe3d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="first-nc-parking.exe", cAlternateFileName="FIRST-~1.EXE")) returned 1 [0034.755] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.755] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0034.756] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.756] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0034.756] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.756] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.757] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0034.757] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.757] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.759] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.759] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0034.759] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.759] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0034.759] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0034.760] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.760] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.760] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0034.761] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.761] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0034.761] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.761] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0034.761] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0034.762] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.762] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0034.762] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.762] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0034.762] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0034.764] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.764] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0034.766] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0034.767] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0034.767] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.767] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0034.767] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0034.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0034.767] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0034.768] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.768] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0034.769] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.769] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.769] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.769] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.769] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0034.769] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.769] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.769] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.769] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.770] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0034.770] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.770] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.770] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.770] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.770] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0034.771] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.771] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.771] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.771] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.771] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0034.772] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.772] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.772] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.772] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0034.772] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.772] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.773] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.773] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0034.774] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.774] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0034.776] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.776] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.776] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0034.777] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.777] FindNextFileW (in: hFindFile=0x3fc25e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.777] FindClose (in: hFindFile=0x3fc25e8 | out: hFindFile=0x3fc25e8) returned 1 [0034.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0034.777] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0035.693] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.853] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.854] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0035.854] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.854] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0035.854] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.855] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0035.855] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0035.855] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0036.235] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.235] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0036.238] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.238] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0036.238] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.238] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.238] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0036.239] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.239] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0036.240] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.241] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0036.241] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.241] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0036.241] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.241] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0036.242] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.242] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0036.242] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.242] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.242] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0036.243] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0036.243] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.243] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0036.531] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.531] FindNextFileW (in: hFindFile=0x3fc2728, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0036.531] FindClose (in: hFindFile=0x3fc2728 | out: hFindFile=0x3fc2728) returned 1 [0036.531] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0036.531] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0036.531] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.531] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.531] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0036.532] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.532] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.532] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.532] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.532] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0036.532] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.532] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.532] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.533] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.533] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0036.533] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.533] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.533] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.533] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.533] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0036.534] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.534] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.534] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.534] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.534] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0036.537] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.538] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.538] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.538] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.538] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0036.538] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.538] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.538] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.538] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.538] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0036.539] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.539] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.539] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.539] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.539] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0036.540] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.540] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.540] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.540] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.540] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0036.541] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.541] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.541] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.541] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.541] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0036.542] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.542] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.542] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.542] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.542] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0036.542] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.542] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.543] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.543] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.543] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0036.544] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.544] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.544] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.544] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.544] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0036.544] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.544] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.544] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.544] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.545] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0036.545] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.545] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.545] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.545] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0036.546] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.546] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.546] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.546] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0036.547] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.547] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.547] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.547] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.547] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0036.548] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.548] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.548] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.548] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.548] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0036.549] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.549] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.549] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.549] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0036.549] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.549] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.549] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.550] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0036.550] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.550] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.551] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.551] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0036.551] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.551] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.552] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.552] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0036.552] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.553] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.553] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.553] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.553] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0036.553] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.553] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.553] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.553] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.554] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0036.554] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.554] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.555] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.555] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.555] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0036.555] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.555] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.555] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.555] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.555] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0036.555] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0036.556] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.556] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0036.556] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.556] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0036.557] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0036.557] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.557] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0036.557] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.557] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.557] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.557] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0036.557] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.558] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.558] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0036.558] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0036.558] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0036.558] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0036.558] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.558] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0036.559] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.559] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0036.560] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0036.561] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.561] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0036.956] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.956] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0036.957] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0036.957] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0036.957] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0037.066] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0037.106] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.106] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0037.107] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0037.108] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0037.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0037.108] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 1 [0037.108] lstrlenW (lpString="Excel.en-us") returned 11 [0037.108] lstrcmpiW (lpString1="C:\\Windows", lpString2="Excel.en-us") returned -1 [0037.108] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x40075f8 [0037.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0037.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc26e8 [0037.108] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.108] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0037.108] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0037.108] lstrlenW (lpString=".1cd") returned 4 [0037.108] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.108] lstrlenW (lpString=".3ds") returned 4 [0037.108] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0037.108] lstrlenW (lpString=".3fr") returned 4 [0037.108] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0037.108] lstrlenW (lpString=".3g2") returned 4 [0037.108] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0037.108] lstrlenW (lpString=".3gp") returned 4 [0037.109] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".7z") returned 3 [0037.109] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.109] lstrlenW (lpString=".accda") returned 6 [0037.109] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".accdb") returned 6 [0037.109] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".accdc") returned 6 [0037.109] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".accde") returned 6 [0037.109] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".accdt") returned 6 [0037.109] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".accdw") returned 6 [0037.109] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0037.109] lstrlenW (lpString=".adb") returned 4 [0037.109] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".adp") returned 4 [0037.109] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai") returned 3 [0037.109] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0037.109] lstrlenW (lpString=".ai3") returned 4 [0037.109] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai4") returned 4 [0037.109] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai5") returned 4 [0037.109] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai6") returned 4 [0037.109] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai7") returned 4 [0037.109] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0037.109] lstrlenW (lpString=".ai8") returned 4 [0037.110] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".anim") returned 5 [0037.110] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0037.110] lstrlenW (lpString=".arw") returned 4 [0037.110] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".as") returned 3 [0037.110] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0037.110] lstrlenW (lpString=".asa") returned 4 [0037.110] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".asc") returned 4 [0037.110] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".ascx") returned 5 [0037.110] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0037.110] lstrlenW (lpString=".asm") returned 4 [0037.110] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".asmx") returned 5 [0037.110] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0037.110] lstrlenW (lpString=".asp") returned 4 [0037.110] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".aspx") returned 5 [0037.110] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0037.110] lstrlenW (lpString=".asr") returned 4 [0037.110] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".asx") returned 4 [0037.110] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".avi") returned 4 [0037.110] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".avs") returned 4 [0037.110] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".backup") returned 7 [0037.110] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0037.110] lstrlenW (lpString=".bak") returned 4 [0037.110] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".bay") returned 4 [0037.110] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0037.110] lstrlenW (lpString=".bd") returned 3 [0037.111] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0037.111] lstrlenW (lpString=".bin") returned 4 [0037.111] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".bmp") returned 4 [0037.111] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".bz2") returned 4 [0037.111] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".c") returned 2 [0037.111] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0037.111] lstrlenW (lpString=".cdr") returned 4 [0037.111] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cer") returned 4 [0037.111] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cf") returned 3 [0037.111] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0037.111] lstrlenW (lpString=".cfc") returned 4 [0037.111] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cfm") returned 4 [0037.111] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cfml") returned 5 [0037.111] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0037.111] lstrlenW (lpString=".cfu") returned 4 [0037.111] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".chm") returned 4 [0037.111] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cin") returned 4 [0037.111] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".class") returned 6 [0037.111] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0037.111] lstrlenW (lpString=".clx") returned 4 [0037.111] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".config") returned 7 [0037.111] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0037.111] lstrlenW (lpString=".cpp") returned 4 [0037.111] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0037.111] lstrlenW (lpString=".cr2") returned 4 [0037.112] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".crt") returned 4 [0037.112] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".crw") returned 4 [0037.112] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".cs") returned 3 [0037.112] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0037.112] lstrlenW (lpString=".css") returned 4 [0037.112] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".csv") returned 4 [0037.112] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".cub") returned 4 [0037.112] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dae") returned 4 [0037.112] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dat") returned 4 [0037.112] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".db") returned 3 [0037.112] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0037.112] lstrlenW (lpString=".dbf") returned 4 [0037.112] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dbx") returned 4 [0037.112] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dc3") returned 4 [0037.112] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dcm") returned 4 [0037.112] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dcr") returned 4 [0037.112] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".der") returned 4 [0037.112] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dib") returned 4 [0037.112] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dic") returned 4 [0037.112] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0037.112] lstrlenW (lpString=".dif") returned 4 [0037.113] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".divx") returned 5 [0037.113] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".djvu") returned 5 [0037.113] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".dng") returned 4 [0037.113] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".doc") returned 4 [0037.113] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".docm") returned 5 [0037.113] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".docx") returned 5 [0037.113] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".dot") returned 4 [0037.113] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dotm") returned 5 [0037.113] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".dotx") returned 5 [0037.113] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0037.113] lstrlenW (lpString=".dpx") returned 4 [0037.113] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dqy") returned 4 [0037.113] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dsn") returned 4 [0037.113] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dt") returned 3 [0037.113] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0037.113] lstrlenW (lpString=".dtd") returned 4 [0037.113] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dwg") returned 4 [0037.113] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dwt") returned 4 [0037.113] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0037.113] lstrlenW (lpString=".dx") returned 3 [0037.113] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0037.114] lstrlenW (lpString=".dxf") returned 4 [0037.114] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".edml") returned 5 [0037.114] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0037.114] lstrlenW (lpString=".efd") returned 4 [0037.114] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".elf") returned 4 [0037.114] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".emf") returned 4 [0037.114] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".emz") returned 4 [0037.114] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".epf") returned 4 [0037.114] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".eps") returned 4 [0037.114] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".epsf") returned 5 [0037.114] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0037.114] lstrlenW (lpString=".epsp") returned 5 [0037.114] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0037.114] lstrlenW (lpString=".erf") returned 4 [0037.114] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".exr") returned 4 [0037.114] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".f4v") returned 4 [0037.114] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".fido") returned 5 [0037.114] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0037.114] lstrlenW (lpString=".flm") returned 4 [0037.114] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".flv") returned 4 [0037.114] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".frm") returned 4 [0037.114] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0037.114] lstrlenW (lpString=".fxg") returned 4 [0037.114] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".geo") returned 4 [0037.115] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".gif") returned 4 [0037.115] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".grs") returned 4 [0037.115] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".gz") returned 3 [0037.115] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0037.115] lstrlenW (lpString=".h") returned 2 [0037.115] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0037.115] lstrlenW (lpString=".hdr") returned 4 [0037.115] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".hpp") returned 4 [0037.115] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".hta") returned 4 [0037.115] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".htc") returned 4 [0037.115] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".htm") returned 4 [0037.115] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".html") returned 5 [0037.115] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0037.115] lstrlenW (lpString=".icb") returned 4 [0037.115] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".ics") returned 4 [0037.115] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".iff") returned 4 [0037.115] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".inc") returned 4 [0037.115] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".indd") returned 5 [0037.115] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0037.115] lstrlenW (lpString=".ini") returned 4 [0037.115] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0037.115] lstrlenW (lpString=".iqy") returned 4 [0037.115] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".j2c") returned 4 [0037.116] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".j2k") returned 4 [0037.116] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".java") returned 5 [0037.116] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0037.116] lstrlenW (lpString=".jp2") returned 4 [0037.116] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".jpc") returned 4 [0037.116] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".jpe") returned 4 [0037.116] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".jpeg") returned 5 [0037.116] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0037.116] lstrlenW (lpString=".jpf") returned 4 [0037.116] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".jpg") returned 4 [0037.116] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".jpx") returned 4 [0037.116] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".js") returned 3 [0037.116] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0037.116] lstrlenW (lpString=".jsf") returned 4 [0037.116] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".json") returned 5 [0037.116] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0037.116] lstrlenW (lpString=".jsp") returned 4 [0037.116] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".kdc") returned 4 [0037.116] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".kmz") returned 4 [0037.116] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".kwm") returned 4 [0037.116] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0037.116] lstrlenW (lpString=".lasso") returned 6 [0037.117] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0037.117] lstrlenW (lpString=".lbi") returned 4 [0037.117] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".lgf") returned 4 [0037.117] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".lgp") returned 4 [0037.117] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".log") returned 4 [0037.117] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".m1v") returned 4 [0037.117] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".m4a") returned 4 [0037.117] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".m4v") returned 4 [0037.117] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".max") returned 4 [0037.117] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".md") returned 3 [0037.117] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0037.117] lstrlenW (lpString=".mda") returned 4 [0037.117] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mdb") returned 4 [0037.117] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mde") returned 4 [0037.117] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mdf") returned 4 [0037.117] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mdw") returned 4 [0037.117] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mef") returned 4 [0037.117] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mft") returned 4 [0037.117] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mfw") returned 4 [0037.117] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0037.117] lstrlenW (lpString=".mht") returned 4 [0037.118] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mhtml") returned 6 [0037.118] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0037.118] lstrlenW (lpString=".mka") returned 4 [0037.118] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mkidx") returned 6 [0037.118] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0037.118] lstrlenW (lpString=".mkv") returned 4 [0037.118] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mos") returned 4 [0037.118] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mov") returned 4 [0037.118] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mp3") returned 4 [0037.118] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mp4") returned 4 [0037.118] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mpeg") returned 5 [0037.118] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0037.118] lstrlenW (lpString=".mpg") returned 4 [0037.118] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mpv") returned 4 [0037.118] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mrw") returned 4 [0037.118] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".msg") returned 4 [0037.118] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".mxl") returned 4 [0037.118] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".myd") returned 4 [0037.118] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".myi") returned 4 [0037.118] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0037.118] lstrlenW (lpString=".nef") returned 4 [0037.119] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".nrw") returned 4 [0037.119] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".obj") returned 4 [0037.119] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".odb") returned 4 [0037.119] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".odc") returned 4 [0037.119] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".odm") returned 4 [0037.119] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".odp") returned 4 [0037.119] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".ods") returned 4 [0037.119] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".oft") returned 4 [0037.119] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".one") returned 4 [0037.119] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".onepkg") returned 7 [0037.119] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0037.119] lstrlenW (lpString=".onetoc2") returned 8 [0037.119] lstrcmpiW (lpString1=".onetoc2", lpString2="lMUI.XML") returned -1 [0037.119] lstrlenW (lpString=".opt") returned 4 [0037.119] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".oqy") returned 4 [0037.119] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".orf") returned 4 [0037.119] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".p12") returned 4 [0037.119] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".p7b") returned 4 [0037.119] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0037.119] lstrlenW (lpString=".p7c") returned 4 [0037.120] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pam") returned 4 [0037.120] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pbm") returned 4 [0037.120] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pct") returned 4 [0037.120] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pcx") returned 4 [0037.120] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pdd") returned 4 [0037.120] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pdf") returned 4 [0037.120] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pdp") returned 4 [0037.120] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pef") returned 4 [0037.120] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pem") returned 4 [0037.120] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pff") returned 4 [0037.120] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pfm") returned 4 [0037.120] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pfx") returned 4 [0037.120] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".pgm") returned 4 [0037.120] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".php") returned 4 [0037.120] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0037.120] lstrlenW (lpString=".php3") returned 5 [0037.120] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0037.120] lstrlenW (lpString=".php4") returned 5 [0037.120] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0037.120] lstrlenW (lpString=".php5") returned 5 [0037.120] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".phtml") returned 6 [0037.121] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0037.121] lstrlenW (lpString=".pict") returned 5 [0037.121] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".pl") returned 3 [0037.121] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0037.121] lstrlenW (lpString=".pls") returned 4 [0037.121] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".pm") returned 3 [0037.121] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0037.121] lstrlenW (lpString=".png") returned 4 [0037.121] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".pnm") returned 4 [0037.121] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".pot") returned 4 [0037.121] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".potm") returned 5 [0037.121] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".potx") returned 5 [0037.121] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".ppa") returned 4 [0037.121] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".ppam") returned 5 [0037.121] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".ppm") returned 4 [0037.121] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".pps") returned 4 [0037.121] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".ppsm") returned 5 [0037.121] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".ppt") returned 4 [0037.121] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.121] lstrlenW (lpString=".pptm") returned 5 [0037.121] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0037.121] lstrlenW (lpString=".pptx") returned 5 [0037.121] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0037.122] lstrlenW (lpString=".prn") returned 4 [0037.122] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".ps") returned 3 [0037.122] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0037.122] lstrlenW (lpString=".psb") returned 4 [0037.122] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".psd") returned 4 [0037.122] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".pst") returned 4 [0037.122] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".ptx") returned 4 [0037.122] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".pub") returned 4 [0037.122] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".pwm") returned 4 [0037.122] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".pxr") returned 4 [0037.122] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0037.122] lstrlenW (lpString=".py") returned 3 [0037.122] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0037.122] lstrlenW (lpString=".qt") returned 3 [0037.122] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0037.122] lstrlenW (lpString=".r3d") returned 4 [0037.122] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0037.122] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.122] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0037.123] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0037.123] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.123] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0037.123] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.123] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0037.123] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0037.124] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.124] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0037.124] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.124] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40075f8 | out: hHeap=0x5c0000) returned 1 [0037.124] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0037.125] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.125] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0037.126] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.126] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0037.127] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0037.127] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.127] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0037.128] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.128] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.128] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0037.128] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.128] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0037.128] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.128] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.128] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0037.129] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.129] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0037.129] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.129] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.129] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0037.130] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.130] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0037.130] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.131] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.131] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0037.131] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.131] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.131] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0037.131] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0037.132] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.132] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0037.132] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.133] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.133] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.133] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.133] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.133] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.134] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.134] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0037.134] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="..", cAlternateFileName="")) returned 1 [0037.134] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x35eef78, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0037.134] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.134] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.134] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0037.134] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0037.134] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.181] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0037.182] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.182] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0037.183] NtAllocateVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x35ef180*=0x3fe8000, ZeroBits=0x0, RegionSize=0x35ef184*=0xf000, AllocationType=0x1000, Protect=0x4) [0037.184] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.184] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0037.184] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.185] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0037.185] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.185] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0037.186] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.186] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0037.551] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.551] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.552] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.552] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0037.552] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0037.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.552] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0037.558] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.558] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.558] NtAllocateVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x35eec88*=0x4049000, ZeroBits=0x0, RegionSize=0x35eec8c*=0x53000, AllocationType=0x1000, Protect=0x4) [0037.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned 67 [0037.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc26e8 [0037.560] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.560] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0037.561] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.561] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4048610 | out: hHeap=0x5c0000) returned 1 [0037.561] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0037.561] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0037.561] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.562] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0037.562] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.563] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0037.568] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.568] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0037.568] FindClose (in: hFindFile=0x3fc25a8 | out: hFindFile=0x3fc25a8) returned 1 [0037.568] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.568] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0037.593] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.593] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0037.596] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0037.596] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.596] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0037.597] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.597] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.597] NtAllocateVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x35eef04*=0x3fd4000, ZeroBits=0x0, RegionSize=0x35eef08*=0x12000, AllocationType=0x1000, Protect=0x4) [0037.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0037.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc26e8 [0037.597] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.597] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.598] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.598] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0037.598] FindClose (in: hFindFile=0x3fc2768 | out: hFindFile=0x3fc2768) returned 1 [0037.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe75e8 | out: hHeap=0x5c0000) returned 1 [0037.598] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0037.600] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.601] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0037.601] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.601] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0037.601] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.601] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.601] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0037.602] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.602] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0037.602] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.602] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.602] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0037.603] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.603] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0037.603] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.604] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.604] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0037.604] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.604] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0037.605] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.605] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.605] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0037.605] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.605] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0037.605] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.605] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.605] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0037.606] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.606] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0037.606] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.607] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.607] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0037.608] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.608] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0037.608] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.608] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.608] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0037.609] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.609] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0037.609] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.609] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.609] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0037.610] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.610] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0037.610] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.610] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.610] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0037.612] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.612] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0037.613] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.613] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.613] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0037.614] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.614] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0037.614] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.614] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.614] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0037.615] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.615] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0037.615] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.615] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.615] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0037.615] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.615] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0037.616] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.616] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.616] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0037.617] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.617] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0037.617] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.617] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.617] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0037.618] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.618] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0037.618] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.618] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.618] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0037.619] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.619] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0037.619] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.619] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.619] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0037.620] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.620] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0037.620] FindClose (in: hFindFile=0x3fc26e8 | out: hFindFile=0x3fc26e8) returned 1 [0037.620] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fd3928 | out: hHeap=0x5c0000) returned 1 [0037.620] FindNextFileW (in: hFindFile=0x3fc2768, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0037.873] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.879] FindNextFileW (in: hFindFile=0x3fc26a8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0042.292] lstrlenW (lpString="SY00792_.WMF") returned 12 [0042.292] lstrlenW (lpString=".1cd") returned 4 [0042.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".3ds") returned 4 [0042.293] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".3fr") returned 4 [0042.293] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".3g2") returned 4 [0042.293] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".3gp") returned 4 [0042.293] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".7z") returned 3 [0042.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0042.293] lstrlenW (lpString=".accda") returned 6 [0042.293] lstrcmpiW (lpString1=".accda", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".accdb") returned 6 [0042.293] lstrcmpiW (lpString1=".accdb", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".accdc") returned 6 [0042.293] lstrcmpiW (lpString1=".accdc", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".accde") returned 6 [0042.293] lstrcmpiW (lpString1=".accde", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".accdt") returned 6 [0042.293] lstrcmpiW (lpString1=".accdt", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".accdw") returned 6 [0042.293] lstrcmpiW (lpString1=".accdw", lpString2="2_.WMF") returned -1 [0042.293] lstrlenW (lpString=".adb") returned 4 [0042.293] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".adp") returned 4 [0042.293] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".ai") returned 3 [0042.293] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0042.293] lstrlenW (lpString=".ai3") returned 4 [0042.293] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".ai4") returned 4 [0042.293] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0042.293] lstrlenW (lpString=".ai5") returned 4 [0042.294] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".ai6") returned 4 [0042.294] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".ai7") returned 4 [0042.294] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".ai8") returned 4 [0042.294] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".anim") returned 5 [0042.294] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1 [0042.294] lstrlenW (lpString=".arw") returned 4 [0042.294] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".as") returned 3 [0042.294] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0042.294] lstrlenW (lpString=".asa") returned 4 [0042.294] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".asc") returned 4 [0042.294] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".ascx") returned 5 [0042.294] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1 [0042.294] lstrlenW (lpString=".asm") returned 4 [0042.294] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".asmx") returned 5 [0042.294] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1 [0042.294] lstrlenW (lpString=".asp") returned 4 [0042.294] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".aspx") returned 5 [0042.294] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1 [0042.294] lstrlenW (lpString=".asr") returned 4 [0042.294] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".asx") returned 4 [0042.294] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".avi") returned 4 [0042.294] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0042.294] lstrlenW (lpString=".avs") returned 4 [0042.295] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".backup") returned 7 [0042.295] lstrcmpiW (lpString1=".backup", lpString2="92_.WMF") returned -1 [0042.295] lstrlenW (lpString=".bak") returned 4 [0042.295] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".bay") returned 4 [0042.295] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".bd") returned 3 [0042.295] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0042.295] lstrlenW (lpString=".bin") returned 4 [0042.295] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".bmp") returned 4 [0042.295] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".bz2") returned 4 [0042.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".c") returned 2 [0042.295] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0042.295] lstrlenW (lpString=".cdr") returned 4 [0042.295] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".cer") returned 4 [0042.295] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".cf") returned 3 [0042.295] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0042.295] lstrlenW (lpString=".cfc") returned 4 [0042.295] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".cfm") returned 4 [0042.295] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".cfml") returned 5 [0042.295] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1 [0042.295] lstrlenW (lpString=".cfu") returned 4 [0042.295] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".chm") returned 4 [0042.295] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0042.295] lstrlenW (lpString=".cin") returned 4 [0042.295] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".class") returned 6 [0042.296] lstrcmpiW (lpString1=".class", lpString2="2_.WMF") returned -1 [0042.296] lstrlenW (lpString=".clx") returned 4 [0042.296] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".config") returned 7 [0042.296] lstrcmpiW (lpString1=".config", lpString2="92_.WMF") returned -1 [0042.296] lstrlenW (lpString=".cpp") returned 4 [0042.296] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".cr2") returned 4 [0042.296] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".crt") returned 4 [0042.296] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".crw") returned 4 [0042.296] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".cs") returned 3 [0042.296] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0042.296] lstrlenW (lpString=".css") returned 4 [0042.296] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".csv") returned 4 [0042.296] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".cub") returned 4 [0042.296] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".dae") returned 4 [0042.296] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".dat") returned 4 [0042.296] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".db") returned 3 [0042.296] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0042.296] lstrlenW (lpString=".dbf") returned 4 [0042.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".dbx") returned 4 [0042.296] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".dc3") returned 4 [0042.296] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0042.296] lstrlenW (lpString=".dcm") returned 4 [0042.297] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dcr") returned 4 [0042.297] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".der") returned 4 [0042.297] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dib") returned 4 [0042.297] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dic") returned 4 [0042.297] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dif") returned 4 [0042.297] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".divx") returned 5 [0042.297] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".djvu") returned 5 [0042.297] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".dng") returned 4 [0042.297] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".doc") returned 4 [0042.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".docm") returned 5 [0042.297] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".docx") returned 5 [0042.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".dot") returned 4 [0042.297] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dotm") returned 5 [0042.297] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".dotx") returned 5 [0042.297] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1 [0042.297] lstrlenW (lpString=".dpx") returned 4 [0042.297] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dqy") returned 4 [0042.297] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0042.297] lstrlenW (lpString=".dsn") returned 4 [0042.298] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".dt") returned 3 [0042.298] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0042.298] lstrlenW (lpString=".dtd") returned 4 [0042.298] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".dwg") returned 4 [0042.298] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".dwt") returned 4 [0042.298] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".dx") returned 3 [0042.298] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0042.298] lstrlenW (lpString=".dxf") returned 4 [0042.298] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".edml") returned 5 [0042.298] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1 [0042.298] lstrlenW (lpString=".efd") returned 4 [0042.298] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".elf") returned 4 [0042.298] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".emf") returned 4 [0042.298] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".emz") returned 4 [0042.298] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".epf") returned 4 [0042.298] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".eps") returned 4 [0042.298] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".epsf") returned 5 [0042.298] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1 [0042.298] lstrlenW (lpString=".epsp") returned 5 [0042.298] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1 [0042.298] lstrlenW (lpString=".erf") returned 4 [0042.298] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0042.298] lstrlenW (lpString=".exr") returned 4 [0042.299] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".f4v") returned 4 [0042.299] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".fido") returned 5 [0042.299] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1 [0042.299] lstrlenW (lpString=".flm") returned 4 [0042.299] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".flv") returned 4 [0042.299] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".frm") returned 4 [0042.299] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".fxg") returned 4 [0042.299] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".geo") returned 4 [0042.299] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".gif") returned 4 [0042.299] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".grs") returned 4 [0042.299] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".gz") returned 3 [0042.299] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0042.299] lstrlenW (lpString=".h") returned 2 [0042.299] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0042.299] lstrlenW (lpString=".hdr") returned 4 [0042.299] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".hpp") returned 4 [0042.299] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".hta") returned 4 [0042.299] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".htc") returned 4 [0042.299] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".htm") returned 4 [0042.299] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0042.299] lstrlenW (lpString=".html") returned 5 [0042.299] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1 [0042.299] lstrlenW (lpString=".icb") returned 4 [0042.300] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".ics") returned 4 [0042.300] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".iff") returned 4 [0042.300] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".inc") returned 4 [0042.300] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".indd") returned 5 [0042.300] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1 [0042.300] lstrlenW (lpString=".ini") returned 4 [0042.300] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".iqy") returned 4 [0042.300] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".j2c") returned 4 [0042.300] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".j2k") returned 4 [0042.300] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".java") returned 5 [0042.300] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1 [0042.300] lstrlenW (lpString=".jp2") returned 4 [0042.300] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".jpc") returned 4 [0042.300] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".jpe") returned 4 [0042.300] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".jpeg") returned 5 [0042.300] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1 [0042.300] lstrlenW (lpString=".jpf") returned 4 [0042.300] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".jpg") returned 4 [0042.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".jpx") returned 4 [0042.300] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0042.300] lstrlenW (lpString=".js") returned 3 [0042.300] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0042.301] lstrlenW (lpString=".jsf") returned 4 [0042.301] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".json") returned 5 [0042.301] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1 [0042.301] lstrlenW (lpString=".jsp") returned 4 [0042.301] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".kdc") returned 4 [0042.301] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".kmz") returned 4 [0042.301] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".kwm") returned 4 [0042.301] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".lasso") returned 6 [0042.301] lstrcmpiW (lpString1=".lasso", lpString2="2_.WMF") returned -1 [0042.301] lstrlenW (lpString=".lbi") returned 4 [0042.301] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".lgf") returned 4 [0042.301] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".lgp") returned 4 [0042.301] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".log") returned 4 [0042.301] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".m1v") returned 4 [0042.301] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".m4a") returned 4 [0042.301] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".m4v") returned 4 [0042.301] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".max") returned 4 [0042.301] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0042.301] lstrlenW (lpString=".md") returned 3 [0042.301] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0042.301] lstrlenW (lpString=".mda") returned 4 [0042.302] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mdb") returned 4 [0042.302] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mde") returned 4 [0042.302] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mdf") returned 4 [0042.302] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mdw") returned 4 [0042.302] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mef") returned 4 [0042.302] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mft") returned 4 [0042.302] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mfw") returned 4 [0042.302] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mht") returned 4 [0042.302] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mhtml") returned 6 [0042.302] lstrcmpiW (lpString1=".mhtml", lpString2="2_.WMF") returned -1 [0042.302] lstrlenW (lpString=".mka") returned 4 [0042.302] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mkidx") returned 6 [0042.302] lstrcmpiW (lpString1=".mkidx", lpString2="2_.WMF") returned -1 [0042.302] lstrlenW (lpString=".mkv") returned 4 [0042.302] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0042.302] lstrlenW (lpString=".mos") returned 4 [0042.303] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mov") returned 4 [0042.303] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mp3") returned 4 [0042.303] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mp4") returned 4 [0042.303] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mpeg") returned 5 [0042.303] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1 [0042.303] lstrlenW (lpString=".mpg") returned 4 [0042.303] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mpv") returned 4 [0042.303] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mrw") returned 4 [0042.303] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".msg") returned 4 [0042.303] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".mxl") returned 4 [0042.303] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".myd") returned 4 [0042.303] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".myi") returned 4 [0042.303] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".nef") returned 4 [0042.303] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0042.303] lstrlenW (lpString=".nrw") returned 4 [0042.304] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".obj") returned 4 [0042.304] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".odb") returned 4 [0042.304] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".odc") returned 4 [0042.304] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".odm") returned 4 [0042.304] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".odp") returned 4 [0042.304] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".ods") returned 4 [0042.304] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".oft") returned 4 [0042.304] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".one") returned 4 [0042.304] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".onepkg") returned 7 [0042.304] lstrcmpiW (lpString1=".onepkg", lpString2="92_.WMF") returned -1 [0042.304] lstrlenW (lpString=".onetoc2") returned 8 [0042.304] lstrcmpiW (lpString1=".onetoc2", lpString2="792_.WMF") returned -1 [0042.304] lstrlenW (lpString=".opt") returned 4 [0042.304] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".oqy") returned 4 [0042.304] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".orf") returned 4 [0042.304] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".p12") returned 4 [0042.304] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".p7b") returned 4 [0042.304] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".p7c") returned 4 [0042.304] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0042.304] lstrlenW (lpString=".pam") returned 4 [0042.304] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pbm") returned 4 [0042.305] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pct") returned 4 [0042.305] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pcx") returned 4 [0042.305] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pdd") returned 4 [0042.305] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pdf") returned 4 [0042.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pdp") returned 4 [0042.305] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pef") returned 4 [0042.305] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pem") returned 4 [0042.305] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pff") returned 4 [0042.305] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pfm") returned 4 [0042.305] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pfx") returned 4 [0042.305] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".pgm") returned 4 [0042.305] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".php") returned 4 [0042.305] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0042.305] lstrlenW (lpString=".php3") returned 5 [0042.305] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1 [0042.305] lstrlenW (lpString=".php4") returned 5 [0042.305] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1 [0042.305] lstrlenW (lpString=".php5") returned 5 [0042.305] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1 [0042.305] lstrlenW (lpString=".phtml") returned 6 [0042.305] lstrcmpiW (lpString1=".phtml", lpString2="2_.WMF") returned -1 [0042.306] lstrlenW (lpString=".pict") returned 5 [0042.306] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".pl") returned 3 [0042.306] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0042.306] lstrlenW (lpString=".pls") returned 4 [0042.306] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".pm") returned 3 [0042.306] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0042.306] lstrlenW (lpString=".png") returned 4 [0042.306] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".pnm") returned 4 [0042.306] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".pot") returned 4 [0042.306] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".potm") returned 5 [0042.306] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".potx") returned 5 [0042.306] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".ppa") returned 4 [0042.306] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".ppam") returned 5 [0042.306] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".ppm") returned 4 [0042.306] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".pps") returned 4 [0042.306] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".ppsm") returned 5 [0042.306] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".ppt") returned 4 [0042.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0042.306] lstrlenW (lpString=".pptm") returned 5 [0042.306] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1 [0042.306] lstrlenW (lpString=".pptx") returned 5 [0042.306] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1 [0042.307] lstrlenW (lpString=".prn") returned 4 [0042.307] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".ps") returned 3 [0042.307] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0042.307] lstrlenW (lpString=".psb") returned 4 [0042.307] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".psd") returned 4 [0042.307] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".pst") returned 4 [0042.307] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".ptx") returned 4 [0042.307] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".pub") returned 4 [0042.307] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".pwm") returned 4 [0042.307] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".pxr") returned 4 [0042.307] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".py") returned 3 [0042.307] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0042.307] lstrlenW (lpString=".qt") returned 3 [0042.307] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0042.307] lstrlenW (lpString=".r3d") returned 4 [0042.307] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".raf") returned 4 [0042.307] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".rar") returned 4 [0042.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0042.307] lstrlenW (lpString=".raw") returned 4 [0042.307] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0042.307] lstrcmpiW (lpString1=".rdf", lpString2=".WMF") returned -1 [0042.309] NtQueryDirectoryFile (FileHandle=0x16c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x35ef2c8, FileInformation=0x402e658, Length=0x1000, FileInformationClass=0x3, ReturnSingleEntry=0, FileName=0x0, RestartScan=0) [0042.410] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40065f0 | out: hHeap=0x5c0000) returned 1 [0042.558] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0042.558] RtlpDosPathNameToRelativeNtPathName_U () [0042.560] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.560] FindNextFileW (in: hFindFile=0x3fc25a8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0042.560] RtlpDosPathNameToRelativeNtPathName_U () [0042.561] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.561] FindNextFileW (in: hFindFile=0x3fc26e8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0042.564] @RtlpCollectFreeBlocks@4 () [0042.566] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0042.566] FindClose (in: hFindFile=0x3fc2568 | out: hFindFile=0x3fc2568) returned 1 [0042.566] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe65e0 | out: hHeap=0x5c0000) returned 1 [0042.567] FindNextFileW (in: hFindFile=0x3fc2528, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0042.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 52 [0042.567] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 1 [0042.567] lstrlenW (lpString="Document Themes 14") returned 18 [0042.567] lstrcmpiW (lpString1="C:\\Windows", lpString2="Document Themes 14") returned -1 [0042.567] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4048610 [0042.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 52 [0042.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fc2568 [0042.569] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.570] FindNextFileW (in: hFindFile=0x3fc2568, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0042.570] lstrlenW (lpString=".1cd") returned 4 [0042.570] lstrcmpiW (lpString1=".1cd", lpString2="thmx") returned -1 [0042.570] lstrlenW (lpString=".3ds") returned 4 [0042.570] lstrcmpiW (lpString1=".3ds", lpString2="thmx") returned -1 [0042.570] lstrlenW (lpString=".3fr") returned 4 [0042.571] lstrcmpiW (lpString1=".3fr", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".3g2") returned 4 [0042.571] lstrcmpiW (lpString1=".3g2", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".3gp") returned 4 [0042.571] lstrcmpiW (lpString1=".3gp", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".7z") returned 3 [0042.571] lstrcmpiW (lpString1=".7z", lpString2="hmx") returned -1 [0042.571] lstrlenW (lpString=".accda") returned 6 [0042.571] lstrcmpiW (lpString1=".accda", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".accdb") returned 6 [0042.571] lstrcmpiW (lpString1=".accdb", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".accdc") returned 6 [0042.571] lstrcmpiW (lpString1=".accdc", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".accde") returned 6 [0042.571] lstrcmpiW (lpString1=".accde", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".accdt") returned 6 [0042.571] lstrcmpiW (lpString1=".accdt", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".accdw") returned 6 [0042.571] lstrcmpiW (lpString1=".accdw", lpString2="y.thmx") returned -1 [0042.571] lstrlenW (lpString=".adb") returned 4 [0042.571] lstrcmpiW (lpString1=".adb", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".adp") returned 4 [0042.571] lstrcmpiW (lpString1=".adp", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".ai") returned 3 [0042.571] lstrcmpiW (lpString1=".ai", lpString2="hmx") returned -1 [0042.571] lstrlenW (lpString=".ai3") returned 4 [0042.571] lstrcmpiW (lpString1=".ai3", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".ai4") returned 4 [0042.571] lstrcmpiW (lpString1=".ai4", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".ai5") returned 4 [0042.571] lstrcmpiW (lpString1=".ai5", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".ai6") returned 4 [0042.571] lstrcmpiW (lpString1=".ai6", lpString2="thmx") returned -1 [0042.571] lstrlenW (lpString=".ai7") returned 4 [0042.572] lstrcmpiW (lpString1=".ai7", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".ai8") returned 4 [0042.572] lstrcmpiW (lpString1=".ai8", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".anim") returned 5 [0042.572] lstrcmpiW (lpString1=".anim", lpString2=".thmx") returned -1 [0042.572] lstrlenW (lpString=".arw") returned 4 [0042.572] lstrcmpiW (lpString1=".arw", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".as") returned 3 [0042.572] lstrcmpiW (lpString1=".as", lpString2="hmx") returned -1 [0042.572] lstrlenW (lpString=".asa") returned 4 [0042.572] lstrcmpiW (lpString1=".asa", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".asc") returned 4 [0042.572] lstrcmpiW (lpString1=".asc", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".ascx") returned 5 [0042.572] lstrcmpiW (lpString1=".ascx", lpString2=".thmx") returned -1 [0042.572] lstrlenW (lpString=".asm") returned 4 [0042.572] lstrcmpiW (lpString1=".asm", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".asmx") returned 5 [0042.572] lstrcmpiW (lpString1=".asmx", lpString2=".thmx") returned -1 [0042.572] lstrlenW (lpString=".asp") returned 4 [0042.572] lstrcmpiW (lpString1=".asp", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".aspx") returned 5 [0042.572] lstrcmpiW (lpString1=".aspx", lpString2=".thmx") returned -1 [0042.572] lstrlenW (lpString=".asr") returned 4 [0042.572] lstrcmpiW (lpString1=".asr", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".asx") returned 4 [0042.572] lstrcmpiW (lpString1=".asx", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".avi") returned 4 [0042.572] lstrcmpiW (lpString1=".avi", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".avs") returned 4 [0042.572] lstrcmpiW (lpString1=".avs", lpString2="thmx") returned -1 [0042.572] lstrlenW (lpString=".backup") returned 7 [0042.572] lstrcmpiW (lpString1=".backup", lpString2="cy.thmx") returned -1 [0042.573] lstrlenW (lpString=".bak") returned 4 [0042.573] lstrcmpiW (lpString1=".bak", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".bay") returned 4 [0042.573] lstrcmpiW (lpString1=".bay", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".bd") returned 3 [0042.573] lstrcmpiW (lpString1=".bd", lpString2="hmx") returned -1 [0042.573] lstrlenW (lpString=".bin") returned 4 [0042.573] lstrcmpiW (lpString1=".bin", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".bmp") returned 4 [0042.573] lstrcmpiW (lpString1=".bmp", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".bz2") returned 4 [0042.573] lstrcmpiW (lpString1=".bz2", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".c") returned 2 [0042.573] lstrcmpiW (lpString1=".c", lpString2="mx") returned -1 [0042.573] lstrlenW (lpString=".cdr") returned 4 [0042.573] lstrcmpiW (lpString1=".cdr", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".cer") returned 4 [0042.573] lstrcmpiW (lpString1=".cer", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".cf") returned 3 [0042.573] lstrcmpiW (lpString1=".cf", lpString2="hmx") returned -1 [0042.573] lstrlenW (lpString=".cfc") returned 4 [0042.573] lstrcmpiW (lpString1=".cfc", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".cfm") returned 4 [0042.573] lstrcmpiW (lpString1=".cfm", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".cfml") returned 5 [0042.573] lstrcmpiW (lpString1=".cfml", lpString2=".thmx") returned -1 [0042.573] lstrlenW (lpString=".cfu") returned 4 [0042.573] lstrcmpiW (lpString1=".cfu", lpString2="thmx") returned -1 [0042.573] lstrlenW (lpString=".chm") returned 4 [0042.573] lstrcmpiW (lpString1=".chm", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".cin") returned 4 [0042.574] lstrcmpiW (lpString1=".cin", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".class") returned 6 [0042.574] lstrcmpiW (lpString1=".class", lpString2="y.thmx") returned -1 [0042.574] lstrlenW (lpString=".clx") returned 4 [0042.574] lstrcmpiW (lpString1=".clx", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".config") returned 7 [0042.574] lstrcmpiW (lpString1=".config", lpString2="cy.thmx") returned -1 [0042.574] lstrlenW (lpString=".cpp") returned 4 [0042.574] lstrcmpiW (lpString1=".cpp", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".cr2") returned 4 [0042.574] lstrcmpiW (lpString1=".cr2", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".crt") returned 4 [0042.574] lstrcmpiW (lpString1=".crt", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".crw") returned 4 [0042.574] lstrcmpiW (lpString1=".crw", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".cs") returned 3 [0042.574] lstrcmpiW (lpString1=".cs", lpString2="hmx") returned -1 [0042.574] lstrlenW (lpString=".css") returned 4 [0042.574] lstrcmpiW (lpString1=".css", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".csv") returned 4 [0042.574] lstrcmpiW (lpString1=".csv", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".cub") returned 4 [0042.574] lstrcmpiW (lpString1=".cub", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".dae") returned 4 [0042.574] lstrcmpiW (lpString1=".dae", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".dat") returned 4 [0042.574] lstrcmpiW (lpString1=".dat", lpString2="thmx") returned -1 [0042.574] lstrlenW (lpString=".db") returned 3 [0042.574] lstrcmpiW (lpString1=".db", lpString2="hmx") returned -1 [0042.574] lstrlenW (lpString=".dbf") returned 4 [0042.575] lstrcmpiW (lpString1=".dbf", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dbx") returned 4 [0042.575] lstrcmpiW (lpString1=".dbx", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dc3") returned 4 [0042.575] lstrcmpiW (lpString1=".dc3", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dcm") returned 4 [0042.575] lstrcmpiW (lpString1=".dcm", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dcr") returned 4 [0042.575] lstrcmpiW (lpString1=".dcr", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".der") returned 4 [0042.575] lstrcmpiW (lpString1=".der", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dib") returned 4 [0042.575] lstrcmpiW (lpString1=".dib", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dic") returned 4 [0042.575] lstrcmpiW (lpString1=".dic", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".dif") returned 4 [0042.575] lstrcmpiW (lpString1=".dif", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".divx") returned 5 [0042.575] lstrcmpiW (lpString1=".divx", lpString2=".thmx") returned -1 [0042.575] lstrlenW (lpString=".djvu") returned 5 [0042.575] lstrcmpiW (lpString1=".djvu", lpString2=".thmx") returned -1 [0042.575] lstrlenW (lpString=".dng") returned 4 [0042.575] lstrcmpiW (lpString1=".dng", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".doc") returned 4 [0042.575] lstrcmpiW (lpString1=".doc", lpString2="thmx") returned -1 [0042.575] lstrlenW (lpString=".docm") returned 5 [0042.575] lstrcmpiW (lpString1=".docm", lpString2=".thmx") returned -1 [0042.575] lstrlenW (lpString=".docx") returned 5 [0042.575] lstrcmpiW (lpString1=".docx", lpString2=".thmx") returned -1 [0042.575] lstrlenW (lpString=".dot") returned 4 [0042.575] lstrcmpiW (lpString1=".dot", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dotm") returned 5 [0042.576] lstrcmpiW (lpString1=".dotm", lpString2=".thmx") returned -1 [0042.576] lstrlenW (lpString=".dotx") returned 5 [0042.576] lstrcmpiW (lpString1=".dotx", lpString2=".thmx") returned -1 [0042.576] lstrlenW (lpString=".dpx") returned 4 [0042.576] lstrcmpiW (lpString1=".dpx", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dqy") returned 4 [0042.576] lstrcmpiW (lpString1=".dqy", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dsn") returned 4 [0042.576] lstrcmpiW (lpString1=".dsn", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dt") returned 3 [0042.576] lstrcmpiW (lpString1=".dt", lpString2="hmx") returned -1 [0042.576] lstrlenW (lpString=".dtd") returned 4 [0042.576] lstrcmpiW (lpString1=".dtd", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dwg") returned 4 [0042.576] lstrcmpiW (lpString1=".dwg", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dwt") returned 4 [0042.576] lstrcmpiW (lpString1=".dwt", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".dx") returned 3 [0042.576] lstrcmpiW (lpString1=".dx", lpString2="hmx") returned -1 [0042.576] lstrlenW (lpString=".dxf") returned 4 [0042.576] lstrcmpiW (lpString1=".dxf", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".edml") returned 5 [0042.576] lstrcmpiW (lpString1=".edml", lpString2=".thmx") returned -1 [0042.576] lstrlenW (lpString=".efd") returned 4 [0042.576] lstrcmpiW (lpString1=".efd", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".elf") returned 4 [0042.576] lstrcmpiW (lpString1=".elf", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".emf") returned 4 [0042.576] lstrcmpiW (lpString1=".emf", lpString2="thmx") returned -1 [0042.576] lstrlenW (lpString=".emz") returned 4 [0042.577] lstrcmpiW (lpString1=".emz", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".epf") returned 4 [0042.577] lstrcmpiW (lpString1=".epf", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".eps") returned 4 [0042.577] lstrcmpiW (lpString1=".eps", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".epsf") returned 5 [0042.577] lstrcmpiW (lpString1=".epsf", lpString2=".thmx") returned -1 [0042.577] lstrlenW (lpString=".epsp") returned 5 [0042.577] lstrcmpiW (lpString1=".epsp", lpString2=".thmx") returned -1 [0042.577] lstrlenW (lpString=".erf") returned 4 [0042.577] lstrcmpiW (lpString1=".erf", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".exr") returned 4 [0042.577] lstrcmpiW (lpString1=".exr", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".f4v") returned 4 [0042.577] lstrcmpiW (lpString1=".f4v", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".fido") returned 5 [0042.577] lstrcmpiW (lpString1=".fido", lpString2=".thmx") returned -1 [0042.577] lstrlenW (lpString=".flm") returned 4 [0042.577] lstrcmpiW (lpString1=".flm", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".flv") returned 4 [0042.577] lstrcmpiW (lpString1=".flv", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".frm") returned 4 [0042.577] lstrcmpiW (lpString1=".frm", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".fxg") returned 4 [0042.577] lstrcmpiW (lpString1=".fxg", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".geo") returned 4 [0042.577] lstrcmpiW (lpString1=".geo", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".gif") returned 4 [0042.577] lstrcmpiW (lpString1=".gif", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".grs") returned 4 [0042.577] lstrcmpiW (lpString1=".grs", lpString2="thmx") returned -1 [0042.577] lstrlenW (lpString=".gz") returned 3 [0042.577] lstrcmpiW (lpString1=".gz", lpString2="hmx") returned -1 [0042.577] lstrlenW (lpString=".h") returned 2 [0042.577] lstrcmpiW (lpString1=".h", lpString2="mx") returned -1 [0042.578] lstrlenW (lpString=".hdr") returned 4 [0042.578] lstrcmpiW (lpString1=".hdr", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".hpp") returned 4 [0042.578] lstrcmpiW (lpString1=".hpp", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".hta") returned 4 [0042.578] lstrcmpiW (lpString1=".hta", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".htc") returned 4 [0042.578] lstrcmpiW (lpString1=".htc", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".htm") returned 4 [0042.578] lstrcmpiW (lpString1=".htm", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".html") returned 5 [0042.578] lstrcmpiW (lpString1=".html", lpString2=".thmx") returned -1 [0042.578] lstrlenW (lpString=".icb") returned 4 [0042.578] lstrcmpiW (lpString1=".icb", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".ics") returned 4 [0042.578] lstrcmpiW (lpString1=".ics", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".iff") returned 4 [0042.578] lstrcmpiW (lpString1=".iff", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".inc") returned 4 [0042.578] lstrcmpiW (lpString1=".inc", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".indd") returned 5 [0042.578] lstrcmpiW (lpString1=".indd", lpString2=".thmx") returned -1 [0042.578] lstrlenW (lpString=".ini") returned 4 [0042.578] lstrcmpiW (lpString1=".ini", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".iqy") returned 4 [0042.578] lstrcmpiW (lpString1=".iqy", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".j2c") returned 4 [0042.578] lstrcmpiW (lpString1=".j2c", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".j2k") returned 4 [0042.578] lstrcmpiW (lpString1=".j2k", lpString2="thmx") returned -1 [0042.578] lstrlenW (lpString=".java") returned 5 [0042.578] lstrcmpiW (lpString1=".java", lpString2=".thmx") returned -1 [0042.578] lstrlenW (lpString=".jp2") returned 4 [0042.578] lstrcmpiW (lpString1=".jp2", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".jpc") returned 4 [0042.579] lstrcmpiW (lpString1=".jpc", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".jpe") returned 4 [0042.579] lstrcmpiW (lpString1=".jpe", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".jpeg") returned 5 [0042.579] lstrcmpiW (lpString1=".jpeg", lpString2=".thmx") returned -1 [0042.579] lstrlenW (lpString=".jpf") returned 4 [0042.579] lstrcmpiW (lpString1=".jpf", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".jpg") returned 4 [0042.579] lstrcmpiW (lpString1=".jpg", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".jpx") returned 4 [0042.579] lstrcmpiW (lpString1=".jpx", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".js") returned 3 [0042.579] lstrcmpiW (lpString1=".js", lpString2="hmx") returned -1 [0042.579] lstrlenW (lpString=".jsf") returned 4 [0042.579] lstrcmpiW (lpString1=".jsf", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".json") returned 5 [0042.579] lstrcmpiW (lpString1=".json", lpString2=".thmx") returned -1 [0042.579] lstrlenW (lpString=".jsp") returned 4 [0042.579] lstrcmpiW (lpString1=".jsp", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".kdc") returned 4 [0042.579] lstrcmpiW (lpString1=".kdc", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".kmz") returned 4 [0042.579] lstrcmpiW (lpString1=".kmz", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".kwm") returned 4 [0042.579] lstrcmpiW (lpString1=".kwm", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".lasso") returned 6 [0042.579] lstrcmpiW (lpString1=".lasso", lpString2="y.thmx") returned -1 [0042.579] lstrlenW (lpString=".lbi") returned 4 [0042.579] lstrcmpiW (lpString1=".lbi", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".lgf") returned 4 [0042.579] lstrcmpiW (lpString1=".lgf", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".lgp") returned 4 [0042.579] lstrcmpiW (lpString1=".lgp", lpString2="thmx") returned -1 [0042.579] lstrlenW (lpString=".log") returned 4 [0042.580] lstrcmpiW (lpString1=".log", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".m1v") returned 4 [0042.580] lstrcmpiW (lpString1=".m1v", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".m4a") returned 4 [0042.580] lstrcmpiW (lpString1=".m4a", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".m4v") returned 4 [0042.580] lstrcmpiW (lpString1=".m4v", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".max") returned 4 [0042.580] lstrcmpiW (lpString1=".max", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".md") returned 3 [0042.580] lstrcmpiW (lpString1=".md", lpString2="hmx") returned -1 [0042.580] lstrlenW (lpString=".mda") returned 4 [0042.580] lstrcmpiW (lpString1=".mda", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mdb") returned 4 [0042.580] lstrcmpiW (lpString1=".mdb", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mde") returned 4 [0042.580] lstrcmpiW (lpString1=".mde", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mdf") returned 4 [0042.580] lstrcmpiW (lpString1=".mdf", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mdw") returned 4 [0042.580] lstrcmpiW (lpString1=".mdw", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mef") returned 4 [0042.580] lstrcmpiW (lpString1=".mef", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mft") returned 4 [0042.580] lstrcmpiW (lpString1=".mft", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mfw") returned 4 [0042.580] lstrcmpiW (lpString1=".mfw", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mht") returned 4 [0042.580] lstrcmpiW (lpString1=".mht", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mhtml") returned 6 [0042.580] lstrcmpiW (lpString1=".mhtml", lpString2="y.thmx") returned -1 [0042.580] lstrlenW (lpString=".mka") returned 4 [0042.580] lstrcmpiW (lpString1=".mka", lpString2="thmx") returned -1 [0042.580] lstrlenW (lpString=".mkidx") returned 6 [0042.581] lstrcmpiW (lpString1=".mkidx", lpString2="y.thmx") returned -1 [0042.581] lstrlenW (lpString=".mkv") returned 4 [0042.581] lstrcmpiW (lpString1=".mkv", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mos") returned 4 [0042.581] lstrcmpiW (lpString1=".mos", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mov") returned 4 [0042.581] lstrcmpiW (lpString1=".mov", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mp3") returned 4 [0042.581] lstrcmpiW (lpString1=".mp3", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mp4") returned 4 [0042.581] lstrcmpiW (lpString1=".mp4", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mpeg") returned 5 [0042.581] lstrcmpiW (lpString1=".mpeg", lpString2=".thmx") returned -1 [0042.581] lstrlenW (lpString=".mpg") returned 4 [0042.581] lstrcmpiW (lpString1=".mpg", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mpv") returned 4 [0042.581] lstrcmpiW (lpString1=".mpv", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mrw") returned 4 [0042.581] lstrcmpiW (lpString1=".mrw", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".msg") returned 4 [0042.581] lstrcmpiW (lpString1=".msg", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".mxl") returned 4 [0042.581] lstrcmpiW (lpString1=".mxl", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".myd") returned 4 [0042.581] lstrcmpiW (lpString1=".myd", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".myi") returned 4 [0042.581] lstrcmpiW (lpString1=".myi", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".nef") returned 4 [0042.581] lstrcmpiW (lpString1=".nef", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".nrw") returned 4 [0042.581] lstrcmpiW (lpString1=".nrw", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".obj") returned 4 [0042.581] lstrcmpiW (lpString1=".obj", lpString2="thmx") returned -1 [0042.581] lstrlenW (lpString=".odb") returned 4 [0042.581] lstrcmpiW (lpString1=".odb", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".odc") returned 4 [0042.582] lstrcmpiW (lpString1=".odc", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".odm") returned 4 [0042.582] lstrcmpiW (lpString1=".odm", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".odp") returned 4 [0042.582] lstrcmpiW (lpString1=".odp", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".ods") returned 4 [0042.582] lstrcmpiW (lpString1=".ods", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".oft") returned 4 [0042.582] lstrcmpiW (lpString1=".oft", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".one") returned 4 [0042.582] lstrcmpiW (lpString1=".one", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".onepkg") returned 7 [0042.582] lstrcmpiW (lpString1=".onepkg", lpString2="cy.thmx") returned -1 [0042.582] lstrlenW (lpString=".onetoc2") returned 8 [0042.582] lstrcmpiW (lpString1=".onetoc2", lpString2="ncy.thmx") returned -1 [0042.582] lstrlenW (lpString=".opt") returned 4 [0042.582] lstrcmpiW (lpString1=".opt", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".oqy") returned 4 [0042.582] lstrcmpiW (lpString1=".oqy", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".orf") returned 4 [0042.582] lstrcmpiW (lpString1=".orf", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".p12") returned 4 [0042.582] lstrcmpiW (lpString1=".p12", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".p7b") returned 4 [0042.582] lstrcmpiW (lpString1=".p7b", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".p7c") returned 4 [0042.582] lstrcmpiW (lpString1=".p7c", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".pam") returned 4 [0042.582] lstrcmpiW (lpString1=".pam", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".pbm") returned 4 [0042.582] lstrcmpiW (lpString1=".pbm", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".pct") returned 4 [0042.582] lstrcmpiW (lpString1=".pct", lpString2="thmx") returned -1 [0042.582] lstrlenW (lpString=".pcx") returned 4 [0042.583] lstrcmpiW (lpString1=".pcx", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pdd") returned 4 [0042.583] lstrcmpiW (lpString1=".pdd", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pdf") returned 4 [0042.583] lstrcmpiW (lpString1=".pdf", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pdp") returned 4 [0042.583] lstrcmpiW (lpString1=".pdp", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pef") returned 4 [0042.583] lstrcmpiW (lpString1=".pef", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pem") returned 4 [0042.583] lstrcmpiW (lpString1=".pem", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pff") returned 4 [0042.583] lstrcmpiW (lpString1=".pff", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pfm") returned 4 [0042.583] lstrcmpiW (lpString1=".pfm", lpString2="thmx") returned -1 [0042.583] lstrlenW (lpString=".pfx") returned 4 [0042.583] lstrcmpiW (lpString1=".pfx", lpString2="thmx") returned -1 [0042.944] lstrlenW (lpString=".pgm") returned 4 [0042.944] lstrcmpiW (lpString1=".pgm", lpString2="thmx") returned -1 [0042.944] lstrlenW (lpString=".php") returned 4 [0042.944] lstrcmpiW (lpString1=".php", lpString2="thmx") returned -1 [0042.944] lstrlenW (lpString=".php3") returned 5 [0042.945] lstrcmpiW (lpString1=".php3", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".php4") returned 5 [0042.945] lstrcmpiW (lpString1=".php4", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".php5") returned 5 [0042.945] lstrcmpiW (lpString1=".php5", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".phtml") returned 6 [0042.945] lstrcmpiW (lpString1=".phtml", lpString2="y.thmx") returned -1 [0042.945] lstrlenW (lpString=".pict") returned 5 [0042.945] lstrcmpiW (lpString1=".pict", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".pl") returned 3 [0042.945] lstrcmpiW (lpString1=".pl", lpString2="hmx") returned -1 [0042.945] lstrlenW (lpString=".pls") returned 4 [0042.945] lstrcmpiW (lpString1=".pls", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".pm") returned 3 [0042.945] lstrcmpiW (lpString1=".pm", lpString2="hmx") returned -1 [0042.945] lstrlenW (lpString=".png") returned 4 [0042.945] lstrcmpiW (lpString1=".png", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".pnm") returned 4 [0042.945] lstrcmpiW (lpString1=".pnm", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".pot") returned 4 [0042.945] lstrcmpiW (lpString1=".pot", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".potm") returned 5 [0042.945] lstrcmpiW (lpString1=".potm", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".potx") returned 5 [0042.945] lstrcmpiW (lpString1=".potx", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".ppa") returned 4 [0042.945] lstrcmpiW (lpString1=".ppa", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".ppam") returned 5 [0042.945] lstrcmpiW (lpString1=".ppam", lpString2=".thmx") returned -1 [0042.945] lstrlenW (lpString=".ppm") returned 4 [0042.945] lstrcmpiW (lpString1=".ppm", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".pps") returned 4 [0042.945] lstrcmpiW (lpString1=".pps", lpString2="thmx") returned -1 [0042.945] lstrlenW (lpString=".ppsm") returned 5 [0042.945] lstrcmpiW (lpString1=".ppsm", lpString2=".thmx") returned -1 [0042.946] lstrlenW (lpString=".ppt") returned 4 [0042.946] lstrcmpiW (lpString1=".ppt", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".pptm") returned 5 [0042.946] lstrcmpiW (lpString1=".pptm", lpString2=".thmx") returned -1 [0042.946] lstrlenW (lpString=".pptx") returned 5 [0042.946] lstrcmpiW (lpString1=".pptx", lpString2=".thmx") returned -1 [0042.946] lstrlenW (lpString=".prn") returned 4 [0042.946] lstrcmpiW (lpString1=".prn", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".ps") returned 3 [0042.946] lstrcmpiW (lpString1=".ps", lpString2="hmx") returned -1 [0042.946] lstrlenW (lpString=".psb") returned 4 [0042.946] lstrcmpiW (lpString1=".psb", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".psd") returned 4 [0042.946] lstrcmpiW (lpString1=".psd", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".pst") returned 4 [0042.946] lstrcmpiW (lpString1=".pst", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".ptx") returned 4 [0042.946] lstrcmpiW (lpString1=".ptx", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".pub") returned 4 [0042.946] lstrcmpiW (lpString1=".pub", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".pwm") returned 4 [0042.946] lstrcmpiW (lpString1=".pwm", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".pxr") returned 4 [0042.946] lstrcmpiW (lpString1=".pxr", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".py") returned 3 [0042.946] lstrcmpiW (lpString1=".py", lpString2="hmx") returned -1 [0042.946] lstrlenW (lpString=".qt") returned 3 [0042.946] lstrcmpiW (lpString1=".qt", lpString2="hmx") returned -1 [0042.946] lstrlenW (lpString=".r3d") returned 4 [0042.946] lstrcmpiW (lpString1=".r3d", lpString2="thmx") returned -1 [0042.946] lstrlenW (lpString=".raf") returned 4 [0042.946] lstrcmpiW (lpString1=".raf", lpString2="thmx") returned -1 [0043.699] @RtlpReAllocateHeap@16 () [0049.029] FindNextFileW (in: hFindFile=0x3fc28e8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.029] FindNextFileW (in: hFindFile=0x3fc28e8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1b35c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x203800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ara131.lex", cAlternateFileName="")) returned 1 [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.029] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.030] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.031] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.032] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.033] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.034] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.035] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.036] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.037] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () [0049.038] @NlsCompareInvariantNoCase@16 () Thread: id = 21 os_tid = 0x9f8 Thread: id = 26 os_tid = 0xa98 Thread: id = 41 os_tid = 0xb38 Thread: id = 43 os_tid = 0xbc8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4ee0a000" os_pid = "0x990" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x97c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x994 [0033.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31fda0 | out: lpSystemTimeAsFileTime=0x31fda0*(dwLowDateTime=0x8c718800, dwHighDateTime=0x1d51ea7)) [0033.177] GetCurrentProcessId () returned 0x990 [0033.177] GetCurrentThreadId () returned 0x994 [0033.177] GetTickCount () returned 0x18f43 [0033.177] QueryPerformanceCounter (in: lpPerformanceCount=0x31fda8 | out: lpPerformanceCount=0x31fda8*=15339253522) returned 1 [0033.180] GetModuleHandleW (lpModuleName=0x0) returned 0x4a590000 [0033.180] __set_app_type (_Type=0x1) [0033.180] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a5b7810) returned 0x0 [0033.180] __getmainargs (in: _Argc=0x4a5da608, _Argv=0x4a5da618, _Env=0x4a5da610, _DoWildCard=0, _StartInfo=0x4a5be0f4 | out: _Argc=0x4a5da608, _Argv=0x4a5da618, _Env=0x4a5da610) returned 0 [0033.181] GetCurrentThreadId () returned 0x994 [0033.181] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x994) returned 0x3c [0033.182] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0033.182] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0033.182] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.182] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0033.182] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x31fd38 | out: phkResult=0x31fd38*=0x0) returned 0x2 [0033.182] VirtualQuery (in: lpAddress=0x31fd20, lpBuffer=0x31fca0, dwLength=0x30 | out: lpBuffer=0x31fca0*(BaseAddress=0x31f000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.182] VirtualQuery (in: lpAddress=0x220000, lpBuffer=0x31fca0, dwLength=0x30 | out: lpBuffer=0x31fca0*(BaseAddress=0x220000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.182] VirtualQuery (in: lpAddress=0x221000, lpBuffer=0x31fca0, dwLength=0x30 | out: lpBuffer=0x31fca0*(BaseAddress=0x221000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.182] VirtualQuery (in: lpAddress=0x224000, lpBuffer=0x31fca0, dwLength=0x30 | out: lpBuffer=0x31fca0*(BaseAddress=0x224000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.182] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x31fca0, dwLength=0x30 | out: lpBuffer=0x31fca0*(BaseAddress=0x320000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0033.182] GetConsoleOutputCP () returned 0x1b5 [0033.182] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0033.183] SetConsoleCtrlHandler (HandlerRoutine=0x4a5b3184, Add=1) returned 1 [0033.183] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.183] SetConsoleMode (hConsoleHandle=0xf8, dwMode=0x0) returned 0 [0033.183] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.183] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x4a5be194 | out: lpMode=0x4a5be194) returned 0 [0033.183] _get_osfhandle (_FileHandle=0) returned 0xec [0033.183] GetConsoleMode (in: hConsoleHandle=0xec, lpMode=0x4a5be198 | out: lpMode=0x4a5be198) returned 0 [0033.183] GetEnvironmentStringsW () returned 0x4f8a60* [0033.184] GetProcessHeap () returned 0x4e0000 [0033.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xa7c) returned 0x4f94f0 [0033.184] FreeEnvironmentStringsW (penv=0x4f8a60) returned 1 [0033.184] GetProcessHeap () returned 0x4e0000 [0033.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x8) returned 0x4f88e0 [0033.184] GetEnvironmentStringsW () returned 0x4f8a60* [0033.184] GetProcessHeap () returned 0x4e0000 [0033.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xa7c) returned 0x4f9f80 [0033.184] FreeEnvironmentStringsW (penv=0x4f8a60) returned 1 [0033.184] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31ebf8 | out: phkResult=0x31ebf8*=0x44) returned 0x0 [0033.184] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x18, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.184] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x1, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.184] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x1, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x0, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x40, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x40, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x40, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.185] RegCloseKey (hKey=0x44) returned 0x0 [0033.185] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31ebf8 | out: phkResult=0x31ebf8*=0x44) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x40, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x1, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x1, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x0, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x9, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x4, lpData=0x31ec10*=0x9, lpcbData=0x31ebf4*=0x4) returned 0x0 [0033.185] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31ebf0, lpData=0x31ec10, lpcbData=0x31ebf4*=0x1000 | out: lpType=0x31ebf0*=0x0, lpData=0x31ec10*=0x9, lpcbData=0x31ebf4*=0x1000) returned 0x2 [0033.185] RegCloseKey (hKey=0x44) returned 0x0 [0033.185] time (in: timer=0x0 | out: timer=0x0) returned 0x5cfcd458 [0033.185] srand (_Seed=0x5cfcd458) [0033.185] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.185] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.186] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.186] GetProcessHeap () returned 0x4e0000 [0033.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x218) returned 0x4faa10 [0033.186] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4faa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0033.186] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.186] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.186] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.186] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0033.186] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0033.186] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0033.186] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0033.186] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0033.186] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0033.186] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0033.186] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0033.186] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0033.186] GetProcessHeap () returned 0x4e0000 [0033.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f94f0 | out: hHeap=0x4e0000) returned 1 [0033.186] GetEnvironmentStringsW () returned 0x4f8a60* [0033.186] GetProcessHeap () returned 0x4e0000 [0033.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xa94) returned 0x4fac30 [0033.187] FreeEnvironmentStringsW (penv=0x4f8a60) returned 1 [0033.187] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.187] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.187] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0033.187] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0033.187] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0033.187] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0033.187] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0033.187] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0033.187] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0033.187] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0033.187] GetProcessHeap () returned 0x4e0000 [0033.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x5c) returned 0x4fb6d0 [0033.187] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31fa00 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x31fa00, lpFilePart=0x31f9e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f9e0*="Desktop") returned 0x25 [0033.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.187] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31f710 | out: lpFindFileData=0x31f710*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x4fb740 [0033.187] FindClose (in: hFindFile=0x4fb740 | out: hFindFile=0x4fb740) returned 1 [0033.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31f710 | out: lpFindFileData=0x31f710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4fb740 [0033.188] FindClose (in: hFindFile=0x4fb740 | out: hFindFile=0x4fb740) returned 1 [0033.188] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0033.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31f710 | out: lpFindFileData=0x31f710*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x85a4afc0, ftLastAccessTime.dwHighDateTime=0x1d51ea7, ftLastWriteTime.dwLowDateTime=0x85a4afc0, ftLastWriteTime.dwHighDateTime=0x1d51ea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x4fb740 [0033.188] FindClose (in: hFindFile=0x4fb740 | out: hFindFile=0x4fb740) returned 1 [0033.188] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.188] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0033.188] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0033.188] GetProcessHeap () returned 0x4e0000 [0033.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fac30 | out: hHeap=0x4e0000) returned 1 [0033.188] GetEnvironmentStringsW () returned 0x4fb740* [0033.188] GetProcessHeap () returned 0x4e0000 [0033.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xae8) returned 0x4fc230 [0033.188] FreeEnvironmentStringsW (penv=0x4fb740) returned 1 [0033.188] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.188] GetProcessHeap () returned 0x4e0000 [0033.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fb6d0 | out: hHeap=0x4e0000) returned 1 [0033.188] GetProcessHeap () returned 0x4e0000 [0033.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4016) returned 0x4fcd20 [0033.189] GetProcessHeap () returned 0x4e0000 [0033.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd20 | out: hHeap=0x4e0000) returned 1 [0033.189] GetConsoleOutputCP () returned 0x1b5 [0033.189] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0033.189] GetUserDefaultLCID () returned 0x409 [0033.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a5c7b50, cchData=8 | out: lpLCData=":") returned 2 [0033.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x31fb10, cchData=128 | out: lpLCData="0") returned 2 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x31fb10, cchData=128 | out: lpLCData="0") returned 2 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x31fb10, cchData=128 | out: lpLCData="1") returned 2 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5da740, cchData=8 | out: lpLCData="/") returned 2 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5da4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5da460, cchData=32 | out: lpLCData="Tue") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5da420, cchData=32 | out: lpLCData="Wed") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5da3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5da3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5da360, cchData=32 | out: lpLCData="Sat") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5da700, cchData=32 | out: lpLCData="Sun") returned 4 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a5c7b40, cchData=8 | out: lpLCData=".") returned 2 [0033.190] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5da4e0, cchData=8 | out: lpLCData=",") returned 2 [0033.190] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0033.191] GetProcessHeap () returned 0x4e0000 [0033.191] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20c) returned 0x4f95c0 [0033.191] GetConsoleTitleW (in: lpConsoleTitle=0x4f95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.192] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.192] GetFileType (hFile=0xf8) returned 0x3 [0033.192] BrandingFormatString () returned 0x4f97e0 [0033.203] GetVersion () returned 0x1db10106 [0033.203] _vsnwprintf (in: _Buffer=0x31fc80, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x31fc18 | out: _Buffer="6.1.7601") returned 8 [0033.203] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.203] GetFileType (hFile=0xf8) returned 0x3 [0033.204] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5d6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0033.204] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5d6340, nSize=0x2000, Arguments=0x31fc20 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0033.204] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31fba8, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fba8*=0x24, lpOverlapped=0x0) returned 1 [0033.204] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31fc48 | out: _Buffer="\r\n") returned 2 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] GetFileType (hFile=0xf8) returned 0x3 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.204] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fc18*=0x2, lpOverlapped=0x0) returned 1 [0033.204] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x31fc48 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] GetFileType (hFile=0xf8) returned 0x3 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0033.204] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x31fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fc18*=0x3f, lpOverlapped=0x0) returned 1 [0033.204] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31fc48 | out: _Buffer="\r\n") returned 2 [0033.204] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.204] GetFileType (hFile=0xf8) returned 0x3 [0033.205] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.205] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.205] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31fc18, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fc18*=0x2, lpOverlapped=0x0) returned 1 [0033.205] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0033.205] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0033.205] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0033.205] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0033.205] _get_osfhandle (_FileHandle=0) returned 0xec [0033.205] GetFileType (hFile=0xec) returned 0x3 [0033.205] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0033.205] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x31fa70 | out: TokenHandle=0x31fa70*=0x0) returned 0xc000007c [0033.205] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x31fa70 | out: TokenHandle=0x31fa70*=0x50) returned 0x0 [0033.205] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x31fa80, TokenInformationLength=0x4, ReturnLength=0x31fa88 | out: TokenInformation=0x31fa80, ReturnLength=0x31fa88) returned 0x0 [0033.205] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x31fa88, TokenInformationLength=0x4, ReturnLength=0x31fa80 | out: TokenInformation=0x31fa88, ReturnLength=0x31fa80) returned 0x0 [0033.205] NtClose (Handle=0x50) returned 0x0 [0033.205] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x31fa50, nSize=0x0, Arguments=0x31fa58 | out: lpBuffer="\x97e0\x4f") returned 0xf [0033.205] GetProcessHeap () returned 0x4e0000 [0033.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x218) returned 0x4e1ab0 [0033.206] GetConsoleTitleW (in: lpConsoleTitle=0x31faa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.206] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0033.206] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0033.207] GetProcessHeap () returned 0x4e0000 [0033.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1ab0 | out: hHeap=0x4e0000) returned 1 [0033.207] LocalFree (hMem=0x4f97e0) returned 0x0 [0033.207] GetProcessHeap () returned 0x4e0000 [0033.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4faa10 | out: hHeap=0x4e0000) returned 1 [0033.207] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f788 | out: _Buffer="\r\n") returned 2 [0033.207] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.207] GetFileType (hFile=0xf8) returned 0x3 [0033.207] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.207] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.207] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f758, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f758*=0x2, lpOverlapped=0x0) returned 1 [0033.207] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0033.207] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.207] _vsnwprintf (in: _Buffer=0x4a5beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f798 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0033.207] _vsnwprintf (in: _Buffer=0x4a5bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f798 | out: _Buffer=">") returned 1 [0033.207] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.207] GetFileType (hFile=0xf8) returned 0x3 [0033.208] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.208] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0033.208] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x31f788, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f788*=0x26, lpOverlapped=0x0) returned 1 [0033.208] _get_osfhandle (_FileHandle=0) returned 0xec [0033.208] GetFileType (hFile=0xec) returned 0x3 [0033.208] _get_osfhandle (_FileHandle=0) returned 0xec [0033.208] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.208] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0033.209] _get_osfhandle (_FileHandle=0) returned 0xec [0033.209] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.209] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.209] _get_osfhandle (_FileHandle=0) returned 0xec [0033.209] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.209] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0033.209] _get_osfhandle (_FileHandle=0) returned 0xec [0033.209] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.209] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.209] _get_osfhandle (_FileHandle=0) returned 0xec [0033.209] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.209] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.209] _get_osfhandle (_FileHandle=0) returned 0xec [0033.209] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0033.210] _get_osfhandle (_FileHandle=0) returned 0xec [0033.210] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.210] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0033.211] _get_osfhandle (_FileHandle=0) returned 0xec [0033.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.211] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0033.212] _get_osfhandle (_FileHandle=0) returned 0xec [0033.212] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.212] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.212] _get_osfhandle (_FileHandle=0) returned 0xec [0033.212] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.212] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0033.212] _get_osfhandle (_FileHandle=0) returned 0xec [0033.212] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.212] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0033.212] _get_osfhandle (_FileHandle=0) returned 0xec [0033.212] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.212] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.212] _get_osfhandle (_FileHandle=0) returned 0xec [0033.212] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.212] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0033.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0033.213] _get_osfhandle (_FileHandle=0) returned 0xec [0033.213] GetFileType (hFile=0xec) returned 0x3 [0033.213] _get_osfhandle (_FileHandle=0) returned 0xec [0033.213] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.213] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.213] GetFileType (hFile=0xf8) returned 0x3 [0033.213] _get_osfhandle (_FileHandle=1) returned 0xf8 [0033.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0033.213] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x31fa68, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fa68*=0x18, lpOverlapped=0x0) returned 1 [0033.213] GetProcessHeap () returned 0x4e0000 [0033.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4012) returned 0x4fcd20 [0033.213] GetProcessHeap () returned 0x4e0000 [0033.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcd20 | out: hHeap=0x4e0000) returned 1 [0033.214] _wcsicmp (_String1="mode", _String2=")") returned 68 [0033.214] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0033.214] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0033.214] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0033.214] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0033.214] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0033.214] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0033.214] GetProcessHeap () returned 0x4e0000 [0033.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0) returned 0x4f97e0 [0033.214] GetProcessHeap () returned 0x4e0000 [0033.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1a) returned 0x4f4610 [0033.214] GetProcessHeap () returned 0x4e0000 [0033.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x38) returned 0x4f6510 [0033.215] GetConsoleOutputCP () returned 0x1b5 [0033.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0033.215] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.215] GetConsoleTitleW (in: lpConsoleTitle=0x31fa20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.216] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.216] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.216] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.216] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.216] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.216] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.216] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.216] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.216] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.216] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.216] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.216] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.216] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.216] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.216] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.216] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.216] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.216] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.216] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.216] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.216] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.216] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.216] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.216] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.216] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.216] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.216] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.216] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.216] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.217] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.217] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.217] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.217] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.217] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.217] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.217] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.217] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.217] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.217] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.217] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.217] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.217] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.217] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.217] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.217] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.217] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.217] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.217] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.217] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.217] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.217] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.217] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.217] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.217] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.217] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.217] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.217] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.217] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.217] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.217] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.217] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.217] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.217] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.218] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.218] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.218] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.218] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.218] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.218] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.218] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.218] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.218] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.218] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.218] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.218] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.218] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.218] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.218] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.218] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.218] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0033.218] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0033.218] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0033.218] GetProcessHeap () returned 0x4e0000 [0033.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x218) returned 0x4e1ab0 [0033.218] GetProcessHeap () returned 0x4e0000 [0033.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x42) returned 0x4f98a0 [0033.218] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0033.218] GetProcessHeap () returned 0x4e0000 [0033.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x420) returned 0x4f9a80 [0033.219] SetErrorMode (uMode=0x0) returned 0x0 [0033.219] SetErrorMode (uMode=0x1) returned 0x0 [0033.219] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f9a90, lpFilePart=0x31f2b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f2b0*="Desktop") returned 0x25 [0033.219] SetErrorMode (uMode=0x0) returned 0x1 [0033.219] GetProcessHeap () returned 0x4e0000 [0033.219] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9a80, Size=0x66) returned 0x4f9a80 [0033.219] GetProcessHeap () returned 0x4e0000 [0033.219] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9a80) returned 0x66 [0033.219] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.219] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0033.219] GetProcessHeap () returned 0x4e0000 [0033.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x128) returned 0x4e1cd0 [0033.219] GetProcessHeap () returned 0x4e0000 [0033.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x240) returned 0x4f9b00 [0033.225] GetProcessHeap () returned 0x4e0000 [0033.225] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9b00, Size=0x12a) returned 0x4f9b00 [0033.225] GetProcessHeap () returned 0x4e0000 [0033.225] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9b00) returned 0x12a [0033.225] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.225] GetProcessHeap () returned 0x4e0000 [0033.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe8) returned 0x4f5b70 [0033.225] GetProcessHeap () returned 0x4e0000 [0033.225] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f5b70, Size=0x7e) returned 0x4f5b70 [0033.225] GetProcessHeap () returned 0x4e0000 [0033.225] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5b70) returned 0x7e [0033.313] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.313] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0xffffffffffffffff [0033.314] GetLastError () returned 0x2 [0033.314] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0xffffffffffffffff [0033.314] GetLastError () returned 0x2 [0033.314] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.314] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0x4f5c00 [0033.314] GetProcessHeap () returned 0x4e0000 [0033.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x4f4640 [0033.314] FindClose (in: hFindFile=0x4f5c00 | out: hFindFile=0x4f5c00) returned 1 [0033.315] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0x4f5c00 [0033.315] GetProcessHeap () returned 0x4e0000 [0033.315] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4640, Size=0x8) returned 0x4f98f0 [0033.315] FindClose (in: hFindFile=0x4f5c00 | out: hFindFile=0x4f5c00) returned 1 [0033.315] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0033.315] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0033.315] GetConsoleTitleW (in: lpConsoleTitle=0x31f570, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.315] GetProcessHeap () returned 0x4e0000 [0033.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x21c) returned 0x4f9c40 [0033.315] GetConsoleTitleW (in: lpConsoleTitle=0x4f9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.315] GetProcessHeap () returned 0x4e0000 [0033.315] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9c40, Size=0xa8) returned 0x4f9c40 [0033.315] GetProcessHeap () returned 0x4e0000 [0033.315] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9c40) returned 0xa8 [0033.315] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0033.316] GetProcessHeap () returned 0x4e0000 [0033.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9c40 | out: hHeap=0x4e0000) returned 1 [0033.316] InitializeProcThreadAttributeList (in: lpAttributeList=0x31f328, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31f2e8 | out: lpAttributeList=0x31f328, lpSize=0x31f2e8) returned 1 [0033.316] UpdateProcThreadAttribute (in: lpAttributeList=0x31f328, dwFlags=0x0, Attribute=0x60001, lpValue=0x31f2d8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31f328, lpPreviousValue=0x0) returned 1 [0033.316] GetStartupInfoW (in: lpStartupInfo=0x31f440 | out: lpStartupInfo=0x31f440*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xec, hStdOutput=0xf8, hStdError=0xf8)) [0033.316] GetProcessHeap () returned 0x4e0000 [0033.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4f4640 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.316] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.317] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.317] GetProcessHeap () returned 0x4e0000 [0033.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4640 | out: hHeap=0x4e0000) returned 1 [0033.317] GetProcessHeap () returned 0x4e0000 [0033.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f8900 [0033.317] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31f360*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f310 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x31f310*(hProcess=0x54, hThread=0x50, dwProcessId=0x9bc, dwThreadId=0x9c0)) returned 1 [0033.326] CloseHandle (hObject=0x50) returned 1 [0033.326] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0033.326] GetProcessHeap () returned 0x4e0000 [0033.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc230 | out: hHeap=0x4e0000) returned 1 [0033.326] GetEnvironmentStringsW () returned 0x4faa10* [0033.326] GetProcessHeap () returned 0x4e0000 [0033.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xae8) returned 0x4fb500 [0033.326] FreeEnvironmentStringsW (penv=0x4faa10) returned 1 [0033.326] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0033.326] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0033.326] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x31ec18, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31ec18, ReturnLength=0x0) returned 0x0 [0033.327] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x31ec50, nSize=0x380, lpNumberOfBytesRead=0x31ec10 | out: lpBuffer=0x31ec50*, lpNumberOfBytesRead=0x31ec10*=0x380) returned 1 [0033.327] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0033.879] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x31f258 | out: lpExitCode=0x31f258*=0x0) returned 1 [0033.879] CloseHandle (hObject=0x54) returned 1 [0033.879] _vsnwprintf (in: _Buffer=0x31f4c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x31f268 | out: _Buffer="00000000") returned 8 [0033.879] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0033.879] GetProcessHeap () returned 0x4e0000 [0033.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fb500 | out: hHeap=0x4e0000) returned 1 [0033.879] GetEnvironmentStringsW () returned 0x4faa10* [0033.879] GetProcessHeap () returned 0x4e0000 [0033.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0e) returned 0x4feb10 [0033.879] FreeEnvironmentStringsW (penv=0x4faa10) returned 1 [0033.879] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0033.879] GetProcessHeap () returned 0x4e0000 [0033.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4feb10 | out: hHeap=0x4e0000) returned 1 [0033.879] GetEnvironmentStringsW () returned 0x4faa10* [0033.879] GetProcessHeap () returned 0x4e0000 [0033.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0e) returned 0x4feb10 [0033.879] FreeEnvironmentStringsW (penv=0x4faa10) returned 1 [0033.879] GetProcessHeap () returned 0x4e0000 [0033.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8900 | out: hHeap=0x4e0000) returned 1 [0033.879] DeleteProcThreadAttributeList (in: lpAttributeList=0x31f328 | out: lpAttributeList=0x31f328) [0034.105] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0034.106] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.106] SetConsoleMode (hConsoleHandle=0xf8, dwMode=0x0) returned 0 [0034.106] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.106] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x4a5be194 | out: lpMode=0x4a5be194) returned 0 [0034.106] _get_osfhandle (_FileHandle=0) returned 0xec [0034.106] GetConsoleMode (in: hConsoleHandle=0xec, lpMode=0x4a5be198 | out: lpMode=0x4a5be198) returned 0 [0034.107] GetConsoleOutputCP () returned 0x4e3 [0034.107] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0034.108] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5b70 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9b00 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1cd0 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9a80 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f98a0 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1ab0 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6510 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4610 | out: hHeap=0x4e0000) returned 1 [0034.108] GetProcessHeap () returned 0x4e0000 [0034.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f97e0 | out: hHeap=0x4e0000) returned 1 [0034.108] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f788 | out: _Buffer="\r\n") returned 2 [0034.108] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.108] GetFileType (hFile=0xf8) returned 0x3 [0034.108] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.109] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0034.109] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f758, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f758*=0x2, lpOverlapped=0x0) returned 1 [0034.109] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0034.109] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.109] _vsnwprintf (in: _Buffer=0x4a5beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f798 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0034.109] _vsnwprintf (in: _Buffer=0x4a5bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f798 | out: _Buffer=">") returned 1 [0034.109] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.109] GetFileType (hFile=0xf8) returned 0x3 [0034.109] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.109] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0034.109] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x31f788, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f788*=0x26, lpOverlapped=0x0) returned 1 [0034.109] _get_osfhandle (_FileHandle=0) returned 0xec [0034.109] GetFileType (hFile=0xec) returned 0x3 [0034.109] _get_osfhandle (_FileHandle=0) returned 0xec [0034.109] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.109] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0034.109] _get_osfhandle (_FileHandle=0) returned 0xec [0034.109] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.109] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0034.109] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.110] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.110] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0034.110] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0034.111] _get_osfhandle (_FileHandle=0) returned 0xec [0034.111] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.111] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.112] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.112] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.112] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0034.112] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0034.113] _get_osfhandle (_FileHandle=0) returned 0xec [0034.113] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.113] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.113] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.114] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0034.114] _get_osfhandle (_FileHandle=0) returned 0xec [0034.114] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.114] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0034.115] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0034.115] _get_osfhandle (_FileHandle=0) returned 0xec [0034.115] GetFileType (hFile=0xec) returned 0x3 [0034.115] _get_osfhandle (_FileHandle=0) returned 0xec [0034.115] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.115] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.115] GetFileType (hFile=0xf8) returned 0x3 [0034.115] _get_osfhandle (_FileHandle=1) returned 0xf8 [0034.115] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0034.115] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31fa68, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fa68*=0x24, lpOverlapped=0x0) returned 1 [0034.115] GetProcessHeap () returned 0x4e0000 [0034.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4012) returned 0x4ff630 [0034.115] GetProcessHeap () returned 0x4e0000 [0034.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff630 | out: hHeap=0x4e0000) returned 1 [0034.115] GetProcessHeap () returned 0x4e0000 [0034.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0) returned 0x4f97e0 [0034.115] GetProcessHeap () returned 0x4e0000 [0034.115] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x22) returned 0x4f4610 [0034.116] GetProcessHeap () returned 0x4e0000 [0034.116] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4faa90 [0034.116] GetConsoleOutputCP () returned 0x4e3 [0034.116] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0034.116] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0034.116] GetConsoleTitleW (in: lpConsoleTitle=0x31fa20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x218) returned 0x4f9910 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x5a) returned 0x4f9b30 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x420) returned 0x4f9090 [0034.117] SetErrorMode (uMode=0x0) returned 0x0 [0034.117] SetErrorMode (uMode=0x1) returned 0x0 [0034.117] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f90a0, lpFilePart=0x31f2b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f2b0*="Desktop") returned 0x25 [0034.117] SetErrorMode (uMode=0x0) returned 0x1 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9090, Size=0x6e) returned 0x4f9090 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9090) returned 0x6e [0034.117] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.117] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x128) returned 0x4f5b70 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x240) returned 0x4e1ab0 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e1ab0, Size=0x12a) returned 0x4e1ab0 [0034.117] GetProcessHeap () returned 0x4e0000 [0034.117] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4e1ab0) returned 0x12a [0034.117] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.118] GetProcessHeap () returned 0x4e0000 [0034.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe8) returned 0x4f9db0 [0034.118] GetProcessHeap () returned 0x4e0000 [0034.118] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9db0, Size=0x7e) returned 0x4f9db0 [0034.118] GetProcessHeap () returned 0x4e0000 [0034.118] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9db0) returned 0x7e [0034.118] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.118] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0xffffffffffffffff [0034.118] GetLastError () returned 0x2 [0034.118] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0xffffffffffffffff [0034.118] GetLastError () returned 0x2 [0034.118] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.118] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0x4f9ba0 [0034.118] FindClose (in: hFindFile=0x4f9ba0 | out: hFindFile=0x4f9ba0) returned 1 [0034.118] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0xffffffffffffffff [0034.119] GetLastError () returned 0x2 [0034.119] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x31f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f020) returned 0x4f9ba0 [0034.119] FindClose (in: hFindFile=0x4f9ba0 | out: hFindFile=0x4f9ba0) returned 1 [0034.119] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0034.119] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0034.119] GetConsoleTitleW (in: lpConsoleTitle=0x31f570, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.119] GetProcessHeap () returned 0x4e0000 [0034.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x21c) returned 0x4f9110 [0034.119] GetConsoleTitleW (in: lpConsoleTitle=0x4f9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.119] GetProcessHeap () returned 0x4e0000 [0034.119] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9110, Size=0xc0) returned 0x4f9110 [0034.119] GetProcessHeap () returned 0x4e0000 [0034.119] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9110) returned 0xc0 [0034.119] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0034.120] GetProcessHeap () returned 0x4e0000 [0034.120] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9110 | out: hHeap=0x4e0000) returned 1 [0034.120] InitializeProcThreadAttributeList (in: lpAttributeList=0x31f328, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31f2e8 | out: lpAttributeList=0x31f328, lpSize=0x31f2e8) returned 1 [0034.120] UpdateProcThreadAttribute (in: lpAttributeList=0x31f328, dwFlags=0x0, Attribute=0x60001, lpValue=0x31f2d8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31f328, lpPreviousValue=0x0) returned 1 [0034.120] GetStartupInfoW (in: lpStartupInfo=0x31f440 | out: lpStartupInfo=0x31f440*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xec, hStdOutput=0xf8, hStdError=0xf8)) [0034.120] GetProcessHeap () returned 0x4e0000 [0034.120] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4f4640 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0034.120] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.121] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.121] GetProcessHeap () returned 0x4e0000 [0034.121] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4640 | out: hHeap=0x4e0000) returned 1 [0034.121] GetProcessHeap () returned 0x4e0000 [0034.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f8900 [0034.121] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31f360*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f310 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x31f310*(hProcess=0x50, hThread=0x54, dwProcessId=0x9ec, dwThreadId=0x9f0)) returned 1 [0034.146] CloseHandle (hObject=0x54) returned 1 [0034.146] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0034.146] GetProcessHeap () returned 0x4e0000 [0034.146] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4feb10 | out: hHeap=0x4e0000) returned 1 [0034.146] GetEnvironmentStringsW () returned 0x4feb10* [0034.146] GetProcessHeap () returned 0x4e0000 [0034.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0e) returned 0x4ff630 [0034.146] FreeEnvironmentStringsW (penv=0x4feb10) returned 1 [0034.146] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x31ec18, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31ec18, ReturnLength=0x0) returned 0x0 [0034.146] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x31ec50, nSize=0x380, lpNumberOfBytesRead=0x31ec10 | out: lpBuffer=0x31ec50*, lpNumberOfBytesRead=0x31ec10*=0x380) returned 1 [0034.146] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) [0090.245] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x31f258 | out: lpExitCode=0x31f258*=0x0) returned 1 [0090.246] CloseHandle (hObject=0x50) returned 1 [0090.246] _vsnwprintf (in: _Buffer=0x31f4c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x31f268 | out: _Buffer="00000000") returned 8 [0090.246] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0090.246] GetProcessHeap () returned 0x4e0000 [0090.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff630 | out: hHeap=0x4e0000) returned 1 [0090.246] GetEnvironmentStringsW () returned 0x4feb10* [0090.246] GetProcessHeap () returned 0x4e0000 [0090.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0e) returned 0x4ff630 [0090.246] FreeEnvironmentStringsW (penv=0x4feb10) returned 1 [0090.246] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0090.246] GetProcessHeap () returned 0x4e0000 [0090.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff630 | out: hHeap=0x4e0000) returned 1 [0090.246] GetEnvironmentStringsW () returned 0x4feb10* [0090.246] GetProcessHeap () returned 0x4e0000 [0090.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0e) returned 0x4ff630 [0090.246] FreeEnvironmentStringsW (penv=0x4feb10) returned 1 [0090.246] GetProcessHeap () returned 0x4e0000 [0090.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8900 | out: hHeap=0x4e0000) returned 1 [0090.247] DeleteProcThreadAttributeList (in: lpAttributeList=0x31f328 | out: lpAttributeList=0x31f328) [0090.247] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0090.247] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.247] SetConsoleMode (hConsoleHandle=0xf8, dwMode=0x0) returned 0 [0090.248] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.248] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x4a5be194 | out: lpMode=0x4a5be194) returned 0 [0090.248] _get_osfhandle (_FileHandle=0) returned 0xec [0090.248] GetConsoleMode (in: hConsoleHandle=0xec, lpMode=0x4a5be198 | out: lpMode=0x4a5be198) returned 0 [0090.248] GetConsoleOutputCP () returned 0x4e3 [0090.248] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0090.248] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0090.248] GetProcessHeap () returned 0x4e0000 [0090.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9db0 | out: hHeap=0x4e0000) returned 1 [0090.248] GetProcessHeap () returned 0x4e0000 [0090.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1ab0 | out: hHeap=0x4e0000) returned 1 [0090.248] GetProcessHeap () returned 0x4e0000 [0090.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5b70 | out: hHeap=0x4e0000) returned 1 [0090.248] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9090 | out: hHeap=0x4e0000) returned 1 [0090.249] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9b30 | out: hHeap=0x4e0000) returned 1 [0090.249] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9910 | out: hHeap=0x4e0000) returned 1 [0090.249] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4faa90 | out: hHeap=0x4e0000) returned 1 [0090.249] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4610 | out: hHeap=0x4e0000) returned 1 [0090.249] GetProcessHeap () returned 0x4e0000 [0090.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f97e0 | out: hHeap=0x4e0000) returned 1 [0090.249] _vsnwprintf (in: _Buffer=0x4a5d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f788 | out: _Buffer="\r\n") returned 2 [0090.249] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.249] GetFileType (hFile=0xf8) returned 0x3 [0090.249] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.249] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0090.249] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f758, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f758*=0x2, lpOverlapped=0x0) returned 1 [0090.249] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0090.249] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0090.250] _vsnwprintf (in: _Buffer=0x4a5beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f798 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0090.250] _vsnwprintf (in: _Buffer=0x4a5bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f798 | out: _Buffer=">") returned 1 [0090.250] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.250] GetFileType (hFile=0xf8) returned 0x3 [0090.250] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.250] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0090.250] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x31f788, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31f788*=0x26, lpOverlapped=0x0) returned 1 [0090.250] _get_osfhandle (_FileHandle=0) returned 0xec [0090.250] GetFileType (hFile=0xec) returned 0x3 [0090.250] _get_osfhandle (_FileHandle=0) returned 0xec [0090.250] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.250] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0090.250] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0090.250] _get_osfhandle (_FileHandle=0) returned 0xec [0090.250] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.250] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0090.250] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0090.250] _get_osfhandle (_FileHandle=0) returned 0xec [0090.250] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.250] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0090.250] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0090.250] _get_osfhandle (_FileHandle=0) returned 0xec [0090.250] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.251] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0090.251] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0090.251] _get_osfhandle (_FileHandle=0) returned 0xec [0090.251] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.251] ReadFile (in: hFile=0xec, lpBuffer=0x4a5cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31fa88, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesRead=0x31fa88*=0x1, lpOverlapped=0x0) returned 1 [0090.251] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a5cc320, cbMultiByte=1, lpWideCharStr=0x4a5ce328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0090.251] _get_osfhandle (_FileHandle=0) returned 0xec [0090.251] GetFileType (hFile=0xec) returned 0x3 [0090.251] _get_osfhandle (_FileHandle=0) returned 0xec [0090.251] SetFilePointer (in: hFile=0xec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0090.251] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.251] GetFileType (hFile=0xf8) returned 0x3 [0090.251] _get_osfhandle (_FileHandle=1) returned 0xf8 [0090.251] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a5cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0090.251] WriteFile (in: hFile=0xf8, lpBuffer=0x4a5cc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x31fa68, lpOverlapped=0x0 | out: lpBuffer=0x4a5cc320*, lpNumberOfBytesWritten=0x31fa68*=0x5, lpOverlapped=0x0) returned 1 [0090.251] GetProcessHeap () returned 0x4e0000 [0090.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4012) returned 0x500150 [0090.251] GetProcessHeap () returned 0x4e0000 [0090.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x500150 | out: hHeap=0x4e0000) returned 1 [0090.251] GetProcessHeap () returned 0x4e0000 [0090.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb0) returned 0x4f97e0 [0090.251] GetProcessHeap () returned 0x4e0000 [0090.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1a) returned 0x4f4610 [0090.252] GetConsoleOutputCP () returned 0x4e3 [0090.252] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a5cbfe0 | out: lpCPInfo=0x4a5cbfe0) returned 1 [0090.252] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0090.252] GetConsoleTitleW (in: lpConsoleTitle=0x31fa20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0090.252] GetProcessHeap () returned 0x4e0000 [0090.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f8900 [0090.252] GetProcessHeap () returned 0x4e0000 [0090.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1a) returned 0x4f4640 [0090.252] GetProcessHeap () returned 0x4e0000 [0090.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x21c) returned 0x4f9910 [0090.252] GetConsoleTitleW (in: lpConsoleTitle=0x4f9920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0090.252] GetProcessHeap () returned 0x4e0000 [0090.252] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f9910, Size=0x80) returned 0x4f9910 [0090.252] GetProcessHeap () returned 0x4e0000 [0090.252] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f9910) returned 0x80 [0090.252] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0090.253] GetProcessHeap () returned 0x4e0000 [0090.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9910 | out: hHeap=0x4e0000) returned 1 [0090.253] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0090.253] exit (_Code=0) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4e7ec000" os_pid = "0x9bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x990" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x9c0 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4dc15000" os_pid = "0x9ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x990" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x9f0 Thread: id = 22 os_tid = 0xa78 Thread: id = 23 os_tid = 0xa7c Thread: id = 24 os_tid = 0xa88 Thread: id = 25 os_tid = 0xa8c Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x48a74000" os_pid = "0xa90" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x9ec" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007801e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xab0 Thread: id = 28 os_tid = 0xaac Thread: id = 29 os_tid = 0xaa8 Thread: id = 30 os_tid = 0xaa4 [0042.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc0d8f0 | out: lpSystemTimeAsFileTime=0xc0d8f0*(dwLowDateTime=0x9157fca0, dwHighDateTime=0x1d51ea7)) [0042.891] GetCurrentProcessId () returned 0xa90 [0042.891] GetCurrentThreadId () returned 0xaa4 [0042.891] GetTickCount () returned 0x1af61 [0042.891] QueryPerformanceCounter (in: lpPerformanceCount=0xc0d8f8 | out: lpPerformanceCount=0xc0d8f8*=16310629800) returned 1 [0042.891] malloc (_Size=0x100) returned 0xf8e80 Thread: id = 31 os_tid = 0xaa0 Thread: id = 32 os_tid = 0xa9c Thread: id = 33 os_tid = 0xa94 Thread: id = 34 os_tid = 0xac8 Thread: id = 42 os_tid = 0xb68 Thread: id = 44 os_tid = 0x8e0 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x45b79000" os_pid = "0xab4" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xa90" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00078af2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 35 os_tid = 0xad0 Thread: id = 36 os_tid = 0xacc Thread: id = 37 os_tid = 0xac4 Thread: id = 38 os_tid = 0xac0 Thread: id = 39 os_tid = 0xabc Thread: id = 40 os_tid = 0xab8 Thread: id = 45 os_tid = 0x8f0 Process: id = "7" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0x0" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 46 os_tid = 0x8 Thread: id = 47 os_tid = 0x24 Thread: id = 48 os_tid = 0x38 Thread: id = 49 os_tid = 0x3c Thread: id = 50 os_tid = 0xc4 Thread: id = 51 os_tid = 0x80 Thread: id = 52 os_tid = 0x78 Thread: id = 53 os_tid = 0xc0 Thread: id = 54 os_tid = 0x28 Thread: id = 55 os_tid = 0x20 Thread: id = 56 os_tid = 0x4c Thread: id = 57 os_tid = 0x44 Thread: id = 58 os_tid = 0x9c Thread: id = 59 os_tid = 0x40 Thread: id = 60 os_tid = 0x34 Thread: id = 61 os_tid = 0xcc Thread: id = 62 os_tid = 0xd0 Thread: id = 63 os_tid = 0xb8 Thread: id = 64 os_tid = 0xd4 Thread: id = 65 os_tid = 0xd8 Thread: id = 66 os_tid = 0xdc Thread: id = 67 os_tid = 0xe8 Thread: id = 68 os_tid = 0xec Thread: id = 69 os_tid = 0x48 Thread: id = 70 os_tid = 0x64 Thread: id = 71 os_tid = 0x2c Thread: id = 72 os_tid = 0x90 Thread: id = 73 os_tid = 0xfc Thread: id = 74 os_tid = 0x100 Thread: id = 75 os_tid = 0x10c Thread: id = 76 os_tid = 0x104 Thread: id = 77 os_tid = 0x108 Thread: id = 78 os_tid = 0xb0 Thread: id = 79 os_tid = 0x110 Thread: id = 80 os_tid = 0x5c Thread: id = 81 os_tid = 0x60 Thread: id = 82 os_tid = 0x128 Thread: id = 83 os_tid = 0x12c Thread: id = 84 os_tid = 0x130 Thread: id = 85 os_tid = 0x134 Thread: id = 86 os_tid = 0x170 Thread: id = 87 os_tid = 0x88 Thread: id = 88 os_tid = 0x98 Thread: id = 89 os_tid = 0x8c Thread: id = 90 os_tid = 0x68 Thread: id = 91 os_tid = 0x74 Thread: id = 92 os_tid = 0x268 Thread: id = 93 os_tid = 0x2e0 Thread: id = 94 os_tid = 0x84 Thread: id = 95 os_tid = 0x3b0 Thread: id = 96 os_tid = 0x1c Thread: id = 97 os_tid = 0x440 Thread: id = 98 os_tid = 0x46c Thread: id = 99 os_tid = 0x94 Thread: id = 100 os_tid = 0x50 Thread: id = 101 os_tid = 0x474 Thread: id = 102 os_tid = 0x5c0 Thread: id = 103 os_tid = 0x5d0 Thread: id = 104 os_tid = 0x614 Thread: id = 105 os_tid = 0x470 Thread: id = 106 os_tid = 0x62c Thread: id = 107 os_tid = 0x698 Thread: id = 108 os_tid = 0x69c Thread: id = 109 os_tid = 0x7c Thread: id = 110 os_tid = 0x18 Thread: id = 111 os_tid = 0x748 Thread: id = 112 os_tid = 0x750 Thread: id = 113 os_tid = 0x798 Thread: id = 114 os_tid = 0x7a0 Thread: id = 115 os_tid = 0x7b4 Thread: id = 116 os_tid = 0x7bc Thread: id = 117 os_tid = 0x7c4 Thread: id = 118 os_tid = 0x58c Thread: id = 119 os_tid = 0x2f8 Thread: id = 120 os_tid = 0x708 Thread: id = 121 os_tid = 0x0 Thread: id = 122 os_tid = 0xa0 Thread: id = 123 os_tid = 0xbc Thread: id = 124 os_tid = 0x54 Thread: id = 125 os_tid = 0x648 Thread: id = 126 os_tid = 0x600